@bongos/core 1.19.1073 → 1.19.1075

package/tests/seam_wiring_guard.mjs

@@ -46,12 +46,12 @@ const nothingExists = () => false;
 // ---------------------------------------------------------------------------
 
 test('reports a declared poller whose file was never shipped, naming module + seam', () => {
-  const r = scanSeamWiring([mod('dev-box', { pollers: ['ghost'] })], { exists: nothingExists });
+  const r = scanSeamWiring([mod('discord', { pollers: ['ghost'] })], { exists: nothingExists });
   assert.equal(r.ok, false);
   assert.equal(r.findings.length, 1);
-  assert.match(r.findings[0], /module "dev-box"/);
+  assert.match(r.findings[0], /module "discord"/);
   assert.match(r.findings[0], /contributes\.pollers: "ghost"/);
-  assert.match(r.findings[0], /modules\/dev-box\/pollers\/ghost\.js does not exist/);
+  assert.match(r.findings[0], /modules\/discord\/pollers\/ghost\.js does not exist/);
   // and it says what to do about it — the three legitimate resolutions
   assert.match(r.findings[0], /Ship the artifact, drop the declaration, or record it in declarativeSeams\.pollers/);
 });
@@ -100,39 +100,39 @@ test('a disciplines entry absent from the registry is reported', () => {
 
 test('a declarative-only entry is recorded, not reported — the load-bearing nuance', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
+    [mod('discord', { pollers: ['discord-bot'] }, { pollers: ['discord-bot'] })],
     { exists: nothingExists },
   );
   assert.equal(r.ok, true, r.findings.join('; '));
-  assert.deepEqual(r.declarative, [{ key: 'dev-box', seam: 'pollers', entry: 'box-lifecycle' }]);
+  assert.deepEqual(r.declarative, [{ key: 'discord', seam: 'pollers', entry: 'discord-bot' }]);
   assert.deepEqual(r.wired, []);
 });
 
 test('the exemption is per-ENTRY, not a blanket skip of the seam', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['box-lifecycle', 'ghost'] }, { pollers: ['box-lifecycle'] })],
+    [mod('discord', { pollers: ['discord-bot', 'ghost'] }, { pollers: ['discord-bot'] })],
     { exists: nothingExists },
   );
   assert.equal(r.ok, false);
   assert.equal(r.findings.length, 1);
   assert.match(r.findings[0], /"ghost"/);
-  assert.deepEqual(r.declarative.map((d) => d.entry), ['box-lifecycle']);
+  assert.deepEqual(r.declarative.map((d) => d.entry), ['discord-bot']);
 });
 
 test('a STALE exemption — the artifact exists now — is itself reported', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
-    { exists: only('modules/dev-box/pollers/box-lifecycle.js') },
+    [mod('discord', { pollers: ['discord-bot'] }, { pollers: ['discord-bot'] })],
+    { exists: only('modules/discord/pollers/discord-bot.js') },
   );
   assert.equal(r.ok, false);
-  assert.match(r.findings[0], /exempts pollers "box-lifecycle" as declarative-only, but modules\/dev-box\/pollers\/box-lifecycle\.js exists/);
+  assert.match(r.findings[0], /exempts pollers "discord-bot" as declarative-only, but modules\/discord\/pollers\/discord-bot\.js exists/);
   assert.match(r.findings[0], /drop the stale declarativeSeams\.pollers entry/);
   assert.deepEqual(r.declarative, [], 'a stale exemption must not also count as declarative-only');
 });
 
 test('an exemption on one seam does not leak to another seam of the same module', () => {
   const r = scanSeamWiring(
-    [mod('dev-box', { pollers: ['x'], uiSections: ['x'] }, { pollers: ['x'] })],
+    [mod('discord', { pollers: ['x'], uiSections: ['x'] }, { pollers: ['x'] })],
     { exists: nothingExists },
   );
   assert.equal(r.findings.length, 1);

package/tests/search_isolation.mjs

@@ -21,8 +21,8 @@
 //      DB in a rolled-back transaction at ship time (the authoritative evidence).
 //
 // Run:  node tests/search_isolation.mjs
-//   (Layer C runs only where a Postgres is reachable — the integration gate / a
-//    dev box; it skips cleanly otherwise so the DB-free unit gate stays green.)
+//   (Layer C runs only where a Postgres is reachable — the integration gate / any
+//    machine with one; it skips cleanly otherwise so the DB-free unit gate stays green.)
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -159,7 +159,7 @@ async function dbReachable() {
 
