@bongos/core 1.23.13 → 1.23.14

package/modules/hall-ui/public/studio.states.json

@@ -278,7 +278,7 @@
     },
     "approvals": {
       "auth": true,
-      "_": "The Approval queue (task 1004323): the studio's quick action opens the glass panel, 1 of 2, on the AFTER render of the applied page with the changed lines beside it. Against the kit's own stub it opens on its could-not-read line; populated, run it against the hall-preview harness (fixtures copy-desk__approvals.json, tasks__visuals.json and the two CANNED_WRITES). HALL_PREVIEW_VISUALS=<dir> serves real renders by the fixture's names.",
+      "_": "The Approval queue (task 1004323): the studio's quick action opens the glass panel, 1 of 2. The card is the changed lines, what each was beside what it is now, with Approve and ship and Send it back under them. Against the kit's own stub it opens on its could-not-read line; populated, run it against the hall-preview harness (fixtures copy-desk__approvals.json, tasks__visuals.json and the two CANNED_WRITES).",
       "actions": [
         [
           "wait",
@@ -297,13 +297,14 @@
         "visible": [
           ".aq-dialog",
           ".aq-eyebrow",
-          ".aq-render"
+          ".aq-line",
+          "[data-approve]"
         ]
       }
     },
     "approvals-before": {
       "auth": true,
-      "_": "The before/after switch on before: the page as it was, nothing marked.",
+      "_": "See it on the page, switched to before: the page as it was.",
       "actions": [
         [
           "wait",
@@ -317,6 +318,14 @@
           "wait",
           1200
         ],
+        [
+          "click",
+          "[data-peek]"
+        ],
+        [
+          "wait",
+          500
+        ],
         [
           "click",
           "[data-phase=\"before\"]"
@@ -336,7 +345,7 @@
     },
     "approvals-phone": {
       "auth": true,
-      "_": "The phone render (the view switch beside the lines).",
+      "_": "See it on the page, on the phone render.",
       "actions": [
         [
           "wait",
@@ -350,6 +359,14 @@
           "wait",
           1200
         ],
+        [
+          "click",
+          "[data-peek]"
+        ],
+        [
+          "wait",
+          500
+        ],
         [
           "click",
           "[data-device=\"phone\"]"
@@ -473,6 +490,39 @@
           ".aq-outcome--sent"
         ]
       }
+    },
+    "approvals-page": {
+      "auth": true,
+      "_": "See it on the page: the optional rendered page opens under the words, on the AFTER render.",
+      "actions": [
+        [
+          "wait",
+          700
+        ],
+        [
+          "click",
+          "#studio-approvals"
+        ],
+        [
+          "wait",
+          1200
+        ],
+        [
+          "click",
+          "[data-peek]"
+        ],
+        [
+          "wait",
+          700
+        ]
+      ],
+      "expect": {
+        "visible": [
+          ".aq-dialog",
+          ".aq-line",
+          ".aq-render"
+        ]
+      }
     }
   },
   "reducedMotion": {

package/modules/hall-ui/public/welcome-boot.js

@@ -10,9 +10,11 @@
 // hall underneath.
 //
 // Rules:
-//   - Once per builder per LOCAL day, remembered in localStorage. Storage that throws cannot
-//     remember, so such a browser is never shown it (it would replay on every visit).
-//   - Never for a visitor who is not signed in, and never over a deep link (#/task/N, #/idea/N).
+//   - A signed-in builder sees it once per LOCAL day, and again after every fresh sign-in (the
+//     sign-in click leaves a flag in localStorage that the return visit consumes). Storage that
+//     throws cannot remember, so such a browser is never shown it (it would replay on every visit).
+//   - A visitor who is not signed in sees the Welcome on Home, every visit, with a "Sign in with
+//     GitHub" button in place of the role choices. Only on Home, never over a deep link (#/task/N, #/idea/N).
 //   - shell.js asks onAccess() BEFORE the craft picker; a load where the welcome showed marks the
 //     picker asked (OTBCraftMode.markAsked), so the two never stack.
 //   - Picking a role also sets the hall's craft mode. Governing is a seat (craft-mode.js), so the
@@ -26,6 +28,8 @@
   'use strict';
 
