@bongos/core 1.21.75 → 1.21.77

package/modules/public-landing/public/assets/artist-review.js

@@ -0,0 +1,107 @@
+/* assets/artist-review.js — THE ARTIST REVIEW BUTTON on the public site (task
+   1004499, goal 1000095 WA6; owner decisions 2026-10-04).
+
+   A signed-in builder looking at a live public page (the landing, /projects,
+   /account and the footer pages) writes UI feedback about it without leaving it.
+   The button sits in the hub bar beside the identity chip and opens the hall's
+   own feedback panel (modules/hall-ui/public/page-notes.js, the Artistry
+   palette), so a review written here is the same doc as one written in the hall:
+   split by an AI into ideas filed under the reviewer, and kept as that page's
+   design reference. Its page id is site:<page>; the Studio lists them.
+
+   Signed out there is no button: GET /me answers 401 and nothing is drawn. Any
+   signed-in builder sees it, in any craft mode — the button is cosmetic, the
+   panel's routes hold the walls (ADR 0016).
+
+   The page names the hall's origin on this tag (data-hall="{{buildersOrigin}}",
+   stamped server-side), so the ideas the panel links to open in the hall, which
+   on the hub is another host. A ?note=N link opens that doc in place. */
+(function () {
+  'use strict';
+  var PANEL = '/modules/hall-ui/public/';
+  // The hall palette's own icon (craft-mode.js ICONS.artistry), built as nodes:
+  // this surface writes no innerHTML.
+  var SVG_NS = 'http://www.w3.org/2000/svg';
+  var ICON_PATHS = [
+    ['M8 2a6 6 0 1 0 0 12c.9 0 1.4-.6 1.4-1.3 0-.8-.6-1-.6-1.7 0-.6.5-1 1.2-1h1.6A2.4 2.4 0 0 0 14 7.6C14 4.5 11.3 2 8 2Z', null],
+    ['M5 6.2h.01M7.6 4.6h.01M10.4 5.2h.01M4.6 9h.01', '2.2'],
+  ];
+  function icon() {
+    var svg = document.createElementNS(SVG_NS, 'svg');
+    [['viewBox', '0 0 16 16'], ['fill', 'none'], ['stroke', 'currentColor'], ['stroke-width', '1.4'], ['stroke-linecap', 'round'], ['stroke-linejoin', 'round'], ['aria-hidden', 'true']]
+      .forEach(function (a) { svg.setAttribute(a[0], a[1]); });
+    ICON_PATHS.forEach(function (p) {
+      var path = document.createElementNS(SVG_NS, 'path');
+      path.setAttribute('d', p[0]);
+      if (p[1]) path.setAttribute('stroke-width', p[1]);
+      svg.appendChild(path);
+    });
+    return svg;
+  }
+  var tag = document.currentScript;
+  var hall = (tag && tag.getAttribute('data-hall')) || '';
+
+  function linkSheet() {
+    if (document.getElementById('arv-sheet')) return;
+    var l = document.createElement('link');
+    l.id = 'arv-sheet';
+    l.rel = 'stylesheet';
+    l.href = PANEL + 'page-notes.css';
