@bongos/core 1.19.1073 → 1.19.1075

package/tests/projects_hub_module_picker.mjs

@@ -59,21 +59,22 @@ const PAYLOAD = {
   // `summary` is part of every real bundle row and is the why-line's FLOOR since task
   // 1003684 — the sentence shown when no rule moved anything. The fixture carried none
   // before that, which quietly made every "no adjustment, no sentence" case pass for the
-  // wrong reason. These are the real strings from starter-bundles.js.
+  // wrong reason. Shaped like the real strings in starter-bundles.js (the live payload is pinned
+  // separately, at the bottom of the team-shape section).
   bundles: [
-    { type: 'game', bundle: ['dev-box', 'discord'], summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.' },
+    { type: 'game', bundle: ['npm-release', 'discord'], summary: 'Somewhere for players to gather, and a way to publish each release of the game.' },
     { type: 'research', bundle: ['agents'], summary: 'Extra agents to run the reading and the experiments the question needs.' },
-    { type: 'business', bundle: ['agents', 'dev-box'], summary: 'A place to try a change before customers see it, and agents to look it over first.' },
+    { type: 'business', bundle: ['agents', 'npm-release'], summary: 'A way to publish each release, and agents to look it over first.' },
     { type: 'non-profit', bundle: ['discord'], summary: 'Somewhere the community around the cause can gather and be heard.' },
     { type: 'not-sure', bundle: [], summary: 'Just the core, and nothing else to decide today. Add modules whenever you know what you need.' },
   ],
   // `aliases` — search words a row is findable under that its own copy never uses
-  // (task 1003500, amending ADR 0244 §3). Never rendered, like the key. dev-box
+  // (task 1003500, amending ADR 0244 §3). Never rendered, like the key. npm-release
   // carries none on purpose, so the "a row without aliases still matches on its own
   // words" path is exercised by the same fixture rather than by a special case.
   optional: [
     { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets.', aliases: ['bots', 'assistants', 'automation'] },
-    { key: 'dev-box', label: 'Dev boxes', summary: 'A cloud workspace where a change can be tried out first.' },
+    { key: 'npm-release', label: 'npm releases', summary: 'Publishes each release of your package to the registry.' },
     { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news.', aliases: ['chatroom', 'talk', 'community'] },
   ],
 };
@@ -92,18 +93,18 @@ const TAILORED = {
   bundles: PAYLOAD.bundles.map((b) => {
     if (b.type === 'game') {
       return { ...b, byTeamShape: {
-        // solo: the shared environment comes off
-        solo: { bundle: ['discord'], adjustments: [{ rule: 'building-alone-needs-no-shared-environment', effect: 'remove', module: 'dev-box', reason: 'You are building this alone, so the shared cloud environment is off.' }] },
-        // small-team: the rule wants dev-box, the bundle already has it — a rule
+        // solo: the release pipeline comes off
+        solo: { bundle: ['discord'], adjustments: [{ rule: 'building-alone-needs-no-release-pipeline', effect: 'remove', module: 'npm-release', reason: 'You are building this alone, so the release pipeline is off.' }] },
+        // small-team: the rule wants npm-release, the bundle already has it — a rule
         // that changed nothing claims nothing
-        'small-team': { bundle: ['dev-box', 'discord'], adjustments: [] },
-        community: { bundle: ['dev-box', 'discord'], adjustments: [] },
+        'small-team': { bundle: ['npm-release', 'discord'], adjustments: [] },
+        community: { bundle: ['npm-release', 'discord'], adjustments: [] },
       } };
     }
     if (b.type === 'research') {
       return { ...b, byTeamShape: {
         solo: { bundle: ['agents'], adjustments: [] },
-        'small-team': { bundle: ['agents', 'dev-box'], adjustments: [{ rule: 'a-team-shares-one-environment', effect: 'add', module: 'dev-box', reason: 'A small team gets one shared environment to build in.' }] },
+        'small-team': { bundle: ['agents', 'npm-release'], adjustments: [{ rule: 'a-team-shares-one-release-pipeline', effect: 'add', module: 'npm-release', reason: 'A small team gets one release pipeline to publish through.' }] },
         community: { bundle: ['agents', 'discord'], adjustments: [{ rule: 'a-community-needs-somewhere-to-gather', effect: 'add', module: 'discord', reason: 'You said an open community is building this, so somewhere for it to gather is switched on.' }] },
       } };
     }
@@ -232,16 +233,16 @@ test('the declared project type preselects its bundle, and the rest of the catal
 