   var DAY_KEY = 'hall-welcome-day:';
+  var SIGNIN_KEY = 'hall-welcome-signin';
+  var SIGNIN_HREF = '/api/bongos/auth/web/start';
   var ART = { day: '/builders/welcome-day.webp', night: '/builders/welcome-night.webp' };
   var ART_WAIT = 1500;       // the veil lifts once the painting is in, or after this long
   var RUN_MS = 3400;         // the city powering up before the greeting
@@ -159,15 +163,25 @@
         '<span class="wb__version" id="wb-version" hidden></span></div>' +
       '<div class="wb__veil" aria-hidden="true"></div>' +
       '<button class="wb__skip" type="button" data-wb-skip>Skip</button>' +
-      '<div class="wb__after">' +
-        '<h2 class="wb__hi" id="wb-hi">' + esc(greetingFor(now) + ', ' + nameOf(builder)) + '</h2>' +
+      '<div class="wb__after">' + (builder ? signedInHtml(builder, now) : signedOutHtml()) + '</div>';
+  }
+  function signedInHtml(builder, now) {
+    return '<h2 class="wb__hi" id="wb-hi">' + esc(greetingFor(now) + ', ' + nameOf(builder)) + '</h2>' +
         '<p class="wb__lede">Where do you want to start the day?</p>' +
         '<div class="wb__choices">' +
           '<button class="wb__choice" type="button" data-wb-roles aria-expanded="false" aria-controls="wb-roles"><b>Start with your role</b><span>Pick today’s craft and go straight to its room.</span></button>' +
           '<button class="wb__choice" type="button" data-wb-home><b>Your home page</b><span>Your work, what needs you, and what shipped.</span></button>' +
         '</div>' +
-        '<div class="wb__roles" id="wb-roles" hidden></div>' +
-      '</div>';
+        '<div class="wb__roles" id="wb-roles" hidden></div>';
+  }
+  // A visitor who is not signed in: the same scene, one way in.
+  function signedOutHtml() {
+    return '<h2 class="wb__hi" id="wb-hi">Welcome to ' + esc(projectName(window.__BRANDING__)) + '</h2>' +
+        '<p class="wb__lede">Sign in to see your work, what needs you, and what shipped.</p>' +
+        '<div class="wb__choices">' +
+          '<button class="wb__choice" type="button" data-wb-signin><b>Sign in with GitHub</b><span>Pick up where you left off.</span></button>' +
+          '<button class="wb__choice" type="button" data-wb-home><b>Look around first</b><span>See the public side of the project.</span></button>' +
+        '</div>';
   }
   function rolesHtml() {
     return rolesFor(craft()).map(function (r) {
@@ -250,6 +264,7 @@
     if (!btn || !root || leaving) return;
     if (btn.hasAttribute('data-wb-skip')) { begin(); finish(); return; }
     if (btn.hasAttribute('data-wb-home')) { leave(); return; }
+    if (btn.hasAttribute('data-wb-signin')) { markSigningIn(); go(SIGNIN_HREF); return; }
     if (btn.hasAttribute('data-wb-roles')) {
       var box = root.querySelector('#wb-roles');
       var open = box.hidden;
@@ -299,19 +314,54 @@
     at(ART_WAIT, begin);
     var skip = root.querySelector('[data-wb-skip]');
     if (skip && skip.focus) skip.focus();
-    loadVersion();
+    if (builder) loadVersion();   // an anonymous visit costs no request
   }
 
   // A link straight to an overlay (#/task/N, #/idea/N, #/blocker/N) is not greeted over.
   function deepLink() { return /^#\//.test((window.location && window.location.hash) || ''); }
 
