@bongos/core 1.21.59 → 1.21.61

package/modules/public-landing/public/projects.html

@@ -2477,6 +2477,13 @@ summary{min-height:24px;padding:3px 0;}
      the ?view=manage&id=N deep link, read by loadManage() */
   var manageId = null;
   var manageInst = null;
+  /* a project's own hall links here by SLUG (task 1004570): it knows its slug, not
+     this page's instance id. Held until the visitor's own projects load, then
+     resolved against THOSE only — a slug that is not yours opens nothing. The
+     section (#mDelete / #mDisconnect) is held too, because setView rewrites the
+     URL and drops the hash before the manage view has painted. */
+  var handedProject = null;
+  var handedSection = null;
 
   function viewFromUrl() {
     var v;
@@ -2486,6 +2493,8 @@ summary{min-height:24px;padding:3px 0;}
       var id = null;
       try { id = new URLSearchParams(location.search).get('id'); } catch (e) {}
       if (id) { manageId = String(id); return 'manage'; }
+      try { handedProject = new URLSearchParams(location.search).get('project') || null; } catch (e) {}
+      if (handedProject && /^#m(Delete|Disconnect)$/.test(location.hash || '')) handedSection = location.hash.slice(1);
       return 'mine';
     }
     return VIEWS[v] ? v : 'map';
@@ -2526,8 +2535,10 @@ summary{min-height:24px;padding:3px 0;}
        sign-in door on the hub's own pages carries the repo scope (task 1004549,
        ADR 0364): it is asked once, at sign-in, and held for the whole session, so
        no flow ever stops halfway to ask for it */
-    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
-      idPart.replace('&', '%26').replace('=', '%3D') + '&repos=1';
+    /* a hand-off that is still waiting on sign-in keeps its slug through the door */
+    var backPart = handedProject ? encodeURIComponent('?view=manage&project=' + handedProject)
+      : '%3Fview%3D' + v + idPart.replace('&', '%26').replace('=', '%3D');
+    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects' + backPart + '&repos=1';
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale — including
        the membership + invitations lists (task 1003774), the same re-read
@@ -3324,6 +3335,16 @@ summary{min-height:24px;padding:3px 0;}
      opens that project's own manage view — the per-project page the
      manage-wave tasks fill in. It replaced the scroll-anchor-into-the-list
      this function used to do. ── */
+  /* the hall's hand-off (task 1004570): the slug becomes one of YOUR projects or
+     nothing — this page stays on your list rather than guessing */
+  function openHandedProject() {
+    if (!handedProject) return;
+    var slug = handedProject;
+    handedProject = null;
+    var inst = ownedInstances.filter(function (i) { return i && i.slug === slug; })[0];
+    if (inst) goToManage(inst.id);
+    else handedSection = null;
+  }
   function goToManage(instId) {
     manageId = String(instId || '');
     manageInst = null;
@@ -8609,6 +8630,12 @@ summary{min-height:24px;padding:3px 0;}
         var inst = data.instance || {};
         inst.open_intent = data.open_intent || null;
         renderManage(inst);
+        /* the hall's hand-off named a card — land on it once the page has its content */
+        if (handedSection) {
+          var target = $(handedSection);
+          handedSection = null;
+          if (target && target.scrollIntoView) target.scrollIntoView({ block: 'start' });
+        }
         /* the SECOND, GitHub-backed read — fired only here (entry + tab
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
@@ -10841,7 +10868,7 @@ summary{min-height:24px;padding:3px 0;}
       $('gate').hidden = true;
       $('mine').hidden = false;
       load();
-      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]);
+      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]).then(openHandedProject);
     })
     .catch(function (err) {
       me = null;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.59",
+  "version": "1.21.61",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.59",
+      "version": "1.21.61",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.59",
+  "version": "1.21.61",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9126,5 +9126,17 @@
       "id": "1004552",
       "text": "The Goals and Tasks pages now open on the version the project owner has starred on the Roadmap. With no star, they show every version as before."
     }
+  ],
+  "1.21.60": [
+    {
+      "id": "1004553",
+      "text": "Builders can now save their filter settings on the Goals and Tasks pages as named views, pick one to open the page with, and find them again on any device. Each builder's views are private to them."
+    }
+  ],
+  "1.21.61": [
+    {
+      "id": "1004570",
+      "text": "A project owner now sees a Danger zone in their project's settings, with links straight to the place where they can take the project offline or delete it. Nobody else sees it, and self-hosted projects don't show it."
+    }
   ]
 }

package/src/bongos/routes/core-update.js

@@ -50,6 +50,23 @@ function hubDeployUrl(config) {
   return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
 }
 
