@bongos/core 1.21.56 → 1.21.58

package/tests/hub_guild_page.mjs

@@ -0,0 +1,624 @@
+// tests/hub_guild_page.mjs — the hub's guild page at /g/<slug> (task 1002301, R25;
+// ADR 0336 D4/D6, ADR 0337 D4.4).
+//
+// A guild spans projects, so its page is the hub's. One shell serves every slug;
+// the page asks the public read (GET /guilds/:slug) and, for someone signed in,
+// the members' own-scope read (GET /guilds/:slug/members), and writes two things:
+// the member's own two switches (PATCH /guilds/:slug/membership) and, for the
+// owner only, the guild applying to a project (POST /guilds/:slug/engagements,
+// task 1002303, R27). These pin:
+//   1. the page as a file: portable, dark only, noindex, no page :root, no
+//      innerHTML, no GitHub id or login read, and only the four guild routes;
+//   2. its slug rule is the module's (a boundary-forced copy);
+//   3. the bar is the hub's — the account page's chrome, with no current place
+//      and the sign-in doors pointed back at the guild by the script;
+//   4. its script, EXECUTED in a node:vm under a DOM stub together with
+//      assets/hub-bar.js: the public view (the roster, the band floors, "under
+//      10"), "no guild here" as ONE answer for an unknown slug, an unlisted guild
+//      and a malformed path, the members' view, the prompt after a guild goes
+//      public (asked, never assumed; "not now" remembered per guild), the
+//      counted switch and its notice, each save sending only what moved, and
+//      the owner's "apply to a project" (shown to the owner alone, one honest
+//      line for a project that is not public on the map);
+//   5. the route: /g/<slug> on the hub's apex only, never on a child or the
+//      builders/status hosts, and a segment that cannot be a slug falls through.
+// What the public roster may hold is the server's, and tests/privacy_matrix.mjs
+// carries its cells; this file proves the page shows what it is given and asks
+// for nothing more.
+//
+// DB-free. Run:  node --test tests/hub_guild_page.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const read = (f) => fs.readFileSync(path.join(LANDING, f), 'utf8').replace(/\r\n/g, '\n');
+const PAGE = read('guild.html');
+const SCRIPT = PAGE.split('<script>').pop().split('</script>')[0];
+const BAR = read('assets/hub-bar.js');
+const HUB = read('projects.html');
+const ACCOUNT = read('account.html');
+
+const guilds = require('../modules/platform-identity/guilds.js');
+const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
+
+// ── 1. the page as a file ────────────────────────────────────────────────────
+
+test('portable and dark only: stamped title, noindex, balanced sentinels, no :root, no literal colour, no baked apex', () => {
+  assert.match(PAGE, /^<html lang="en" data-mode="dark">/m, 'dark is fixed on <html> (ADR 0204)');
+  assert.match(PAGE, /<title>\{\{productName\}\} — Guild<\/title>/);
+  assert.match(PAGE, /<meta name="robots" content="noindex">/, 'one shell answers every slug, so a guild that does not exist must not index as a page');
+  const styles = [...PAGE.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
+  assert.doesNotMatch(styles, /:root\s*\{/, 'a page-local :root outranks the injected pack');
+  assert.doesNotMatch(styles, /#[0-9a-f]{3,8}\b/i, 'every colour is a token, never a literal');
+  assert.doesNotMatch(PAGE, /cloudbongos\.com/, 'no hardcoded apex — the file ships to every instance');
+  assert.doesNotMatch(PAGE, /gtag|plausible|googletagmanager/);
+  assert.equal((PAGE.match(/<!--apex-only:start-->/g) || []).length, (PAGE.match(/<!--apex-only:end-->/g) || []).length, 'balanced sentinels');
+  const stamped = applyBrandTokens(PAGE, { identity: { productName: 'Spike Harbor' } }, 'https://spike.example', 'https://builders.spike.example', '');
+  assert.doesNotMatch(stamped, /\{\{[a-zA-Z]+\}\}/, 'every token stamps');
+  assert.match(stamped, /<title>Spike Harbor — Guild<\/title>/);
+  assert.match(PAGE, /<link rel="stylesheet" href="\/assets\/cosmos\.css">/, 'the hub’s sheet, which carries [hidden]{display:none !important} over the page’s grid rules');
+});
+
+test('the script builds no markup from strings, never reads a GitHub id or login, and the regions ship hidden', () => {
+  assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML/, 'live DOM is textContent / createElement only');
