@bongos/core 1.19.1015 → 1.19.1017

package/modules/public-landing/public/projects.html

@@ -1649,6 +1649,7 @@ summary{min-height:24px;padding:3px 0;}
   }
   var catalog = [];
   var mineOrigins = {};   /* normalized host → 'owner' | 'builder' */
+  var appliedOrigins = {}; /* normalized host → true; GET /my-projects' applied echo (R10, task 1002286) */
   var ownedInstances = []; /* the viewer's OWN provisioning rows (never torn_down) */
   var ownedByHost = {};    /* lower(domain) → instance row — the dedupe join */
   /* What the platform's own entry is FOR SEARCH. It is deliberately not pushed
@@ -2166,6 +2167,63 @@ summary{min-height:24px;padding:3px 0;}
       : '';
   }
 
+  /* ══ APPLY TO JOIN (R10, task 1002286) ═══════════════════════════════
+     The card's own door onto the join relay platform-identity already runs
+     (POST /my-projects/join, R08 task 1002284): one click, on the origin the
+     card already has — no URL to type, unlike the separate join-by-URL field
+     task 1003774 is adding to View · Your projects. Hidden for the platform's
+     own card, a member (the “yours”/“you build here” chip already says so) and
+     a signed-out visitor (there is no session to file the request under).
+     Applied is read from the hub's own echo (GET /my-projects' `applied`,
+     loadMemberships) and updated the moment a request lands — the echo
+     carries no status (ADR 0201 D1.3), so Applied IS pending here; there is
+     nothing truer to say until membership itself appears. ══ */
+  function cardApplyHtml(p, rel) {
+    if (p.isSelf || isMember(rel) || !me) return '';
+    return appliedOrigins[hostOf(p.origin)]
+      ? '<button type="button" class="btn ghost" id="cardApply" disabled>Applied</button>'
+      : '<button type="button" class="btn ghost" id="cardApply">Apply to join</button>';
+  }
+  /* The relay's own outcome (my-projects.js RELAY_SENTENCE) is shown verbatim
+     — this page invents no wording of its own for a door it did not build.
+     Only `status === 'requested'` moves the button to Applied; every other
+     2xx (already_member, invite_only, open_enrollment, members_only,
+     not_published) is the door's answer, not a click that went through. */
+  function submitApply(btn, p) {
+    btn.disabled = true;
+    btn.textContent = 'Applying…';
+    var msg = $('cardApplyMsg');
+    fetch(API + '/my-projects/join', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ origin: p.origin }),
+    }).then(function (res) {
+      if (res.status === 401) {
+        btn.textContent = 'Apply to join'; btn.disabled = false;
+        if (msg) { msg.className = 'projMsg err'; msg.innerHTML = signInAgain(); }
+        return;
+      }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok && data && data.status === 'requested') {
+          appliedOrigins[hostOf(p.origin)] = true;
+          btn.textContent = 'Applied';
+          if (msg) { msg.className = 'projMsg ok'; msg.textContent = data.message || 'Requested.'; }
+          return;
+        }
+        btn.textContent = 'Apply to join';
+        btn.disabled = false;
+        var e = apiError(data, res.status);
+        if (msg) {
+          msg.className = 'projMsg' + (res.ok ? '' : ' err');
+          msg.textContent = (res.ok && data && data.message) || e.message || 'Could not reach that project — try again in a moment.';
+        }
+      });
+    }).catch(function () {
+      btn.textContent = 'Apply to join';
+      btn.disabled = false;
+      if (msg) { msg.className = 'projMsg err'; msg.textContent = 'Couldn’t reach the platform — check your connection and try again.'; }
+    });
+  }
+
   function openCard(p, rel, returnTo) {
     var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
@@ -2195,13 +2253,16 @@ summary{min-height:24px;padding:3px 0;}
        is member-gated AND address-gated: a member's entry, only where the hall
        is somewhere other than the site the first door already opens. */
     var hall = isMember(rel) ? hallUrlOf(p) : '';
+    var applyBtn = cardApplyHtml(p, rel);
     $('cardActions').innerHTML = (href
       ? '<a class="cardOpen" id="cardOpen" href="' + esc(href) + '"' +
         (p.isSelf ? '' : ' target="_blank" rel="noopener"') + '>' +
         (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
       : '') + (hall
       ? '<a class="cardHall" id="cardHall" href="' + esc(hall) + '" target="_blank" rel="noopener">' + HALL_GLYPH + 'Builders\' hall</a>'
-      : '');
+      : '') + applyBtn + (applyBtn ? '<p class="projMsg" id="cardApplyMsg"></p>' : '');
+    var applyEl = $('cardApply');
+    if (applyEl && !applyEl.disabled) applyEl.addEventListener('click', function () { submitApply(applyEl, p); });
     closeMenus();
     cardReturn = returnTo || null;
     $('cardScrim').hidden = false;
@@ -2446,16 +2507,20 @@ summary{min-height:24px;padding:3px 0;}
   /* "Mine" is a MEMBERSHIP, not the catalog's advisory owner column: the
      authority is platform_identity_project_memberships, whose role is
      owner|builder|visitor, and GET /my-projects already returns the
-     { owned, building } split. 401 (signed out) is not an error here. */
+     { owned, building, applied } split — `applied` is the statusless echo
+     (ADR 0201 D1.3) the card's Apply button reads back (R10, task 1002286).
+     401 (signed out) is not an error here. */
   function loadMemberships() {
     return fetch(API + '/my-projects', { credentials: 'same-origin' })
-      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [] }; })
+      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [], applied: [] }; })
       .then(function (d) {
         mineOrigins = {};
+        appliedOrigins = {};
         (d.owned || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'owner'; });
         (d.building || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'builder'; });
+        (d.applied || []).forEach(function (m) { if (m.origin) appliedOrigins[hostOf(m.origin)] = true; });
       })
-      .catch(function () { mineOrigins = {}; });
+      .catch(function () { mineOrigins = {}; appliedOrigins = {}; });
   }
 