+    document.head.appendChild(l);
+  }
+  var loading = null;
+  // The panel learns it is on the public site, and where the hall is, from here.
+  function ready(api) { api.configure({ surface: 'site', hall: hall }); return api; }
+  function loadPanel() {
+    if (window.OTBPageNotes) return Promise.resolve(ready(window.OTBPageNotes));
+    if (loading) return loading;
+    loading = new Promise(function (resolve, reject) {
+      var s = document.createElement('script');
+      s.src = PANEL + 'page-notes.js';
+      s.onload = function () { if (window.OTBPageNotes) resolve(ready(window.OTBPageNotes)); else reject(new Error('panel did not load')); };
+      s.onerror = function () { loading = null; reject(new Error('panel did not load')); };
+      document.head.appendChild(s);
+    });
+    return loading;
+  }
+  // The hall's palette (craft-mode.js TOOLS.artistry) wears the same two names;
+  // the two pages share no script, so tests/artist_review.mjs holds them equal.
+  var LABEL = 'Artist review: write feedback on this page';
+  var SHORT = 'Review';
+  function drawButton() {
+    var bar = document.querySelector('.barRight');
+    if (!bar || document.getElementById('arv-btn')) return null;
+    var b = document.createElement('button');
+    b.type = 'button';
+    b.id = 'arv-btn';
+    b.className = 'arv-btn';
+    b.setAttribute('aria-label', LABEL);
+    b.title = LABEL;
+    var label = document.createElement('span');
+    label.className = 'arv-btn__label';
+    label.textContent = SHORT;
+    b.appendChild(icon());
+    b.appendChild(label);
+    b.addEventListener('click', function () {
+      loadPanel().then(function (api) { api.open(); }, function () { b.setAttribute('aria-disabled', 'true'); });
+    });
+    var who = document.getElementById('who');
+    if (who && who.parentNode === bar) bar.insertBefore(b, who);
+    else bar.appendChild(b);
+    return b;
+  }
+
+  function signedIn(me) {
+    if (!me) return;
+    linkSheet();
+    drawButton();
+    var note = /[?&]note=([1-9]\d{0,17})(?:&|$)/.exec(window.location.search || '');
+    if (note) loadPanel().then(function (api) { api.openNote(note[1]); }, function () { /* the page still works */ });
+  }
+
+  fetch('/api/bongos/me', { method: 'GET', credentials: 'same-origin', headers: { Accept: 'application/json' } })
+    .then(function (r) { return r.ok ? r.json().catch(function () { return null; }) : null; })
+    .then(function (d) { signedIn(d ? (d.builder || d.me || d) : null); }, function () { /* signed out or offline: no button */ });
+
+  window.OTBArtistReview = { signedIn: signedIn };
+})();

