@bongos/core 1.24.52 → 1.24.54

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.52'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.54'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -46,6 +46,11 @@ const path = require('path');
 const express = require('express');
 const { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal } = require('./bongos/serve-internal');
 const { isApiShapedPath, apiNotFoundBody } = require('./bongos/api-path-404');
+const { errorHandlers } = require('./error-page');
+const { applyLinkPreview } = require('./link-preview');
+const { clientBranding, branding } = require('./branding');
+// The instance's public origin, for an absolute link-preview image URL ('' when unset).
+const safeOrigin = () => { try { return branding().domains.publicOrigin || ''; } catch { return ''; } };
 const moduleLoader = require('./module-loader/loader');
 const { start: startErrorTally, startDailySend: startErrorReports } = require('./module-loader/error-tally');
 const { isModuleEnabled } = require('./modules');
@@ -317,9 +322,14 @@ function buildPlatformApp() {
   // per request, because modules mount inside mountInternalSurfaces above. No
   // provider (the module is off, as on every instance but the hub) → next(),
   // and /raise falls through to the 404 tail like any unknown path.
+  // The module renders its own HTML, so the platform's one link-preview card (task
+  // 1005091) is added here, on the way out, to any page it sends.
   app.use('/raise', (req, res, next) => {
     const raise = isApexHost(req) && seams.resolveOptional('raise.web');
     if (!raise) return next();
+    const send = res.send.bind(res);
+    res.send = (body) => send(typeof body === 'string' && body.includes('</head>')
+      ? applyLinkPreview(body, clientBranding(), safeOrigin()) : body);
     Promise.resolve(raise.handle(req, res, next)).catch(next);
   });
   // THE ACCOUNT PAGE (task 1004259, ADR 0337 D4.3): where a person edits what
@@ -402,15 +412,19 @@ function buildPlatformApp() {
   // or the builders' hall lands here. There is NO game to fall through to, so:
   //   * an API-shaped path gets a self-describing JSON 404 (never HTML), the
   //     same contract server.js gives so a mis-prefixed CLI call is legible;
-  //   * everything else gets a plain-text 404 — a game-less instance ships no
-  //     themed island page (public/404.html lives in the game module).
-  app.use((req, res) => {
-    res.status(404);
-    if (isApiShapedPath(req.path)) {
-      return res.json(apiNotFoundBody(req.path));
-    }
-    return res.type('text/plain').send('404 — not found');
+  //   * a browser asking for a page gets the branded 404 (src/error-page.js,
+  //     task 1005091), and any other client the plain-text 404 it always had.
+  // Then the trailing error net: a page route that throws answers the branded 500
+  // to a browser instead of Express's bare "Internal Server Error".
+  const { notFound, onError } = errorHandlers({
+    brandHtml: injectBrandingGlobal,
+    notFoundCopy: () => { try { return clientBranding().copy.notFound; } catch { return 'Page not found.'; } },
+    isApiShapedPath,
+    apiNotFoundBody,
+    log: (err, req) => logger.error({ err, method: req.method, url: req.originalUrl }, 'page request failed'),
   });
+  app.use(notFound);
+  app.use(onError);
 