+  // Home is the bare hall URL with no routed view; a signed-out visitor is only greeted there.
+  function onHome() {
+    var p = String((window.location && window.location.pathname) || '/').replace(/\/+$/, '');
+    var h = (window.location && window.location.hash) || '';
+    return (p === '' || p === '/builders') && (h === '' || h === '#' || h === '#home');
+  }
+
+  // A sign-in in flight is remembered, so the welcome greets the builder when they come back signed in.
+  function markSigningIn() { try { window.localStorage.setItem(SIGNIN_KEY, '1'); } catch (_) { /* cannot remember */ } }
+  function takeSignedIn() {
+    try {
+      var was = window.localStorage.getItem(SIGNIN_KEY) === '1';
+      if (was) window.localStorage.removeItem(SIGNIN_KEY);
+      return was;
+    } catch (_) { return false; }
+  }
+  // Any sign-in link on the page (the shell's own, in the top bar) counts the same as the welcome's button.
+  function watchSignInLinks() {
+    if (!document.addEventListener) return;
+    document.addEventListener('click', function (e) {
+      var a = e.target && e.target.closest && e.target.closest('a[href]');
+      // Same-origin only: the href must START with the sign-in path, not merely mention it.
+      if (a && String(a.getAttribute('href')).indexOf(SIGNIN_HREF) === 0) markSigningIn();
+    }, true);
+  }
+
   // shell.js's call, before the craft picker's. True when the welcome is (or was) up on this load.
   function onAccess(access, builder) {
     if (shown) return true;
-    if (!access || access.authed !== true || !builder || builder.id == null || deepLink()) return false;
+    if (deepLink()) return false;
+    if (access && access.authed === false) {
+      if (!onHome()) return false;
+      shown = true;
+      show(null);
+      return true;
+    }
+    if (!access || access.authed !== true || !builder || builder.id == null) return false;
     var key = DAY_KEY + builder.id, now = new Date();
     try {
-      if (!firstVisitToday(window.localStorage.getItem(key), now)) return false;
+      // Every fresh sign-in is greeted; otherwise only the day's first visit.
+      var fresh = takeSignedIn();
+      if (!fresh && !firstVisitToday(window.localStorage.getItem(key), now)) return false;
       window.localStorage.setItem(key, localDay(now));
     } catch (_) { return false; }
     shown = true;
@@ -322,11 +372,11 @@
   }
 
   var api = {
-    DAY_KEY: DAY_KEY, ROLES: ROLES, ART: ART, TOWERS: TOWERS, BEACONS: BEACONS, LANES: LANES, AW: AW, AH: AH,
+    DAY_KEY: DAY_KEY, SIGNIN_KEY: SIGNIN_KEY, ROLES: ROLES, ART: ART, TOWERS: TOWERS, BEACONS: BEACONS, LANES: LANES, AW: AW, AH: AH,
     localDay: localDay, firstVisitToday: firstVisitToday, greetingFor: greetingFor, nameOf: nameOf, timeOfDay: timeOfDay,
     artFor: artFor, projectName: projectName, bannerText: bannerText, rolesFor: rolesFor, pulseRuns: pulseRuns,
     onAccess: onAccess, finish: finish, close: close,
   };
-  if (typeof window !== 'undefined') window.OTBWelcome = api;
+  if (typeof window !== 'undefined') { window.OTBWelcome = api; watchSignInLinks(); }
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
 })();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.13",
+  "version": "1.23.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.13",
+      "version": "1.23.14",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.13",
+  "version": "1.23.14",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10460,7 +10460,15 @@
       "text": "Project owners can now press Recruit next to any builder on the community leaderboard or search, which opens their project's invite page with that builder's name already filled in."
     }
   ],
-  "1.23.13": [
+  "1.23.14": [
+    {
+      "id": "1004839",
+      "text": "The studio is simpler for artists. Its four doors now read in plain words: Resume, Work through tweaks, Approve and confirm tweaks, and Needs to be reviewed. The approve door only shows for artists at metic or above, and an em"
+    },
+    {
+      "id": "1004851",
+      "text": "The Welcome page now greets people every time they sign in, not only on their first visit of the day. Visitors who are not signed in now land on the Welcome with a Sign in with GitHub button."
+    },
     {
       "id": "1004644",
       "text": "The tweak editor's split view now shows the landing and status pages under the words, instead of opening a second window."

