@bongos/core 1.24.44 → 1.24.46

package/tests/autobongos_runner_login_db.mjs

@@ -0,0 +1,105 @@
+// tests/autobongos_runner_login_db.mjs — an Autobongos runner's one-time code against
+// a REAL Postgres (task 1004547, goal 1000139).
+//
+// tests/autobongos_runner_login.mjs proves the login DB-free, but its fake pool
+// re-implements the WHERE that burns a code, so it cannot catch that WHERE being
+// wrong. This file runs the real migration (core_295) and the real exchangeCode SQL:
+// a code works once even when two PCs race it, an expired code mints nothing, and
+// the session it mints carries source 'runner', which the widened CHECK admits.
+//
+// It SELF-SKIPS (exit 0) with no reachable Postgres, and refuses any database that
+// already has a `builders` table — it creates its own throwaway tables. Listed in
+// run-unit-tests.js's INTEGRATION set.
+//
+// Run:  createdb runner_login_scratch && DATABASE_URL=postgres:///runner_login_scratch node tests/autobongos_runner_login_db.mjs
+
+import pg from 'pg';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`autobongos_runner_login_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+const { rows: realRows } = await pool.query(`SELECT to_regclass('public.builders') IS NOT NULL AS has_builders`);
+if (realRows[0].has_builders) {
+  console.log('autobongos_runner_login_db.mjs SKIPPED — this database has a `builders` table, so it is not a scratch DB.');
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+
+// The minimum of the three core tables the migration alters, as 003_pms.sql made them.
+await pool.query(`
+  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
+  CREATE TABLE builders (id bigserial PRIMARY KEY, github_login text, status text NOT NULL DEFAULT 'active');
+  CREATE TABLE builder_sessions (
+    id bigserial PRIMARY KEY, builder_id bigint REFERENCES builders(id), token_hash text,
+    source text NOT NULL CHECK (source IN ('cli', 'web')), user_agent text, expires_at timestamptz);
+  CREATE TABLE claims (id bigserial PRIMARY KEY, task_id bigint);
+`);
+const HERE = path.dirname(url.fileURLToPath(import.meta.url));
+await pool.query(fs.readFileSync(path.join(HERE, '..', 'migrations', 'core_295_runner_logins.sql'), 'utf8'));
+// Re-running is a no-op (every step is IF NOT EXISTS / DROP IF EXISTS).
+await pool.query(fs.readFileSync(path.join(HERE, '..', 'migrations', 'core_295_runner_logins.sql'), 'utf8'));
+
+const runnerLogin = require('../src/bongos/runner-login.js');
+const { rows: [owner] } = await pool.query(`INSERT INTO builders (github_login) VALUES ('owner') RETURNING id`);
+const { rows: [gone] } = await pool.query(`INSERT INTO builders (github_login, status) VALUES ('gone', 'inactive') RETURNING id`);
+
+await t('a code trades for a runner session exactly once', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: owner.id, label: 'pc' }, pool);
+  const first = await runnerLogin.exchangeCode({ code }, pool);
+  assert.equal(String(first.builder_id), String(owner.id));
+  const { rows } = await pool.query('SELECT source, expires_at FROM builder_sessions WHERE id = $1', [first.session_id]);
+  assert.equal(rows[0].source, 'runner');
+  assert.equal(rows[0].expires_at, null, 'a runner login does not lapse; it is revoked');
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'code_invalid' });
+});
+
+await t('two PCs racing one code: one wins, one session', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: owner.id }, pool);
+  const before = (await pool.query('SELECT count(*)::int AS n FROM builder_sessions')).rows[0].n;
+  const results = await Promise.all([runnerLogin.exchangeCode({ code }, pool), runnerLogin.exchangeCode({ code }, pool)]);
+  assert.equal(results.filter((r) => r.token).length, 1);
+  assert.equal(results.filter((r) => r.refused === 'code_invalid').length, 1);
+  const after = (await pool.query('SELECT count(*)::int AS n FROM builder_sessions')).rows[0].n;
+  assert.equal(after - before, 1);
+});
+
+await t('an expired code mints nothing', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: owner.id, now: Date.now() - 16 * 60 * 1000 }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'code_invalid' });
+  const { rows } = await pool.query('SELECT used_at FROM runner_enrollment_codes WHERE code_hash = $1', [require('../src/bongos/db-kernel.js').sessionTokenHash(code)]);
+  assert.equal(rows[0].used_at, null, 'an expired code is not even marked used');
+});
+
+await t('an offboarded builder\'s code mints nothing and stays unused', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: gone.id }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'builder_inactive' });
+  const { rows } = await pool.query(`SELECT count(*)::int AS n FROM builder_sessions WHERE builder_id = $1`, [gone.id]);
+  assert.equal(rows[0].n, 0);
+});
+
+await t('every claim reads not-autonomous by default; the mark is a real column', async () => {
+  const { rows } = await pool.query(`INSERT INTO claims (task_id) VALUES (1) RETURNING autonomous`);
+  assert.equal(rows[0].autonomous, false);
+});
+
+await pool.end();
+console.log(`\nautobongos_runner_login_db.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/craft_mode_nav.mjs

