@bongos/core 1.24.72 → 1.24.74

package/tests/government_constitution_durable.mjs

@@ -0,0 +1,304 @@
+// tests/government_constitution_durable.mjs — a ratified constitution survives a
+// restart (task 1005140).
+//
+// Found live on toast, 2026-11-07: the board ratified a Timocratic Republic, the
+// amendment was written to <instance root>/config/government.json, and the next
+// container start (deploy, restart, or an idle wake on a free plan) erased the
+// file. The project went back to the day-one monarchy without an error.
+//
+// DB-free: the constitution row lives in an in-memory stand-in for db.js's two
+// functions; the instance pack is a REAL temp file, and "a restart" is deleting
+// it. The invariants:
+//
+//   1. A restart does not lose a ratified constitution — the row restores it.
+//   2. A file with no row is ADOPTED into the row (nobody loses one on upgrade).
+//   3. The row wins over a stale file.
+//   4. The row is written BEFORE the file, and a write that did not take is
+//      REPORTED at the close (constitution_not_applied), never absorbed.
+//   5. The operator's re-apply only ever re-applies a PASSED constitutional
+//      amendment — it cannot invent a block.
+//   6. The restore runs at boot, immediately.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+const constitution = require(path.join(GOV, 'constitution.js'));
+const board = require(path.join(GOV, 'board.js'));
+
+const MONARCHY = Object.freeze({ membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true });
+const TIMOCRACY = Object.freeze({ membership: 'rank:metic+', pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true });
+const quiet = { log: () => {}, error: () => {} };
+
+let seq = 0;
+const tmpPack = () => path.join(os.tmpdir(), `gov-durable-${process.pid}-${Date.now()}-${seq++}`, 'config', 'government.json');
+
+// One harness: an in-memory row, and the config's instance path redirected to
+// a temp file for both the write and the read — what a real process does with
+// its own INSTANCE_PATH.
+async function withInstance(fn, { row = null, saveFails = false, getFails = null, history } = {}) {
+  const pack = tmpPack();
+  const store = { row, saves: [] };
+  const orig = {
+    get: db.getConstitutionRow, save: db.saveConstitutionRow,
+    apply: config.applyBoardAmendment, load: config.loadGovernmentConfig,
+    list: db.listAmendmentHistory,
+  };
+  if (history !== undefined) db.listAmendmentHistory = async () => history;
+  db.getConstitutionRow = async () => { if (getFails) throw getFails; return store.row; };
+  db.saveConstitutionRow = async (args) => {
+    if (saveFails) throw new Error('connection refused');
+    store.saves.push(args);
+    store.row = { board: args.board, source: args.source, amendment_item_id: args.itemId };
+    return store.row;
+  };
+  config.applyBoardAmendment = (proposed, opts = {}) => orig.apply(proposed, { instancePath: opts.instancePath || pack });
+  config.loadGovernmentConfig = (opts = {}) => orig.load({ ...opts, instancePath: opts.instancePath || pack });
+  try { return await fn({ pack, store, live: () => orig.load({ instancePath: pack }).board }); }
+  finally {
+    db.getConstitutionRow = orig.get; db.saveConstitutionRow = orig.save; db.listAmendmentHistory = orig.list;
+    config.applyBoardAmendment = orig.apply; config.loadGovernmentConfig = orig.load;
+    fs.rmSync(path.dirname(path.dirname(pack)), { recursive: true, force: true });
+  }
+}
+
+const restart = (pack) => fs.rmSync(pack, { force: true });
+
+// ── 1. the bug itself ────────────────────────────────────────────────────────
+
+test('a ratified constitution survives a container restart (the toast bug)', async () => {
+  await withInstance(async ({ pack, store, live }) => {
+    const out = await constitution.recordRatified(TIMOCRACY, { itemId: '7' });
+    assert.equal(out.failure, null, `the ratified amendment took: ${JSON.stringify(out.failure)}`);
+    assert.deepEqual({ ...live() }, TIMOCRACY, 'in force right after the close');
+    assert.deepEqual(store.row.board, TIMOCRACY, 'the durable row holds it');
+    assert.equal(store.row.source, 'amendment');
