@bongos/core 1.19.373 → 1.19.375

package/tests/joinability_invite_only.mjs

@@ -0,0 +1,192 @@
+// tests/joinability_invite_only.mjs — the invite-only door (task 1003044).
+//
+// The project's joinability is read through branding(), memoized for the
+// process — so, like tests/platform_visibility_gate.mjs, the pack is set to
+// 'invite_only' BEFORE the first require and the REAL app is booted on it. What
+// this proves, DB-free (the door answers before any lookup):
+//   - the one reader every admission surface uses says invite_only, and the
+//     legacy open-enrolment flag does not override the stricter choice;
+//   - the shared sign-in decision admits an invited first-timer and nobody else;
+//   - the public POST /access-requests refuses with the plain sentence, on
+//     every API prefix, before validating the body;
+//   - the Archon invite route is behind the session gate;
+//   - the manifest carries the policy for the hub's "runs as" line.
+// The 'open' boot is tests/joinability_open.mjs; 'apply' (the default pack) is
+// every other boot test in the suite plus tests/auth_admission_gate.mjs.
+//
+// Run:  node --test tests/joinability_invite_only.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// set BEFORE anything that could read branding() is first required (a hoisted
+// ESM import would run before this line)
+const brandingFile = path.join(os.tmpdir(), `bongos-join-invite-${process.pid}.json`);
+fs.writeFileSync(brandingFile, JSON.stringify({
+  identity: { productName: 'Spike Harbor' },
+  project: { platformVisibility: 'public', joinability: 'invite_only' },
+}));
+process.env.GDS_BRANDING_FILE = brandingFile;
+
+const { joinabilityMode, openEnrollmentEnabled, firstTimeAdmissionBlocked, firstAdminLogin } = require('../src/bongos/auth-admission.js');
+const platformMod = require('../src/platform-server.js');
+
+function withLegacyFlag(val, fn) {
+  const prev = process.env.OTB_OPEN_XENOS_ENROLLMENT;
+  if (val === undefined) delete process.env.OTB_OPEN_XENOS_ENROLLMENT;
+  else process.env.OTB_OPEN_XENOS_ENROLLMENT = val;
+  try { return fn(); } finally {
+    if (prev === undefined) delete process.env.OTB_OPEN_XENOS_ENROLLMENT;
+    else process.env.OTB_OPEN_XENOS_ENROLLMENT = prev;
+  }
+}
+
+// ── the decision ─────────────────────────────────────────────────────────────
+
+test('invite_only: the one reader says so, and open enrolment is off', () => {
+  withLegacyFlag(undefined, () => {
+    assert.equal(joinabilityMode(), 'invite_only');
+    assert.equal(openEnrollmentEnabled(), false);
+  });
+});
+
+test('invite_only: the legacy OPEN_XENOS_ENROLLMENT flag does not override the stricter choice', () => {
+  withLegacyFlag('1', () => {
+    assert.equal(joinabilityMode(), 'invite_only');
+    assert.equal(openEnrollmentEnabled(), false);
+    assert.equal(firstTimeAdmissionBlocked({ existing: null, approved: false, login: 'stranger' }), true);
+  });
+});
+
+test('invite_only: only an invite admits a first-timer; a member always passes', () => {
+  withLegacyFlag(undefined, () => {
+    assert.equal(firstTimeAdmissionBlocked({ existing: null, approved: false, login: 'stranger' }), true, 'no invite → refused');
+    assert.equal(firstTimeAdmissionBlocked({ existing: null, approved: true, login: 'invited-one' }), false, 'an Archon-created invite admits');
+    assert.equal(firstTimeAdmissionBlocked({ existing: { id: 3 }, approved: false, login: 'member' }), false, 'a member is never locked out');
+  });
+});
+
+test('invite_only: the configured firstAdmin is a standing invite the door never closes (ADR 0062 §6 — intended)', () => {
+  const prev = process.env.OTB_FIRST_ADMIN;
+  process.env.OTB_FIRST_ADMIN = 'founding-owner';
+  try {
+    assert.equal(firstAdminLogin(), 'founding-owner');
+    assert.equal(firstTimeAdmissionBlocked({ existing: null, approved: false, login: 'Founding-Owner' }), false);
+  } finally {
+    if (prev === undefined) delete process.env.OTB_FIRST_ADMIN;
+    else process.env.OTB_FIRST_ADMIN = prev;
+  }
+});
+
+// ── the real booted app ──────────────────────────────────────────────────────
+
+let server, port;
+before(async () => {
+  server = http.createServer(platformMod.buildPlatformApp());
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => {
+  await new Promise((r) => server.close(r));
+  delete process.env.GDS_BRANDING_FILE;