   /* The owner-scoped half of the sky (task 1002744). The public catalog

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -42,7 +42,7 @@ What changed in translation, on purpose. The method's **three persisted homes**
 Read four live signals, then print two or three recommended next commands with a one-line reason each, followed by the full list grouped by category. Signals, all read locally and none written:
 
 1. **The world files**: does `DESIGN.md` exist at the repo root; is `config/branding.json` present over the neutral pack; is `docs/project-context.template.md` filled or still the scaffold. A scaffold with no answers recommends `shape` first; a missing `DESIGN.md` alone does not make the project greenfield (the neutral pack is the world).
-2. **The last kit report** for the target, if any: `report.json` under `%TMP%/ui-design-kit/<surface>/<page>/` (or the `--out` dir the last run named). Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
+2. **The last kit report** for the target, if any: `report.json` under the `--out` dir the last `render.js` run named — pass one explicitly on a shared machine, since the un-named default falls back to a world-readable OS temp dir (`os.tmpdir()`'s `ui-design-kit/<surface>/<page>/`: `%TMP%` on Windows, `$TMPDIR` on mac/linux). This is only ever read to shape the printed suggestion below, never trusted as authority. Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
 3. **Dirty files in version control**: `git status --porcelain` over the surfaces (`modules/*/public/`, `src/ui/`, `public*/`). Dirty UI files recommend `polish` on that path before anything new.
 4. **A stub already listening**: `kit/serve.js` prints its port when it starts; a page already served means the live loop (the playwright plugin) is available without a second server. Never start a duplicate on an occupied port.
 

package/modules/ui-design/styles/expedition/mock.html

@@ -39,9 +39,7 @@ body {
   --gutter: clamp(16px, 4vw, 26px);
   --band: clamp(40px, 7vh, 72px);
   margin: 0;
-  background: var(--bg);
-  background-image: radial-gradient(var(--dots) .9px, transparent 1px);
-  background-size: var(--dot-pitch) var(--dot-pitch);
+  background-color: var(--bg);
   color: var(--ink);
   font-family: var(--font-body);
   font-size: 16px;
@@ -101,6 +99,21 @@ body {
   }
 }
 