@@ -63,7 +63,7 @@ function parseSidebar(html) {
   });
 }
 
-function boot({ session = {}, perms = { 'board.vote.cast': true } } = {}) {
+function boot({ session = {}, local = {}, perms = { 'board.vote.cast': true } } = {}) {
   const root = makeEl('HTML');
   const topbar = makeEl('DIV');
   const sidebar = makeEl('NAV');
@@ -95,7 +95,7 @@ function boot({ session = {}, perms = { 'board.vote.cast': true } } = {}) {
     __BRANDING__: {}, __MODULES__: { enabled: { provisioning: true } },
     BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
     matchMedia: () => ({ matches: false, addEventListener() {} }),
-    localStorage: mk({}), sessionStorage: mk(session), location,
+    localStorage: mk(local), sessionStorage: mk(session), location,
     clearTimeout() {}, setTimeout() { return 0; }, requestAnimationFrame() {}, scrollTo() {},
     addEventListener() {}, dispatchEvent() { return true; },
   };
@@ -116,6 +116,7 @@ function boot({ session = {}, perms = { 'board.vote.cast': true } } = {}) {
   return {
     craft, root,
     signIn: (rank = 'archon') => shell.applyAccess({ authed: true, rank, permissions: perms, builder: { id: 7, rank } }),
+    signOut: () => shell.applyAccess({ authed: false }),
     // The tabs a reader can see: the gate let them through AND the mode kept them.
     showing: () => parsed().flatMap((g) => g.items).filter((a) => !a.hidden && !a.hasAttribute('data-craft-off')).map((a) => a.id.slice(4)),
     headShowing: (group) => {
@@ -150,7 +151,20 @@ test('every tab a mode names is a real NAV item, and every NAV item lives in som
   assert.ok(NAV_IDS.length >= 24, `read ${NAV_IDS.length} NAV ids from shell.js`);
   const named = new Set(CRAFTS.flatMap((m) => craft.tabsFor(m)));
   for (const id of named) assert.ok(NAV_IDS.includes(id), `${id} is a NAV id`);
-  for (const id of NAV_IDS) assert.ok(named.has(id), `${id} is reachable from some mode's nav`);
+  // Home is the one exception: in a mode the craft plate IS the Home button
+  // (task 1005065), so no mode lists the Home tab beside it (task 1005070).
+  for (const id of NAV_IDS) {
+    if (id === 'home') continue;
+    assert.ok(named.has(id), `${id} is reachable from some mode's nav`);
+  }
+});
+
+test('ONE HOME: no mode shows the Home tab, because the plate is Home in every mode (task 1005070)', () => {
+  const { craft } = boot();
+  for (const m of CRAFTS) assert.ok(!craft.tabsFor(m).includes('home'), `${m} does not list the Home tab beside the plate`);
+  const none = boot();
+  none.signIn();
+  assert.ok(none.showing().includes('home'), 'with no mode there is no plate, so the Home tab shows');
 });
 
