@bongos/core 1.24.11 → 1.24.12

package/tests/hall_nav.mjs

@@ -282,7 +282,10 @@ test('sidebar groups read by audience, in order', () => {
   // it is the goals seen as one picture.
   // 2026-10-08: 'city' — the governor city — joins after the Board Room, on the
   // same atom and for the same reason (owner call; it leads the Governing mode).
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'city', 'thinking', 'studio'],
+  // task 1004939 (goal 1000137): 'market-watch' joins last — the project's scouts on its
+  // market, so its subject is the project. Module-gated: it is dropped wherever the
+  // default-off market-watch module is not enabled (this boot reports no module state).
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'city', 'thinking', 'studio', 'market-watch'],
     'the unlabeled group is the project itself (task 1002425 order)');
   // task 1004685 (the living-city prototype, round-3 board 6): 'my-agents' joins You —
   // how your own Claude works for you, the personal half of "the city steers

package/tests/hall_page_gate_map.mjs

@@ -60,6 +60,10 @@ const ORACLE = {
   // owner-only (atom + owner seat) (tests/market_watch_settings.mjs proves the 403s), and the
   // shell carries no data, so sign-in is the page tier and the routes are the wall.
   '/builders/market-watch-settings': 'requireBuilderPage',
+  // task 1004939: the Market Watch home and tracked-item pages. Every member of the
+  // project reads them; both reads are requireBuilder, so sign-in is the whole gate.
+  '/builders/market-watch': 'requireBuilderPage',
+  '/builders/market-watch-item': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
   // task 1003479: the goal map, on the goal board's tier. task 1004232 (sky part 4):
   // the URL now serves THE PROJECT SKY (the same page as /thinking, in its whole-project

package/tests/market_watch_module.mjs

@@ -34,12 +34,13 @@ test('the manifest validates, ships disabled, declares a payer, and contributes
   assert.equal(manifest.spend && manifest.spend.requiresPayer, true,
     'every run spends the project AI budget, so the payer guard is declared before the first route');
   // Task 1004936 added its tables and the one-shot hub seed; task 1004937 the weekly-run
-  // poller; task 1004940 the weekly ask (its poller, its routes and its hall slice). Each
+  // poller; task 1004939 the home and item pages' route file; task 1004940 the weekly ask (its poller, its routes and its hall slice). Each
   // screen task adds its own entries, so this pins what must be there, not the whole list.
   const c = manifest.contributes;
   assert.equal(c.migrations, true);
   for (const p of ['hub-seed', 'weekly-run', 'weekly-ask']) assert.ok(c.pollers.includes(p), `poller ${p}`);
   assert.ok(c.routes.includes('ask'), 'the weekly ask routes');
+  assert.ok(c.routes.includes('pages'), 'the home and item pages\' routes');
   assert.ok(c.routes.includes('settings'), 'the owner settings routes (task 1004938, tests/market_watch_settings.mjs)');
   assert.ok(c.uiSections.includes('weekly-ask'), 'the weekly ask hall slice (hallWidgetScripts needs a uiSection)');
   assert.ok(c.routes.includes('rules'), 'the rules page routes (task 1004941)');

package/tests/market_watch_pages.mjs

@@ -0,0 +1,356 @@
+// tests/market_watch_pages.mjs — the Market Watch home and tracked-item pages (task
+// 1004939, goal 1000137), without a database: the page shapes run on the committed seed
+// (36 competitors, 24 partners), the proposal rules, the three routes (a visitor with no
+// session gets a 401 and no data; a member reads and proposes), the quiet off state, and
+// the escaping of member and research text where it becomes markup.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import http from 'node:http';
+import vm from 'node:vm';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const seed = require('../modules/market-watch/seed.js');
+const db = require('../modules/market-watch/db.js');
+const pages = require('../modules/market-watch/pages.js');
+const rows = require('./fixtures/market-watch-seed-rows.cjs');
+// The page's escaper is the hall's one (dom-utils.js), loaded for real, not a stand-in.
+{
+  const win = { location: { search: '', hash: '', pathname: '/' }, addEventListener() {}, localStorage: null };
+  const doc = { addEventListener() {}, querySelector: () => null, querySelectorAll: () => [], documentElement: { dataset: {} } };
+  new Function('window', 'document', readFileSync(new URL('../modules/hall-ui/public/dom-utils.js', import.meta.url), 'utf8'))(win, doc);
+  globalThis.OTB = win.OTB;
+  // The sparkline is the kit's (hall-kit.js), loaded for real too.