+// WHERE THIS PROJECT'S OWNER TAKES IT OFFLINE OR DISCONNECTS IT (task 1004570). Both
+// controls live on the hub's Projects page for this project — the typed-name confirm and
+// the intent queue are there (ADR 0290) — so the hall only links to them and gains no
+// second delete path. Same two inputs as hubDeployUrl (the hub origin and this project's
+// client id, which is its slug); null on a self-hosted instance or the hub itself, so the
+// hall shows no section rather than a dead link. The page resolves ?project=<slug>
+// against the visitor's OWN projects, so the link opens nothing for anyone else.
+function hubManageLinks(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  const origin = config.origin.replace(/\/+$/, '');
+  const page = `${origin}/projects?view=manage&project=${encodeURIComponent(String(config.clientId))}`;
+  let host = origin;
+  try { host = new URL(origin).host; } catch { /* keep the origin as written */ }
+  return { hub_host: host, manage_url: page, offline_url: `${page}#mDelete`, disconnect_url: `${page}#mDisconnect` };
+}
+
 // WHERE THIS PROJECT'S UPDATE BUTTON GOES (task 1004296). The act itself never happens in
 // Settings: it is the deploy door's two-step confirm and auto-rollback (ADR 0293), and that
 // door is the provisioning module's — so only a hall that runs provisioning has one.
@@ -216,9 +233,25 @@ function buildCoreUpdateRouter({
     }, { errorCode: 'software_update_failed', message: false }),
   );
 
+  // GET /project/manage-link — the hub's page for THIS project, where its owner takes it
+  // offline or disconnects it (task 1004570). On a hosted project the owner is its Archon,
+  // so the read is Archon-only: a builder below that is refused and the hall draws no
+  // section. { link: null } on a self-hosted instance (no hub to link to).
+  // rank: archon — the project's owner; it names where the project can be ended.
+  router.get(
+    '/project/manage-link',
+    auth.requireBuilder,
+    auth.requireRank('archon'),
+    asyncHandler('GET /project/manage-link', async (_req, res) => {
+      const { idp } = doorInputs();
+      res.json({ ok: true, link: hubManageLinks(idp) });
+    }, { errorCode: 'manage_link_failed', message: false }),
+  );
+
   return router;
 }
 
 module.exports = buildCoreUpdateRouter;
+module.exports.hubManageLinks = hubManageLinks;
 module.exports.hubDeployUrl = hubDeployUrl;
 module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.59'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.61'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/filter_views.mjs