 test('Government shows only in Governing, and Governing is the shortest list', () => {
@@ -326,3 +340,37 @@ test('the dropdown opens on its own when the page you are on is inside it', () =
   assert.equal(bootTree({ mode: 'artistry' }).fold(), null, 'no other mode folds anything');
   assert.equal(bootTree().fold(), null, 'nor does no mode');
 });
+
+// ── the remembered nav (task 1005070) ──────────────────────────────────────
+// Every hall page is a full load and /me is the slowest read the owner makes, so
+// the rail used to boot empty and pop its tabs in once /me answered. The shell
+// now keeps the last settled access and paints from it; /me (whose client never
+// answers in this harness) still settles the rest.
+const NAV_KEY = 'hall-nav-access';
+
+test('THE REMEMBERED NAV: a signed-in settle is kept, and the next page paints it before /me answers', () => {
+  const local = {};
+  const first = boot({ local });
+  first.signIn();
+  const settled = first.showing();
+  const kept = JSON.parse(local[NAV_KEY]);
+  assert.equal(kept.rank, 'archon');
+  assert.equal(kept.builder.id, 7);
+  assert.ok(!('needs' in kept), 'never the needs roster, so a badge is never stale');
+  const next = boot({ local });
+  assert.deepEqual(next.showing(), settled, 'the next page paints the same tabs with /me still out');
+  const cold = boot();
+  assert.deepEqual(cold.showing(), ['home'], 'with nothing kept the rail waits for /me, as before');
+});
+
+test('THE REMEMBERED NAV is forgotten on a signed-out settle, and an old one is not painted', () => {
+  const local = {};
+  const p = boot({ local });
+  p.signIn();
+  assert.ok(local[NAV_KEY]);
+  p.signOut();
+  assert.ok(!(NAV_KEY in local), 'a sign-out or a 401 drops it');
+  const stale = boot({ local: { [NAV_KEY]: JSON.stringify({ at: Date.now() - 2 * 24 * 60 * 60 * 1000, rank: 'archon', builder: { id: 7 } }) } });
+  assert.deepEqual(stale.showing(), ['home'], 'a day-old memory is not painted');
+  assert.match(SHELL, /function doLogout\(\) \{\n\s+forgetAccess\(\);/, 'the sign-out link forgets it before it leaves');
+});

