@bongos/core 1.24.25 → 1.24.27

package/tests/core_update_banner.mjs

@@ -237,7 +237,7 @@ test('a real request through the assembled router returns the verdict, not a 500
   }
 });
 
-// ── the banner ────────────────────────────────────────────────────────────────
+// ── the shell's half: who is asked, and how often ───────────────────────────────
 
 function boot({ permissions, update, status = 200, dismissed = null, provisioning = true, pathname = '/settings' } = {}) {
   const els = new Map();
@@ -295,15 +295,6 @@ function boot({ permissions, update, status = 200, dismissed = null, provisionin
 
 const BEHIND = { running: '1.19.861', latest: '1.19.871', behind: true, reading: 'ok' };
 
-test('an owner who is behind sees the banner, naming both versions', async () => {
-  const b = boot({ permissions: { 'core.pin.move': true }, update: BEHIND });
-  await new Promise((r) => setTimeout(r, 0));
-  const el = b.banner();
-  assert.ok(el, 'banner rendered');
-  assert.match(el.innerHTML, /1\.19\.871/);
-  assert.match(el.innerHTML, /1\.19\.861/);
-});
-
 test('a builder without the atom is never even asked about it', async () => {
   const b = boot({ permissions: { 'task.create': true }, update: BEHIND });
   await new Promise((r) => setTimeout(r, 0));
@@ -311,33 +302,6 @@ test('a builder without the atom is never even asked about it', async () => {
   assert.ok(!b.requested.includes('GET /api/bongos/core-update'), 'no request is made');
 });
 
-test('no answer renders no banner — not a false "up to date"', async () => {
-  const b = boot({ permissions: { 'core.pin.move': true }, update: { running: '1.19.861', latest: null, behind: false, reading: 'no_answer' } });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.equal(b.banner(), undefined);
-});
-
-test('a dismissal silences THAT version only', async () => {
-  const same = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, dismissed: '1.19.871' });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.equal(same.banner(), undefined, 'the dismissed version stays dismissed');
-
-  const newer = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, dismissed: '1.19.800' });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.ok(newer.banner(), 'a newer release re-announces itself');
-});
-
-test('the Upgrade action appears only where the deploy door exists', async () => {
-  const on = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, provisioning: true });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.match(on.banner().innerHTML, /href="\/deploy"/);
-
-  const off = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, provisioning: false });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.ok(off.banner(), 'a tenant still hears the news');
-  assert.doesNotMatch(off.banner().innerHTML, /href="\/deploy"/, 'but is not offered a 404');
-});
-
 test('the banner is asked for ONCE, not on every access settle', async () => {
   const b = boot({ permissions: { 'core.pin.move': true }, update: BEHIND });
   await new Promise((r) => setTimeout(r, 0));
@@ -345,61 +309,11 @@ test('the banner is asked for ONCE, not on every access settle', async () => {
   assert.equal(first, 1);
 });
 
-// ── the chain, with the map the SERVER would really send (task 1004118) ───────
-//
-// Every case above hands applyAccess a permissions map written here. That is exactly
-// how task 1004045's banner shipped dead: it gated on `core.pin.move`, /me resolved
-// only NAV_PERMISSION_ATOMS, the atom was not in it, and the guard bailed for every
-// builder on every instance — while this suite stayed green throughout.
-//
-// So this case does NOT write the map. It DERIVES it from me.js's own declaration,
-// the way the server does, and grants everything in it. If the atom the banner needs
-// is not part of that projection, there is nothing here to grant and the banner
-// cannot render — which is the real bug, reproduced as a failure.
-test('the banner renders from the projection /me ACTUALLY sends, not one written by this test', async () => {
-  const meSrc = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/me.js'), 'utf8');
-  const m = meSrc.match(/NAV_PERMISSION_ATOMS = Object\.freeze\(\[([^\]]*)\]\)/);
-  assert.ok(m, 'NAV_PERMISSION_ATOMS is readable');
-  const atoms = m[1].split(',').map((x) => x.trim().replace(/^'|'$/g, '')).filter(Boolean);
-  // A builder who holds everything the projection can report — the most generous real
-  // answer the server is capable of giving.
-  const permissions = Object.fromEntries(atoms.map((a) => [a, true]));
-  const b = boot({ permissions, update: BEHIND });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.ok(
-    b.banner(),
-    'the banner did not render for a builder holding EVERY atom /me can report — so the atom it ' +
-    'gates on is outside NAV_PERMISSION_ATOMS and the feature is dead for everyone (task 1004118)',
-  );
-});
-
-// ── the banner must not offer the page you are on (task 1004145) ──────────────
-// The owner pressed this on /deploy and reported "I clicked update, but I didn't see
-// anything happen". Nothing had: it is an <a href="/deploy"> styled as a button and
-// labelled with the verb, so on /deploy it navigates to the current page and does
-// nothing at all. No request was ever made — verified against the live box, which had
-// no core-upgrade POST in three hours and no queued intent from that press.
-
-test('on /deploy the banner points at the control instead of linking to /deploy', async () => {
-  const b = boot({ pathname: '/deploy', permissions: { 'core.pin.move': true }, update: BEHIND });
-  await new Promise((r) => setTimeout(r, 0));
-  const html = b.banner().innerHTML;
-  assert.doesNotMatch(html, /href="\/deploy"/, 'no link to the page already open');
-  assert.match(html, /control below/i, 'it says where the real control is');
-  assert.match(html, /1\.19\.871/, 'and still announces the release');
-});
-
-test('everywhere else the banner still offers the link', async () => {
-  const b = boot({ pathname: '/settings', permissions: { 'core.pin.move': true }, update: BEHIND });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.match(b.banner().innerHTML, /href="\/deploy"/, 'the action is real from any other page');
-});
-
-test('a trailing slash is still /deploy', async () => {
-  const b = boot({ pathname: '/deploy/', permissions: { 'core.pin.move': true }, update: BEHIND });
-  await new Promise((r) => setTimeout(r, 0));
-  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/);
-});
+// The pill (task 1005041) replaced the banner, and its DOM half — said only from an answer,
+// rendered from the projection /me really sends (task 1004118), never a link to the page you
+// are on (task 1004145), never offering a held version (task 1004730) — is pinned against the
+// real shell.js and update-pill.js in tests/update_pill.mjs. What stays here is the verdict,
+// the route, and the shell's half: who is asked, and how often.
 