@@ -0,0 +1,144 @@
+// tests/filter_views.mjs — saved filter views (task 1004553): the pure storage rules
+// in modules/builder-settings/filter-views.js and the own-scoped /me/filter-views
+// routes, run against a fake prefs store keyed by builder. No DB needed.
+//
+// Run:  node --test tests/filter_views.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const fv = require('../modules/builder-settings/filter-views.js');
+
+// One behavior_prefs blob per builder — the column the routes really write.
+const rows = new Map();
+const db = require('../modules/builder-settings/db.js');
+db.getBuilderBehaviorPrefs = async (id) => rows.get(id) || {};
+db.setBuilderBehaviorPrefs = async (id, prefs) => { rows.set(id, prefs); return prefs; };
+const router = require('../modules/builder-settings/routes/settings.js')();
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+function handler(method, path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods[method]);
+  assert.ok(layer, `${method} ${path} is registered`);
+  return layer.route.stack[layer.route.stack.length - 1].handle;
+}
+async function call(method, path, { builder, body, query = {}, params = {} }) {
+  const out = { status: 200, body: null };
+  const res = {
+    status(s) { out.status = s; return this; },
+    json(b) { out.body = b; return this; },
+    fail(code, opts) { out.status = (opts && opts.status) || 400; out.body = { error: { code, message: opts && opts.message } }; return this; },
+  };
+  await handler(method, path)({ builder, body, query, params }, res);
+  return out;
+}
+const ALICE = { id: 1, rank: 'thetes' };
+const BOB = { id: 2, rank: 'metic' };
+
+test('saving a view keeps sibling prefs and only what was sent', () => {
+  const r = fv.saveView({ wandering: 'low' }, 'goals', { name: '  My  open goals ', values: { 'f-goal-status': 'open' } });
+  assert.equal(r.ok, true);
+  assert.equal(r.prefs.wandering, 'low', 'sibling knobs survive');
+  assert.deepEqual(r.view, { id: 1, name: 'My open goals', values: { 'f-goal-status': 'open' }, is_default: false });
+});
+
+test('saving under an existing name updates that view instead of adding a second', () => {
+  let p = fv.saveView({}, 'goals', { name: 'Mine', values: { a: '1' } }).prefs;
+  p = fv.saveView(p, 'goals', { name: 'mine', values: { a: '2' } }).prefs;
+  const list = fv.listViews(p, 'goals');
+  assert.equal(list.length, 1);
+  assert.deepEqual(list[0].values, { a: '2' });
+});
+
+test('only one view per page is the default', () => {
+  let p = fv.saveView({}, 'goals', { name: 'A', values: {}, is_default: true }).prefs;
+  p = fv.saveView(p, 'goals', { name: 'B', values: {}, is_default: true }).prefs;
+  assert.deepEqual(fv.listViews(p, 'goals').map((v) => [v.name, v.is_default]), [['A', false], ['B', true]]);
+  p = fv.updateView(p, 'goals', 1, { is_default: true }).prefs;
+  assert.deepEqual(fv.listViews(p, 'goals').map((v) => v.is_default), [true, false]);
+  p = fv.updateView(p, 'goals', 1, { is_default: false }).prefs;
+  assert.deepEqual(fv.listViews(p, 'goals').map((v) => v.is_default), [false, false]);
+});
+
+test('pages keep separate lists, and deleting the last view leaves no empty key behind', () => {
+  let p = fv.saveView({}, 'goals', { name: 'G', values: {} }).prefs;
+  p = fv.saveView(p, 'work', { name: 'W', values: {} }).prefs;
+  assert.deepEqual(fv.listViews(p, 'work').map((v) => v.name), ['W']);
+  p = fv.deleteView(p, 'goals', 1).prefs;
+  p = fv.deleteView(p, 'work', 1).prefs;
+  assert.equal(fv.RESERVED_KEY in p, false);
+});
+
+test('bad input is refused with a readable reason', () => {
+  assert.equal(fv.saveView({}, 'Goals!', { name: 'x', values: {} }).ok, false);
+  assert.equal(fv.saveView({}, 'goals', { name: '   ', values: {} }).ok, false);
+  assert.equal(fv.saveView({}, 'goals', { name: 'x'.repeat(61), values: {} }).ok, false);
+  assert.equal(fv.saveView({}, 'goals', { name: 'x', values: [] }).ok, false);
+  assert.equal(fv.saveView({}, 'goals', { name: 'x', values: { 'f-a': 3 } }).ok, false);
+  let p = {};
+  for (let i = 0; i < fv.MAX_VIEWS_PER_PAGE; i++) p = fv.saveView(p, 'goals', { name: `v${i}`, values: {} }).prefs;