package/modules/public-landing/public/contact.html

@@ -120,5 +120,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/guild.html

@@ -629,5 +629,7 @@
   load();
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/index.html

@@ -1261,5 +1261,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
   });
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/invitations.html

@@ -961,5 +961,7 @@
   });
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/privacy.html

@@ -129,5 +129,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/projects.html

@@ -11174,5 +11174,7 @@ summary{min-height:24px;padding:3px 0;}
     .then(loadSelfShipped, loadSelfShipped);
 })();
 </script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/public-landing/public/terms.html

@@ -134,5 +134,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms" aria-current="page">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<!-- the Artist review button: signed-in builders only (task 1004499) -->
+<script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>
 </html>

package/modules/ui-design/kit/serve.js

@@ -439,6 +439,33 @@ function handlePatch(res, body) {
   return json(res, 200, { handle: h, previous_handle: previous || null });
 }
 
+// The page feedback panel's routes (task 1004499: the public site's Artist review
+// button opens modules/hall-ui/public/page-notes.js), so a render can picture the
+// panel open. One draft per page for the run; nothing is ever split or filed.
+// SIMPLIFIED: drafts are keyed by page alone, where the real route keys them by
+// (author, page) — the stub has one fixture builder, so the two agree here.
+const pnDrafts = new Map();
+function pageNotesRoute(req, res, rest, u) {
+  if (!rest.startsWith('/page-notes')) return false;
+  if (!AUTH) { json(res, 401, UNAUTH); return true; }
+  if (rest === '/page-notes/site') { json(res, 200, { notes: [] }); return true; }
+  if (rest === '/page-notes' && req.method === 'GET') { json(res, 200, { page_id: u.searchParams.get('page_id') || '', notes: [] }); return true; }
+  if (rest === '/page-notes' && req.method === 'POST') {
+    readBody(req, (body) => {
+      const key = String(body.page_id || '');
+      if (!pnDrafts.has(key)) pnDrafts.set(key, { id: String(pnDrafts.size + 1), page_id: key, page_path: body.page_path || '/', page_title: body.page_title || '', body_md: '', status: 'draft', idea_ids: [], author_name: 'builder' });
+      json(res, 200, { note: pnDrafts.get(key), images: [] });
+    });
+    return true;
+  }
+  const one = rest.match(/^\/page-notes\/(\d+)$/);
+  if (one && req.method === 'PATCH') {
+    readBody(req, (body) => { for (const n of pnDrafts.values()) if (n.id === one[1]) n.body_md = String(body.body_md || ''); json(res, 200, { ok: true }); });
+    return true;
+  }
+  return false;
+}
+
 // The hub's guild page (task 1002301): GET /guilds/:slug (public), GET /guilds/:slug/members
 // and PATCH /guilds/:slug/membership (own-scope), answered from ONE set of guilds held for the
 // run (guilds.json, or the file a states file's stub.fixtures names), keyed by slug, each with
@@ -661,6 +688,7 @@ const server = http.createServer((req, res) => {
        starter-bundles.js declaration, so the picture the kit renders and the
        payload the route serves cannot drift apart silently. */
     if (rest === '/provisioning/starter-bundles') return json(res, 200, STARTER_BUNDLES_FIXTURE);
+    if (pageNotesRoute(req, res, rest, u)) return;
     if (rest === '/auth/logout') return json(res, 200, { ok: true });
     if (rest.startsWith('/auth/web/start')) { res.writeHead(302, { location: PREFIX }); return res.end(); }
     if (rest === '/instance') { const b = pages.size ? pages.values().next().value.brand : {}; return json(res, 200, { brand: { productName: (b && b.productName) || '', project: {} }, modules: {} }); }
@@ -672,6 +700,10 @@ const server = http.createServer((req, res) => {
     res.writeHead(200, { 'content-type': MIME['.js'], 'cache-control': 'no-store' });
     return res.end(bundle ? fs.readFileSync(bundle, 'utf8') : '/* stub: no client bundle in this checkout */');
   }
+  // an enabled module's browser assets, as serve-internal.js serves them on every host
+  // (task 1004499: the public site loads the hall's feedback panel from here)
+  const modAsset = p.match(/^\/modules\/([a-z][a-z0-9-]*)\/public\/(.+)$/);
+  if (modAsset) { const abs = fileUnder(path.join(ROOT, 'modules', modAsset[1], 'public'), modAsset[2]); if (abs) return sendFile(abs, res); }
   // docs/ raw (a mock's relative links resolve) and the surface dir by its checkout path
   if (p.startsWith('/docs/')) { const abs = fileUnder(DOCS, p.slice('/docs/'.length)); if (abs) return sendFile(abs, res); }
   const relSurface = path.relative(ROOT, DIR).split(path.sep).join('/');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.75",
+  "version": "1.21.77",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.75",
+      "version": "1.21.77",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.75",
+  "version": "1.21.77",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9260,5 +9260,17 @@
       "id": "1003807",
       "text": "The module store now only shows modules that are safe and good enough: each must pass the security check, and once it has real-world data it needs a score of at least 50 out of 100. Brand-new modules show with a 'New' label un"
     }
+  ],
+  "1.21.76": [
+    {
+      "id": "1004499",
+      "text": "Artists can now review the public website while looking at it. A signed-in builder on cloudbongos.com's public pages (home, projects, account, guilds, invitations, privacy, terms, contact) sees a Review button in the top bar,"
+    }
+  ],
+  "1.21.77": [
+    {
+      "id": "1004638",
+      "text": "The hall sidebar now has a solid background, so the page title no longer shows through the Builders' Hall name in light mode."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.75'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.77'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/artist_review.mjs