 test('the banner asks with the project\'s stored update rule (task 1004535)', async () => {
   const r2 = createRequire(import.meta.url);

package/tests/core_upgrade_owner_door.mjs

@@ -430,26 +430,12 @@ function boot({ provisioning, deployUrl, pathname = '/settings', hash = '', held
   vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
   windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions: { 'core.pin.move': true } });
   return {
-    banner: () => inserted.find((e) => String(e._html).includes('is available')),
-    notice: () => inserted.find((e) => e.id === 'core-update-notice'),
     deployItem: () => els.get('nav-deploy'),
   };
 }
 const settle = () => new Promise((r) => setTimeout(r, 0));
 const HUB = 'https://cloudbongos.com/deploy?project=hoodify-finance';
 
-// Task 1004296 moved the hand-off: a hall without a door of its own sends its owner to
-// Settings → Software update, whose Update button carries the hub address (GET
-// /software-update's `door`). The banner and the rail no longer link off-site.
-await t('on a hosted project, the banner\'s Upgrade goes to Settings → Software update, not off-site', async () => {
-  const b = boot({ provisioning: false, deployUrl: HUB });
-  await settle();
-  assert.ok(b.banner(), 'the banner renders');
-  assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, 'Upgrade opens the Software update panel');
-  assert.ok(!b.banner().innerHTML.includes(HUB), 'never the hub address directly, even when an older server sends one');
-  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the local /deploy, which this hall no longer has');
-});
-
 await t('on a hosted project, the rail\'s Deploy item stays hidden — it is the platform hall\'s page', async () => {
   const b = boot({ provisioning: false, deployUrl: HUB });
   await settle();
@@ -458,54 +444,16 @@ await t('on a hosted project, the rail\'s Deploy item stays hidden — it is the
   assert.equal(item.dataset.module, 'provisioning', 'its module gate stays, so a hall without the door hides it');
 });
 
-await t('a hall with no door of its own and no hub still links to Software update', async () => {
-  for (const url of [null, 'javascript:alert(1)', 42]) {
-    const b = boot({ provisioning: false, deployUrl: url });
-    await settle();
-    assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, `Software update for ${JSON.stringify(url)}`);
-    assert.doesNotMatch(b.banner().innerHTML, /javascript:/);
-  }
-});
-
-await t('on the Software update panel itself, the banner points rather than linking to the page it is on', async () => {
-  const b = boot({ provisioning: false, pathname: '/settings', hash: '#software-update' });
-  await settle();
-  assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, 'no link to where you already are');
-  assert.match(b.banner().innerHTML, /core-update-notice__hint/);
-});
-
-await t('on the platform, the local door wins: the banner links /deploy and the rail keeps it', async () => {
+// The banner that used to link here is the Update pill now (task 1005041): where its Update now
+// goes on each kind of hall, and the held version it refuses to offer, are pinned against the
+// real pill in tests/update_pill.mjs. What stays here is the rail.
+await t('on the platform, the rail keeps its local /deploy', async () => {
   const b = boot({ provisioning: true, deployUrl: HUB });
   await settle();
-  assert.match(b.banner().innerHTML, /href="\/deploy"/);
-  assert.ok(!b.banner().innerHTML.includes(HUB));
-  assert.ok(!b.banner().innerHTML.includes('software-update'), 'the platform takes its update at its own door');
   const item = b.deployItem();
   assert.notEqual(item.getAttribute('href'), HUB, 'the rail keeps the local /deploy');
   assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');
 });
 
