@bongos/core 1.19.509 → 1.19.511

package/tests/conflict_resolve.mjs

@@ -52,9 +52,21 @@ function mkExec(scn = {}) {
     if (cmd === 'checkout') return ret(scn.checkout ?? 0);
     if (cmd === 'rev-parse') {
       revCount += 1;
-      const sha = revCount === 1 ? (scn.before ?? 'aaaaaaa') : (scn.after ?? 'bbbbbbb');
-      return { code: 0, stdout: `${sha}\n`, stderr: '' };
+      // 1st = the pre-merge tip, 2nd = the merge commit, 3rd = the post-merge
+      // regeneration commit (task 1003546 step 7b), when there was drift to commit.
+      if (revCount === 1) return { code: 0, stdout: `${scn.before ?? 'aaaaaaa'}\n`, stderr: '' };
+      if (revCount === 2) return { code: 0, stdout: `${scn.after ?? 'bbbbbbb'}\n`, stderr: '' };
+      return { code: 0, stdout: `${scn.regenSha ?? scn.after ?? 'bbbbbbb'}\n`, stderr: '' };
     }
+    if (cmd === 'status') {
+      // --porcelain after step 7b's regeneration: a non-empty body = the merged tree
+      // disagreed with the generated artifacts the merge produced. Default OFF so the
+      // pre-1003546 cases keep asserting the plain merge-and-push path.
+      const drift = scn.drift ?? false;
+      return { code: 0, stdout: drift ? ' M docs/copy-registry.json\n' : '', stderr: '' };
+    }
+    if (cmd === 'add') return ret(0);
+    if (cmd === 'commit') return ret(scn.commit ?? 0);
     if (cmd === 'merge' && a[1] === '--abort') return ret(0);
     if (cmd === 'merge') {
       if (scn.merge === 'conflict') { mergeOutcome = 'conflict'; return { code: 1, stdout: 'CONFLICT (content)', stderr: '' }; }
@@ -79,8 +91,13 @@ function mkExec(scn = {}) {
 function mkDeps(scn = {}, over = {}) {
   const reg = [];
   const exec = mkExec(scn);
+  const genCalls = [];
   return {
     exec,
+    // task 1003546: resolveBranchConflicts regenerates on the MERGED tree before it
+    // pushes, so it takes the same runGenerators seam refreshStaleGenerated does.
+    // Stubbed for every case — the real one would spawn node against a fake clone.
+    runGenerators: over.runGenerators || (async (opts) => { genCalls.push(opts); return { code: scn.genCode ?? 0 }; }),
     githubPush: {
       isConfigured: () => (over.configured === undefined ? true : over.configured),
       isSafeBranch: (b) => (over.safeBranch === undefined ? (typeof b === 'string' && b.length > 0 && !b.startsWith('-')) : over.safeBranch),
@@ -94,6 +111,7 @@ function mkDeps(scn = {}, over = {}) {
     rmtmp: () => {},
     _exec: exec,
     _reg: reg,
+    _gen: genCalls,
   };
 }
 
@@ -377,7 +395,11 @@ test('1915 defaultRunGenerators strips *_INSTANCE_ROOT from the child env and pi
       const leaked = Object.keys(call.opts.env || {}).filter((k) => /_INSTANCE_ROOT$/.test(k));
       assert.deepEqual(leaked, [], 'no *_INSTANCE_ROOT key survives into the generator child env');
       assert.ok(call.opts.env.PATH, 'benign env (PATH) is preserved so node still resolves');
-      assert.ok(String(call.argv[0]).startsWith('/tmp/clone-xyz'), 'the generator script path is under the clone');
+      // Separator-normalised: defaultRunGenerators builds this with path.join, which
+      // emits backslashes on win32 — the bare startsWith made this assertion fail on
+      // every Windows builder for a reason unrelated to what it tests (task 1003546).
+      assert.ok(String(call.argv[0]).replace(/\\/g, '/').startsWith('/tmp/clone-xyz'),
+        'the generator script path is under the clone');
     }
   } finally {
     if (prev.g === undefined) delete process.env.GDS_INSTANCE_ROOT; else process.env.GDS_INSTANCE_ROOT = prev.g;
@@ -455,8 +477,100 @@ test('1915 defaultRunGenerators reports the worst child exit code (0 all-clean;
   assert.equal(badGen.code, 2, 'a single failing generator surfaces its non-zero code');
 });
 