+
+    restart(pack); // the container's filesystem is wiped
+    assert.deepEqual({ ...live() }, MONARCHY, 'fixture: with the file gone the process alone falls back to monarchy');
+
+    const r = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(r.action, 'restored');
+    assert.deepEqual({ ...live() }, TIMOCRACY, 'after the boot restore the board\'s decision is in force again');
+  });
+});
+
+// ── 2 + 3. adopt on first read; the row wins ─────────────────────────────────
+
+test('a file with no row is adopted into the database and the log says so', async () => {
+  await withInstance(async ({ pack, store }) => {
+    fs.mkdirSync(path.dirname(pack), { recursive: true });
+    fs.writeFileSync(pack, JSON.stringify({ ranks: { metic: { label: 'Trusted' } }, board: TIMOCRACY }));
+    const lines = [];
+    const r = await constitution.reconcile({ instancePath: pack, log: (m) => lines.push(m), error: () => {} });
+    assert.equal(r.action, 'adopted');
+    assert.deepEqual(store.row.board, TIMOCRACY);
+    assert.equal(store.row.source, 'adopted_file');
+    assert.ok(lines.some((l) => /adopted/.test(l)), 'the adoption is logged');
+    const again = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(again.action, 'in_step', 'a second pass changes nothing');
+  });
+});
+
+test('no row and no file is the vanilla instance: nothing is written', async () => {
+  await withInstance(async ({ pack, store }) => {
+    const r = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(r.action, 'none');
+    assert.equal(store.saves.length, 0);
+    assert.equal(fs.existsSync(pack), false, 'no file is invented for a vanilla instance');
+  }, { history: [] });
+});
+
+test('the toast case: no row, no file, a passed amendment — the first boot puts it back in force (part C)', async () => {
+  const history = [
+    { item_id: 30, amendment_id: 9, outcome: 'returned', proposed: MONARCHY, kind: 'constitution' },
+    { item_id: 21, amendment_id: 1, outcome: 'passed', proposed: TIMOCRACY, kind: 'constitution' },
+  ];
+  await withInstance(async ({ pack, store, live }) => {
+    assert.deepEqual({ ...live() }, MONARCHY, 'fixture: the erased instance answers the day-one monarchy');
+    const lines = [];
+    const r = await constitution.reconcile({ instancePath: pack, log: (m) => lines.push(m), error: () => {} });
+    assert.equal(r.action, 'recovered', JSON.stringify(r));
+    assert.equal(r.item_id, '21', 'the PASSED amendment, never the newer returned one');
+    assert.deepEqual({ ...live() }, TIMOCRACY, 'the board decision is in force again');
+    assert.deepEqual(store.row.board, TIMOCRACY, 'and durable, so the next restart keeps it');
+    assert.ok(lines.some((l) => /put back passed amendment 1/.test(l)), 'the log says so');
+    assert.equal((await constitution.reconcile({ instancePath: pack, ...quiet })).action, 'in_step');
+  }, { history });
+});
+
+test('the row wins over a stale file, and the file keeps its other keys', async () => {
+  await withInstance(async ({ pack, live }) => {
+    fs.mkdirSync(path.dirname(pack), { recursive: true });
+    fs.writeFileSync(pack, JSON.stringify({ ranks: { metic: { label: 'Trusted' } }, board: MONARCHY }));
+    const r = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(r.action, 'restored');
+    assert.deepEqual({ ...live() }, TIMOCRACY);
+    assert.equal(JSON.parse(fs.readFileSync(pack, 'utf8')).ranks.metic.label, 'Trusted', 'rank templates survive the restore');
+  }, { row: { board: TIMOCRACY, source: 'amendment' } });
+});
+
+test('an unmigrated database (no table) and an unreadable one never throw and never touch the file', async () => {
+  const missing = Object.assign(new Error('relation "government_constitution" does not exist'), { code: '42P01' });
+  await withInstance(async ({ pack }) => {
+    assert.equal((await constitution.reconcile({ instancePath: pack, ...quiet })).action, 'no_table');
+    assert.equal(fs.existsSync(pack), false);
+  }, { getFails: missing });
+  await withInstance(async ({ pack }) => {
+    assert.equal((await constitution.reconcile({ instancePath: pack, ...quiet })).action, 'read_failed');
