@nanobpm/nano-workforce 0.138.3 → 0.139.1

package/test/delivery-graphs-library-embed.test.ts

@@ -0,0 +1,156 @@
+// Contract guard for the reusable delivery-graph LIBRARY App-View (issue #523, epic #519 S4).
+//
+// The Library surface (pages/delivery-graphs/library.*) LISTS saved library entries (the `listLibrary`
+// door) and, per row, offers Reuse (load the saved graph back into the compose textarea `#dg-json`) and
+// Delete (the `deleteLibraryEntry` door). Reuse crosses the App-View iframe boundary: it drives the
+// compose mount's NEW inbound fill seam over the shared `deliveryGraph.compose.fill` host-bridge
+// message. Plus a Save-to-library affordance on the staged App-View (save-from-digest) and a
+// Save-to-library row action on the dispatched/history grid. This test pins that wiring so it cannot
+// silently regress: the sidecars mount the same module, the door defaults are module-anchored off
+// import.meta.url (the #279/#467/#536 App-View resolution class), Reuse posts the ONE shared fill message, Delete hits the per-entry door,
+// the compose mount adds the inbound fill listener, and the page carries the new Library App-View node.
+import { test } from "node:test";
+import { assert, assertEquals, assertStringIncludes } from "#test-assert";
+import { readFileSync } from "node:fs";
+import { DG_COMPOSE_FILL_MESSAGE } from "../pages/delivery-graphs/mount.js";
+
+const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
+const DIR = `${ROOT}pages/delivery-graphs`;
+const LIBRARY_JS = readFileSync(`${DIR}/library.mount.js`, "utf8");
+const COMPOSE_JS = readFileSync(`${DIR}/mount.js`, "utf8");
+const STAGED_JS = readFileSync(`${DIR}/staged.mount.js`, "utf8");
+const EMBED_HTML = readFileSync(`${DIR}/library-embed.html`, "utf8");
+const STANDALONE_HTML = readFileSync(`${DIR}/library-standalone.html`, "utf8");
+const PAGE_JSON = readFileSync(`${ROOT}pages/delivery-graphs.page.json`, "utf8");
+
+// Pull a MODULE-ANCHORED default spec out of `const <name> = config.<field> ?? <CONST>;` where the
+// CONST is declared `const <CONST> = new URL("<spec>", import.meta.url).href;` (#467/#536).
+function defaultSpec(src: string, name: string): string {
+  const m = src.match(new RegExp(`${name}\\s*=\\s*config\\.\\w+\\s*\\?\\?\\s*(\\w+);`));
+  assert(m, `mount must default ${name} from config with a fallback constant`);
+  const constM = src.match(
+    new RegExp(`const ${m![1]}\\s*=\\s*new URL\\(\\s*"([^"]*)"\\s*,\\s*import\\.meta\\.url\\s*\\)\\s*\\.href`),
+  );
+  assert(
+    constM,
+    `mount must default ${m![1]} to new URL("<spec>", import.meta.url) so the door is anchored to the ` +
+      `module's own served location, not the document base (#467/#536)`,
+  );
+  return constM![1];
+}
+test("#523: the Library App-View mounts the same module standalone and embedded", () => {
+  assert(/mountDeliveryGraphLibrary/.test(LIBRARY_JS), "library.mount.js must export mountDeliveryGraphLibrary");
+  for (const [file, html] of [["library-embed.html", EMBED_HTML], ["library-standalone.html", STANDALONE_HTML]] as const) {
+    assert(
+      /import \{ mountDeliveryGraphLibrary \} from "\.\/library\.mount\.js"/.test(html),
+      `${file} must import mountDeliveryGraphLibrary from ./library.mount.js`,
+    );
+    assert(/mountDeliveryGraphLibrary\(/.test(html), `${file} must call mountDeliveryGraphLibrary`);
+  }
+});
+
+test("#523: the page binds the Library node to the library App-View sidecars", () => {
+  const page = JSON.parse(PAGE_JSON) as { nodes: Array<Record<string, any>> };
