@bongos/core 1.21.65 → 1.21.67

package/tests/canonical_profile_url.mjs

@@ -9,14 +9,15 @@
 // OWN WHERE CLAUSE and throws on a placeholder or a literal comparison it did
 // not consume, so a predicate this file cannot read can never degrade into "no
 // constraint" and quietly pass. The REAL core router runs above it over a REAL
-// loopback socket, and the REAL browser script runs in a vm above a stub DOM.
-// Nothing here asserts against a canned response.
+// loopback socket. Nothing here asserts against a canned response.
 //
-// THE FLAG IS FALSE TODAY (ADR 0214 D1), so the three render behaviours are all
-// no-ops in production. Testing only that would be testing nothing, so the
-// client tests run the SAME source with the one constant flipped — and assert
-// the substitution changed exactly one thing, because a mutation that misses is
-// the failure mode this file exists to avoid.
+// THE FLAG IS FALSE (ADR 0214 D1), and the page that would flip it (goal
+// 1000048 R14, task 1002365) was abandoned. So the browser half that would have
+// rendered rel=canonical, the link-out and the numeric-id redirect was removed
+// (task 1003451): it shipped 137 lines of permanently dead branches to every
+// /profile reader. The server half stays — getPublicHandle is live, and the
+// resolver is what a rebuilt page will call. The test below pins the absence,
+// and fails the moment the flag flips without the browser half coming back.
 //
 // LANE: DB-free. It must run on every PR, where there is no Postgres. The last
 // test asserts that membership from the runner's own source (learning 1000218 —
@@ -26,7 +27,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
-import vm from 'node:vm';
 import express from 'express';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
@@ -48,7 +48,6 @@ const require = createRequire(import.meta.url);
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const read = (...p) => readFileSync(join(ROOT, ...p), 'utf8');
 
-const CLIENT_SRC = read('modules', 'hall-ui', 'public', 'profile-canonical.js');
 const MODULE_SRC = read('modules', 'platform-identity', 'canonical-profile.js');
 const PROFILE_JS = read('modules', 'hall-ui', 'public', 'profile.js');
 const PROFILE_HTML = read('modules', 'hall-ui', 'public', 'profile.html');
@@ -429,154 +428,21 @@ test('an older hub provider without getPublicHandle degrades to null instead of
 test.after(() => server.close());
 
 // ===========================================================================
-// The browser script — the three behaviours, run for real in a vm
+// The wiring: the page and the stamp
 // ===========================================================================
 
