@bongos/core 1.25.17 → 1.25.19

package/tests/landing_guide_hall.mjs

@@ -0,0 +1,364 @@
+// tests/landing_guide_hall.mjs — the start-a-project guide, plain (builders' hall) version,
+// and the switch between it and the game scene (task 1005276, goal 1000106).
+//
+// The two presentations share ONE conversation (assets/guide-core.js): the state machine,
+// the server's client rules and the doors are pinned by tests/landing_guide_scene.mjs. What
+// this file holds is the hall half and the switch, RUN under a small DOM stub:
+//   * the hall walk: open → chat → the first send held → the cap → the plan asked for and
+//     drawn under the talk → "Sign up and get started"; Escape hands focus back;
+//   * the fallback (a "form" start) and a retry error that gives the words back;
+//   * which one a door opens: the game unless this browser picked the plain one; the switch
+//     both ways mid-chat keeps the same chat (no second start) and is remembered;
+//   * the switch is offered only when the other presentation is on the page;
+//   * the markup and the sheet: hidden labelled dialog, the honeypot out of the tab order,
+//     the core loaded first, tokens only (no typed colour, size, corner, shadow or breakpoint).
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8').replace(/\r\n/g, '\n');
+const CSS = fs.readFileSync(path.join(LANDING, 'assets', 'guide-hall.css'), 'utf8').replace(/\r\n/g, '\n');
+const HALL_SRC = fs.readFileSync(path.join(LANDING, 'assets', 'guide-hall.js'), 'utf8');
+const Core = require(path.join(LANDING, 'assets', 'guide-core.js'));
+const Scene = require(path.join(LANDING, 'assets', 'guide-scene.js'));
+const Hall = require(path.join(LANDING, 'assets', 'guide-hall.js'));
+
+// ── a small DOM: the two dialogs, each with its named parts ───────────────────────
+const GAME_PARTS = ['log', 'err', 'form', 'text', 'website', 'send', 'end', 'go', 'left', 'segs', 'plan-body', 'plan-toggle', 'plan-close', 'close', 'skip', 'make-plan', 'plan-again', 'saved', 'switch'];
+const HALL_PARTS = ['log', 'err', 'form', 'text', 'website', 'send', 'end', 'go', 'left', 'body', 'plan', 'plan-body', 'saved', 'close', 'make-plan', 'plan-again', 'switch'];
+
+function makeDom({ game = true, hall = true } = {}) {
+  const listeners = new Map();
+  const on = (target) => (type, fn) => { if (!listeners.has(target)) listeners.set(target, {}); (listeners.get(target)[type] ||= []).push(fn); };
+  const fire = (target, type, ev) => ((listeners.get(target) || {})[type] || []).forEach((fn) => fn(ev));
+  const doc = { activeElement: null };
+  function node(tag = 'div') {
+    const n = {
+      tagName: tag.toUpperCase(), children: [], className: '', textContent: '', hidden: false, disabled: false, value: '', maxLength: 0, attrs: {}, scrollTop: 0, scrollHeight: 0, offsetTop: 0, offsetParent: {},
+      get firstChild() { return this.children[0] || null; },
+      appendChild(c) { this.children.push(c); return c; },
+      removeChild(c) { this.children.splice(this.children.indexOf(c), 1); return c; },
+      setAttribute(k, v) { this.attrs[k] = String(v); }, getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; },
+      removeAttribute(k) { delete this.attrs[k]; },
+      classList: { set: new Set(), add(c) { this.set.add(c); }, remove(c) { this.set.delete(c); }, toggle(c, v) { if (v) this.set.add(c); else this.set.delete(c); }, contains(c) { return this.set.has(c); } },
+      focus() { doc.activeElement = n; },
+      querySelectorAll() { return []; },
+      querySelector() { return null; },
+    };
+    n.addEventListener = on(n);
+    Object.defineProperty(n, 'innerHTML', { set() { throw new Error('innerHTML is not allowed'); } });
+    return n;
+  }
+  function dialog(attr, names) {
+    const parts = {};
+    names.forEach((k) => { parts[k] = node(); });
+    const root = node();
+    root.hidden = true;
+    root.querySelector = (sel) => {