-// Task 1004730: a version this project already tried and rolled back is not announced as
-// "available" with an Upgrade button. The banner says what happened instead, in the owner's
-// words, and points at Software update for the rest.
-await t('a held version: the banner says it was tried and rolled back, and the project is still fine', async () => {
-  const held = { version: '1.19.1033', still_on: '1.19.871', message: 'long form' };
-  const b = boot({ provisioning: false, held });
-  await settle();
-  const n = b.notice();
-  assert.ok(n, 'the banner renders');
-  assert.doesNotMatch(n.innerHTML, /is available/);
-  assert.match(n.innerHTML, /1\.19\.1033<\/strong> was tried on this project and rolled back/);
-  assert.match(n.innerHTML, /still on 1\.19\.871 and working/);
-  assert.match(n.innerHTML, /href="\/settings#software-update">Details</);
-  assert.doesNotMatch(n.innerHTML, />Upgrade</, 'no button to take the version that just failed');
-});
-
-await t('a hold on an OLDER version than the one now out leaves the ordinary banner', async () => {
-  const b = boot({ provisioning: false, held: { version: '1.19.900', still_on: '1.19.871', message: 'x' } });
-  await settle();
-  assert.ok(b.banner(), 'the newer release is announced as usual');
-});
-
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/deploy_handoff.mjs