+  assert.doesNotMatch(SCRIPT, /github_(id|login)/, 'a roster shows handle, display name, avatar and kind — never a GitHub id or login (ADR 0336 D4)');
+  for (const id of ['guildBody', 'missing', 'missingSignin', 'gYou', 'showAsk', 'shownUnlisted', 'gRosterEmpty', 'gApply']) {
+    assert.match(PAGE, new RegExp(`id="${id}"[^>]*\\bhidden\\b`), `#${id} ships hidden`);
+  }
+  for (const [name, values] of [['shown', ['on', 'off']], ['counted', ['on', 'off']]]) {
+    for (const v of values) assert.match(PAGE, new RegExp(`<input type="radio" name="${name}" value="${v}">`));
+  }
+  for (const id of ['askYes', 'askNo', 'youSave', 'gRoster', 'tShipped', 'tCredits', 'tKarma', 'tProjects']) assert.match(PAGE, new RegExp(`id="${id}"`));
+});
+
+test('the page calls only the four guild routes; the bar’s two calls stay in the shared asset', () => {
+  const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST|DELETE)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
+  assert.deepEqual([...new Set(calls)].sort(), ['GET /guilds/', 'PATCH /guilds/', 'POST /guilds/'].sort(), 'every call is built on /guilds/<slug>');
+  assert.deepEqual([...SCRIPT.matchAll(/request\('[A-Z]+', '\/guilds\/' \+ slug( \+ '[^']*')?/g)].map((m) => m[0]).sort(), [
+    "request('GET', '/guilds/' + slug",
+    "request('GET', '/guilds/' + slug",
+    "request('GET', '/guilds/' + slug + '/members'",
+    "request('GET', '/guilds/' + slug + '/members'",
+    "request('PATCH', '/guilds/' + slug + '/membership'",
+    "request('POST', '/guilds/' + slug + '/engagements'",
+  ].sort());
+  assert.match(PAGE, /<script src="\/assets\/hub-bar\.js"><\/script>\n<script>\n\(function \(\) \{/, 'hub-bar.js runs first, so window.HubBar exists when the page script asks for it');
+  assert.doesNotMatch(SCRIPT, /function (openBand|closeMenus|openMenu)\b|\/auth\/logout/, 'no second copy of the bands or sign out in the page');
+  assert.match(SCRIPT, /var bar = window\.HubBar \|\| \{ paint: function \(\) \{\}, ready: Promise\.resolve\(null\) \};/);
+});
+
+// ── 2. the slug rule is the module's ─────────────────────────────────────────
+
+test('the page’s slug rule is guilds.js’s own (normalizeHandle’s charset, a two-character floor)', () => {
+  const fn = SCRIPT.match(/  function slugFromPath\(pathname\) \{[\s\S]*?\n  \}\n/);
+  const re = SCRIPT.match(/  var SLUG_RE = (\/[^\n]+\/);\n/);
+  assert.ok(fn && re, 'slugFromPath and SLUG_RE are still whole declarations');
+  const slugFromPath = vm.runInNewContext(`var SLUG_RE = ${re[1]};\n${fn[0]}; slugFromPath`);
+  for (const s of ['forge-crew', 'ab', 'a--b', 'x1', '9lives', 'a'.repeat(39), 'a', 'a'.repeat(40), '-ab', 'ab-', 'a_b', 'a.b', 'café', 'me', 'api', 'Forge-Crew']) {
+    const lower = s.toLowerCase();
+    const moduleSays = guilds.lookupSlug(s) === lower && guilds.normalizeGuildSlug(s).error !== 'slug_invalid';
+    assert.equal(slugFromPath(`/g/${encodeURIComponent(s)}`) === lower, moduleSays, `"${s}": the page and the module disagree`);
+  }
+  assert.equal(slugFromPath('/g/forge-crew/'), 'forge-crew', 'a trailing slash is the same guild');
+  assert.equal(slugFromPath('/g/forge-crew/members'), null, 'one segment only');
+  assert.equal(slugFromPath('/g/%E0%A4%A'), null, 'a malformed escape is no guild, not a thrown page');
+});
+
+// ── 3. the bar is the hub's ──────────────────────────────────────────────────
+
+const chrome = (html) => {
+  const m = html.match(/<a class="skip vh"[\s\S]*?<div class="menuBand" id="menuProfile"[\s\S]*?\n<\/div>\n/);
+  assert.ok(m, 'the skip link, the bar and both bands are one block');
+  return m[0];
+};
+
+test('the bar is the account page’s: the same chrome, minus the current place, with the sign-in doors left for the script to point', () => {
+  for (const piece of [
+    '<header class="shell bar">',
+    '<a class="barMark" id="barMark" href="/">',
+    '<button class="trig" type="button" id="projTrig" data-menu="projects" aria-expanded="false" aria-controls="menuProjects">Projects<svg class="cv" viewBox="0 0 20 20" aria-hidden="true"><path d="m5.6 8 4.4 4.4L14.4 8"/></svg></button>',
+    '<button class="trig who" type="button" id="who" data-menu="profile" aria-expanded="false" aria-controls="menuProfile" hidden>',
+    '<div class="menuBand" id="menuProjects" data-menu="projects" hidden>',
+    '<div class="menuBand" id="menuProfile" data-menu="profile" hidden>',
