@bongos/core 1.21.74 → 1.21.76

package/modules/public-landing/public/assets/artist-review.js

@@ -0,0 +1,107 @@
+/* assets/artist-review.js — THE ARTIST REVIEW BUTTON on the public site (task
+   1004499, goal 1000095 WA6; owner decisions 2026-10-04).
+
+   A signed-in builder looking at a live public page (the landing, /projects,
+   /account and the footer pages) writes UI feedback about it without leaving it.
+   The button sits in the hub bar beside the identity chip and opens the hall's
+   own feedback panel (modules/hall-ui/public/page-notes.js, the Artistry
+   palette), so a review written here is the same doc as one written in the hall:
+   split by an AI into ideas filed under the reviewer, and kept as that page's
+   design reference. Its page id is site:<page>; the Studio lists them.
+
+   Signed out there is no button: GET /me answers 401 and nothing is drawn. Any
+   signed-in builder sees it, in any craft mode — the button is cosmetic, the
+   panel's routes hold the walls (ADR 0016).
+
+   The page names the hall's origin on this tag (data-hall="{{buildersOrigin}}",
+   stamped server-side), so the ideas the panel links to open in the hall, which
+   on the hub is another host. A ?note=N link opens that doc in place. */
+(function () {
+  'use strict';
+  var PANEL = '/modules/hall-ui/public/';
+  // The hall palette's own icon (craft-mode.js ICONS.artistry), built as nodes:
+  // this surface writes no innerHTML.
+  var SVG_NS = 'http://www.w3.org/2000/svg';
+  var ICON_PATHS = [
+    ['M8 2a6 6 0 1 0 0 12c.9 0 1.4-.6 1.4-1.3 0-.8-.6-1-.6-1.7 0-.6.5-1 1.2-1h1.6A2.4 2.4 0 0 0 14 7.6C14 4.5 11.3 2 8 2Z', null],
+    ['M5 6.2h.01M7.6 4.6h.01M10.4 5.2h.01M4.6 9h.01', '2.2'],
+  ];
+  function icon() {
+    var svg = document.createElementNS(SVG_NS, 'svg');
+    [['viewBox', '0 0 16 16'], ['fill', 'none'], ['stroke', 'currentColor'], ['stroke-width', '1.4'], ['stroke-linecap', 'round'], ['stroke-linejoin', 'round'], ['aria-hidden', 'true']]
+      .forEach(function (a) { svg.setAttribute(a[0], a[1]); });
+    ICON_PATHS.forEach(function (p) {
+      var path = document.createElementNS(SVG_NS, 'path');
+      path.setAttribute('d', p[0]);
+      if (p[1]) path.setAttribute('stroke-width', p[1]);
+      svg.appendChild(path);
+    });
+    return svg;
+  }
+  var tag = document.currentScript;
+  var hall = (tag && tag.getAttribute('data-hall')) || '';
+
+  function linkSheet() {
+    if (document.getElementById('arv-sheet')) return;
+    var l = document.createElement('link');
+    l.id = 'arv-sheet';
+    l.rel = 'stylesheet';
+    l.href = PANEL + 'page-notes.css';