@@ -0,0 +1,206 @@
+// tests/deploy_handoff.mjs — the hub's half of the in-place update (task 1005041).
+//
+// A hosted project's hall opens the hub's deploy door as a small window and tells it which
+// version to take (update-pill.js). The safety of that rests on three refusals, each pinned
+// here by EXECUTING the real deploy-handoff.js: a message from any window but the opener, or
+// from any origin but the project's registered address, is not heard; a version the hub's own
+// preview would not move to is shown to the owner, never sent; and with no word from the hall
+// the window waits for a press. It never moves anything on load by itself.
+import assert from 'node:assert/strict';
+import { test, afterEach } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const FILE = path.join(ROOT, 'modules/hall-ui/public/deploy-handoff.js');
+const SRC = fs.readFileSync(FILE, 'utf8');
+const H = require_(FILE);
+
+const PREVIEW = { instance_id: '14', slug: 'toast', reading: 'ok', behind: true, recommended_version: '1.21.30', viewer_may_move: true, open_intent: null };
+const OPENER = {};
+const GO = { tag: 'bongos-update', step: 'go', to: '1.21.30' };
+const base = { data: GO, source: OPENER, opener: OPENER, origin: 'https://toast.cloudbongos.com', allowed: 'https://toast.cloudbongos.com', preview: PREVIEW };
+
+// ── the rule ──────────────────────────────────────────────────────────────────
+
+test('the one message that may start the move', () => {
+  assert.equal(H.judgeGo(base), null);
+});
+
+test('a message from any window but the one that opened this is not heard', () => {
+  assert.equal(H.judgeGo({ ...base, source: {} }), 'not_opener');
+  assert.equal(H.judgeGo({ ...base, opener: null }), 'not_opener');
+});
+
+test('a message from any origin but the project\'s own address is not heard', () => {
+  assert.equal(H.judgeGo({ ...base, origin: 'https://evil.example' }), 'wrong_origin');
+  assert.equal(H.judgeGo({ ...base, origin: 'https://toast.cloudbongos.com.evil.example' }), 'wrong_origin');
+  assert.equal(H.judgeGo({ ...base, origin: 'http://toast.cloudbongos.com' }), 'wrong_origin', 'the scheme counts');
+  assert.equal(H.judgeGo({ ...base, allowed: null }), 'wrong_origin', 'a project with no address can be asked by nobody');
+});
+
+test('only the version the hub itself would move to is sent', () => {
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, to: '1.21.31' } }), 'wrong_version');
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, to: undefined } }), 'wrong_version');
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, to: '1.21.30 ' } }), 'wrong_version');
+});
+
+test('nothing to move, a viewer who may not, or a run already open: refused', () => {
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, behind: false } }), 'nothing_to_move');
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, reading: 'no_answer' } }), 'nothing_to_move');
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, viewer_may_move: false } }), 'not_allowed');
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, open_intent: { action: 'restart' } } }), 'busy');
+});
+
+test('another page\'s message is not this protocol', () => {
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, tag: 'other' } }), 'not_go');
+  assert.equal(H.judgeGo({ ...base, data: 'go' }), 'not_go');
+});
+
+test('the allowed origin is the project\'s registered address, and nothing that is not a host', () => {
+  assert.equal(H.projectOrigin({ domain: 'Toast.CloudBongos.com' }, 'https:'), 'https://toast.cloudbongos.com');
+  assert.equal(H.projectOrigin({ domain: 'toast.cloudbongos.com' }, 'http:'), 'http://toast.cloudbongos.com', 'http only on a harness served over http');
+  for (const domain of [null, '', 'localhost', 'a b.com', 'evil.com/path', 'evil.com?x', 'https://evil.com', '-x.com']) {
+    assert.equal(H.projectOrigin({ domain }, 'https:'), null, JSON.stringify(domain));
+  }
+});
+
+test('the window is the handoff only when asked for it', () => {
+  assert.equal(H.wanted({ search: '?project=toast&handoff=1' }), true);
+  assert.equal(H.wanted({ search: '?handoff=1' }), true);
+  assert.equal(H.wanted({ search: '?project=toast' }), false);
+  assert.equal(H.wanted({ search: '?handoff=10' }), false);
+  assert.equal(H.wanted(null), false);
+});
+
+// ── the page, run for real ────────────────────────────────────────────────────
+
+const armed = new Set();
+afterEach(() => { for (const id of armed) clearTimeout(id); armed.clear(); });
+const settle = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+const plain = (x) => JSON.parse(JSON.stringify(x));
+
+function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }] } = {}) {
+  const told = [];
+  const requests = [];
+  const listeners = {};
+  let closed = false;
+  const main = { _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+  const bodyEl = { _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+  const buttons = {};
+  const documentObj = {
+    documentElement: { setAttribute() {} },
+    getElementById(id) {
+      if (id === 'hall-main') return main;