+/* the halftone screen, fixed under the content. Not body's own background-image on purpose:
+   the branding pack's `backdrop` emits a `body{background:...}` rule after the page's own
+   stylesheet (serve-internal.js themeMarkup()), and that shorthand resets background-image
+   to none on any served page. A texture on body silently does not exist; a texture on a
+   layer does (the same pattern as the blueprint look's grid, task 1003633). */
+body::before {
+  content: "";
+  position: fixed;
+  inset: 0;
+  z-index: -1;
+  pointer-events: none;
+  background-image: radial-gradient(var(--dots) .9px, transparent 1px);
+  background-size: var(--dot-pitch) var(--dot-pitch);
+}
+
 *, *::before, *::after { box-sizing: border-box; }
 a { color: inherit; }
 :focus-visible { outline: 2px solid var(--focus); outline-offset: 3px; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1015",
+  "version": "1.19.1017",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1015",
+      "version": "1.19.1017",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1015",
+  "version": "1.19.1017",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/capture.js

@@ -269,6 +269,7 @@ async function main() {
     console.error('       ... [--spark]                       offer it up for someone else to develop');
     console.error('       ... [--full --fields-file f.json]   file a Full Idea (five fields; see spark.js --template)');
     console.error('       ... [--no-prompt]                   never ask anything (default when not a terminal)');
+    console.error('       ... [--via planning]                a planning session\'s capture — the sky records the door (task 1004233)');
     process.exit(2);
   }
 
@@ -281,6 +282,15 @@ async function main() {
   const fieldsFile = arg('--fields-file', args);
   const noPrompt = hasFlag('--no-prompt', args);
   const goalArg = arg('--goal', args);
+  // task 1004233 (sky part 5): WHICH DOOR. The server reads 'cli' off this
+  // session's token, so this CLI names nothing — except a planning session's
+  // capture, which no session can tell from any other CLI filing. Only that one
+  // value is accepted here; the server refuses every other claim the same way.
+  const viaFromArg = arg('--via', args);
+  if (viaFromArg !== null && viaFromArg !== 'planning') {
+    console.error(`--via "${viaFromArg}" is not a door this CLI may name. Where a filing came from is read off your session; the one value you may add is --via planning.`);
+    process.exit(2);
+  }
 
   // A BAD --kind used to reach the server and come back a 400 (task 1003694).
   // That is not merely late, it is invisible where it matters: a SCHEDULED routine
@@ -376,6 +386,7 @@ async function main() {
     suggested_priority: priority,
   };
   if (kindFromArg) payload.kind = kindFromArg;
+  if (viaFromArg) payload.filed_via = viaFromArg;
   if (goalResolution.goalId != null) payload.goal_id = goalResolution.goalId;
   if (wantFull) {
     // The server validates these against the R141 declaration and scores them

package/scripts/gds/run-unit-tests.js

@@ -83,6 +83,10 @@ const INTEGRATION = new Set([
   // rows is NULL rather than a free ship. Only a transaction engine settles
   // those, so this runs here and the DB-free sibling covers the renderer.
   'acclaim_feed_evidence_db',
+  // task 1002977: proves the changed-totals skip rule (a single INSERT ...
+  // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
+  // a fake pool can prove the query shape but not which reports it inserts.
+  'activity_snapshots_db',
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
   'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1015'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1017'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -416,7 +416,10 @@ test('the recruiting surface really is exactly two reads, and each one joins REA
   assert.match(route, /'\/scouting\/:handle'/, 'and the pre-accept sliver');
 