+// ── task 1003546: the merged tree is regenerated BEFORE the push ────────────────
+// The `otb-regen` driver runs DURING the merge and rebuilds by scanning the working
+// tree, which at that moment is still the PRE-merge tree. So a merge can come out
+// clean — exit 0, no unmerged paths, no markers — carrying a generated artifact that
+// describes neither side nor the merged tree, and nothing downstream can see it.
+// resolveBranchConflicts must therefore regenerate on the FINAL tree and commit the
+// drift before pushing (PR #536 / task 1003544: the registry kept the branch's line
+// numbers and `unit` stayed red through the heal).
+
+test('1003546 clean merge → generators run on the merged tree, drift committed, head_sha is the regen commit', async () => {
+  const deps = mkDeps({ merge: 'clean', before: 'oldsha1', after: 'mergesha', drift: true, regenSha: 'regensha' });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr1' }, deps);
+  assert.equal(r.resolved, true);
+  assert.equal(deps._gen.length, 1, 'generators ran exactly once against the merged tree');
+  assert.ok(ran(deps._exec, 'commit'), 'post-merge generator drift is committed');
+  assert.equal(r.regenerated, true, 'the result reports that a regeneration was needed');
+  assert.equal(r.head_sha, 'regensha', 'head_sha is the regen commit, not the bare merge commit');
+});
+
+test('1003546 the regeneration happens AFTER the merge and its commit BEFORE the push (ordering is the whole point)', async () => {
+  const order = [];
+  const deps = mkDeps({ merge: 'clean', drift: true });
+  const baseExec = deps.exec;
+  deps.exec = async (args) => {
+    const a = args[0] === '-C' ? args.slice(2) : args;
+    if (['merge', 'commit', 'push'].includes(a[0])) order.push(a[0]);
+    return baseExec(args);
+  };
+  deps.runGenerators = async () => { order.push('__generators__'); return { code: 0 }; };
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr2' }, deps);
+  assert.equal(r.resolved, true);
+  assert.deepEqual(order, ['merge', '__generators__', 'commit', 'push'],
+    'a pre-merge regeneration (or a push before the regen commit) is exactly the bug');
+});
+
+test('1003546 no post-merge drift → the merge alone is pushed, nothing extra committed', async () => {
+  const deps = mkDeps({ merge: 'clean', after: 'mergesha', drift: false });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr3' }, deps);
+  assert.equal(r.resolved, true);
+  assert.equal(r.regenerated, false);
+  assert.equal(r.head_sha, 'mergesha', 'the merge commit is the head when regen is a no-op');
+  assert.ok(!ran(deps._exec, 'commit'), 'nothing is committed when the merge was already correct');
+  assert.ok(ran(deps._exec, 'push'), 'the resolved branch still lands');
+});
+
+test('1003546 a failing generator never pushes an uncertifiable merged tree', async () => {
+  const deps = mkDeps({ merge: 'clean', drift: true, genCode: 2 });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr4' }, deps);
+  assert.equal(r.resolved, false);
+  assert.equal(r.skipped, 'generator_failed');
+  assert.ok(!ran(deps._exec, 'push'), 'a tree we cannot certify is left for a human, never pushed');
+});
+
+test('1003546 a failing post-merge commit is reported, not pushed', async () => {
+  const deps = mkDeps({ merge: 'clean', drift: true, commit: 1 });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr5' }, deps);
+  assert.equal(r.resolved, false);
+  assert.equal(r.skipped, 'commit_failed');
+  assert.ok(!ran(deps._exec, 'push'), 'no push without the regeneration commit');
+});
+
+// THE INVARIANT THAT WOULD HAVE CAUGHT #536 ON DAY ONE. Two hand-maintained lists
+// name the same artifacts: REGENERABLE (what the merge driver claims to heal) and
+// GENERATOR_SCRIPTS (what the server actually re-runs). copy-inventory.js was added
+// to the first and not the second, so the copy registry was "covered" by the driver
+// and regenerated by nobody. Pin them as one set, via each artifact's PRODUCER.
+test('1003546 every REGENERABLE artifact has a producer, and every producer is in GENERATOR_SCRIPTS', async () => {
+  const regen = require('../scripts/gds/git-merge-regen.js');
+  const G = require('../scripts/gds/gen-repo-map.js');
+  const CI = require('../scripts/gds/copy-inventory.js');
+
+  // Derived from each generator's own exports where it publishes them, so this map
+  // cannot silently drift from the generator it names.
+  const PRODUCED_BY = new Map([
+    ['docs/repo-map.md', 'scripts/gds/gen-repo-map.js'],
+    ['docs/file-map.md', 'scripts/gds/gen-file-map.js'],
+    ['docs/session-log-index.md', 'scripts/gds/gen-session-index.js'],
+    [CI.REGISTRY_REL, 'scripts/gds/copy-inventory.js'],
+    [CI.REPORT_REL, 'scripts/gds/copy-inventory.js'],
+    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/gds/gen-repo-map.js']),
+  ]);
+
+  for (const p of regen.REGENERABLE) {
+    const producer = PRODUCED_BY.get(p);
+    assert.ok(producer, `REGENERABLE knows ${p} but this test has no producer for it — name the generator that writes it`);
+    assert.ok(
+      cr.GENERATOR_SCRIPTS.includes(producer),
+      `${p} is healed by the merge driver but ${producer} is not in GENERATOR_SCRIPTS, so the server never re-runs it on the merged tree (the task 1003544 strand)`
+    );
+  }
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
-  console.log(`\nconflict-resolve (task 1385 + 1915) tests: ${passed} passed, ${failed} failed`);
+  console.log(`\nconflict-resolve (task 1385 + 1915 + 1003546) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }, 100);