+      if (id === 'ho-body') return bodyEl;
+      if (!bodyEl._html.includes(`id="${id}"`)) return null;
+      return (buttons[id] ||= { _on: {}, addEventListener(ev, fn) { this._on[ev] = fn; } });
+    },
+  };
+  if (opener) opener.postMessage = (msg, origin) => told.push({ msg, origin });
+  const windowObj = {
+    OTB: realOTB(), document: documentObj, opener, __handoffHearMs: 30,
+    location: { protocol: 'https:', pathname: '/deploy', search: '?project=toast&handoff=1', assign() {} },
+    addEventListener: (ev, fn) => { (listeners[ev] ||= []).push(fn); },
+    setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); armed.add(id); return id; },
+    close() { closed = true; },
+  };
+  const api = {
+    request: (method, p, opts) => {
+      requests.push({ method, path: p, body: opts && opts.body });
+      if (p === '/api/bongos/provisioning/fleet') return Promise.resolve({ ok: true, status: 200, data: { instances: rows } });
+      if (method === 'GET' && /core-upgrade$/.test(p)) return Promise.resolve({ ok: true, status: 200, data: { ok: true, preview } });
+      if (method === 'POST') return Promise.resolve(post);
+      return Promise.resolve({ ok: false, status: 404, data: null });
+    },
+  };
+  const sandbox = { window: windowObj, console, Promise, JSON };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'deploy-handoff.js' });
+  windowObj.OTBDeployHandoff.run({ api });
+  return {
+    told, requests, body: bodyEl, buttons, closed: () => closed,
+    message: (data, { source = opener, origin = 'https://toast.cloudbongos.com' } = {}) => { for (const fn of listeners.message || []) fn({ data, source, origin }); },
+    posts: () => requests.filter((r) => r.method === 'POST'),
+  };
+}
+
+test('it says "ready" only to the project\'s own address, and moves nothing until it hears', async () => {
+  const b = boot();
+  await settle(5);
+  assert.deepEqual(plain(b.told), [{ msg: { tag: 'bongos-update', step: 'ready' }, origin: 'https://toast.cloudbongos.com' }]);
+  assert.equal(b.posts().length, 0, 'nothing moves on load');
+});
+
+test('the go from the project\'s own hall moves it to that version, says so, and closes', async () => {
+  const b = boot();
+  await settle(5);
+  b.message(GO);
+  await settle(5);
+  assert.equal(b.posts().length, 1);
+  assert.equal(b.posts()[0].path, '/api/bongos/provisioning/instances/14/core-upgrade');
+  assert.deepEqual(plain(b.posts()[0].body), { to: '1.21.30' });
+  assert.deepEqual(plain(b.told[1]), { msg: { tag: 'bongos-update', step: 'started', to: '1.21.30' }, origin: 'https://toast.cloudbongos.com' });
+  assert.match(b.body.innerHTML, /The update has started/);
+});
+
+test('a go from another site, or another window, moves nothing', async () => {
+  const b = boot();
+  await settle(5);
+  b.message(GO, { origin: 'https://evil.example' });
+  b.message(GO, { source: {} });
+  await settle(5);
+  assert.equal(b.posts().length, 0);
+});
+
+test('a go naming another version is shown to the owner, never sent', async () => {
+  const b = boot();
+  await settle(5);
+  b.message({ ...GO, to: '1.21.31' });
+  await settle(5);
+  assert.equal(b.posts().length, 0);
+  assert.match(b.body.innerHTML, /A different version is ready/);
+  assert.match(b.body.innerHTML, /Update to 1\.21\.30/, 'the press names the hub\'s own version');
+});
+
+test('no word from the hall: one press, naming the version, and only the press moves it', async () => {
+  const b = boot();
+  await settle(60);
+  assert.equal(b.posts().length, 0, 'waiting is not consent');
+  assert.match(b.body.innerHTML, /id="ho-go"/);
+  b.buttons['ho-go']._on.click();
+  await settle(5);
+  assert.deepEqual(plain(b.posts()[0].body), { to: '1.21.30' });
+});
+
+test('opened by hand, with no hall behind it: the press, never an automatic move', async () => {
+  const b = boot({ opener: null });
+  await settle(5);
+  assert.equal(b.posts().length, 0);
+  assert.match(b.body.innerHTML, /Update to 1\.21\.30/);
+});
+
+test('a refusal is said in the server\'s words, here and to the hall', async () => {
+  const b = boot({ post: { ok: false, status: 409, data: { error: { code: 'intent_conflict', message: 'A restart is running for this project.' } } } });
+  await settle(5);
+  b.message(GO);
+  await settle(5);
+  assert.match(b.body.innerHTML, /A restart is running for this project\./);
+  assert.deepEqual(plain(b.told[1]), { msg: { tag: 'bongos-update', step: 'refused', message: 'A restart is running for this project.' }, origin: 'https://toast.cloudbongos.com' });
+});
+
+test('a project already current, or one with no address, says so and moves nothing', async () => {
+  const cur = boot({ preview: { ...PREVIEW, behind: false } });
+  await settle(5);
+  assert.match(cur.body.innerHTML, /already runs the newest version/);
+  const none = boot({ rows: [{ id: '14', slug: 'toast', domain: null }] });
+  await settle(60);
+  assert.equal(none.told.length, 0, 'nobody to say "ready" to');
+  assert.match(none.body.innerHTML, /id="ho-go"/, 'the press is still there');
+});