+      const m = sel.match(new RegExp('^\\[' + attr + '="([^"]+)"\\]$'));
+      return m ? parts[m[1]] || null : null;
+    };
+    return { root, parts };
+  }
+  const g = game ? dialog('data-gd', GAME_PARTS) : null;
+  if (g) g.parts['plan-toggle'].offsetParent = null;   // desktop: the plan stands beside the talk
+  const h = hall ? dialog('data-gh', HALL_PARTS) : null;
+  Object.assign(doc, {
+    documentElement: node('html'),
+    head: node('head'),
+    getElementById: (id) => (id === 'guide' && g ? g.root : id === 'guideHall' && h ? h.root : null),
+    createElement: (t) => node(t),
+    querySelector: () => null,
+  });
+  doc.addEventListener = on(doc);
+  return { doc, game: g, hall: h, fire, node };
+}
+
+function makeWin(mods, routes) {
+  const calls = [];
+  const timers = [];
+  const win = {
+    __MODULES__: mods,
+    localStorage: { data: {}, getItem(k) { return k in this.data ? this.data[k] : null; }, setItem(k, v) { this.data[k] = String(v); }, removeItem(k) { delete this.data[k]; } },
+    setTimeout: (fn, ms) => { timers.push({ fn, ms }); },
+    fetch: (url, opts = {}) => {
+      calls.push({ url, method: opts.method || 'GET', body: opts.body ? JSON.parse(opts.body) : null, headers: opts.headers || {} });
+      const r = routes(url, opts);
+      return Promise.resolve({ status: r.status, json: () => Promise.resolve(r.body) });
+    },
+  };
+  return { win, calls, timers };
+}
+const ON = { enabled: { 'front-door-guide': true } };
+const tick = () => new Promise((r) => setImmediate(r));
+const settle = async (n = 4) => { for (let i = 0; i < n; i++) await tick(); };
+function click(dom, door) {
+  let prevented = false;
+  const ev = { target: { closest: (sel) => (sel === '[data-guide-door]' ? door : null) }, button: 0, preventDefault() { prevented = true; }, get defaultPrevented() { return prevented; } };
+  dom.fire(dom.doc, 'click', ev);
+  return prevented;
+}
+// boot both, in the page's script order (the core is required by each)
+function bootAll(win, dom) { Scene.boot(win, dom.doc); Hall.boot(win, dom.doc); }
+
+const planAnswer = {
+  ok: true, mode: 'plan', message: 'Here is your plan.', next: { action: 'sign_up', label: 'Sign up and get started' }, saved: { message: 'Saved.' },
+  conversation: { messages_used: 2, messages_left: 0 },
+  plan: { summary: 'A booking site for a dance school.', how_it_works: ['Students pick a class'], steps: [{ title: 'Sign up', detail: 'Make your account' }], modules: [], needs: [], open_questions: ['Payments?'], cost_and_time: 'Cost and time depend on you.' },
+};
+function chatRoutes(over = {}) {
+  let left = 2;
+  return (url, opts) => {
+    const m = (opts.method || 'GET') + ' ' + url;
+    if (over[m]) return over[m](opts);
+    if (url.endsWith('/status')) return { status: 200, body: { ok: true, mode: 'chat', limits: { max_messages: 2, max_message_chars: 1000 } } };
+    if (m === 'POST /api/bongos/front-door-guide/conversations') return { status: 201, body: { ok: true, mode: 'chat', greeting: 'Hi!', conversation: { id: '9', token: 'tk', messages_used: 0, messages_left: 2, max_message_chars: 1000 }, saved: { message: 'This chat is saved on this device.', keep_days: 30 } } };
+    if (url.endsWith('/plan')) return { status: 200, body: planAnswer };
+    left -= 1;
+    return left > 0
+      ? { status: 200, body: { ok: true, mode: 'chat', reply: { text: 'Tell me more.' }, conversation: { messages_used: 1, messages_left: left } } }
+      : { status: 200, body: { ok: true, mode: 'ended', reason: 'message_cap', next_step: 'plan', message: 'That is all.', reply: { text: 'Thanks.' }, conversation: { messages_used: 2, messages_left: 0 } } };
+  };
+}
+const texts = (list) => list.children.map((li) => li.children.map((c) => c.textContent).join(' | '));
+
+// ── module off ─────────────────────────────────────────────────────────────────────
+test('module off: the hall reads nothing and takes no door', async () => {