package/tests/git_merge_regen.mjs

@@ -22,6 +22,12 @@
 //   9. END-TO-END for docs/copy-registry.json: two branches that each regenerate
 //      it differently merge without conflict markers via the real .gitattributes +
 //      git-config wiring, and the result equals a fresh regeneration.
+//  10. REGRESSION (task 1003546) — the driver runs MID-merge, so a tree-scanning
+//      artifact heals to the PRE-merge tree: two branches shifting line numbers in
+//      the same scanned UI file merge CLEAN and leave the registry STALE. Pins why
+//      the merge's OWNER must regenerate afterwards (conflict-resolve.js step 7b).
+//      Needs a real clone (the driver's __dirname must BE the merging tree), so it
+//      skips where the environment cannot host that.
 //
 // Run:  node tests/git_merge_regen.mjs
 
@@ -135,7 +141,15 @@ function withBlockBody(src, body) {
   try {
     g('init', '-q');
     g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
-    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    // The fixture repo carries none of the repo's eol rules, so on a Windows box
+    // with the usual global core.autocrlf=true git would check the merge result out
+    // as CRLF while the generators render LF — a byte comparison below would fail on
+    // line endings alone. Pin it so the fixture is platform-neutral (task 1003546).
+    g('config', 'core.autocrlf', 'false');
+    // Forward slashes: `git config` strips backslashes from the value, so a win32
+    // path.join() driver path reaches node with its separators gone and the driver
+    // never loads — this fixture was silently dead on Windows (task 1003546).
+    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/repo-map.md merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeMap('base\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -213,7 +227,15 @@ function withBlockBody(src, body) {
   try {
     g('init', '-q');
     g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
-    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    // The fixture repo carries none of the repo's eol rules, so on a Windows box
+    // with the usual global core.autocrlf=true git would check the merge result out
+    // as CRLF while the generators render LF — a byte comparison below would fail on
+    // line endings alone. Pin it so the fixture is platform-neutral (task 1003546).
+    g('config', 'core.autocrlf', 'false');
+    // Forward slashes: `git config` strips backslashes from the value, so a win32
+    // path.join() driver path reaches node with its separators gone and the driver
+    // never loads — this fixture was silently dead on Windows (task 1003546).
+    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/copy-registry.json merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeReg('{"schema":0}\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -235,4 +257,108 @@ function withBlockBody(src, body) {
   }
 }
 