+  }, { getFails: new Error('timeout') });
+});
+
+// ── 4. row first, and a write that did not take is reported ──────────────────
+
+test('the row is written before the file: a failed save leaves the old rule and SAYS so', async () => {
+  await withInstance(async ({ pack, live }) => {
+    const out = await constitution.recordRatified(TIMOCRACY, { itemId: '7' });
+    assert.equal(out.applied, null);
+    assert.ok(out.failure, 'reported, not absorbed');
+    assert.equal(out.failure.problems[0].where, 'database');
+    assert.equal(fs.existsSync(pack), false, 'nothing was put in force that would vanish at the next restart');
+    assert.equal(out.failure.problems[0].reason, 'save_failed');
+    assert.doesNotMatch(JSON.stringify(out.failure), /connection refused/, 'a voter sees a reason word, never the driver message');
+    assert.deepEqual({ ...live() }, MONARCHY);
+  }, { saveFails: true });
+});
+
+test('a file write that silently did not take is caught by the read-back', async () => {
+  await withInstance(async ({ store }) => {
+    config.applyBoardAmendment = (proposed) => ({ ...proposed }); // claims success, writes nothing
+    const out = await constitution.recordRatified(TIMOCRACY, { itemId: '7' });
+    assert.ok(out.failure, 'the verify caught it');
+    assert.deepEqual(out.failure.problems.map((p) => p.where), ['in_force']);
+    assert.deepEqual(out.failure.problems[0].fields, ['membership', 'pass_rule']);
+    assert.deepEqual(store.row.board, TIMOCRACY, 'the durable row still holds the decision, so a restore can finish the job');
+  });
+});
+
+test('closeItem hands a constitution that did not take back to the caller (and the vote route forwards it)', async () => {
+  const item = { id: '21', subject_type: 'constitutional_amendment', subject_id: '5', opened_by: '42', closed_at: null, expired: false, constitution: MONARCHY };
+  const stubs = {
+    getVotesForItem: async () => [{ id: '1', voter_id: '42', direction: 'yes' }],
+    closeBoardItem: async ({ outcome }) => ({ ...item, closed_at: 'T', outcome }),
+    getAmendment: async () => ({ id: '5', proposed: TIMOCRACY, kind: 'constitution' }),
+    insertAuthorRatifyKarma: async () => true,
+    getBoardItemAuthor: async () => '42',
+  };
+  const orig = {};
+  for (const [k, v] of Object.entries(stubs)) { orig[k] = db[k]; db[k] = v; }
+  try {
+    await withInstance(async () => {
+      const closed = await board.closeItem(item, { cause: 'vote' });
+      assert.equal(closed.outcome, 'passed');
+      assert.ok(closed.constitution_not_applied, 'the close itself reports it');
+      assert.equal(closed.constitution_not_applied.problems[0].where, 'database');
+    }, { saveFails: true });
+    await withInstance(async ({ live }) => {
+      const closed = await board.closeItem(item, { cause: 'vote' });
+      assert.equal(closed.constitution_not_applied, undefined, 'a clean apply reports nothing');
+      assert.deepEqual({ ...closed.applied_constitution }, TIMOCRACY);
+      assert.deepEqual({ ...live() }, TIMOCRACY);
+    });
+  } finally { for (const [k, v] of Object.entries(orig)) db[k] = v; }
+
+  const routeSrc = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
+  assert.match(routeSrc, /closure && closure\.constitution_not_applied \? \{ constitution_not_applied:/,
+    'the vote route forwards it to the page the voter is standing on');
+  for (const page of ['board-room.js', 'street-card.js']) {
+    const src = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', page), 'utf8');
+    assert.match(src, /constitution_not_applied/, `${page} says so instead of "in force"`);
+  }
+});
+
+// ── 5. the operator's re-apply ───────────────────────────────────────────────
+
+test('re-apply puts the newest PASSED constitutional amendment back, skipping returned ones and laws', async () => {
+  const history = [
+    { item_id: 30, amendment_id: 12, outcome: 'returned', proposed: MONARCHY, kind: 'constitution' },
+    { item_id: 29, amendment_id: 11, outcome: 'passed', proposed: { enact: [] }, kind: 'laws' },
+    { item_id: 21, amendment_id: 1, outcome: 'passed', proposed: TIMOCRACY, kind: 'constitution' },