package/tests/government_protected_surfaces.mjs

@@ -328,6 +328,21 @@ const ADDED_SINCE_R101 = [
     why: 'split out of the protected ship.js: the ship-mode step every ship runs '
        + 'before it lands, so an edit here could change how work reaches main.',
   },
+  // task 1004546: the Autobongos self-edit wall. The grade of task 1004540 refused a
+  // version whose guard lived in unprotected shared files, so it moved into these two
+  // small ones and they sit beside the rest of the publish pipeline.
+  {
+    after: 'modules/lifecycle/publish-reconciler.js',
+    glob: 'modules/lifecycle/runner-self.js',
+    why: 'the one list of files an unattended runner may never change, and the shape of '
+       + "a runner's claim; an edit here could let a runner loosen its own fence.",
+  },
+  {
+    after: 'modules/lifecycle/runner-self.js',
+    glob: 'modules/lifecycle/runner-self-guard.js',
+    why: "the server's refusal to publish a runner's change to its own supervisor, safety "
+       + 'checks or kill switch, read against the pull request\'s real files.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from

package/tests/hall_loading.mjs

@@ -0,0 +1,153 @@
+// tests/hall_loading.mjs — the hall's one loader, the Bongos mark (task 1005043, goal 1000095).
+//
+// Owner ask, 2026-11-03: a smooth load screen with the Bongos logo anywhere the
+// hall waits for data, in the spirit of monday.com's Vibe data loaders. One CSS
+// component in style.css (.hall-loading) draws the mark from shell.js's
+// brand-mark geometry; a page opts in by putting the class on the placeholder it
+// already had. These cases read the real sheets and pages: the loader keeps
+// DESIGN.md's motion and colour rules, its rest frame is the logo, and no hall
+// page is left with a bare "Loading…" line or a blank wait.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const STYLE = read('style.css');
+const SHELL = read('shell.js');
+
+// The loader's section of style.css, from its banner to the next rule family.
+const START = STYLE.indexOf('/* ---- the loader (task 1005043)');
+const LOADER = STYLE.slice(START, STYLE.indexOf('/* collapsible card body', START));
+
+function keyframes(name) {
+  const m = STYLE.match(new RegExp(`@keyframes ${name} \\{`));
+  assert.ok(m, `@keyframes ${name} exists`);
+  let depth = 1, i = m.index + m[0].length;
+  for (; i < STYLE.length && depth; i++) depth += STYLE[i] === '{' ? 1 : STYLE[i] === '}' ? -1 : 0;
+  return STYLE.slice(m.index + m[0].length, i - 1);
+}
+
+test('the loader is drawn from the Bongos mark, in three sizes', () => {
+  assert.ok(START > 0 && LOADER.length > 500, 'the loader section is found in style.css');
+  for (const sel of ['.hall-loading {', '.hall-loading::before {', '.hall-loading::after {', '.hall-loading--page {', '.hall-loading--inline {']) {
+    assert.ok(LOADER.includes(sel), `${sel} is declared`);
+  }
+  // The same ring arc, core and dot the shell's brand mark draws, so the loader IS the logo.
+  const ring = SHELL.match(/<path class="mr" d="([^"]+)"/)[1];
+  assert.ok(LOADER.includes(`d='${ring}'`), 'the ring is the brand mark\'s arc');
+  assert.ok(SHELL.includes('<circle class="mp" cx="100" cy="100" r="55"'), 'the brand mark\'s core');
+  assert.ok(LOADER.includes("circle cx='100' cy='100' r='55'"), 'is the loader\'s core');
+  assert.ok(SHELL.includes('<circle cx="156" cy="46" r="12" fill="#fb9569"/>'), 'the brand mark\'s dot');
+  assert.ok(LOADER.includes("circle cx='156' cy='46' r='12'"), 'is the loader\'s dot');
+});
+
+test('it moves in CSS only, on transform and filter only, and rests on the logo', () => {
+  const frames = { 'hall-loading-arrive': keyframes('hall-loading-arrive'), 'hall-loading-turn': keyframes('hall-loading-turn'), 'hall-loading-breathe': keyframes('hall-loading-breathe') };
+  for (const [name, body] of Object.entries(frames)) {
+    const props = [...body.matchAll(/([a-z-]+)\s*:/g)].map((m) => m[1]);
+    assert.ok(props.length, `${name} animates something`);
+    for (const prop of props) assert.ok(['transform', 'filter'].includes(prop), `${name} animates ${prop}, not transform or filter`);
+  }
+  // The rest frame: the turn has no `from`, so 0deg (the logo's own pose, dot top right)
+  // is where it starts and where the Kill Switch leaves it; the arrival and the breath
+  // have no `to`, so their resting value is the element as styled, fully shown.
+  assert.match(frames['hall-loading-turn'], /^\s*to \{ transform: rotate\(1turn\); \}\s*$/);
+  assert.match(frames['hall-loading-arrive'], /^\s*from \{/);
+  assert.match(frames['hall-loading-breathe'], /^\s*from \{/);
+  // The Kill Switch stops every animation, pseudo-elements included.
+  assert.match(STYLE, /@media \(prefers-reduced-motion: reduce\) \{\s*\*, \*::before, \*::after \{\s*animation: none !important;/);
+  // No motion authored in JavaScript: nothing in the hall drives the loader from script.
+  for (const f of fs.readdirSync(HALL).filter((n) => n.endsWith('.js'))) {
+    assert.doesNotMatch(read(f), /hall-loading[^'"\n]*['"]\)?\.(animate|style)\b/, `${f} does not animate the loader`);
+  }
+});
+
+test('every colour is a token; the black in the masks is alpha, not paint', () => {
+  const css = LOADER.replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.doesNotMatch(css, /#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(/, 'no colour literal');
+  const paints = [...css.matchAll(/(?:background|color):\s*([^;]+);/g)].map((m) => m[1].trim());
+  assert.ok(paints.length >= 3, 'the ink, the dot and the caption are painted');
+  for (const p of paints) assert.match(p, /^(var\(--[a-z-]+\)|color-mix\(in srgb, var\(--ink\) \d+%, var\(--bg-card\)\))$/, `${p} is a token or a mix of one`);
+  // The one accent is the dot: the live thing on a waiting page (the One Warm Thing Rule).
+  assert.equal((css.match(/var\(--accent\)/g) || []).length, 1, 'the accent paints the dot alone');
+  const masks = [...css.matchAll(/url\("data:image\/svg\+xml,([^"]+)"\)/g)].map((m) => decodeURIComponent(m[1]));
+  assert.equal(masks.length, 2, 'two masks: the ring and core, and the dot');