+    document.head.appendChild(l);
+  }
+  var loading = null;
+  // The panel learns it is on the public site, and where the hall is, from here.
+  function ready(api) { api.configure({ surface: 'site', hall: hall }); return api; }
+  function loadPanel() {
+    if (window.OTBPageNotes) return Promise.resolve(ready(window.OTBPageNotes));
+    if (loading) return loading;
+    loading = new Promise(function (resolve, reject) {
+      var s = document.createElement('script');
+      s.src = PANEL + 'page-notes.js';
+      s.onload = function () { if (window.OTBPageNotes) resolve(ready(window.OTBPageNotes)); else reject(new Error('panel did not load')); };
+      s.onerror = function () { loading = null; reject(new Error('panel did not load')); };
+      document.head.appendChild(s);
+    });
+    return loading;
+  }
+  // The hall's palette (craft-mode.js TOOLS.artistry) wears the same two names;
+  // the two pages share no script, so tests/artist_review.mjs holds them equal.
+  var LABEL = 'Artist review: write feedback on this page';
+  var SHORT = 'Review';
+  function drawButton() {
+    var bar = document.querySelector('.barRight');
+    if (!bar || document.getElementById('arv-btn')) return null;
+    var b = document.createElement('button');
+    b.type = 'button';
+    b.id = 'arv-btn';
+    b.className = 'arv-btn';
+    b.setAttribute('aria-label', LABEL);
+    b.title = LABEL;
+    var label = document.createElement('span');
+    label.className = 'arv-btn__label';
+    label.textContent = SHORT;
+    b.appendChild(icon());
+    b.appendChild(label);
+    b.addEventListener('click', function () {
+      loadPanel().then(function (api) { api.open(); }, function () { b.setAttribute('aria-disabled', 'true'); });
+    });
+    var who = document.getElementById('who');
+    if (who && who.parentNode === bar) bar.insertBefore(b, who);
+    else bar.appendChild(b);
+    return b;
+  }
+
+  function signedIn(me) {
+    if (!me) return;
+    linkSheet();
+    drawButton();
+    var note = /[?&]note=([1-9]\d{0,17})(?:&|$)/.exec(window.location.search || '');
+    if (note) loadPanel().then(function (api) { api.openNote(note[1]); }, function () { /* the page still works */ });
+  }
+
+  fetch('/api/bongos/me', { method: 'GET', credentials: 'same-origin', headers: { Accept: 'application/json' } })
+    .then(function (r) { return r.ok ? r.json().catch(function () { return null; }) : null; })
+    .then(function (d) { signedIn(d ? (d.builder || d.me || d) : null); }, function () { /* signed out or offline: no button */ });
+
+  window.OTBArtistReview = { signedIn: signedIn };
+})();

