@bongos/core 1.21.78 → 1.21.80

package/scripts/gds/module.js

@@ -1138,14 +1138,34 @@ async function fetchVerified(key, { wanted, call, core, log, errlog, verb, shoul
 
   const artifact = require('./module-artifact');
   const verified = await artifact.verifyModuleArtifact(dl.buf, { key, includeFiles: true });
-  if (!verified.ok) return fail(1, `REFUSING: the downloaded tarball failed verification (${verified.code}): ${verified.message}`);
+  if (!verified.ok) {
+    await reportInstall(call, key, described.version, 'verify_failed');
+    return fail(1, `REFUSING: the downloaded tarball failed verification (${verified.code}): ${verified.message}`);
+  }
   if (verified.version !== described.version || verified.tarballSha256 !== described.tarball_sha256 || verified.treeSha256 !== described.tree_sha256) {
+    await reportInstall(call, key, described.version, 'hash_mismatch');
     return fail(1, `REFUSING: the download is not the ${described.version} the store described (version or hash differs).`);
   }
   log(`  ✓ verified ${verified.files.length} file(s), ${verified.bytes} bytes — tree ${verified.treeSha256.slice(0, 12)}…`);
   return { ok: true, described, verified };
 }
 
+// Tell the store whether an install or update of this exact version worked (task
+// 1003793): it feeds the module's Install score, the part an author cannot fake.
+// Counts only — yes, or a short code saying where it failed; never a message, a
+// path or anything about this machine (owner's privacy posture, 2026-10-01). The
+// store drops it if the caller switched reporting off in Settings, so there is no
+// client-side switch to keep in step. Best-effort and silent: a report that does
+// not arrive changes nothing about the install. Only failures that are the
+// module's own count: a refused or unreachable store, or a core the module does
+// not support, says nothing about the module and is not reported.
+async function reportInstall(call, key, version, errorCode = null) {
+  const body = errorCode ? { ok: false, error_code: errorCode } : { ok: true };
+  try {
+    await call('POST', `/store/modules/${encodeURIComponent(key)}/versions/${encodeURIComponent(version)}/install-report`, { json: body });
+  } catch { /* best-effort */ }
+}
+
 // Tell the store which exact version was placed. A failure here never undoes the
 // placement: the files are good, and the next install or update records it.
 async function recordPlaced(key, version, { call, errlog, verb }) {
@@ -1190,10 +1210,12 @@ async function cmdInstall(args, {
   if (!got.ok) return got.code;
 
   try { placeModule(got.verified.files, target); }
-  catch (e) { errlog(`bongos module install: could not place the module — ${e.message}`); return 1; }
+  catch (e) { await reportInstall(call, key, got.described.version, 'place_failed'); errlog(`bongos module install: could not place the module — ${e.message}`); return 1; }
   log(`  ✓ placed at ${target}`);
 
-  if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'install' }))) return 1;
+  const recorded = await recordPlaced(key, got.described.version, { call, errlog, verb: 'install' });
+  await reportInstall(call, key, got.described.version);
+  if (!recorded) return 1;
   log(`\n✓ Installed "${key}" ${got.described.version}. It is not switched on: enable it from the hall's Modules tab when you want it.`);
   const howto = howtoLink(key, got.described.version, got.verified.files, call.apiBase);
   if (howto) log(`  How to use it: ${howto}`);
@@ -1276,10 +1298,12 @@ async function cmdUpdate(args, {
   if (!got.ok) return got.code;
 
   try { replaceModule(got.verified.files, target); }
-  catch (e) { errlog(`bongos module update: could not replace the module, ${installed} is still in place — ${e.message}`); return 1; }
+  catch (e) { await reportInstall(call, key, got.described.version, 'place_failed'); errlog(`bongos module update: could not replace the module, ${installed} is still in place — ${e.message}`); return 1; }
   log(`  ✓ replaced ${installed} with ${got.described.version} at ${target}`);
 