   return app;
 }

package/tests/brand_surfaces.mjs

@@ -0,0 +1,213 @@
+// tests/brand_surfaces.mjs — the brand outside the hall (task 1005091, goal 1000138):
+// the link-preview card every public page carries, the branded 404 and 500 pages,
+// the themed API docs, the brand colour on Discord posts, and no maker's name written
+// into the portable landing.
+//
+// Behaviour, not spelling: the server is built and asked for pages over HTTP, the
+// error handlers and the link-preview template are called, and the Discord posters
+// send to a stubbed fetch whose bodies are read back.
+//
+// Run:  node --test tests/brand_surfaces.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { buildPlatformApp } = require('../src/platform-server.js');
+const { linkPreviewTags, applyLinkPreview, CARD_PATH } = require('../src/link-preview.js');
+const { errorPageTemplate, errorHandlers } = require('../src/error-page.js');
+const { applyBrandTokens, injectBrandingGlobal } = require('../src/bongos/serve-internal.js');
+const { clientBranding } = require('../src/branding.js');
+const webhook = require('../modules/discord/webhook.js');
+const discordLib = require('../scripts/discord/lib.js');
+const { ogCardHtml } = require('../scripts/bongos/gen-brand.js');
+
+const BRAND = clientBranding();
+const PRODUCT = BRAND.identity.productName;
+
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => { await new Promise((resolve) => server.close(resolve)); });
+
+// node:http, not fetch: fetch drops a Host override.
+function get(p, { host = '127.0.0.1', accept = 'text/html,application/xhtml+xml,*/*;q=0.8' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host, Accept: accept } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, type: res.headers['content-type'] || '', body }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// ── the link-preview card ───────────────────────────────────────────────────────
+test('the card is built from the page\'s own title and description, with the shared image', () => {
+  const html = '<html><head><title>Status &amp; more — Acme</title><meta name="description" content="What &quot;shipped&quot;."></head><body></body></html>';
+  const brand = { identity: { productName: 'Acme' }, copy: { tagline: 'unused' } };
+  const tags = linkPreviewTags(html, brand, 'https://acme.example/');
+  assert.ok(tags.includes('<meta property="og:title" content="Status &amp; more — Acme">'), 'escaped once, not twice');
+  assert.ok(tags.includes('<meta property="og:description" content="What &quot;shipped&quot;.">'));
+  assert.ok(tags.includes(`<meta property="og:image" content="https://acme.example${CARD_PATH}">`), 'absolute when the instance has an origin');
+  assert.ok(tags.includes('<meta name="twitter:card" content="summary_large_image">'));
+  assert.ok(tags.includes('<meta property="og:site_name" content="Acme">'));
+  assert.ok(linkPreviewTags('<title>x</title>', {}, '').includes(`content="${CARD_PATH}"`), 'root-relative with no origin');
+  // a page that writes its own card keeps it
+  assert.equal(linkPreviewTags('<head><meta property="og:title" content="own"></head>', brand, ''), '');
+  const applied = applyLinkPreview(html, brand, '');
+  assert.ok(applied.indexOf('og:image') < applied.indexOf('</head>'));
+});
+
+test('every served public page carries the card: status, docs, and anything branded', async () => {
+  const status = await get('/', { host: 'status.example.com' });
+  assert.equal(status.status, 200);
+  assert.match(status.body, new RegExp(`<meta property="og:image" content="[^"]*${CARD_PATH.replace(/[.]/g, '\\.')}">`));
+  assert.match(status.body, /<meta property="og:title" content="[^"]*build status">/);
+  const docs = await get('/docs');
+  assert.equal(docs.status, 200);
+  assert.match(docs.body, /<meta name="twitter:card" content="summary_large_image">/);
+  // the landing and hub pages go through the same injection