+  new Function('window', 'document', readFileSync(new URL('../modules/hall-ui/public/hall-kit.js', import.meta.url), 'utf8'))(win, doc);
+  globalThis.OTBKit = win.OTBKit;
+}
+const MW = require('../modules/hall-ui/public/market-watch-lib.js');
+
+const R = rows.seedRows(seed);
+const RUNS = db.numberRuns(R.runs);
+const ITEMS = rows.listItemsFrom(R, RUNS, db);
+const NOW = new Date('2026-10-29T09:00:00Z');
+const SETTINGS = { settings: { enabled: true, monthly_cap_usd: 20, cadence: 'weekly', configured: true }, spentThisMonthUsd: 3.4, recentRuns: [], nextRunDue: null };
+const RULES = { active: R.rules };
+const byName = (name, kind) => ITEMS.find((i) => i.kind === kind && i.name.startsWith(name));
+
+function home(over = {}) {
+  return pages.shapeHome({ items: ITEMS, runs: RUNS, settings: SETTINGS, scores: rows.latestScoresFrom(R), entries: R.entries, rules: RULES, now: NOW, ...over });
+}
+function itemView(it) {
+  return pages.shapeItem({ item: it, entries: rows.caseFileFrom(R, RUNS, it.id), history: db.sparklines(R.scores.filter((s) => s.item_id === it.id), RUNS), rules: RULES });
+}
+
+// ---- the home on the seed ---------------------------------------------------------
+
+test('the home desk on the seed: three scouts, 36 competitors on the landscape, eight reports', () => {
+  const h = home();
+  assert.deepEqual(h.scouts.map((s) => [s.kind, s.watched]), [['competitor', 36], ['partner', 24], ['topic', 0]]);
+  assert.equal(h.scouts[0].level, 1, 'one numbered run (the seed), so every item is level 1');
+  assert.equal(h.weeks_watched, 1);
+  assert.deepEqual(h.streak, [{ n: 1, ran: true, date: '2026-10-28', reason: null }]);
+  assert.equal(h.dots.length, 36, 'every competitor is a dot');
+  for (const d of h.dots) assert.equal(Object.keys(d.scores).length, 6, `${d.name}: five dimensions plus overall`);
+  // The axes are the rules' own words, with overall last.
+  assert.deepEqual(h.axes.map((a) => a.key), [...seed.RUBRIC.competitor.map((d) => d.key), 'overall']);
+  assert.equal(h.axes[0].label, 'AI agents write the code');
+  // Eight reports, at most one per item, competitors and partners taken in turn
+  // (they are scored on different scales, so they are never ranked against each other).
+  assert.equal(h.reports.length, 8);
+  assert.equal(new Set(h.reports.map((r) => r.item_id)).size, 8);
+  assert.deepEqual(h.reports.map((r) => r.kind), ['competitor', 'partner', 'competitor', 'partner', 'competitor', 'partner', 'competitor', 'partner']);
+  assert.equal(h.reports[1].item_name, byName('NLnet Foundation', 'partner').name, 'the best-fit partner leads the partners');
+  assert.deepEqual(h.hot, h.reports.map((r) => r.item_id));
+  assert.deepEqual(h.budget, { cap_usd: 20, spent_usd: 3.4, left_usd: 16.6 });
+  assert.deepEqual(h.next_sweep, { due: null, enabled: true });
+});
+
+test('a report is the surest entry on its item: pinned, then confidence, then insight', () => {
+  const it = byName('GitHub Copilot', 'competitor');
+  const byId = new Map([[String(it.id), it]]);
+  const e = (id, over) => ({ id, item_id: it.id, run_id: 1, type: 'datapoint', found_on: '2026-10-28', takeaway: `t${id}`, confidence: 2, source_url: 'https://x.test', pinned: false, ...over });
+  assert.equal(pages.pickReports([e(1), e(2, { confidence: 3 }), e(3)], byId)[0].id, 2);
+  assert.equal(pages.pickReports([e(1, { type: 'insight' }), e(2)], byId)[0].id, 1);
+  assert.equal(pages.pickReports([e(1, { confidence: 3 }), e(2, { pinned: true, confidence: 1 })], byId)[0].id, 2);
+  assert.equal(pages.pickReports([e(1)], new Map()).length, 0, 'an entry on an item that is not listed is no report');
+});
+
+test('a removed item leaves the desk; a paused one stays on the landscape but is not counted as watched', () => {
+  const removed = byName('Cognition', 'competitor');
+  const paused = byName('Cursor', 'competitor');
+  const items = ITEMS.map((i) => (i.id === removed.id ? { ...i, status: 'removed' } : i.id === paused.id ? { ...i, status: 'paused' } : i));