+  const library = page.nodes.find((n) => n.id === "delivery-graphs-library");
+  assert(library, "the page must carry the delivery-graphs-library node");
+  assert(library?.type === "appView", "delivery-graphs-library must be an appView (#523)");
+  assert(library?.props?.embed === "./delivery-graphs/library-embed.html", "it embeds the library embed sidecar");
+  assert(library?.props?.standalone === "./delivery-graphs/library-standalone.html", "it has the library standalone sidecar");
+});
+
+test("#523/#467/#536: the Library list door default is module-anchored and hits the listLibrary door", () => {
+  const spec = defaultSpec(LIBRARY_JS, "libraryUrl");
+  assert(spec.endsWith("delivery-graph/library"), `libraryUrl default "${spec}" must hit the listLibrary door`);
+  assert(!spec.startsWith("/"), `default libraryUrl "${spec}" must not be absolute (App-View #279 resolution class)`);
+  assert(spec.startsWith("../"), `default libraryUrl "${spec}" must step up out of /delivery-graphs/ (module-anchored, #467/#536)`);
+  // The list read consumes the door's `entries` array (one row per saved entry).
+  assert(/body\.entries/.test(LIBRARY_JS), "library.mount.js must render one row per `entries[]` item the listLibrary door returns");
+});
+
+test("#523: Reuse drives the compose fill seam over the shared host-bridge message", () => {
+  // Reuse loads the saved graph back into the SEPARATE compose App-View, so it posts the ONE shared
+  // fill message (its type imported from ./mount.js, never re-declared) UP over the App-View boundary.
+  assert(
+    /import \{ DG_COMPOSE_FILL_MESSAGE \} from "\.\/mount\.js"/.test(LIBRARY_JS),
+    "library.mount.js must import DG_COMPOSE_FILL_MESSAGE from ./mount.js (the ONE source of truth for the fill message type)",
+  );
+  assert(/data-reuse=/.test(LIBRARY_JS), "library.mount.js must render a per-row Reuse affordance carrying the entry id");
+  assert(/postMessage\(/.test(LIBRARY_JS), "Reuse must post the fill message across the App-View boundary");
+  assert(/type:\s*DG_COMPOSE_FILL_MESSAGE/.test(LIBRARY_JS), "the Reuse message must carry the shared DG_COMPOSE_FILL_MESSAGE type");
+  assert(/graphJson:\s*entry\.graph/.test(LIBRARY_JS), "the Reuse message must carry the saved entry's graph JSON");
+});
+
+test("#523: Delete hits the per-entry deleteLibraryEntry door", () => {
+  assert(/data-delete=/.test(LIBRARY_JS), "library.mount.js must render a per-row Delete affordance carrying the entry id");
+  // The delete door is the per-entry path under the list door: DELETE .../delivery-graph/library/<id>.
+  assert(/method:\s*"DELETE"/.test(LIBRARY_JS), "Delete must issue an HTTP DELETE to the deleteLibraryEntry door");
+  assert(/encodeURIComponent\(/.test(LIBRARY_JS), "the delete path must URL-encode the entry id it appends to the library door");
+});
+
+test("#523: the compose mount exposes an INBOUND reuse-fill seam (message → #dg-json)", () => {
+  // The compose mount previously had NO inbound prefill — its #dg-json was set only by Load-example /
+  // typing. S4 adds a same-origin message listener that fills #dg-json through a single fillComposer seam.
+  assert(/export const DG_COMPOSE_FILL_MESSAGE\s*=/.test(COMPOSE_JS), "mount.js must export the DG_COMPOSE_FILL_MESSAGE fill-message type");
+  // Pin the actual wire value the imported const carries: this is the cross-App-View host-bridge
+  // message type the Library/compose sidecars agree on, so a silent change to the string is a
+  // breaking wire-contract change and the compose mount must declare exactly that literal.