+  const dom = makeDom({ game: false });
+  const { win, calls } = makeWin({ enabled: { 'front-door-guide': false } }, () => ({ status: 500, body: {} }));
+  Hall.boot(win, dom.doc);
+  await tick();
+  assert.equal(calls.length, 0);
+  assert.equal(click(dom, dom.node('a')), false);
+  assert.equal(dom.hall.root.hidden, true);
+});
+
+// ── the hall walk ──────────────────────────────────────────────────────────────────
+test('the hall walk: open, the first send held, the cap asks for the plan, the plan under the talk, sign up', async () => {
+  const dom = makeDom();
+  const { win, calls, timers } = makeWin(ON, chatRoutes());
+  win.localStorage.data[Core.VIEW_KEY] = 'hall';
+  bootAll(win, dom);
+  await tick();
+  const door = dom.node('a');
+  assert.equal(click(dom, door), true, 'the door is taken');
+  const P = dom.hall.parts;
+  assert.equal(dom.hall.root.hidden, false, 'this browser picked the plain one');
+  assert.equal(dom.game.root.hidden, true, 'and the game stays down');
+  assert.ok(dom.doc.documentElement.classList.contains('gd-open'), 'the page under it does not scroll');
+  assert.deepEqual(texts(P.log), ['Guide | Your guide is thinking…'], 'the waiting line is words');
+  await settle();
+  assert.equal(dom.hall.root.getAttribute('data-phase'), 'chat');
+  assert.deepEqual(calls[1].body, { website: '' }, 'the hidden field is sent as it stands');
+  assert.deepEqual(JSON.parse(win.localStorage.data[Core.STORE_KEY]), { id: '9', token: 'tk' }, 'the same chat key the hand-off reads');
+  assert.deepEqual(texts(P.log), ['Guide | Hi!']);
+  assert.equal(P.left.textContent, '2 of 2 messages left');
+  assert.equal(P.saved.textContent, 'This chat is saved on this device.');
+  assert.equal(P.plan.hidden, true, 'no plan section while talking');
+  assert.equal(P['make-plan'].hidden, true);
+  assert.equal(dom.doc.activeElement, P.text, 'focus lands in the box');
+  assert.equal(P.switch.hidden, false, 'the game is offered');
+
+  P.text.value = 'A booking site';
+  dom.fire(P.form, 'submit', { preventDefault() {} });
+  assert.equal(P.text.value, '');
+  assert.equal(dom.hall.root.getAttribute('data-phase'), 'sending');
+  assert.ok(timers[0].ms > 1000, 'the first message waits out the bot check');
+  timers.shift().fn();
+  await settle();
+  assert.deepEqual(calls[2].body, { token: 'tk', text: 'A booking site', website: '' });
+  assert.equal(P.left.textContent, '1 of 2 messages left');
+  assert.equal(P['make-plan'].hidden, false, 'after a message the plan can be asked for early');
+
+  // Enter sends too
+  P.text.value = 'Students book';
+  dom.fire(P.text, 'keydown', { key: 'Enter', shiftKey: false, preventDefault() {} });
+  assert.equal(timers[0].ms, 0, 'later messages never wait');
+  timers.shift().fn();
+  await settle(6);
+  assert.ok(calls.some((c) => c.url.endsWith('/conversations/9/plan')), 'POST …/plan once the cap ended the chat');
+  assert.equal(dom.hall.root.getAttribute('data-phase'), 'ended');
+  assert.equal(P.form.hidden, true);
+  assert.equal(P.end.hidden, false);
+  assert.equal(P.plan.hidden, false, 'the plan sits under the talk');
+  const plan = P['plan-body'].children.map((c) => c.textContent);
+  assert.equal(plan[0], 'A booking site for a dance school.');
+  assert.ok(plan.includes('How it works') && plan.includes('Steps') && plan.includes('Still to decide'));
+  assert.equal(plan.at(-1), 'Cost and time depend on you.');
+  assert.equal(P.left.textContent, 'No messages left');
+  assert.equal(P.go.textContent, 'Sign up and get started');
+  assert.equal(P['plan-again'].hidden, true);
+  assert.equal(dom.doc.activeElement, P.go, 'focus moves to the way on');
+
+  dom.fire(dom.hall.root, 'keydown', { key: 'Escape', preventDefault() {} });
+  assert.equal(dom.hall.root.hidden, true);
+  assert.equal(dom.doc.activeElement, door, 'focus goes back to the door');
+  assert.ok(!dom.doc.documentElement.classList.contains('gd-open'));