package/tests/design_tokens_shared.mjs

@@ -0,0 +1,183 @@
+// tests/design_tokens_shared.mjs — the ONE shared token sheet every Cloud Bongos
+// surface loads (task 1005081, goal 1000138 "One Cloud Bongos design system").
+//
+// modules/ui-design/public/tokens.css holds the named scales — type sizes, spacing,
+// corners, shadows, motion, stacking layers — namespaced --ds-*, and the hall's own
+// scale names became aliases onto it. What this pins, DB-free and browser-free:
+//   * the sheet exists and defines every scale;
+//   * it never redefines the fifteen pack tokens (the pack must keep winning) and
+//     carries no colour literal except black/white with alpha (the Fifteen Rule);
+//   * its dark rule is written twice, byte-identical (the dark twins);
+//   * every surface loads it — the hall through style.css's @import (all 33 hall
+//     pages link style.css), the landing + hub pages, the status page and the three
+//     raise views through a <link> placed BEFORE their own sheet, so a surface's own
+//     values still win on source order;
+//   * the hall's old token names still resolve — each alias names a --ds-* token the
+//     sheet defines;
+//   * the one URL is served on every host, status. included (serve-internal.js's
+//     module-asset route used to step aside on a generic surface host).
+//
+// Run:  node --test tests/design_tokens_shared.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const URL_PATH = '/modules/ui-design/public/tokens.css';
+const SHEET = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'tokens.css'), 'utf8');
+const decomment = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '');
+const CODE = decomment(SHEET);
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+const blockAfter = (src, marker) => {
+  const at = src.indexOf(marker);
+  assert.notEqual(at, -1, `missing ${marker}`);
+  const open = src.indexOf('{', at);
+  return src.slice(open + 1, src.indexOf('}', open));
+};
+const decls = (body) => Object.fromEntries([...body.matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)].map((m) => [m[1], m[2].trim()]));
+const ROOT_TOKENS = decls(blockAfter(CODE, ':root {'));
+
+test('the shared sheet defines every named scale', () => {
+  const scales = {
+    'type sizes': ['--ds-text-3xs', '--ds-text-2xs', '--ds-text-xs', '--ds-text-sm', '--ds-text-md', '--ds-text-lg', '--ds-text-xl', '--ds-text-2xl', '--ds-text-3xl', '--ds-text-4xl', '--ds-text-5xl', '--ds-text-title', '--ds-text-headline', '--ds-text-figure', '--ds-text-display'],
+    spacing: ['--ds-space-hair', '--ds-space-xs', '--ds-space-sm', '--ds-space-md', '--ds-space-lg', '--ds-space-xl'],
+    corners: ['--ds-radius-pill', '--ds-radius-panel', '--ds-radius-tile'],
+    shadows: ['--ds-shadow-pop'],
+    motion: ['--ds-dur-fast', '--ds-dur-base', '--ds-dur-slow', '--ds-ease', '--ds-ease-arrive'],
+    'stacking layers': ['--ds-z-progress', '--ds-z-topbar', '--ds-z-sidebar', '--ds-z-scrim', '--ds-z-drawer', '--ds-z-modal', '--ds-z-diagram-full'],
+  };
+  for (const [scale, names] of Object.entries(scales)) {
+    for (const n of names) assert.ok(ROOT_TOKENS[n], `${scale}: ${n} is defined on :root`);
+  }
+  // DESIGN.md's values, so loading the sheet moves nothing
+  assert.equal(ROOT_TOKENS['--ds-radius-pill'], '999px');
+  assert.equal(ROOT_TOKENS['--ds-radius-panel'], '16px');
+  assert.equal(ROOT_TOKENS['--ds-radius-tile'], '10px');
+  assert.deepEqual(['hair', 'xs', 'sm', 'md', 'lg', 'xl'].map((k) => ROOT_TOKENS[`--ds-space-${k}`]), ['6px', '10px', '14px', '22px', '34px', '52px']);
+  assert.equal(ROOT_TOKENS['--ds-ease'].replace(/\s+/g, ''), 'cubic-bezier(.2,.7,.3,1)', 'the one state easing');
+  assert.equal(ROOT_TOKENS['--ds-ease-arrive'].replace(/\s+/g, ''), 'cubic-bezier(.16,1,.3,1)', 'the entrance ease-out');
+  // the type sizes climb
+  const px = Object.entries(ROOT_TOKENS).filter(([k, v]) => k.startsWith('--ds-text-') && /^[\d.]+px$/.test(v)).map(([, v]) => parseFloat(v));
+  assert.deepEqual(px, [...px].sort((a, b) => a - b), 'the fixed type steps are declared small to large');
+});
+
+test('every name is --ds-* — no shared name can collide with a surface\'s own', () => {
+  // cosmos.css spends --line as a COLOUR and raise.css sets --radius to 10px: an
+  // un-namespaced shared token would silently change whichever surface lacked it
+  const names = [...CODE.matchAll(/(--[\w-]+)\s*:/g)].map((m) => m[1]);
+  assert.ok(names.length > 40);
+  assert.deepEqual(names.filter((n) => !n.startsWith('--ds-')), []);
+});
+
+test('it never redefines the fifteen pack tokens and holds no colour literal but black/white alpha', () => {
+  const pack = JSON.parse(read('config', 'branding.neutral.json')).theme.ui;
+  const fifteen = [...Object.keys(pack.colors).map((k) => '--' + k.replace(/[A-Z]/g, (c) => '-' + c.toLowerCase())), '--font-display', '--font-body'];
+  assert.equal(fifteen.length, 15);
+  for (const t of fifteen) assert.doesNotMatch(CODE, new RegExp(`${t}\\s*:`), `${t} belongs to the pack`);
+  assert.doesNotMatch(CODE, /#[0-9a-f]{3,8}\b/i, 'no hex colour');