+// ── 10) REGRESSION (task 1003546): the driver runs MID-merge, so a tree-scanning ──
+// artifact heals to the PRE-merge tree and the merge lands clean but STALE.
+//
+// Cases 8 + 9 prove the copy-registry rule regenerates and that a real merge comes
+// out marker-free — but their fixture repos contain no scanned SOURCE, so the scan
+// returns the same bytes whichever tree it reads and they are blind to WHEN it runs.
+// This case supplies the missing half: two branches that each shift line numbers in
+// the SAME scanned UI file, in a real clone where the driver's own `__dirname` is
+// the merging tree. The merge exits 0 with no unmerged paths and no markers — and
+// keeps OUR registry verbatim, silently discarding the other side's line numbers.
+// Measured before the fix: `"line": 464` where the merged tree says 466; that is the
+// PR #536 / task 1003544 strand, and the reason conflict-resolve.js regenerates
+// AFTER the merge (step 7b) instead of trusting the driver.
+//
+// It SKIPS rather than fails where the environment cannot host the fixture (no local
+// clone, the scanned file moved, or a base whose registry is already stale) — a
+// characterization test must never red for a reason it cannot attribute.
+{
+  const SCANNED = 'modules/hall-ui/public/task-detail.js';
+  const REGEN_PATHS = ['docs/copy-registry.json', 'docs/copy-inventory.md'];
+  // Short clone path: a deep temp dir blows Windows' MAX_PATH on the clone's
+  // .git/objects/info/commit-graphs entries.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-regen-e2e-'));
+  const work = path.join(root, 'w');
+  const g = (...a) => spawnSync('git', a, { cwd: work, encoding: 'utf8' });
+  const gen = (...a) => spawnSync('node', [path.join(work, 'scripts/gds/copy-inventory.js'), ...a],
+    { cwd: work, encoding: 'utf8' });
+  // "Does regeneration change tracked CONTENT?" — `git diff` applies .gitattributes
+  // (`*.json text eol=lf`), so it ignores the worktree line endings that make a raw
+  // byte comparison stale on a Windows checkout.
+  const regenDirty = () => { gen(); return g('diff', '--quiet', '--', ...REGEN_PATHS).status !== 0; };
+  const scannedFile = () => path.join(work, SCANNED);
+
+  let skip = null;
+  try {
+    if (spawnSync('git', ['clone', '--local', '-q', repo, work], { encoding: 'utf8' }).status !== 0) {
+      skip = 'the repo could not be locally cloned';
+    }
+    if (!skip) {
+      g('config', 'user.email', 't@t');
+      g('config', 'user.name', 't');
+      g('config', 'core.autocrlf', 'false');
+      g('config', 'merge.otb-regen.name', 'regen');
+      g('config', 'merge.otb-regen.driver',
+        `node ${path.join(work, 'scripts/gds/git-merge-regen.js').replace(/\\/g, '/')} %O %A %B %P`);
+
+      if (!fs.existsSync(scannedFile())) skip = `${SCANNED} is gone — repoint this fixture at another scanned surface`;
+      else if (fs.readFileSync(scannedFile(), 'utf8').split('\n').length < 420) skip = `${SCANNED} is too short for two distant edits`;
+    }
+    if (!skip && regenDirty()) {
+      skip = 'the committed copy registry is already stale at this base — nothing could be attributed to the merge';
+    }
+
+    if (!skip) {
+      g('checkout', '--', ...REGEN_PATHS);
+      const pad = (atLine, tag) => {
+        const lines = fs.readFileSync(scannedFile(), 'utf8').split('\n');
+        lines.splice(atLine, 0, `// pad ${tag}`, `// pad ${tag}`);
+        fs.writeFileSync(scannedFile(), lines.join('\n'));
+      };
+
+      // Base is HEAD itself — never a branch NAME, which does not exist in a CI
+      // detached checkout.
+      const base = g('rev-parse', 'HEAD').stdout.trim();
+      g('checkout', '-q', '-B', 'fixture-ours', base);
+      pad(10, 'OURS');
+      gen();
+      g('add', '-A'); g('commit', '-qm', 'ours: shift copy lines near the top + regen');
+
+      g('checkout', '-q', '-B', 'fixture-theirs', base);
+      pad(400, 'THEIRS');
+      gen();
+      g('add', '-A'); g('commit', '-qm', 'theirs: shift copy lines far below + regen');
+
+      g('checkout', '-q', 'fixture-ours');
+      const m = g('merge', '--no-edit', 'fixture-theirs');
+
+      // 1. The merge lands CLEAN — the driver did clear the textual conflict.
+      assert.equal(m.status, 0, `the driver must resolve the registry conflict; got ${m.status} :: ${m.stdout}${m.stderr}`);
+      assert.equal(g('diff', '--name-only', '--diff-filter=U').stdout.trim(), '', 'no path may be left unmerged');
+      const healed = fs.readFileSync(path.join(work, 'docs', 'copy-registry.json'), 'utf8');
+      assert.ok(!MARKERS.test(healed), 'the merged registry must carry no conflict markers');
+
+      // 2. THE HAZARD: it kept OURS verbatim, because the scan ran before the merge.
+      assert.equal(
+        g('diff', '--quiet', 'HEAD^1', 'HEAD', '--', 'docs/copy-registry.json').status, 0,
+        'expected the merge to keep ours byte-for-byte (the mid-merge scan)'
+      );
+      assert.equal(regenDirty(), true,
+        'expected the merged tree to be STALE — the driver cannot see the merged tree, which is WHY '
+        + 'conflict-resolve.js regenerates after the merge (step 7b). If this assertion now fails, git has '
+        + 'begun running merge drivers against the merged tree: re-read step 7b, it may be simplifiable.');
+
+      // 3. THE CURE step 7b relies on: a post-merge regeneration is sufficient.
+      g('add', '-A'); g('commit', '-qm', 'regenerate from the merged tree');
+      assert.equal(regenDirty(), false, 'a post-merge regeneration must leave the registry fresh');
+    } else {
+      console.log(`git_merge_regen: case 10 SKIPPED — ${skip}`);
+    }
+  } finally {
+    try { fs.rmSync(root, { recursive: true, force: true }); } catch (_) { /* best effort */ }
+  }
+}
+
 console.log('git_merge_regen: all assertions passed');