package/modules/public-landing/public/contact.html

@@ -120,5 +120,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/guild.html

@@ -629,5 +629,7 @@
   load();
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/index.html

@@ -1261,5 +1261,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
   });
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/invitations.html

@@ -961,5 +961,7 @@
   });
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/privacy.html

@@ -129,5 +129,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/projects.html

@@ -11174,5 +11174,7 @@ summary{min-height:24px;padding:3px 0;}
     .then(loadSelfShipped, loadSelfShipped);
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/terms.html

@@ -134,5 +134,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms" aria-current="page">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/ui-design/kit/serve.js

@@ -439,6 +439,33 @@ function handlePatch(res, body) {
   return json(res, 200, { handle: h, previous_handle: previous || null });
 }
 
+// The page feedback panel's routes (task 1004499: the public site's Artist review
+// button opens modules/hall-ui/public/page-notes.js), so a render can picture the
+// panel open. One draft per page for the run; nothing is ever split or filed.
+// SIMPLIFIED: drafts are keyed by page alone, where the real route keys them by
+// (author, page) — the stub has one fixture builder, so the two agree here.
+const pnDrafts = new Map();
+function pageNotesRoute(req, res, rest, u) {
+  if (!rest.startsWith('/page-notes')) return false;
+  if (!AUTH) { json(res, 401, UNAUTH); return true; }
+  if (rest === '/page-notes/site') { json(res, 200, { notes: [] }); return true; }
+  if (rest === '/page-notes' && req.method === 'GET') { json(res, 200, { page_id: u.searchParams.get('page_id') || '', notes: [] }); return true; }
+  if (rest === '/page-notes' && req.method === 'POST') {
+    readBody(req, (body) => {
+      const key = String(body.page_id || '');
+      if (!pnDrafts.has(key)) pnDrafts.set(key, { id: String(pnDrafts.size + 1), page_id: key, page_path: body.page_path || '/', page_title: body.page_title || '', body_md: '', status: 'draft', idea_ids: [], author_name: 'builder' });
+      json(res, 200, { note: pnDrafts.get(key), images: [] });
+    });
+    return true;
+  }
+  const one = rest.match(/^\/page-notes\/(\d+)$/);
+  if (one && req.method === 'PATCH') {
+    readBody(req, (body) => { for (const n of pnDrafts.values()) if (n.id === one[1]) n.body_md = String(body.body_md || ''); json(res, 200, { ok: true }); });
+    return true;
+  }
+  return false;
+}
+
 // The hub's guild page (task 1002301): GET /guilds/:slug (public), GET /guilds/:slug/members
 // and PATCH /guilds/:slug/membership (own-scope), answered from ONE set of guilds held for the
 // run (guilds.json, or the file a states file's stub.fixtures names), keyed by slug, each with
@@ -661,6 +688,7 @@ const server = http.createServer((req, res) => {
        starter-bundles.js declaration, so the picture the kit renders and the
        payload the route serves cannot drift apart silently. */
     if (rest === '/provisioning/starter-bundles') return json(res, 200, STARTER_BUNDLES_FIXTURE);
+    if (pageNotesRoute(req, res, rest, u)) return;
     if (rest === '/auth/logout') return json(res, 200, { ok: true });
     if (rest.startsWith('/auth/web/start')) { res.writeHead(302, { location: PREFIX }); return res.end(); }
     if (rest === '/instance') { const b = pages.size ? pages.values().next().value.brand : {}; return json(res, 200, { brand: { productName: (b && b.productName) || '', project: {} }, modules: {} }); }
@@ -672,6 +700,10 @@ const server = http.createServer((req, res) => {
     res.writeHead(200, { 'content-type': MIME['.js'], 'cache-control': 'no-store' });
     return res.end(bundle ? fs.readFileSync(bundle, 'utf8') : '/* stub: no client bundle in this checkout */');
   }
+  // an enabled module's browser assets, as serve-internal.js serves them on every host
+  // (task 1004499: the public site loads the hall's feedback panel from here)
+  const modAsset = p.match(/^\/modules\/([a-z][a-z0-9-]*)\/public\/(.+)$/);
+  if (modAsset) { const abs = fileUnder(path.join(ROOT, 'modules', modAsset[1], 'public'), modAsset[2]); if (abs) return sendFile(abs, res); }
   // docs/ raw (a mock's relative links resolve) and the surface dir by its checkout path
   if (p.startsWith('/docs/')) { const abs = fileUnder(DOCS, p.slice('/docs/'.length)); if (abs) return sendFile(abs, res); }
   const relSurface = path.relative(ROOT, DIR).split(path.sep).join('/');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.74",
+  "version": "1.21.76",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.74",
+      "version": "1.21.76",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.74",
+  "version": "1.21.76",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9254,5 +9254,17 @@
       "id": "1004628",
       "text": "Projects now have a Ship mode setting. Auto, the default, means the AI ships finished work on its own. Manual means it asks first. Owners can switch it on the project settings page."
     }
+  ],
+  "1.21.75": [
+    {
+      "id": "1003807",
+      "text": "The module store now only shows modules that are safe and good enough: each must pass the security check, and once it has real-world data it needs a score of at least 50 out of 100. Brand-new modules show with a 'New' label un"
+    }
+  ],
+  "1.21.76": [
+    {
+      "id": "1004499",
+      "text": "Artists can now review the public website while looking at it. A signed-in builder on cloudbongos.com's public pages (home, projects, account, guilds, invitations, privacy, terms, contact) sees a Review button in the top bar,"
+    }
   ]
 }