+});
+
+test('the hall: a "form" start is the plain door, never an error', async () => {
+  const dom = makeDom();
+  const { win } = makeWin(ON, chatRoutes({ 'POST /api/bongos/front-door-guide/conversations': () => ({ status: 200, body: { ok: true, mode: 'form', reason: 'daily_budget', message: 'Our guide is busy today.' } }) }));
+  win.localStorage.data[Core.VIEW_KEY] = 'hall';
+  bootAll(win, dom);
+  await tick();
+  click(dom, dom.node('a'));
+  await settle();
+  const P = dom.hall.parts;
+  assert.equal(dom.hall.root.getAttribute('data-phase'), 'fallback');
+  assert.deepEqual(texts(P.log), ['Guide | Our guide is busy today.']);
+  assert.equal(P.err.hidden, true);
+  assert.equal(P.form.hidden, true);
+  assert.equal(P.go.textContent, 'Start a project');
+  assert.equal(P.left.hidden, true, 'no count on the fallback');
+  assert.equal(P.saved.hidden, true);
+});
+
+test('the hall: too long says so and gives the words back; an empty box says so and sends nothing', async () => {
+  const dom = makeDom();
+  const { win, calls, timers } = makeWin(ON, chatRoutes({ 'POST /api/bongos/front-door-guide/conversations/9/messages': () => ({ status: 400, body: { ok: false, error: 'too_long', max_message_chars: 500 } }) }));
+  win.localStorage.data[Core.VIEW_KEY] = 'hall';
+  bootAll(win, dom);
+  await tick();
+  click(dom, dom.node('a'));
+  await settle();
+  const P = dom.hall.parts;
+  P.text.value = '   ';
+  dom.fire(P.form, 'submit', { preventDefault() {} });
+  assert.equal(P.err.textContent, Core.COPY.empty);
+  assert.equal(timers.length, 0, 'nothing sent');
+  P.text.value = 'my long words';
+  dom.fire(P.form, 'submit', { preventDefault() {} });
+  timers.shift().fn();
+  await settle();
+  assert.equal(P.err.hidden, false);
+  assert.equal(P.err.textContent, 'That is too long. Keep it under 500 characters.');
+  assert.equal(P.text.value, 'my long words', 'the words come back');
+  assert.equal(P.text.maxLength, 500);
+  assert.equal(calls.filter((c) => c.url.endsWith('/messages')).length, 1);
+});
+
+// ── which one, and the switch ──────────────────────────────────────────────────────
+test('a door opens the game when this browser has not picked; the switch carries the chat both ways and is remembered', async () => {
+  const dom = makeDom();
+  const { win, calls, timers } = makeWin(ON, chatRoutes());
+  bootAll(win, dom);
+  await tick();
+  click(dom, dom.node('a'));
+  await settle();
+  assert.equal(dom.game.root.hidden, false, 'the game by default');
+  assert.equal(dom.hall.root.hidden, true);
+  assert.equal(dom.game.parts.switch.hidden, false, '"Use the simple version" is there');
+
+  dom.game.parts.text.value = 'A booking site';
+  dom.fire(dom.game.parts.form, 'submit', { preventDefault() {} });
+  timers.shift().fn();
+  await settle();
+
+  dom.fire(dom.game.parts.switch, 'click', {});
+  assert.equal(dom.game.root.hidden, true);
+  assert.equal(dom.hall.root.hidden, false);
+  assert.ok(dom.doc.documentElement.classList.contains('gd-open'));
+  assert.equal(win.localStorage.data[Core.VIEW_KEY], 'hall', 'the pick is kept on this browser');
+  assert.deepEqual(texts(dom.hall.parts.log), ['Guide | Hi!', 'You | A booking site', 'Guide | Tell me more.'], 'the same chat');
+  assert.equal(dom.hall.parts.left.textContent, '1 of 2 messages left');
+  assert.equal(dom.doc.activeElement, dom.hall.parts.text);
+  assert.equal(calls.filter((c) => c.method === 'POST' && c.url.endsWith('/conversations')).length, 1, 'never a second chat');
+
+  // keep talking in the plain one: the same conversation id
+  dom.hall.parts.text.value = 'Students book';
+  dom.fire(dom.hall.parts.form, 'submit', { preventDefault() {} });
+  timers.shift().fn();
+  await settle(6);
+  assert.equal(calls.filter((c) => c.url.endsWith('/conversations/9/messages')).length, 2);
+  assert.equal(dom.hall.root.getAttribute('data-phase'), 'ended');
+