+    '<li class="bandCell"><a class="bandT signout" href="/api/bongos/auth/logout">Sign out</a></li>',
+  ]) {
+    assert.ok(HUB.includes(piece), `projects.html no longer carries: ${piece}`);
+    assert.ok(PAGE.includes(piece), `guild.html does not carry the hub's: ${piece}`);
+  }
+  const norm = (html) => chrome(html)
+    .replace(/start\?return=\/account&amp;repos=1/, 'start?repos=1')
+    .replace(/href="#\w+">Skip to content/, 'href="#MAIN">Skip to content')
+    .replace(/<!--[\s\S]*?-->/g, '')
+    .replace(/^[ \t]*\n/gm, '')
+    .replace(' aria-current="page"', '');
+  assert.equal(norm(PAGE), norm(ACCOUNT), 'one bar with /account, so a change to it is a change to both');
+  assert.doesNotMatch(chrome(PAGE), /aria-current/, 'no band item is this page');
+  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?repos=1">Sign in<\/a>/,
+    'no return in the markup — one shell serves every slug; without script the route falls back to the Referer, which is this page');
+  assert.match(PAGE, /<a class="skip vh" href="#guild">/);
+  assert.match(PAGE, /<main class="gld" id="guild">/, 'the skip link has its landmark');
+  const styles = [...PAGE.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
+  assert.doesNotMatch(styles, /\.(shell|bar|barMark|barLeft|barRight|trig|who|signinDoor|menuBand|band[A-Z]\w*)\b[^{}]*\{/, 'no bar or band rule in the page');
+});
+
+// ── 4. the script, executed ──────────────────────────────────────────────────
+
+const PUBLIC = () => ({
+  guild: { slug: 'forge-crew', name: 'Forge Crew', description: 'We ship the boring parts.', created_at: '2026-09-12T10:20:00.000Z' },
+  members: [
+    { handle: 'mara', display_name: 'Mara Quinn', avatar_url: 'https://avatars.example/u/1', membership_kind: 'owner' },
+    { handle: 'ines', display_name: 'Ines Duarte', avatar_url: null, membership_kind: 'member' },
+    { handle: 'kip', display_name: null, avatar_url: 'javascript:alert(1)', membership_kind: 'member' },
+  ],
+  size: 3,
+  totals: { credits: 2000, works_shipped: 100, karma: 0, projects: 10, as_of: '2026-10-01T03:00:00.000Z' },
+});
+const MEMBERS = (you = {}, visibility = 'public') => ({
+  guild: { slug: 'forge-crew', name: 'Forge Crew', description: 'We ship the boring parts.', visibility },
+  you: { membership_kind: 'member', shown_publicly: false, counted_in_totals: true, ...you },
+  members: [...PUBLIC().members, { handle: 'octo', display_name: 'Octo', avatar_url: null, membership_kind: 'member' }, { handle: 'sol', display_name: 'Sol', avatar_url: null, membership_kind: 'member' }],
+  count: 5,
+});
+const NOT_FOUND = { status: 404, data: { error: { code: 'guild_not_found' } } };
+
+// A DOM stub just wide enough for this page and hub-bar.js: every id in the
+// markup is an element (hidden where the markup says so); created elements keep
+// their children, and setting textContent clears them, as in a browser.
+function node(tag, attrs = {}) {
+  const n = { tag, attrs, children: [], _text: '', className: '', disabled: false, hidden: false, style: {}, _on: {} };
+  Object.defineProperty(n, 'textContent', {
+    get() { return n._text + n.children.map((c) => c.textContent).join(''); },
+    set(v) { n._text = String(v); n.children = []; },
+  });
+  n.appendChild = (c) => { n.children.push(c); return c; };
+  n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.getAttribute = (k) => (k in n.attrs ? n.attrs[k] : null);
+  n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
+  n.closest = () => null;
+  n.contains = () => false;
+  n.focus = () => {};
+  return n;
+}
+function boot({ pathname = '/g/forge-crew', me = null, answer = () => NOT_FOUND, storage = {}, storageThrows = false } = {}) {
+  const els = new Map();
+  for (const m of PAGE.matchAll(/<(\w+)([^>]*?)\sid="([\w-]+)"([^>]*)>/g)) {
+    const attrs = Object.fromEntries([...(m[2] + m[4]).matchAll(/\s([\w-]+)="([^"]*)"/g)].map((a) => [a[1], a[2]]));
+    const e = node(m[1], attrs);
+    e.id = m[3];
+    e.hidden = /\shidden\b/.test(m[2] + m[4]);
+    els.set(m[3], e);
+  }
+  const radios = [...PAGE.matchAll(/<input type="radio" name="(\w+)" value="(\w+)">/g)].map((m) => Object.assign(node('input'), { name: m[1], value: m[2], checked: false }));
+  const trigs = [...els.values()].filter((e) => /\btrig\b/.test(e.attrs.class || ''));