+  const landingLike = injectBrandingGlobal('<html><head><title>{{productName}} — community</title></head><body></body></html>', BRAND, {});
+  assert.ok(landingLike.includes(`<meta property="og:title" content="${PRODUCT} — community">`));
+});
+
+test('the card image is a 1200x630 PNG drawn from the shared mark', () => {
+  const png = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'brand', 'og-card.png'));
+  assert.equal(png.toString('ascii', 1, 4), 'PNG');
+  assert.deepEqual([png.readUInt32BE(16), png.readUInt32BE(20)], [1200, 630]);
+  const page = ogCardHtml({ markSvg: '<svg/>', name: 'Acme <Co>', fontLinks: ['https://f.example/x'], fontFamily: '"Manrope", sans-serif' });
+  assert.ok(page.includes('text-transform:lowercase'), 'the wordmark is lowercase (DESIGN.md "Naming")');
+  assert.ok(page.includes('Acme &lt;Co&gt;'), 'the name is escaped');
+  assert.ok(page.includes('data:image/svg+xml;base64,'), 'the mark is the shared file, embedded');
+});
+
+// ── the branded 404 and 500 ────────────────────────────────────────────────────
+test('a browser gets the branded 404; an API path keeps JSON; a non-HTML client keeps text', async () => {
+  const page = await get('/no-such-page');
+  assert.equal(page.status, 404);
+  assert.match(page.type, /text\/html/);
+  assert.ok(page.body.includes('<use href="/modules/ui-design/public/brand/mark.svg#mark"/>'), 'the shared mark');
+  assert.ok(page.body.includes(`<title>${BRAND.copy.notFound} · ${PRODUCT}</title>`), 'the pack\'s words and the product name');
+  assert.ok(page.body.includes(BRAND.theme.fonts.links[0].replace(/&/g, '&amp;')), 'the pack\'s faces');
+  assert.doesNotMatch(page.body, /\{\{/);
+
+  const api = await get('/api/bongos/no-such-thing', { accept: 'text/html' });
+  assert.equal(api.status, 404);
+  assert.match(api.type, /application\/json/);
+
+  const curl = await get('/no-such-page', { accept: 'text/plain' });
+  assert.equal(curl.status, 404);
+  assert.match(curl.type, /text\/plain/);
+});
+
+test('a page route that throws answers the branded 500 to a browser and JSON to the API', () => {
+  const logged = [];
+  const { onError } = errorHandlers({
+    brandHtml: (h) => applyBrandTokens(h, { identity: { productName: 'Acme' } }, '', '', '', '', ''),
+    notFoundCopy: () => 'Gone.', isApiShapedPath: (p) => p.startsWith('/api/'), apiNotFoundBody: () => ({}),
+    log: (err) => logged.push(err.message),
+  });
+  const res = () => {
+    const r = { headersSent: false, code: 0, ctype: '', body: null };
+    r.status = (c) => { r.code = c; return r; };
+    r.type = (t) => { r.ctype = t; return r; };
+    r.send = (b) => { r.body = b; return r; };
+    r.json = (b) => { r.ctype = 'json'; r.body = b; return r; };
+    return r;
+  };
+  const req = (p, accept) => ({ path: p, method: 'GET', accepts: (t) => (Array.isArray(t) ? (accept === 'html' ? 'html' : 'json') : accept === 'html') });
+  const page = res();
+  onError(new Error('boom'), req('/projects', 'html'), page, () => {});
+  assert.equal(page.code, 500);
+  assert.equal(page.ctype, 'html');
+  assert.ok(page.body.includes('Something went wrong on our side.') && page.body.includes('· Acme</title>'));
+  assert.doesNotMatch(page.body, /boom/, 'the error text never reaches the page');
+  const api = res();
+  onError(new Error('boom'), req('/api/bongos/x', 'html'), api, () => {});
+  assert.equal(api.ctype, 'json');
+  assert.equal(api.body.error.code, 'internal_error');
+  assert.deepEqual(logged, ['boom', 'boom']);
+  // the 404 template carries the pack's words for "not found"
+  assert.ok(errorPageTemplate(404, { notFound: 'Gone.' }).includes('<h1>Gone.</h1>'));
+});
+
+test('the error page and the docs write their dark tier twice, byte-identical', () => {
+  const twins = (src) => {
+    const a = src.match(/html\[data-theme="dark"\]\s*\{([^}]*)\}/);
+    const b = src.match(/@media \(prefers-color-scheme:\s*dark\)\s*\{\s*html:not\(\[data-theme\]\)\s*\{([^}]*)\}/);