+  assertEquals(DG_COMPOSE_FILL_MESSAGE, "nano-delivery-graph-compose-fill", "the shared fill-message type must be the pinned wire-contract string");
+  assertStringIncludes(COMPOSE_JS, `"${DG_COMPOSE_FILL_MESSAGE}"`, "mount.js must declare the fill-message type as the pinned string literal");
+  assert(/function fillComposer\(/.test(COMPOSE_JS), "mount.js must define the single fillComposer seam every fill routes through");
+  assert(/addEventListener\("message"/.test(COMPOSE_JS), "mount.js must register an inbound `message` listener for the fill seam");
+  assert(/data\.type !== DG_COMPOSE_FILL_MESSAGE/.test(COMPOSE_JS), "the listener must gate on the shared fill-message type");
+  assert(/jsonEl\.value = graphJson/.test(COMPOSE_JS), "fillComposer must load the graph JSON into the #dg-json textarea");
+  // Same-origin guard: a foreign origin must not be able to drive the fill.
+  assert(/ev\.origin !== window\.location\.origin/.test(COMPOSE_JS), "the fill listener must reject cross-origin messages");
+});
+
+test("#523: Save-to-library on the staged App-View posts save-from-digest", () => {
+  const spec = defaultSpec(STAGED_JS, "saveLibraryUrl");
+  assert(spec.endsWith("actions/delivery-graph/library/save"), `saveLibraryUrl default "${spec}" must hit the saveToLibrary door`);
+  assert(!spec.startsWith("/"), `default saveLibraryUrl "${spec}" must not be absolute (App-View #279 resolution class)`);
+  assert(spec.startsWith("../"), `default saveLibraryUrl "${spec}" must step up out of /delivery-graphs/ (module-anchored, #467/#536)`);
+  assert(/data-save-library=/.test(STAGED_JS), "staged.mount.js must render a per-row Save-to-library affordance carrying the digest");
+  // Save-from-digest: it posts { name, digest } — it must NOT compile or stage a raw graph (the #460
+  // operator boundary the staged view enforces stays intact).
+  assert(/post\(saveLibraryUrl,\s*\{\s*name:[^}]*digest:/.test(STAGED_JS), "Save-to-library must POST { name, digest } (save-from-digest) to the save door");
+});
+
+test("#523: Save-to-library is offered on a dispatched/history grid row (save-from-dispatched)", () => {
+  const page = JSON.parse(PAGE_JSON) as { nodes: Array<Record<string, any>> };
+  const grid = page.nodes.find((n) => n.id === "delivery-graphs-inflight");
+  assert(grid, "the page must carry the delivery-graphs-inflight grid");
+  const action = (grid?.props?.rowActions ?? []).find((a: Record<string, any>) => a.label === "Save to library");
+  assert(action, "the in-flight grid must offer a `Save to library` row action");
+  assert(
+    action?.action?.path === "/app/api/actions/delivery-graph/library/save",
+    "the Save-to-library row action must post to the saveToLibrary door",
+  );
+  assert(
+    action?.action?.body?.digest === "{{row.digest}}" && action?.action?.body?.name === "{{row.title}}",
+    "the Save-to-library row action must save-from-digest, naming the entry from the run title",
+  );
+});
+test("#523: the x-hook-secret guard is gated on a same-origin door (no cross-origin secret exfil)", () => {
+  // A `?library=` / `?staged=` / `?preview=` override can point a door at a full `https://…` URL on a
+  // FOREIGN origin. The shared guard secret must NEVER ride along to an arbitrary host, so each mount
+  // attaches `x-hook-secret` only when the resolved door URL is same-origin.