   const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
-  for (const composed of ['scoutingListableSql', 'recruiterSliverVisibleSql']) {
+  // The directory reads TWO tiers since task 1002291 — ranked, and the hidden
+  // builders it lists by name — and the opt-out must empty both, or "removes you
+  // from the People directory" is false for a builder who also hid their record.
+  for (const composed of ['scoutingListableSql', 'scoutingNameOnlySql', 'recruiterSliverVisibleSql']) {
     const body = av.slice(av.indexOf(`function ${composed}(`));
     assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,
       `${composed} stopped composing the reach axis — opting out would no longer empty that surface`);

package/tests/activity_snapshots_db.mjs

@@ -0,0 +1,97 @@
+// tests/activity_snapshots_db.mjs — task 1002977 (community spec D2; real DB).
+//
+// Proves the windowed data plane's append-only history against real SQL. The
+// skip-on-unchanged rule lives entirely inside one INSERT ... WHERE NOT EXISTS
+// statement (activity-snapshots.js), so a fake pool can only prove the query
+// SHAPE (modules/platform-identity/tests/activity-snapshots.mjs); only a real
+// Postgres can prove WHICH reports it actually inserts, and that upsertActivity
+// (the existing POST /sso/activity/rollup path) really calls it end to end.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/activity_snapshots_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { recordActivitySnapshot } = require('../modules/platform-identity/activity-snapshots.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`activity_snapshots_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const BUILDER = 90002977, OTHER_BUILDER = 90002978;
+const IDS = [BUILDER, OTHER_BUILDER];
+const CLIENT = 't1002977-client';
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  // upsertActivity's INSERT always names recent_ships (012_recent_ships adds the
+  // column); without it here, step 2 below fails 42703 on a fresh database.
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
+  await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  await cleanup();
+
+  // 1 — recordActivitySnapshot directly: the changed-totals skip rule.
+  const first = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  ok(first !== null, 'a first-ever report inserts — nothing to be unchanged from');
+
+  const unchanged = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  ok(unchanged === null, 'an identical re-report inserts nothing');
+
+  const changed = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 150, tasksShipped: 5, karma: 3 }, { pool });
+  ok(changed !== null, 'a changed report (credits differ) inserts a new row');
+
+  const { rows: history } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at, id`,
+    [CLIENT, BUILDER],
+  );
+  ok(history.length === 2, 'exactly two rows exist — the unchanged report left no trace');
+  assert.deepEqual(history.map((r) => r.credits), [100, 150]);
+  pass++; console.log('  ok - the history is in report order');
+
+  // 2 — upsertActivity (the real POST /sso/activity/rollup path) really calls it.
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 10, tasksShipped: 1, karma: 0 }, { pool });
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 10, tasksShipped: 1, karma: 0 }, { pool });
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 20, tasksShipped: 1, karma: 0 }, { pool });
+  const { rows: viaRollup } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at, id`,
+    [CLIENT, OTHER_BUILDER],
+  );
+  ok(viaRollup.length === 2, 'upsertActivity appends a snapshot per changed report — two calls, one repeat, one row skipped');
+  assert.deepEqual(viaRollup.map((r) => r.credits), [10, 20]);
+  pass++; console.log('  ok - deleting the call inside upsertActivity would leave this red');
+
+  console.log(`\nactivity_snapshots_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/card_apply_ui.mjs