-  if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'update' }))) return 1;
+  const recorded = await recordPlaced(key, got.described.version, { call, errlog, verb: 'update' });
+  await reportInstall(call, key, got.described.version);
+  if (!recorded) return 1;
   log(`\n✓ Updated "${key}" ${installed} → ${got.described.version}. Its on/off switch is unchanged.`);
   return 0;
 }

package/scripts/hall-preview/live-identity.js

@@ -34,6 +34,7 @@ const ME_SCOPED_PATHS = [
   'me/sound-prefs',
   'me/event-sound-prefs',
   'me/art-key/own',
+  'store/usage-reporting',
   'builders/:id/profile',
   'builders/:id/active-claims',
   'builders/:id/activity?section=tasks',

package/src/bongos/github-repos.js

@@ -75,10 +75,11 @@ async function listUserRepos(token, { q = '', fetchImpl = fetch } = {}) {
 // no README/first commit (exactly the "leave it completely empty" the manual step
 // demanded).
 //
-// private:false is now a PRODUCT choice, not a credential limit: since ADR 0155 the
-// token holds `repo` and COULD create a private repo, but a Cloud Bongos instance is
-// open-source / capture-resistant by design, so a repo WE create defaults to public.
-// A user who wants a private instance adopts a private repo they made themselves.
+// private:true — a repo WE create is PRIVATE (ADR 0370, superseding ADR 0155 §3's
+// public default): a new owner's code must never be world-readable from the first
+// push without them choosing that. The standup already handles a private target —
+// ensurePrivateRepoAccess mints the project's own read-only deploy key before the
+// first pull (ADR 0176) — and the owner can make it public later from the manage page.
 // Deliberately not a parameter — nothing should be able to flip this implicitly.
 //
 // Returns { full_name, html_url }. A 422 (name already exists / invalid) becomes a
@@ -87,7 +88,7 @@ async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   const res = await fetchImpl(`${GH_API}/user/repos`, {
     method: 'POST',
     headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
-    body: JSON.stringify({ name, private: false, auto_init: false }),
+    body: JSON.stringify({ name, private: true, auto_init: false }),
   });
   if (res.status === 201) {
     const r = await res.json();
@@ -131,7 +132,7 @@ async function getUserRepo(token, { owner, name, fetchImpl = fetch } = {}) {
 
 // The visibility PATCH both directions share. Deliberately NOT exported: callers get
 // one named function per direction, so the name stays the contract and no caller can
-// pass a direction it did not mean (the createUserRepo private:false precedent).
+// pass a direction it did not mean (the createUserRepo fixed-visibility precedent).
 async function setRepoPrivate(token, { owner, name, fetchImpl = fetch }, isPrivate) {
   const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
     method: 'PATCH',