   // Assert — every opt-in module is a row; the bundle's two are on
   const rows = h.rows();
-  assert.deepEqual(rows.map((r) => r.key), ['agents', 'dev-box', 'discord'], 'the whole opt-in catalog is offered');
-  assert.deepEqual(rows.filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord'], 'the game bundle is preselected');
+  assert.deepEqual(rows.map((r) => r.key), ['agents', 'npm-release', 'discord'], 'the whole opt-in catalog is offered');
+  assert.deepEqual(rows.filter((r) => r.pressed).map((r) => r.key), ['npm-release', 'discord'], 'the game bundle is preselected');
   assert.equal(rows.find((r) => r.key === 'agents').pressed, false, 'and nothing else is');
   // each row carries the copy an owner can actually read
-  assert.equal(rows[1].label, 'Dev boxes');
-  assert.match(rows[1].summary, /cloud workspace/);
+  assert.equal(rows[1].label, 'npm releases');
+  assert.match(rows[1].summary, /package to the registry/);
 });
 
 test('a different type preselects a different bundle, and "not sure" preselects nothing', async () => {
-  for (const [type, expected] of [['research', ['agents']], ['business', ['agents', 'dev-box']], ['non-profit', ['discord']], ['not-sure', []], [null, []]]) {
+  for (const [type, expected] of [['research', ['agents']], ['business', ['agents', 'npm-release']], ['non-profit', ['discord']], ['not-sure', []], [null, []]]) {
     const h = boot({ state: { projType: type } });
     await h.open();
     assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), expected, `type=${type}`);
@@ -272,8 +273,8 @@ test('a toggle flips one module and leaves the rest of the preselect standing',
   h.click('agents');
 
   // Assert
-  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'dev-box']);
-  assert.deepEqual(h.state.modules, ['agents', 'dev-box'], 'and the draft holds the real answer, in catalog order');
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'npm-release']);
+  assert.deepEqual(h.state.modules, ['agents', 'npm-release'], 'and the draft holds the real answer, in catalog order');
   assert.ok(h.saves() >= 2, 'each toggle is written to the draft');
 });
 
@@ -285,7 +286,7 @@ test('the first toggle is what turns "not answered" into an answer', async () =>
   assert.equal(h.forCreate(), undefined, 'so the create request carries no modules key');
 
   h.click('agents');
-  assert.deepEqual(h.forCreate(), ['agents', 'dev-box', 'discord'], 'after a touch it carries the whole set');
+  assert.deepEqual(h.forCreate(), ['agents', 'npm-release', 'discord'], 'after a touch it carries the whole set');
 });
 
 test('switching every module off is a real answer, not a reset to the bundle', async () => {
@@ -293,7 +294,7 @@ test('switching every module off is a real answer, not a reset to the bundle', a
   // said "none", and Next must not hand them the bundle back.
   const h = boot({ state: { projType: 'game' } });
   await h.open();
-  h.click('dev-box');
+  h.click('npm-release');
   h.click('discord');
 
   assert.deepEqual(h.state.modules, []);
@@ -314,7 +315,7 @@ test('Skip walks past WITHOUT answering, so the server applies the bundle the pa
   assert.deepEqual(h.shown, [5], 'it advances to the Home step');
   assert.equal(h.state.modules, null, 'and answers nothing');
   assert.equal(h.forCreate(), undefined);
-  assert.deepEqual(h.picked(), ['dev-box', 'discord'], 'while the set they were shown is still the set they get');
+  assert.deepEqual(h.picked(), ['npm-release', 'discord'], 'while the set they were shown is still the set they get');
 });
 
 test('Skip does not erase a toggle already made', async () => {
@@ -325,7 +326,7 @@ test('Skip does not erase a toggle already made', async () => {
   h.click('agents');
   h.skip();
 
-  assert.deepEqual(h.state.modules, ['agents', 'dev-box', 'discord']);
+  assert.deepEqual(h.state.modules, ['agents', 'npm-release', 'discord']);
 });
 
 test('Next CONFIRMS the set on screen — looking at it and accepting it is not the same as never being asked', async () => {
@@ -334,8 +335,8 @@ test('Next CONFIRMS the set on screen — looking at it and accepting it is not
 
   h.next();
 
-  assert.deepEqual(h.state.modules, ['dev-box', 'discord'], 'the preselect becomes the answer');
-  assert.deepEqual(h.forCreate(), ['dev-box', 'discord'], 'and rides the create request');
+  assert.deepEqual(h.state.modules, ['npm-release', 'discord'], 'the preselect becomes the answer');
+  assert.deepEqual(h.forCreate(), ['npm-release', 'discord'], 'and rides the create request');
 });
 
 test('changing the project type re-preselects while nothing has been said, and never after', async () => {
@@ -414,7 +415,7 @@ test('the review names the set even when the picker was never opened (task 10023
   // and the module NAMES are not known. "None — just the core" would be a false
   // promise on the last screen before Create: the server is about to apply the
   // type's bundle. The row says that instead, then repaints when the read lands.
-  const h = boot({ state: { projType: 'game', step: 7 } });
+  const h = boot({ state: { projType: 'game', step: 8 } });   // 8 = the review since task 1004351
 