@@ -0,0 +1,297 @@
+// tests/card_apply_ui.mjs — the "Apply to join" affordance on the map's
+// project card, EXECUTED (BV1.R10, task 1002286, goal 1000110).
+//
+// The idiom is tests/project_invite_ui.mjs beside it (there is no jsdom in
+// this repo): lift the region out of modules/public-landing/public/projects.html,
+// run it in a vm under a minimal DOM/fetch stub, and drive it directly —
+// rather than reading the source and hoping. cardApplyHtml/submitApply are
+// deliberately small and depend on only a handful of free variables
+// (isMember, hostOf, appliedOrigins, me, $, fetch, jsonOrEmpty, apiError,
+// signInAgain), all supplied by the sandbox the way project_invite_ui.mjs
+// supplies esc()/jsonOrEmpty()/apiError() rather than slicing them too.
+//
+// What it proves, and why each matters:
+//   • the button is invisible for the platform's own card, for a member (the
+//     "yours"/"you build here" chip already says that), and for a signed-out
+//     visitor (there is no session to file the request under) — C6's rule
+//     applied to a fourth region
+//   • Apply sends exactly { origin } on the cookie session, to the join relay
+//     R08 already built (POST /my-projects/join)
+//   • only `status === 'requested'` moves the button to Applied and marks the
+//     origin applied; every other outcome the relay can give (already_member,
+//     invite_only, open_enrollment, members_only, not_published) is shown as
+//     the DOOR'S OWN WORDS and leaves the button re-tryable — R08's relay
+//     invented this vocabulary once already; the card must not invent a
+//     second one
+//   • a refusal, an expired session and an unreachable platform are each said
+//     honestly and never mistaken for a filed application
+//   • loadMemberships() reads the `applied` echo GET /my-projects returns
+//     (R08, ADR 0201 D1.3) into appliedOrigins, by host, the same way it
+//     already reads `owned`/`building` into mineOrigins
+//
+// Run:  node --test --test-reporter=tap tests/card_apply_ui.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// ── the card-apply region ────────────────────────────────────────────────
+const START = SCRIPT.indexOf('/* ══ APPLY TO JOIN (R10, task 1002286)');
+const END = SCRIPT.indexOf('function openCard(p, rel, returnTo) {');
+assert.ok(START > 0, 'the region must start at the APPLY TO JOIN banner');
+assert.ok(END > START, 'the region must end before openCard()');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function cardApplyHtml(', 'function submitApply(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+function boot({ me = { rank: 'thetes' }, appliedOrigins = {}, answers = [] } = {}) {
+  const requests = [];
+  const els = new Map();
+  const makeEl = (id) => ({
+    _id: id, textContent: '', className: '', _html: '', disabled: false,
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+  });
+  const $ = (id) => {
+    if (id == null) return null;
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+
+  const queued = answers.slice();
+  const fetch = (url, init = {}) => {
+    requests.push({ url, method: init.method, body: init.body, credentials: init.credentials, headers: init.headers });
+    const a = queued.shift() || { ok: true, status: 200, body: { ok: true, status: 'requested', message: 'Requested.' } };
+    if (a.reject) return Promise.reject(new Error('offline'));
+    return Promise.resolve({ ok: a.ok, status: a.status, json: () => Promise.resolve(a.body) });
+  };
+
+  // isMember/hostOf mirror the real page's own trivial pure functions — kept
+  // here rather than sliced in, the project_invite_ui.mjs precedent for a
+  // dependency simple enough that a second, hand-written copy cannot drift.
+  const sandbox = {
+    $, fetch, console, Promise, JSON, String, Object,
+    me, appliedOrigins,
+    API: '/api/bongos',
+    isMember: (rel) => rel === 'owner' || rel === 'builder',
+    hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase(),
+    jsonOrEmpty: (res) => res.json().catch(() => ({})),
+    apiError: (data, status) => ({
+      code: (data && data.error && data.error.code) || ('http_' + status),
+      message: (data && data.error && data.error.message) || '',
+    }),
+    signInAgain: () => 'Your session expired — <a href="/in">sign in again</a>.',