 const client = await dbReachable();
 if (!client) {
-  console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / on a dev box.');
+  console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / wherever a Postgres is reachable.');
   console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
   // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
   // ended it, so when Postgres was unreachable the Pool survived with libuv handles

package/tests/session_records.mjs

@@ -397,7 +397,7 @@ test('buildSessionDigest accumulates per-model usage (model_usage), skipping syn
 });
 
 test('buildSessionDigest (task 1676): folds unlabeled token-bearing turns into a priceable model bucket', () => {
-  // The dev-box/CI symptom: a token-bearing turn with no model id (or '<synthetic>')
+  // The CI symptom: a token-bearing turn with no model id (or '<synthetic>')
   // contributes to total_tokens but was DROPPED from model_usage — so the digest
   // stored total_tokens>0 yet priced to $0 (ADR 0097). The fix attributes the
   // unaccounted remainder to a real, priceable family bucket so cost-plus pays.

package/tests/session_rename_fallback.mjs

@@ -3,7 +3,7 @@
 // Two artefacts get renamed here, and the whole risk is in the fallback, not the rename:
 //
 //   1. ~/.config/<instance>/gds-session.json → bongos-session.json. This file is on disk on every
-//      builder machine and every live dev box. Renaming it with no fallback signs all of them out
+//      builder machine. Renaming it with no fallback signs all of them out
 //      at once and every /builder-* command dies with 'no Bongos session'.
 //   2. The `gds_session` browser cookie → `bongos_session`. Renaming it logs out every signed-in
 //      session, the owner's included. The read-list is THREE names, because `pms_session` predates
@@ -263,23 +263,6 @@ test('the browser logout clears every session-cookie name', () => {
   }
 });
 
-// ── 6. the box scripts read both names ──────────────────────────────────────────────────────
-
-test('the baked box scripts scan BOTH session filenames', () => {
-  // These run on live dev boxes and are baked at provision time, so they cannot import anything.
-  // A box provisioned AFTER the rename writes only the new name; one provisioned before has only
-  // the old. Missing either silently breaks heartbeat/reporting on half the fleet.
-  for (const rel of ['infra/box-heartbeat.sh', 'infra/box-report-host-keys.sh',
-    'infra/box-report-terminal.sh', 'infra/box-report-version.sh']) {
-    const src = read(rel);
-    const glob = src.split('\n').find((l) => l.includes('for _sess in'));
-    assert.ok(glob, `${rel}: session glob not found`);
-    for (const name of [NEW_FILE, 'gds-session.json']) {
-      assert.ok(glob.includes(name), `${rel}: glob must scan ${name} — got: ${glob.trim()}`);
-    }
-  }
-});
-
 // ── 8. the credential detector follows the rename ───────────────────────────────────────────
 
 test('the artifact-scan credential detector flags a read of EVERY session filename', () => {
@@ -295,7 +278,3 @@ test('the artifact-scan credential detector flags a read of EVERY session filena
     assert.ok(rule.includes(stem), `the detector must still match ${name} — got: ${rule.trim()}`);
   }
 });
-// The box resolver is EXECUTED — a post-rename box and a migrated one — in
-// tests/lib_sh_resolution.mjs, which already owns the extraction harness for that shell
-// block. Deliberately not duplicated here: two harnesses on one block is two things to
-// fix when the names next move (task 1003704).

package/tests/session_start_freshness.mjs

@@ -66,7 +66,7 @@ test('clean main full clone, strictly behind → pull', () => {
 
 // ---------- pull: a clean, strictly-behind checkout self-heals (task 1284) ----------
 // FF is now safe on ANY branch and ANY clone type when ahead===0 and the tree is
-// clean — that's what lets a dev-box worktree (feature branch off a partial clone)
+// clean — that's what lets a worktree (feature branch off a partial clone)
 // stop silently running stale code.
 
 test('feature branch, clean, ahead 0 → pull (self-heal, not warn)', () => {
@@ -75,13 +75,13 @@ test('feature branch, clean, ahead 0 → pull (self-heal, not warn)', () => {
   assert.equal(d.reason, 'safe-fast-forward');
 });
 
-test('partial/blobless clone, clean, ahead 0 → pull (boxes self-heal)', () => {
+test('partial/blobless clone, clean, ahead 0 → pull (partial clones self-heal)', () => {
   const d = decideFreshness({ ...SAFE, isPartialClone: true });
   assert.equal(d.action, 'pull');
   assert.equal(d.reason, 'safe-fast-forward');
 });
 