+  const bands = ['menuProjects', 'menuProfile'].map((id) => els.get(id));
+  const calls = [];
+  const document = {
+    title: 'Spike Harbor — Guild', cookie: '', activeElement: null,
+    addEventListener() {},
+    getElementById: (id) => els.get(id) || null,
+    createElement: (tag) => node(tag),
+    querySelector(sel) {
+      if (sel === '.menuBand:not([hidden])') return bands.find((b) => !b.hidden) || null;
+      if (sel === '.trig[aria-expanded="true"]') return null;
+      const m = sel.match(/^input\[name="(\w+)"\]:checked$/);
+      if (!m) throw new Error(`unstubbed selector: ${sel}`);
+      return radios.find((r) => r.name === m[1] && r.checked) || null;
+    },
+    querySelectorAll(sel) {
+      if (sel === '.trig') return trigs;
+      if (sel === '.menuBand') return bands;
+      const m = sel.match(/^input\[name="(\w+)"\]$/);
+      if (!m) throw new Error(`unstubbed selector: ${sel}`);
+      return radios.filter((r) => r.name === m[1]);
+    },
+  };
+  const fetch = (url, init = {}) => {
+    const method = init.method || 'GET';
+    const body = init.body ? JSON.parse(init.body) : undefined;
+    const p = url.replace(/^\/api\/bongos/, '');
+    calls.push({ method, path: p, body });
+    const out = p === '/me' ? (me ? { status: 200, data: { builder: me } } : { status: 401, data: null }) : answer(method, p, body);
+    return Promise.resolve({ status: out.status, ok: out.status >= 200 && out.status < 300, json: () => Promise.resolve(out.data) });
+  };
+  const localStorage = {
+    getItem(k) { if (storageThrows) throw new Error('denied'); return k in storage ? storage[k] : null; },
+    setItem(k, v) { if (storageThrows) throw new Error('denied'); storage[k] = String(v); },
+  };
+  const window = { localStorage, location: { assign() {} } };
+  const ctx = vm.createContext({ document, fetch, location: { hostname: 'cloudbongos.com', pathname }, window });
+  vm.runInContext(BAR, ctx);
+  vm.runInContext(SCRIPT, ctx);
+  const dom = {
+    els, radios, calls, storage, document,
+    el: (id) => els.get(id),
+    text: (id) => els.get(id).textContent,
+    checked: (name) => (radios.find((r) => r.name === name && r.checked) || {}).value,
+    pick(name, value) {
+      for (const r of radios.filter((x) => x.name === name)) r.checked = r.value === value;
+      for (const f of radios.find((x) => x.name === name && x.value === value)._on.change || []) f({});
+    },
+    click(id) { for (const f of els.get(id)._on.click || []) f({ preventDefault() {} }); },
+    submit() { for (const f of els.get('youForm')._on.submit || []) f({ preventDefault() {} }); },
+    rows: () => els.get('gRoster').children,
+    guildCalls: () => calls.filter((c) => c.path.startsWith('/guilds/')),
+  };
+  return dom;
+}
+const settle = async () => { for (let i = 0; i < 24; i++) await new Promise((r) => setImmediate(r)); };
+const ME = { github_login: 'octo', avatar_url: null };
+
+test('signed out, a public guild: the identity, the band floors, the public roster — and one call, never the members’ read', async () => {
+  const dom = boot({ answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  assert.equal(dom.el('guildBody').hidden, false);
+  assert.equal(dom.el('loading').hidden, true);
+  assert.equal(dom.el('missing').hidden, true);
+  assert.equal(dom.el('gYou').hidden, true, 'nothing of yours on a page you are not signed in to');
+  assert.equal(dom.text('gName'), 'Forge Crew');
+  assert.equal(dom.document.title, 'Forge Crew — Spike Harbor');
+  assert.equal(dom.text('gKicker'), 'Guild', 'the public sees only public guilds, so it is not told which kind');
+  assert.equal(dom.text('gMeta'), '3 members · since Sep 2026', 'size is the public roster’s length (ADR 0336 D4)');
+  assert.equal(dom.text('gDesc'), 'We ship the boring parts.');
+  assert.deepEqual(['tShipped', 'tCredits', 'tKarma', 'tProjects'].map((id) => dom.text(id)), ['100+', '2,000+', 'under 10', '10+'],
+    'band floors as published, never re-derived; 0 is below the first band');
+  assert.equal(dom.el('tKarma').className, 'under');
+  assert.equal(dom.text('gRecordNote'), 'Counted on 1 Oct 2026. Projects are the public projects its listed members build on.');
+  assert.deepEqual(dom.guildCalls().map((c) => `${c.method} ${c.path}`), ['GET /guilds/forge-crew'], 'a stranger’s page makes one guild call');