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#card-apply' });
+
+  const settle = async () => { for (let i = 0; i < 10; i++) await Promise.resolve(); };
+  return { requests, sandbox, settle, $, msg: () => $('cardApplyMsg') };
+}
+
+// ── cardApplyHtml: who sees the button at all ───────────────────────────
+
+test('the platform\'s own card never offers Apply', () => {
+  const { sandbox } = boot();
+  const html = sandbox.cardApplyHtml({ isSelf: true, origin: 'https://x.example' }, 'none');
+  assert.equal(html, '');
+});
+
+test('a member sees nothing — the relationship chip already says so', () => {
+  const { sandbox } = boot();
+  for (const rel of ['owner', 'builder']) {
+    assert.equal(sandbox.cardApplyHtml({ origin: 'https://x.example' }, rel), '', rel);
+  }
+});
+
+test('a signed-out visitor sees nothing — there is no session to apply under', () => {
+  const { sandbox } = boot({ me: null });
+  assert.equal(sandbox.cardApplyHtml({ origin: 'https://x.example' }, 'none'), '');
+});
+
+test('a signed-in visitor with no filed application gets an enabled Apply button', () => {
+  const { sandbox } = boot();
+  const html = sandbox.cardApplyHtml({ origin: 'https://x.example' }, 'none');
+  assert.match(html, /id="cardApply"/);
+  assert.doesNotMatch(html, /disabled/);
+  assert.match(html, />Apply to join</);
+});
+
+test('an already-applied origin renders Applied, disabled — the echo, by host', () => {
+  const { sandbox } = boot({ appliedOrigins: { 'x.example': true } });
+  const html = sandbox.cardApplyHtml({ origin: 'https://x.example/' }, 'none');
+  assert.match(html, /id="cardApply" disabled/);
+  assert.match(html, />Applied</);
+});
+
+// ── submitApply: the request itself ─────────────────────────────────────
+
+test('Apply sends exactly { origin } to the join relay, on the cookie session', async () => {
+  const ui = boot();
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(ui.requests.length, 1);
+  const req = ui.requests[0];
+  assert.equal(req.url, '/api/bongos/my-projects/join');
+  assert.equal(req.method, 'POST');
+  assert.equal(req.credentials, 'same-origin');
+  assert.deepEqual(JSON.parse(req.body), { origin: 'https://mercury.example' });
+});
+
+test('a filed application moves the button to Applied and marks the origin', async () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: { ok: true, status: 'requested', message: 'Requested access.' } }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(btn.textContent, 'Applied');
+  assert.equal(btn.disabled, true, 'a filed application does not re-offer the click');
+  assert.equal(ui.sandbox.appliedOrigins['mercury.example'], true);
+  assert.equal(ui.msg().className, 'projMsg ok');
+  assert.equal(ui.msg().textContent, 'Requested access.');
+});
+
+test('already_member is the door\'s own answer, not a filed application', async () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: { ok: true, status: 'already_member', message: 'You already build on this project — sign in to it to see it here.' } }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(btn.textContent, 'Apply to join', 're-tryable — this was not an application');
+  assert.equal(btn.disabled, false);
+  assert.equal(ui.sandbox.appliedOrigins['mercury.example'], undefined, 'not marked applied');
+  assert.equal(ui.msg().className, 'projMsg', 'the door\'s own answer, not an error');
+  assert.match(ui.msg().textContent, /already build on this project/);
+});
+
+test('invite_only is said in the door\'s own words, and the button stays re-tryable', async () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: { ok: true, status: 'invite_only', message: 'This project is invite-only — it doesn’t take requests.' } }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(btn.disabled, false);
+  assert.match(ui.msg().textContent, /invite-only/);
+});
+
+test('a real refusal (e.g. the project is not yet on the map) is shown as an error, via apiError', async () => {
+  const ui = boot({ answers: [{ ok: false, status: 404, body: { error: { code: 'unknown_project', message: 'no such project' } } }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(btn.textContent, 'Apply to join');
+  assert.equal(btn.disabled, false);
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.equal(ui.msg().textContent, 'no such project');