package/src/bongos/module-listing.js

@@ -0,0 +1,85 @@
+// src/bongos/module-listing.js — which store modules the catalog lists, under the
+// quality floor (task 1003807, criterion wa5-curated-listing, ADR 0343 D2/D5).
+//
+// One module appears once, as its NEWEST published version (semver order), judged by
+// that version's CURRENT score: the newest module_assessment_scores row for it
+// (computed_at DESC, id DESC), whether computed or a Metic+ override (core_265).
+// placeVersion is the whole rule and is pure, so tests drive it directly:
+//
+//   excluded  the Security gate has not passed (false, or not run yet), or the
+//             version has no score row at all. The gate is a hard exclusion (D2).
+//   new       passed the gate but has no real-world data yet (is_new, D5). Listed
+//             with a "New" label and never ranked: the floor does not apply until
+//             it has a real score (owner decision, 2026-10-01).
+//   listed    passed the gate and its overall score is at least the floor.
+//   excluded  otherwise: scored below the floor, or no overall to compare.
+//
+// A delisted module (ADR 0338 D2) is never in the catalog, whatever its score.
+
+const { parseVersion, cmp } = require('../module-loader/semver');
+
+// The quality floor, 0-100. It lives here and nowhere else: it is part of Bongos
+// itself, not a live setting, so no author, builder or instance can move it.
+// Changing it is an owner-approved, reviewed task (owner decision, 2026-10-01).
+// Authors read the rule in docs/modules-contract.md ("Getting listed").
+const QUALITY_FLOOR = 50;
+
+// Where one version stands. `score` is its current score row, or null.
+// Returns { placement: 'listed' | 'new' | 'excluded', reason }.
+function placeVersion(score, floor = QUALITY_FLOOR) {
+  if (!score) return { placement: 'excluded', reason: 'not_assessed' };
+  if (score.security_passed !== true) return { placement: 'excluded', reason: 'security_not_passed' };
+  if (score.is_new) return { placement: 'new', reason: 'new' };
+  if (score.overall == null) return { placement: 'excluded', reason: 'no_score' };
+  if (score.overall < floor) return { placement: 'excluded', reason: 'below_floor' };
+  return { placement: 'listed', reason: 'at_or_above_floor' };
+}
+
+// The newest version row per module key, in semver order (a version that does not
+// parse is skipped, as latestVersions does in module-store.js).
+function newestPerModule(rows) {
+  const out = new Map();
+  for (const r of rows) {
+    const next = parseVersion(r.version);
+    if (!next) continue;
+    const have = out.get(r.module_key);
+    if (have && cmp(parseVersion(have.version), next) >= 0) continue;
+    out.set(r.module_key, r);
+  }
+  return [...out.values()];
+}
+
+// The catalog: { floor, listed: [...], new: [...] }, each entry
+// { key, title, version, published_at, overall, is_new }. Excluded versions are left
+// out entirely: a module below the bar is not listed at all. Both lists are in key
+// order; ranking is a separate task (1003808) and does not happen here.
+async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: versions } = await pool.query(
+    `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
+       FROM store_modules m JOIN store_module_versions v ON v.module_key = m.module_key
+      WHERE m.status = 'listed'`);
+  const newest = newestPerModule(versions);
+  const scores = new Map();
+  if (newest.length) {
+    const { rows } = await pool.query(
+      `SELECT DISTINCT ON (version_id) version_id, overall, security_passed, is_new
+         FROM module_assessment_scores
+        WHERE version_id = ANY($1)
+        ORDER BY version_id, computed_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
+    for (const s of rows) scores.set(String(s.version_id), s);
+  }
+  const out = { floor, listed: [], new: [] };
+  for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
+    const score = scores.get(String(r.version_id)) || null;
+    const { placement } = placeVersion(score, floor);
+    if (placement === 'excluded') continue;
+    out[placement].push({
+      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
+      overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
+    });
+  }
+  return out;
+}
+
+module.exports = { QUALITY_FLOOR, placeVersion, listCatalog };

package/src/bongos/routes/modules.js

@@ -97,6 +97,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
+const { listCatalog } = require('../module-listing');
 
 // A packaged submission embeds every file's content (base64) — cap the total
 // so a runaway/misbuilt module can't bloat the review-queue table. Generous
@@ -692,6 +693,20 @@ module.exports = function buildModulesRouter() {
       res.json({ latest });
     }));
 
+  // The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each
+  // listed module's newest version, if it passed the Security gate and scores at or
+  // above the floor, or under "new" if it has no real-world data yet. Below the bar
+  // is not listed at all. The floor is fixed in module-listing.js and returned here.
+  //
+  // rank: any-builder — a read of public store metadata, like /store/modules/latest:
+  // no entitlement taken, nothing changed.
+  router.get('/store/modules', auth.requireBuilder,
+    asyncHandler('GET /store/modules', async (_req, res) => {
+      const listing = await listCatalog();
+      res.set('Cache-Control', 'no-store');
+      res.json(listing);
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.74'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.76'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/artist_review.mjs