-test('the dev-box case: feature branch + partial clone + clean + ahead 0 → pull', () => {
+test('the partial-clone worktree case: feature branch + partial clone + clean + ahead 0 → pull', () => {
   const d = decideFreshness({ behind: 12, ahead: 0, branch: 'claude/poincare', hasTrackedChanges: false, isPartialClone: true });
   assert.equal(d.action, 'pull');
   assert.equal(d.reason, 'safe-fast-forward');

package/tests/session_token_hash_db.mjs

@@ -12,7 +12,7 @@
 // (2) is the one worth a real database. It is the whole reason the migration
 // backfills instead of letting sessions re-mint, and it can only be proved by
 // running the actual SQL against rows in the actual old shape. A mistake here
-// does not fail loudly in review — it signs out every builder and every dev box
+// does not fail loudly in review — it signs out every builder
 // on deploy day, including whoever would have to log in to fix it.
 //
 // The sibling `session_token_hash.mjs` is DB-free and pins the hash itself plus

package/tests/ship_card.mjs

@@ -127,7 +127,7 @@ test('confirmed + bailed land: says NOT landed, names the reason, warns', () =>
 });
 
 test('confirmed + bailed land: the bail reaches the printed monospace card', () => {
-  // The monospace card is the ALWAYS-printed fallback (headless, cron, dev box).
+  // The monospace card is the ALWAYS-printed fallback (headless, cron).
   // If the reason stops at the model, the builder still never sees it.
   const out = card.renderMonospaceCard(card.buildCardModel(bailed));
   assert.match(out, /NOT landed/);

package/tests/ship_ci_deploy.mjs

@@ -298,8 +298,8 @@ test('pending is NOT a bail: no reason, so the card keeps "landing automatically
   assert.equal(o.reason, null);
 });
 
-test('strandCommand: a box gets the resume, a laptop gets /merge-mode', () => {
-  // /merge-mode needs gh + a main checkout a dev box doesn't have (task 1052).
+test('strandCommand: a server-publish checkout gets the resume, a laptop gets /merge-mode', () => {
+  // /merge-mode needs gh + a main checkout a credential-less checkout doesn't have (task 1052).
   assert.equal(strandCommand(77, 'server'), 'node scripts/gds/ship.js 77');
   assert.equal(strandCommand(77, 'local'), '/merge-mode');
 });
@@ -352,11 +352,11 @@ test('config/deploy.json — when present ships as ci; absent is fine on the neu
     'To roll back to operator-laptop deploys, set mode "laptop" AND disarm the PROD_DEPLOY_VIA_CI repo var.');
 });
 
-// ---- 6. shouldBailOnFetchFailure: the task-1037 dev-box publish fix ----
+// ---- 6. shouldBailOnFetchFailure: the task-1037 server-publish fix ----
 //
 // autoMerge() ran `git fetch origin main` as a HARD precondition before
-// dispatching to the land path. A credential-less dev box (private origin,
-// scrubbed clone token — ADR 0053) can't fetch, so it bailed here and stranded
+// dispatching to the land path. A credential-less checkout (private origin,
+// no clone token) can't fetch, so it bailed here and stranded
 // every ship at confirmed — never reaching the ADR-0055 server-mediated publish
 // built precisely for it (the bug task 1027 surfaced). The fix makes a fetch
 // failure fatal ONLY off the server path. Truth table, proven without git:
@@ -367,8 +367,8 @@ test('shouldBailOnFetchFailure: fetch OK never bails (regardless of path)', () =
   assert.equal(shouldBailOnFetchFailure(true, 'laptop', 'local'), false);
 });
 
-test('shouldBailOnFetchFailure: fetch FAILED on the dev-box server path does NOT bail', () => {
-  // The fix: ci + server (a credential-less box) proceeds to ciLandServer, which
+test('shouldBailOnFetchFailure: fetch FAILED on the server-publish path does NOT bail', () => {
+  // The fix: ci + server (a credential-less checkout) proceeds to ciLandServer, which
   // bundles against the local origin/main while the server tops up main.
   assert.equal(shouldBailOnFetchFailure(false, 'ci', 'server'), false);
 });
@@ -424,15 +424,15 @@ test('classifyLandOutcome: NOT merged + deploy unconfigured → pending, never s
   assert.equal(classifyLandOutcome({ pr_state: 'closed', merged: false, deploy_status: 'unconfigured' }), 'failed');
 });
 
-// ---- 8. strandNextStep: box-aware recovery guidance, never gh-only /merge-mode on a box (task 1052) ----
-// The #1027 retrospective: a confirmed-strand on a dev box pointed the builder at
-// /merge-mode, which needs gh + a main checkout a box lacks — a dead end.
+// ---- 8. strandNextStep: recovery guidance that fits the push path, never gh-only /merge-mode on the server path (task 1052) ----
+// The #1027 retrospective: a confirmed-strand on a server-publish checkout pointed the builder at
+// /merge-mode, which needs gh + a main checkout that checkout lacks — a dead end.
 