+});
+
+test('an expired session offers a way back in rather than a silent failure', async () => {
+  const ui = boot({ answers: [{ ok: false, status: 401, body: {} }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(btn.disabled, false);
+  assert.match(ui.msg().innerHTML, /sign in again/i);
+  assert.equal(ui.msg().className, 'projMsg err');
+});
+
+test('an unreachable platform is said as a network problem, and the click is re-tryable', async () => {
+  const ui = boot({ answers: [{ reject: true }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  await ui.settle();
+
+  assert.equal(btn.disabled, false);
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /reach the platform/i);
+});
+
+test('the button disables and reads Applying… the instant it is pressed', () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: { ok: true, status: 'requested', message: 'ok' } }] });
+  const btn = { textContent: '', disabled: false };
+  ui.sandbox.submitApply(btn, { origin: 'https://mercury.example' });
+  assert.equal(btn.disabled, true, 'disabled synchronously — no double-send on a fast second click');
+  assert.equal(btn.textContent, 'Applying…');
+});
+
+// ── loadMemberships: the applied echo, by host ───────────────────────────
+
+test('loadMemberships reads GET /my-projects\' applied echo into appliedOrigins, by host', () => {
+  const START2 = SCRIPT.indexOf('function loadMemberships() {');
+  const END2 = SCRIPT.indexOf('\n  }', START2) + 4;
+  assert.ok(START2 > 0 && END2 > START2, 'loadMemberships must be findable');
+  const region = SCRIPT.slice(START2, END2);
+
+  const sandbox = {
+    API: '/api/bongos',
+    mineOrigins: {},
+    appliedOrigins: {},
+    hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase(),
+    fetch: () => Promise.resolve({
+      ok: true,
+      json: () => Promise.resolve({
+        owned: [{ origin: 'https://owned.example' }],
+        building: [{ origin: 'https://built.example' }],
+        applied: [{ origin: 'https://applied.example/', applied_at: '2026-09-01T00:00:00Z' }],
+      }),
+    }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(region, sandbox, { filename: 'projects.html#load-memberships' });
+
+  return sandbox.loadMemberships().then(() => {
+    // The region reassigns mineOrigins/appliedOrigins to a fresh `{}` it
+    // creates INSIDE the vm's own realm, so Object.assign re-parents a copy
+    // to this realm before comparing — a cross-realm deepStrictEqual reads
+    // an identically-shaped object as unequal over its prototype alone.
+    assert.deepEqual(Object.assign({}, sandbox.mineOrigins), { 'owned.example': 'owner', 'built.example': 'builder' });
+    assert.deepEqual(Object.assign({}, sandbox.appliedOrigins), { 'applied.example': true });
+  });
+});
+
+test('a fetch failure clears appliedOrigins too, not just mineOrigins', () => {
+  const START2 = SCRIPT.indexOf('function loadMemberships() {');
+  const END2 = SCRIPT.indexOf('\n  }', START2) + 4;
+  const region = SCRIPT.slice(START2, END2);
+  const sandbox = {
+    API: '/api/bongos',
+    mineOrigins: { stale: 'owner' },
+    appliedOrigins: { stale: true },
+    hostOf: (o) => String(o || ''),
+    fetch: () => Promise.reject(new Error('offline')),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(region, sandbox, { filename: 'projects.html#load-memberships-fail' });
+
+  return sandbox.loadMemberships().then(() => {
+    assert.deepEqual(Object.assign({}, sandbox.mineOrigins), {});
+    assert.deepEqual(Object.assign({}, sandbox.appliedOrigins), {});
+  });
+});
+
+// ── the card is actually wired to it (source pins) ───────────────────────
+
+test('openCard builds the Apply button from cardApplyHtml and wires its click to submitApply', () => {
+  assert.match(SCRIPT, /var applyBtn = cardApplyHtml\(p, rel\);/);
+  assert.match(SCRIPT, /\) \+ applyBtn \+ \(applyBtn \? '<p class="projMsg" id="cardApplyMsg"><\/p>' : ''\);/,
+    'the message line only ships when there is a button that could produce one');
+  assert.match(SCRIPT, /var applyEl = \$\('cardApply'\);/);
+  assert.match(SCRIPT, /if \(applyEl && !applyEl\.disabled\) applyEl\.addEventListener\('click', function \(\) \{ submitApply\(applyEl, p\); \}\);/,
+    'an already-Applied card (disabled) is never re-wired to send a second request');
+});