+  assert.equal(dom.el('signinTop').getAttribute('href'), '/api/bongos/auth/web/start?return=/g/forge-crew&repos=1', 'sign-in returns to this guild');
+});
+
+test('the roster: name, handle, the owner marked; a missing name falls back to the handle; only an http(s) avatar is drawn', async () => {
+  const dom = boot({ answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  const rows = dom.rows();
+  assert.equal(rows.length, 3);
+  const [mara, ines, kip] = rows.map((li) => li.children);
+  assert.equal(mara[0].tag, 'img');
+  assert.equal(mara[0].src, 'https://avatars.example/u/1');
+  assert.equal(mara[0].alt, '', 'decorative: the name is beside it');
+  assert.equal(mara[1].textContent, 'Mara Quinnmara');
+  assert.equal(mara[2].textContent, 'Owner');
+  assert.equal(ines[0].tag, 'span', 'no avatar → the initial, not a broken image');
+  assert.equal(ines[0].textContent, 'I');
+  assert.equal(ines[2].textContent, '', 'a member carries no tag');
+  assert.equal(kip[0].tag, 'span', 'a javascript: avatar is never an img src');
+  assert.equal(kip[1].children[0].textContent, 'kip', 'no display name → the handle');
+  assert.equal(dom.el('gRosterEmpty').hidden, true);
+});
+
+test('not counted yet, and an empty roster, say so', async () => {
+  const data = { ...PUBLIC(), members: [], size: 0, totals: null };
+  const dom = boot({ answer: () => ({ status: 200, data }) });
+  await settle();
+  assert.deepEqual(['tShipped', 'tCredits', 'tKarma', 'tProjects'].map((id) => dom.text(id)), ['—', '—', '—', '—']);
+  assert.equal(dom.text('gRecordNote'), 'Not counted yet. A guild’s record is counted once a week.');
+  assert.equal(dom.el('gRosterEmpty').hidden, false);
+  assert.equal(dom.text('gMeta'), '0 members · since Sep 2026');
+});
+
+test('"no guild here" is ONE answer: an unknown slug, an unlisted guild from outside, a malformed path — signed out it offers sign-in', async () => {
+  const out = boot({ pathname: '/g/night-shift' });
+  await settle();
+  assert.equal(out.el('missing').hidden, false);
+  assert.equal(out.el('guildBody').hidden, true);
+  assert.equal(out.el('missingSignin').hidden, false);
+  assert.equal(out.el('missingSignin').getAttribute('href'), '/api/bongos/auth/web/start?return=/g/night-shift&repos=1');
+  assert.equal(out.text('missingWhy'), 'There is no public guild at this address. If it is an unlisted guild you belong to, sign in to see it.');
+
+  const stranger = boot({ pathname: '/g/night-shift', me: ME });
+  await settle();
+  assert.deepEqual(stranger.guildCalls().map((c) => `${c.method} ${c.path}`), ['GET /guilds/night-shift', 'GET /guilds/night-shift/members']);
+  assert.equal(stranger.el('missing').hidden, false);
+  assert.equal(stranger.el('missingSignin').hidden, true, 'signed in already');
+  assert.equal(stranger.text('missingWhy'), 'There is no guild at this address that you can see. A guild that is unlisted is shown only to its members.');
+
+  const unknown = boot({ pathname: '/g/no-such-guild', me: ME });
+  await settle();
+  assert.equal(unknown.text('missingWhy'), stranger.text('missingWhy'), 'an unknown slug and someone else’s unlisted guild read the same');
+
+  for (const bad of ['/g/-x-', '/g/a', '/g/a_b', '/g/forge-crew/members']) {
+    const dom = boot({ pathname: bad, me: ME });
+    await settle();
+    assert.equal(dom.el('missing').hidden, false, `${bad} is no guild`);
+    assert.deepEqual(dom.guildCalls(), [], `${bad}: no guild read for a path that cannot be a slug`);
+  }
+});
+
+test('a read that fails is not "no guild here": the alert says to try again', async () => {
+  const dom = boot({ answer: () => ({ status: 500, data: null }) });
+  await settle();
+  assert.equal(dom.el('missing').hidden, true);
+  assert.equal(dom.el('pageAlert').className, 'alert on');
+  assert.equal(dom.text('pageAlert'), 'Couldn’t read this guild right now — refresh in a moment.');
+});
+
+test('signed in, not a member: the public page and nothing of yours', async () => {
+  const dom = boot({ me: ME, answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  assert.equal(dom.el('guildBody').hidden, false);
+  assert.equal(dom.el('gYou').hidden, true);
+  assert.equal(dom.rows().length, 3);
+  assert.equal(dom.text('gMembersSide'), 'The members who chose to be listed on this page.');
+});
+
+function memberAnswer(state) {
+  return (m, p, body) => {
+    if (p === '/guilds/forge-crew' && m === 'GET') return { status: 200, data: PUBLIC() };