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.13'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.14'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_approval_queue.mjs

@@ -188,14 +188,19 @@ await test('open: the queue\'s head, the applied page\'s render, and the words b
   assert.ok(b.classes.has('aq-open'), 'the page behind stops scrolling');
   assert.equal(text(b.q('.aq-eyebrow')), 'approval queue · 1 of 2');
   assert.equal(text(b.q('.aq-title')), 'Home · landing · 1 line rewritten, applied · 1 not applied');
+  assert.equal(b.q('img'), null, 'the words lead: no picture until the artist asks for it');
+  assert.equal(b.requests.filter((r) => r.url.endsWith('/visuals')).length, 0, 'and none is fetched until then');
+  await b.click(b.q('[data-peek]'));
   const img = b.q('img');
   assert.equal(img.attrs.src, url(41, 'after-desktop-light'), 'the AFTER render, desktop, in the hall\'s own mode');
   assert.equal(img.attrs.alt, 'Home, after, desktop, light');
   assert.deepEqual(b.qa('[data-phase]').map((x) => [text(x), x.attrs['aria-pressed']]), [['before', 'false'], ['after', 'true']]);
+  await b.click(b.q('[data-peek]'));
+  assert.equal(b.q('img'), null, 'and it folds away again');
   assert.equal(b.qa('mark').length, 1, 'one applied line carries the mark');
   assert.equal(text(b.q('mark')), 'Agents write the code.');
   assert.match(text(b.q('.aq-line--refused')), /not applied: the page no longer shows it/);
-  assert.equal(b.body.querySelectorAll('img').length, 1, 'a hostile line is text, never markup');
+  assert.equal(b.body.querySelectorAll('img').length, 0, 'a hostile line is text, never markup');
   assert.equal(b.win.pwned, undefined);
   assert.equal(text(b.q('.aq-hint')), 'highlighted: the words you changed');
   assert.deepEqual(b.counts, [2], 'the door hears how many wait');
@@ -205,9 +210,10 @@ await test('open: the queue\'s head, the applied page\'s render, and the words b
 await test('the switches: before and after, desktop and phone, light and dark, each a render of the applied branch', async () => {
   const b = bootPanel({ answers: { [APPROVALS]: queueFor(), [vis(41)]: slotsFor(41) } });
   await b.panel.open(); await settle(); await settle();
+  await b.click(b.q('[data-peek]'));
   await b.click(b.q('[data-phase="before"]'));
   assert.equal(b.q('img').attrs.src, url(41, 'before-desktop-light'));
-  assert.equal(b.qa('mark').length, 0, 'before is the page as it was: nothing marked');
+  assert.equal(b.qa('mark').length, 1, 'the words beside the picture do not change with it');
   await b.click(b.q('[data-device="phone"]'));
   assert.equal(b.q('img').attrs.src, url(41, 'before-phone-light'));
   assert.match(b.q('img').attrs.class, /aq-render--phone/);
@@ -216,17 +222,19 @@ await test('the switches: before and after, desktop and phone, light and dark, e
   assert.equal(b.requests.filter((r) => r.url.endsWith('/visuals')).length, 1, 'the renders are read once per round');
 });
 
-await test('a missing render says what it shows instead; no renders at all means nothing to approve from', async () => {
+await test('a missing render says what it shows instead; no renders at all never blocks the decision', async () => {
   const b = bootPanel({ answers: { [APPROVALS]: queueFor(), [vis(41)]: slotsFor(41, ['after-desktop-dark']) } });
   await b.panel.open(); await settle(); await settle();
+  await b.click(b.q('[data-peek]'));
   assert.equal(b.q('img').attrs.src, url(41, 'after-desktop-dark'));
   assert.equal(text(b.q('.aq-frame__swap')), 'No desktop light render; showing desktop dark.');
   const none = bootPanel({ answers: { [APPROVALS]: queueFor(), [vis(41)]: slotsFor(41, []) } });
   await none.panel.open(); await settle(); await settle();
+  assert.ok(!none.q('[data-approve]').disabled, 'the words are what is approved: no picture is needed');
+  await none.click(none.q('[data-peek]'));
   assert.equal(none.q('img'), null);
   assert.match(text(none.q('.aq-frame__note')), /No render is attached/);
-  assert.ok(none.q('[data-approve]').disabled, 'approve waits for a picture of the page');
-  assert.ok(!none.q('[data-open-note]').disabled, 'sending it back does not');
+  assert.ok(!none.q('[data-open-note]').disabled, 'sending it back is open too');
 });
 
 await test('approve and ship: one POST through the host\'s write, then the artboard\'s line and the next page', async () => {
@@ -297,6 +305,24 @@ await test('a builder who may not decide reads the queue with a sentence, not tw
   assert.match(text(b.q('.aq-sealed')), /Only the artist who wrote this page, or another artist/);
 });
 