@@ -0,0 +1,231 @@
+// tests/artist_review.mjs — the Artist review button on the public site (task
+// 1004499, goal 1000095 WA6). Owner decisions 2026-10-04: the public pages plus
+// the Studio; any signed-in builder sees it; it sits in the hub bar; the
+// reviews are listed in the Studio.
+//
+// Four altitudes: the pure rules (a site doc is read in the Studio), the SQL,
+// the route over a stubbed db through real HTTP, and the browser half — the
+// REAL artist-review.js drawing the button (or nothing) and loading the REAL
+// page-notes.js, whose page id and idea links follow the public surface.
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const N = require('../modules/page-notes/notes.js');
+const LOADER = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/assets/artist-review.js'), 'utf8');
+const NOTES = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/page-notes.js'), 'utf8');
+const realListForSurface = require('../modules/page-notes/db.js').listForSurface;
+const PAGES = ['index', 'projects', 'account', 'privacy', 'terms', 'contact', 'guild', 'invitations'];
+
+// ---------- pure ----------
+
+test('a site doc is read in the Studio; a hall doc still on its own page', () => {
+  assert.equal(N.noteLink({ id: '5', page_id: 'site:projects', page_path: '/projects' }), '/builders/studio?note=5');
+  assert.equal(N.noteLink({ id: '6', page_id: 'builders:studio', page_path: '/studio' }), '/studio?note=6');
+  assert.equal(N.isSiteNote({ page_id: 'site:home' }), true);
+  assert.equal(N.isSiteNote({ page_id: 'builders:site' }), false, 'the surface, not a page named site');
+  assert.equal(N.normalizeDraft({ page_id: 'site:home', page_path: '/' }).ok, true, 'the site surface is a valid page id');
+  const body = N.ideaBody({ body: 'The hero is too dark.' }, { id: '5', page_id: 'site:home', page_title: 'Home' }, 'Ana');
+  assert.match(body, /Full reference doc: \[Home feedback\]\(\/builders\/studio\?note=5\)$/, 'every idea it becomes links into the hall');
+});
+
+test('the Studio list row: counts the ideas, carries the link, never the body', () => {
+  const r = N.siteListItem({ id: 9, page_id: 'site:terms', page_path: '/terms', page_title: 'Terms', status: 'filed', submitted_at: 't', idea_ids: [1, 2, 3], author_name: 'Bo', excerpt: 'x', body_md: 'SECRET' });
+  assert.deepEqual(r, { id: '9', page_id: 'site:terms', page_path: '/terms', page_title: 'Terms', status: 'filed', submitted_at: 't', idea_count: 3, author_name: 'Bo', excerpt: 'x', link: '/builders/studio?note=9' });
+});
+
+// ---------- SQL ----------
+
+test('listForSurface reads submitted docs on that surface only, newest first', async () => {
+  let seen = null;
+  await realListForSurface('site', { limit: 20 }, async (text, params) => { seen = { text, params }; return { rows: [] }; });
+  assert.deepEqual(seen.params, ['site:%', 20]);
+  assert.match(seen.text, /n\.page_id LIKE \$1 AND n\.status <> 'draft'/);
+  assert.match(seen.text, /ORDER BY n\.submitted_at DESC/);
+  assert.doesNotMatch(seen.text, /\bn\.body_md\b(?!,)/, 'only an excerpt leaves the table');
+});
+
+// ---------- the route ----------
+
+const db = require('../modules/page-notes/db.js');
+const api = require('../src/module-api.js');
+let viewer = { id: 9, rank: 'thetes' };
+let asked = null;
+db.listForSurface = async (surface, opts) => {
+  asked = { surface, opts };
+  return [{ id: 41, page_id: 'site:projects', page_path: '/projects', page_title: 'Projects', status: 'filed', submitted_at: '2026-10-04', idea_ids: [7], author_name: 'Ana', excerpt: 'Labels overlap.' }];
+};
+db.getNote = async () => null;
+api.requireBuilder = (req, res, next) => { if (!viewer) return res.status(401).json({ error: { code: 'unauthenticated' } }); req.builder = viewer; next(); };
+const express = require('express');
+const app = express();
+app.use((req, res, next) => { res.fail = (code, s) => res.status(typeof s === 'number' ? s : 400).json({ error: { code } }); next(); });
+app.use(express.json());
+app.use('/api/bongos', require('../modules/page-notes/routes/page-notes.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+test.after(() => server.close());
+const get = (p) => new Promise((resolve, reject) => {
+  http.get(`http://127.0.0.1:${server.address().port}/api/bongos${p}`, (res) => {
+    let s = '';