package/src/bongos/module-usage-reports.js

@@ -0,0 +1,112 @@
+// src/bongos/module-usage-reports.js — take in the counts real installs report
+// about a store module version: did the install work, and how many runtime
+// errors it threw on a day (task 1003793, ADR 0343 D1; tables core_273).
+//
+// WHY a separate intake. Install and Reliability are the parts of a module's
+// score an author cannot fake, because they come from other people's installs.
+// That makes them telemetry about someone else's setup, so the owner set the
+// privacy posture up front (Will, 2026-10-01): COUNTS ONLY, ON BY DEFAULT, WITH
+// AN OPT-OUT. This file is where that posture is enforced, at the server, so it
+// holds whatever client sends the report:
+//   - a report is a yes/no plus a short error CODE, or a whole-number daily
+//     count — there is no field for error text, paths or user data;
+//   - a holder that has switched reporting off is dropped at intake, before
+//     anything is written.
+// Scoring the reports into signal rows is module-assess-installs.js's job.
+//
+// Every function takes { db } (a pg Pool or anything with query()) so tests run
+// against a fake client, the way module-entitlements.js does.
+
+const ERROR_CODE_RE = /^[a-z][a-z0-9_]{0,39}$/; // same rule as core_273's CHECK
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
+const MAX_DAILY_ERRORS = 1_000_000;
+// How far back a daily count may be sent. Matches the window Reliability is
+// scored over (module-assess-installs.js), so nothing is stored that never counts.
+const ERROR_DAY_WINDOW = 30;
+
+function poolOf(db) { return db || require('./pool').pool; }
+
+// Does this holder have usage reporting switched off? No row = on (the default).
+async function isOptedOut({ holderKind, holderRef }, { db } = {}) {
+  const { rows } = await poolOf(db).query(
+    'SELECT 1 FROM module_usage_report_optouts WHERE holder_kind = $1 AND holder_ref = $2',
+    [holderKind, holderRef]);
+  return rows.length > 0;
+}
+
+// Switch a holder's reporting on or off. Idempotent either way.
+async function setReporting({ holderKind, holderRef, enabled }, { db } = {}) {
+  const pool = poolOf(db);
+  if (enabled) {
+    await pool.query('DELETE FROM module_usage_report_optouts WHERE holder_kind = $1 AND holder_ref = $2',
+      [holderKind, holderRef]);
+  } else {
+    await pool.query(
+      `INSERT INTO module_usage_report_optouts (holder_kind, holder_ref) VALUES ($1, $2)
+       ON CONFLICT (holder_kind, holder_ref) DO NOTHING`, [holderKind, holderRef]);
+  }
+  return { enabled: !!enabled };
+}
+
+// Check a report's shape. Returns null when fine, else { code, message } — the
+// route turns that into a 400. Pure.
+function installReportError({ ok, errorCode }) {
+  if (typeof ok !== 'boolean') return { code: 'bad_report', message: 'ok is true or false.' };
+  if (ok && errorCode != null) return { code: 'bad_report', message: 'A working install carries no error code.' };
+  if (!ok && !ERROR_CODE_RE.test(String(errorCode || ''))) {
+    return { code: 'bad_error_code', message: 'A failed install carries a short lowercase code (letters, digits, _), never a message.' };
+  }
+  return null;
+}
+
+// Check a daily error count. `today` is a YYYY-MM-DD string (UTC) so tests can pin it. Pure.
+function errorCountError({ day, count }, { today = new Date().toISOString().slice(0, 10) } = {}) {
+  if (!Number.isInteger(count) || count < 0 || count > MAX_DAILY_ERRORS) {
+    return { code: 'bad_count', message: `count is a whole number from 0 to ${MAX_DAILY_ERRORS}.` };
+  }
+  if (!DAY_RE.test(String(day || '')) || Number.isNaN(Date.parse(`${day}T00:00:00Z`))) {
+    return { code: 'bad_day', message: 'day is a date, YYYY-MM-DD.' };
+  }
+  const ageDays = (Date.parse(`${today}T00:00:00Z`) - Date.parse(`${day}T00:00:00Z`)) / 86_400_000;
+  if (ageDays < 0) return { code: 'bad_day', message: 'day cannot be in the future.' };
+  if (ageDays > ERROR_DAY_WINDOW) return { code: 'bad_day', message: `day must be within the last ${ERROR_DAY_WINDOW} days.` };
+  return null;
+}
+
+// Record a holder's latest install or update attempt of a version — it REPLACES
+// their previous one, so retries never grow the table or outweigh other holders.
+// Resolves { recorded: true } or { recorded: false, reason: 'opted_out' }.
+// Validate with installReportError first.
+async function recordInstallReport({ versionId, holderKind, holderRef, ok, errorCode = null }, { db } = {}) {
+  const pool = poolOf(db);
+  if (await isOptedOut({ holderKind, holderRef }, { db: pool })) return { recorded: false, reason: 'opted_out' };
+  await pool.query(
+    `INSERT INTO module_install_reports (version_id, holder_kind, holder_ref, ok, error_code)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (version_id, holder_kind, holder_ref)
+     DO UPDATE SET ok = EXCLUDED.ok, error_code = EXCLUDED.error_code, reported_at = now()`,
+    [versionId, holderKind, holderRef, ok, ok ? null : errorCode]);
+  return { recorded: true };
+}
+
+// Record a version's runtime error count for one holder on one day. A second
+// report for the same day REPLACES the count (the sender counts the whole day),
+// so a retried send never doubles it. Validate with errorCountError first.
+async function recordErrorCount({ versionId, holderKind, holderRef, day, count }, { db } = {}) {
+  const pool = poolOf(db);
+  if (await isOptedOut({ holderKind, holderRef }, { db: pool })) return { recorded: false, reason: 'opted_out' };
+  await pool.query(
+    `INSERT INTO module_runtime_error_counts (version_id, holder_kind, holder_ref, day, error_count)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (version_id, holder_kind, holder_ref, day)
+     DO UPDATE SET error_count = EXCLUDED.error_count, reported_at = now()`,
+    [versionId, holderKind, holderRef, day, count]);
+  return { recorded: true };
+}
+
+module.exports = {
+  ERROR_CODE_RE, ERROR_DAY_WINDOW,
+  isOptedOut, setReporting,
+  installReportError, errorCountError,
+  recordInstallReport, recordErrorCount,
+};