+  const h = home({ items });
+  assert.equal(h.scouts[0].watched, 34);
+  assert.ok(!h.dots.some((d) => d.id === removed.id));
+  assert.ok(h.dots.some((d) => d.id === paused.id));
+  assert.ok(!h.reports.some((r) => r.item_id === removed.id));
+});
+
+test('the budget never reads below zero, and a stopped watch says so', () => {
+  const h = home({ settings: { ...SETTINGS, settings: { ...SETTINGS.settings, enabled: false }, spentThisMonthUsd: 25 } });
+  assert.equal(h.budget.left_usd, 0);
+  assert.deepEqual(MW.nextSweep(h), { big: 'paused', small: 'the watch is switched off' });
+  const due = home({ settings: { ...SETTINGS, nextRunDue: new Date('2026-11-02T06:00:00Z') } });
+  assert.equal(MW.nextSweep(due, NOW).big, '3d 21h');
+  assert.equal(MW.nextSweep(home(), NOW).big, 'due now');
+});
+
+// ---- the item page on the seed ----------------------------------------------------
+
+test('the dossier on the seed: five labelled sparklines, the overall line and the case file', () => {
+  const v = itemView(byName('GitHub Copilot', 'competitor'));
+  assert.equal(v.item.kind, 'competitor');
+  assert.deepEqual(v.dimensions.map((d) => d.label), seed.RUBRIC.competitor.map((d) => d.label));
+  for (const d of v.dimensions) assert.deepEqual([d.series.length, d.first === d.latest], [1, true]);
+  assert.deepEqual(v.overall, { series: [6], first: 6, latest: 6 });
+  assert.deepEqual(v.runs, [{ n: 1, date: '2026-10-28' }]);
+  assert.equal(v.entries.length, 4);
+  for (const e of v.entries) {
+    assert.equal(e.run, 1);
+    assert.match(e.source_url, /^https:\/\//);
+    assert.ok([1, 2, 3].includes(e.confidence));
+  }
+  const p = itemView(byName('NLnet Foundation', 'partner'));
+  assert.deepEqual(p.dimensions.map((d) => d.key), seed.RUBRIC.partner.map((d) => d.key), 'a partner is scored on the partner rubric');
+});
+
+test('a sparkline is the kit sparkline, and skips a run that did not score the dimension instead of drawing a zero', () => {
+  const svg = MW.spark([4, null, 6], 60, 20, 'x');
+  assert.match(svg, /class="kit-spark"/, 'drawn by OTBKit.sparklineHtml');
+  assert.equal(svg, MW.spark([4, 6], 60, 20, 'x'), 'the null run is dropped, not drawn as 0');
+});
+
+// ---- proposals ----------------------------------------------------------------------
+
+const COP = { id: 4, kind: 'competitor' };
+const KEYS = new Set(seed.RUBRIC.competitor.map((d) => d.key));
+const norm = (b, item = COP) => pages.normalizeProposal(b, { item, rubricKeys: KEYS });
+
+test('each of the four changes, with a one-line reason, becomes a proposal the server shapes', () => {
+  assert.deepEqual(norm({ kind: 'rescore', dimension: 'contributor_economy', value: '4', reason: 'pays maintainers now' }).value,
+    { kind: 'rescore', item_id: 4, log_entry_id: null, reason: 'pays maintainers now', payload: { dimension: 'contributor_economy', value: 4 } });
+  assert.deepEqual(norm({ kind: 'move_kind', to: 'competitor', reason: 'r' }).value.payload, { from: 'competitor', to: 'partner' },
+    'the direction comes from the item, never from the client');
+  assert.deepEqual(norm({ kind: 'move_kind', reason: 'r' }, { id: 9, kind: 'partner' }).value.payload, { from: 'partner', to: 'competitor' });
+  assert.deepEqual(norm({ kind: 'add_source', url: 'https://example.org/changelog', reason: 'r' }).value.payload, { source_url: 'https://example.org/changelog' });
+  assert.deepEqual(norm({ kind: 'correct_entry', log_entry_id: '15', reason: 'r' }).value, { kind: 'correct_entry', item_id: 4, log_entry_id: 15, reason: 'r', payload: {} });
+  assert.deepEqual(norm({ kind: 'remove_item', reason: 'shut down' }).value.payload, {}, 'stop tracking');
+  assert.deepEqual(pages.normalizeProposal({ kind: 'add_item', scout: 'topic', name: ' agent pay models ', reason: 'r' }).value.payload,
+    { kind: 'topic', name: 'agent pay models', url: null });
+});
+