@@ -0,0 +1,231 @@
+// tests/artist_review.mjs — the Artist review button on the public site (task
+// 1004499, goal 1000095 WA6). Owner decisions 2026-10-04: the public pages plus
+// the Studio; any signed-in builder sees it; it sits in the hub bar; the
+// reviews are listed in the Studio.
+//
+// Four altitudes: the pure rules (a site doc is read in the Studio), the SQL,
+// the route over a stubbed db through real HTTP, and the browser half — the
+// REAL artist-review.js drawing the button (or nothing) and loading the REAL
+// page-notes.js, whose page id and idea links follow the public surface.
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const N = require('../modules/page-notes/notes.js');
+const LOADER = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/assets/artist-review.js'), 'utf8');
+const NOTES = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/page-notes.js'), 'utf8');
+const realListForSurface = require('../modules/page-notes/db.js').listForSurface;
+const PAGES = ['index', 'projects', 'account', 'privacy', 'terms', 'contact', 'guild', 'invitations'];
+
+// ---------- pure ----------
+
+test('a site doc is read in the Studio; a hall doc still on its own page', () => {
+  assert.equal(N.noteLink({ id: '5', page_id: 'site:projects', page_path: '/projects' }), '/builders/studio?note=5');
+  assert.equal(N.noteLink({ id: '6', page_id: 'builders:studio', page_path: '/studio' }), '/studio?note=6');
+  assert.equal(N.isSiteNote({ page_id: 'site:home' }), true);
+  assert.equal(N.isSiteNote({ page_id: 'builders:site' }), false, 'the surface, not a page named site');
+  assert.equal(N.normalizeDraft({ page_id: 'site:home', page_path: '/' }).ok, true, 'the site surface is a valid page id');
+  const body = N.ideaBody({ body: 'The hero is too dark.' }, { id: '5', page_id: 'site:home', page_title: 'Home' }, 'Ana');
+  assert.match(body, /Full reference doc: \[Home feedback\]\(\/builders\/studio\?note=5\)$/, 'every idea it becomes links into the hall');
+});
+
+test('the Studio list row: counts the ideas, carries the link, never the body', () => {
+  const r = N.siteListItem({ id: 9, page_id: 'site:terms', page_path: '/terms', page_title: 'Terms', status: 'filed', submitted_at: 't', idea_ids: [1, 2, 3], author_name: 'Bo', excerpt: 'x', body_md: 'SECRET' });
+  assert.deepEqual(r, { id: '9', page_id: 'site:terms', page_path: '/terms', page_title: 'Terms', status: 'filed', submitted_at: 't', idea_count: 3, author_name: 'Bo', excerpt: 'x', link: '/builders/studio?note=9' });
+});
+
+// ---------- SQL ----------
+
+test('listForSurface reads submitted docs on that surface only, newest first', async () => {
+  let seen = null;
+  await realListForSurface('site', { limit: 20 }, async (text, params) => { seen = { text, params }; return { rows: [] }; });
+  assert.deepEqual(seen.params, ['site:%', 20]);
+  assert.match(seen.text, /n\.page_id LIKE \$1 AND n\.status <> 'draft'/);
+  assert.match(seen.text, /ORDER BY n\.submitted_at DESC/);
+  assert.doesNotMatch(seen.text, /\bn\.body_md\b(?!,)/, 'only an excerpt leaves the table');
+});
+
+// ---------- the route ----------
+
+const db = require('../modules/page-notes/db.js');
+const api = require('../src/module-api.js');
+let viewer = { id: 9, rank: 'thetes' };
+let asked = null;
+db.listForSurface = async (surface, opts) => {
+  asked = { surface, opts };
+  return [{ id: 41, page_id: 'site:projects', page_path: '/projects', page_title: 'Projects', status: 'filed', submitted_at: '2026-10-04', idea_ids: [7], author_name: 'Ana', excerpt: 'Labels overlap.' }];
+};
+db.getNote = async () => null;
+api.requireBuilder = (req, res, next) => { if (!viewer) return res.status(401).json({ error: { code: 'unauthenticated' } }); req.builder = viewer; next(); };
+const express = require('express');
+const app = express();
+app.use((req, res, next) => { res.fail = (code, s) => res.status(typeof s === 'number' ? s : 400).json({ error: { code } }); next(); });
+app.use(express.json());
+app.use('/api/bongos', require('../modules/page-notes/routes/page-notes.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+test.after(() => server.close());
+const get = (p) => new Promise((resolve, reject) => {
+  http.get(`http://127.0.0.1:${server.address().port}/api/bongos${p}`, (res) => {
+    let s = '';