   // Arrange + Act — the review asks for the value before the read can answer
   const first = h.extrasRow();
@@ -425,7 +426,7 @@ test('the review names the set even when the picker was never opened (task 10023
 
   await h.settle();
   assert.equal(h.reviews(), 1, 'the review repaints itself once the names are known');
-  assert.equal(h.extrasRow(), 'Dev boxes, Discord', 'and then it names them');
+  assert.equal(h.extrasRow(), 'npm releases, Discord', 'and then it names them');
 });
 
 test('the review reads an answered picker back, empty included', async () => {
@@ -454,26 +455,26 @@ test('the team shape adjusts the type bundle, and the panel says why in the owne
   // Act
   await h.open();
 
-  // Assert — the shared environment came off, and the reason is on screen
+  // Assert — the release pipeline came off, and the reason is on screen
   assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['discord'],
-    'solo drops the dev box the game bundle would have preselected');
+    'solo drops npm releases, which the game bundle would have preselected');
   assert.equal(h.whyShown(), true);
-  assert.deepEqual(h.why(), ['You are building this alone, so the shared cloud environment is off.']);
+  assert.deepEqual(h.why(), ['You are building this alone, so the release pipeline is off.']);
 });
 
 test('a rule that changed nothing claims nothing', async () => {
-  // small-team ADDS dev-box, and the game bundle already carries it. A reason
+  // small-team ADDS npm-release, and the game bundle already carries it. A reason
   // shown for a change that did not happen is a claim the owner cannot check.
   const h = boot({ state: { projType: 'game', teamShape: 'small-team' }, payload: TAILORED });
   await h.open();
 
-  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['npm-release', 'discord']);
   // No adjustment, so no adjustment-sentence — the rule still claims nothing. But the
   // panel is not silent: the TYPE explains its own preselect (task 1003684), because two
   // extras switched on with no reason beside them is the state ADR 0237 calls worse than
   // no preselect at all. The rule's voice and the type's voice are different things.
-  assert.deepEqual(h.why(), ['Somewhere for players to gather, and a place to walk a change through before anyone plays it.']);
-  assert.ok(!h.why().some((s) => /shared cloud environment|somewhere for it to gather is switched on/.test(s)),
+  assert.deepEqual(h.why(), ['Somewhere for players to gather, and a way to publish each release of the game.']);
+  assert.ok(!h.why().some((s) => /release pipeline|somewhere for it to gather is switched on/.test(s)),
     'and no RULE sentence is invented for a change that did not happen');
   assert.equal(h.whyShown(), true, 'the block carries the type\'s reason');
 });
@@ -496,7 +497,7 @@ test('answering the About step later re-preselects, with no second read', async
   h.state.teamShape = 'small-team';
   h.render();
 
-  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'dev-box']);
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'npm-release']);
   assert.equal(h.fetches(), 1, 'and the answer cost no round trip');
 });
 
@@ -520,9 +521,9 @@ test('once the owner has answered, the reasons go — the panel stops arguing',
   await h.open();
   assert.equal(h.why().length, 1);
 
-  h.click('dev-box');
+  h.click('npm-release');
 
-  assert.deepEqual(h.state.modules, ['dev-box', 'discord'], 'their toggle stands over the rule');
+  assert.deepEqual(h.state.modules, ['npm-release', 'discord'], 'their toggle stands over the rule');
   assert.deepEqual(h.why(), [], 'and the rule stops explaining a set that is no longer its own');
   assert.equal(h.whyShown(), false);
 });
@@ -533,10 +534,10 @@ test('a payload with no byTeamShape degrades to the untailored bundle, never to
   const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: PAYLOAD });
   await h.open();
 
-  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['npm-release', 'discord']);
   // Degraded, but still explained: with no byTeamShape there is no adjustment to report,
   // and the type's own summary is exactly the untailored reason (task 1003684).
-  assert.deepEqual(h.why(), ['Somewhere for players to gather, and a place to walk a change through before anyone plays it.']);
+  assert.deepEqual(h.why(), ['Somewhere for players to gather, and a way to publish each release of the game.']);
 });
 
 test('an off-vocabulary team shape adjusts nothing', async () => {
@@ -545,10 +546,10 @@ test('an off-vocabulary team shape adjusts nothing', async () => {
   const h = boot({ state: { projType: 'game', teamShape: 'a-huge-corporation' }, payload: TAILORED });
   await h.open();
 