package/tests/projects_hub.mjs

@@ -1995,6 +1995,19 @@ test('the wizard takes the world by scope: no card ground, the six-step strip as
   assert.doesNotMatch(block, /#[0-9a-f]{3,8}\b/i, 'every colour is a token');
 });
 
+/* ── one fold for the whole wizard (task 1003538, a task 1003346 follow-up). The rail folded
+   at the sheet's 900 while the wizard's fields, choice bands and review ledger folded at the
+   page's 840 (cosmos's createSplit collapse), so between the two the rail was already three-up
+   beside full-width bands. Both sheets now name the same width. ── */
+test('the wizard folds at one width: the rail\'s media rule sits at 840px with the bands, and no 900px rule is left in the #view-new block (task 1003538)', () => {
+  const at = COSMOS.indexOf('THE CREATE WIZARD, IN THE WORLD');
+  assert.ok(at > -1, 'the #view-new block exists in cosmos.css');
+  const block = COSMOS.slice(at);
+  assert.match(block, /@media \(max-width:840px\)\{\s*#view-new \.steps\{grid-template-columns:repeat\(3,1fr\);/, 'the rail folds to three columns at 840, the width the bands fold at');
+  assert.doesNotMatch(block, /@media \(max-width:900px\)/, 'no 900px rule is left in the wizard block');
+  assert.match(STYLE, /@media \(max-width:840px\)\{[\s\S]*?\.review\{grid-template-columns:1fr;/, 'the page\'s own wizard block still folds its bands and ledger at that same 840');
+});
+
 test('the wizard\'s own structures wear the world: hairline fields, cells of one band, the review as a ledger, the human steps as a numbered ledger, the standup strip as the rail (task 1003346)', () => {
   const at = STYLE.indexOf('the create wizard (task 1002763');
   assert.ok(at > -1, 'the wizard block is still the page\'s own');