-const LIVE_SRC = CLIENT_SRC.replace('const CANONICAL_PROFILE_PAGE_LIVE = false;', 'const CANONICAL_PROFILE_PAGE_LIVE = true;');
-
-test('the live-source substitution changes exactly one thing (the instrument, checked first)', () => {
-  assert.notEqual(LIVE_SRC, CLIENT_SRC, 'the constant this file flips is not spelled the way the test expects — every client assertion below would be testing the dark path');
-  const diffs = CLIENT_SRC.split('\n').filter((l, i) => l !== LIVE_SRC.split('\n')[i]);
-  assert.equal(diffs.length, 1, 'the substitution must flip one line, not rewrite the module');
-});
-
-function boot(src, { hubOriginMeta, modules, search } = {}) {
-  const head = { children: [], appendChild(el) { this.children.push(el); } };
-  const els = new Map();
-  const el = (id) => {
-    if (!els.has(id)) els.set(id, { id, hidden: true, _html: '', attrs: {}, setAttribute(k, v) { this.attrs[k] = v; }, getAttribute(k) { return this.attrs[k] ?? null; }, set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } });
-    return els.get(id);
-  };
-  const meta = hubOriginMeta === undefined ? null : { getAttribute: () => hubOriginMeta };
-  const replaced = [];
-  const assigned = [];
-  const sandbox = {
-    console: { error() {}, warn() {}, log() {} },
-    URL,
-    URLSearchParams,
-    document: {
-      head,
-      querySelector: (sel) => (sel === 'meta[name="hub-origin"]' ? meta : (head.children.find((c) => c.attrs.rel === 'canonical') || null)),
-      getElementById: (id) => (id === 'xp-scroll' || id === 'xp-body' ? el(id) : null),
-      createElement: () => ({ attrs: {}, setAttribute(k, v) { this.attrs[k] = v; }, getAttribute(k) { return this.attrs[k] ?? null; } }),
-    },
-    // `assign` is stubbed too, and deliberately records into a SEPARATE list:
-    // swapping replace→assign must fail on the assertion (the numeric URL would
-    // stay in history as a place Back returns to), not crash on an undefined
-    // method, which would "pass" the mutation check for the wrong reason.
-    location: { search: search || '', replace: (u) => replaced.push(u), assign: (u) => assigned.push(u), href: '' },
-    window: { OTB: { escapeHtml: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;') }, __MODULES__: modules || [] },
-  };
-  sandbox.globalThis = sandbox;
-  vm.createContext(sandbox);
-  vm.runInContext(src, sandbox, { filename: 'profile-canonical.js' });
-  return {
-    api: sandbox.window.OTBCanonical,
-    canonicalHref: () => { const l = head.children.find((c) => c.attrs.rel === 'canonical'); return l ? l.attrs.href : null; },
-    xp: () => el('xp-scroll'),
-    xpHtml: () => el('xp-body').innerHTML,
-    replaced,
-    assigned,
-  };
-}
-
-const FEDERATED = { hubOriginMeta: 'https://cloudbongos.com', modules: ['lifecycle', 'hall-ui'] };
-const HUB = { hubOriginMeta: 'https://cloudbongos.com', modules: ['platform-identity', 'hall-ui'] };
-
-test('DARK today: with the shipped source nothing is emitted, anywhere', () => {
-  const fed = boot(CLIENT_SRC, FEDERATED);
-  fed.api.render({ handle: 'ada' });
-  assert.equal(fed.canonicalHref(), null, 'a canonical must not name a URL that 404s');
-  assert.equal(fed.xp().hidden, true);
-  const hub = boot(CLIENT_SRC, { ...HUB, search: '?id=7' });
-  hub.api.render({ handle: 'ada' });
-  assert.deepEqual(hub.replaced, [], 'redirecting a working page to a 404 would be the worst of the three');
-});
-
-test('LIVE, federated: rel=canonical points at the hub and the link-out is visible', () => {
-  const page = boot(LIVE_SRC, FEDERATED);
-  page.api.render({ handle: 'ada' });
-  assert.equal(page.canonicalHref(), 'https://cloudbongos.com/u/ada');
-  assert.equal(page.xp().hidden, false);
-  assert.match(page.xpHtml(), /href="https:\/\/cloudbongos\.com\/u\/ada"/);
-  assert.match(page.xpHtml(), /See the cross-project record/,
-    'the link-out is what ADR 0171 D1 asks a federated instance to render instead of inlining numbers');
-  assert.deepEqual(page.replaced, [], 'a federated instance shows its OWN record — it must never redirect away from it');
-});
-
-test('LIVE, hub: the numeric ?id= form redirects to the canonical handle URL', () => {
-  const page = boot(LIVE_SRC, { ...HUB, search: '?id=7' });
-  page.api.render({ handle: 'ada' });
-  assert.deepEqual(page.replaced, ['https://cloudbongos.com/u/ada']);
-  assert.equal(page.canonicalHref(), null, 'a page that redirects must not also declare a canonical');
-});
-
-test('LIVE, hub without ?id=: the self view is not redirected', () => {
-  const page = boot(LIVE_SRC, { ...HUB, search: '' });
-  page.api.render({ handle: 'ada' });
-  assert.deepEqual(page.replaced, [], 'the handle-less /profile is the viewer\'s own page, not a numeric address');
-});
-
-test('LIVE: no handle means no canonical, no link-out and NO REDIRECT — the fallback is a working page', () => {
-  for (const data of [{}, { handle: null }, { handle: '' }]) {
-    const fed = boot(LIVE_SRC, FEDERATED);
-    fed.api.render(data);
-    assert.equal(fed.canonicalHref(), null);
-    assert.equal(fed.xp().hidden, true);
-
-    const hub = boot(LIVE_SRC, { ...HUB, search: '?id=7' });
-    hub.api.render(data);
-    assert.deepEqual(hub.replaced, [],
-      'absent, provisional and private all arrive here as a missing handle and all get the ordinary local page — there is no error shape to read a signal off');
-  }
-});
-
-test('LIVE: a vanilla instance with no hub origin emits nothing', () => {
-  for (const meta of [undefined, '', '   ', 'http://cloudbongos.com', 'https://cloudbongos.com/u']) {
-    const page = boot(LIVE_SRC, { hubOriginMeta: meta, modules: [] });
-    page.api.render({ handle: 'ada' });
-    assert.equal(page.canonicalHref(), null, `an unusable hub-origin meta (${JSON.stringify(meta)}) must produce no canonical, never a relative one`);
-    assert.equal(page.xp().hidden, true);
-  }
-});
-
-test('LIVE: a hostile handle from the wire never reaches an href', () => {
-  for (const handle of ['ada/../../admin', 'ada"onload=x', '../evil', 'a b']) {
-    const page = boot(LIVE_SRC, FEDERATED);
-    page.api.render({ handle });
-    assert.equal(page.canonicalHref(), null, `handle ${JSON.stringify(handle)} must be refused, not encoded`);
-  }
-});
-
-// ===========================================================================
-// The wiring: the mirror, the page, and the stamp
-// ===========================================================================
-
-test('the client mirror and the module agree on both constants', () => {
-  const liveInModule = /const CANONICAL_PROFILE_PAGE_LIVE = (true|false);/.exec(MODULE_SRC);
-  const liveInClient = /const CANONICAL_PROFILE_PAGE_LIVE = (true|false);/.exec(CLIENT_SRC);
-  assert.ok(liveInModule && liveInClient, 'both files must spell the flag as a plain const so this guard can read it');
-  assert.equal(liveInClient[1], liveInModule[1],
-    'the browser mirror has drifted from modules/platform-identity/canonical-profile.js — flip both or neither');
-  assert.equal(String(CANONICAL_PROFILE_PAGE_LIVE), liveInModule[1], 'the module export disagrees with its own source');
-
-  const prefixInClient = /const CANONICAL_PROFILE_PREFIX = '([^']+)';/.exec(CLIENT_SRC);
-  assert.ok(prefixInClient, 'the client must spell the prefix as a plain const');
-  assert.equal(prefixInClient[1], CANONICAL_PROFILE_PREFIX, 'the two canonical namespaces have drifted apart');
-});
-
-test('the profile page loads the script BEFORE profile.js, and profile.js calls it', () => {
-  // Match the <script> TAGS, not the filenames: both names also appear in the
-  // page's prose, and an ordering assertion that reads a comment proves nothing.
+test('while the page is dark, /profile ships no canonical wiring at all (task 1003451)', () => {
+  // The browser half (profile-canonical.js) was removed when R14 — the
+  // /u/<handle> page that would have turned it on — was abandoned: 137 lines
+  // whose every branch sat behind a false flag, shipped to every /profile
+  // reader. Rebuild it with the page. Until then the module's flag is the one
+  // statement of "dark", and nothing in the hall may branch on it.
+  assert.equal(CANONICAL_PROFILE_PAGE_LIVE, false,
+    'the flag flipped: the /u/<handle> page now resolves, so the browser half (rel=canonical, link-out, numeric-id redirect) has to be rebuilt in this same change');
   const tags = [...PROFILE_HTML.matchAll(/<script\s+src="\/builders\/([a-z-]+\.js)/g)].map((m) => m[1]);
-  assert.ok(tags.includes('profile-canonical.js'),
-    'the page never loads the script, so nothing above runs in a browser');
-  assert.ok(
-    tags.indexOf('profile-canonical.js') < tags.indexOf('profile.js'),
-    `profile.js must load AFTER profile-canonical.js so window.OTBCanonical exists when renderProfile runs — got ${tags.join(', ')}`,
-  );
-  assert.match(PROFILE_JS, /window\.OTBCanonical\.render\(data\)/,
-    'profile.js must hand the profile response to the canonical wiring');
+  assert.ok(tags.includes('profile.js'), 'the tag reader matched nothing, so the next assertion would pass vacuously');
+  assert.ok(!tags.includes('profile-canonical.js'), 'the page loads a canonical script whose every branch is dead');
+  assert.doesNotMatch(PROFILE_JS, /OTBCanonical/, 'profile.js branches on a canonical wiring that does not exist');
 });
 