+  assert.match(fv.saveView(p, 'goals', { name: 'one more', values: {} }).errors[0], /at most/);
+  let q = fv.saveView({}, 'goals', { name: 'A', values: {} }).prefs;
+  q = fv.saveView(q, 'goals', { name: 'B', values: {} }).prefs;
+  assert.match(fv.updateView(q, 'goals', 2, { name: 'a' }).errors[0], /already have/);
+});
+
+test('a builder saves a view and reads it back from a fresh request (another device)', async () => {
+  rows.clear();
+  const saved = await call('post', '/me/filter-views', { builder: ALICE, body: { page: 'goals', name: 'Open', values: { 'f-goal-status': 'open' }, is_default: true } });
+  assert.equal(saved.status, 201);
+  const got = await call('get', '/me/filter-views', { builder: ALICE, query: { page: 'goals' } });
+  assert.deepEqual(got.body.views, [{ id: 1, name: 'Open', values: { 'f-goal-status': 'open' }, is_default: true }]);
+});
+
+test('another builder cannot see, rename, default or delete it', async () => {
+  const seen = await call('get', '/me/filter-views', { builder: BOB, query: { page: 'goals' } });
+  assert.deepEqual(seen.body.views, []);
+  const patch = await call('patch', '/me/filter-views/:id', { builder: BOB, params: { id: '1' }, body: { page: 'goals', name: 'Hijacked' } });
+  assert.equal(patch.status, 404);
+  const del = await call('delete', '/me/filter-views/:id', { builder: BOB, params: { id: '1' }, query: { page: 'goals' } });
+  assert.equal(del.status, 404);
+  const still = await call('get', '/me/filter-views', { builder: ALICE, query: { page: 'goals' } });
+  assert.equal(still.body.views[0].name, 'Open', 'Alice\'s view is untouched');
+});
+
+test('the owner renames and deletes their own view', async () => {
+  const ren = await call('patch', '/me/filter-views/:id', { builder: ALICE, params: { id: '1' }, body: { page: 'goals', name: 'Open goals' } });
+  assert.equal(ren.body.view.name, 'Open goals');
+  const del = await call('delete', '/me/filter-views/:id', { builder: ALICE, params: { id: '1' }, query: { page: 'goals' } });
+  assert.deepEqual(del.body.views, []);
+});
+
+test('a missing page is a 400; a wrong-shaped body is refused before it is stored; a bad value is a 422', async () => {
+  rows.clear();
+  assert.equal((await call('get', '/me/filter-views', { builder: ALICE, query: {} })).status, 400);
+  assert.equal((await call('post', '/me/filter-views', { builder: ALICE, body: { page: 'goals', name: 'x' } })).status, 400, 'values missing');
+  assert.equal((await call('post', '/me/filter-views', { builder: ALICE, body: { page: 'goals', name: 'x', values: {}, owner: 2 } })).status, 400, 'unknown field');
+  assert.equal((await call('post', '/me/filter-views', { builder: ALICE, body: { page: 'goals', name: '   ', values: {} } })).status, 422);
+  assert.equal(rows.size, 0, 'nothing was written');
+});
+
+test('every route is own-scoped: requireBuilder, and no id from the request picks the builder', () => {
+  const routes = src('modules/builder-settings/routes/settings.js');
+  for (const m of ['get', 'post', 'patch', 'delete']) {
+    assert.match(routes, new RegExp(`router\\.${m}\\('/me/filter-views[^']*', api\\.requireBuilder,`));
+  }
+  const block = routes.slice(routes.indexOf("'/me/filter-views'"), routes.indexOf('Per-builder DISPLAY NAME'));
+  assert.doesNotMatch(block, /BehaviorPrefs\((?!req\.builder\.id)/, 'prefs are only ever read/written for req.builder.id');
+});
+
+test('both pages opt in, and apply my default view before the focus version', () => {
+  const work = src('modules/hall-ui/public/work.js');
+  assert.match(work, /views: \{ page: 'work', client: api, base: `\$\{API\}\/me\/filter-views` \}/);
+  assert.match(work, /applyDefault\(\{ fire: true \}\)[\s\S]{0,160}!applied && applyFocusVersion\(focusResp\)/);
+  const goals = src('modules/hall-ui/public/goals-page.js');
+  assert.match(goals, /views: \{ page: 'goals', client: api, base: `\$\{API\}\/me\/filter-views` \}/);
+  assert.match(goals, /if \(!\(views && await views\.applyDefault\(\{ fire: false \}\)\)\) applyFocusVersion\(focusResp\);/);
+  const kit = src('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /if \(!\(await ready\) \|\| urlHasFilter\) return false;/, 'a URL filter beats my default view');
+});