+  try { fs.unlinkSync(brandingFile); } catch { /* already gone */ }
+});
+
+function request(pathname, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method,
+      headers: {
+        host: 'spike.test',
+        ...(payload ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } : {}),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+test('booted invite_only: the public POST /access-requests refuses with the plain sentence, on every prefix', async () => {
+  for (const p of ['/api/gds/access-requests', '/api/bongos/access-requests']) {
+    const res = await request(p, { method: 'POST', body: { github_login: 'octocat', note: 'hi' } });
+    assert.equal(res.status, 403, p);
+    const j = JSON.parse(res.body);
+    assert.equal(j.error && j.error.code, 'invite_only', `${p}: the ADR 0116 envelope`);
+    assert.match(j.error.message, /invite-only/, 'says which door this is');
+    assert.match(j.error.message, /sign in with GitHub/i, 'and names the one way in');
+  }
+});
+
+test('booted invite_only: the door answers before the body is read — nothing about the applicant is consulted', async () => {
+  const res = await request('/api/gds/access-requests', { method: 'POST', body: {} });
+  assert.equal(res.status, 403, 'not a 400 — the refusal is the door’s, not the form’s');
+  assert.equal(JSON.parse(res.body).error.code, 'invite_only');
+});
+
+test('booted invite_only: the Archon invite route sits behind the session gate', async () => {
+  const res = await request('/api/gds/access-requests/invite', { method: 'POST', body: { github_login: 'octocat' } });
+  assert.equal(res.status, 401);
+  assert.equal(JSON.parse(res.body).error.code, 'unauthenticated');
+});
+
+test('booted invite_only: the manifest carries the policy the hub reads back', async () => {
+  const res = await request('/api/gds/instance');
+  assert.equal(res.status, 200);
+  const m = JSON.parse(res.body);
+  assert.equal(m.brand.project.joinability, 'invite_only');
+  assert.equal(m.admission.policy, 'invite-only', 'the legacy binary field agrees');
+});
+
+// ── the copy, where a stranger meets it ──────────────────────────────────────
+
+const src = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+test('the web sign-in refusal names the invite-only door instead of sending a stranger to a request form', () => {
+  const auth = src('src/bongos/routes/auth.js');
+  assert.match(auth, /auth\.joinabilityMode\(\) === 'invite_only'/);
+  assert.match(auth, /'This project is invite-only'/);
+  assert.match(auth, /doesn’t take applications/);
+});
+
+test('the hall landing renders one door per mode, and its form collapses on the door’s own answers', () => {
+  const hall = src('modules/hall-ui/public/hall-render.js');
+  const door = (hall.match(/function landingDoorHtml\(mode\) \{[\s\S]*?\n  \}\n/) || [''])[0];
+  assert.ok(door, 'landingDoorHtml() must exist');
+  assert.match(door, /mode === 'open'/);
+  assert.match(door, /mode === 'invite_only'/);
+  assert.match(door, /there is nothing to apply for here/);
+  assert.match(door, /id="access-request-form"/, 'the apply door keeps the request form');
+  assert.match(hall, /\$\{landingDoorHtml\(joinabilityMode\(\)\)\}/, 'renderLanding paints the door the pack names');
+  assert.match(hall, /code === 'invite_only' \|\| code === 'open_enrollment'/, 'the refusal codes are handled, not shown red');
+});
+
+test('the CLI says invite-only and stops, rather than filing a request the project refuses', () => {
+  const cli = src('scripts/gds/login.js');
+  assert.match(cli, /joinability === 'invite_only'/);
+  assert.match(cli, /is invite-only — it doesn’t take applications/);
+});
+
+test('the Watch page offers the Archon an invite by username — the way in when nobody can apply', () => {
+  const watch = src('modules/hall-ui/public/watch.js');
+  assert.match(watch, /\/access-requests\/invite/);
+  assert.match(watch, /nobody can apply, so this is how people get in/);
+  const gate = (watch.match(/function renderGate\(data, target\) \{[\s\S]*?\n  \}\n/) || [''])[0];
+  assert.ok(gate, 'renderGate() must exist');
+  assert.equal((gate.match(/wireInviteForm\(target\)/g) || []).length, 2, 'the form is wired in BOTH branches — an empty queue and a listed one');
+  assert.equal((gate.match(/inviteFormHtml\(\)/g) || []).length, 2, 'and rendered in both');
+});