+await test('open(pageId) lands on that page card, says so when it is not in the queue, and can skip the second read', async () => {
+  const b = bootPanel({ answers: { [APPROVALS]: queueFor(), [vis(42)]: slotsFor(42) } });
+  await b.panel.open('landing:projects');
+  await settle(); await settle();
+  assert.equal(text(b.q('.aq-eyebrow')), 'approval queue · 2 of 2', 'the Projects card, not the head');
+  const miss = bootPanel({ answers: { [APPROVALS]: queueFor() } });
+  await miss.panel.open('landing:nowhere');
+  await settle(); await settle();
+  assert.equal(text(miss.q('.aq-eyebrow')), 'approval queue · 1 of 2');
+  assert.equal(text(miss.q('.aq-error')), 'That page is not waiting for your sign-off right now.');
+  const once = bootPanel({ answers: { [APPROVALS]: queueFor() } });
+  await once.panel.refresh();
+  await once.panel.open(undefined, { reload: false });
+  await settle(); await settle();
+  assert.equal(once.requests.filter((r) => r.url.endsWith('/copy-desk/approvals')).length, 1, 'refreshed once, opened without re-reading');
+  assert.equal(once.panel.notAppliedCount(), 0);
+});
+
 await test('empty, closed with Escape, and focus goes back where it was', async () => {
   const b = bootPanel({ answers: { [APPROVALS]: queueFor({ tasks: [] }) } });
   const opener = { focus() { boot.focused = opener; } };
@@ -391,9 +417,6 @@ await test('a line holding {{productName}} reads as the product name in a chip,
   assert.ok(chips.every((c) => c.attrs['data-hole'] === 'productName' && text(c) === 'Cloud Bongos'));
   assert.ok(b.q('mark').querySelector('.aq-hole'), 'the chip sits inside the changed words\' mark');
   assert.ok(!/\{\{/.test(b.scrim.innerHTML || '') && !/\{\{/.test(text(b.scrim)), 'no raw {{token}} anywhere in the panel');
-  b.scrim.fire('click', { target: b.q('[data-phase="before"]') }); await settle();
-  assert.equal(lineWords(), 'Both are how Cloud Bongos itself works.');
-  assert.equal(asideWords(), 'becomes: This project, Cloud Bongos, has two doors.');
 });
 
 await test('the dialog fits the viewport at every width: capped by the screen, the page shrinks first, rows wrap', () => {
@@ -411,7 +434,8 @@ await test('the dialog fits the viewport at every width: capped by the screen, t
   assert.match(rule('.aq-foot'), /flex-wrap: wrap/);
   assert.match(rule('.aq-body'), /min-width: 0/);
   assert.match(rule('.aq-frame'), /flex-grow: 1;[\s\S]*min-width: 0/, 'the rendered page is what shrinks first');
-  assert.match(rule('.aq-lines'), /width: clamp\(240px, 32%, 300px\)/, 'the words keep the artboard\'s 300 until the page has shrunk');
+  assert.match(rule('.aq-lines'), /min-width: 0/, 'the words take the full width and can shrink');
+  assert.match(rule('.aq-line'), /grid-template-columns: minmax\(0, 1fr\) minmax\(0, 1fr\)/, 'was and now sit side by side');
   assert.match(rule('.aq-line__text'), /overflow-wrap: anywhere/, 'a long word breaks inside its column');
 });
 