+    if (p === '/guilds/forge-crew/members' && m === 'GET') return { status: 200, data: MEMBERS(state.you, state.visibility) };
+    if (p === '/guilds/forge-crew/membership' && m === 'PATCH') {
+      if (state.patch) return state.patch(body);
+      state.you = { ...state.you, ...body };
+      const you = MEMBERS(state.you).you;
+      return { status: 200, data: { shown_publicly: you.shown_publicly, counted_in_totals: you.counted_in_totals } };
+    }
+    return NOT_FOUND;
+  };
+}
+
+test('a member of a public guild who is not on its page: the members’ roster, and the prompt stands in for the pair', async () => {
+  const dom = boot({ me: ME, answer: memberAnswer({}) });
+  await settle();
+  assert.equal(dom.el('gYou').hidden, false);
+  assert.equal(dom.text('gKicker'), 'Guild · public');
+  assert.equal(dom.text('gMeta'), '5 members · 3 on the public page · since Sep 2026', 'both lists the member can see, each its own length');
+  assert.equal(dom.rows().length, 5, 'the members’ roster: everyone, private members included (joining is consent to be seen by the guild)');
+  assert.equal(dom.text('gYouSide'), 'You’re a member of this guild. Only you see this, and only you can change it.');
+  assert.equal(dom.el('showAsk').hidden, false, 'asked, never assumed (ADR 0336 D4 §3)');
+  assert.equal(dom.el('shownBand').hidden, true, 'while the prompt stands it is the control');
+  assert.equal(dom.checked('shown'), 'off');
+  assert.equal(dom.checked('counted'), 'on');
+  assert.equal(dom.text('countWhat'), 'Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with.',
+    'the ADR 0337 D4.4 notice, said before the switch is touched');
+});
+
+test('the prompt: "show me" sends shown_publicly alone, then re-reads both; the pair takes its place', async () => {
+  const state = {};
+  const dom = boot({ me: ME, answer: memberAnswer(state) });
+  await settle();
+  dom.click('askYes');
+  await settle();
+  const patches = dom.calls.filter((c) => c.method === 'PATCH');
+  assert.deepEqual(patches, [{ method: 'PATCH', path: '/guilds/forge-crew/membership', body: { shown_publicly: true } }]);
+  const after = dom.guildCalls().slice(dom.guildCalls().indexOf(patches[0]) + 1).map((c) => `${c.method} ${c.path}`);
+  assert.deepEqual(after.sort(), ['GET /guilds/forge-crew', 'GET /guilds/forge-crew/members'], 'the public roster and size move with the switch, so both are re-read');
+  assert.equal(dom.text('youMsg'), 'Saved — you’re listed on its public page.');
+  assert.equal(dom.el('youMsg').className, 'projMsg ok');
+  assert.equal(dom.el('showAsk').hidden, true);
+  assert.equal(dom.el('shownBand').hidden, false);
+  assert.equal(dom.checked('shown'), 'on');
+});
+
+test('the prompt: "not now" writes nothing, keeps you off, and is remembered for this guild only', async () => {
+  const storage = {};
+  const dom = boot({ me: ME, answer: memberAnswer({}), storage });
+  await settle();
+  dom.click('askNo');
+  assert.equal(dom.calls.filter((c) => c.method === 'PATCH').length, 0, 'staying off needs no write');
+  assert.equal(dom.el('showAsk').hidden, true);
+  assert.equal(dom.el('shownBand').hidden, false);
+  assert.equal(dom.text('youMsg'), 'You’re staying off its public page. You can change that here at any time.');
+  assert.deepEqual(storage, { 'cb-guild-ask-forge-crew': 'no' });
+
+  const again = boot({ me: ME, answer: memberAnswer({}), storage });
+  await settle();
+  assert.equal(again.el('showAsk').hidden, true, 'not asked twice on this browser');
+  assert.equal(again.el('shownBand').hidden, false);
+
+  const blocked = boot({ me: ME, answer: memberAnswer({}), storageThrows: true });
+  await settle();
+  assert.equal(blocked.el('showAsk').hidden, false, 'storage that throws only means being asked again');
+  blocked.click('askNo');
+  assert.equal(blocked.el('showAsk').hidden, true);
+});
+
+test('the switches: nothing changed sends nothing; each save sends only what moved and says it plainly', async () => {
+  const state = {};
+  const storage = { 'cb-guild-ask-forge-crew': 'no' };
+  const dom = boot({ me: ME, answer: memberAnswer(state), storage });
+  await settle();
+  dom.submit();
+  assert.equal(dom.text('youMsg'), 'Nothing has changed.');
+  assert.equal(dom.calls.filter((c) => c.method === 'PATCH').length, 0);
+
+  dom.pick('counted', 'off');