package/tests/joinability_open.mjs

@@ -0,0 +1,89 @@
+// tests/joinability_open.mjs — the open door (task 1003044).
+//
+// The pack is set to 'open' BEFORE the first require (branding() memoizes for
+// the process), then the real app boots on it. Proves: open enrolment follows
+// the setting (a first-timer self-enrols, no invite needed), the public POST
+// /access-requests says "no request needed — sign in", and the manifest reports
+// the door both ways. The invite-only boot is tests/joinability_invite_only.mjs.
+//
+// Run:  node --test tests/joinability_open.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// set BEFORE anything that could read branding() is first required
+const brandingFile = path.join(os.tmpdir(), `bongos-join-open-${process.pid}.json`);
+fs.writeFileSync(brandingFile, JSON.stringify({
+  identity: { productName: 'Spike Harbor' },
+  project: { platformVisibility: 'public', joinability: 'open' },
+}));
+process.env.GDS_BRANDING_FILE = brandingFile;
+
+const { joinabilityMode, openEnrollmentEnabled, firstTimeAdmissionBlocked } = require('../src/bongos/auth-admission.js');
+const platformMod = require('../src/platform-server.js');
+
+test('open: the setting alone opens the door — no legacy flag needed', () => {
+  const prev = process.env.OTB_OPEN_XENOS_ENROLLMENT;
+  delete process.env.OTB_OPEN_XENOS_ENROLLMENT;
+  try {
+    assert.equal(joinabilityMode(), 'open');
+    assert.equal(openEnrollmentEnabled(), true);
+    assert.equal(firstTimeAdmissionBlocked({ existing: null, approved: false, login: 'stranger' }), false, 'a first-timer self-enrols');
+  } finally {
+    if (prev !== undefined) process.env.OTB_OPEN_XENOS_ENROLLMENT = prev;
+  }
+});
+
+let server, port;
+before(async () => {
+  server = http.createServer(platformMod.buildPlatformApp());
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => {
+  await new Promise((r) => server.close(r));
+  delete process.env.GDS_BRANDING_FILE;
+  try { fs.unlinkSync(brandingFile); } catch { /* already gone */ }
+});
+
+function request(pathname, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method,
+      headers: {
+        host: 'spike.test',
+        ...(payload ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } : {}),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: data }));
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+test('booted open: the public POST /access-requests says no request is needed — sign in', async () => {
+  const res = await request('/api/gds/access-requests', { method: 'POST', body: { github_login: 'octocat' } });
+  assert.equal(res.status, 409);
+  const j = JSON.parse(res.body);
+  assert.equal(j.error.code, 'open_enrollment');
+  assert.match(j.error.message, /open/);
+  assert.match(j.error.message, /[Ss]ign in with GitHub/);
+});
+
+test('booted open: the manifest reports the door both ways', async () => {
+  const m = JSON.parse((await request('/api/gds/instance')).body);
+  assert.equal(m.brand.project.joinability, 'open');
+  assert.equal(m.admission.policy, 'open');
+});