+  for (const m of CODE.matchAll(/rgba?\(([^)]*)\)/g)) {
+    const [r, g, b] = m[1].split(',').map((x) => parseFloat(x));
+    assert.ok((r === 0 && g === 0 && b === 0) || (r === 255 && g === 255 && b === 255), `only black/white with alpha: ${m[0]}`);
+  }
+  assert.doesNotMatch(CODE, /\b(hsla?|oklch|lab|lch)\(/, 'no other colour function');
+});
+
+test('the dark rule is written twice, byte-identical', () => {
+  const sw = blockAfter(CODE, 'html[data-theme="dark"], :root[data-mode="dark"] {');
+  const media = CODE.slice(CODE.indexOf('@media (prefers-color-scheme: dark)'));
+  const twin = blockAfter(media, 'html:not([data-theme]):not([data-mode="light"]) {');
+  assert.ok(sw.trim().length > 0);
+  assert.equal(sw.replace(/\s+/g, ' ').trim(), twin.replace(/\s+/g, ' ').trim());
+});
+
+test('the reduced-motion switch zeroes the motion scale', () => {
+  const rm = blockAfter(CODE.slice(CODE.indexOf('@media (prefers-reduced-motion: reduce)')), ':root {');
+  for (const n of Object.keys(ROOT_TOKENS).filter((k) => k.startsWith('--ds-dur-') || k === '--ds-stagger')) {
+    assert.match(rm, new RegExp(`${n}\\s*:\\s*0ms`), `${n} is zeroed under reduced motion`);
+  }
+});
+
+test('the hall loads it: style.css @imports it FIRST, and every hall page links style.css', () => {
+  const style = read('modules', 'hall-ui', 'public', 'style.css');
+  const imports = [...decomment(style).matchAll(/@import url\("([^"]+)"\)/g)].map((m) => m[1]);
+  assert.equal(imports[0], URL_PATH, 'the shared sheet is the first import, so the hall\'s own rules follow it');
+  const dir = path.join(ROOT, 'modules', 'hall-ui', 'public');
+  const pages = fs.readdirSync(dir).filter((f) => f.endsWith('.html'));
+  assert.ok(pages.length > 20);
+  for (const p of pages) assert.match(fs.readFileSync(path.join(dir, p), 'utf8'), /<link rel="stylesheet" href="\/builders\/style\.css/, `${p} links style.css`);
+});
+
+test('the landing, hub, status and raise pages link it before their own sheet', () => {
+  const tag = `<link rel="stylesheet" href="${URL_PATH}">`;
+  const pages = [
+    ...fs.readdirSync(path.join(ROOT, 'modules', 'public-landing', 'public')).filter((f) => f.endsWith('.html')).map((f) => ['modules', 'public-landing', 'public', f]),
+    ['modules', 'status-ui', 'public', 'index.html'],
+    ['modules', 'raise', 'views', 'page.html'], ['modules', 'raise', 'views', 'gate.html'], ['modules', 'raise', 'views', 'nda.html'],
+  ];
+  for (const p of pages) {
+    const html = read(...p);
+    const own = html.search(/<link rel="stylesheet" href="[^"]*(world|cosmos|style|raise)\.css/);
+    if (own === -1) continue; // a page with no surface sheet of its own (none today, but not this test's business)
+    const at = html.indexOf(tag);
+    assert.ok(at > -1, `${p.join('/')} links the shared sheet`);
+    assert.ok(at < own, `${p.join('/')} links it BEFORE its own sheet, so the surface's values still win`);
+  }
+});
+
+test('the hall\'s old token names still resolve — each alias names a defined --ds-* token', () => {
+  const style = decomment(read('modules', 'hall-ui', 'public', 'style.css'));
+  const want = ['--line', '--radius', '--radius-sm', '--radius-pill', '--sp-hair', '--sp-xs', '--sp-sm', '--sp-md', '--sp-lg', '--sp-xl',
+    '--shadow-pop', '--z-progress', '--z-topbar', '--z-sidebar', '--z-scrim', '--z-drawer', '--z-modal', '--z-diagram-full', '--label-size'];
+  for (const n of want) {
+    const m = style.match(new RegExp(`${n}\\s*:\\s*var\\((--ds-[\\w-]+)\\)`));
+    assert.ok(m, `${n} is an alias onto the shared sheet`);
+    assert.ok(ROOT_TOKENS[m[1]], `${n} → ${m[1]} is defined in tokens.css`);
+  }
+  // the four-step --space-* scale still rides the --sp-* aliases
+  for (const n of ['--space-1', '--space-2', '--space-3', '--space-4']) assert.match(style, new RegExp(`${n}\\s*:\\s*var\\(--sp-`));
+});
+
+// ── the one URL, on every host ────────────────────────────────────────────────
+// node:http, not fetch: fetch silently drops a Host override (tests/module_asset_subdomain.mjs).
+function get(port, p, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body, type: res.headers['content-type'] || '' }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('the sheet is served at one path on the apex, the hall host and the status host', async () => {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try {
+    const port = server.address().port;
+    for (const host of ['example.com', 'builders.example.com', 'status.example.com']) {
+      const r = await get(port, URL_PATH, host);
+      assert.equal(r.status, 200, `${host} serves ${URL_PATH}`);
+      assert.match(r.type, /text\/css/, `${host} serves it as CSS`);
+      assert.match(r.body, /--ds-radius-panel:/, `${host} serves the shared sheet's bytes`);
+    }
+    // the status host still answers its OWN files first
+    const own = await get(port, '/style.css', 'status.example.com');
+    assert.equal(own.status, 200);
+    assert.doesNotMatch(own.body, /--ds-radius-panel:/);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+});