package/src/bongos/routes/modules.js

@@ -38,6 +38,13 @@
 //   POST /store/modules/:key/delist
 //                               Metic+ takes a module out of the store; holders
 //                               keep it (task 1003797, ADR 0338 D2).
+//   POST /store/modules/:key/versions/:version/install-report
+//   POST /store/modules/:key/versions/:version/error-count
+//   GET|POST /store/usage-reporting
+//                               counts real installs report — did an install work,
+//                               runtime errors per day — scored into the Install and
+//                               Reliability parts, and the caller's own switch to
+//                               stop reporting (task 1003793, ADR 0343 D1).
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -90,6 +97,10 @@ const {
   resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
   delistModule, delistedKeySet,
 } = require('../module-store');
+const {
+  isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
+} = require('../module-usage-reports');
+const { recordInstallSignals } = require('../../../scripts/gds/module-assess-installs');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
 const log = require('../logger').logger.child({ src: 'modules' });
@@ -726,6 +737,91 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, entitlement: out.entitlement });
     }));
 
+  // ---- usage reports: the Install and Reliability parts (task 1003793, ADR 0343 D1) ----
+  //
+  // Real installs report counts back so a module is scored on what happens when
+  // other people run it. Owner's privacy posture (2026-10-01): counts only, on by
+  // default, with an opt-out — enforced in src/bongos/module-usage-reports.js, which
+  // drops a report from a holder who switched reporting off before anything is
+  // written. Own-scoped like /acquired: the holder is always the caller, never
+  // named in the request, so requireBuilder is the gate, and only a LIVE holder of
+  // the module may report on it. Each accepted report re-scores the two parts.
+  async function reportTarget(req, res) {
+    const { key, version } = req.params;
+    if (!KEY_RE.test(key) || !parseVersion(version)) {
+      res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      return null;
+    }
+    const r = await resolveReadable(key, version);
+    if (!r.ok) { res.fail(r.code, { status: r.status, message: r.message }); return null; }
+    const holder = { holderKind: 'builder', holderRef: String(req.builder.id) };
+    const held = await checkEntitlement({ moduleKey: key, ...holder });
+    if (!held.entitled) {
+      res.fail('not_entitled', { status: 403, message: `You do not hold "${key}", so you cannot report on it.` });
+      return null;
+    }
+    return { versionId: r.version.id, ...holder };
+  }
+
+  // Re-score after an accepted report, once the response is sent so the reporter
+  // never waits on it. A scoring failure never loses the report; the next report
+  // re-scores from the same stored rows.
+  function rescore(versionId) {
+    setImmediate(() => {
+      recordInstallSignals(versionId).catch((e) => {
+        log.warn({ err: e.message, versionId }, 'install/reliability re-score failed; the report is kept');
+      });
+    });
+  }
+
+  router.post('/store/modules/:key/versions/:version/install-report', auth.requireBuilder,
+    asyncHandler('POST /store/modules/:key/versions/:version/install-report', async (req, res) => {
+      if (validateOrRespond(req, res, {
+        ok: { type: 'boolean', required: true },
+        error_code: { type: 'string', maxLength: 40 },
+      })) return;
+      const report = { ok: req.body.ok, errorCode: req.body.error_code == null ? null : req.body.error_code };
+      const bad = installReportError(report);