 test('the hub origin is stamped as a meta, and never straight into an href', () => {
@@ -593,9 +459,9 @@ test('the hub origin is stamped as a meta, and never straight into an href', ()
 });
 
 test('the resolver is the ONLY place that spells the canonical namespace', () => {
-  // Two files may carry it: the module and its browser mirror (checked equal
-  // above). A third would be a second opinion about where a profile lives.
-  const owners = ['modules/platform-identity/canonical-profile.js', 'modules/hall-ui/public/profile-canonical.js'];
+  // One file carries it: the module. A second would be a second opinion
+  // about where a profile lives.
+  const owners = ['modules/platform-identity/canonical-profile.js'];
   const offenders = [];
   const walk = (rel) => {
     for (const e of require('node:fs').readdirSync(join(ROOT, rel), { withFileTypes: true })) {

package/tests/hub_account_page.mjs

@@ -134,7 +134,7 @@ test('the bands say what the hub’s say and lead into /projects; Account is the
     ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
   ], 'this page has no views of its own, so every item names /projects in full');
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProfile')), [
-    ['My projects', '/projects?view=mine'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
+    ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
   ]);
   assert.deepEqual(PAGE.match(/<a [^>]*aria-current="page"[^>]*>[^<]+/g), ['<a class="bandT" href="/account" aria-current="page">Account']);
 });

package/tests/hub_engagement_cards.mjs

@@ -1,15 +1,16 @@
-// tests/hub_engagement_cards.mjs — the guild cards in /projects?view=mine's
-// Invitations, EXECUTED (task 1002303, R27; ADR 0365 D2/D3).
+// tests/hub_engagement_cards.mjs — the guild cards on the hub's /invitations page,
+// EXECUTED (task 1002303, R27; ADR 0365 D2/D3). They lived under /projects?view=mine
+// until task 1004276 gave the invitations a page of their own.
 //
 // GET /me/guild-engagements names what the guilds a builder is in have going with
 // a project: "G is applying to P" (the guild's owner put it forward) and "P
 // invited G". Each card's Apply is the hub's ONE join relay (postJoinRequest,
-// tests/card_apply_ui.mjs pins it for the map's card) with `guild` added — the
+// tests/card_apply_ui.mjs pins /projects' copy for the map's card) with `guild` added — the
 // builder applies as themselves, never as the guild. What these pin:
 //   • the two kinds draw as two sentences, with the project's host and a plain
 //     hint; a row the page cannot act on is dropped, never drawn with a dead button
-//   • the Invitations section shows while EITHER list has a row, and hides when
-//     neither does (the projects' own invites and the guild cards are one section)
+//   • the page's one empty line shows only once the reads have answered and NO list
+//     has a row (the projects' own invites and the guild cards are one section)
 //   • Apply sends exactly { origin, guild } — plus the builder's own note when they
 //     open "Add a note" and write one — on the cookie session, to /my-projects/join
 //   • `requested` is the only answer that reads as applied; the relay's other
@@ -19,7 +20,7 @@
 //   • an expired session and a dead network are said as such
 //   • textContent / createElement only — no markup built from strings
 //
-// The idiom is tests/project_invite_ui.mjs: lift the region out of projects.html,
+// The idiom is tests/project_invite_ui.mjs: lift the region out of invitations.html,
 // run it in a node:vm under a DOM stub, drive real clicks, and assert the slice
 // boundaries, so a rename can never leave this file executing an empty string.
 //
@@ -34,7 +35,7 @@ import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
-const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const HUB = fs.readFileSync(path.join(LANDING, 'invitations.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
 // the rows region: mineEl/mineRow, the lists, the section, and the guild cards —
@@ -79,12 +80,12 @@ function el(tag) {
 