+  ];
+  const origList = db.listAmendmentHistory;
+  db.listAmendmentHistory = async () => history;
+  try {
+    await withInstance(async ({ store, live }) => {
+      const out = await constitution.reapplyNewestPassed({ updatedBy: '3' });
+      assert.equal(out.ok, true, JSON.stringify(out));
+      assert.equal(out.item_id, '21');
+      assert.deepEqual({ ...live() }, TIMOCRACY);
+      assert.equal(store.row.source, 'reapply');
+      assert.equal(store.saves[0].updatedBy, '3');
+    });
+    db.listAmendmentHistory = async () => history.slice(0, 2);
+    await withInstance(async ({ store }) => {
+      const out = await constitution.reapplyNewestPassed({});
+      assert.deepEqual(out, { ok: false, reason: 'no_passed_amendment' });
+      assert.equal(store.saves.length, 0, 'it never invents a constitution');
+    });
+  } finally { db.listAmendmentHistory = origList; }
+});
+
+test('the re-apply route is pinned to the owner atom and takes no block from the request', () => {
+  const { GOVERNMENT_PINS } = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  const pins = GOVERNMENT_PINS || {};
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'), 'utf8');
+  assert.match(src, /'POST \/government\/constitution\/reapply': 'perm:government\.manage'/);
+  if (Object.keys(pins).length) assert.equal(pins['POST /government/constitution/reapply'], 'perm:government.manage');
+  const routeSrc = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
+  assert.match(routeSrc, /router\.post\('\/government\/constitution\/reapply', api\.requireBuilder, api\.requirePermission\('government\.manage'\), constitution\.reapplyRoute\(log\)\)/,
+    'the route exists, gated on the owner atom');
+  assert.doesNotMatch(constitution.reapplyRoute.toString(), /req\.body/, 'the block comes from a passed amendment, never the request');
+});
+
+test('the re-apply handler answers 404 with nothing passed and 200 with the board it put back', async () => {
+  const call = async () => {
+    const res = { code: 200, body: null,
+      status(c) { this.code = c; return this; }, json(b) { this.body = b; return this; },
+      fail(code, status, extra) { this.code = typeof status === 'number' ? status : status.status; this.body = { code, ...extra }; return this; } };
+    await constitution.reapplyRoute({ error: () => {} })({ builder: { id: '3' }, body: { board: MONARCHY } }, res);
+    return res;
+  };
+  const origList = db.listAmendmentHistory;
+  try {
+    db.listAmendmentHistory = async () => [];
+    await withInstance(async () => {
+      const res = await call();
+      assert.equal(res.code, 404);
+      assert.equal(res.body.code, 'no_passed_amendment');
+    });
+    db.listAmendmentHistory = async () => [{ item_id: 21, amendment_id: 1, outcome: 'passed', proposed: TIMOCRACY, kind: 'constitution' }];
+    await withInstance(async ({ live }) => {
+      const res = await call();
+      assert.equal(res.code, 200);
+      assert.deepEqual({ ...res.body.board }, TIMOCRACY, 'the passed amendment, not the request body');
+      assert.deepEqual({ ...live() }, TIMOCRACY);
+    });
+  } finally { db.listAmendmentHistory = origList; }
+});
+
+// ── 6. at boot ───────────────────────────────────────────────────────────────
+
+test('the restore runs the moment the poller starts, not after a delay', () => {
+  const poller = require(path.join(GOV, 'pollers', 'constitution-restore.js'));
+  let calls = 0;
+  poller.start({ reconcileFn: async () => { calls += 1; return { action: 'in_step' }; } });
+  try {
+    return new Promise((resolve) => setImmediate(() => { assert.equal(calls, 1); resolve(); }));
+  } finally { poller.stop(); }
+});
+
+test('the module declares the poller and the migration creates the one-row table', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
+  assert.ok(manifest.contributes.pollers.includes('constitution-restore'));
+  const sql = fs.readFileSync(path.join(GOV, 'migrations', 'government_037_constitution.sql'), 'utf8');
+  assert.match(sql, /CREATE TABLE IF NOT EXISTS government_constitution/);
+  assert.match(sql, /CHECK \(id = 1\)/, 'one row, by construction');
+});