package/tests/module_api.mjs

@@ -32,6 +32,7 @@ const PUBLISHED_SURFACE = [
   'llmCache', // BV1.R73: shared LLM-cost cache (1.6.0; tracked domain leak)
   'llmPricing', // BV1.R77: shared token→USD pricing (1.7.0; tracked domain leak — economy carve)
   'branding', 'clientBranding', 'userAgent', 'resolveEnv', 'readConfigFileSync', 'configHome', 'configPath', // userAgent added 1.12.0 (BV1.R86; github-push UA)
+  'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',

package/tests/profile_nudge_prefs.mjs

@@ -0,0 +1,97 @@
+// tests/profile_nudge_prefs.mjs — the "Complete your profile" nudge shaper
+// (task 1002802 / P06, goal 1000045).
+//
+// The nudge replaced the profile-setup wizard spec Decision 2 rejected: a
+// DISMISSIBLE line item in the hall's needs-attention inbox, shown when bio or
+// preferred_disciplines are empty. These pin the pure decision layer — what
+// counts as missing, when the line shows, and that a dismissal is durable and
+// reversible without disturbing the sibling knobs sharing behavior_prefs.
+//
+// Run:  node --test tests/profile_nudge_prefs.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const p = require('../modules/builder-settings/profile-nudge-prefs.js');
+
+test('missingProfileFields: empty, whitespace, and absent all count as missing', () => {
+  assert.deepEqual(p.missingProfileFields({ bio: '', preferredDisciplines: [] }), ['bio', 'disciplines']);
+  assert.deepEqual(p.missingProfileFields({ bio: '   \n\t ', preferredDisciplines: [] }), ['bio', 'disciplines']);
+  assert.deepEqual(p.missingProfileFields({}), ['bio', 'disciplines']);
+  assert.deepEqual(p.missingProfileFields({ bio: null, preferredDisciplines: null }), ['bio', 'disciplines']);
+});
+
+test('missingProfileFields: a real value on either side drops only that entry', () => {
+  assert.deepEqual(p.missingProfileFields({ bio: 'I build things', preferredDisciplines: [] }), ['disciplines']);
+  assert.deepEqual(p.missingProfileFields({ bio: '', preferredDisciplines: ['engineer'] }), ['bio']);
+  assert.deepEqual(p.missingProfileFields({ bio: 'x', preferredDisciplines: ['engineer'] }), []);
+});
+
+test('missingProfileFields: a non-array disciplines value is missing, not a crash', () => {
+  assert.deepEqual(p.missingProfileFields({ bio: 'x', preferredDisciplines: 'engineer' }), ['disciplines']);
+  assert.deepEqual(p.missingProfileFields({ bio: 'x', preferredDisciplines: {} }), ['disciplines']);
+});
+
+test('nudgeDismissed: defaults to NOT dismissed; only a real boolean overrides', () => {
+  assert.equal(p.nudgeDismissed({}), false);
+  assert.equal(p.nudgeDismissed(null), false);
+  assert.equal(p.nudgeDismissed({ profile_nudge_dismissed: true }), true);
+  assert.equal(p.nudgeDismissed({ profile_nudge_dismissed: false }), false);
+  // Garbage in the blob must not read as dismissed — that would silence the
+  // nudge for a builder who never dismissed it.
+  assert.equal(p.nudgeDismissed({ profile_nudge_dismissed: 'yes' }), false);
+  assert.equal(p.nudgeDismissed({ profile_nudge_dismissed: 1 }), false);