 const TIDEPOOL = { guild: { slug: 'forge-crew', name: 'Forge Crew' }, kind: 'apply', project: { name: 'Tidepool', origin: 'https://tidepool.example.com' }, created_at: '2026-10-03T12:00:00.000Z' };
 const LANTERN = { guild: { slug: 'forge-crew', name: 'Forge Crew' }, kind: 'invited', project: { name: 'Lantern Works', origin: 'https://lantern.example.com' }, created_at: '2026-10-02T09:30:00.000Z' };
-const REQUESTED = { ok: true, status: 200, body: { ok: true, status: 'requested', message: 'Requested access. The project’s owner admits new builders.' } };
+const REQUESTED = { ok: true, status: 200, body: { ok: true, status: 'requested', message: 'Applied. The project’s owner admits new builders.' } };
 
-function boot({ answers = [] } = {}) {
+function boot({ answers = [], read = true } = {}) {
   const ids = new Map();
-  for (const id of ['mineInvites', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
-  ids.get('mineInvites').hidden = true;
+  for (const id of ['invitesNone', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList']) ids.set(id, el(id === 'invitesNone' ? 'p' : 'ul'));
+  ids.get('invitesNone').hidden = true;
   const requests = [];
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
@@ -98,21 +99,22 @@ function boot({ answers = [] } = {}) {
     document, fetch, console, Promise, JSON, String, Object, Array, URL,
     $: (id) => ids.get(id) || null,
     API: '/api/bongos',
-    appliedOrigins: {}, mineOrigins: {},
     hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase(),
     safeHttpUrl: (raw) => { try { const u = new URL(String(raw)); return (u.protocol === 'https:' || u.protocol === 'http:') ? u.href : ''; } catch (e) { return ''; } },
     jsonOrEmpty: (res) => res.json().catch(() => ({})),
     apiError: (data, status) => { const e = (data && data.error) || {}; return { code: e.code || ('http_' + status), message: e.message || '' }; },
   };
   vm.createContext(sandbox);
-  vm.runInContext(RELAY, sandbox, { filename: 'projects.html#join-relay' });
-  vm.runInContext(REGION, sandbox, { filename: 'projects.html#mine-rows' });
+  vm.runInContext(RELAY, sandbox, { filename: 'invitations.html#join-relay' });
+  vm.runInContext(REGION, sandbox, { filename: 'invitations.html#rows' });
+  // the renders below run as if loadInvites had answered; its own test reads the flag flip
+  if (read) sandbox.invitesRead = true;
   const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
   const cards = () => ids.get('engageList').children;
   const part = (card, cls) => card.querySelector('.' + cls);
   const button = (card, cls) => part(card, 'mineRow__actions').children.find((b) => String(b.className).split(' ').includes(cls));
   const click = async (b) => { for (const f of b._on.click || []) f({}); await settle(); };
-  return { sandbox, ids, requests, settle, cards, part, button, click, section: () => ids.get('mineInvites') };
+  return { sandbox, ids, requests, settle, cards, part, button, click, none: () => ids.get('invitesNone') };
 }
 
 // ── drawing the cards ────────────────────────────────────────────────────────
@@ -127,12 +129,12 @@ test('the two kinds draw as two plain sentences, with the project’s host, a hi
   assert.equal(ui.part(a, 'mineRow__host').textContent, 'tidepool.example.com');
   assert.equal(ui.part(a, 'mineRow__hint').textContent, 'You apply as yourself — add a note for the owner if you like.');
   assert.equal(a.className, 'mineRow engageRow');
-  assert.equal(ui.button(a, 'btn').textContent, 'Apply');
+  assert.equal(ui.button(a, 'btn').textContent, 'Apply to join', 'the join field’s word for the same relay, on the same page');
   assert.equal(ui.button(a, 'linklike').textContent, 'Add a note');
   assert.equal(ui.part(a, 'mineJoinNote').hidden, true, 'the note waits behind "Add a note"');
   assert.equal(ui.part(a, 'mineJoinNote').maxLength, 400, 'the join note’s own limit');
   assert.equal(ui.part(a, 'projMsg').getAttribute('role'), 'status');
-  assert.equal(ui.section().hidden, false, 'guild cards alone show the Invitations section');
+  assert.equal(ui.none().hidden, true, 'guild cards alone: the page does not say nothing is waiting');
 });
 
 test('a row the page cannot act on is dropped, never drawn with a button that fails', () => {
@@ -146,49 +148,52 @@ test('a row the page cannot act on is dropped, never drawn with a button that fa
     null,
   ]);
   assert.equal(ui.cards().length, 0);
-  assert.equal(ui.section().hidden, true, 'nothing to show: the section hides');
+  assert.equal(ui.none().hidden, false, 'nothing to show: the page says so in one line');
 });
 
