@tribe-nest/forge 3.39.0 → 3.42.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tribe-nest/forge",
-  "version": "3.39.0",
+  "version": "3.42.0",
   "publishConfig": {
     "access": "public"
   },
@@ -31,7 +31,7 @@
     "@stripe/react-stripe-js": "^3.8.0",
     "@stripe/stripe-js": "^7.6.1",
     "@tanstack/react-query": "^5.62.7",
-    "@tribe-nest/media-client": "^0.1.0",
+    "@tribe-nest/media-client": "^0.2.1",
     "@tribe-nest/media-protocol": "^1.0.0",
     "axios": "^1.7.9",
     "lucide-react": "^0.510.0",

package/src/_tests/publishedResolvability.spec.ts

@@ -30,12 +30,23 @@ import { join } from "path";
  * creator site, while the whole suite stayed green and the starter's release
  * notes announced the feature.
  *
- * So there are two properties here and they are separate:
+ * So there are three properties here and they are separate:
  *
  *  1. every bare import in the published tree names a package the consumer's
  *     install will actually produce (a dependency, or a peer that npm installs
- *     because it is NOT marked optional), and
- *  2. every workspace package Forge depends on is one npm will publish.
+ *     because it is NOT marked optional),
+ *  2. every workspace package Forge depends on is one npm will publish, and
+ *  3. the RANGE Forge declares for a workspace package accepts the version that
+ *     package is actually at.
+ *
+ * The third failed too, and silently. Forge went on declaring
+ * `"@tribe-nest/media-client": "^0.1.0"` after that package moved to `0.2.0`,
+ * and `^0.1.0` does not accept `0.2.x`. Inside the monorepo nothing shows it -
+ * the symlink means every build, every spec and every `check-types` run sees
+ * the 0.2 source - while a creator site resolved 0.1.1 from npm and got a
+ * `useRemoteTrack` that never detached a media element, so a remount left an
+ * orphan still playing the call's audio. The published surface was a minor
+ * version behind the surface the tests were green against.
  *
  * Specs are excluded: they never ship (`files` is `["src"]`, but a consumer
  * never imports a `.spec` file), and they legitimately reach for vitest, jsdom
@@ -47,6 +58,7 @@ const PACKAGES_ROOT = join(FORGE_ROOT, "..");
 
 type PackageJson = {
   name: string;
+  version?: string;
   private?: boolean;
   files?: string[];
   exports?: Record<string, unknown>;
@@ -181,4 +193,70 @@ describe("what a creator site's install has to produce", () => {
   it("still exports the media entry the Forge manifest advertises", () => {
     expect(forge.exports?.["./media"]).toBe("./src/ui/media/index.ts");
   });
+
+  /**
+   * The declared range has to accept the version the package is AT.
+   *
+   * Deliberately hand-rolled rather than reaching for `semver`: this package
+   * declares its dependencies honestly (that is the whole subject of this
+   * file), and `semver` is only present here as somebody else's transitive.
+   * The cost is that only the range forms this repo actually uses are
+   * understood - anything else fails loudly rather than passing vacuously,
+   * which is the right way round for a guard.
+   */
+  const satisfies = (range: string, version: string): boolean => {
+    const parse = (value: string): [number, number, number] => {
+      const parts = value.split(".").map((n) => Number.parseInt(n, 10));
+      if (parts.length !== 3 || parts.some((n) => !Number.isFinite(n))) {
+        throw new Error(`not a plain semver version: ${value}`);
+      }
+      return [parts[0]!, parts[1]!, parts[2]!];
+    };
+    const atLeast = (a: [number, number, number], b: [number, number, number]) =>
+      a[0] !== b[0] ? a[0] > b[0] : a[1] !== b[1] ? a[1] > b[1] : a[2] >= b[2];
+
+    const [major, minor, patch] = parse(version);
+    if (range === "*") return true;
+    if (/^\d/.test(range)) return range === version; // exact pin
+    if (range.startsWith("^")) {
+      const floor = parse(range.slice(1));
+      if (!atLeast([major, minor, patch], floor)) return false;
+      // Caret on a 0.x version pins the MINOR, which is where a pre-1.0
+      // package puts its breaking changes. `^0.1.0` does not accept `0.2.0`,
+      // and that is exactly the case this test exists for.
+      return floor[0] === 0 ? minor === floor[1] : major === floor[0];
+    }
+    throw new Error(`unsupported range form "${range}" - teach this helper before using it`);
+  };
+
+  it("declares a range that accepts each workspace package's current version", () => {
+    const workspaceDeps = Object.entries(forge.dependencies ?? {}).filter(([name]) =>
+      name.startsWith("@tribe-nest/"),
+    );
+    expect(workspaceDeps.length).toBeGreaterThan(0);
+
+    const stale = workspaceDeps
+      .map(([name, range]) => {
+        const dependency = readPackage(join(PACKAGES_ROOT, name.replace("@tribe-nest/", "")));
+        return { name, range, version: dependency.version };
+      })
+      .filter(({ range, version }) => !satisfies(range, version!))
+      .map(({ name, range, version }) => `${name}: declared ${range}, package is at ${version}`);
+
+    expect(stale).toEqual([]);
+  });
+
+  it("the range check itself knows that a 0.x caret pins the minor", () => {
+    // Without this the test above is only as good as a helper nobody checked,
+    // and the bug it guards is precisely a 0.x caret being read as permissive.
+    expect(satisfies("^0.1.0", "0.1.1")).toBe(true);
+    expect(satisfies("^0.1.0", "0.2.0")).toBe(false);
+    expect(satisfies("^0.2.1", "0.2.1")).toBe(true);
+    expect(satisfies("^0.2.1", "0.2.0")).toBe(false);
+    expect(satisfies("^1.0.0", "1.0.1")).toBe(true);
+    expect(satisfies("^1.0.0", "2.0.0")).toBe(false);
+    expect(satisfies("1.0.1", "1.0.1")).toBe(true);
+    expect(satisfies("1.0.1", "1.0.2")).toBe(false);
+    expect(() => satisfies(">=1.0.0", "1.0.0")).toThrow();
+  });
 });