+    res.on('data', (c) => { s += c; });
+    res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(s || 'null'), headers: res.headers }));
+  }).on('error', reject);
+});
+
+test('GET /page-notes/site: any signed-in builder reads the list; a visitor nothing', async () => {
+  viewer = { id: 9, rank: 'thetes' };
+  const r = await get('/page-notes/site');
+  assert.equal(r.status, 200, 'answered by the list, never read as doc id "site"');
+  assert.deepEqual(asked, { surface: 'site', opts: { limit: 20 } });
+  assert.equal(r.headers['cache-control'], 'no-store');
+  assert.deepEqual(r.body.notes.map((n) => [n.id, n.idea_count, n.link]), [['41', 1, '/builders/studio?note=41']]);
+  viewer = null;
+  assert.equal((await get('/page-notes/site')).status, 401);
+});
+
+// ---------- the browser half ----------
+
+function el(tag, id, cls) {
+  const attrs = {};
+  const listeners = {};
+  const e = {
+    tagName: tag, id: id || '', className: cls || '', children: [], parentNode: null, innerHTML: '', title: '', type: '', src: '', href: '', rel: '',
+    dataset: {},
+    setAttribute(k, v) { attrs[k] = String(v); if (k.startsWith('data-')) e.dataset[k.slice(5).replace(/-(\w)/g, (_m, c) => c.toUpperCase())] = String(v); },
+    getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    appendChild(c) { c.parentNode = e; e.children.push(c); if (e.onAppend) e.onAppend(c); return c; },
+    insertBefore(c, ref) { c.parentNode = e; const at = e.children.indexOf(ref); if (at === -1) e.children.push(c); else e.children.splice(at, 0, c); return c; },
+    addEventListener(t, fn) { (listeners[t] ||= []).push(fn); },
+    click() { (listeners.click || []).forEach((fn) => fn({ target: e })); },
+  };
+  return e;
+}
+const tree = (r) => r.children.flatMap((c) => [c, ...tree(c)]);
+const flush = async () => { for (let i = 0; i < 6; i++) await new Promise((r) => setTimeout(r, 0)); };
+
+function bootSite({ me = { builder: { id: 9, github_login: 'ana' } }, search = '', pathname = '/projects', hall = 'https://builders.example.com' } = {}) {
+  const body = el('BODY');
+  const head = el('HEAD');
+  const bar = body.appendChild(el('DIV', '', 'barRight'));
+  bar.appendChild(el('BUTTON', 'projTrig', 'trig'));
+  const who = bar.appendChild(el('BUTTON', 'who', 'trig who'));
+  const script = el('SCRIPT');
+  script.setAttribute('data-hall', hall);
+  const fetched = [];
+  const loaded = [];
+  const opened = [];
+  const configured = [];
+  const all = () => [head, body, ...tree(head), ...tree(body)];
+  const document = {
+    body, head, currentScript: script, title: 'Projects — Example',
+    getElementById: (id) => all().find((n) => n.id === id) || null,
+    querySelector: (sel) => (sel === '.barRight' ? bar : null),
+    createElement: (t) => el(t.toUpperCase()),
+    createElementNS: (_ns, t) => el(t),
+  };
+  const window = { location: { search, pathname }, document };
+  head.onAppend = (tag) => {
+    if (tag.tagName !== 'SCRIPT') return;
+    loaded.push(tag.src);
+    window.OTBPageNotes = { configure: (c) => configured.push(JSON.parse(JSON.stringify(c))), open: () => opened.push('open'), openNote: (id) => opened.push('note ' + id) };
+    tag.onload();
+  };
+  const fetch = async (url, opts) => {
+    fetched.push([url, opts.credentials]);
+    return me ? { ok: true, json: async () => me } : { ok: false, status: 401, json: async () => ({}) };
+  };
+  const sandbox = { window, document, fetch, Promise, setTimeout };
+  vm.createContext(sandbox);
+  vm.runInContext(LOADER, sandbox, { filename: 'artist-review.js' });
+  return { window, document, body, head, bar, who, fetched, loaded, opened, configured, sandbox };
+}
+
+test('SIGNED OUT: no button, no sheet, no panel — the page is untouched', async () => {
+  const s = bootSite({ me: null });
+  await flush();
+  assert.deepEqual(s.fetched, [['/api/bongos/me', 'same-origin']]);
+  assert.equal(s.document.getElementById('arv-btn'), null);
+  assert.equal(s.head.children.length, 0);
+  assert.deepEqual(s.configured, [], 'the panel is never told anything');
+});
+
+test('SIGNED IN: the Review button sits in the hub bar right before the identity chip, and opens the hall\'s panel', async () => {
+  const s = bootSite();
+  await flush();
+  const b = s.document.getElementById('arv-btn');
+  assert.ok(b, 'drawn');