+test('a proposal is refused without a reason, with a bad value, or about something it cannot name', () => {
+  const err = (b, item) => norm(b, item).error;
+  assert.equal(err({ kind: 'rescore', dimension: 'human_gates', value: 4 }), 'reason_required');
+  assert.equal(err({ kind: 'rescore', dimension: 'human_gates', value: 4, reason: '   \n ' }), 'reason_required');
+  assert.equal(err({ kind: 'rescore', dimension: 'human_gates', value: 4, reason: 'x'.repeat(281) }), 'reason_too_long');
+  assert.equal(norm({ kind: 'rescore', dimension: 'human_gates', value: 4, reason: 'two\nlines' }).value.reason, 'two lines', 'a reason is one line');
+  assert.equal(err({ kind: 'rescore', dimension: 'worker_ownership', value: 4, reason: 'r' }), 'invalid_dimension', 'a partner dimension on a competitor');
+  assert.equal(err({ kind: 'rescore', dimension: 'human_gates', value: 11, reason: 'r' }), 'invalid_value');
+  assert.equal(err({ kind: 'rescore', dimension: 'human_gates', value: '', reason: 'r' }), 'invalid_value');
+  assert.equal(err({ kind: 'move_kind', reason: 'r' }, { id: 3, kind: 'topic' }), 'cannot_move_topic');
+  assert.equal(err({ kind: 'add_source', url: 'javascript:alert(1)', reason: 'r' }), 'invalid_url');
+  assert.equal(err({ kind: 'correct_entry', log_entry_id: '0', reason: 'r' }), 'invalid_entry');
+  assert.equal(err({ kind: 'rule_change', reason: 'r' }), 'invalid_kind', 'a rules change is the rules page\'s, not this one\'s');
+  assert.equal(pages.normalizeProposal({ kind: 'rescore', reason: 'r' }).error, 'item_not_found');
+  assert.equal(pages.normalizeProposal({ kind: 'add_item', scout: 'friend', name: 'x', reason: 'r' }).error, 'invalid_scout');
+});
+
+test('the propose dialog offers exactly the four changes, and posts what the server reads', () => {
+  const html = MW.dialogHtml('change', { item: { id: 4, kind: 'competitor', name: 'Copilot' }, dimensions: [{ key: 'human_gates', label: 'Humans hold the gates', latest: 7 }], entries: [] });
+  assert.deepEqual([...html.matchAll(/<option value="(rescore|move_kind|add_source|correct_entry)">/g)].map((m) => m[1]), ['rescore', 'move_kind', 'add_source', 'correct_entry']);
+  assert.match(html, /Move to partner/);
+  assert.doesNotMatch(MW.dialogHtml('change', { item: { kind: 'topic' } }), /move_kind/, 'a topic cannot move');
+  const form = (vals) => ({ elements: Object.fromEntries(Object.entries(vals).map(([k, v]) => [k, { value: v }])) });
+  assert.deepEqual(MW.bodyFor('change', form({ kind: 'rescore', dimension: 'human_gates', value: '8', reason: ' r ' }), { id: 4 }),
+    { kind: 'rescore', item_id: 4, reason: 'r', dimension: 'human_gates', value: '8' });
+  assert.deepEqual(MW.bodyFor('stop', form({ reason: 'gone' }), { id: 4 }), { kind: 'remove_item', item_id: 4, reason: 'gone' });
+});
+
+// ---- untrusted text becomes markup only through esc --------------------------------
+
+test('an item name or takeaway with markup in it is escaped on the landscape and in the dialog', () => {
+  const evil = '<img src=x onerror=alert(1)>"\'';
+  const h = home();
+  const svg = MW.scopeSvg({ ...h, dots: [{ id: 1, name: evil, overall: 5, level: 1, scores: { open_source_ethos: 5, contributor_economy: 5 } }], hot: [1] }, 'open_source_ethos', 'contributor_economy');
+  assert.ok(!svg.includes('<img'), 'no tag survives');
+  assert.match(svg, /&lt;img src=x onerror=alert\(1\)&gt;&quot;&#39;/);
+  const dlg = MW.dialogHtml('change', { item: { id: 1, kind: 'competitor', name: evil }, dimensions: [], entries: [{ id: 1, found_on: '2026-10-28', takeaway: evil }] });
+  assert.ok(!dlg.includes('<img'));
+  assert.equal(MW.safeHref('javascript:alert(1)'), '#', 'only an http(s) source becomes a link');
+});
+
+// ---- the routes --------------------------------------------------------------------
+
+const api = require('../src/module-api.js');
+let viewer = { id: 77, rank: 'xenos' };
+api.requireBuilder = (req, res, next) => {
+  if (!viewer) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = viewer;