+    assert.ok(a && b, 'both twins exist');
+    const norm = (s) => s.replace(/\s+/g, ' ').trim();
+    assert.equal(norm(b[1]), norm(a[1]));
+  };
+  twins(errorPageTemplate(404));
+  twins(fs.readFileSync(path.join(ROOT, 'public-docs', 'index.html'), 'utf8'));
+});
+
+// ── the API docs ───────────────────────────────────────────────────────────────
+test('the API docs load the brand: the scales, the mark, the pack\'s faces and a token theme for Redoc', async () => {
+  const r = await get('/docs');
+  assert.equal(r.status, 200);
+  assert.ok(r.body.includes('<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">'));
+  assert.ok(r.body.includes('<use href="/modules/ui-design/public/brand/mark.svg#mark"/>'));
+  assert.ok(r.body.includes(BRAND.theme.fonts.links[0].replace(/&/g, '&amp;')), 'the pack\'s font link is spliced');
+  assert.match(r.body, /Redoc\.init\('\/docs\/openapi\.json', \{[^}]*theme: theme \}/);
+  assert.doesNotMatch(r.body, /system-ui, -apple-system, Segoe UI, Roboto/, 'the old system-font bar is gone');
+  assert.doesNotMatch(r.body, /#2b6cb0|#1a1a1a/, 'no off-pack colour');
+});
+
+// ── Discord ────────────────────────────────────────────────────────────────────
+async function capture(fn, envKey) {
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  const prev = process.env[envKey];
+  process.env[envKey] = 'https://discord.example/api/webhooks/1/x';
+  globalThis.fetch = async (url, init) => { sent.push(JSON.parse(init.body)); return { ok: true, status: 200, json: async () => ({ id: '1' }), text: async () => '' }; };
+  try { await fn(); } finally {
+    globalThis.fetch = realFetch;
+    if (prev === undefined) delete process.env[envKey]; else process.env[envKey] = prev;
+  }
+  return sent;
+}
+
+test('a Discord broadcast is an embed in the pack\'s accent (a sample post)', async () => {
+  const accent = parseInt(BRAND.theme.colors.accent.slice(1), 16);
+  const sample = webhook.embedBody('**Shipped:** the status page now matches the hall.');
+  assert.deepEqual(sample, {
+    embeds: [{ description: '**Shipped:** the status page now matches the hall.', color: accent }],
+    allowed_mentions: { parse: [] },
+  });
+  assert.equal(webhook.embedBody('x', { theme: { colors: { accent: 'not-a-colour' } } }).embeds[0].color, undefined, 'no bar rather than a wrong one');
+  assert.equal(webhook.embedBody('y'.repeat(5000)).embeds[0].description.length, 4096);
+
+  const [moduleBody] = await capture(() => webhook.postWebhook('ship_news', 'shipped'), 'DISCORD_SHIP_NEWS_WEBHOOK');
+  assert.deepEqual(moduleBody, { embeds: [{ description: 'shipped', color: accent }], allowed_mentions: { parse: [] } });
+  const [coreBody] = await capture(() => discordLib.postWebhook('ship_news', 'shipped'), 'DISCORD_SHIP_NEWS_WEBHOOK');
+  assert.deepEqual(coreBody, moduleBody, 'the core twin posts the same embed');
+});
+
+// ── the portable landing names no maker ─────────────────────────────────────────
+test('the landing names its maker only from the pack, and drops the band when there is none', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'index.html'), 'utf8');
+  const code = src.replace(/<!--(?!\/?brand-if)[\s\S]*?-->/g, '').replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.doesNotMatch(code, /Verro|VERRO/, 'no maker\'s name written into the portable page');
+  const stamp = (name) => applyBrandTokens(src, { identity: { productName: 'Acme', worldName: 'Acme', company: { name, site: '', tagline: '' } } }, '', '', '', '', '');
+  const named = stamp('Rocket Labs');
+  assert.ok(named.includes('<p class="wordmark">Rocket Labs</p>'));
+  assert.ok(named.includes('Built by Rocket Labs, Acme is our way'));
+  assert.ok(named.includes('held by Rocket Labs or its pilot clients'));
+  const none = stamp('');
+  assert.doesNotMatch(none, /class="wrap verro"|held by|Built by ,/, 'the band and the line drop whole');
+});