+    res.on('data', (c) => { s += c; });
+    res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(s || 'null'), headers: res.headers }));
+  }).on('error', reject);
+});
+
+test('GET /page-notes/site: any signed-in builder reads the list; a visitor nothing', async () => {
+  viewer = { id: 9, rank: 'thetes' };
+  const r = await get('/page-notes/site');
+  assert.equal(r.status, 200, 'answered by the list, never read as doc id "site"');
+  assert.deepEqual(asked, { surface: 'site', opts: { limit: 20 } });
+  assert.equal(r.headers['cache-control'], 'no-store');
+  assert.deepEqual(r.body.notes.map((n) => [n.id, n.idea_count, n.link]), [['41', 1, '/builders/studio?note=41']]);
+  viewer = null;
+  assert.equal((await get('/page-notes/site')).status, 401);
+});
+
+// ---------- the browser half ----------
+
+function el(tag, id, cls) {
+  const attrs = {};
+  const listeners = {};
+  const e = {
+    tagName: tag, id: id || '', className: cls || '', children: [], parentNode: null, innerHTML: '', title: '', type: '', src: '', href: '', rel: '',
+    dataset: {},
+    setAttribute(k, v) { attrs[k] = String(v); if (k.startsWith('data-')) e.dataset[k.slice(5).replace(/-(\w)/g, (_m, c) => c.toUpperCase())] = String(v); },
+    getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    appendChild(c) { c.parentNode = e; e.children.push(c); if (e.onAppend) e.onAppend(c); return c; },
+    insertBefore(c, ref) { c.parentNode = e; const at = e.children.indexOf(ref); if (at === -1) e.children.push(c); else e.children.splice(at, 0, c); return c; },
+    addEventListener(t, fn) { (listeners[t] ||= []).push(fn); },
+    click() { (listeners.click || []).forEach((fn) => fn({ target: e })); },
+  };
+  return e;
+}
+const tree = (r) => r.children.flatMap((c) => [c, ...tree(c)]);
+const flush = async () => { for (let i = 0; i < 6; i++) await new Promise((r) => setTimeout(r, 0)); };
+
+function bootSite({ me = { builder: { id: 9, github_login: 'ana' } }, search = '', pathname = '/projects', hall = 'https://builders.example.com' } = {}) {
+  const body = el('BODY');
+  const head = el('HEAD');
+  const bar = body.appendChild(el('DIV', '', 'barRight'));
+  bar.appendChild(el('BUTTON', 'projTrig', 'trig'));
+  const who = bar.appendChild(el('BUTTON', 'who', 'trig who'));
+  const script = el('SCRIPT');
+  script.setAttribute('data-hall', hall);
+  const fetched = [];
+  const loaded = [];
+  const opened = [];
+  const configured = [];
+  const all = () => [head, body, ...tree(head), ...tree(body)];
+  const document = {
+    body, head, currentScript: script, title: 'Projects — Example',
+    getElementById: (id) => all().find((n) => n.id === id) || null,
+    querySelector: (sel) => (sel === '.barRight' ? bar : null),
+    createElement: (t) => el(t.toUpperCase()),
+    createElementNS: (_ns, t) => el(t),
+  };
+  const window = { location: { search, pathname }, document };
+  head.onAppend = (tag) => {
+    if (tag.tagName !== 'SCRIPT') return;
+    loaded.push(tag.src);
+    window.OTBPageNotes = { configure: (c) => configured.push(JSON.parse(JSON.stringify(c))), open: () => opened.push('open'), openNote: (id) => opened.push('note ' + id) };
+    tag.onload();
+  };
+  const fetch = async (url, opts) => {
+    fetched.push([url, opts.credentials]);
+    return me ? { ok: true, json: async () => me } : { ok: false, status: 401, json: async () => ({}) };
+  };
+  const sandbox = { window, document, fetch, Promise, setTimeout };
+  vm.createContext(sandbox);
+  vm.runInContext(LOADER, sandbox, { filename: 'artist-review.js' });
+  return { window, document, body, head, bar, who, fetched, loaded, opened, configured, sandbox };
+}
+
+test('SIGNED OUT: no button, no sheet, no panel — the page is untouched', async () => {
+  const s = bootSite({ me: null });
+  await flush();
+  assert.deepEqual(s.fetched, [['/api/bongos/me', 'same-origin']]);
+  assert.equal(s.document.getElementById('arv-btn'), null);
+  assert.equal(s.head.children.length, 0);
+  assert.deepEqual(s.configured, [], 'the panel is never told anything');
+});
+
+test('SIGNED IN: the Review button sits in the hub bar right before the identity chip, and opens the hall\'s panel', async () => {
+  const s = bootSite();
+  await flush();
+  const b = s.document.getElementById('arv-btn');
+  assert.ok(b, 'drawn');