package/tests/government_session_scope.mjs

@@ -41,7 +41,8 @@ const scopes = require(path.join(GOV, 'session-scopes.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 
 // Hand-written: the sources this instance accepts.
-const EXPECTED_SOURCES = ['cli', 'web', null];
+// 'runner' is an Autobongos PC's own login (task 1004547, src/bongos/runner-login.js).
+const EXPECTED_SOURCES = ['cli', 'web', 'runner', null];
 
 function fakeRes() {
   const res = {

package/tests/hall_reading_world.mjs

@@ -278,7 +278,11 @@ test('the viewer spends the named z rung, not a hand-written 9999', () => {
   assert.ok(full, '.dgv.is-fullscreen has a rule');
   assert.match(full, /z-index:\s*var\(--z-diagram-full\)/);
   assert.doesNotMatch(decomment(viewerCss), /z-index:\s*\d/, 'no bare number is left in the sheet');
-  assert.match(decomment(styleCss), /--z-diagram-full:\s*\d+/, 'and the rung is named in the shell ladder');
+  // task 1005081: the ladder's numbers live in the shared token sheet; the hall's
+  // rung is the alias onto it
+  assert.match(decomment(styleCss), /--z-diagram-full:\s*var\(--ds-z-diagram-full\)/, 'and the rung is named in the shell ladder');
+  const shared = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'tokens.css'), 'utf8');
+  assert.match(decomment(shared), /--ds-z-diagram-full:\s*\d+/, 'and the shared sheet gives it a number');
 });
 
 test('the fullscreen scroll lock is on the root, where the shell already locks', () => {

package/tests/hall_tokens.mjs

@@ -82,6 +82,21 @@ const contractTier = declarations(bodyAt(src.indexOf('{', bareRoots[0].index)));
 const darkExplicit = declarations(blockAfter('html[data-theme="dark"] {'));
 const darkMedia = declarations(blockAfter('html:not([data-theme]) {'));
 
+// THE SHARED TOKEN SHEET (task 1005081). style.css @imports
+// modules/ui-design/public/tokens.css first, so its scales (--ds-*) sit UNDER the
+// hall's own declarations, and the hall's scale names (--radius, --sp-*, --z-*,
+// --shadow-pop, --line, --label-size) are aliases onto it. Its :root and its dark
+// switch rule are read here so the resolver sees what the browser sees.
+const SHARED_SRC = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'tokens.css'), 'utf8');
+const sharedBlock = (marker) => {
+  const at = SHARED_SRC.indexOf(marker);
+  assert.notEqual(at, -1, `tokens.css no longer contains ${marker} — update this test`);
+  const open = SHARED_SRC.indexOf('{', at);
+  return declarations(SHARED_SRC.slice(open + 1, SHARED_SRC.indexOf('}', open)));
+};
+const sharedRoot = sharedBlock(':root {');
+const sharedDark = sharedBlock('html[data-theme="dark"]');
+
 // THE CASCADE THAT ACTUALLY SHIPS. injectBrandingInto splices the pack's theme
 // <style> at the END of <head> — after style.css's <link> — as a plain :root.
 // Equal specificity, later in document order, so for the tokens the pack emits
@@ -112,8 +127,8 @@ const NIGHT_TINT = process.env.UI_DESIGN_TINT === '1'
   : {};
 