+      if (bad) return res.fail(bad.code, { status: 400, message: bad.message });
+      const t = await reportTarget(req, res);
+      if (!t) return;
+      const out = await recordInstallReport({ ...t, ...report });
+      res.json({ ok: true, recorded: out.recorded, ...(out.reason ? { reason: out.reason } : {}) });
+      if (out.recorded) rescore(t.versionId);
+    }));
+
+  router.post('/store/modules/:key/versions/:version/error-count', auth.requireBuilder,
+    asyncHandler('POST /store/modules/:key/versions/:version/error-count', async (req, res) => {
+      if (validateOrRespond(req, res, {
+        day: { type: 'string', required: true, maxLength: 10 },
+        count: { type: 'integer', required: true },
+      })) return;
+      const report = { day: req.body.day, count: req.body.count };
+      const bad = errorCountError(report);
+      if (bad) return res.fail(bad.code, { status: 400, message: bad.message });
+      const t = await reportTarget(req, res);
+      if (!t) return;
+      const out = await recordErrorCount({ ...t, ...report });
+      res.json({ ok: true, recorded: out.recorded, ...(out.reason ? { reason: out.reason } : {}) });
+      if (out.recorded) rescore(t.versionId);
+    }));
+
+  // The caller's own reporting switch (Settings → Profile and privacy). On unless
+  // they turned it off.
+  router.get('/store/usage-reporting', auth.requireBuilder,
+    asyncHandler('GET /store/usage-reporting', async (req, res) => {
+      const off = await isOptedOut({ holderKind: 'builder', holderRef: String(req.builder.id) });
+      res.set('Cache-Control', 'no-store');
+      res.json({ enabled: !off });
+    }));
+
+  router.post('/store/usage-reporting', auth.requireBuilder,
+    asyncHandler('POST /store/usage-reporting', async (req, res) => {
+      if (validateOrRespond(req, res, { enabled: { type: 'boolean', required: true } })) return;
+      const out = await setReporting({ holderKind: 'builder', holderRef: String(req.builder.id), enabled: req.body.enabled });
+      res.json({ ok: true, enabled: out.enabled });
+    }));
+
   return router;
 };
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.78'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.80'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_repos_helpers.mjs

@@ -92,7 +92,7 @@ test('listUserRepos: 401 → typed github_unauthorized', async () => {
   );
 });
 
-test('createUserRepo: sends auto_init:false + private:false, returns full_name/html_url', async () => {
+test('createUserRepo: sends auto_init:false + private:true, returns full_name/html_url', async () => {
   let sentBody = null;
   const fetchImpl = async (url, init) => {
     sentBody = JSON.parse(init.body);
@@ -100,10 +100,10 @@ test('createUserRepo: sends auto_init:false + private:false, returns full_name/h
   };
   const out = await gh.createUserRepo('tok', { name: 'mercury', fetchImpl });
   assert.equal(sentBody.auto_init, false, 'empty repo — no README/first commit');
-  // Still public AFTER the ADR 0155 scope widen: `repo` COULD create a private repo,
-  // but a repo Cloud Bongos creates stays public by product choice (open-source /
-  // capture-resistant by design). Guards against the widen silently changing what we make.
-  assert.equal(sentBody.private, false, 'a repo WE create is public by product choice');
+  // PRIVATE by default (ADR 0370, superseding ADR 0155 §3): a new owner's code is never
+  // world-readable from the first push unless they choose that. strictEqual on `true`, so
+  // a dropped field (GitHub's own default is public) reds here too.
+  assert.equal(sentBody.private, true, 'a repo WE create is private by default');
   assert.equal(sentBody.name, 'mercury');
   assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury' });
 });