+  for (const m of masks) assert.doesNotMatch(m.replace(/stroke='black'|fill='none'/g, ''), /fill='|stroke='|#/, 'a mask carries no colour of its own');
+});
+
+test('the page loaders step aside by themselves, and never show without :has()', () => {
+  assert.match(STYLE, /\.hall-loading--wait, \.hall-loading--zones \{ display: none; \}/);
+  assert.match(STYLE, /@supports selector\(:has\(a\)\) \{\s*\.hall-loading--wait:not\(:has\(~ :not\(\[hidden\], script, template, style\)\)\) \{ display: flex; \}\s*\.hall-loading--zones:not\(:has\(~ :not\(\[hidden\]\) > :not\(\[hidden\], script, template, style\)\)\) \{ display: flex; \}\s*\}/);
+  // A page whose sections all start [hidden] carries the --wait loader FIRST in its main.
+  for (const page of ['board-room', 'deploy', 'fleet', 'gate', 'government', 'market-watch-settings', 'project-settings', 'sessions']) {
+    const html = read(`${page}.html`);
+    const main = html.slice(html.indexOf('<main id="hall-main">'));
+    const first = main.replace(/<main id="hall-main">\s*(<!--[\s\S]*?-->\s*)*/, '');
+    assert.match(first, /^<p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…<\/p>/, `${page} opens its main on the page loader`);
+    const after = first.slice(first.indexOf('</p>') + 4);
+    const kids = [...after.matchAll(/^ {8}<(section|div|p|nav)\b([^>]*)>/gm)];
+    assert.ok(kids.length >= 2, `${page} has sections after the loader`);
+    for (const [, tag, attrs] of kids) assert.match(attrs, /\bhidden\b/, `${page}: a <${tag}> after the loader starts hidden, or the loader would never show`);
+  }
+  assert.match(read('index.html'), /<section class="view" id="view-home"[^>]*>\s*<!--[^>]*-->\s*<p class="hall-loading hall-loading--page hall-loading--zones" role="status">Loading…<\/p>/, 'Home waits on its zones');
+  assert.match(read('watch.html'), /<main id="hall-main">\s*<!--[^>]*-->\s*<p class="hall-loading hall-loading--page hall-loading--zones" role="status">Loading…<\/p>/, 'Watch waits on its panes');
+  // Settings' layout is never [hidden] while it loads, so its loader is put away by hideLayout().
+  assert.match(read('settings.html'), /id="settings-groups"[^>]*>\s*<!--[^>]*-->\s*<p class="hall-loading hall-loading--page" id="settings-loading" role="status">/);
+  assert.match(read('settings.js'), /function hideLayout\(hide\) \{[\s\S]*?getElementById\('settings-loading'\)[\s\S]*?loading\.hidden = true;/);
+});
+
+test('no hall page waits on a bare line of text any more', () => {
+  // A placeholder an element's own script rewrites IN PLACE keeps its plain words:
+  // the class would stay behind on the finished sentence. Each is named with why.
+  const IN_PLACE = new Set([
+    'atlas.html#caption',             // the map's caption, rewritten by atlas.js
+    'sessions.html#ledger-status',    // the ledger's status line, rewritten by sessions.js
+    'goals.html#goal-deps-card-lede', // the dependency card's lede, rewritten by goals-page.js
+    'goals.html#goal-deps-lede',
+    'profile.html#activity-placeholder', // reused for the signed-out notice by profile.js
+  ]);
+  const WAIT = /<(p|div|li|span|td)\b([^>]*)>\s*(?:Loading|Reading|Opening|Checking)\b[^<]*…\s*<\/\1>|<(p|div|li|span|td)\b([^>]*)>…<\/\4>/g;
+  const misses = [];
+  for (const f of fs.readdirSync(HALL).filter((n) => n.endsWith('.html'))) {
+    for (const m of read(f).matchAll(WAIT)) {
+      const attrs = m[2] || m[5] || '';
+      if (/page-head__sub/.test(attrs)) continue; // the page head is hidden on every page but Home (task 1004836)
+      const id = (attrs.match(/\bid="([^"]+)"/) || [])[1];
+      if (id && IN_PLACE.has(`${f}#${id}`)) continue;
+      if (!/\bhall-loading\b/.test(attrs)) misses.push(`${f}: ${m[0].slice(0, 90)}`);
+    }
+  }
+  assert.deepEqual(misses, [], 'every waiting placeholder wears the loader');
+  // The table placeholder rows keep their cell, with the loader inside it.
+  assert.match(read('work.html'), /<td colspan="6" class="ledger__empty"><span class="hall-loading" role="status">Loading…<\/span><\/td>/);
+  assert.match(read('hall-widgets.js'), /<td colspan="4" class="ledger__empty"><span class="hall-loading" role="status">Loading…<\/span><\/td>/);
+});
+
+test('the placeholders the page scripts write wear it too, and a failure stops it', () => {
+  const WRITTEN = {
+    'blockers.js': '<li class="hall-loading hall-loading--page" role="status">Loading…</li>',
+    'goals.js': '<div class="hall-loading" role="status">Loading your goals…</div>',
+    'lightbulb.js': '<p class="hall-loading" role="status">Loading…</p>',
+    'task-detail.js': '<p class="hall-loading hall-loading--inline" role="status">Loading versions…</p>',
+    'criterion-uat-ui.js': '<p class="hall-loading hall-loading--inline" role="status">Loading…</p>',
+    'watch.js': '<p class="hall-loading" role="status">Reading…</p>',
+    'studio.js': '<p class="hall-loading" role="status">Reading the reviews…</p>',
+    'settings-specialities.js': '<p class="hall-loading hall-loading--inline" role="status">Loading this project’s skills…</p>',
+    'settings-software-update.js': '<p class="hall-loading hall-loading--inline" role="status">Checking for a newer version…</p>',
+    'goals-page.js': '<div class="hall-loading" role="status">Loading…</div>',
+  };
+  for (const [f, markup] of Object.entries(WRITTEN)) assert.ok(read(f).includes(markup), `${f} writes the loader`);
+  // Blockers' first paint replaces the list wholesale, so its loader cannot outlive the rows.
+  assert.match(read('blockers.js'), /listEl\.innerHTML = rows\.length/);
+  // Collab used to be blank on a failed read; with loaders in its lists it must stop them.
+  const collab = read('collab.js');
+  const failure = collab.slice(collab.lastIndexOf('load().catch('));
+  assert.match(failure, /\['for-me', 'mine', 'all'\]\.forEach\(\(k\) => \{ const host = \$\(`#cb-\$\{k\}`\); if \(host\) host\.innerHTML = ''; \}\);/);
+  // The skeleton bars and the goal list's rings breathe in the loader's beat.
+  assert.match(STYLE, /\.kit-skel \{[^}]*animation: hall-loading-breathe \.8s ease-in-out infinite alternate-reverse;/);
+  assert.match(read('goals.css'), /\.gr-skel__ring \{[^}]*animation: hall-loading-breathe \.8s ease-in-out infinite alternate-reverse;/);
+});