+  assert.equal(b.parentNode, s.bar);
+  assert.equal(s.bar.children[s.bar.children.indexOf(b) + 1], s.who, 'beside the identity chip');
+  assert.equal(b.getAttribute('aria-label'), 'Artist review: write feedback on this page', 'the same name as the hall\'s palette');
+  assert.equal(b.innerHTML, '', 'built as nodes: this surface writes no innerHTML');
+  assert.equal(b.children[0].tagName, 'svg');
+  assert.deepEqual([b.children[1].className, b.children[1].textContent], ['arv-btn__label', 'Review']);
+  assert.doesNotMatch(LOADER, /\.innerHTML\s*=/);
+  assert.deepEqual(s.head.children.map((t) => t.href), ['/modules/hall-ui/public/page-notes.css'], 'the panel\'s own sheet, served from the hall module');
+  assert.deepEqual(s.loaded, [], 'the panel is not loaded until it is wanted');
+  b.click(); await flush();
+  b.click(); await flush();
+  assert.deepEqual(s.loaded, ['/modules/hall-ui/public/page-notes.js'], 'loaded once');
+  assert.deepEqual(s.opened, ['open', 'open']);
+  assert.deepEqual(s.configured[0], { surface: 'site', hall: 'https://builders.example.com' }, 'the panel is told, explicitly, it is on the public site and where the hall is');
+});
+
+test('a ?note=N link opens that doc in place; a hall origin that is not one is dropped', async () => {
+  const s = bootSite({ search: '?note=41', hall: 'javascript:alert(1)' });
+  await flush();
+  assert.deepEqual(s.opened, ['note 41']);
+  assert.equal(s.body.dataset.pnHall, undefined);
+});
+
+test('the panel names a public page as site:<first path segment>, and its ideas open in the hall', async () => {
+  const run = (pathname, hall = 'https://builders.example.com') => {
+    const s = bootSite({ pathname, hall });
+    return flush().then(() => {
+      vm.runInContext(NOTES, s.sandbox, { filename: 'page-notes.js' });
+      s.window.OTBPageNotes.configure({ surface: 'site', hall });
+      return s;
+    });
+  };
+  for (const [p, id] of [['/', 'site:home'], ['/projects', 'site:projects'], ['/account', 'site:account'], ['/privacy.html', 'site:privacy']]) {
+    const s = await run(p);
+    assert.equal(s.window.OTBPageNotes.page().id, id, p);
+    assert.equal(N.PAGE_ID_RE.test(id), true, 'the server takes it');
+  }
+  const s = await run('/projects');
+  s.document.title = 'Example — projects';
+  assert.equal(s.window.OTBPageNotes.page().title, 'Projects', 'named by its path, not the product name the title leads with');
+  assert.equal((await run('/')).window.OTBPageNotes.page().title, 'Home');
+  assert.match(NOTES, /esc\(ideaHref\(i\.id\)\)/, 'idea links go through the surface-aware href');
+  assert.equal(s.window.OTBPageNotes.ideaHref('7'), 'https://builders.example.com/builders/idea/7', 'an idea opens in the hall');
+  const bad = await run('/projects', 'javascript:alert(1)');
+  assert.equal(bad.window.OTBPageNotes.ideaHref('7'), '/builders/idea/7', 'a hall origin that is not one is dropped');
+  s.window.OTBPageNotes.configure({});
+  assert.equal(s.window.OTBPageNotes.page().id, 'builders:home', 'unconfigured, it is the hall panel it always was');
+  assert.equal(s.window.OTBPageNotes.ideaHref('7'), '/#/idea/7');
+});
+
+test('the public button and the hall palette wear one name', () => {
+  const craft = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/craft-mode.js'), 'utf8');
+  const tool = /id: 'palette', icon: 'artistry', short: '([^']+)', label: '([^']+)'/.exec(craft);
+  assert.ok(tool, 'the palette tool');
+  assert.ok(LOADER.includes("var SHORT = '" + tool[1] + "';"), 'the short name');
+  assert.ok(LOADER.includes("var LABEL = '" + tool[2] + "';"), 'the full name');
+});
+
+test('every public page carries the loader last, with the hall origin stamped server-side', () => {
+  for (const f of PAGES) {
+    const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public', f + '.html'), 'utf8').replace(/\r\n/g, '\n');
+    assert.match(html, /<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, f);
+  }
+  const serve = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+  assert.match(serve, /\.split\('\{\{buildersOrigin\}\}'\)/, 'the token the tag carries is one the server fills');
+  assert.match(serve, /const MODULE_ASSET_RE = \/\^\\\/modules\\\/\(\[a-z\]\[a-z0-9-\]\*\)\\\/public\\\/\(\.\+\)\$\//, 'the panel is served at /modules/hall-ui/public/');
+});