+});
+
+test('shouldNudge: shows only when something is missing AND not dismissed', () => {
+  const missing = { bio: '', preferredDisciplines: [] };
+  const complete = { bio: 'x', preferredDisciplines: ['engineer'] };
+  assert.equal(p.shouldNudge({ behaviorPrefs: {}, ...missing }), true);
+  assert.equal(p.shouldNudge({ behaviorPrefs: { profile_nudge_dismissed: true }, ...missing }), false);
+  assert.equal(p.shouldNudge({ behaviorPrefs: {}, ...complete }), false);
+  assert.equal(p.shouldNudge({ behaviorPrefs: { profile_nudge_dismissed: true }, ...complete }), false);
+});
+
+test('describeForApi: reports what is missing even while dismissed (show is the gate)', () => {
+  const d = p.describeForApi({ profile_nudge_dismissed: true }, { bio: '', preferredDisciplines: [] });
+  assert.equal(d.dismissed, true);
+  assert.equal(d.show, false, 'a dismissed nudge never shows');
+  assert.deepEqual(d.missing, ['bio', 'disciplines'], 'but the API still says what is empty');
+  assert.equal(d.override, true);
+  assert.equal(d.default_dismissed, false);
+});
+
+test('validatePatch: accepts dismissed true/false/null, refuses everything else', () => {
+  assert.deepEqual(p.validatePatch({ dismissed: true }), { ok: true, patch: { profile_nudge_dismissed: true } });
+  assert.deepEqual(p.validatePatch({ dismissed: false }), { ok: true, patch: { profile_nudge_dismissed: false } });
+  assert.deepEqual(p.validatePatch({ dismissed: null }), { ok: true, patch: { profile_nudge_dismissed: null } });
+  assert.deepEqual(p.validatePatch({}), { ok: true, patch: {} }, 'empty body is a valid no-op');
+  assert.equal(p.validatePatch({ dismissed: 'yes' }).ok, false);
+  assert.equal(p.validatePatch({ nope: true }).ok, false);
+  assert.equal(p.validatePatch(null).ok, false);
+  assert.equal(p.validatePatch([]).ok, false);
+});
+
+test('applyPatch: null clears the key; sibling behavior knobs are never disturbed', () => {
+  const existing = { wandering: 'focused', widgets: false, interaction: { technical_level: 'engineer' } };
+  const set = p.applyPatch(existing, { profile_nudge_dismissed: true });
+  assert.equal(set.profile_nudge_dismissed, true);
+  assert.equal(set.wandering, 'focused');
+  assert.equal(set.widgets, false);
+  assert.deepEqual(set.interaction, { technical_level: 'engineer' });
+  // Clearing removes the key entirely (back to the sparse default) and still
+  // leaves the siblings alone — the undismiss path.
+  const cleared = p.applyPatch(set, { profile_nudge_dismissed: null });
+  assert.equal('profile_nudge_dismissed' in cleared, false);
+  assert.equal(cleared.wandering, 'focused');
+  assert.equal(p.nudgeDismissed(cleared), false, 'cleared → the nudge can return');
+  // Pure: the input blob is not mutated.
+  assert.equal('profile_nudge_dismissed' in existing, false);
+});
+
+test('the reserved key is the documented one (behavior_prefs is shared)', () => {
+  assert.equal(p.RESERVED_KEY, 'profile_nudge_dismissed');
+  assert.equal(p.DEFAULT_DISMISSED, false);
+});