+  assert.equal(dom.text('countWhat'), 'Your numbers are left out of this guild’s totals, from its next weekly count.', 'the notice follows the choice before it is saved');
+  dom.submit();
+  await settle();
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'PATCH').at(-1).body, { counted_in_totals: false });
+  assert.equal(dom.text('youMsg'), 'Saved — your numbers are left out of its totals.');
+
+  dom.pick('shown', 'on');
+  dom.pick('counted', 'on');
+  dom.submit();
+  await settle();
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'PATCH').at(-1).body, { shown_publicly: true, counted_in_totals: true });
+  assert.equal(dom.text('youMsg'), 'Saved — you’re listed on its public page, and your numbers count toward its totals.');
+});
+
+test('a refused or expired save is said, and the buttons come back', async () => {
+  const state = { patch: () => ({ status: 400, data: { error: { code: 'validation_failed', message: 'counted_in_totals must be a boolean' } } }) };
+  const dom = boot({ me: ME, answer: memberAnswer(state), storage: { 'cb-guild-ask-forge-crew': 'no' } });
+  await settle();
+  dom.pick('counted', 'off');
+  dom.submit();
+  await settle();
+  assert.equal(dom.text('youMsg'), 'Counted_in_totals must be a boolean.');
+  assert.equal(dom.el('youMsg').className, 'projMsg err');
+  assert.equal(dom.el('youSave').disabled, false);
+  state.patch = () => ({ status: 401, data: null });
+  dom.submit();
+  await settle();
+  assert.equal(dom.text('youMsg'), 'Your session expired — sign in again to save.');
+  assert.equal(dom.el('who').hidden, true, 'the chip is repainted signed out');
+});
+
+test('an unlisted guild, to its members: no public page, so no pair, no prompt, no shown_publicly sent, and no published record', async () => {
+  const answer = (owner) => (m, p, body) => {
+    if (p === '/guilds/night-shift' && m === 'GET') return NOT_FOUND;
+    if (p === '/guilds/night-shift/members') return { status: 200, data: { ...MEMBERS({ membership_kind: owner ? 'owner' : 'member' }, 'unlisted'), guild: { slug: 'night-shift', name: 'Night Shift', description: '', visibility: 'unlisted' } } };
+    if (m === 'PATCH') return { status: 200, data: { shown_publicly: false, counted_in_totals: body.counted_in_totals } };
+    return NOT_FOUND;
+  };
+  const dom = boot({ pathname: '/g/night-shift', me: ME, answer: answer(false) });
+  await settle();
+  assert.equal(dom.el('guildBody').hidden, false, 'a member reaches their unlisted guild through the own-scope read');
+  assert.equal(dom.text('gKicker'), 'Guild · unlisted');
+  assert.equal(dom.text('gMeta'), '5 members', 'no public page to count, and no founding date in the members’ read');
+  assert.equal(dom.el('gDesc').hidden, true);
+  assert.equal(dom.el('showAsk').hidden, true);
+  assert.equal(dom.el('shownBand').hidden, true);
+  assert.equal(dom.text('shownUnlisted'), 'This guild is unlisted, so it has no public page. If it is made public, you’ll be asked here before you’re listed on it.');
+  assert.equal(dom.el('gFigs').hidden, true);
+  assert.equal(dom.text('gRecordNote'), 'This guild is unlisted, so its record isn’t published anywhere.');
+  dom.pick('shown', 'on');
+  dom.pick('counted', 'off');
+  dom.submit();
+  await settle();
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'PATCH').map((c) => c.body), [{ counted_in_totals: false }],
+    'consent to a page that does not exist is never sent (ADR 0336 D4 §3: consent is to what the card showed)');
+
+  const owner = boot({ pathname: '/g/night-shift', me: ME, answer: answer(true) });
+  await settle();
+  assert.equal(owner.text('gYouSide'), 'You own this guild. Only you see this, and only you can change it.');
+  assert.equal(owner.text('shownUnlisted'), 'This guild is unlisted, so it has no public page. If you make it public, you’ll be listed on it as its owner, and each member will be asked before they are.',
+    'a visibility change flips only the owner’s own flag');
+});
+
+// ── 4b. apply to a project, as this guild (task 1002303, R27; ADR 0365 D2) ──
+// The owner files the guild's application; it applies for nobody, so each member
+// (the owner included) applies as themselves from their invitations. A project
+// that is unknown, off the map or not public is ONE 404 on the server, and one
+// line here that never says a private project exists.