-test('the section shows while EITHER list has a row, and a decline that empties both hides it', async () => {
+test('the empty line stays down while EITHER list has a row, and a decline that empties both puts it up', async () => {
   const ui = boot({ answers: [{ ok: true, status: 200, body: { ok: true } }] });
   ui.sandbox.renderInvitesList([{ client_id: 'cb-grove', name: 'The Grove', origin: 'https://grove.example.com' }]);
   ui.sandbox.renderEngagements([]);
-  assert.equal(ui.section().hidden, false, 'a project’s own invite alone');
+  assert.equal(ui.none().hidden, true, 'a project’s own invite alone');
   ui.sandbox.renderEngagements([TIDEPOOL]);
   ui.sandbox.renderInvitesList([]);
-  assert.equal(ui.section().hidden, false, 'guild cards alone');
+  assert.equal(ui.none().hidden, true, 'guild cards alone');
   ui.sandbox.renderEngagements([]);
-  assert.equal(ui.section().hidden, true, 'neither');
+  assert.equal(ui.none().hidden, false, 'neither');
 
   ui.sandbox.renderInvitesList([{ client_id: 'cb-grove', name: 'The Grove', origin: 'https://grove.example.com' }]);
   const row = ui.ids.get('invitesList').children[0];
   const decline = row.querySelector('.mineRow__actions').children.find((b) => b.textContent === 'Decline');
   await ui.click(decline);
   assert.equal(ui.ids.get('invitesList').children.length, 0);
-  assert.equal(ui.section().hidden, true, 'the last decline hides it when there is no guild card either');
+  assert.equal(ui.none().hidden, false, 'the last decline puts it up when there is no guild card either');
 });
 
-test('loadInvites reads both lists, and a guild read that fails is silent', async () => {
-  const ui = boot({ answers: [
+test('loadInvites reads both lists, a guild read that fails is silent, and the empty line waits for every answer', async () => {
+  const ui = boot({ read: false, answers: [
     (url) => (url.endsWith('/my-projects/invites') ? { ok: true, status: 200, body: { invites: [] } } : { ok: false, status: 500, body: {} }),
     (url) => (url.endsWith('/my-projects/invites') ? { ok: true, status: 200, body: { invites: [] } } : { ok: false, status: 500, body: {} }),
   ] });
+  ui.sandbox.renderInvitesList([]);
+  assert.equal(ui.none().hidden, true, 'no "nothing waiting" line before the reads have answered');
   await ui.sandbox.loadInvites();
   await ui.settle();
   assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(),
     ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/me/guild-requests', 'GET /api/bongos/my-projects/invites']);
   for (const r of ui.requests) assert.equal(r.credentials, 'same-origin', 'own-scope reads, on the cookie session');
   assert.equal(ui.cards().length, 0);
-  assert.equal(ui.section().hidden, true);
+  assert.equal(ui.sandbox.invitesRead, true);
+  assert.equal(ui.none().hidden, false, 'every read answered, nothing in any list');
 
-  const ok = boot({ answers: [
+  const ok = boot({ read: false, answers: [
     (url) => (url.endsWith('/me/guild-engagements') ? { ok: true, status: 200, body: { engagements: [TIDEPOOL], count: 1 } } : { ok: true, status: 200, body: { invites: [] } }),
     (url) => (url.endsWith('/me/guild-engagements') ? { ok: true, status: 200, body: { engagements: [TIDEPOOL], count: 1 } } : { ok: true, status: 200, body: { invites: [] } }),
   ] });
   await ok.sandbox.loadInvites();
   await ok.settle();
   assert.equal(ok.cards().length, 1);
-  assert.equal(ok.section().hidden, false);
+  assert.equal(ok.none().hidden, true);
 });
 
 // ── applying ─────────────────────────────────────────────────────────────────
@@ -219,7 +224,7 @@ test('"Add a note" opens the card’s own note, and the note rides along, trimme
   assert.deepEqual(ui.requests[0].body, { origin: 'https://tidepool.example.com', note: 'I like the boring parts too.', guild: 'forge-crew' });
 });
 