package/tests/government_seed.mjs

@@ -53,6 +53,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_031_treasury.sql',                   // the treasury: a pot per goal and the loans a dry pot asks the reserve for (task 1004712)
   'government_032_ask_flags.sql',                  // the reword list: matters a reader flagged as unclear (owner 2026-10-23)
   'government_036_access_holders.sql',             // who holds the keys outside Bongos + the access:<key> ask seat (task 1005000)
+  'government_037_constitution.sql',               // the constitution in force as a durable row (task 1005140)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.

package/tests/hall_city.mjs

@@ -289,7 +289,7 @@ test('the city sits in the hall chrome, behind the shell\'s full-screen switch',
   // task 1004685 (the living city): gov-living.js, the model under the drawing, and
   // gov-feeds.js, its one reader per page (shared with the shell's tally), load before it
   // task 1004702: the card answers its first ask in place, so the deck's card and sender (and the desk rows under them) load before the page
-  assert.deepEqual(scripts, ['dom-utils', 'shell-trail', 'craft-mode', 'shell', 'hall-dialog', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'hall-kit', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-deck', 'city-decide', 'city-switchboard', 'city'], 'the shell first, then the shared dialog (task 1005085), as on every hall page');
+  assert.deepEqual(scripts, ['dom-utils', 'shell-game', 'shell-trail', 'craft-mode', 'shell', 'hall-dialog', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'hall-kit', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-deck', 'city-decide', 'city-switchboard', 'city'], 'the shell first, then the shared dialog (task 1005085), as on every hall page');
   // task 1004925: every script but dom-utils.js is deferred, so none holds up the
   // parser; defer runs them in document order, which is why the order above still
   // holds. dom-utils.js stays synchronous: the one-escaper guard