package/src/data/queries/useAuthActions.ts

@@ -1,6 +1,14 @@
 import { useForge } from "../../provider/ForgeProvider";
 import { useMutation } from "@tanstack/react-query";
 
+/**
+ * Where a Forge site's reset-password page lives.
+ *
+ * Every functional page on a code website is under `/i/`, and the emailed link
+ * is built from whatever the site sends here.
+ */
+export const DEFAULT_RESET_PASSWORD_PATH = "/i/reset-password";
+
 // Stateless account actions (no session state) — kept out of PublicAuthContext.
 //
 // ## Why these hit `/public/sessions/*` and not `/public/accounts/*`
@@ -33,8 +41,8 @@ import { useMutation } from "@tanstack/react-query";
 export function useForgotPassword() {
   const { client, profileId } = useForge();
 
-  return useMutation<unknown, unknown, { email: string; origin?: string; profileId?: string }>({
-    mutationFn: async ({ email, origin, profileId: overrideProfileId }) => {
+  return useMutation<unknown, unknown, { email: string; origin?: string; profileId?: string; resetPath?: string }>({
+    mutationFn: async ({ email, origin, profileId: overrideProfileId, resetPath }) => {
       const contextId = overrideProfileId ?? profileId;
       if (!contextId) {
         // Better than posting without it: the endpoint would 400 on schema
@@ -47,6 +55,11 @@ export function useForgotPassword() {
         // The reset link is built server-side from this, and the association
         // endpoint requires it (the global one treated it as optional).
         origin: origin ?? (typeof window !== "undefined" ? window.location.origin : undefined),
+        // And the PATH, because the backend cannot guess it. Its default is
+        // `apps/client`'s `/reset-password`, which does not exist on a code
+        // website - every functional page there is under `/i/`, so the emailed
+        // link 404'd for everyone on the current default storefront.
+        resetPath: resetPath ?? DEFAULT_RESET_PASSWORD_PATH,
       });
       return res.data;
     },