+  for (const [name, src] of [
+    ["library.mount.js", LIBRARY_JS],
+    ["mount.js", COMPOSE_JS],
+    ["staged.mount.js", STAGED_JS],
+  ] as const) {
+    assert(/function isSameOrigin\(url\)/.test(src), `${name} must define an isSameOrigin(url) guard`);
+    assert(
+      /new URL\(url,\s*window\.location\.href\)\.origin === window\.location\.origin/.test(src),
+      `${name} isSameOrigin must compare the resolved URL origin against window.location.origin`,
+    );
+    assert(
+      /config\.hookSecret && isSameOrigin\(url\)\s*\?\s*\{\s*"x-hook-secret"/.test(src),
+      `${name} must attach x-hook-secret ONLY when hookSecret is set AND the door URL is same-origin`,
+    );
+    assert(
+      /headers:\s*headers\(url\)/.test(src),
+      `${name} must thread the request URL into headers(url) so the secret gate sees the target origin`,
+    );
+  }
+});

package/test/delivery-graphs-library-export.test.ts

@@ -0,0 +1,62 @@
+// Contract guard for the delivery-graph LIBRARY Export affordance (issue #525, epic #519 S6).
+//
+// Export is a purely client-side Blob download of a saved library entry's stored graph JSON as
+// `<name>.deliverygraph.json` — no backend door. It builds directly on the S4 Library App-View (#523,
+// `pages/delivery-graphs/library.mount.js`): each rendered library entry gains an Export button
+// alongside Reuse/Delete. This test pins BOTH halves so the affordance cannot silently regress:
+//   • a behavioural guard on the pure, DOM-free `buildDeliveryGraphExport()` helper — it "builds a
+//     download from the entry's graph JSON": the download contents are the entry's stored graph
+//     verbatim and the filename is the sanitised name + `.deliverygraph.json`; and
+//   • a source guard that the mount renders the per-row Export control and assembles the Blob download
+//     (createObjectURL → anchor.download → revokeObjectURL) from that helper.
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { readFileSync } from "node:fs";
+import { buildDeliveryGraphExport, DELIVERY_GRAPH_EXPORT_SUFFIX } from "../pages/delivery-graphs/library.mount.js";
+
+const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
+const LIBRARY_JS = readFileSync(`${ROOT}pages/delivery-graphs/library.mount.js`, "utf8");
+
+test("#525: the export filename suffix is the pinned .deliverygraph.json contract", () => {
+  assertEquals(DELIVERY_GRAPH_EXPORT_SUFFIX, ".deliverygraph.json");
+});
+
+test("#525: buildDeliveryGraphExport downloads the entry's stored graph JSON verbatim", () => {
+  const graph = '{"nodes":[{"id":"a"}],"edges":[]}';
+  const out = buildDeliveryGraphExport({ id: "lib-1", name: "Onboarding", graph });
+  // "builds a download from the entry's graph JSON": bytes are the stored graph, unmodified.
+  assertEquals(out.contents, graph, "export contents must be the entry's stored graph JSON, byte-for-byte");
+  assertEquals(out.mime, "application/json", "an exported delivery graph is application/json");
+  assertEquals(out.filename, `Onboarding${DELIVERY_GRAPH_EXPORT_SUFFIX}`, "filename is <name>.deliverygraph.json");
+});
+
+test("#525: the export filename sanitises unsafe characters in the entry name", () => {
+  const out = buildDeliveryGraphExport({ id: "lib-2", name: "My Graph / v2: final!", graph: "{}" });
+  assertEquals(out.filename, `My-Graph-v2-final${DELIVERY_GRAPH_EXPORT_SUFFIX}`);
+  // No path separators, and never a leading-dot hidden file.