+  // and back to the game, plan and all
+  dom.fire(dom.hall.parts.switch, 'click', {});
+  assert.equal(dom.hall.root.hidden, true);
+  assert.equal(dom.game.root.hidden, false);
+  assert.equal(win.localStorage.data[Core.VIEW_KEY], 'game');
+  assert.equal(dom.game.root.getAttribute('data-phase'), 'ended');
+  assert.equal(dom.game.parts['plan-body'].children[0].textContent, 'A booking site for a dance school.');
+
+  // closed and opened again: the last pick
+  dom.fire(dom.game.root, 'keydown', { key: 'Escape', preventDefault() {} });
+  dom.fire(dom.game.parts.switch, 'click', {});            // nothing open: the press opens nothing
+  assert.equal(dom.hall.root.hidden, true);
+  assert.equal(win.localStorage.data[Core.VIEW_KEY], 'game');
+  win.localStorage.data[Core.VIEW_KEY] = 'hall';
+  click(dom, dom.node('a'));
+  assert.equal(dom.hall.root.hidden, false);
+  assert.equal(dom.game.root.hidden, true);
+});
+
+test('the switch is offered only when the other one is on the page', async () => {
+  const gameOnly = makeDom({ hall: false });
+  const a = makeWin(ON, chatRoutes());
+  Scene.boot(a.win, gameOnly.doc);
+  await tick();
+  click(gameOnly, gameOnly.node('a'));
+  assert.equal(gameOnly.game.parts.switch.hidden, true);
+
+  const hallOnly = makeDom({ game: false });
+  const b = makeWin(ON, chatRoutes());
+  Hall.boot(b.win, hallOnly.doc);
+  await tick();
+  click(hallOnly, hallOnly.node('a'));
+  assert.equal(hallOnly.hall.root.hidden, false, 'with no game the plain one opens');
+  assert.equal(hallOnly.hall.parts.switch.hidden, true);
+});
+
+test('a stored pick that is not a presentation falls back to the game', async () => {
+  const dom = makeDom();
+  const { win } = makeWin(ON, chatRoutes());
+  win.localStorage.data[Core.VIEW_KEY] = 'bogus';
+  bootAll(win, dom);
+  await tick();
+  click(dom, dom.node('a'));
+  assert.equal(dom.game.root.hidden, false);
+});
+
+// ── markup and sheet ───────────────────────────────────────────────────────────────
+test('the plain dialog is markup, hidden, labelled, with the honeypot out of the tab order and the same closing action', () => {
+  assert.match(HTML, /<div class="gh" id="guideHall" role="dialog" aria-modal="true" aria-labelledby="ghTitle" hidden>/);
+  assert.match(HTML, /<input class="gh__hp" type="text" name="website" data-gh="website" tabindex="-1" autocomplete="off" aria-hidden="true">/);
+  assert.match(HTML, /<label class="gh__label" for="ghText">Your message<\/label>/);
+  assert.match(HTML, /<a class="door door--go" data-gh="go" href="\/projects\?view=new">Sign up and get started<\/a>/);
+  assert.match(HTML, /<button type="button" class="gh__link" data-gh="switch">Use the game version<\/button>/);
+  assert.match(HTML, /<button type="button" class="gd__switch" data-gd="switch" hidden>Use the simple version<\/button>/);
+  assert.match(HTML, /<script src="\/assets\/guide-core\.js"><\/script>\n<script src="\/assets\/guide-scene\.js"><\/script>\n<script src="\/assets\/guide-hall\.js"><\/script>/);
+  assert.match(HTML, /<link rel="stylesheet" href="\/assets\/guide-hall\.css">/);
+  assert.ok(HTML.indexOf('/assets/world.css') < HTML.indexOf('/assets/guide-hall.css'));
+});
+
+test('the hall script writes no innerHTML and asks the server nothing itself', () => {
+  const code = HALL_SRC.replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.doesNotMatch(code, /innerHTML/);
+  assert.doesNotMatch(code, /fetch\(|localStorage|sessionStorage/, 'the routes and the storage are the core\'s');
+});
+
+test('the sheet: tokens only, no :root, no breakpoint, no !important, no motion', () => {
+  const code = CSS.replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.doesNotMatch(code, /#[0-9a-f]{3,8}\b/i, 'no hex colour');
+  assert.doesNotMatch(code, /\brgba?\((?!0, 0, 0,)/, 'the only literal is black with alpha (the scrim)');
+  assert.doesNotMatch(code, /font-size:\s*\d/, 'type from the scale');