-test('strandNextStep: a dev box (via "server") is pointed at resume, NOT /merge-mode', () => {
+test('strandNextStep: a server-publish checkout (via "server") is pointed at resume, NOT /merge-mode', () => {
   const s = strandNextStep(1027, 'server');
   assert.match(s, /ship\.js 1027/, 'names the resume command with the task id');
   assert.match(s, /resume|resumes/i);
-  assert.match(s, /NOT available/, 'explicitly says /merge-mode is not available on a box');
+  assert.match(s, /NOT available/, 'explicitly says /merge-mode is not available there');
 });
 
 test('strandNextStep: a laptop (via "local") keeps /merge-mode, with resume as the alternative', () => {
@@ -441,25 +441,25 @@ test('strandNextStep: a laptop (via "local") keeps /merge-mode, with resume as t
   assert.match(s, /ship\.js 1027/, 'and resume is offered as the alternative');
 });
 
-test('task 1046: regenerateDiagrams SKIPS on the dev-box (server-publish) path and leaves the tree untouched', () => {
+test('task 1046: regenerateDiagrams SKIPS on the server-publish path and leaves the tree untouched', () => {
   const { execSync } = require('node:child_process');
   const ROOT = path.resolve(__dirname, '..');
   const status = () => execSync('git status --porcelain docs/onboarding/diagrams', { cwd: ROOT }).toString();
   const before = status();
   const prev = process.env.OTB_PUSH_VIA_SERVER;
-  process.env.OTB_PUSH_VIA_SERVER = '1'; // force pushVia()==='server' (a credential-less dev box)
+  process.env.OTB_PUSH_VIA_SERVER = '1'; // force pushVia()==='server' (a credential-less checkout)
   try {
-    // On a box there is no headless browser; attempting the render strands the
+    // On the server-publish path there is no headless browser; attempting the render strands the
     // regenerated .mmd + assertions.json UNCOMMITTED in the tree (#1046). The
     // guard must return early BEFORE any regen/render, so the call is a pure no-op.
     assert.equal(ship.regenerateDiagrams(), 'skipped-server',
-      'on a dev box the diagram regen must skip entirely (no render attempt)');
+      'on the server-publish path the diagram regen must skip entirely (no render attempt)');
   } finally {
     if (prev === undefined) delete process.env.OTB_PUSH_VIA_SERVER;
     else process.env.OTB_PUSH_VIA_SERVER = prev;
   }
   assert.equal(status(), before,
-    '#1046: the dev-box skip must not write or stage any diagram artifact (no uncommitted .mmd/assertions left behind)');
+    '#1046: the server-publish skip must not write or stage any diagram artifact (no uncommitted .mmd/assertions left behind)');
 });
 
 // ---- 9. pickStaleGateReviewRun: the gate-author-trust re-run nudge (task 1169) ----

package/tests/ship_error_shape.mjs

@@ -11,7 +11,7 @@
 //   * interpolating `data.error` into a template string stringifies the
 //     envelope OBJECT — that is the literal "[object Object]";
 //   * `data.error === 'some_code'` never matches, so the graceful branch
-//     behind it (box_scope re-auth, verify-attestation remedy, the
+//     behind it (the re-auth hint, verify-attestation remedy, the
 //     CLAIM_SESSION_MISMATCH explanation) is DEAD CODE against a live server;
 //   * `data.<field>` reads a top-level field that MOVED into `error.details`.
 //

package/tests/ship_premerge.mjs

@@ -43,7 +43,7 @@ t('decidePreMerge: single commit behind still merges', () => {
   assert.equal(ship.decidePreMerge({ branch: 'claude/feat', behind: 1 }).action, 'merge');
 });
 