-test('requested is the one answer that reads as applied: the button says so and stays down, and the map learns it too', async () => {
+test('requested is the one answer that reads as applied: the button says so and stays down', async () => {
   const ui = boot({ answers: [REQUESTED] });
   ui.sandbox.renderEngagements([TIDEPOOL]);
   const card = ui.cards()[0];
@@ -231,8 +236,8 @@ test('requested is the one answer that reads as applied: the button says so and
   assert.equal(ui.part(card, 'mineJoinNote').hidden, true, 'a sent note is not offered again');
   assert.equal(ui.part(card, 'mineRow__hint').hidden, true, 'nor is the hint about one');
   assert.equal(ui.part(card, 'projMsg').className, 'projMsg ok');
-  assert.equal(ui.part(card, 'projMsg').textContent, 'Requested access. The project’s owner admits new builders.', 'the relay’s own words');
-  assert.equal(ui.sandbox.appliedOrigins['tidepool.example.com'], true, 'the map’s Apply reads the same echo');
+  assert.equal(ui.part(card, 'projMsg').textContent, 'Applied. The project’s owner admits new builders.', 'the relay’s own words');
+  assert.doesNotMatch(RELAY, /appliedOrigins/, 'this page has no map, so its relay keeps no Applied echo');
 });
 
 test('409 guild_engagement_gone: the guild application has ended, the plain application is offered, and it sends no guild', async () => {
@@ -241,9 +246,8 @@ test('409 guild_engagement_gone: the guild application has ended, the plain appl
   const card = ui.cards()[0];
   await ui.click(ui.button(card, 'btn'));
   assert.equal(ui.part(card, 'projMsg').textContent, 'That guild application has ended — you can still apply on your own.');
-  assert.equal(ui.button(card, 'btn').textContent, 'Apply on my own');
+  assert.equal(ui.button(card, 'btn').textContent, 'Apply to join on my own');
   assert.equal(ui.button(card, 'btn').disabled, false);
-  assert.equal(ui.sandbox.appliedOrigins['lantern.example.com'], undefined, 'nothing was relayed, so nothing reads as applied');
 
   await ui.click(ui.button(card, 'btn'));
   assert.deepEqual(ui.requests[1].body, { origin: 'https://lantern.example.com' }, 'on your own means no guild');
@@ -261,7 +265,7 @@ test('the relay’s other answers are said in its own words, and the card stays
   await ui.click(ui.button(card, 'btn'));
   assert.equal(ui.part(card, 'projMsg').className, 'projMsg', 'the door’s answer, not an error');
   assert.match(ui.part(card, 'projMsg').textContent, /invite-only/);
-  assert.equal(ui.button(card, 'btn').textContent, 'Apply');
+  assert.equal(ui.button(card, 'btn').textContent, 'Apply to join');
   assert.equal(ui.button(card, 'btn').disabled, false);
   await ui.click(ui.button(card, 'btn'));
   assert.equal(ui.part(card, 'projMsg').className, 'projMsg err');
@@ -279,7 +283,7 @@ test('an expired session offers a way back in, built from elements; a dead netwo
   assert.equal(msg.className, 'projMsg err');
   assert.equal(msg.textContent, 'Your session expired — sign in again.');
   const link = msg.children.find((c) => c.tag === 'a');
-  assert.equal(link.href, '/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine&repos=1', 'back to this view, with the repo scope every hub sign-in carries');
+  assert.equal(link.href, '/api/bongos/auth/web/start?return=/invitations&repos=1', 'back to this page, with the repo scope every hub sign-in carries');
   assert.equal(ui.button(card, 'btn').disabled, false);
   await ui.click(ui.button(card, 'btn'));
   assert.equal(msg.textContent, 'Couldn’t reach the platform — check your connection and try again.');
@@ -287,20 +291,20 @@ test('an expired session offers a way back in, built from elements; a dead netwo
 
 // ── the markup, the region's rules, the kit ──────────────────────────────────
 
-test('the cards are a real list inside the Invitations section, built with createElement / textContent only', () => {
-  const section = (HUB.match(/<section id="mineInvites" hidden aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
+test('the cards are a real list inside the invitations section, built with createElement / textContent only', () => {
+  const section = (HUB.match(/<section id="mineInvites" aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
   assert.match(section, /<ul class="mineRows" id="invitesList"><\/ul>/);
   assert.match(section, /<ul class="mineRows" id="engageList"><\/ul>/, 'ships as real markup the script only fills');
   assert.doesNotMatch(CARDS, /innerHTML|insertAdjacentHTML|outerHTML/, 'no markup built from strings');
-  assert.match(SCRIPT, /if \(v === 'mine' && me\) \{ refreshList\(\); loadMemberships\(\); loadInvites\(\); \}/, 'the mine view re-reads both lists on entry, through loadInvites');
+  assert.match(SCRIPT, /bar\.ready\.then\(function \(me\) \{[\s\S]*?loadInvites\(\);/, 'signed in, the page reads every list through loadInvites');
   const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
   assert.match(COSMOS, /\.mineRows:not\(:empty\)~\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between any two lists that have rows');
   assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>')), /engageRow/, 'styled in cosmos.css, not in the page head');
 });
 