 const RAW = {
-  light: { ...contractTier, ...PACK },
-  dark: { ...contractTier, ...PACK, ...darkExplicit, ...NIGHT_TINT },
+  light: { ...sharedRoot, ...contractTier, ...PACK },
+  dark: { ...sharedRoot, ...contractTier, ...PACK, ...sharedDark, ...darkExplicit, ...NIGHT_TINT },
 };
 
 // ── color resolution ─────────────────────────────────────────────────────────
@@ -319,7 +334,10 @@ test('--line is a width, not a colour', () => {
   // DESIGN.md warns about this exact name: --line is a 1px WIDTH here and a
   // hairline COLOUR in the hub's sheet. Page sheets that treated it as a colour
   // were repointed at --rule / --rule-soft in task 1003303.
-  assert.match(contractTier['--line'], /^\d+px$/, '--line must resolve to a length');
+  // an alias onto the shared sheet since task 1005081 — follow it one step
+  const alias = /^var\((--[\w-]+)\)$/.exec(contractTier['--line']);
+  const line = alias ? sharedRoot[alias[1]] : contractTier['--line'];
+  assert.match(String(line), /^\d+px$/, '--line must resolve to a length');
   const sheets = fs.readdirSync(HALL).filter((f) => f.endsWith('.css'));
   const misuse = sheets.filter((f) => /var\(--line\s*,/.test(fs.readFileSync(path.join(HALL, f), 'utf8')));
   assert.deepEqual(misuse, [], 'a colour fallback on --line means the sheet thinks it is a colour');
@@ -346,6 +364,7 @@ test('every token a hall stylesheet references is defined', () => {
   const sheets = fs.readdirSync(HALL).filter((f) => f.endsWith('.css'));
   const defined = new Set([
     ...Object.keys(contractTier), ...Object.keys(darkExplicit), ...Object.keys(PACK),
+    ...Object.keys(sharedRoot), // the shared token sheet the hall @imports (task 1005081)
   ]);
   // A sheet may define its own private tokens (atlas.css's --ab-* family), and
   // a page script may set one inline on the element (roadmap.js writes

package/tests/nav_permission_atoms.mjs

@@ -100,7 +100,8 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // task 1005076: the setup flow's holdForSetup;
 // task 1005050: Accomplishments left it (folded into Profile; its hashes redirect);
 // task 1005051: Roadmap left it (folded into Goals; /roadmap redirects).
-const SHELL_SHA = '5e52e0337239f532';
+// task 1005070: the remembered nav (the rail paints before /me).
+const SHELL_SHA = 'dbbe6f2eb49a65c3';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/ui_design_kit.mjs

@@ -125,6 +125,36 @@ test('the page argument survives Git Bash path conversion of a bare slash', () =
   assert.equal(lib.pageName('/'), 'index'); assert.equal(lib.pageName('/builders/ranks'), 'ranks'); assert.equal(lib.pageName('/projects?view=mine'), 'projects');
 });
 