package/tests/provisioning_starter_bundles.mjs

@@ -0,0 +1,268 @@
+// tests/provisioning_starter_bundles.mjs — the curated starter bundles (BV1.R19,
+// task 1002338; goal 1000046 criterion `proj-module-select`).
+//
+// Three things are pinned here, and the middle one is the reason this file exists.
+//
+//   1. The resolver — bundleForProjectType(type) for each declared type, and the
+//      core-only fallback for a type nobody declared. A creation form must never
+//      be handed a guess.
+//   2. Bundle <-> catalog integrity — a bundle is a list of module KEYS, declared
+//      in a pure file that may not import the live catalog (the one-way rule, ADR
+//      0083). This test IS the link: it reads every modules/*/module.json off disk
+//      and fails the build the moment a bundle names a module that does not exist,
+//      names an always-on one (a preselect that toggles nothing), or the declared
+//      always-on list drifts from the manifests' `default: true` set.
+//   3. The read surface — GET /provisioning/starter-bundles is public and returns
+//      exactly what the resolver returns, so R20's picker and R17's rule engine
+//      cannot read a different answer than a script would.
+//
+// DB-free: the route is a pure read, so nothing here touches Postgres or the
+// network beyond a loopback listener on port 0.
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_starter_bundles.mjs
+
+import { test, before, after } from 'node:test';
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+// ESM named imports off the CJS module on purpose: knip cannot trace a
+// createRequire() import, so a test-only export would read as dead code and move
+// the knip ratchet (see the repo's knip learning).
+import {
+  ALWAYS_ON_CORE,
+  STARTER_BUNDLES,
+  HUB_ONLY_MODULES,
+  bundleForProjectType,
+  allStarterBundles,
+} from '../modules/provisioning/starter-bundles.js';
+
+const require = createRequire(import.meta.url);
+
+// Stub the doorway in require.cache BEFORE the route file loads (the
+// access_requests_invite pattern): the route destructures `pool` at require time,
+// and a real pg pool would hold the event loop open long after the assertions
+// pass. Nothing here needs a database — the route under test is a pure read.
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: { async query() { throw new Error('the starter-bundles route must not touch the database'); } },
+};
+
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+const MODULES_DIR = fileURLToPath(new URL('../modules', import.meta.url));
+
+// Every module key on disk, with the manifest's `default` — the live catalog as
+// the loader discovers it (src/module-loader/loader.js scans exactly this).
+function manifestsOnDisk() {
+  const out = new Map();
+  for (const ent of fs.readdirSync(MODULES_DIR, { withFileTypes: true })) {
+    if (!ent.isDirectory()) continue;
+    const manifestPath = path.join(MODULES_DIR, ent.name, 'module.json');
+    if (!fs.existsSync(manifestPath)) continue;
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    out.set(manifest.key, manifest);
+  }
+  return out;
+}
+
+// ── the resolver ────────────────────────────────────────────────────────────
+
+test('bundleForProjectType returns the always-on core plus the type\'s opt-in modules', () => {
+  // Arrange
+  const type = 'game';
+
+  // Act
+  const resolved = bundleForProjectType(type);
+
+  // Assert
+  assert.equal(resolved.type, 'game');
+  assert.deepEqual(resolved.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(resolved.bundle, [...STARTER_BUNDLES.game.modules]);
+  assert.deepEqual(resolved.modules, [...ALWAYS_ON_CORE, ...STARTER_BUNDLES.game.modules]);
+  assert.ok(resolved.label && resolved.summary, 'carries owner-facing copy for the picker to render');
+});
+
+test('every declared project type resolves to a bundle', () => {
+  // Arrange — the shipped vocabulary (task 1002772, owner decision 2026-08-13).
+  const declared = provisioning.PROJECT_TYPES;
+
+  // Act + Assert
+  for (const type of declared) {
+    const resolved = bundleForProjectType(type);
+    assert.equal(resolved.type, type, `${type} resolves to itself, not the fallback`);
+  }
+  assert.deepEqual(
+    Object.keys(STARTER_BUNDLES).sort(),
+    [...declared].sort(),
+    'the bundle table covers the declared type vocabulary exactly — no missing type, no invented one',
+  );
+});
+
+test('an undeclared or unknown project type falls back to the core, and never guesses a type', () => {
+  // A project may have no type at all: the column is nullable because every row
+  // predates the field and must not be back-filled with a guess (migration
+  // provisioning_007). The fallback must be honest about that.
+  for (const type of [null, undefined, '', 'saas-tool', 'GAME', 42, {}]) {
+    // Act
+    const resolved = bundleForProjectType(type);
+
+    // Assert
+    assert.equal(resolved.type, null, `${JSON.stringify(type)} → no declared type`);
+    assert.deepEqual(resolved.bundle, [], 'nothing is preselected on a guess');
+    assert.deepEqual(resolved.modules, [...ALWAYS_ON_CORE]);
+  }
+});
+
+test('"not-sure" is a real answer that resolves to the core only, distinct from an undeclared type', () => {
+  // Arrange + Act