 test('the kit pictures the cards and the stub answers the read and the guild on the join', () => {
-  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
-  assert.ok(states['in-mine-engagements'] && states['in-mine-engagement-applied'], 'two kit states: the cards, and one applied');
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'invitations.states.json'), 'utf8')).states;
+  assert.ok(states['in-engagements'] && states['in-engagement-applied'], 'two kit states: the cards, and one applied');
   const serve = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
   assert.match(serve, /'\/me\/guild-engagements': 'me__guild-engagements'/);
   assert.match(serve, /refuse\(res, 409, 'guild_engagement_gone'/, 'the stub refuses a guild with no engagement, as the route does');

package/tests/hub_guild_cards.mjs

@@ -1,6 +1,7 @@
 // tests/hub_guild_cards.mjs — a guild's invite to you and a join request to a guild
-// you own, in /projects?view=mine's Invitations, EXECUTED (task 1004583; ADR 0336
-// D3/D4 §3, ADR 0337 D4.4).
+// you own, on the hub's /invitations page, EXECUTED (task 1004583; ADR 0336
+// D3/D4 §3, ADR 0337 D4.4). Under /projects?view=mine until task 1004276 gave the
+// invitations a page of their own.
 //
 // R24 (task 1002300) shipped the routes — GET /me/guild-requests, POST
 // /guild-requests/:id/accept|decline, GET /guilds/:slug/requests — and nothing in
@@ -16,8 +17,8 @@
 //     guild as it is now, and the next accept sends that
 //   • an ended invite or request leaves nothing pressable; an expired session and a
 //     dead network are said as such, and the card stays re-tryable
-//   • Decline is a body-less POST whose 204 drops the row (the section hides with
-//     its last row); a failure keeps the row and says so
+//   • Decline is a body-less POST whose 204 drops the row (the page's empty line
+//     comes up with the last row); a failure keeps the row and says so
 //   • the owner's card names who asked, with the handle once, and accepts with no
 //     body — the requester's switch rode their request
 //   • ONE read feeds both lists — GET /me/guild-requests's incoming and
@@ -26,7 +27,7 @@
 //   • textContent / createElement only
 //
 // The idiom is tests/hub_engagement_cards.mjs: lift the region out of
-// projects.html, run it in a node:vm under a DOM stub, drive real clicks, and
+// invitations.html, run it in a node:vm under a DOM stub, drive real clicks, and
 // assert the slice boundaries so a rename can never leave this executing nothing.
 //
 // DB-free. Run:  node --test tests/hub_guild_cards.mjs
@@ -40,7 +41,7 @@ import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
-const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const HUB = fs.readFileSync(path.join(LANDING, 'invitations.html'), 'utf8').replace(/\r\n/g, '\n');
 const GUILD_PAGE = fs.readFileSync(path.join(LANDING, 'guild.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
@@ -88,8 +89,8 @@ const GONE = { ok: false, status: 204, body: undefined };
 
 function boot({ answers = [] } = {}) {
   const ids = new Map();
-  for (const id of ['mineInvites', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
-  ids.get('mineInvites').hidden = true;
+  for (const id of ['invitesNone', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList']) ids.set(id, el(id === 'invitesNone' ? 'p' : 'ul'));
+  ids.get('invitesNone').hidden = true;
   const requests = [];
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
@@ -110,7 +111,8 @@ function boot({ answers = [] } = {}) {
     apiError: (data, status) => { const e = (data && data.error) || {}; return { code: e.code || ('http_' + status), message: e.message || '', details: e.details || e || {} }; },
   };
   vm.createContext(sandbox);
-  vm.runInContext(REGION, sandbox, { filename: 'projects.html#mine-rows' });
+  vm.runInContext(REGION, sandbox, { filename: 'invitations.html#rows' });
+  sandbox.invitesRead = true; // as if loadInvites had answered: the empty line may show
   const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
   const invites = () => ids.get('guildInviteList').children;
   const asks = () => ids.get('guildRequestList').children;
@@ -125,7 +127,7 @@ function boot({ answers = [] } = {}) {
     for (const f of radios(card).find((r) => r.value === value)._on.change || []) f({});
     await settle();
   };
-  return { sandbox, ids, requests, settle, invites, asks, part, actions, button, radios, msg, click, pick, section: () => ids.get('mineInvites') };
+  return { sandbox, ids, requests, settle, invites, asks, part, actions, button, radios, msg, click, pick, none: () => ids.get('invitesNone') };
 }
 