+test('a page at the surface root reads index.states.json (task 1005080)', () => {
+  const hall = path.join(ROOT, 'modules', 'hall-ui', 'public');
+  assert.equal(lib.sidecarPath(hall, '/builders/', 'states'), path.join(hall, 'index.states.json'), 'the hall Home has no last segment of its own');
+  assert.equal(lib.sidecarPath(hall, '/builders/work', 'states'), path.join(hall, 'work.states.json'), 'a named page keeps its own file');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-root-'));
+  assert.equal(lib.sidecarPath(tmp, '/builders/', 'states'), path.join(tmp, 'builders.states.json'), 'no index file: the old name stands, so the miss is reported by name');
+});
+
+test('storage: a states or probes file may seed browser storage, and a bad shape is refused (task 1005080)', () => {
+  const ok = { page: '/x', storage: { session: { a: '1' }, local: { b: 'x' } }, states: { s: { storage: { session: { c: '2' } } } } };
+  assert.deepEqual(lib.validateStatesFile(ok).errors, []);
+  assert.ok(lib.validateStatesFile({ page: '/x', storage: { cookie: {} }, states: { s: {} } }).errors.some((e) => /storage\.cookie/.test(e)), 'only session and local');
+  assert.ok(lib.validateStatesFile({ page: '/x', storage: { session: { a: 1 } }, states: { s: {} } }).errors.some((e) => /storage\.session/.test(e)), 'values are strings');
+  assert.ok(lib.validateStatesFile({ page: '/x', states: { s: { storage: [] } } }).errors.some((e) => /states\.s\.storage/.test(e)), 'a state may carry its own');
+  assert.ok(lib.validateProbesFile({ page: '/x', storage: 'yes', probes: [{ name: 'p', expect: { visible: ['a'] } }] }).errors.some((e) => /^storage/.test(e)), 'a probes file too');
+  assert.deepEqual(lib.mergeStorage({ session: { a: '1', b: '1' } }, undefined, { session: { b: '2' }, local: { c: '3' } }), { session: { a: '1', b: '2' }, local: { c: '3' } }, 'a state layers over the file');
+});
+
+test('every hall sidecar renders the page a returning builder sees, not the first-visit mode picker (task 1005080)', () => {
+  const hall = path.join(ROOT, 'modules', 'hall-ui', 'public');
+  const files = fs.readdirSync(hall).filter((n) => /\.(states|probes)\.json$/.test(n));
+  assert.ok(files.length > 30);
+  for (const n of files) {
+    const json = JSON.parse(fs.readFileSync(path.join(hall, n), 'utf8'));
+    assert.equal(json.storage && json.storage.session && json.storage.session['hall-craft-asked'], '1', `${n}: seeds the picker as already asked`);
+  }
+  // the key is craft-mode.js's own; a rename there must break this pin, not silently bring the picker back
+  assert.match(fs.readFileSync(path.join(hall, 'craft-mode.js'), 'utf8'), /var ASKED_KEY = 'hall-craft-asked';/);
+});
+
 // ── the mock checker: platform rules vs the instance's taste ──────────────────
 const GOOD_MOCK = `<!doctype html><html><head><style>
 body{--pad:8px;color:var(--ink);background:var(--bg)}

package/tests/welcome_boot_browser.mjs

@@ -89,6 +89,8 @@ test('first visit of the day: the welcome, not the craft picker; Skip brings the
   await signIn(page);
   assert.deepEqual(await state(page), { welcome: true, picker: false, craft: null, asked: '1' },
     'the welcome shows, the picker is marked asked and does not stack on it');
+  assert.equal(await page.evaluate(() => document.querySelector('.wb__banner').tagName), 'DIV',
+    'over a signed-in hall the shell keeps the one <header>; the banner is a plain block (task 1005080)');
   // The painting loads and its motion is laid over it.
   await page.waitForFunction(() => { const i = document.querySelector('#welcome-boot .wb__img'); return i && i.complete && i.naturalWidth === 1024; });
   assert.equal(await page.isVisible('[data-wb-skip]'), true);
@@ -135,9 +137,11 @@ test('a visitor who is not signed in gets the Welcome on Home with a sign-in but
     roles: !!document.querySelector('[data-wb-roles]'),
     keys: Object.keys(localStorage).filter((k) => k.startsWith('hall-welcome-day') || k === 'hall-welcome-signin'),
     picker: !!document.getElementById('craft-picker'),
+    banner: document.querySelector('.wb__banner').tagName,
   }));
   assert.match(s.hi, /^Welcome to /);
   assert.deepEqual([s.signin, s.roles, s.keys, s.picker], [true, false, [], false]);
+  assert.equal(s.banner, 'HEADER', 'for a visitor the welcome is the page, so its banner is the one <header> (task 1005080)');
   await ctx.close();
 });