+  assert.doesNotMatch(code, /border-radius:\s*\d/, 'corners from the scale');
+  assert.doesNotMatch(code, /:root|@media|!important|animation|transition/);
+});
+
+test('every control in the plain dialog clears the 24px floor', () => {
+  for (const [sel, min] of [['.gh__x', /width: 40px; height: 40px/], ['.gh__link', /min-height: 24px/]]) {
+    const rule = CSS.slice(CSS.indexOf(sel + ' {'));
+    assert.match(rule.slice(0, rule.indexOf('}')), min, sel);
+  }
+  // the presses are the landing's own door pills (48px, index.html .door)
+  assert.match(HTML, /\.door\{display:inline-flex;align-items:center;justify-content:center;min-height:48px;/);
+});

package/tests/landing_guide_scene.mjs

@@ -31,6 +31,8 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8').replace(/\r\n/g, '\n');
 const CSS = fs.readFileSync(path.join(LANDING, 'assets', 'guide-scene.css'), 'utf8').replace(/\r\n/g, '\n');
 const JS_SRC = fs.readFileSync(path.join(LANDING, 'assets', 'guide-scene.js'), 'utf8');
+// the conversation's own half (the routes, the storage) is shared with the plain twin since task 1005276
+const CORE_SRC = fs.readFileSync(path.join(LANDING, 'assets', 'guide-core.js'), 'utf8');
 const G = require(path.join(LANDING, 'assets', 'guide-scene.js'));
 
 const chatStart = (over = {}) => ({
@@ -462,7 +464,7 @@ test('the scene is markup, hidden, a labelled modal dialog, with the honeypot ou
   assert.match(HTML, /<button type="button" class="gd__more" data-gd="make-plan" hidden>Make my plan<\/button>/);
   assert.match(HTML, /<button type="button" class="gd__more" data-gd="plan-again" hidden>Make my plan<\/button>/);
   assert.match(HTML, /<p class="gd__saved" data-gd="saved" hidden><\/p>/);
-  assert.match(HTML, /<script src="\/assets\/guide-scene\.js"><\/script>/);
+  assert.match(HTML, /<script src="\/assets\/guide-core\.js"><\/script>\n<script src="\/assets\/guide-scene\.js"><\/script>/, 'the shared core loads first');
   assert.match(HTML, /<link rel="stylesheet" href="\/assets\/guide-scene\.css">/);
   // the guide is the Patron sprite the hall already serves, not a second drawing
   assert.match(HTML, /src="\/modules\/hall-ui\/public\/characters\/patron\.png"/);
@@ -474,11 +476,12 @@ test('a signed-in visitor keeps the plain doors: the /me read takes the hook off
 });
 
 test('the script writes no innerHTML and talks only to the guide routes', () => {
-  assert.doesNotMatch(JS_SRC.replace(/\/\*[\s\S]*?\*\//g, ''), /innerHTML/);
-  const urls = [...JS_SRC.matchAll(/API \+ '([^']+)'/g)].map((m) => m[1]);
+  for (const src of [JS_SRC, CORE_SRC]) assert.doesNotMatch(src.replace(/\/\*[\s\S]*?\*\//g, ''), /innerHTML/);
+  const urls = [...CORE_SRC.matchAll(/API \+ '([^']+)'/g)].map((m) => m[1]);
   assert.deepEqual([...new Set(urls)].sort(), ['/conversations', '/conversations/', '/status']);
-  assert.match(JS_SRC, /convUrl\('\/plan'\)/, 'the plan route');
-  assert.doesNotMatch(JS_SRC, /sessionStorage/, 'the chat is kept in local storage, as the server\'s contract says');
+  assert.doesNotMatch(JS_SRC, /fetch\(/, 'the scene asks the server nothing itself: the core does');
+  assert.match(CORE_SRC, /convUrl\('\/plan'\)/, 'the plan route');
+  assert.doesNotMatch(CORE_SRC + JS_SRC, /sessionStorage/, 'the chat is kept in local storage, as the server\'s contract says');
   assert.equal(G.API, '/api/bongos/front-door-guide');
 });
 

package/tests/module_api.mjs

@@ -55,6 +55,7 @@ const PUBLISHED_SURFACE = [
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'readApplicantViewFromHub', // added by task 1002304 (ADR 0365 D5): the same NARROW hub read as readApplicantProfileFromHub, answering { profile, guild } so the reviewer queue can group a guild's applicants. The guild rides only beside a profile, and the older port is kept so a module on it reads exactly what it did