package/tests/discord_board_broadcast.mjs

@@ -132,16 +132,29 @@ test('the emitter fires on FRESH opens only, and the listener is registered (sou
   assert.ok(manifest.consumes.includes('government'), 'the port consumption is declared');
 });
 
-test('#871 survives: the mention poster keeps parse:[] and rings only the explicit allowlist', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'webhook.js'), 'utf8');
-  const block = src.slice(src.indexOf('async function postWebhookMentions'));
-  assert.match(block, /postCore\(channel, text, \{ parse: \[\], users \}\)/,
-    'content can never ping on its own — only the server-resolved ids ring');
-  const plain = src.slice(src.indexOf('async function postWebhook('), src.indexOf('async function postWebhookMentions'));
-  assert.match(plain, /postCore\(channel, text, \{ parse: \[\] \}\)/,
-    'the default poster stays fully suppressed — #871 verbatim');
-  assert.match(block, /slice\(0, 20\)/, 'the allowlist is sanity-bounded');
-  assert.match(block, /\^\\d\+\$/, 'only numeric snowflake ids survive the filter');
+test('#871 survives: the mention poster keeps parse:[] and rings only the explicit allowlist', async () => {
+  // Drive the two posters against a stubbed fetch and read the bodies they send
+  // (task 1005091 moved the plain poster onto an embed; the rule did not move).
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  const prev = process.env.DISCORD_BOARD_ROOM_WEBHOOK;
+  process.env.DISCORD_BOARD_ROOM_WEBHOOK = 'https://discord.example/api/webhooks/1/x';
+  globalThis.fetch = async (url, init) => { sent.push(JSON.parse(init.body)); return { ok: true, status: 200, json: async () => ({ id: '9' }) }; };
+  try {
+    await webhook.postWebhookMentions('board_room', 'vote <@1> @everyone', ['111', '222', 'not-an-id', ...Array.from({ length: 30 }, (_, i) => String(1000 + i))]);
+    await webhook.postWebhook('board_room', 'plain @everyone');
+  } finally {
+    globalThis.fetch = realFetch;
+    if (prev === undefined) delete process.env.DISCORD_BOARD_ROOM_WEBHOOK; else process.env.DISCORD_BOARD_ROOM_WEBHOOK = prev;
+  }
+  const [ring, plain] = sent;
+  assert.deepEqual(ring.allowed_mentions.parse, [], 'content can never ping on its own — only the server-resolved ids ring');
+  assert.equal(ring.content, 'vote <@1> @everyone', 'the mention post stays message text, so its ids can ring');
+  assert.equal(ring.allowed_mentions.users.length, 20, 'the allowlist is sanity-bounded');
+  assert.ok(ring.allowed_mentions.users.every((u) => /^\d+$/.test(u)), 'only numeric snowflake ids survive the filter');
+  assert.deepEqual(plain.allowed_mentions, { parse: [] }, 'the default poster stays fully suppressed — #871 verbatim');
+  assert.equal(plain.content, undefined, 'the default poster sends an embed, not message text');
+  assert.equal(plain.embeds[0].description, 'plain @everyone');
   assert.ok(webhook.CHANNELS.has('board_room'), 'the channel key exists');
 });
 

package/tests/docs_openapi_route.mjs

@@ -67,7 +67,8 @@ test('/docs Redoc page points at the same-origin spec URL it now always serves',
     const res = await fetch(base + '/docs');
     assert.equal(res.status, 200);
     const html = await res.text();
-    assert.match(html, /spec-url="\/docs\/openapi\.json"/, 'Redoc host page fetches /docs/openapi.json');
+    // task 1005091: Redoc is started by Redoc.init with the page's theme, so the URL is its first argument
+    assert.match(html, /Redoc\.init\('\/docs\/openapi\.json'/, 'Redoc host page fetches /docs/openapi.json');
   });
 });
 

package/tests/goal_forest_page.mjs

@@ -19,7 +19,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
-import { makeRunner, makeEl, walk } from './helpers.mjs';
+import { makeRunner, makeEl, walk, realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -58,6 +58,7 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
       escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
       $: (sel) => documentObj.getElementById(String(sel).replace(/^#/, '')),
       fmtNum: (n) => String(n), fmtDate: (iso) => String(iso ?? ''), toast() {}, rankLabel: (r) => String(r ?? ''), categoryChip: () => '',
+      statusPill: realOTB().statusPill, // the one status pill (task 1005086)
     },
     OTBTaskLib: {},
     OTBKit: {

package/tests/hall_audit.mjs

@@ -128,7 +128,8 @@ test('the removed-class guard CATCHES a reintroduction, and tolerates lookalikes
   // watch.css legitimately defines badge--sev-low; the guard must not match it.
   assert.equal(re('sev-low').test('.badge--sev-low { color: red }'), false,
     'a different class that merely ends with the name is not a reintroduction');
-  assert.match(read('watch.css'), /\.badge--sev-low/, 'watch.css still owns the live severity styles');
+  // task 1005086: the severity badges joined the shared status pill's tones in controls.css
+  assert.match(read('controls.css'), /\.badge--sev-low/, 'controls.css owns the live severity styles');
 });
 