package/src/data/queries/useBroadcasts.ts

@@ -181,6 +181,66 @@ export type BroadcastViewerCredentials = {
  * the SAME call to the same address. A session that is pinged on one stack and
  * not the other reports a different audience count for the same room.
  */
+export type BroadcastPollOption = { id: string; label: string; position: number; voteCount: number };
+
+export type BroadcastPoll = {
+  id: string;
+  question: string;
+  status: "draft" | "live" | "closed";
+  /**
+   * The ASKING of this question in this broadcast, which is what a vote names.
+   *
+   * A poll belongs to a stream template and can be asked again in a later
+   * broadcast; each asking has its own votes and its own one-vote-per-viewer
+   * rule. So the same question next month is a different run, and somebody who
+   * answered last month may answer again.
+   */
+  runId: string;
+  options: BroadcastPollOption[];
+  totalVotes: number;
+};
+
+/**
+ * Reading and answering the poll a broadcast is asking.
+ *
+ * Both endpoints are public and take no bearer token, like the broadcast page
+ * they belong to. The read returns only what is already on everyone's screen,
+ * and the write is identified by a key the viewer's own browser made up.
+ */
+export function useBroadcastPollApi() {
+  const { client } = useForge();
+
+  return {
+    /**
+     * The question being asked right now, or null.
+     *
+     * Fetched once when the player mounts, for the viewer who arrived in the
+     * middle of a poll. Everything after that arrives on the socket, so this is
+     * not polled: a timer would be a second, later-arriving source of truth for
+     * numbers that are already being pushed.
+     */
+    livePoll: async (broadcastId: string): Promise<BroadcastPoll | null> => {
+      const res = await client.get(`/streams/v2/public/polls/live`, { params: { broadcastId } });
+      return res.data?.poll ?? null;
+    },
+    /**
+     * One vote.
+     *
+     * `alreadyVoted` comes back true rather than an error when this viewer has
+     * already answered, which is the ordinary case for somebody with the stream
+     * open in two tabs.
+     */
+    vote: async (payload: {
+      runId: string;
+      optionId: string;
+      voterKey: string;
+    }): Promise<{ poll: BroadcastPoll; alreadyVoted: boolean }> => {
+      const res = await client.post(`/streams/v2/public/polls/vote`, payload);
+      return res.data;
+    },
+  };
+}
+
 export function useBroadcastSessionApi() {
   const { client } = useForge();
 

package/src/i18n/de.json

@@ -175,6 +175,11 @@
   "forge.broadcast_player.sound_on": "Ton einschalten",
   "forge.broadcast_player.started": "Vor {duration} gestartet",
   "forge.broadcast_player.watching_now": "{count} schauen gerade zu",
+  "forge.broadcast_poll.closed": "Umfrage beendet",
+  "forge.broadcast_poll.live": "Umfrage",
+  "forge.broadcast_poll.votes_one": "{count} Stimme",
+  "forge.broadcast_poll.votes_other": "{count} Stimmen",
+  "forge.broadcast_poll.your_vote": "(deine Stimme)",
   "forge.broadcast_ticket_purchase.buy_tickets": "Tickets kaufen",
   "forge.broadcast_ticket_purchase.from_price": "Ab {price}",
   "forge.broadcast_watch.leave": "Übertragung verlassen",

package/src/i18n/en.json

@@ -175,6 +175,11 @@
   "forge.broadcast_player.sound_on": "Turn sound on",
   "forge.broadcast_player.started": "Started {duration} ago",
   "forge.broadcast_player.watching_now": "{count} watching now",
+  "forge.broadcast_poll.closed": "Poll closed",
+  "forge.broadcast_poll.live": "Poll",
+  "forge.broadcast_poll.votes_one": "{count} vote",
+  "forge.broadcast_poll.votes_other": "{count} votes",
+  "forge.broadcast_poll.your_vote": "(your vote)",
   "forge.broadcast_ticket_purchase.buy_tickets": "Buy tickets",
   "forge.broadcast_ticket_purchase.from_price": "From {price}",
   "forge.broadcast_watch.leave": "Leave broadcast",