-  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['npm-release', 'discord']);
   // No rule fires, so nothing is CLAIMED about the unknown shape — the sentence shown is
   // the type's, which is true regardless of who is building it (task 1003684).
-  assert.deepEqual(h.why(), ['Somewhere for players to gather, and a place to walk a change through before anyone plays it.']);
+  assert.deepEqual(h.why(), ['Somewhere for players to gather, and a way to publish each release of the game.']);
 });
 
 test('a couldn\'t-load read clears any reasons it had already painted', async () => {
@@ -617,17 +618,17 @@ test('the picker and the server resolve the same set for every answer an owner c
 // not move.
 // ─────────────────────────────────────────────────────────────────────────────
 
-const DEV_BOX = PAYLOAD.optional[1];
+const NPM_RELEASE = PAYLOAD.optional[1];
 
 test('the matcher reads a row\'s own words — its name, its summary and its key', () => {
   // Still lexical, never semantic: the only words it knows are the ones the owner
   // can see, plus the two it cannot — the key, and the declared aliases below.
   const h = boot({ state: { projType: 'game' } });
 
-  assert.equal(h.matches(DEV_BOX, 'boxes'), true, 'by a word in the name');
-  assert.equal(h.matches(DEV_BOX, 'workspace'), true, 'by a word in the summary');
-  assert.equal(h.matches(DEV_BOX, 'dev-box'), true, 'by the key');
-  assert.equal(h.matches(DEV_BOX, 'discord'), false, 'and never by a word that is in none of them');
+  assert.equal(h.matches(NPM_RELEASE, 'releases'), true, 'by a word in the name');
+  assert.equal(h.matches(NPM_RELEASE, 'package'), true, 'by a word in the summary');
+  assert.equal(h.matches(NPM_RELEASE, 'npm-release'), true, 'by the key');
+  assert.equal(h.matches(NPM_RELEASE, 'discord'), false, 'and never by a word that is in none of them');
 });
 
 // ── task 1003500: the aliases, and the gap they close ────────────────────────
@@ -686,9 +687,9 @@ test('aliases narrow like any other word, and a row without them still matches o
   const discord = PAYLOAD.optional[2];
 
   assert.equal(h.matches(discord, 'chat news'), true, 'an alias AND a summary word still narrows to the row that has both');
-  assert.equal(h.matches(discord, 'chat workspace'), false, 'an alias does not rescue a term the row cannot answer');
-  assert.equal(h.matches(DEV_BOX, 'chat'), false, 'and a row declaring no aliases is not matched by another row\'s');
-  assert.equal(h.matches(DEV_BOX, 'workspace'), true, 'while its own words keep working untouched');
+  assert.equal(h.matches(discord, 'chat package'), false, 'an alias does not rescue a term the row cannot answer');
+  assert.equal(h.matches(NPM_RELEASE, 'chat'), false, 'and a row declaring no aliases is not matched by another row\'s');
+  assert.equal(h.matches(NPM_RELEASE, 'package'), true, 'while its own words keep working untouched');
 });
 
 test('typing an alias filters the band to that row, and the count says so', async () => {
@@ -704,14 +705,14 @@ test('typing an alias filters the band to that row, and the count says so', asyn
 test('a term matches as a SUBSTRING, so a half-typed word still finds its module', () => {
   const h = boot({ state: { projType: 'game' } });
 
-  assert.equal(h.matches(DEV_BOX, 'work'), true, 'the owner is still typing');
-  assert.equal(h.matches(DEV_BOX, 'ace'), true, 'even mid-word — a dumb filter beats a clever one that finds nothing');
+  assert.equal(h.matches(NPM_RELEASE, 'pack'), true, 'the owner is still typing');
+  assert.equal(h.matches(NPM_RELEASE, 'kag'), true, 'even mid-word — a dumb filter beats a clever one that finds nothing');
 });
 
 test('matching is case-insensitive in both directions', () => {
   const h = boot({ state: { projType: 'game' } });
 
-  assert.equal(h.matches(DEV_BOX, 'DEV BOXES'), true, 'a shouted query finds a title-cased row');
+  assert.equal(h.matches(NPM_RELEASE, 'NPM RELEASES'), true, 'a shouted query finds a title-cased row');
   assert.equal(h.matches(PAYLOAD.optional[0], 'ai'), true, 'and a quiet one finds a shouted row');
 });
 
@@ -719,15 +720,15 @@ test('every term must match — typing more words narrows, it never widens', ()
   // AND, not OR. An owner adding a word is telling us the list is still too long.
   const h = boot({ state: { projType: 'game' } });
 
-  assert.equal(h.matches(DEV_BOX, 'cloud change'), true, 'both words are in the row');
-  assert.equal(h.matches(DEV_BOX, 'cloud discord'), false, 'one of them is not, so the row is out');
+  assert.equal(h.matches(NPM_RELEASE, 'package registry'), true, 'both words are in the row');
+  assert.equal(h.matches(NPM_RELEASE, 'package discord'), false, 'one of them is not, so the row is out');
 });
 
 test('an empty search is not a search — every row stays', () => {
   const h = boot({ state: { projType: 'game' } });
 