package/tests/goal_map_page.mjs

@@ -413,7 +413,7 @@ await test('a goal title never becomes markup — in the ledger, the panel or th
 
 await test('Sky sits directly under Goals in the nav, member-gated, at the URL Goals links to', () => {
   const shell = read('shell.js');
-  const item = shell.indexOf("{ id: 'goal-map', label: 'Sky', icon: 'goals', href: '/goal-map', gate: 'member' }");
+  const item = shell.indexOf("{ id: 'goal-map', label: 'Sky', icon: 'sky', href: '/goal-map', gate: 'member' }");
   assert.ok(item > -1, 'the nav item, with the slot the map was denied (ADR 0227 §11)');
   const goals = shell.indexOf("{ id: 'goals', label: 'Goals'"); const work = shell.indexOf("{ id: 'work', label: 'Tasks'");
   assert.ok(goals > -1 && goals < item && item < work, 'under Goals, above Tasks');

package/tests/hall_commands.mjs

@@ -156,7 +156,7 @@ test('the page is wired: nav entry in Docs, sign-in gated, both reads, no hand-t
   assert.match(js, /\/api\/bongos\/cli\/commands/);
   assert.ok(!/data-skill=|data-verb=|\/builder-ship|bongos claim/.test(page), 'the HTML names no command — the rows are generated');
   const shell = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
-  assert.match(shell, /id: 'commands', label: 'Commands', icon: 'docs', href: '\/commands', gate: 'signed'/);
+  assert.match(shell, /id: 'commands', label: 'Commands', icon: 'commands', href: '\/commands', gate: 'signed'/);
   const serveInternal = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
   assert.match(serveInternal.match(/const SIGNEDIN_BUILDERS_PAGE_RE =\s*(\/.*\/);/)[1], /\|commands\)/);
 });

package/tests/hall_nav.mjs

@@ -683,3 +683,45 @@ test('the badge is styled for BOTH shapes of the rail', () => {
   const drawer = css.slice(css.indexOf('html.drawer-open .app-sidebar'));
   assert.match(drawer, /\.nav-item__badge \{ top: 50%/, 'the mobile drawer position');
 });
+
+// task 1004626: ONE GLYPH PER TAB. The rail is an icon strip until it opens,
+// so at rest the icon is the tab's only name. Nine Government tabs once wore
+// one shield and every Docs tab one page — the owner's word was "very
+// confusing". Read off the RENDERED markup, so a fallback or a render bug that
+// paints two tabs alike reds here even if the NAV keys differ.
+test('every sidebar tab draws its own icon — no two tabs share a glyph', () => {
+  const html = boot().sidebarHtml;
+  const items = [...html.matchAll(/<a class="nav-item" id="nav-([^"]+)"[^>]*><svg class="nav-icon"[^>]*>([\s\S]*?)<\/svg>/g)]
+    .map((m) => ({ id: m[1], glyph: m[2] }));
+  assert.ok(items.length >= 20, `the nav items were actually located (${items.length})`);
+  const seen = new Map();
+  for (const { id, glyph } of items) {
+    assert.ok(glyph.trim(), `nav item ${id} draws a glyph (an unknown icon key renders an empty frame)`);
+    assert.ok(!seen.has(glyph), `nav items ${seen.get(glyph)} and ${id} draw the same icon`);
+    seen.set(glyph, id);
+  }
+});
+
+test('every NAV icon key is declared in ICONS, used once, and no two ICONS draw alike', () => {
+  const nav = SRC.slice(SRC.indexOf('var NAV = ['), SRC.indexOf('var NAV_COLLAPSE_KEY'));
+  const keys = [...nav.matchAll(/icon: '([^']+)'/g)].map((m) => m[1]);
+  assert.ok(keys.length >= 20, 'the NAV icon keys were actually located');
+  const block = SRC.slice(SRC.indexOf('var ICONS = {'), SRC.indexOf('function icon('));
+  const icons = new Map([...block.matchAll(/^\s+([a-z]+): '(.*)',$/gm)].map((m) => [m[1], m[2]]));
+  assert.ok(icons.size >= keys.length, 'the ICONS entries were actually located');
+  for (const k of keys) assert.ok(icons.has(k), `NAV icon '${k}' exists in ICONS`);
+  assert.equal(new Set(keys).size, keys.length, `no icon key is used by two tabs: ${keys.filter((k, i) => keys.indexOf(k) !== i).join(', ')}`);
+  const markup = [...icons.values()];
+  assert.equal(new Set(markup).size, markup.length, 'no two ICONS entries draw the same markup');
+});
+
+// task 1004639: glyph path data is shipped verbatim, and the release packager's
+// leak scan reads four numbers chained on dots as a leaked address. The first
+// thinking glyph chained four that way and refused the whole core release, so a new
+// glyph separates its numbers with spaces wherever four would otherwise chain.
+test('no glyph path data reads as an IP address to the release leak scan', () => {
+  const block = SRC.slice(SRC.indexOf('var ICONS = {'), SRC.indexOf('function icon('));
+  assert.ok(block.includes('thinking:'), 'the ICONS block was actually located');
+  const hits = block.match(/\d+\.\d+\.\d+\.\d+/g) || [];
+  assert.deepEqual(hits, [], 'separate the numbers with spaces so no four chain on dots');
+});