package/src/ui/headless/broadcast/useBroadcastPoll.ts

@@ -0,0 +1,225 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+
+import { useBroadcastPollApi, type BroadcastPoll } from "../../../data/queries/useBroadcasts";
+
+/**
+ * The poll a viewer is being asked, and their answer to it.
+ *
+ * ## Where the numbers come from
+ *
+ * One fetch when the player mounts, for somebody who arrived mid-question, and
+ * the socket for everything after. The player owns the socket (it is the same
+ * connection chat rides on), so it hands the events down here rather than this
+ * opening a second one.
+ *
+ * ## The voter key
+ *
+ * A random id kept in this browser, per site, not per broadcast: the same
+ * person watching two streams is one voter with one key, and the server's
+ * uniqueness is per POLL anyway. It identifies nobody. It exists so that
+ * pressing the button twice counts once, and it is honestly defeatable by
+ * clearing storage, which is the trade the feature was designed around.
+ *
+ * Storage can throw (a private window, a browser set to block site data), and a
+ * viewer who cannot be remembered must still be able to vote. So a failure
+ * falls back to a key held in memory for this page view.
+ */
+
+const VOTER_KEY_STORAGE = "tribenest.broadcast.voter";
+
+function randomKey(): string {
+  const bytes = new Uint8Array(16);
+  if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+    crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+function readVoterKey(): string {
+  if (typeof localStorage === "undefined") return randomKey();
+  try {
+    const held = localStorage.getItem(VOTER_KEY_STORAGE);
+    if (held && held.length >= 8) return held;
+    const minted = randomKey();
+    localStorage.setItem(VOTER_KEY_STORAGE, minted);
+    return minted;
+  } catch {
+    // Blocked or full. One vote per page view is worse than one per browser and
+    // much better than no vote at all.
+    return randomKey();
+  }
+}
+
+/**
+ * Which ASKINGS this browser has answered, so the UI opens on the results.
+ *
+ * Keyed by run and not by poll, which is the whole difference. A question
+ * belongs to a stream template and gets asked again - later in the same
+ * broadcast, or in next week's - and each asking has its own votes and its own
+ * one-vote rule. Keyed by poll, this remembered "you answered this question"
+ * for ever: a returning viewer met a fresh poll already showing bars and
+ * "(your vote)", with no way to take part. The server would have accepted their
+ * vote; the panel never offered it.
+ */
+const votedKey = (runId: string) => `tribenest.broadcast.voted.run.${runId}`;
+
+function readVoted(runId: string): string | null {
+  if (typeof localStorage === "undefined") return null;
+  try {
+    return localStorage.getItem(votedKey(runId));
+  } catch {
+    return null;
+  }
+}
+
+function forgetVoted(runId: string): void {
+  if (typeof localStorage === "undefined") return;
+  try {
+    localStorage.removeItem(votedKey(runId));
+  } catch {
+    // Nothing to undo if it could not be written in the first place.
+  }
+}
+
+function rememberVoted(runId: string, optionId: string): void {
+  if (typeof localStorage === "undefined") return;
+  try {
+    localStorage.setItem(votedKey(runId), optionId);
+  } catch {
+    // Nothing to do. The server still refuses the second vote; the viewer just
+    // sees the form again in a new tab.
+  }
+}
+
+/**
+ * What a viewer's own vote should be after a poll update arrives.
+ *
+ * This exists because of a bug that made the first click look ignored. Voting
+ * publishes results to EVERY viewer, including the one who just voted, and
+ * that push used to re-read the vote from storage. The push routinely beat the
+ * HTTP response it was caused by, storage had not been written yet, and the
+ * panel flipped back to buttons - so the viewer clicked again, and only the
+ * second click appeared to work. Their first vote had counted all along.
+ *
+ * The rule that fixes it: an update to the same ASKING never changes who this
+ * viewer voted for. Only a different asking re-reads storage.
+ *
+ * The identity is the RUN, not the poll. The same question asked again is a new
+ * asking with an empty tally that this viewer has not answered, so comparing
+ * polls would carry their old answer into it and lock them out of voting.
+ */
+export function votedOptionForIncoming(args: {
+  currentRunId: string | null;
+  incomingRunId: string | null;
+  votedOptionId: string | null;
+  /** What storage holds for the incoming asking, if anything. */
+  storedForIncoming: string | null;
+}): string | null {
+  if (!args.incomingRunId) return null;
+  if (args.incomingRunId === args.currentRunId) {
+    // Held in memory beats storage: a vote in flight is not in storage yet, and
+    // a viewer whose browser refuses storage still gets to keep their answer
+    // for as long as the page is open.
+    return args.votedOptionId ?? args.storedForIncoming;
+  }
+  return args.storedForIncoming;
+}
+
+export type BroadcastPollApi = {
+  poll: BroadcastPoll | null;
+  /** The option this browser chose, if it has voted on the current poll. */
+  votedOptionId: string | null;
+  voting: boolean;
+  error: string | null;
+  vote: (optionId: string) => void;
+  /** Feed socket payloads in. Null ends the poll. */
+  onPollEvent: (poll: BroadcastPoll | null) => void;
+};
+
+export function useBroadcastPoll(broadcastId?: string): BroadcastPollApi {
+  const api = useBroadcastPollApi();
+  const [poll, setPoll] = useState<BroadcastPoll | null>(null);
+  const [votedOptionId, setVotedOptionId] = useState<string | null>(null);
+  const [voting, setVoting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const voterKeyRef = useRef<string | null>(null);
+
+  const voterKey = () => {
+    if (!voterKeyRef.current) voterKeyRef.current = readVoterKey();
+    return voterKeyRef.current;
+  };
+
+  useEffect(() => {
+    if (!broadcastId) return;
+    let cancelled = false;
+    api
+      .livePoll(broadcastId)
+      .then((live) => {
+        if (cancelled) return;
+        setPoll(live);
+        setVotedOptionId(live?.runId ? readVoted(live.runId) : null);
+      })
+      .catch(() => {
+        // A poll that cannot be fetched is a poll the viewer does not see. It
+        // is not worth an error on a page whose job is to play a stream.
+        if (!cancelled) setPoll(null);
+      });
+    return () => {
+      cancelled = true;
+    };
+    // The api object is rebuilt per render; the broadcast is what identifies
+    // the fetch.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [broadcastId]);
+
+  const onPollEvent = useCallback((next: BroadcastPoll | null) => {
+    setPoll((current) => {
+      setVotedOptionId((held) =>
+        votedOptionForIncoming({
+          currentRunId: current?.runId ?? null,
+          incomingRunId: next?.runId ?? null,
+          votedOptionId: held,
+          storedForIncoming: next?.runId ? readVoted(next.runId) : null,
+        }),
+      );
+      return next;
+    });
+    setError(null);
+  }, []);
+
+  const vote = useCallback(
+    (optionId: string) => {
+      const current = poll;
+      if (!current || current.status !== "live" || !current.runId || votedOptionId || voting) return;
+
+      setVoting(true);
+      setError(null);
+      // Both recorded before the request goes out, not in its `then`. The
+      // results push this vote causes routinely arrives BEFORE the response to
+      // it, and anything reading storage at that moment has to already find the
+      // vote there.
+      setVotedOptionId(optionId);
+      rememberVoted(current.runId, optionId);
+      api
+        .vote({ runId: current.runId, optionId, voterKey: voterKey() })
+        .then((result) => setPoll(result.poll))
+        .catch((err: unknown) => {
+          setVotedOptionId(null);
+          forgetVoted(current.runId);
+          const message = (err as { response?: { data?: { message?: string } } })?.response?.data?.message;
+          setError(message ?? "That vote did not go through.");
+        })
+        .finally(() => setVoting(false));
+    },
+    // `api` is rebuilt per render and holds no state of its own.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [poll, votedOptionId, voting],
+  );
+
+  return useMemo(
+    () => ({ poll, votedOptionId, voting, error, vote, onPollEvent }),
+    [poll, votedOptionId, voting, error, vote, onPollEvent],
+  );
+}