-  assert.equal(h.matches(DEV_BOX, ''), true);
-  assert.equal(h.matches(DEV_BOX, '   '), true, 'and a box holding only spaces is the same as an empty one');
+  assert.equal(h.matches(NPM_RELEASE, ''), true);
+  assert.equal(h.matches(NPM_RELEASE, '   '), true, 'and a box holding only spaces is the same as an empty one');
 });
 
 test('typing filters the band to the rows that answer, in catalog order', async () => {
@@ -737,21 +738,21 @@ test('typing filters the band to the rows that answer, in catalog order', async
   assert.equal(h.rows().length, 3, 'the whole catalog before anything is typed');
 
   // Act — a word from one row's NAME
-  h.type('boxes');
+  h.type('releases');
 
   // Assert
-  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box']);
+  assert.deepEqual(h.rows().map((r) => r.key), ['npm-release']);
 });
 
 test('a summary word and a key find their row just as a name word does', async () => {
   const h = boot({ state: { projType: 'game' } });
   await h.open();
 
-  h.type('workspace');
-  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box'], 'by summary');
+  h.type('package');
+  assert.deepEqual(h.rows().map((r) => r.key), ['npm-release'], 'by summary');
 
-  h.type('dev-box');
-  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box'], 'by key');
+  h.type('npm-release');
+  assert.deepEqual(h.rows().map((r) => r.key), ['npm-release'], 'by key');
 
   h.type('DISCORD');
   assert.deepEqual(h.rows().map((r) => r.key), ['discord'], 'and case is not part of the question');
@@ -761,10 +762,10 @@ test('two terms narrow to the rows that carry both', async () => {
   const h = boot({ state: { projType: 'game' } });
   await h.open();
 
-  h.type('cloud change');
-  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box']);
+  h.type('package registry');
+  assert.deepEqual(h.rows().map((r) => r.key), ['npm-release']);
 
-  h.type('cloud discord');
+  h.type('package discord');
   assert.deepEqual(h.rows(), [], 'and no row carries both of these');
 });
 
@@ -785,7 +786,7 @@ test('a switched-on module the search is HIDING is still switched on', async ()
   // toggles, and a view must not be able to edit it.
   const h = boot({ state: { projType: 'game' } });
   await h.open();
-  assert.deepEqual(h.picked(), ['dev-box', 'discord'], 'the game bundle is on');
+  assert.deepEqual(h.picked(), ['npm-release', 'discord'], 'the game bundle is on');
 
   // Act — search for the one module that is OFF, hiding both that are on
   h.type('agents');
@@ -793,7 +794,7 @@ test('a switched-on module the search is HIDING is still switched on', async ()
   // Assert
   assert.deepEqual(h.rows().map((r) => r.key), ['agents'], 'only the match is on screen');
   assert.equal(h.rows()[0].pressed, false, 'and it is off, as it was');
-  assert.deepEqual(h.picked(), ['dev-box', 'discord'], 'the two hidden ones are still switched on');
+  assert.deepEqual(h.picked(), ['npm-release', 'discord'], 'the two hidden ones are still switched on');
   assert.equal(h.state.modules, null, 'and typing answered nothing on the owner\'s behalf');
   assert.match(h.filterNote(), /2 extras are switched on/, 'the count under the field says so out loud');
   assert.match(h.filterNote(), /including any this search is hiding/, 'and that some of them are hidden');
@@ -820,16 +821,16 @@ test('with nothing switched on the count says only what is shown', async () => {
 });
 
 test('the review names the hidden picks too — a filter never reaches the create request', async () => {
-  const h = boot({ state: { projType: 'game', step: 7 } });
+  const h = boot({ state: { projType: 'game', step: 8 } });   // 8 = the review since task 1004351
   await h.open();
   h.click('agents');
-  assert.deepEqual(h.forCreate(), ['agents', 'dev-box', 'discord']);
+  assert.deepEqual(h.forCreate(), ['agents', 'npm-release', 'discord']);
 
   h.type('discord');
 
   assert.deepEqual(h.rows().map((r) => r.key), ['discord'], 'one row on screen');
-  assert.deepEqual(h.forCreate(), ['agents', 'dev-box', 'discord'], 'three modules in the answer');
-  assert.equal(h.extrasRow(), 'Extra agents, Dev boxes, Discord', 'and the review names all three');
+  assert.deepEqual(h.forCreate(), ['agents', 'npm-release', 'discord'], 'three modules in the answer');
+  assert.equal(h.extrasRow(), 'Extra agents, npm releases, Discord', 'and the review names all three');
 });
 
 test('clearing the search brings every row back, untouched', async () => {
@@ -840,8 +841,8 @@ test('clearing the search brings every row back, untouched', async () => {
 
   h.type('');
 