+  'readAppStatusFromHub', // added by task 1004571: where THIS project's app runs, read from the hub for the options menu's app-host panel. The same NARROW-port reason as readApplicantProfileFromHub: it carries this instance's hub client secret, so it takes no argument and a module can neither widen nor re-address it
   'notifyHubOfInvite', // added by task 1002818 (ADR 0353): tell the hub about one of THIS project's invites (or its rescind) so the invitee sees it in My Projects. The same NARROW-port reason as readApplicantProfileFromHub: the call carries this instance's hub client secret, so a module passes one login and one direction and can neither widen nor re-address it
   'inviteExpiry', // added by task 1002969 (ADR 0356): the ONE read-time definition of when a recruit invite's door closes. The sign-in gate reads it in core; the onboarding queues and the hub's notice list are modules, so without the doorway each would restate the 30 days and the predicate, and two copies can close a door on different days
   'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience

package/tests/module_loader.mjs

@@ -278,7 +278,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'front-door-guide', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'app-host', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'front-door-guide', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/npm_release_where.mjs

@@ -290,8 +290,14 @@ test('the module declares the task page section and ships its widget; the seam g
   assert.deepEqual(manifest.contributes.uiSections, ['task-where']);
   assert.ok(manifest.contributes.routes.includes('task-where'));
   assert.ok(fs.existsSync(path.join(ROOT, 'modules/npm-release/public/task-widget.js')));
-  const guard = fs.readFileSync(path.join(ROOT, 'scripts/bongos/seam-wiring-guard.js'), 'utf8');
-  assert.match(guard, /alternates: \(dir\) => \[path\.join\(dir, 'public', 'task-widget\.js'\)\]/);
+  // Ask the guard itself (task 1004571 converted this from a source-text match): a module
+  // whose only widget is task-widget.js counts as wired, and with no widget it does not.
+  const { scanSeamWiring } = require('../scripts/bongos/seam-wiring-guard.js');
+  const dir = path.join(ROOT, 'modules/npm-release');
+  const only = (file) => ({ exists: (p) => p === path.join(dir, 'public', file) });
+  const mod = [{ key: 'npm-release', dir, manifest: { contributes: { uiSections: ['task-where'] } } }];
+  assert.deepEqual(scanSeamWiring(mod, only('task-widget.js')).findings, []);
+  assert.equal(scanSeamWiring(mod, { exists: () => false }).findings.length, 1);
 });
 
 test('the server injects task widgets just before task.js, and names no module doing it', () => {
@@ -302,8 +308,12 @@ test('the server injects task widgets just before task.js, and names no module d
   assert.ok(out.indexOf('/builders/md-reader.js') < out.indexOf('task-widget.js'));
   assert.match(out, /<script src="\/modules\/npm-release\/public\/task-widget\.js" defer><\/script>/);
   assert.equal(injectModuleHallWidgets(page, [], 'task'), page, 'no module, no change');
-  const index = '<script src="/builders/builders.js?v=1"></script>';
+  // The index's builders.js is deferred, so its widgets are too (unchanged). Since task
+  // 1004571 a widget loads the way its consumer does, so a plain consumer gets a plain one.
+  const index = '<script src="/builders/builders.js?v=1" defer></script>';
   assert.match(injectModuleHallWidgets(index, [{ key: 'x', src: '/m.js' }]), /^<script src="\/m\.js" defer><\/script><script src="\/builders\/builders\.js/, 'the index injection is unchanged');
+  const plain = '<script src="/builders/settings.js?v=1"></script>';
+  assert.match(injectModuleHallWidgets(plain, [{ key: 'x', src: '/m.js' }], 'settings'), /^<script src="\/m\.js"><\/script><script src="\/builders\/settings\.js/);
   const si = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
   assert.match(si, /hallWidgetScripts\(\{ isEnabled: isModuleEnabled, file: 'task-widget\.js' \}\),\s*\n\s*'task',/);
 });