package/tests/hub_connections_page.mjs

@@ -77,7 +77,7 @@ test('the body: a door, a loading line, the inactive and unreadable lines, then
   assert.match(MAIN, /<h1>connections<\/h1>/);
   assert.match(MAIN, /it grants no rank and no access to anything/, 'a connection is never authority (ADR 0016, ADR 0202)');
   assert.match(MAIN, /<section class="aDoor" id="door" hidden aria-labelledby="door-h">[\s\S]*?href="\/api\/bongos\/auth\/web\/start\?return=\/connections&amp;repos=1"/, 'signed out, the door returns here');
-  assert.match(MAIN, /<p class="loading" id="loading">/);
+  assert.match(MAIN, /<p class="loading loading-mark loading-mark--page" id="loading" role="status">/); // the Bongos-mark loader (task 1005053)
   assert.match(MAIN, /<p class="mineEmpty" id="inactive" hidden>/);
   assert.match(MAIN, /<p class="projMsg err" id="readFailed" role="alert" hidden>/);
   assert.match(MAIN, /<p class="projMsg" id="connMsg" role="status" aria-live="polite" hidden><\/p>/);

package/tests/hub_invitations_page.mjs

@@ -56,7 +56,7 @@ test('the page wears the hub’s bar, with Invitations as the one current place;
 test('the body: a door, a loading line, the four lists in order under one heading, the empty line, and the join field', () => {
   assert.match(MAIN, /<h1>invitations<\/h1>/);
   assert.match(MAIN, /<section class="aDoor" id="door" hidden aria-labelledby="door-h">[\s\S]*?href="\/api\/bongos\/auth\/web\/start\?return=\/invitations&amp;repos=1"/, 'signed out, the door returns here');
-  assert.match(MAIN, /<p class="loading" id="loading">/);
+  assert.match(MAIN, /<p class="loading loading-mark loading-mark--page" id="loading" role="status">/); // the Bongos-mark loader (task 1005053)
   const section = (MAIN.match(/<section id="mineInvites" aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
   assert.ok(section, 'the invitations section ships as markup, never hidden on its own: it is the page');
   assert.match(section, /<p class="mineEmpty" id="invitesNone" hidden>[^<]+<\/p>/, 'one empty line, down until the reads have answered');