-// idea #364: a credential-less partial-clone dev box (pushVia 'server') cannot run
+// idea #364: a credential-less partial-clone checkout (pushVia 'server') cannot run
 // the local `git merge origin/main` (no creds to lazily fetch main's blobs) and
 // does not need to — the server reconciles with main at publish time (ADR 0055).
 // So the server path SKIPS the pre-merge regardless of how far behind it is, while

package/tests/ship_resume.mjs

@@ -8,7 +8,7 @@
 // strands the task with no claim:
 //   - grade fail   → task stuck at `completed`  → re-run should RE-GRADE
 //   - merge/deploy fail → task stuck at `confirmed` → re-run should RE-MERGE
-//     (the exact task-1027 dev-box nightmare)
+//     (the exact task-1027 nightmare)
 // evaluateResumeAction is the pure decision behind that routing. We prove the
 // full truth table here — no git, no network.
 //

package/tests/skill_preflight.mjs

@@ -2,8 +2,8 @@
 // guards-skill-declares-machine.
 //
 // THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
-// Mac or the droplet. It was run on a dev box anyway — and ship.js ALREADY knew,
-// because strandNextStep() tells a box "/merge-mode is NOT available here". The
+// Mac or the droplet. It was run on a checkout with no gh and no main checkout anyway — and ship.js
+// ALREADY knew, because strandNextStep() tells such a checkout "/merge-mode is NOT available here". The
 // knowledge existed in two places and neither stopped the run: prose cannot
 // refuse, and the one executable copy sat on a different code path.
 //

package/tests/skip_is_not_pass.mjs

@@ -4,7 +4,7 @@
 //
 // modules/security/tests/sanitize_rebuild.mjs gated its two physical-confinement symlink
 // cases behind canSymlink() and, in the else-branch, printed `ok` and did `passed += 2`.
-// So on any machine that cannot create symlinks — the Windows dev box, a container without
+// So on any machine that cannot create symlinks — a Windows machine, a container without
 // CAP_SYMLINK, a non-admin account — the suite reported two passes for two cases that never
 // ran, and those two are the ONLY coverage of physical confinement.
 //

package/tests/task_visual_slots.mjs

@@ -157,5 +157,36 @@ await test('attach uploads every slot file in the directory to its NAMED slot, a
   assert.equal(code, 0, 'all eight attached');
 });
 
+// task 1004358: every test above drives the bare module router, which is why a
+// real render 413'd live — buildGdsRouter's global 64 KB express.json runs FIRST
+// and rejected any slot body over 64 KB before the route's own 8 MB parser saw
+// it. So this case puts the REAL gate from buildGdsRouter (its first layer)
+// in front of the same router, and sends a body the size of a real render.
+await test('a slot render over 64 KB gets past buildGdsRouter\'s global body cap and attaches (task 1004358)', async () => {
+  const { buildGdsRouter } = require('../src/bongos/routes.js');
+  const gate = buildGdsRouter().stack[0].handle;
+  const whole = express();
+  whole.use(gate);
+  whole.use((req, res, next) => { res.fail = (code, status, extra) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code, ...(extra || {}) }); next(); });
+  whole.use(require('../modules/lifecycle/routes/visuals.js')());
+  whole.use((err, req, res, next) => res.status(err.status || 500).json({ error: err.type || 'error' }));
+  const srv = http.createServer(whole);
+  await new Promise((r) => srv.listen(0, '127.0.0.1', r));
+  const at = `http://127.0.0.1:${srv.address().port}`;
+  // A real PNG padded past the cap: ~120 KB, the size of the renders that failed live.
+  const big = Buffer.concat([PNG, Buffer.alloc(120 * 1024)]);
+  const body = JSON.stringify({ image_b64: big.toString('base64'), content_type: 'image/png' });
+  assert.ok(body.length > 64 * 1024, 'the body is over the global cap');
+  try {
+    const post = (url) => fetch(at + url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body });
+    const control = await post('/tasks/5002/not-a-bypassed-path');
+    assert.equal(control.status, 413, 'the gate under test really is the 64 KB cap');
+    const r = await post('/tasks/5002/visuals/before-desktop-light');
+    const j = await r.json();
+    assert.equal(r.status, 201, `the render attaches, not 413: ${JSON.stringify(j)}`);
+    assert.equal(j.slot, 'before-desktop-light');
+  } finally { await new Promise((r) => srv.close(r)); }
+});
+
 fs.rmSync(TMP, { recursive: true, force: true });
 summary();

package/tests/terms_acceptance.mjs

@@ -495,12 +495,12 @@ await ta('no hub session, no acceptance — the unauthenticated caller is bounce
   assert.equal(pool.accounts.size, 0, 'an account (and an acceptance) was created for a caller with no session');
 });
 