+  next();
+};
+const reads = [];
+let runReads = 0;
+const handed = [];
+db.listItems = async (pool, a) => { reads.push(['listItems', a.project]); handed.push(a.knownRuns === RUNS); return ITEMS; };
+db.numberedRuns = async () => { runReads += 1; return RUNS; };
+db.settingsView = async () => SETTINGS;
+db.rules = async () => RULES;
+db.getItem = async (pool, { project, id, knownRuns }) => (handed.push(knownRuns === RUNS), 0) || (project === 'https://hub.test' ? ITEMS.find((i) => i.id === id) || null : null);
+db.caseFile = async (pool, { itemId, knownRuns }) => (handed.push(knownRuns === RUNS), 0) || rows.caseFileFrom(R, RUNS, itemId);
+db.scoreHistory = async (pool, { itemId, knownRuns }) => (handed.push(knownRuns === RUNS), 0) || db.sparklines(R.scores.filter((s) => s.item_id === itemId), RUNS);
+db.proposals = async () => [];
+const inserts = [];
+const fakePool = {
+  async query(sql, params) {
+    if (/LATEST|DISTINCT ON/.test(sql)) return { rows: rows.latestScoresFrom(R) };
+    if (/found_on >= \$2/.test(sql)) return { rows: R.entries };
+    if (/INSERT INTO market_watch_proposals/.test(sql)) {
+      inserts.push({ sql, params });
+      // The item-scoped INSERT selects from the item WHERE it is this project's.
+      if (/FROM market_watch_items i/.test(sql) && params[2] === 999) return { rows: [] };
+      return { rows: [{ id: 501, kind: params[1] === undefined ? 'add_item' : (/VALUES/.test(sql) ? 'add_item' : params[1]), status: 'open', created_at: 'now' }] };
+    }
+    throw new Error(`unexpected query: ${sql.slice(0, 60)}`);
+  },
+};
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code } });
+  next();
+});
+app.use(express.json());
+app.use('/api/bongos', require('../modules/market-watch/routes/pages.js')({ pool: fakePool, project: 'https://hub.test' }));
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      let raw = '';
+      res.on('data', (c) => { raw += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(raw); } catch { /* none */ } resolve({ status: res.statusCode, body: j, raw }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+test('A NON-MEMBER GETS NOTHING: no session is a 401 on every route, before any read or write', async () => {
+  viewer = null;
+  reads.length = 0;
+  inserts.length = 0;
+  try {
+    for (const [m, p, b] of [['GET', '/market-watch/home'], ['GET', '/market-watch/items/4'], ['POST', '/market-watch/proposals', { kind: 'remove_item', item_id: 4, reason: 'r' }]]) {
+      const r = await call(m, p, b);
+      assert.equal(r.status, 401, `${m} ${p}`);
+      assert.doesNotMatch(r.raw, /Copilot|competitor|takeaway/, `${m} ${p} leaks nothing`);
+    }
+    assert.equal(reads.length, 0, 'nothing was read');
+    assert.equal(inserts.length, 0, 'nothing was written');
+  } finally {
+    viewer = { id: 77, rank: 'xenos' };
+  }
+});
+
+test('an offboarded builder is no member: 403 on every route, nothing read or written', async () => {
+  viewer = { id: 78, rank: 'metic', status: 'inactive' };
+  reads.length = 0;
+  inserts.length = 0;
+  try {
+    for (const [m, p, b] of [['GET', '/market-watch/home'], ['GET', '/market-watch/items/4'], ['POST', '/market-watch/proposals', { kind: 'remove_item', item_id: 4, reason: 'r' }]]) {
+      assert.equal((await call(m, p, b)).status, 403, `${m} ${p}`);
+    }
+    assert.deepEqual([reads.length, inserts.length], [0, 0]);
+  } finally {
+    viewer = { id: 77, rank: 'xenos' };
+  }
+});
+
+test('every member reads both pages, a newcomer included, scoped to this project', async () => {
+  runReads = 0;
+  handed.length = 0;
+  const h = await call('GET', '/market-watch/home');
+  assert.equal(h.status, 200);
+  assert.equal(h.body.dots.length, 36);
+  assert.deepEqual(reads.at(-1), ['listItems', 'https://hub.test']);
+  const it = await call('GET', '/market-watch/items/4');
+  assert.equal(it.status, 200);
+  assert.equal(it.body.item.name, 'GitHub Copilot coding agent');