+  assert(!out.filename.includes("/") && !out.filename.includes("\\"), "filename must carry no path separators");
+  assert(!out.filename.startsWith("."), "filename must not be a hidden dotfile");
+});
+
+test("#525: an unnamed entry falls back to a stable id-derived filename", () => {
+  const named = buildDeliveryGraphExport({ id: "lib-3", name: "   ", graph: "{}" });
+  assertEquals(named.filename, `delivery-graph-lib-3${DELIVERY_GRAPH_EXPORT_SUFFIX}`, "blank name falls back to the entry id");
+  const anon = buildDeliveryGraphExport({ graph: "{}" });
+  assertEquals(anon.filename, `delivery-graph${DELIVERY_GRAPH_EXPORT_SUFFIX}`, "no name and no id falls back to a constant");
+});
+
+test("#525: an entry with no stored graph yields empty contents (nothing to download)", () => {
+  assertEquals(buildDeliveryGraphExport({ id: "x", name: "n" }).contents, "");
+  assertEquals(buildDeliveryGraphExport({ id: "x", name: "n", graph: 42 as unknown as string }).contents, "");
+});
+
+test("#525: the Library mount renders a per-row Export control wired to a Blob download", () => {
+  assert(/data-export=/.test(LIBRARY_JS), "library.mount.js must render a per-row Export affordance carrying the entry id");
+  assert(/closest\("\[data-export\]"\)/.test(LIBRARY_JS), "the list click handler must route the Export button");
+  assert(/buildDeliveryGraphExport\(entry\)/.test(LIBRARY_JS), "Export must assemble the download from buildDeliveryGraphExport(entry)");
+  // The actual client-side download mechanics: Blob → object URL → anchor download → revoke.
+  assert(/new Blob\(\[contents\]/.test(LIBRARY_JS), "Export must build a Blob from the entry's graph contents");
+  assert(/URL\.createObjectURL\(/.test(LIBRARY_JS), "Export must create an object URL for the download");
+  assert(/\.download = filename/.test(LIBRARY_JS), "Export must set the anchor download filename");
+  assert(/URL\.revokeObjectURL\(/.test(LIBRARY_JS), "Export must revoke the object URL after triggering the download");
+});

package/test/delivery-graphs-staged-embed.test.ts

@@ -6,10 +6,21 @@
 // Dispatch button and NO way to see the graph. The staged App-View (pages/delivery-graphs/staged.*)
 // closes that: per row it offers Preview-DI (over the nano-navigate bridge) AND Dispatch. This test
 // pins the wiring so it cannot silently regress: the sidecars exist and mount the same module, the door
-// defaults are base-relative (the #279 App-View resolution class — a leading-slash path 404s through the
-// console iframe), it drives the DI-preview bridge, and it posts the dispatch by digest.
+// defaults are MODULE-ANCHORED (`new URL("../app/api/…", import.meta.url)`, the #467 App-View
+// resolution class — see below), it drives the DI-preview bridge, and it posts the dispatch by digest.
+//
+// #279/#467 resolution class: the staged shell (staged-embed.html / staged-standalone.html) — and thus
+// staged.mount.js — is served ONE DIRECTORY DEEP at `<appMount>/delivery-graphs/`, while the API lives
+// at the app root, a sibling of `/delivery-graphs/`: `<appMount>/app/api/…`. A leading-slash absolute
+// default resolves against the console iframe ORIGIN, not the app-view base (#279). A document-base-
+// relative default (`"app/api/…"`) resolves against the `…/delivery-graphs/` shell base to
+// `…/delivery-graphs/app/api/…` → 404 on EVERY surface (the Studio console never injects
+// window.__NANO_APP_VIEW__, so the default runs) — the "Could not load staged proposals." bug (#536).
+// The only correct default is anchored to staged.mount.js's OWN url (import.meta.url): `../app/api/…`
+// steps up out of `/delivery-graphs/` onto `<appMount>/app/api/…` on all surfaces. This test pins that
+// resolution against the REAL, `/delivery-graphs/`-deep module url so neither regression can return.
 import { test } from "node:test";
-import { assert } from "#test-assert";
+import { assert, assertEquals } from "#test-assert";
 import { readFileSync } from "node:fs";
 
 const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
@@ -19,15 +30,55 @@ const EMBED_HTML = readFileSync(`${DIR}/staged-embed.html`, "utf8");
 const STANDALONE_HTML = readFileSync(`${DIR}/staged-standalone.html`, "utf8");
 const PAGE_JSON = readFileSync(`${ROOT}pages/delivery-graphs.page.json`, "utf8");
 
-// Pull the string default out of `const <name> = config.<field> ?? <CONST>;` (or a module const).