-await ta('a dev-box session cannot mint an acceptance either (ADR 0016 trust boundary)', async () => {
+await ta('a session of an undeclared source (a leftover dev-box token) cannot mint an acceptance either', async () => {
   SESSION = { ...HUB_SESSION, source: 'box' };
   pool.accounts.clear();
   const res = await authorize();
   assert.equal(res.status, 403);
-  assert.equal(pool.accounts.size, 0, 'a box-scoped session recorded a platform T&C acceptance');
+  assert.equal(pool.accounts.size, 0, 'a session of an undeclared source recorded a platform T&C acceptance');
 });
 
 // ===========================================================================

package/tests/upgrade.mjs

@@ -1055,7 +1055,7 @@ function moduleLibStub(verdict) {
 t('preflightModules: a DISABLED incompatible module is returned as a warning, not dropped', () => {
   const dir = scratchConsumer();
   mkdirSync(join(dir, 'modules'), { recursive: true });
-  const warned = { key: 'stale-catalog-entry', coreVersion: '^1.0.0', enabled: false, satisfied: false, maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } };
+  const warned = { key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: false, maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } };
   const res = u.preflightModules({ instanceDir: dir, targetVersion: '2.0.0' }, {
     moduleLib: moduleLibStub({ ok: true, blocking: [], warnings: [warned], deprecations: [], expired: [], core: '2.0.0' }),
   });
@@ -1084,7 +1084,7 @@ t('preflightModules: no modules/ dir returns every collection empty (a vanilla c
 t('reportModulePreflight: prints the rotted-but-disabled module WITH its maintainer named', () => {
   const out = [];
   const mods = {
-    warnings: [{ key: 'stale-catalog-entry', coreVersion: '^1.0.0', maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } }],
+    warnings: [{ key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } }],
     deprecations: [], expired: [],
   };
   u.reportModulePreflight(mods, '2.0.0', { log: (s) => out.push(s), err: (s) => out.push(s) });
@@ -1122,8 +1122,8 @@ t('runUpgrade: a REFUSED bump still reports the non-blocking module findings', a
     err: (s) => out.push(String(s)),
     moduleLib: moduleLibStub({
       ok: false,
-      blocking: [{ key: 'enabled-breaker', coreVersion: '^1.0.0', enabled: true, satisfied: false }],
-      warnings: [{ key: 'stale-catalog-entry', coreVersion: '^1.0.0', maintenance: { status: 'orphaned', note: 'author unreachable' } }],
+      blocking: [{ key: 'enabled-breaker', version: '1.0.0', coreVersion: '^1.0.0', enabled: true, satisfied: false }],
+      warnings: [{ key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', maintenance: { status: 'orphaned', note: 'author unreachable' } }],
       deprecations: [], expired: [], core: '2.0.0',
     }),
   });

package/tests/watch_sealed_floor.mjs

@@ -19,7 +19,6 @@
 //   builder.roster.read     → metic    (ADR 0157, was archon)
 //   session.search          → metic    (ADR 0157, was archon)
 //   audit_log.read          → metic    (ADR 0157, was archon)
-//   box.fleet.manage        → metic    (ADR 0157, was archon)
 //
 // A hardcoded 'metic' is the same defect one ADR later, which is why the fix reads
 // the floor off the DENIAL: requirePermission already rides `details.floors` on

package/tests/wizard_draft_resume.mjs

@@ -90,9 +90,9 @@ test('post-auth: the real step is rendered', () => {
 
 test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
   assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
-  // 8 is the done panel, reached by its own branch above this slice; 0 is the gate. Neither
+  // 9 is the done panel (8 before task 1004351), reached by its own branch above this slice; 0 is the gate. Neither
   // is a resumable wizard position, so the placeholder is allowed to stand.
-  for (const bad of [0, 8, 99]) {
+  for (const bad of [0, 9, 99]) {
     assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
   }
 });