package/tests/hall_studio_home.mjs

@@ -129,7 +129,7 @@ function heldClock(h, m) {
   return Held;
 }
 
-function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY } = {}) {
+function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY, rank = 'metic', queue = null } = {}) {
   const root = augment(makeEl('body', {}));
   root.innerHTML = body;
   const byId = (id) => walk(root, (c) => (c.id === id ? c : null));
@@ -156,7 +156,7 @@ function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY } =
       const body = opts ? opts.body : undefined;
       requests.push({ method, url, body });
       const key = `${method} ${url.replace(/^\/api\/bongos/, '')}`;
-      if (key === 'GET /me') return signedIn ? ok({ builder: { id: ME, display_name: 'Artist A', rank: 'metic' } }) : { ok: false, status: 401, data: {} };
+      if (key === 'GET /me') return signedIn ? ok({ builder: { id: ME, display_name: 'Artist A', rank } }) : { ok: false, status: 401, data: {} };
       const a = answers[key];
       if (typeof a === 'function') return a(body);
       if (a) return a;
@@ -170,6 +170,7 @@ function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY } =
     localStorage: { getItem: () => null, setItem() {} },
     addEventListener() {},
     scrollTo() {},
+    ...(queue ? { OTBApprovalQueue: queue.api, OTBApprovalQueueLib: require('../modules/hall-ui/public/approval-queue-lib.js') } : {}),
   };
   // setInterval is held, never real (a real one would keep the run alive): the
   // test fires each registered tick by hand, as a minute passing.
@@ -243,8 +244,8 @@ try {
     ]);
     assert.equal(lib.landingHost('https://cloudbongos.com/', 'builders.x.test'), 'cloudbongos.com', 'the stamped origin wins');
     assert.equal(lib.landingHost('{{publicOrigin}}', 'builders.x.test'), 'x.test', 'an unstamped token is no address');
-    assert.equal(lib.askedLine(NEXT.asked_pages), '1 page has been asked for. It comes up first in the Tweak/CopyWrite Flow.');
-    assert.equal(lib.askedLine(4), '4 pages have been asked for. They come up first in the Tweak/CopyWrite Flow.');
+    assert.equal(lib.askedLine(NEXT.asked_pages), '1 page has been asked for. It comes up first in Work through tweaks.');
+    assert.equal(lib.askedLine(4), '4 pages have been asked for. They come up first in Work through tweaks.');
     assert.equal(lib.askedLine(0), '');
   });
 
@@ -260,7 +261,7 @@ try {
     assert.deepEqual(rows.map((r) => [r.title, r.state, r.age, r.stuck]), [
       ['Contact', 'Approved, going live', 'for 17 days', true],
       ['Tasks', 'Submitted, waiting to be applied', 'for 1 day', false],
-      ['Status', 'Needs a look', 'since today', true],
+      ['Status', 'Needs to be reviewed', 'since today', true],
     ]);
     assert.deepEqual(lib.inFlightRows(null, NOW), []);
   });
@@ -309,13 +310,79 @@ try {
     assert.equal(s.requests.filter((r) => /copy-desk\/(tally|next|pages)/.test(r.url)).length, 0);
   });
 