package/src/ui/index.ts

@@ -183,6 +183,10 @@ export { ReplayList, type ReplayListProps } from "./styled/ReplayList";
 export { LiveBroadcastList, type LiveBroadcastListProps } from "./styled/LiveBroadcastList";
 export { BroadcastWatch, type BroadcastWatchProps } from "./styled/BroadcastWatch";
 export { EndedBroadcast, type EndedBroadcastProps } from "./styled/broadcast/EndedBroadcast";
+// Shared with the admin studio, which renders the same tallies in its Polls
+// tab and burns them into the stage. Three surfaces, one rounding.
+export { pollPercentages, type PollLike, type PollResult } from "./styled/broadcast/pollResults";
+export { BroadcastPollPanel } from "./styled/broadcast/BroadcastPollPanel";
 export { BroadcastPassValidation, type BroadcastPassValidationProps } from "./styled/broadcast/BroadcastPassValidation";
 export { BroadcastTicketPurchase, type BroadcastTicketPurchaseProps } from "./styled/broadcast/BroadcastTicketPurchase";
 export {

package/src/ui/styled/ForgotPasswordForm.tsx

@@ -6,12 +6,18 @@ import { useForgeTheme } from "../theme/ForgeThemeProvider";
 export interface ForgotPasswordFormProps {
   /** Href for the "Back to login" / "Login" links. */
   loginHref: string;
+  /**
+   * The path the emailed reset link points at, on this site's own origin.
+   * Defaults to `/i/reset-password`, which is where the starter puts it. Pass
+   * one only if the site moved that route.
+   */
+  resetPath?: string;
 }
 
 const msg = (e: unknown) => (e as { response?: { data?: { message?: string } } })?.response?.data?.message;
 