package/tests/projects_hub.mjs

@@ -910,8 +910,8 @@ test('the manage view ships as real markup with the four settings homes (C7)', (
     'mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
     assert.match(HUB, new RegExp(`id="${id}"`), `${id} must be real markup`);
   }
-  // and the not-yet copy a crawler reads is in the document, not a template string
-  assert.match(HUB, /isn’t wired up/, 'the honest empty states live in the markup');
+  // every settings home is live now (tasks 1003042 / 1003043 / 1003044) — no not-yet copy remains
+  assert.doesNotMatch(HUB, /isn’t wired up/, 'no section is a placeholder any more');
 });
 
 test('the manage view balances its own tree, like the wizard', () => {
@@ -1214,3 +1214,77 @@ test('the settings reads fire on entry + tab return only — never on the in-fli
   assert.match(load, /res\.status === 401 \? signInAgain\(\)/, 'a lapsed session is said as sign-in, not as an outage');
   assert.match(load, /var asked = manageId;/, 'a stale answer must never describe a newer project');
 });
+
+/* ── how people join (task 1003044): the joinability toggle — the visibility
+   section's shape, key for key: the choice from the platform's row, what the
+   project runs from its own manifest (brand.project.joinability), the save's
+   push.message shown verbatim and never painted as the live state. ── */
+
+test('the joinability section is live markup with its body slot and a sibling fold', () => {
+  assert.match(HUB, /id="mJoin"/, 'the volatile slot is real markup, not JS-built');
+  assert.match(HUB, /id="mJoinWhat"/, 'the what-changes fold ships with the page');
+  const card = (HUB.match(/<div class="card" id="mJoinability">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the joinability card must be extractable');
+  const slotAt = card.indexOf('id="mJoin"');
+  const foldAt = card.indexOf('id="mJoinWhat"');
+  assert.ok(slotAt > 0 && foldAt > slotAt, 'the fold sits outside the slot it must survive');
+  assert.doesNotMatch(card, /isn’t wired up|For now, people apply to join/, 'the placeholder copy is gone — the section is real now');
+  const fold = (HUB.match(/<details class="finePrint" id="mJoinWhat">[\s\S]*?<\/details>/) || [''])[0];
+  for (const label of ['Anyone can join', 'Apply to join', 'Invite only']) {
+    assert.match(fold, new RegExp(`<b>${label}</b>`), `${label} is explained in the fold`);
+  }
+  assert.match(fold, /already members stay members/, 'a change never unseats a member');
+  assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
+});
+
+test('the joinability choices are the platform’s vocabulary, each in plain words, and the pick is a real radio group', () => {
+  assert.match(SCRIPT, /var JOIN_OPTIONS = \{\s*open: \{ label: 'Anyone can join'/);
+  assert.match(SCRIPT, /apply: \{ label: 'Apply to join'/);
+  assert.match(SCRIPT, /invite_only: \{ label: 'Invite only'/);
+  const render = fnHub('renderJoin');
+  assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!JOIN_OPTIONS\[v\]; \}\)/,
+    'only values the page can describe are offered — the server’s options list is the source');
+  assert.match(render, /role="radiogroup"/);
+  assert.match(render, /type="radio" name="mJoinPick"/);
+  assert.match(render, /data-join-save/, 'one Save control');
+});
+
+test('the joinability save sends the one key and shows the platform’s receipt verbatim — never the reply as the live state', () => {
+  const save = fnHub('doJoinSave');
+  assert.match(save, /method: 'PATCH'/);
+  assert.match(save, /\/settings'/, 'PATCH /provisioning/instances/:id/settings');
+  assert.match(save, /JSON\.stringify\(\{ joinability: value \}\)/, 'the body is the one key this section owns');
+  assert.match(save, /\(data\.push && data\.push\.message\)/, 'push.message is rendered as the server wrote it');
+  assert.doesNotMatch(save, /joinRuns\(|mJoinRuns/, 'the "runs" line is never written from the save reply');
+  assert.match(save, /e\.code === 'intent_conflict' \? 'projMsg' : 'projMsg err'/,
+    'a 409 intent_conflict is saved-but-waiting — shown as the server’s sentence, not as a failure');
+  assert.match(save, /if \(data\.push && data\.push\.queued\) mJoinPushSeen = true;/, 'a push that settles before the re-read still triggers the manifest read');
+  assert.match(save, /loadManage\(true, true\)/, 'the strip + in-flight line re-read open_intent after a save');
+});
+
+test('what the project RUNS for joinability comes only from its own manifest, and every answer is said', () => {
+  const runs = fnHub('loadJoinRuns');
+  assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
+  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/, 'the same public GET /instance the runner reads');
+  assert.match(runs, /p && p\.joinability/, 'the manifest key is brand.project.joinability');
+  assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
+  assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
+  assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
+  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
+  assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
+});
+
+test('the joinability in-flight line shares the visibility section’s push predicate and re-asks the manifest when it settles', () => {
+  const st = fnHub('renderJoinState');
+  assert.match(st, /if \(visPushOpen\(inst\)\)/, 'one settings push carries every key — one predicate, shared');
+  assert.doesNotMatch(st, /fetch\(/, 'fetch-free — the minute tick may call it');
+  assert.match(st, /Until then it keeps its current setting\./, 'a queued push does not claim the new value');
+  assert.match(st, /if \(mJoinPushSeen\) \{ mJoinPushSeen = false; loadJoinRuns\(inst\); \}/,
+    'the manifest is asked again the moment the push is gone');
+  assert.match(fnHub('loadJoinability'), /if \(!visPushOpen\(inst\)\) loadJoinRuns\(inst\);/, 'entering during an open push keeps the intent line');
+  assert.match(fnHub('loadJoinability'), /var asked = manageId;/, 'a stale answer must never describe a newer project');
+  assert.match(fnHub('renderManage'), /renderJoinState\(inst\);/, 'renderManage repaints it on every tick');
+  assert.match(SCRIPT, /if \(!keepRepo\) loadJoinability\(inst\);/, 'the settings read fires on entry + tab return only');
+  assert.match(SCRIPT, /\$\('mJoin'\)\.addEventListener\('click'[\s\S]{0,200}data-join-save[\s\S]{0,40}doJoinSave\(\)/,
+    'the Save control is wired to ITS save — a copy that left the listener on #mVis ships a dead button');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -166,7 +166,7 @@ test('an in-flight project is watched on its own page; a settled one keeps the C
   assert.match(SCRIPT, /setInterval\(manageWatchTick, 5000\)/);
 });
 