+  assert.equal(runReads, 2, 'one read of the runs per page load, not one per db.js read');
+  assert.deepEqual(handed, [true, true, true, true], 'listItems, getItem, caseFile and scoreHistory reuse it');
+  assert.equal((await call('GET', '/market-watch/items/9999')).status, 404);
+  assert.equal((await call('GET', '/market-watch/items/abc')).status, 400);
+});
+
+test('a member files a proposal: one row, origin member, their id, this project; nothing else changes', async () => {
+  inserts.length = 0;
+  const r = await call('POST', '/market-watch/proposals', { kind: 'rescore', item_id: 4, dimension: 'human_gates', value: 8, reason: 'agents now need two reviews' });
+  assert.equal(r.status, 201);
+  assert.equal(inserts.length, 1);
+  const [{ sql, params }] = inserts;
+  assert.match(sql, /'member'/);
+  assert.match(sql, /i\.project = \$1/, 'the item must be this project\'s, in the SQL');
+  assert.deepEqual(params, ['https://hub.test', 'rescore', 4, null, JSON.stringify({ dimension: 'human_gates', value: 8 }), 'agents now need two reviews', 77]);
+  const s = await call('POST', '/market-watch/proposals', { kind: 'add_item', scout: 'competitor', name: 'Devin 3', reason: 'new' });
+  assert.equal(s.status, 201);
+  assert.equal(inserts[1].params.at(-1), 77);
+  assert.equal((await call('POST', '/market-watch/proposals', { kind: 'rescore', item_id: 4, dimension: 'human_gates', value: 8 })).status, 400);
+  assert.equal((await call('POST', '/market-watch/proposals', { kind: 'remove_item', item_id: 9999, reason: 'r' })).status, 404, 'an item that is not this project\'s');
+  assert.equal((await call('POST', '/market-watch/proposals', { kind: 'remove_item', item_id: 4, reason: 'r', status: 'approved' })).status, 400,
+    'an unknown field (a member trying to approve their own proposal) is refused');
+  assert.equal(inserts.length, 2, 'refused proposals write nothing');
+});
+
+// ---- the quiet off state -----------------------------------------------------------
+
+function bootPage(file, { modules, fetchStatus = 200, search = '' } = {}) {
+  const els = {};
+  const el = (id) => (els[id] = els[id] || { id, hidden: true, innerHTML: '', textContent: '', style: {}, value: '', dataset: {}, addEventListener() {}, querySelectorAll: () => [], setAttribute() {} });
+  const listeners = {};
+  const fetches = [];
+  const window = {
+    __MODULES__: modules,
+    OTBMarketWatch: MW,
+    location: { pathname: '/market-watch', search, assign() {} },
+    localStorage: { getItem: () => null, setItem() {} },
+  };
+  const document = {
+    title: 'Market Watch — Hub',
+    getElementById: el,
+    querySelectorAll: () => [],
+    addEventListener: (ev, fn) => { listeners[ev] = fn; },
+  };
+  const ctx = vm.createContext({
+    window, document, URLSearchParams, console,
+    fetch: async (url) => { fetches.push(url); return { status: fetchStatus, ok: fetchStatus === 200, json: async () => ({ error: { code: 'not_found' } }) }; },
+  });
+  vm.runInContext(readFileSync(new URL(`../modules/hall-ui/public/${file}`, import.meta.url), 'utf8'), ctx);
+  return { els, fetches, ready: () => listeners.DOMContentLoaded() };
+}
+
+test('MARKET WATCH OFF: both pages show the quiet off line, not an error, and ask the server nothing', async () => {
+  for (const [file, body] of [['market-watch.js', 'mw-desk'], ['market-watch-item.js', 'mw-wrap']]) {
+    const p = bootPage(file, { modules: { enabled: { 'market-watch': false } }, search: '?id=4' });
+    await p.ready();
+    assert.equal(p.els['mw-off'].hidden, false, `${file}: the off state shows`);
+    assert.equal(p.els['mw-fail'].hidden, true, `${file}: no error`);
+    assert.equal(p.els[body].hidden, true);
+    assert.equal(p.fetches.length, 0, `${file}: an off module is not asked`);
+  }
+  // A project whose shell did not report the module, where its routes are not mounted: the
+  // read 404s with no item code, and that is the same quiet off state.