-function defaultUrl(name: string): string {
+// The REAL served location of staged.mount.js on each surface: one directory deep under
+// `/delivery-graphs/`.
+const STANDALONE_MOUNT = "http://127.0.0.1:3000/delivery-graphs/staged.mount.js";
+const STUDIO_MOUNT = "http://studio-host:8080/console/app-view/Workforce/delivery-graphs/staged.mount.js";
+
+// Pull the module-anchored default spec out of `const <name> = config.<field> ?? <CONST>;` where the
+// CONST is declared `const <CONST> = new URL("<spec>", import.meta.url).href;`.
+function defaultSpec(name: string): string {
   const m = MOUNT_JS.match(new RegExp(`${name}\\s*=\\s*config\\.\\w+\\s*\\?\\?\\s*(\\w+);`));
   assert(m, `staged.mount.js must default ${name} from config with a fallback constant`);
-  const constM = MOUNT_JS.match(new RegExp(`const ${m![1]}\\s*=\\s*"([^"]*)"`));
-  assert(constM, `staged.mount.js must declare the ${m![1]} fallback as a string literal`);
+  const constM = MOUNT_JS.match(
+    new RegExp(`const ${m![1]}\\s*=\\s*new URL\\(\\s*"([^"]*)"\\s*,\\s*import\\.meta\\.url\\s*\\)\\s*\\.href`),
+  );
+  assert(
+    constM,
+    `staged.mount.js must default ${m![1]} to new URL("<spec>", import.meta.url) so the door is anchored ` +
+      `to the module's own served location, not the document base (#467/#536)`,
+  );
   return constM![1];
 }
 
+// A module-anchored door default must (a) not be absolute (#279), (b) step up out of /delivery-graphs/
+// (#467), and (c) resolve onto <appMount>/app/api/… both standalone AND inside the Studio iframe.
+function assertModuleAnchored(name: string, endpoint: string): void {
+  const spec = defaultSpec(name);
+  assert(
+    !spec.startsWith("/"),
+    `default ${name} spec "${spec}" must not be absolute: a leading-slash path resolves against the ` +
+      `iframe ORIGIN (console :8080), not the app-view base, so every fetch 404s (#279)`,
+  );
+  assert(
+    spec.startsWith("../"),
+    `default ${name} spec "${spec}" must step up out of /delivery-graphs/ (import.meta.url points at ` +
+      `<appMount>/delivery-graphs/staged.mount.js; the API is a sibling at <appMount>/app/api/…) (#467)`,
+  );
+  assert(spec.endsWith(endpoint), `default ${name} spec "${spec}" must hit the ${endpoint} door`);
+  assertEquals(
+    new URL(spec, STANDALONE_MOUNT).href,
+    `http://127.0.0.1:3000/${endpoint}`,
+    `default ${name} must resolve to the app root, not the /delivery-graphs/ shell base (#467)`,
+  );
+  assertEquals(
+    new URL(spec, STUDIO_MOUNT).href,
+    `http://studio-host:8080/console/app-view/Workforce/${endpoint}`,
+    `default ${name} must resolve under the app-view base the console proxies, not the console origin ` +
+      `root (#279) nor the /delivery-graphs/ shell base (#467/#536)`,
+  );
+}
+
 test("#511: the staged App-View mounts the same module standalone and embedded", () => {
   assert(/mountStagedProposals/.test(MOUNT_JS), "staged.mount.js must export mountStagedProposals");
   for (const [file, html] of [["staged-embed.html", EMBED_HTML], ["staged-standalone.html", STANDALONE_HTML]] as const) {
@@ -48,25 +99,19 @@ test("#511: the page binds the Staged proposals node to the staged App-View side