-test('working sections come before the not-wired one on manage, and the placeholder states today’s behavior', () => {
+test('the manage sections keep their order, and no placeholder copy remains (tasks 1003043 + 1003044)', () => {
   const repo = HUB.indexOf('id="mRepoVisibility"');
   const vis = HUB.indexOf('id="mVisibility"');
   const join = HUB.indexOf('id="mJoinability"');
@@ -175,7 +175,9 @@ test('working sections come before the not-wired one on manage, and the placehol
   // "who can see it" is live since task 1003043 — its not-yet line is gone
   const visCard = HUB.slice(vis, join);
   assert.doesNotMatch(visCard, /isn’t wired up|For now, every project’s pages are open to everyone/);
-  assert.match(HUB, /For now, people apply to join and you invite them\./);
+  // "how people join" is live since task 1003044 — the last placeholder is gone
+  const joinCard = HUB.slice(join, del);
+  assert.doesNotMatch(joinCard, /isn’t wired up|For now, people apply to join and you invite them/);
   assert.doesNotMatch(HUB, /It lands in one of the next updates/);
 });
 

package/tests/public_landing_projects.mjs

@@ -107,20 +107,27 @@ test('a domainless instance gets an honest no-address state', async () => {
   assert.match(body, /[Nn]o address yet/);
 });
 
-test('the manage view is served: identity block + honest not-yet sections (task 1003041)', async () => {
+test('the manage view is served: identity block + the four settings homes, all live (task 1003041)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /id="view-manage"/);
-  // the four settings homes the sibling manage-wave tasks fill in
+  // the four settings homes the manage-wave tasks filled in
   for (const id of ['mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
     assert.match(body, new RegExp(`id="${id}"`), `${id} must be served`);
   }
-  assert.match(body, /isn’t wired up/, 'each unshipped section says so honestly');
+  assert.doesNotMatch(body, /isn’t wired up/, 'every settings section is live — no not-yet copy is served');
   // the not-found state is one clean answer — never a permission hint
   const missing = (body.match(/<section id="mMissing"[\s\S]*?<\/section>/) || [''])[0];
   assert.ok(missing, 'the not-found state must be served');
   assert.doesNotMatch(missing, /permission|allowed|access|owner/i);
 });
 