package/tests/focus_version_filter_default.mjs

@@ -39,9 +39,10 @@ test('a focus the select has no option for is left alone, not selected as a blan
 test('both pages read the focus and apply it after their version options fill', () => {
   const work = src('modules/hall-ui/public/work.js');
   assert.match(work, /\/versions\/focus/);
-  assert.match(work, /populateVersionFilter\(taskState\.versions\);\s*restoreUrlFilter\('f-version'\);\s*if \(applyFocusVersion\(focusResp\)\)/);
+  // task 1004553 moved the call after the Goal options fill, behind the builder's default view.
+  assert.match(work, /restoreUrlFilter\('f-goal'\)[\s\S]{0,600}!applied && applyFocusVersion\(focusResp\)/);
   const goals = src('modules/hall-ui/public/goals-page.js');
   assert.match(goals, /\/versions\/focus/);
-  assert.match(goals, /populateVersionFilter\(\);\s*applyFocusVersion\(focusResp\);/);
+  assert.match(goals, /populateVersionFilter\(\);[\s\S]{0,400}applyFocusVersion\(focusResp\);/);
   for (const page of [work, goals]) assert.match(page, /OTBTaskLib\.focusVersionDefault\(/);
 });

package/tests/project_manage_link.mjs

@@ -0,0 +1,111 @@
+// tests/project_manage_link.mjs — a hosted project's owner reaches Take-offline and
+// Delete from their own hall (task 1004570). These EXECUTE: the link builder against
+// real inputs, and real HTTP requests through the assembled router with only
+// requireBuilder replaced, so the Archon gate that refuses a non-owner is the real one.
+//
+// Run:  node --test tests/project_manage_link.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.NODE_ENV = 'test';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const { hubManageLinks } = require_(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+
+const HUB = { origin: 'https://hub.example.com/', clientId: 'mercury' };
+
+test('the link opens THIS project on the hub, at the two cards', () => {
+  assert.deepEqual(hubManageLinks(HUB), {
+    hub_host: 'hub.example.com',
+    manage_url: 'https://hub.example.com/projects?view=manage&project=mercury',
+    offline_url: 'https://hub.example.com/projects?view=manage&project=mercury#mDelete',
+    disconnect_url: 'https://hub.example.com/projects?view=manage&project=mercury#mDisconnect',
+  });
+});
+
+test('no hub (self-hosted, or the hub itself) means no link, never a wrong one', () => {
+  assert.equal(hubManageLinks(null), null);
+  assert.equal(hubManageLinks({ origin: 'https://hub.example.com' }), null, 'no client id');
+  assert.equal(hubManageLinks({ origin: 'javascript:alert(1)', clientId: 'x' }), null, 'not an http origin');
+  assert.equal(hubManageLinks({ origin: 'https://hub.example.com/"><script>', clientId: 'x' }), null);
+});
+
+// One server per test: requireBuilder is swapped for a stub that seats the rank the
+// request names, and the route module is re-required so it captures the stub.
+async function withServer(idp, fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const saved = realAuth.requireBuilder;
+  realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: req.get('x-rank') }; next(); };
+  delete r2.cache[routePath];
+  const express = r2('express');
+  const { attachFail } = r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const app = express();
+  app.use(attachFail);
+  app.use(r2(routePath)({ doorInputs: () => ({ provisioning: false, idp }) }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const get = (rank) => fetch(`http://127.0.0.1:${server.address().port}/project/manage-link`, { headers: { 'x-rank': rank } });
+  try { await fn(get); } finally {
+    server.close();
+    realAuth.requireBuilder = saved;
+    delete r2.cache[routePath];
+  }
+}
+
+test('C1: the owner (the hosted project\'s Archon) gets the link', async () => {
+  await withServer(HUB, async (get) => {
+    const res = await get('archon');
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).link.offline_url, 'https://hub.example.com/projects?view=manage&project=mercury#mDelete');
+  });
+});
+
+test('C2: a builder of the same project below Archon is refused by the server', async () => {
+  await withServer(HUB, async (get) => {
+    for (const rank of ['metic', 'thetes', 'xenos']) {
+      const res = await get(rank);
+      assert.equal(res.status, 403, `${rank} is refused`);
+      assert.equal(JSON.stringify(await res.json()).includes('hub.example.com'), false, `${rank} learns nothing`);
+    }
+  });
+});
+
+test('C3: a self-hosted instance answers no link', async () => {
+  await withServer(null, async (get) => {
+    const res = await get('archon');
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).link, null);
+  });
+});
+
+test('the hall section is hidden in the markup and shown only for a real link', () => {
+  const html = read('modules/hall-ui/public/project-settings.html');
+  assert.match(html, /<section class="scroll" id="ps-danger"[^>]*\bhidden>/);
+  const js = read('modules/hall-ui/public/project-settings.js');
+  assert.match(js, /if \(!link \|\| !link\.offline_url \|\| !link\.disconnect_url\) return;/);
+  assert.match(js, /\/project\/manage-link/);
+});
+
+test('the hub resolves the slug against the visitor\'s OWN projects only', () => {
+  const page = read('modules/public-landing/public/projects.html');
+  assert.match(page, /ownedInstances\.filter\(function \(i\) \{ return i && i\.slug === slug; \}\)\[0\]/);
+  assert.match(page, /\.then\(openHandedProject\)/);
+});
+
+test('the hall\'s two sentences say what the hub\'s own folds promise', () => {
+  const hall = read('modules/hall-ui/public/project-settings.html');
+  const hub = read('modules/public-landing/public/projects.html');
+  for (const claim of ['repository on GitHub', 'cannot be undone', 'bring it back', 'Take it offline', 'Disconnect from Bongos entirely']) {
+    assert.ok(hall.includes(claim), `the hall says "${claim}"`);
+    assert.ok(hub.includes(claim), `the hub says "${claim}" too`);
+  }
+});