-  assert.deepEqual(h.rows().map((r) => r.key), ['agents', 'dev-box', 'discord']);
-  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord'],
+  assert.deepEqual(h.rows().map((r) => r.key), ['agents', 'npm-release', 'discord']);
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['npm-release', 'discord'],
     'with the preselect exactly as it was before the search');
   assert.equal(h.filterNote(), '', 'and the count goes quiet again');
 });
@@ -851,11 +852,11 @@ test('a toggle made while filtered lands in the answer in catalog order, and the
   const h = boot({ state: { projType: 'non-profit' } });
   await h.open();
 
-  h.type('workspace');
-  h.click('dev-box');
+  h.type('package');
+  h.click('npm-release');
 
-  assert.deepEqual(h.state.modules, ['dev-box', 'discord'], 'catalog order, not click order');
-  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box'], 'and the search is still the search');
+  assert.deepEqual(h.state.modules, ['npm-release', 'discord'], 'catalog order, not click order');
+  assert.deepEqual(h.rows().map((r) => r.key), ['npm-release'], 'and the search is still the search');
   assert.equal(h.rows()[0].pressed, true, 'the row they just switched on shows it');
 });
 

package/tests/projects_hub_pre_uat.mjs

@@ -241,11 +241,10 @@ test('no wall-clock promises, no operator vocabulary on the stranger’s path',
   assert.doesNotMatch(HUB, /about five minutes/, 'the empty state');
   assert.doesNotMatch(HUB, /a runner does the real work/, 'the mine fine print');
   assert.doesNotMatch(SCRIPT, /pinned platform core/, 'the review Shape row');
-  /* The wizard creates hosting_shape 'cloud-host', whose owner-facing name became
-     "cloud host" at ADR 0323 — "its own server" was ambiguous between that shape and
-     a dedicated one, and said nothing about WHO runs it. The assertion still guards the
-     same property this test is about: owner vocabulary, and no wall-clock promise. */
-  assert.match(SCRIPT, /\['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release'\]/);
+  /* Since ADR 0345 (task 1004351) the review names the HALL as hosted by us and gives the
+     APP its own row. The assertion still guards the same property this test is about:
+     owner vocabulary, and no wall-clock promise. */
+  assert.ok(SCRIPT.includes("['Builders\\' hall', 'Hosted by us, on the platform’s current release'],"), 'the review names the hall as hosted by us');
   assert.doesNotMatch(HUB, /\/new-project<\/code> assistant/, 'the done panel’s closing line');
   assert.match(HUB, /Sign-in switches on after the GitHub steps|switch sign-in on/, 'the address step does not promise sign-in "just works"');
   assert.doesNotMatch(HUB, /Sign-in, sharing, everything just works/);

package/tests/provision.mjs

@@ -130,25 +130,25 @@ t('planCorePinRefresh: a trailing file: pin → refresh; a current one → no-op
   // The W3 shape: repo pins 1.19.2, control plane runs 1.19.196 → refresh (heals
   // the silent-rollback hazard before the next repo-driven deploy).
   assert.deepEqual(
-    P.planCorePinRefresh({ pinnedDep: 'file:vendor/bongos-core-1.19.2.tgz', coreVersion: '1.19.196' }),
+    P.planCorePinRefresh({ pinnedDep: 'file:vendor/bongos-core-1.19.2.tgz', version: '1.0.0', coreVersion: '1.19.196' }),
     { action: 'refresh', pinned: '1.19.2' });
   // Pin already matches the running core → nothing to commit.
   assert.deepEqual(
-    P.planCorePinRefresh({ pinnedDep: 'file:vendor/bongos-core-1.19.196.tgz', coreVersion: '1.19.196' }),
+    P.planCorePinRefresh({ pinnedDep: 'file:vendor/bongos-core-1.19.196.tgz', version: '1.0.0', coreVersion: '1.19.196' }),
     { action: 'current', pinned: '1.19.196' });
   // A non-canonical file: pin can't be compared → refresh heals it to canonical.
   assert.equal(
-    P.planCorePinRefresh({ pinnedDep: 'file:vendor/core.tgz', coreVersion: '1.19.196' }).action,
+    P.planCorePinRefresh({ pinnedDep: 'file:vendor/core.tgz', version: '1.0.0', coreVersion: '1.19.196' }).action,
     'refresh');
 });
 