package/tests/wizard_intent_resume.mjs

@@ -15,12 +15,12 @@
 // ruled out the task's other option (drop the record at a terminal state).
 //
 // The reset fires only when there is a SECOND DRAFT to lose, and the draft's own step is
-// what says so. A landed create clears DRAFT_KEY — but show(8) then persists the done
+// what says so. A landed create clears DRAFT_KEY — but show(9) then persists the done
 // panel's position straight back into it, so a plain "is there a draft?" test is always
 // yes and would skip the reset forever, leaving the finished project's name sitting in
 // the fresh form. (That is exactly what the first cut of this change shipped into a
 // render: "still watching Mercury" above a name field still reading "Mercury".) Only
-// steps 1-7 are wizard steps; anything else is the done panel's own bookkeeping.
+// steps 1-8 are wizard steps; anything else is the done panel's own bookkeeping.
 //
 // Harness: there is no jsdom in this repo, so this follows tests/wizard_draft_resume.mjs
 // and tests/project_door_ui.mjs — slice the real region out of the page's INLINE script
@@ -57,8 +57,8 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
   assert.ok(offerSlice, 'paintResumeOffer() was not found in projects.html');
   assert.match(enterSlice, /if \(focus && !resumeIntent\) \{/, 'the intent branch is part of the slice');
   assert.match(enterSlice, /startProgress\(created\.id\);/, 'so is the resume branch it guards');
-  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 7/,
-    'the STORED draft\'s step decides, not state.step — state.step is 8 for the whole life of a finished standup');
+  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 8/,
+    'the STORED draft\'s step decides, not state.step — state.step is 9 for the whole life of a finished standup');
   assert.match(SCRIPT, /if \(created && created\.id\) \{ enterCreated\(created, !!focus\); return; \}/,
     'enter() still hands the created record straight to it');
 });
@@ -72,7 +72,7 @@ function runEnter({ focus, resumeIntent = false, draft = null, record }) {
   const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0 };
   // state.step is the DONE step for the whole life of a finished standup — the value
   // a draft-blind reading would have trusted
-  const state = { step: draft ? draft.step : 8, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
+  const state = { step: draft ? draft.step : 9, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
   const sandbox = {
     record, focus, resumeIntent, state,
     DRAFT_KEY: 'draft',
@@ -98,7 +98,7 @@ const REC = { id: 'inst-1', name: 'Acme', slug: 'acme', domain: 'acme.example',
 
 test('a reload / Back / identity settle (focus false) still resumes the done panel, watch and all', () => {
   const { calls, state } = runEnter({ focus: false, record: REC });
-  assert.deepEqual(calls.show, [[8, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
+  assert.deepEqual(calls.show, [[9, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
   assert.equal(calls.resets, 0, 'nothing is reset — this is the same standup continuing');
   assert.equal(calls.done, 1, 'the checklist is re-rendered');
   assert.deepEqual(calls.progress, ['inst-1'], 'the progress watch is restarted from the record');
@@ -126,7 +126,7 @@ test('…and the standup stays one click away, named, on the resume link', () =>
 
 test('the resume link gets the done panel back — the record was never cleared', () => {
   const { calls, sandbox } = runEnter({ focus: true, resumeIntent: true, record: REC });
-  assert.deepEqual(calls.show, [[8, true]], 'a deliberate resume moves focus to the done panel');
+  assert.deepEqual(calls.show, [[9, true]], 'a deliberate resume moves focus to the done panel');
   assert.deepEqual(calls.progress, ['inst-1'], 'the watch comes back with it');
   assert.equal(sandbox.resumeIntent, false, 'the flag is ONE-SHOT — the next plain nav click must mean "new" again');
   assert.deepEqual(calls.offer, [null], 'and the offer comes down behind it');
@@ -144,17 +144,28 @@ test('a second draft already under way is NOT wiped by navigating back to the wi
 });
 
 test('the done panel\'s own saved step is NOT a second draft — it must not block the reset', () => {
-  // Caught in a render, not in a unit test: show(8) calls saveDraft(), so DRAFT_KEY is
+  // Caught in a render, not in a unit test: show(9) calls saveDraft(), so DRAFT_KEY is
   // non-empty again the moment a create lands. Reading "is there a draft?" left the
   // finished project's name in the fresh form, under a line offering to resume it.
-  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 8, name: 'Mercury' } });
+  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 9, name: 'Mercury' } });
   assert.equal(calls.resets, 1, 'the done step is bookkeeping, not a project being typed');
   assert.deepEqual(calls.show, [[1, false]], 'out-of-range steps land on the name step');
   assert.equal(state.name, '', 'and the finished project\'s name does not survive into it');
   assert.equal(calls.done, 0, 'never back onto the done panel');
 });
 