+test('the joinability section is served live, with its fold (task 1003044)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="mJoin"/, 'the live section body is served');
+  assert.match(body, /id="mJoinWhat"/, 'the what-changes fold is served');
+  assert.match(body, /already members stay members/, 'the promise survives to the wire, not just the source');
+});
+
 test('the delete section is served live, and never claims to erase (task 1003042)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /id="mDel"/, 'the live section body is served');

package/tests/ship_push_diagnosis.mjs

@@ -0,0 +1,78 @@
+// tests/ship_push_diagnosis.mjs — a terminal push failure must not advise a retry
+// (task 1003293).
+//
+// A failed `git push` in ciLandLocal already parks the task at `confirmed` and
+// opens no PR, which is correct. The ADVICE was the defect: "Fix the push and
+// re-ship" cannot work for the most common cause — a commit touching
+// .github/workflows/ pushed with a credential lacking GitHub's `workflow` scope.
+// Re-shipping fails identically, and the reconciler cannot heal a branch that
+// never reached the remote, so the task sits at `confirmed` looking like an
+// ordinary pending land while its code exists on exactly one machine. That
+// happened twice in one session.
+//
+// These tests pin the distinction the fix turns on: TERMINAL (retrying is
+// pointless — say what actually resolves it) vs transient (retrying is the
+// answer).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { pushDiagnosis, PUSH_DIAGNOSES } = require(path.join(ROOT, 'scripts', 'gds', 'ship-land.js'));
+
+test('THE case that stranded two tasks: the workflow scope rejection', () => {
+  // GitHub's real wording, verbatim from the run that stranded task 1003283.
+  const d = pushDiagnosis(
+    'remote: error: refusing to allow an OAuth App to create or update workflow '
+    + '`.github/workflows/publish.yml` without `workflow` scope\n'
+    + 'To https://github.com/owner/repo.git\n ! [remote rejected] branch -> branch');
+  assert.equal(d.id, 'workflow_scope');
+  assert.equal(d.terminal, true, 'retrying this can never succeed — saying "re-ship" is what stranded the work');
+  assert.match(d.fix, /ssh|workflow/i, 'the advice must name the remedy that actually works');
+});
+
+test('branch protection and a dead credential are terminal too', () => {
+  assert.equal(pushDiagnosis('remote: error: GH006: Protected branch update failed').terminal, true);
+  assert.equal(pushDiagnosis('fatal: Authentication failed for https://github.com/o/r.git/').terminal, true);
+  assert.equal(pushDiagnosis('git@github.com: Permission denied (publickey).').terminal, true);
+});
+
+test('a stale branch IS retryable — the honest "re-ship" case', () => {
+  const d = pushDiagnosis('error: failed to push some refs\nUpdates were rejected because the remote contains work that you do not have locally');
+  assert.equal(d.id, 'stale_branch');
+  assert.equal(d.terminal, false);
+});
+
+test('an unrecognised failure defaults to RETRYABLE, never to terminal', () => {
+  // The safe direction. A wrong "this can never work" sends someone hunting a
+  // problem that does not exist; a wrong "try again" costs one command.
+  const d = pushDiagnosis('fatal: the remote end hung up unexpectedly');
+  assert.equal(d.id, 'unknown');
+  assert.equal(d.terminal, false);
+  assert.equal(pushDiagnosis('').terminal, false);
+  assert.equal(pushDiagnosis(null).terminal, false);
+  assert.equal(pushDiagnosis(undefined).terminal, false);
+});
+
+test('every diagnosis carries both a cause and a remedy', () => {
+  // A classification with no `fix` is just a nicer way of saying "it broke",
+  // which is the state this replaced.
+  for (const d of PUSH_DIAGNOSES) {
+    assert.ok(d.id && d.why && d.fix, `incomplete diagnosis: ${JSON.stringify(d)}`);
+    assert.ok(d.why.length > 20, `${d.id}: "why" must explain, not label`);
+    assert.equal(typeof d.terminal, 'boolean');
+  }
+  const fallback = pushDiagnosis('anything at all');
+  assert.ok(fallback.why && fallback.fix);
+});
+
+test('the patterns do not collide — the first match is the RIGHT match', () => {
+  // A workflow-scope rejection also contains "error:" and often "403"; if the
+  // auth pattern matched it first, the advice would send someone to re-login
+  // instead of to SSH, and the push would fail again.
+  const workflowMsg = 'remote: error: refusing to allow an OAuth App to create or update workflow `.github/workflows/x.yml` without `workflow` scope';
+  assert.equal(pushDiagnosis(workflowMsg).id, 'workflow_scope');
+});