package/tests/hall_studio_home.mjs

@@ -418,12 +418,50 @@ try {
     assert.equal(none.el('st-older').hidden, true, 'no review waiting: no door');
   });
 
+  await test('From the live site (task 1004499): the public pages\' reviews, each opening its doc here', async () => {
+    const N = require('../modules/page-notes/notes.js');
+    // the route's own mapper over two listForSurface rows
+    const rows = [
+      { id: 31, page_id: 'site:projects', page_path: '/projects', page_title: 'Projects', status: 'filed', submitted_at: day(1), idea_ids: [1, 2], author_name: 'Ana', excerpt: 'The map labels <b>overlap</b>.\n![shot](/api/bongos/page-notes/images/4)' },
+      { id: 32, page_id: 'site:home', page_path: '/', page_title: '', status: 'splitting', submitted_at: day(0), idea_ids: [], author_name: 'Bo', excerpt: 'Hero is too dark.' },
+    ].map(N.siteListItem);
+    const s = bootStudio({ answers: { ...HOME, 'GET /page-notes/site': ok({ notes: rows }) } });
+    await s.settle();
+    assert.equal(s.el('st-site-detail').textContent, '2 reviews from the live site');
+    await s.click('st-site');
+    assert.equal(s.el('st-panel-title').textContent, 'From the live site');
+    const body = s.el('st-panel-body').innerHTML;
+    assert.deepEqual([...body.matchAll(/class="st-site" href="([^"]*)"/g)].map((m) => m[1]), ['/builders/studio?note=31', '/builders/studio?note=32'], 'each row opens its doc in the Studio');
+    assert.match(body, /st-site__page">Projects</);
+    assert.match(body, /st-site__page">\/</, 'an untitled page falls back to its path');
+    assert.match(body, /Ana · [^<]* · 2 ideas/);
+    assert.match(body, /Bo · [^<]* · splitting/);
+    assert.match(body, /The map labels &lt;b&gt;overlap&lt;\/b&gt;\. \[image\]</, 'the excerpt is escaped and its picture named, not shown');
+    const long = bootStudio({ answers: { ...HOME, 'GET /page-notes/site': ok({ notes: [{ ...rows[1], excerpt: 'word '.repeat(60) }] }) } });
+    await long.settle();
+    await long.click('st-site');
+    const cut = /st-site__text">([^<]*)</.exec(long.el('st-panel-body').innerHTML)[1];
+    assert.ok(cut.length <= 140 && /word…$/.test(cut), `a long excerpt ends on a whole word and says it goes on: ${cut}`);
+    await s.clickIn('st-panel', '[data-close-panel]');
+
+    const none = bootStudio({ answers: { ...HOME, 'GET /page-notes/site': ok({ notes: [] }) } });
+    await none.settle();
+    assert.equal(none.el('st-site-detail').textContent, 'no reviews from the live site yet');
+    await none.click('st-site');
+    assert.match(none.el('st-panel-body').innerHTML, /None yet\./);
+
+    const down = bootStudio({ answers: HOME });
+    await down.settle();
+    await down.click('st-site');
+    assert.match(down.el('st-panel-body').innerHTML, /could not be read just now/);
+  });
+
   await test('the markup: one h1 (the greeting), the tally and four doors, the libs before the page, the full-screen switch', () => {
     const nc = HTML.replace(/<!--[\s\S]*?-->/g, '');
     assert.equal((nc.match(/<h1\b/g) || []).length, 1);
     assert.match(nc, /<h1[^>]*id="studio-greet"[^>]*data-words/);
     assert.match(nc, /<p[^>]*id="studio-sub"[^>]*data-words/);
-    for (const id of ['st-tally', 'st-resume', 'st-flow', 'studio-approvals', 'st-status', 'st-older']) assert.match(nc, new RegExp(`id="${id}"`));
+    for (const id of ['st-tally', 'st-resume', 'st-flow', 'studio-approvals', 'st-status', 'st-site', 'st-older']) assert.match(nc, new RegExp(`id="${id}"`));
     assert.match(nc, /<body[^>]*data-fullscreen-switch/);
     const at = (f) => nc.indexOf(f);
     assert.ok(at('tweak-editor-lib.js') < at('studio-lib.js') && at('studio-lib.js') < at('/studio.js'), 'the libs, then the page');