 t('planCorePinRefresh: registry pins and absent deps are skipped, never rewritten', () => {
   // Registry pin (ADR 0134): npm resolves it within its range — not ours to vendor.
-  assert.equal(P.planCorePinRefresh({ pinnedDep: '^1.19.100', coreVersion: '1.19.196' }).action, 'skip');
-  assert.equal(P.planCorePinRefresh({ pinnedDep: '1.19.196', coreVersion: '1.19.196' }).action, 'skip');
+  assert.equal(P.planCorePinRefresh({ pinnedDep: '^1.19.100', version: '1.0.0', coreVersion: '1.19.196' }).action, 'skip');
+  assert.equal(P.planCorePinRefresh({ pinnedDep: '1.19.196', version: '1.0.0', coreVersion: '1.19.196' }).action, 'skip');
   // No @bongos/core dependency at all → not ours to invent.
-  assert.equal(P.planCorePinRefresh({ pinnedDep: undefined, coreVersion: '1.19.196' }).action, 'skip');
-  assert.equal(P.planCorePinRefresh({ pinnedDep: '', coreVersion: '1.19.196' }).action, 'skip');
+  assert.equal(P.planCorePinRefresh({ pinnedDep: undefined, version: '1.0.0', coreVersion: '1.19.196' }).action, 'skip');
+  assert.equal(P.planCorePinRefresh({ pinnedDep: '', version: '1.0.0', coreVersion: '1.19.196' }).action, 'skip');
 });
 
 t('safeVersionLabel: passes clean semver, rejects any shell metacharacter', () => {

package/tests/provisioning_capacity.mjs

@@ -248,7 +248,7 @@ await ta('dry-run measures nothing and refuses nothing, even on a full box; an u
 
 await ta('statusCapacityLine prints "box at N of M" for the CLI', async () => {
   delete process.env.PROVISION_BOX_CEILING;
-  // fleetCapacity reads THIS host's /proc/meminfo (absent on a Windows dev box → default);
+  // fleetCapacity reads THIS host's /proc/meminfo (absent on a Windows machine → default);
   // the line must carry the count and the source whichever it is.
   const line = await statusCapacityLine(fakeDb(12));
   assert.match(line, /control-plane box: 12 of \d+ project slots taken \((measured|default)/);

package/tests/provisioning_recommendations.mjs

@@ -147,7 +147,8 @@ test('a rule whose module the bundle already carries records no adjustment', ()
 });
 
 test('a removal rule whose module is absent records no adjustment', () => {
-  // Arrange — `non-profit` is `discord` alone, so solo\'s dev-box removal is a no-op.
+  // Arrange — `non-profit` is `discord` alone, and `solo` names no live rule (the removal rule for
+  // it left with the dev-box module, task 1003886), so there is nothing to remove or to claim.
   const answers = { type: 'non-profit', team_shape: 'solo' };
 
   // Act

package/tests/provisioning_starter_bundles.mjs

@@ -37,7 +37,6 @@ import {
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   HUB_ONLY_MODULES,
-  RETIRED_MODULES,
   RULED_TEAM_SHAPES,
   bundleForProjectType,
   allStarterBundles,
@@ -336,9 +335,6 @@ test('the opt-in catalog declared for the picker IS the on-disk opt-in set', ()
   const onDisk = manifestsOnDisk();
   const optInOnDisk = [...onDisk.values()]
     .filter((m) => m.default !== true && !HUB_ONLY_MODULES.includes(m.key))
-    // A RETIRED module is still on disk while its removal lands, and must already
-    // be gone from the catalog — so it is the one permitted absence (task 1003886).
-    .filter((m) => !RETIRED_MODULES.includes(m.key))
     .map((m) => m.key)
     .sort();
 
@@ -350,24 +346,6 @@ test('the opt-in catalog declared for the picker IS the on-disk opt-in set', ()
     'the picker\'s catalog has drifted from the manifests — a module was added, removed, or flipped its default');
 });
 
-test('a RETIRED module is withdrawn everywhere an owner could still reach it', () => {
-  // The retirement is only real if it holds at every offer point at once. A key
-  // left in any one of them is still a module a new project can end up with,
-  // which is exactly what the withdrawal exists to stop (task 1003886).
-  for (const key of RETIRED_MODULES) {
-    assert.ok(!OPTIONAL_MODULES.some((m) => m.key === key),
-      `retired module "${key}" is still a row the creation picker offers`);
-    for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
-      assert.ok(!bundle.modules.includes(key),
-        `retired module "${key}" is still preselected by the "${type}" bundle`);
-    }
-    // Posting it directly is a real answer that resolves to nothing, not a
-    // non-answer: the key is DROPPED, exactly as an unknown one would be.
-    assert.deepEqual(normalizeModuleSelection([key]), [],
-      `retired module "${key}" is still accepted when an owner posts it directly`);
-  }
-});
-
 test('every opt-in module carries owner-facing copy, and no module jargon rides along', () => {
   for (const row of OPTIONAL_MODULES) {
     assert.ok(row.label && row.label.length <= 40, `"${row.key}" needs a short label`);