+  // A stand-in for the Approval queue panel: what the studio asks of it is the point here.
+  const stubQueue = ({ count = 2, pending = 0 } = {}) => {
+    const calls = { open: [], refresh: 0 };
+    const api = { mount: (o) => ({
+      open: async (...a) => { calls.open.push(a); },
+      refresh: async () => { calls.refresh += 1; o.onCount(count); return count; },
+      count: () => count,
+      notAppliedCount: () => pending,
+    }) };
+    return { calls, api };
+  };
+
+  await test('the approve door shows for metic and up, and never mounts the queue below that', async () => {
+    const q = stubQueue();
+    const metic = bootStudio({ answers: HOME, queue: q });
+    await metic.settle();
+    assert.equal(metic.el('studio-approvals').hidden, false);
+    assert.equal(q.calls.refresh, 1, 'the door hears how many wait');
+    const low = stubQueue();
+    const thetes = bootStudio({ answers: HOME, queue: low, rank: 'thetes' });
+    await thetes.settle();
+    assert.equal(thetes.el('studio-approvals').hidden, true, 'below metic the door stays hidden');
+    assert.equal(low.calls.refresh, 0, 'and its queue is never read');
+    const gone = bootStudio({ answers: HOME, rank: 'archon' });
+    await gone.settle();
+    assert.equal(gone.el('studio-approvals').hidden, true, 'no panel loaded: no door to nowhere');
+  });
+
+  await test('an empty approval queue says so in a toast; a submitted-not-applied round still opens the dialog', async () => {
+    const empty = stubQueue({ count: 0 });
+    const a = bootStudio({ answers: HOME, queue: empty });
+    await a.settle();
+    await a.click('studio-approvals');
+    assert.equal(empty.calls.open.length, 0, 'no blank dialog');
+    assert.match(a.el('toast').textContent, /Nothing is waiting for your sign-off/);
+    const pending = stubQueue({ count: 0, pending: 1 });
+    const b = bootStudio({ answers: HOME, queue: pending });
+    await b.settle();
+    await b.click('studio-approvals');
+    assert.equal(pending.calls.open.length, 1, 'the not-applied list is still reachable');
+    const full = stubQueue({ count: 2 });
+    const c = bootStudio({ answers: HOME, queue: full });
+    await c.settle();
+    await c.click('studio-approvals');
+    assert.equal(full.calls.open.length, 1);
+    assert.equal(full.calls.open[0][1].reload, false, 'one read, then open without re-reading');
+    assert.equal(full.calls.refresh, 2, 'the page load and the click, nothing more');
+  });
+
+  await test('a page that Needs to be reviewed opens its own approval card from the status panel', async () => {
+    const q = stubQueue();
+    const waiting = { ...PAGES, in_flight: [{ page_id: 'landing:contact', title: 'Contact', surface: 'landing', state: 'waiting_for_artist', state_word: 'Waiting for your review', since: day(1), stuck: false }] };
+    const s = bootStudio({ answers: { ...HOME, 'GET /copy-desk/pages': ok(waiting) }, queue: q });
+    await s.settle();
+    await s.click('st-status');
+    const overlay = s.el('st-panel');
+    overlay.fire('click', { target: overlay.querySelector('[data-review-page]'), preventDefault() {} });
+    await s.settle();
+    assert.equal(s.el('st-panel').hidden, true, 'the panel gives way to the card');
+    assert.deepEqual(JSON.parse(JSON.stringify(q.calls.open)).map((c) => c[0]), ['landing:contact']);
+    const low = bootStudio({ answers: { ...HOME, 'GET /copy-desk/pages': ok(waiting) }, queue: stubQueue(), rank: 'thetes' });
+    await low.settle();
+    await low.click('st-status');
+    assert.equal(low.el('st-panel-body').querySelector('[data-review-page]'), null, 'below metic the row opens the editor instead');
+  });
+
   await test('the Tweak/CopyWrite Flow: the recommendation, pick another swaps it, take it claims THAT page and opens it', async () => {
     const s = bootStudio({ answers: { ...HOME, 'POST /copy-desk/pages/builders:studio/claim': ok({ ok: true, outcome: 'created' }) } });
     await s.settle();
     await s.click('st-flow');
     assert.equal(s.el('st-panel').hidden, false);
     assert.ok(s.html.classList.contains('st-open'));
-    assert.equal(s.el('st-panel-title').textContent, 'Tweak/CopyWrite Flow');
+    assert.equal(s.el('st-panel-title').textContent, 'Work through tweaks');
     const body = () => s.el('st-panel-body').innerHTML;
     assert.match(body(), /st-next__page">Projects</);
     assert.match(body(), /landing · 2 people asked for it/);
@@ -346,7 +413,7 @@ try {
     await s.settle();
     await s.click('st-status');
     const body = s.el('st-panel-body').innerHTML;
-    assert.equal(s.el('st-panel-title').textContent, 'Artist Review Status');
+    assert.equal(s.el('st-panel-title').textContent, 'Needs to be reviewed');
     assert.deepEqual([...body.matchAll(/st-surface__name">([^<]*)</g)].map((m) => m[1]), ['Landing', 'Builders hall', 'Status']);
     assert.match(body, /st-surface__where">cloudbongos\.com</);
     assert.match(body, /1 of 2 tweaked/);