 // ---- 5. the page never scrolls sideways (task 1002446) --------------------

package/tests/hall_record_world.mjs

@@ -59,6 +59,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -403,6 +404,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
       kindIsUnset: (k) => !k || k === 'unclassified',
       KIND_UNSET: 'unclassified',
       escapeHtml,
+      statusPill: realOTB().statusPill, // the one status pill (task 1005086)
       $: (sel) => documentObj.querySelector(sel),
       fmtDate: (iso) => String(iso).slice(0, 10),
       errCode: (d) => (d && d.error && d.error.code) || null,
@@ -520,21 +522,23 @@ test('under two figures there is no band at all — one figure is not a row', as
 // The status pill is the one place a lifecycle state is coloured, and it must
 // take the status vocabulary rather than the accent (DESIGN.md §Reuse).
 test('the status pill takes the state vocabulary, and backlog is deliberately neutral', async () => {
+  // task 1005086: the tone comes from the hall's ONE map (dom-utils.js STATUS_TONE) and the
+  // pill is the ONE .status-pill, so the task page reads exactly as every other page does.
   const tones = {
-    shipped: 'rec-pill--ok', confirmed: 'rec-pill--ok',
-    active: 'rec-pill--info', completed: 'rec-pill--info', ready: 'rec-pill--info',
-    blocked: 'rec-pill--warn',
+    shipped: 'status-pill--ok', confirmed: 'status-pill--ok',
+    active: 'status-pill--info', completed: 'status-pill--info', ready: 'status-pill--info',
+    blocked: 'status-pill--warn',
   };
   for (const [status, cls] of Object.entries(tones)) {
     const r = renderTask({ ...BASE_TASK, status });
     await r.boot(); await settle();
-    assert.match(r.html(), new RegExp(`class="rec-pill ${cls}">${status}<`), `${status} takes ${cls}`);
+    assert.match(r.html(), new RegExp(`class="status-pill ${cls}">${status}<`), `${status} takes ${cls}`);
   }
   const r = renderTask({ ...BASE_TASK, status: 'backlog' });
   await r.boot(); await settle();
-  assert.match(r.html(), /class="rec-pill">backlog</,
+  assert.match(r.html(), /class="status-pill status-pill--neutral">backlog</,
     'backlog is the NEUTRAL pill: the retired inline block painted it amber like blocked, and "not scheduled yet" is not "something is wrong here"');
-  assert.doesNotMatch(r.html(), /rec-pill--\w+">backlog/, 'and it takes no state tone at all');
+  assert.doesNotMatch(r.html(), /status-pill--(ok|warn|danger|info)">backlog/, 'and it takes no state tone at all');
 });
 
 test('an open rank floor is said as the absence of one, not "min rank any rank"', async () => {

package/tests/hall_roster_world.mjs

@@ -102,7 +102,7 @@ test('goals: rows|cards is a segmented view toggle that still writes #f-goal-vie
   assert.match(src, /function setGoalView\(view, opts\)/);
   assert.match(src, /b\.setAttribute\('aria-pressed', String\(b\.dataset\.view === view\)\)/, 'the buttons carry the pressed state');
   assert.match(src, /if \(savedGoalView === 'cards'\) setGoalView\('cards', \{ fire: false \}\)/, 'the saved pref restores the toggle without a render');
-  const css = read('goals.css');
+  const css = read('controls.css'); // the shared view toggle since task 1005086
   const pressed = block(css, '.viewtoggle__btn[aria-pressed="true"]');
   assert.match(pressed, /var\(--accent-tint\)/, 'the pressed side takes the current-thing tint');
   assert.doesNotMatch(pressed, /var\(--accent\)/, 'never the accent fill: a view is not a live door');