package/tests/landing_legal_pages.mjs

@@ -206,7 +206,8 @@ for (const p of PAGES) {
     const html = read(p.file);
     const styles = [...html.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
     assert.doesNotMatch(styles, /\.(shell|bar|barMark|barLeft|barRight|trig|who|signinDoor|menuBand|band[A-Z]\w*)\b[^{}]*\{/, 'no bar or band rule in the page');
-    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
+    // then the Artist review button's loader (task 1004499), the page's last tag
+    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
     assert.doesNotMatch(html, /<script>/, 'and no inline copy of the bands');
     assert.match(html, /<a data-link-hall href="\{\{buildersOrigin\}\}">Builders' hall<\/a><\/nav><\/footer>/, 'the hall keeps a door in the footer row now the bar has no Hall pill, as on /account');
   });

package/tests/page_notes_db.mjs

@@ -54,8 +54,11 @@ await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES (
 
 const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_001_notes.sql'), 'utf8');
 await pool.query(MIGRATION);
+// task 1004499: the Studio's site list reads by page_id prefix
+const MIGRATION_2 = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_002_surface_index.sql'), 'utf8');
+await pool.query(MIGRATION_2);
 const PAGE = 'builders:pn-test-page';
-const clean = () => pool.query('DELETE FROM page_notes_docs WHERE page_id LIKE $1', ['builders:pn-test-%']);
+const clean = () => pool.query('DELETE FROM page_notes_docs WHERE page_id LIKE $1 OR page_id LIKE $2', ['builders:pn-test-%', 'pntest:%']);
 await clean();
 
 const PNG = Buffer.from('89504e470d0a1a0a0000000d4948445200000001000000010806000000', 'hex');
@@ -135,6 +138,30 @@ await test('deleting a doc takes its images with it', async () => {
 
 await clean();
 await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
+await test('THE SITE LIST (task 1004499): one surface, submitted only, newest first, read through its own index', async () => {
+  await pool.query(MIGRATION_2);
+  const mk = async (author, page, at) => {
+    const n = await db.openDraft({ authorId: author, pageId: page, pagePath: '/', pageTitle: page }, q);
+    await pool.query("UPDATE page_notes_docs SET status = 'filed', submitted_at = $2, body_md = 'words' WHERE id = $1", [n.id, at]);
+    return String(n.id);
+  };
+  const older = await mk(A, 'pntest:home', '2026-10-01T00:00:00Z');
+  const newer = await mk(B, 'pntest:projects', '2026-10-02T00:00:00Z');
+  await db.openDraft({ authorId: A, pageId: 'pntest:terms', pagePath: '/terms', pageTitle: 'Terms' }, q);
+  await mk(A, 'builders:pn-test-other', '2026-10-03T00:00:00Z');
+  const rows = await db.listForSurface('pntest', { limit: 20 }, q);
+  assert.deepEqual(rows.map((r) => String(r.id)), [newer, older], 'the surface only, drafts left out, newest first');
+  const c = await pool.connect();
+  try {
+    await c.query('BEGIN');
+    await c.query('SET LOCAL enable_seqscan = off');
+    const plan = (await c.query("EXPLAIN SELECT id FROM page_notes_docs n WHERE n.page_id LIKE 'site:%' AND n.status <> 'draft'")).rows.map((r) => r['QUERY PLAN']).join('\n');
+    assert.match(plan, /page_notes_by_surface/, plan);
+    await c.query('ROLLBACK');
+  } finally { c.release(); }
+  await clean();
+});
+
 await pool.end();
 console.log(`page_notes_db: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);