+  assert.equal(b.parentNode, s.bar);
+  assert.equal(s.bar.children[s.bar.children.indexOf(b) + 1], s.who, 'beside the identity chip');
+  assert.equal(b.getAttribute('aria-label'), 'Artist review: write feedback on this page', 'the same name as the hall\'s palette');
+  assert.equal(b.innerHTML, '', 'built as nodes: this surface writes no innerHTML');
+  assert.equal(b.children[0].tagName, 'svg');
+  assert.deepEqual([b.children[1].className, b.children[1].textContent], ['arv-btn__label', 'Review']);
+  assert.doesNotMatch(LOADER, /\.innerHTML\s*=/);
+  assert.deepEqual(s.head.children.map((t) => t.href), ['/modules/hall-ui/public/page-notes.css'], 'the panel\'s own sheet, served from the hall module');
+  assert.deepEqual(s.loaded, [], 'the panel is not loaded until it is wanted');
+  b.click(); await flush();
+  b.click(); await flush();
+  assert.deepEqual(s.loaded, ['/modules/hall-ui/public/page-notes.js'], 'loaded once');
+  assert.deepEqual(s.opened, ['open', 'open']);
+  assert.deepEqual(s.configured[0], { surface: 'site', hall: 'https://builders.example.com' }, 'the panel is told, explicitly, it is on the public site and where the hall is');
+});
+
+test('a ?note=N link opens that doc in place; a hall origin that is not one is dropped', async () => {
+  const s = bootSite({ search: '?note=41', hall: 'javascript:alert(1)' });
+  await flush();
+  assert.deepEqual(s.opened, ['note 41']);
+  assert.equal(s.body.dataset.pnHall, undefined);
+});
+
+test('the panel names a public page as site:<first path segment>, and its ideas open in the hall', async () => {
+  const run = (pathname, hall = 'https://builders.example.com') => {
+    const s = bootSite({ pathname, hall });
+    return flush().then(() => {
+      vm.runInContext(NOTES, s.sandbox, { filename: 'page-notes.js' });
+      s.window.OTBPageNotes.configure({ surface: 'site', hall });
+      return s;
+    });
+  };
+  for (const [p, id] of [['/', 'site:home'], ['/projects', 'site:projects'], ['/account', 'site:account'], ['/privacy.html', 'site:privacy']]) {
+    const s = await run(p);
+    assert.equal(s.window.OTBPageNotes.page().id, id, p);
+    assert.equal(N.PAGE_ID_RE.test(id), true, 'the server takes it');
+  }
+  const s = await run('/projects');
+  s.document.title = 'Example — projects';
+  assert.equal(s.window.OTBPageNotes.page().title, 'Projects', 'named by its path, not the product name the title leads with');
+  assert.equal((await run('/')).window.OTBPageNotes.page().title, 'Home');
+  assert.match(NOTES, /esc\(ideaHref\(i\.id\)\)/, 'idea links go through the surface-aware href');
+  assert.equal(s.window.OTBPageNotes.ideaHref('7'), 'https://builders.example.com/builders/idea/7', 'an idea opens in the hall');
+  const bad = await run('/projects', 'javascript:alert(1)');
+  assert.equal(bad.window.OTBPageNotes.ideaHref('7'), '/builders/idea/7', 'a hall origin that is not one is dropped');
+  s.window.OTBPageNotes.configure({});
+  assert.equal(s.window.OTBPageNotes.page().id, 'builders:home', 'unconfigured, it is the hall panel it always was');
+  assert.equal(s.window.OTBPageNotes.ideaHref('7'), '/#/idea/7');
+});
+
+test('the public button and the hall palette wear one name', () => {
+  const craft = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/craft-mode.js'), 'utf8');
+  const tool = /id: 'palette', icon: 'artistry', short: '([^']+)', label: '([^']+)'/.exec(craft);
+  assert.ok(tool, 'the palette tool');
+  assert.ok(LOADER.includes("var SHORT = '" + tool[1] + "';"), 'the short name');
+  assert.ok(LOADER.includes("var LABEL = '" + tool[2] + "';"), 'the full name');
+});
+
+test('every public page carries the loader last, with the hall origin stamped server-side', () => {
+  for (const f of PAGES) {
+    const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public', f + '.html'), 'utf8').replace(/\r\n/g, '\n');
+    assert.match(html, /<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, f);
+  }
+  const serve = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+  assert.match(serve, /\.split\('\{\{buildersOrigin\}\}'\)/, 'the token the tag carries is one the server fills');
+  assert.match(serve, /const MODULE_ASSET_RE = \/\^\\\/modules\\\/\(\[a-z\]\[a-z0-9-\]\*\)\\\/public\\\/\(\.\+\)\$\//, 'the panel is served at /modules/hall-ui/public/');
+});