+  const notSure = bundleForProjectType('not-sure');
+  const undeclared = bundleForProjectType(null);
+
+  // Assert — same modules, different provenance: one owner said "not sure", the
+  // other said nothing at all, and the picker should be able to tell them apart.
+  assert.deepEqual(notSure.modules, undeclared.modules);
+  assert.equal(notSure.type, 'not-sure');
+  assert.equal(undeclared.type, null);
+  assert.deepEqual(notSure.bundle, [], 'the escape hatch adds nothing — nothing depends on it');
+});
+
+test('a caller mutating a resolved bundle cannot corrupt the declaration', () => {
+  // Arrange
+  const first = bundleForProjectType('game');
+
+  // Act
+  first.modules.push('not-a-module');
+  first.bundle.length = 0;
+  first.core.length = 0;
+
+  // Assert
+  const second = bundleForProjectType('game');
+  assert.deepEqual(second.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(second.bundle, [...STARTER_BUNDLES.game.modules]);
+  assert.ok(!second.modules.includes('not-a-module'));
+});
+
+test('allStarterBundles returns one resolved bundle per declared type', () => {
+  // Act
+  const all = allStarterBundles();
+
+  // Assert
+  assert.deepEqual(all.map((b) => b.type), Object.keys(STARTER_BUNDLES));
+  for (const row of all) assert.deepEqual(row, bundleForProjectType(row.type));
+});
+
+// ── bundle <-> catalog integrity ────────────────────────────────────────────
+
+test('every module a bundle names exists in the module catalog', () => {
+  // Arrange
+  const onDisk = manifestsOnDisk();
+  assert.ok(onDisk.size > 0, 'read the manifests off disk');
+
+  // Act + Assert
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(onDisk.has(key), `bundle "${type}" names "${key}", which is not a module on disk`);
+    }
+  }
+});
+
+test('every always-on module is a real module whose manifest says default: true', () => {
+  // Arrange
+  const onDisk = manifestsOnDisk();
+
+  // Act + Assert
+  for (const key of ALWAYS_ON_CORE) {
+    assert.ok(onDisk.has(key), `ALWAYS_ON_CORE names "${key}", which is not a module on disk`);
+    assert.equal(onDisk.get(key).default, true, `"${key}" is listed as always-on but its manifest is not default: true`);
+  }
+  const defaultsOnDisk = [...onDisk.values()].filter((m) => m.default === true).map((m) => m.key).sort();
+  assert.deepEqual(
+    [...ALWAYS_ON_CORE].sort(),
+    defaultsOnDisk,
+    'the declared always-on list has drifted from the manifests — a module was added, removed, or flipped its default',
+  );
+});
+
+test('a bundle may only add opt-in modules — never one that is already always-on', () => {
+  // A preselect that names an always-on module toggles nothing and reads to the
+  // owner as a choice they made; that is a lie the picker would render.
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(!ALWAYS_ON_CORE.includes(key), `bundle "${type}" names always-on module "${key}"`);
+    }
+  }
+});
+
+test('no bundle names a hub-only module', () => {
+  // platform-identity and provisioning are the control plane's own modules — the
+  // hub runs them, a project created THROUGH the hub never should.
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(!HUB_ONLY_MODULES.includes(key), `bundle "${type}" names hub-only module "${key}"`);
+    }
+  }
+});
+
+test('a bundle lists each module once', () => {
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    assert.equal(new Set(bundle.modules).size, bundle.modules.length, `bundle "${type}" repeats a module`);
+  }
+});
+
+// ── the read surface ────────────────────────────────────────────────────────
+
+// Mount the real router. The route under test is a pure read, so it needs no
+// session gate and no res.fail helper — which is itself the point of the
+// assertion below.
+const express = require('express');
+const buildProvisioningRouter = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use('/api/bongos', buildProvisioningRouter());
+
+let server;
+let port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => { await new Promise((resolve) => server.close(resolve)); });
+
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => {
+        let parsed = null;
+        try { parsed = JSON.parse(body); } catch { /* non-JSON */ }
+        resolve({ status: res.statusCode, body: parsed, raw: body });
+      });
+    }).on('error', reject);
+  });
+}
+
+test('GET /provisioning/starter-bundles is public and serves the resolved bundles', async () => {
+  // Act — no session: `rank: public`, the same gate (none) the signed-out create
+  // wizard reads GET /provisioning/onboard-plan with.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+
+  // Assert
+  assert.equal(res.status, 200, `readable with no session (got ${res.status} ${res.raw})`);
+  assert.deepEqual(res.body.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(res.body.bundles, allStarterBundles());
+  assert.equal(res.body.bundles.length, provisioning.PROJECT_TYPES.length);
+});
+
+test('the route never reaches the database — the bundles are a declaration, not a query', async () => {
+  // The stubbed pool throws on any query, so a 200 here IS the assertion: an
+  // owner picking a type in the wizard must not cost a round trip to Postgres.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+  assert.equal(res.status, 200);
+});