   assert(staged?.props?.standalone === "./delivery-graphs/staged-standalone.html", "it has the staged standalone sidecar");
 });
 
-test("#511/#279: the staged list door default is base-relative", () => {
-  const url = defaultUrl("stagedUrl");
-  assert(url.endsWith("delivery-graph/staged"), `stagedUrl default "${url}" must hit the listStagedProposals door`);
-  assert(!url.startsWith("/"), `default stagedUrl "${url}" must be base-relative (App-View #279 resolution class)`);
+test("#511/#279/#467: the staged list door default is module-anchored to the app root", () => {
+  assertModuleAnchored("stagedUrl", "app/api/delivery-graph/staged");
 });
 
 test("#511: DI preview — the staged view wires the proposal-bpmn door and bridges the XML to the explorer", () => {
-  const url = defaultUrl("proposalBpmnUrl");
-  assert(url.endsWith("actions/delivery-graph/proposal-bpmn"), `proposalBpmnUrl default "${url}" must hit the previewProposalBpmn door`);
-  assert(!url.startsWith("/"), `default proposalBpmnUrl "${url}" must be base-relative`);
+  assertModuleAnchored("proposalBpmnUrl", "app/api/actions/delivery-graph/proposal-bpmn");
   assert(/data-preview-di=/.test(MOUNT_JS), "staged.mount.js must render a per-row Preview-DI affordance carrying the digest");
   assert(/target:\s*"definitionPreview"/.test(MOUNT_JS), "staged.mount.js must post nano-navigate to the definitionPreview target");
   assert(/params:\s*\{\s*xml:/.test(MOUNT_JS), "staged.mount.js must carry the compiled BPMN xml in the bridge message");
 });
 
 test("#460/#511: Dispatch is the operator's launch — posts the digest to the dispatch door, and never compiles/stages", () => {
-  const url = defaultUrl("dispatchUrl");
-  assert(url.endsWith("actions/delivery-graph/dispatch"), `dispatchUrl default "${url}" must hit the dispatchDeliveryGraph door`);
-  assert(!url.startsWith("/"), `default dispatchUrl "${url}" must be base-relative`);
+  assertModuleAnchored("dispatchUrl", "app/api/actions/delivery-graph/dispatch");
   assert(/data-dispatch=/.test(MOUNT_JS), "staged.mount.js must render a per-row Dispatch affordance carrying the digest");
   assert(/window\.confirm\(/.test(MOUNT_JS), "Dispatch must confirm before launching (dispatch authorises side effects)");
   // Operator-only: this surface dispatches a digest that is ALREADY staged — it must not compile or
@@ -75,3 +120,10 @@ test("#460/#511: Dispatch is the operator's launch — posts the digest to the d
   assert(!/graphJson/.test(MOUNT_JS), "staged.mount.js must NOT submit pasted graph JSON (it only lists+dispatches staged proposals)");
   assert(!/approvalToken/.test(MOUNT_JS), "staged.mount.js must NOT carry the removed replayable approvalToken");
 });
+
+test("#520: Dismiss is the operator's discard — posts the digest to the dismiss door, behind a confirm, and launches nothing", () => {
+  assertModuleAnchored("dismissUrl", "app/api/actions/delivery-graph/dismiss");
+  assert(/data-dismiss=/.test(MOUNT_JS), "staged.mount.js must render a per-row Dismiss affordance carrying the digest");
+  // Dismiss is a one-way discard off the staged list — confirm before it drops the proposal.
+  assert(/window\.confirm\(DISMISS_CONFIRM\)/.test(MOUNT_JS), "staged.mount.js must confirm before dismissing (a one-way discard off the staged list)");
+});