 // ── the D4.4 notice: one sentence on two pages ───────────────────────────────
@@ -151,7 +153,7 @@ test('an invite card says what joining shows, offers the switch set to count, an
   const ui = boot();
   ui.sandbox.renderGuildInvites([OPEN_HANDS, QUIET_ROOM]);
   assert.equal(ui.requests.length, 0, 'drawing sends nothing');
-  assert.equal(ui.section().hidden, false);
+  assert.equal(ui.none().hidden, true, 'something is waiting');
   const [open, quiet] = ui.invites();
   assert.equal(ui.part(open, 'mineRow__name').textContent, 'You’re invited to join Open Hands');
   assert.equal(ui.part(open, 'guildRow__desc').textContent, 'A newer guild for first-time builders.');
@@ -253,7 +255,7 @@ test('an ended invite leaves nothing pressable; an expired session offers a way
   await out.click(out.button(card, 'Accept'));
   const a = out.msg(card).children.find((c) => c.tag === 'a');
   assert.ok(a, 'a sign-in link, built as an element');
-  assert.equal(a.href, '/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine&repos=1');
+  assert.equal(a.href, '/api/bongos/auth/web/start?return=/invitations&repos=1');
   assert.equal(out.button(card, 'Accept').disabled, false);
   await out.click(out.button(card, 'Accept'));
   assert.equal(out.msg(card).textContent, 'Couldn’t reach the platform — check your connection and try again.');
@@ -270,14 +272,14 @@ test('Decline is a body-less POST whose 204 drops the row, and the last one hide
   assert.equal(ui.requests[0].method, 'POST');
   assert.equal(ui.requests[0].body, undefined, 'nothing to send');
   assert.equal(ui.invites().length, 0);
-  assert.equal(ui.section().hidden, false, 'the owner’s card still stands');
+  assert.equal(ui.none().hidden, true, 'the owner’s card still stands');
   const ask = ui.asks()[0];
   await ui.click(ui.button(ask, 'Decline'));
   assert.equal(ui.asks().length, 1, 'kept on a failure');
   assert.equal(ui.msg(ask).textContent, 'Couldn’t decline just now — try again in a moment.');
   assert.equal(ui.button(ask, 'Decline').disabled, false);
   ui.sandbox.renderGuildRequests([]);
-  assert.equal(ui.section().hidden, true, 'no row in any list hides the section');
+  assert.equal(ui.none().hidden, false, 'no row in any list: the page says nothing is waiting');
 });
 
 // ── the owner's card ─────────────────────────────────────────────────────────
@@ -333,13 +335,13 @@ test('ONE read feeds both lists — the invites to you and the requests to every
   assert.doesNotMatch(CARDS, /\/me\/guilds'|\/requests'/, 'no per-guild queue read anywhere in the cards');
 });
 
-test('a failed or empty read is silent: no cards, and the section stays hidden', async () => {
+test('a failed or empty read is silent: no cards, only the page’s own empty line', async () => {
   for (const answer of [{ ok: false, status: 500, body: {} }, { reject: true }, { ok: true, status: 200, body: {} }]) {
     const ui = boot({ answers: [answer] });
     await ui.sandbox.loadGuildQueue();
     await ui.settle();
     assert.equal(ui.invites().length + ui.asks().length, 0);
-    assert.equal(ui.section().hidden, true);
+    assert.equal(ui.none().hidden, false);
   }
 });
 
@@ -359,13 +361,13 @@ test('a row the page cannot answer is dropped, never drawn with a button that fa
 
 // ── the markup, the region's rules, the kit ──────────────────────────────────
 
-test('the cards are real lists in the Invitations section, built with createElement / textContent only', () => {
-  const section = (HUB.match(/<section id="mineInvites" hidden aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
+test('the cards are real lists in the invitations section, built with createElement / textContent only', () => {
+  const section = (HUB.match(/<section id="mineInvites" aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
   const order = ['invitesList', 'guildInviteList', 'engageList', 'guildRequestList'].map((id) => section.indexOf(`<ul class="mineRows" id="${id}"></ul>`));
   assert.ok(order.every((i) => i > 0), 'each list ships as real markup the script only fills');
   assert.deepEqual([...order].sort((a, b) => a - b), order, 'invites to you first, the requests to your guilds last');
   assert.doesNotMatch(CARDS, /innerHTML|insertAdjacentHTML|outerHTML/);
-  assert.match(REGION, /function loadInvites\(\) \{[\s\S]*?loadEngagements\(\),\s*loadGuildQueue\(\)\s*\]\);/, 'the mine view reads them with the other invitations');
+  assert.match(REGION, /function loadInvites\(\) \{[\s\S]*?loadEngagements\(\),\s*loadGuildQueue\(\)\s*\]\)/, 'the page reads them with the other invitations');
   const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
   for (const rule of ['.guildCount__opts{', '.guildCount__opt:has(input:checked) b::before{', '.guildCount__opt:focus-within{', '.guildRow--invite .mineRow__actions{align-self:flex-end;}']) {
     assert.ok(COSMOS.includes(rule), `cosmos.css carries ${rule}`);
@@ -374,9 +376,9 @@ test('the cards are real lists in the Invitations section, built with createElem
 });
 
 test('the kit pictures the cards, and the stub answers the four calls as the routes do', () => {
-  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
-  for (const s of ['in-mine-guild-cards', 'in-mine-guild-count-off', 'in-mine-guild-joined']) assert.ok(states[s], `kit state ${s}`);
-  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes.map((p) => p.name);
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'invitations.states.json'), 'utf8')).states;
+  for (const s of ['in-guild-cards', 'in-guild-count-off', 'in-guild-joined']) assert.ok(states[s], `kit state ${s}`);
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'invitations.probes.json'), 'utf8')).probes.map((p) => p.name);
   assert.ok(probes.some((n) => /guild invite/.test(n)) && probes.some((n) => /join request/.test(n)), 'probes drive both cards');
   const serve = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
   assert.match(serve, /rest === '\/me\/guild-requests' && req\.method === 'GET'\) return AUTH \? myGuildRequests\(res\)/);