+  for (const file of ['market-watch.js', 'market-watch-item.js']) {
+    const p = bootPage(file, { modules: undefined, fetchStatus: 404, search: '?id=4' });
+    await p.ready();
+    assert.equal(p.els['mw-off'].hidden, false, `${file}: unmounted routes read as off`);
+    assert.equal(p.els['mw-fail'].hidden, true);
+  }
+});

package/tests/market_watch_rules.mjs

@@ -45,7 +45,7 @@ const V1 = {
 
 // ── the in-memory database ─────────────────────────────────────────────────────
 function makeDb() {
-  const t = { versions: [], proposals: [], items: [], seq: 100 };
+  const t = { versions: [], proposals: [], items: [], scores: [], runs: [{ id: 50, project: P, status: 'done' }], seq: 100 };
   const nextId = () => ++t.seq;
   t.versions.push({ id: nextId(), project: P, ...JSON.parse(JSON.stringify(V1)), approved_at: new Date('2026-10-28'), created_at: new Date('2026-10-28') });
   t.items.push({ id: nextId(), project: P, kind: 'competitor', name: 'OpenHands', url: 'https://openhands.dev', status: 'active', why_tracked: '' });
@@ -103,6 +103,28 @@ function makeDb() {
         if (it) it.status = 'removed';
         return one(it ? { id: it.id } : null);
       }
+      case 'mw:item-rescore': {
+        const it = t.items.find((x) => String(x.id) === String(a) && x.project === b && x.status !== 'removed');
+        const run = [...t.runs].reverse().find((x) => x.project === b && ['done', 'partial'].includes(x.status));
+        if (!it || !run) return one(null);
+        const old = t.scores.find((x) => x.item_id === it.id && x.run_id === run.id && x.dimension === c);
+        if (old) old.value = d; else t.scores.push({ item_id: it.id, run_id: run.id, dimension: c, value: d });
+        return one({ item_id: it.id });
+      }
+      case 'mw:item-move': {
+        const it = t.items.find((x) => String(x.id) === String(a) && x.project === b && x.kind === d && x.status !== 'removed');
+        if (!it || t.items.some((o) => o.project === b && o.kind === c && o.url === it.url && o.name === it.name)) return one(null);
+        it.kind = c;
+        return one({ id: it.id });
+      }
+      case 'mw:item-add-source': {
+        const it = t.items.find((x) => String(x.id) === String(a) && x.project === b && x.status !== 'removed');
+        if (!it) return one(null);
+        it.facts = it.facts || {};
+        const list = it.facts.watch_sources || [];
+        if (!list.includes(c)) it.facts.watch_sources = [...list, c];
+        return one({ id: it.id });
+      }
       case 'mw:proposal-decide': {
         const p = prop(a, b);
         if (!p || p.status !== 'open') return one(null);
@@ -260,13 +282,13 @@ test('an approved add-item proposal creates the tracked item; the run\'s and the
   assert.equal(proposals.itemFromPayload({}), null);
 });
 
-test('remove_item takes the item off the watch; kinds this page does not define are recorded as approved', async () => {
+test('remove_item takes the item off the watch; a correct_entry is recorded as approved, not applied', async () => {
   const { t, pool, withTx } = makeDb();
   const itemId = t.items[0].id;
   const filed = await proposals.createProposal(pool, { project: P, step: 'names', change: { op: 'remove', item_id: itemId }, reason: 'not a rival', proposedBy: ADA });
   await proposals.decideProposal({ project: P, id: filed.proposal.id, decision: 'approve', decidedBy: OWNER, withTx });
   assert.equal(t.items[0].status, 'removed');