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-08-city-tab/);
+    assert.match(HTML, /shell\.js\?v=2026-10-08-glyph-fix/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);
@@ -657,6 +657,18 @@ try {
     assert.equal(lib.canFrame('https://builders.cloudbongos.com/studio', here), true);
     assert.equal(lib.canFrame('https://cloudbongos.com/', here), false, 'the apex is another origin');
     assert.equal(lib.canFrame('not a url', { origin: '', href: '' }), false);
+    // task 1004393: the apex and status pages split in place only once the proxy allows it.
+    assert.equal(lib.FRAME_SIBLINGS, false, 'off until the proxy sends frame-ancestors for the builders host');
+    assert.equal(lib.canFrame('https://status.cloudbongos.com/', here), false, 'the default follows the switch');
+    assert.equal(lib.canFrame('https://cloudbongos.com/pricing', here, true), true, 'the apex, switched on');
+    assert.equal(lib.canFrame('https://status.cloudbongos.com/', here, true), true, 'the status host, switched on');
+    assert.equal(lib.canFrame('https://box.cloudbongos.com/', here, true), false, 'never another subdomain');
+    assert.equal(lib.canFrame('https://cloudbongos.com.evil.example/', here, true), false, 'never a lookalike host');
+    assert.equal(lib.canFrame('http://cloudbongos.com/', here, true), false, 'never the other scheme');
+    const local = { origin: 'http://builders.localhost:3000', href: 'http://builders.localhost:3000/tweak-editor' };
+    assert.equal(lib.canFrame('http://localhost:3000/', local, true), true, 'the port travels with the apex');
+    const bare = { origin: 'https://cloudbongos.com', href: 'https://cloudbongos.com/builders/tweak-editor' };
+    assert.equal(lib.canFrame('https://status.cloudbongos.com/', bare, true), false, 'only the builders host frames its siblings');
     assert.equal(lib.splitWindowFeatures({ availWidth: 1600, availHeight: 1000, availLeft: 0, availTop: 0 }), 'popup=yes,width=1600,height=500,left=0,top=500', 'the bottom half of the screen');
     assert.match(lib.splitWindowFeatures(undefined), /^popup=yes,width=\d+,height=\d+,left=0,top=\d+$/);
   });