package/tests/welcome_boot_browser.mjs

@@ -43,6 +43,7 @@ async function hall({ art = true, reducedMotion = 'no-preference', time = null }
   await ctx.route(ORIGIN + '/**', (route) => {
     const p = new URL(route.request().url()).pathname;
     if (p === '/' || p === '/index.html') return route.fulfill({ contentType: 'text/html', body: PAGE });
+    if (p === '/api/bongos/auth/web/start') return route.fulfill({ contentType: 'text/html', body: '<!doctype html><title>github</title><p id="auth">sign in</p>' });
     if (p === '/thinking' || p === '/city') return route.fulfill({ contentType: 'text/html', body: '<!doctype html><title>room</title><p id="room">' + p + '</p>' });
     const ext = path.extname(p);
     if (ext === '.webp' && !art) return route.fulfill({ status: 404, body: '' });
@@ -123,12 +124,53 @@ test('once a day: the next load the same day gets no welcome (and the picker is
   await ctx.close();
 });
 
-test('a visitor who is not signed in is never greeted, and nothing is remembered', { skip }, async () => {
+test('a visitor who is not signed in gets the Welcome on Home with a sign-in button, and no day is remembered', { skip }, async () => {
   const ctx = await hall();
   const { page } = await open(ctx);
   await page.evaluate(() => window.OTBShell.applyAccess({ authed: false }));
-  const s = await page.evaluate(() => ({ welcome: !!document.getElementById('welcome-boot'), keys: Object.keys(localStorage).filter((k) => k.startsWith('hall-welcome-day')) }));
-  assert.deepEqual(s, { welcome: false, keys: [] });
+  await page.waitForSelector('#welcome-boot');
+  const s = await page.evaluate(() => ({
+    hi: document.getElementById('wb-hi').textContent,
+    signin: !!document.querySelector('[data-wb-signin]'),
+    roles: !!document.querySelector('[data-wb-roles]'),
+    keys: Object.keys(localStorage).filter((k) => k.startsWith('hall-welcome-day') || k === 'hall-welcome-signin'),
+    picker: !!document.getElementById('craft-picker'),
+  }));
+  assert.match(s.hi, /^Welcome to /);
+  assert.deepEqual([s.signin, s.roles, s.keys, s.picker], [true, false, [], false]);
+  await ctx.close();
+});
+
+test('every fresh sign-in is welcomed again the same day, whichever sign-in link was clicked', { skip }, async () => {
+  for (const link of ['[data-wb-signin]', '#shell-signin']) {
+    const ctx = await hall();
+    const first = await open(ctx);
+    await signIn(first.page);
+    await first.page.waitForSelector('#welcome-boot');
+    await first.page.close();   // the day is now seen
+    const out = await open(ctx);
+    await out.page.evaluate(() => window.OTBShell.applyAccess({ authed: false }));
+    await out.page.waitForSelector('#welcome-boot');
+    // The welcome's own button, or the shell's top-bar link, leaves the flag and heads for GitHub.
+    await out.page.evaluate((sel) => document.querySelector(sel).click(), link);
+    await out.page.waitForSelector('#auth');
+    const { page } = await open(ctx);
+    await signIn(page);
+    await page.waitForSelector('#welcome-boot');
+    assert.equal(await page.evaluate(() => localStorage.getItem('hall-welcome-signin')), null, link + ': the flag is spent');
+    await ctx.close();
+  }
+});
+
+test('a link that only mentions the sign-in path on another site sets no flag', { skip }, async () => {
+  const ctx = await hall();
+  const { page } = await open(ctx);
+  await page.evaluate(() => {
+    const a = document.createElement('a');
+    a.id = 'far'; a.href = 'https://elsewhere.test/auth/web/start'; a.addEventListener('click', (e) => e.preventDefault());
+    document.body.appendChild(a); a.click();
+  });
+  assert.equal(await page.evaluate(() => localStorage.getItem('hall-welcome-signin')), null);
   await ctx.close();
 });