+
+function ownerAnswer(engage) {
+  const members = (m, p, body) => memberAnswer({ you: { membership_kind: 'owner' } })(m, p, body);
+  return (m, p, body) => (p === '/guilds/forge-crew/engagements' && m === 'POST' ? engage(body) : members(m, p, body));
+}
+const ENGAGED = (origin) => ({
+  status: 200,
+  data: { engagement: { guild: { slug: 'forge-crew', name: 'Forge Crew' }, kind: 'apply', project: { name: 'Tidepool', origin }, created_at: '2026-10-05T09:00:00.000Z' } },
+});
+const sendApply = (dom, value) => {
+  dom.el('applyOrigin').value = value;
+  for (const f of dom.el('applyForm')._on.submit || []) f({ preventDefault() {} });
+};
+
+test('apply to a project: shown to the guild’s owner alone — never to a member, a stranger or someone signed out', async () => {
+  const owner = boot({ me: ME, answer: ownerAnswer(() => NOT_FOUND) });
+  await settle();
+  assert.equal(owner.el('gApply').hidden, false, 'the owner files for the guild');
+
+  const member = boot({ me: ME, answer: memberAnswer({}) });
+  await settle();
+  assert.equal(member.el('gApply').hidden, true, 'a member applies from their own invitations, not here');
+
+  const stranger = boot({ me: ME, answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  assert.equal(stranger.el('gApply').hidden, true);
+
+  const out = boot({ answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  assert.equal(out.el('gApply').hidden, true);
+});
+
+test('apply to a project: sends exactly { origin } (a bare host taken as https://), and says it applied for nobody, the owner included', async () => {
+  const sent = [];
+  const dom = boot({ me: ME, answer: ownerAnswer((body) => { sent.push(body); return ENGAGED(body.origin); }) });
+  await settle();
+
+  sendApply(dom, '   ');
+  assert.equal(sent.length, 0, 'an empty field is a question, not a request');
+  assert.equal(dom.text('applyMsg'), 'Enter the project’s address.');
+  assert.equal(dom.el('applyMsg').className, 'projMsg err');
+
+  sendApply(dom, ' tidepool.example.com ');
+  await settle();
+  assert.deepEqual(sent, [{ origin: 'https://tidepool.example.com' }], 'the one field the route reads, and nothing else');
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'POST').map((c) => c.path), ['/guilds/forge-crew/engagements']);
+  assert.equal(dom.text('applyMsg'), 'Done. Forge Crew’s members will see Tidepool in their invitations, and each one applies as themselves. That includes you — this didn’t apply for you.');
+  assert.equal(dom.el('applyMsg').className, 'projMsg ok');
+  assert.equal(dom.el('applyOrigin').value, '', 'the field clears for the next one');
+  assert.equal(dom.el('applySend').disabled, false);
+  assert.equal(dom.calls.filter((c) => c.path === '/my-projects/join').length, 0, 'filing never applies on anyone’s behalf');
+});
+
+test('apply to a project: a project that is not public on the map is ONE honest line; other refusals in the server’s words', async () => {
+  let answer = { status: 404, data: { error: { code: 'unknown_project', message: 'unknown_project' } } };
+  const dom = boot({ me: ME, answer: ownerAnswer(() => answer) });
+  await settle();
+
+  sendApply(dom, 'https://stealth.example.com');
+  await settle();
+  assert.equal(dom.text('applyMsg'), 'No public project on the map at that address.', 'unknown, private and stealth read the same');
+  assert.doesNotMatch(dom.text('applyMsg'), /private|stealth|exists/i);
+  assert.equal(dom.el('applyMsg').className, 'projMsg err');
+  assert.equal(dom.el('applyOrigin').value, 'https://stealth.example.com', 'a refusal keeps what was typed');
+
+  answer = { status: 403, data: { error: { code: 'guild_owner_only', message: 'only the guild owner can do that' } } };
+  sendApply(dom, 'https://tidepool.example.com');
+  await settle();
+  assert.equal(dom.text('applyMsg'), 'Only the guild owner can do that.');
+
+  answer = { status: 401, data: null };
+  sendApply(dom, 'https://tidepool.example.com');
+  await settle();
+  assert.equal(dom.text('applyMsg'), 'Your session expired — sign in again to send this.');
+  assert.equal(dom.el('who').hidden, true, 'the chip is repainted signed out');
+});
+
+// ── 5. the route ─────────────────────────────────────────────────────────────
+
+const { buildPlatformApp } = require('../src/platform-server.js');
+const modules = require('../src/modules.js');
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => {
+  modules.setModuleOverrides({});
+  await new Promise((resolve) => server.close(resolve));
+});
+function get(pathname, host) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /g/<slug>: served on the hub’s apex, stamped; never on a child, the builders host or the status host', async () => {
+  modules.setModuleOverrides({ 'platform-identity': false });
+  const child = await get('/g/forge-crew', 'game.test.local');
+  assert.equal(child.status, 404, 'a child instance has no guilds, so no page');
+  modules.setModuleOverrides({ 'platform-identity': true });
+  for (const p of ['/g/forge-crew', '/g/Forge-Crew', '/g/forge-crew/', '/g/no-such-guild']) {
+    const hub = await get(p, 'game.test.local');
+    assert.equal(hub.status, 200, `${p}: one shell for every well-formed slug — the guild routes decide what exists`);
+    assert.match(hub.body, /— Guild<\/title>/);
+    assert.match(hub.body, /window\.__BRANDING__=/);
+    assert.doesNotMatch(hub.body, /\{\{[a-zA-Z]+\}\}/);
+    assert.match(hub.body, /<script src="\/assets\/hub-bar\.js\?v=[0-9a-f]{8}"><\/script>/, 'the shared bar script is content-stamped');
+  }
+  for (const p of ['/g/a', '/g/a_b', '/g/forge-crew/members', '/g/' + 'a'.repeat(40)]) {
+    const bad = await get(p, 'game.test.local');
+    assert.equal(bad.status, 404, `${p} cannot be a slug, so it is the 404 tail`);
+  }
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    const other = await get('/g/forge-crew', host);
+    assert.doesNotMatch(other.body, /— Guild<\/title>/, `${host} must not serve the guild page`);
+  }
+});