package/tests/hall_fullscreen.mjs

@@ -25,6 +25,8 @@ const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const SHELL = fs.readFileSync(path.join(HALL, 'shell.js'), 'utf8');
 // task 1004492: the way back lives in shell-trail.js, which every page loads first.
 const TRAIL = fs.readFileSync(path.join(HALL, 'shell-trail.js'), 'utf8');
+// task 1005142: game mode, the hall-wide half of the switch; every page loads it before the shell.
+const GAME = fs.readFileSync(path.join(HALL, 'shell-game.js'), 'utf8');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 
 // Boot the shell once — one page load. `store` is the browser's localStorage and
@@ -125,11 +127,16 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(GAME, sandbox, { filename: 'shell-game.js' });
   vm.runInContext(TRAIL, sandbox, { filename: 'shell-trail.js' });
   vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
   const root = documentObj.documentElement;
   return {
     store,
+    game: () => windowObj.OTBShellGame,
+    gameStamp: () => root.dataset.game === 'on',
+    // The "how to leave" line: showing = the shell created it and it is not hidden.
+    hintShowing: () => els.has('fullscreen-hint') && els.get('fullscreen-hint').hidden === false,
     button: () => getElementById('fullscreen-toggle'),
     on: () => root.dataset.fullscreen === 'on',
     plain: () => root.dataset.fullscreenPlain === 'on',
@@ -477,3 +484,97 @@ test('source: full screen hides the sidebar and foot, and collapses the top bar
   assert.match(css, /html\[data-fullscreen="on"\] \.topbar-side > :not\(\.fullscreen-toggle\)/);
   assert.doesNotMatch(css, /html\[data-fullscreen="on"\] \.app-topbar \{ display: none/);
 });
+
+// GAME MODE (task 1005142, BONGOS-V3 R02). The spec's done-when: no page shows the
+// sidebar in game mode. Game mode is hall-wide — one key, read by the SAME switch
+// — so these drive the real shell-game.js + shell.js the way a reader moves
+// through the hall: page after page over one browser store.
+test('game mode: EVERY page opens without its bars — plain, laid-out, and one that remembers "off"', () => {
+  const store = { 'hall-game': 'on', 'hall-fullscreen:goals': 'off' };
+  for (const [page, optIn] of [['goals', false], ['work', false], ['thinking', true], ['city', true]]) {
+    const p = boot({ page, optIn, store });
+    assert.equal(p.on(), true, `${page} opens in full screen`);
+    assert.equal(p.gameStamp(), true, `${page}: html[data-game="on"]`);
+    assert.equal(p.plain(), optIn === false, `${page}: the plain mark still follows the page`);
+  }
+  assert.equal(boot({ page: 'goals', optIn: false, store: {} }).on(), false, 'and outside game mode nothing changed');
+});
+
+test('game mode: every hall page carries the switch — none opts out, and each loads shell-game.js before the shell', () => {
+  const pages = fs.readdirSync(HALL).filter((f) => f.endsWith('.html'));
+  assert.ok(pages.length >= 30, `found ${pages.length} hall pages`);
+  for (const f of pages) {
+    const html = read(f);
+    assert.doesNotMatch(html, /data-fullscreen-switch="off"/, `${f} must not opt out: it would keep its sidebar in game mode`);
+    assert.match(html, /id="app-topbar"/, `${f}: the top bar is where the shell renders the switch`);
+    const tags = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js[^"]*"( defer)?><\/script>/g)].map((m) => [m[1], !!m[2]]);
+    const game = tags.findIndex((t) => t[0] === 'shell-game');
+    const shell = tags.findIndex((t) => t[0] === 'shell');
+    assert.ok(game >= 0 && game < shell, `${f} loads shell-game.js before shell.js`);
+    assert.equal(tags[game][1], tags[shell][1], `${f}: both load the same way, so the order holds`);
+  }
+});
+
+test('game mode: leaving brings the bars back for THIS page only, and never rewrites a page\'s own memory', () => {
+  const store = { 'hall-game': 'on', 'hall-fullscreen:thinking': 'on' };
+  const goals = boot({ page: 'goals', optIn: false, store });
+  goals.press('Escape');
+  assert.equal(goals.on(), false, 'Escape still leaves');
+  assert.equal(store['hall-fullscreen:goals'], undefined, 'nothing remembered for the page');
+  assert.equal(boot({ page: 'goals', optIn: false, store }).on(), true, 'the next load opens without bars again');
+  const sky = boot({ page: 'thinking', store });
+  sky.button().click();
+  assert.equal(sky.on(), false, 'the corner button leaves too');
+  assert.equal(store['hall-fullscreen:thinking'], 'on', 'the sky\'s own choice survives game mode');
+});
+
+test('game mode: the Escape hand-off is unchanged — a press the page used, or one in a field, does not leave', () => {
+  const p = boot({ page: 'goals', optIn: false, store: { 'hall-game': 'on' } });
+  p.press('Escape', { pageUses: true });
+  assert.equal(p.on(), true, 'a page listener that called preventDefault keeps the press');
+  p.press('Escape', { target: { tagName: 'TEXTAREA' } });
+  assert.equal(p.on(), true);
+});
+
+test('game mode: set() switches the page live, and turning it off hands each page back its own memory', () => {
+  const store = { 'hall-fullscreen:thinking': 'on' };
+  const goals = boot({ page: 'goals', optIn: false, store });
+  goals.game().set(true);
+  assert.equal(store['hall-game'], 'on');
+  assert.equal(goals.on(), true, 'on at once, no reload');
+  assert.ok(goals.resizes() >= 1, 'a page that sizes to its box is told to re-measure');
+  goals.game().set(false);
+  assert.equal(goals.on(), false, 'goals remembered nothing, so its bars return');
+  assert.equal(goals.gameStamp(), false);
+  assert.equal(store['hall-fullscreen:goals'], undefined, 'and switching the mode wrote nothing for the page');
+  const sky = boot({ page: 'thinking', store: Object.assign(store, { 'hall-game': 'on' }) });
+  sky.game().set(false);
+  assert.equal(sky.on(), true, 'the sky had chosen full screen itself, and keeps it');
+});
+
+test('game mode: ?game=on / ?game=off set it from the URL; anything else is ignored', () => {
+  const store = {};
+  assert.equal(boot({ page: 'work', optIn: false, store, search: '?game=on' }).on(), true);
+  assert.equal(store['hall-game'], 'on');
+  assert.equal(boot({ page: 'goals', optIn: false, store }).on(), true, 'and it holds on the next page');
+  assert.equal(boot({ page: 'work', optIn: false, store, search: '?game=off' }).on(), false);
+  boot({ page: 'work', optIn: false, store, search: '?game=%22%3E%3Cimg%3E' });
+  assert.equal(store['hall-game'], 'off', 'a value that is not on/off is not stored');
+});
+
+test('game mode: how to leave is said once per tab, not on every page; outside it the shell\'s rule stands', () => {
+  const store = { 'hall-game': 'on' };
+  const session = {};
+  assert.equal(boot({ page: 'goals', optIn: false, store, session }).hintShowing(), true, 'the first page says it');
+  assert.equal(boot({ page: 'work', optIn: false, store, session }).hintShowing(), false, 'the next does not repeat it');
+  const own = { 'hall-fullscreen:thinking': 'on' };
+  assert.equal(boot({ page: 'thinking', store: own, session: {} }).hintShowing(), true);
+  assert.equal(boot({ page: 'thinking', store: own, session: {} }).hintShowing(), true, 'a remembered page says it on every open, as before');
+});
+
+test('game mode: storage that throws leaves the hall out of game mode, with the switch working', () => {
+  const p = boot({ page: 'goals', optIn: false, storageThrows: true, search: '?game=on' });
+  assert.equal(p.on(), false);
+  p.button().click();
+  assert.equal(p.on(), true);
+});