-  t.proposals.push({ id: 900, project: P, kind: 'rescore', origin: 'member', item_id: itemId, payload: {}, status: 'open', proposed_by: ADA });
+  t.proposals.push({ id: 900, project: P, kind: 'correct_entry', origin: 'member', item_id: itemId, log_entry_id: 7, payload: {}, status: 'open', proposed_by: ADA });
   const out = await proposals.decideProposal({ project: P, id: 900, decision: 'approve', decidedBy: OWNER, withTx });
   assert.deepEqual([out.status, out.applied], ['approved', false]);
 });
@@ -494,3 +516,41 @@ test('the weekly run fences a tracked item\'s name, link and why-tracked text as
   assert.notEqual(other, markers[0].match(/([0-9a-f]{16})/)[1], 'a fresh marker per request');
   assert.doesNotMatch(req.system[0].text, /Ignore all previous/, 'the cached rules prefix carries no item text');
 });
+
+// task 1004939: the item page's proposals, applied on approval with the payloads pages.js writes.
+test('approving the item page\'s re-score, move and add-source applies each one', async () => {
+  const { t, withTx } = makeDb();
+  const itemId = t.items[0].id;
+  const file = (id, kind, payload) => t.proposals.push({ id, project: P, kind, origin: 'member', item_id: itemId, payload, status: 'open', proposed_by: ADA });
+  file(901, 'rescore', { dimension: 'human_gates', value: 8 });
+  file(902, 'add_source', { source_url: 'https://openhands.dev/blog' });
+  file(903, 'move_kind', { from: 'competitor', to: 'partner' });
+  for (const id of [901, 902, 903]) {
+    const out = await proposals.decideProposal({ project: P, id, decision: 'approve', decidedBy: OWNER, withTx });
+    assert.deepEqual([out.ok, out.status, out.applied], [true, 'applied', true], `proposal ${id}`);
+  }
+  assert.deepEqual(t.scores, [{ item_id: itemId, run_id: 50, dimension: 'human_gates', value: 8 }]);
+  assert.deepEqual(t.items[0].facts.watch_sources, ['https://openhands.dev/blog']);
+  assert.equal(t.items[0].kind, 'partner');
+  // A move that no longer applies (it is a partner now) changes nothing and stays open.
+  file(904, 'move_kind', { from: 'competitor', to: 'partner' });
+  assert.equal((await proposals.decideProposal({ project: P, id: 904, decision: 'approve', decidedBy: OWNER, withTx })).reason, 'no_longer_applies');
+  assert.equal(t.proposals.find((p) => p.id === 904).status, 'open');
+  // A payload that is not what pages.js writes is refused, never guessed at.
+  file(905, 'add_source', { source_url: 'javascript:alert(1)' });
+  assert.equal((await proposals.decideProposal({ project: P, id: 905, decision: 'approve', decidedBy: OWNER, withTx })).reason, 'bad_payload');
+});
+
+test('the payloads the item page files are the ones an approval applies', () => {
+  const pages = require(path.join(MW, 'pages.js'));
+  const item = { id: 4, kind: 'competitor' };
+  for (const body of [
+    { kind: 'rescore', dimension: 'human_gates', value: '6.5', reason: 'r' },
+    { kind: 'move_kind', reason: 'r' },
+    { kind: 'add_source', url: 'https://example.org/changelog', reason: 'r' },
+  ]) {
+    const n = pages.normalizeProposal(body, { item });
+    assert.ok(n.ok, body.kind);
+    assert.ok(proposals.itemChange(n.value.kind, n.value.payload), `${body.kind}: pages.js writes a payload proposals.js applies`);
+  }
+});

package/tests/nav_permission_atoms.mjs

@@ -94,7 +94,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852); task 1004938: the
 // Market Watch settings nav item and its fuel glyph.
-const SHELL_SHA = '4022e01fbb4045ad';
+const SHELL_SHA = 'b89fd877947ae9f8';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);