-test('a draft whose step is missing or junk resets too — only 1-7 preserves anything', () => {
+test('a draft on the app step or the review is live too — the last two numbered steps (task 1004351)', () => {
+  // The app step moved the review from 7 to 8. A guard left at 7 would reset a second
+  // project sitting on its review, silently wiping it.
+  for (const step of [7, 8]) {
+    const { calls, state } = runEnter({ focus: true, record: REC, draft: { step } });
+    assert.equal(calls.resets, 0, `step ${step} is a live draft`);
+    assert.deepEqual(calls.show, [[step, true]]);
+    assert.equal(state.step, step);
+  }
+});
+
+test('a draft whose step is missing or junk resets too — only 1-8 preserves anything', () => {
   for (const draft of [{ step: 0 }, { step: 9 }, { name: 'half-typed' }]) {
     const { calls } = runEnter({ focus: true, record: REC, draft });
     assert.equal(calls.resets, 1, `step ${JSON.stringify(draft.step)} is not a wizard step`);

package/tests/wizard_preselect_why.mjs

@@ -1,12 +1,12 @@
 // tests/wizard_preselect_why.mjs — the module picker always says WHY the preselect is on
 // (task 1003684).
 //
-// The bug as filed said the starter-bundle "why" sentence was being dropped for
-// Game + small-team. It was not: `adjustments` is a DELTA, and a rule that fires without
-// changing anything claims nothing (ADR 0243). The game bundle is already
-// ['dev-box','discord'] and the small-team rule ADDS dev-box, so the rule fires, moves
-// nothing, and correctly reports []. Verified against live core 1.19.580:
-//   byTeamShape['small-team'] => {"bundle":["dev-box","discord"],"adjustments":[]}
+// The bug as filed said the starter-bundle "why" sentence was being dropped for one
+// type + team-shape pair. It was not: `adjustments` is a DELTA, and a rule that fires
+// without changing anything claims nothing (ADR 0243). When a type's bundle already holds
+// the module a rule adds — today the game bundle is ['discord'] and the community rule
+// ADDS discord — the rule fires, moves nothing, and correctly reports []:
+//   byTeamShape.community => {"bundle":["discord"],"adjustments":[]}
 //
 // The real defect is what the owner then saw: two extras pre-switched-on with no reason
 // beside them — precisely the state the paint site's own comment calls out, "a preselect an
@@ -46,13 +46,13 @@ const BUNDLES = {
       type: 'game',
       label: 'Game starter',
       summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
-      bundle: ['dev-box', 'discord'],
+      bundle: ['discord'],
       byTeamShape: {
         // the live case: the rule fires, moves nothing, reports nothing
-        'small-team': { bundle: ['dev-box', 'discord'], adjustments: [] },
+        community: { bundle: ['discord'], adjustments: [] },
         solo: {
-          bundle: ['discord'],
-          adjustments: [{ reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.' }],
+          bundle: [],
+          adjustments: [{ reason: 'You are building this alone, so the community space is off.' }],
         },
       },
     },
@@ -62,9 +62,9 @@ const BUNDLES = {
       summary: 'Extra agents to run the reading and the experiments the question needs.',
       bundle: ['agents'],
       byTeamShape: {
-        'small-team': {
-          bundle: ['agents', 'dev-box'],
-          adjustments: [{ reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.' }],
+        community: {
+          bundle: ['agents', 'discord'],
+          adjustments: [{ reason: 'You said an open community is building this, so somewhere for it to gather is switched on.' }],
         },
       },
     },
@@ -83,16 +83,16 @@ function why({ projType, teamShape, modules = null, bundles = BUNDLES }) {
   return Array.from(sandbox.__out);
 }
 
-test('game + small-team: no delta, so the type\'s own summary is the reason', () => {
+test('game + community: no delta, so the type\'s own summary is the reason', () => {
   // This is the exact combination from the live walk that surfaced the bug.
-  const out = why({ projType: 'game', teamShape: 'small-team' });
+  const out = why({ projType: 'game', teamShape: 'community' });
   assert.deepEqual(out, ['Somewhere for players to gather, and a place to walk a change through before anyone plays it.']);
 });
 
 test('a REAL adjustment still speaks for itself — the summary does not displace it', () => {
-  const out = why({ projType: 'research', teamShape: 'small-team' });
+  const out = why({ projType: 'research', teamShape: 'community' });
   assert.equal(out.length, 1);
-  assert.match(out[0], /shared environment/);
+  assert.match(out[0], /somewhere for it to gather/);
   assert.doesNotMatch(out[0], /reading and the experiments/, 'the rule\'s sentence wins, not the summary');
 });
 
@@ -128,7 +128,7 @@ test('before the bundles read lands, nothing is claimed', () => {
 
 test('every sentence returned is a plain string, so the paint site can escape it directly', () => {
   for (const t of ['game', 'research']) {
-    for (const s of ['small-team', 'solo', null]) {
+    for (const s of ['community', 'solo', null]) {
       for (const line of why({ projType: t, teamShape: s })) {
         assert.equal(typeof line, 'string', `${t}/${s} yielded a non-string`);
       }