package/tests/hall_my_agents.mjs

@@ -443,7 +443,7 @@ test('PAGE: in the hall family, with no prototype key', () => {
   assert.deepEqual(sheets, ['style.css', 'oversight.css', 'speciality-tools.css', 'my-agents.css'],
     'rides the oversight archetype; the shared speciality sheet (task 1005052) before its own, so the page skin wins');
   const scripts = [...html.matchAll(/src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts.slice(0, 4), ['dom-utils', 'shell-trail', 'craft-mode', 'shell']); // dom-utils first: the shell escapes through it (task 1004876)
+  assert.deepEqual(scripts.slice(0, 5), ['dom-utils', 'shell-game', 'shell-trail', 'craft-mode', 'shell']); // dom-utils first: the shell escapes through it (task 1004876)
   for (const s of ['gov-living', 'gov-positions', 'my-agents', 'speciality-tools']) assert.ok(scripts.includes(s), `loads ${s}.js`);
   assert.doesNotMatch(html, /ma-key|data-proto|Prototype data/, 'nothing on the page is prototype data, so there is no key');
   assert.doesNotMatch(read('my-agents.js'), /governor-overlay/, 'and it reads no overlay');

package/tests/hall_street.mjs

@@ -490,7 +490,7 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['dom-utils', 'shell-trail', 'craft-mode', 'shell', 'hall-dialog', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
+  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['dom-utils', 'shell-game', 'shell-trail', 'craft-mode', 'shell', 'hall-dialog', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 

package/tests/nav_permission_atoms.mjs

@@ -102,7 +102,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // task 1005051: Roadmap left it (folded into Goals; /roadmap redirects).
 // task 1005070: the remembered nav (the rail paints before /me).
 // task 1005088: the sidebar mark is drawn by reference to the one brand mark.
-const SHELL_SHA = '2845bfedfaf7846f';
+const SHELL_SHA = 'e9c13c142bcd2a95';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);