package/tests/publish_branch_route.mjs

@@ -1,7 +1,7 @@
 // tests/publish_branch_route.mjs
 //
 // Coverage for server-mediated branch publish (ADR 0055 / task 1025) — the path
-// that lets a dev-box builder (no GitHub push credential) ship: the box uploads a
+// that lets a builder on a checkout with no GitHub push credential ship: the client uploads a
 // thin git bundle, the server pushes it + opens the PR + auto-merges with the
 // server-side GITHUB_PUSH_TOKEN.
 //
@@ -9,12 +9,10 @@
 //   1. src/bongos/github-push.js — the push/PR/status logic, exercised through the
 //      injectable exec + fetch seams (deps.exec / deps.fetchImpl / deps.token /
 //      deps.repoInfo / deps.mkdtemp / deps.rmtmp).
-//   2. The route wiring — a STRUCTURAL guard that POST/GET publish* are
-//      requireBuilder and DO NOT carry auth.allowBoxScope. That absence is what
-//      makes a box-scoped session 403 (#919/ADR 0053). box_scope_session.mjs
-//      proves requireBuilder's box gate; this proves the publish routes never opt
-//      out of it — a future edit that added allowBoxScope would reintroduce the
-//      "a leaked box token can ship arbitrary code" hole, and this test fails first.
+//   2. The route wiring — a STRUCTURAL guard that POST/GET publish* and the
+//      attest route are requireBuilder-gated, so an unauthenticated caller (or a
+//      session of an undeclared source — tests/government_session_scope.mjs) can
+//      never publish.
 //
 // Run:  node tests/publish_branch_route.mjs
 
@@ -407,8 +405,7 @@ await t('getPublishStatus: merged, workflow EXISTS but no successful run yet →
 });
 
 // ===========================================================================
-// Layer 2 — STRUCTURAL guard: the publish routes are requireBuilder and carry
-// NO allowBoxScope (so a box-scoped session is denied — #919 regression guard).
+// Layer 2 — STRUCTURAL guard: the publish routes are requireBuilder-gated.
 // ===========================================================================
 function findRouteLayer(router, routePath, method) {
   return router.stack.find(
@@ -419,36 +416,31 @@ function handlesOf(layer) {
   return layer.route.stack.map((s) => s.handle);
 }
 
-await t('POST /tasks/:id/publish-branch: requireBuilder present, allowBoxScope ABSENT', async () => {
+await t('POST /tasks/:id/publish-branch: requireBuilder present', async () => {
   const router = buildTasksRouter();
   const layer = findRouteLayer(router, '/tasks/:id/publish-branch', 'post');
   assert.ok(layer, 'the publish-branch POST route must be registered');
   const handles = handlesOf(layer);
   assert.ok(handles.includes(auth.requireBuilder), 'must be requireBuilder-gated');
-  assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope — a box session must be denied (#919)');
 });
 
-await t('GET /tasks/:id/publish-status: requireBuilder present, allowBoxScope ABSENT', async () => {
+await t('GET /tasks/:id/publish-status: requireBuilder present', async () => {
   const router = buildTasksRouter();
   const layer = findRouteLayer(router, '/tasks/:id/publish-status', 'get');
   assert.ok(layer, 'the publish-status GET route must be registered');
   const handles = handlesOf(layer);
   assert.ok(handles.includes(auth.requireBuilder), 'must be requireBuilder-gated');
-  assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope');
 });
 
 // task 1169 (ADR 0058): the laptop ci-land attest endpoint. It posts the trustless
-// gate-author-trust commit status for a Metic+ author, so the SAME #919 box-scope
-// guard the publish routes carry applies here — a box session must reauth, never
-// self-attest. The structural guard proves it never opts out of requireBuilder's
-// box gate (no allowBoxScope), matching publish-branch / publish-status exactly.
-await t('POST /tasks/:id/attest-gate: requireBuilder present, allowBoxScope ABSENT', async () => {
+// gate-author-trust commit status for a Metic+ author, so it carries the same
+// requireBuilder gate as publish-branch / publish-status.
+await t('POST /tasks/:id/attest-gate: requireBuilder present', async () => {
   const router = buildTasksRouter();
   const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
   assert.ok(layer, 'the attest-gate POST route must be registered');
   const handles = handlesOf(layer);
   assert.ok(handles.includes(auth.requireBuilder), 'must be requireBuilder-gated');
-  assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope — a box session must reauth, never self-attest (#919)');
 });
 
 // task 1002645: the attest call is the ONE moment the laptop ci-land tells the