 /** Themed forgot-password request form, built on `useForgotPassword`. */
-export function ForgotPasswordForm({ loginHref }: ForgotPasswordFormProps) {
+export function ForgotPasswordForm({ loginHref, resetPath }: ForgotPasswordFormProps) {
   const t = useForgeT();
   const theme = useForgeTheme();
   const forgotPassword = useForgotPassword();
@@ -50,7 +56,11 @@ export function ForgotPasswordForm({ loginHref }: ForgotPasswordFormProps) {
     setError("");
     setIsSubmitting(true);
     try {
-      await forgotPassword.mutateAsync({ email, origin: window.location.origin });
+      await forgotPassword.mutateAsync({
+        email,
+        origin: window.location.origin,
+        ...(resetPath ? { resetPath } : {}),
+      });
       setIsSuccess(true);
     } catch (err) {
       setError(msg(err) || t("forge.forgot_password_form.error"));

package/src/ui/styled/_tests/broadcastPollVote.spec.ts

@@ -0,0 +1,127 @@
+import { describe, expect, it } from "vitest";
+
+import { votedOptionForIncoming } from "../../headless/broadcast/useBroadcastPoll";
+
+/**
+ * The rule that decides whether a viewer keeps their own vote when a poll
+ * update arrives.
+ *
+ * Reported as "I have to click twice before it records my answer". Voting
+ * pushes results to every viewer INCLUDING the one who just voted, that push
+ * routinely beat the HTTP response it was caused by, and the handler re-read
+ * the vote from storage that the response had not written yet. The panel
+ * flipped back to buttons, the viewer clicked again, and their first vote had
+ * been counted the whole time.
+ *
+ * The identity being compared is the ASKING. It was the poll once, and the
+ * second report followed: a question asked again showed a returning viewer
+ * "(your vote)" over last time's answer and refused to let them take part.
+ */
+describe("votedOptionForIncoming", () => {
+  it("keeps a vote that is still in flight when the results it caused arrive first", () => {
+    // The exact double-click bug: same poll, vote held in memory, storage not
+    // written yet. Answering null here is what sent the viewer back to the
+    // buttons.
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-1",
+        votedOptionId: "option-a",
+        storedForIncoming: null,
+      }),
+    ).toBe("option-a");
+  });
+
+  it("keeps the vote through every later result push on the same poll", () => {
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-1",
+        votedOptionId: "option-a",
+        storedForIncoming: "option-a",
+      }),
+    ).toBe("option-a");
+  });
+
+  it("never lets another viewer's vote overwrite this one", () => {
+    // Storage would only disagree after a stale write, but the rule has to be
+    // stated: what is held in memory for the current poll wins.
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-1",
+        votedOptionId: "option-a",
+        storedForIncoming: "option-b",
+      }),
+    ).toBe("option-a");
+  });
+
+  it("recovers a vote from storage on a reload mid-poll", () => {
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-1",
+        votedOptionId: null,
+        storedForIncoming: "option-a",
+      }),
+    ).toBe("option-a");
+  });
+
+  it("starts a NEW asking fresh, so the last answer does not carry over", () => {
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-2",
+        votedOptionId: "option-a",
+        storedForIncoming: null,
+      }),
+    ).toBeNull();
+  });
+
+  it("opens a new asking on its results when this browser already answered THAT asking", () => {
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-2",
+        votedOptionId: null,
+        storedForIncoming: "option-x",
+      }),
+    ).toBe("option-x");
+  });
+
+  it("lets a viewer answer the same question asked again", () => {
+    // The second bug, in one assertion. The question is identical and this
+    // browser answered it last time; the ASKING is new, so the panel must open
+    // on buttons rather than on "(your vote)".
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: "run-2",
+        votedOptionId: "option-a",
+        storedForIncoming: null,
+      }),
+    ).toBeNull();
+  });
+
+  it("clears the vote when the poll ends", () => {
+    expect(
+      votedOptionForIncoming({
+        currentRunId: "run-1",
+        incomingRunId: null,
+        votedOptionId: "option-a",
+        storedForIncoming: null,
+      }),
+    ).toBeNull();
+  });
+
+  it("handles the first poll of the broadcast, with nothing current", () => {
+    expect(
+      votedOptionForIncoming({
+        currentRunId: null,
+        incomingRunId: "run-1",
+        votedOptionId: null,
+        storedForIncoming: null,
+      }),
+    ).toBeNull();
+  });
+});