@bongos/core 1.19.510 → 1.19.512

package/tests/project_door_ui.mjs

@@ -0,0 +1,267 @@
+// tests/project_door_ui.mjs — the owner's join-door control, EXECUTED (BV1.R05,
+// task 1002324, ADR 0182 D1).
+//
+// tests/projects_hub.mjs pins this section's source text; this file pins its
+// BEHAVIOUR. It lifts the real region out of modules/public-landing/public/
+// projects.html — the option table, renderDoor, loadDoor, doDoorSave and the
+// delegated click — runs it in a vm under a minimal DOM stub, PARSES the markup
+// it writes into innerHTML, and drives a real click on the Save control.
+//
+// Why a vm harness rather than jsdom: there is no jsdom in this repo. The
+// precedent is tests/task_detail_ui.mjs (after tests/goal_criterion_confirm_ui.mjs);
+// this one differs in where the source comes from — the hub's script is INLINE in
+// the page, so the region is sliced out rather than read from a .js file, and the
+// slice boundaries are asserted so a rename can never quietly test nothing.
+//
+// What it proves, and why each matters:
+//   • the three choices render with the goal's PLAIN interview labels
+//   • the project's CURRENT door is the preselected one — an owner opening the
+//     page reads their own setting, never a default that misreports it
+//   • only values the SERVER offered are rendered (the options list is the source)
+//   • Save PATCHes the own-scoped settings channel with exactly { visibility }
+//   • the platform's receipt is shown verbatim, and a refusal is SAID — the radio
+//     never moves to a value the server did not accept
+//
+// Run:  node --test --test-reporter=tap tests/project_door_ui.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The region under test, sliced from the page verbatim. Both boundaries are
+// asserted: a rename that moved either one would otherwise leave this file
+// executing an empty string and passing.
+const START = SCRIPT.indexOf('var DOOR_OPTIONS = {');
+const END = SCRIPT.indexOf('/* ── delete the project');
+assert.ok(START > 0, 'the join-door region must start at DOOR_OPTIONS');
+assert.ok(END > START, 'the join-door region must end before the delete section');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function renderDoor(', 'function loadDoor(', 'function doDoorSave(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+// Narrow on purpose (the task_detail_ui.mjs rule): it supports exactly the
+// selectors the region uses, so it stays honest about what it can prove.
+
+const RADIO = /<input type="radio" name="mDoorPick" value="([^"]*)"( checked)?>/g;
+const OPTION = /<label class="visOpt"><input type="radio" name="mDoorPick" value="([^"]*)"( checked)?><span><b>([^<]*)<\/b>([^<]*)<\/span><\/label>/g;
+
+function parseOptions(html) {
+  const out = [];
+  for (const m of String(html).matchAll(OPTION)) {
+    out.push({ value: m[1], checked: !!m[2], label: m[3], blurb: m[4] });
+  }
+  return out;
+}
+
+// Boot the region against a scripted settings channel and hand back the handles
+// a test drives it with.
+function boot({ settings, options = ['public', 'private', 'stealth'], patchAnswer } = {}) {
+  const requests = [];
+  const els = new Map();
+  const listeners = new Map();
+
+  const makeEl = (id) => ({
+    _id: id, _html: '', textContent: '', className: '', disabled: false,
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+    addEventListener(type, fn) {
+      if (type !== 'click') return;
+      if (!listeners.has(id)) listeners.set(id, []);
+      listeners.get(id).push(fn);
+    },
+  });
+  const $ = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+
+  // what the owner has clicked; starts as whatever the render marked checked
+  let picked = null;
+  const slotHtml = () => ($('mDoor')._html || '');
+  const saveBtn = { hasAttribute: (a) => a === 'data-door-save', disabled: false };
+
+  const document = {
+    querySelector(sel) {
+      if (sel === '#mDoor input[name="mDoorPick"]:checked') {
+        if (picked !== null) return { value: picked };
+        const found = [...slotHtml().matchAll(RADIO)].find((m) => m[2]);
+        return found ? { value: found[1] } : null;
+      }
+      if (sel === '#mDoor [data-door-save]') return slotHtml().includes('data-door-save') ? saveBtn : null;
+      throw new Error(`the stub does not support the selector ${sel}`);
+    },
+  };
+
+  const answer = (body, { ok = true, status = 200 } = {}) => Promise.resolve({ ok, status, _json: body });
+  const fetch = (url, init = {}) => {
+    requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
+    if ((init.method || 'GET') === 'GET') {
+      return answer({ ok: true, settings, options: { visibility: options } });
+    }
+    return patchAnswer || answer({ ok: true, saved: { ...settings, visibility: JSON.parse(init.body).visibility }, push: { queued: true, message: 'Saved. Your project will restart to pick this up — until then it keeps its current setting.' } });
+  };
+
+  const sandbox = {
+    $, document, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    encodeURIComponent, setTimeout, clearTimeout,
+    API: '/api/bongos',
+    manageId: '18',
+    manageInst: { id: 18, status: 'active' },
+    esc: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    apiError: (data, status) => ({ code: (data && data.error && data.error.code) || 'error', message: (data && data.error && data.error.message) || `HTTP ${status}` }),
+    signInAgain: () => '<a href="/signin">Sign in again</a>',
+    loadManage: () => { requests.push({ url: 'loadManage' }); },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#join-door' });
+
+  const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
+  return {
+    requests, sandbox, settle,
+    options: () => parseOptions(slotHtml()),
+    slot: () => slotHtml(),
+    msg: () => $('mDoorMsg'),
+    pick: (v) => { picked = v; },
+    async load() { sandbox.loadDoor(); await settle(); },
+    async clickSave() {
+      const handlers = listeners.get('mDoor') || [];
+      assert.equal(handlers.length, 1, 'the section wires exactly one delegated click handler');
+      handlers[0]({ target: { closest: (sel) => (sel === 'button' ? saveBtn : null) } });
+      await settle();
+    },
+  };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the three choices render with the goal’s plain interview labels', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  assert.deepEqual(ui.options().map((o) => o.label), ['Public', 'Private', 'Stealth']);
+  assert.deepEqual(ui.options().map((o) => o.value), ['public', 'private', 'stealth']);
+  assert.match(ui.slot(), /role="radiogroup"/, 'the pick is a real radio group, not a list of buttons');
+  for (const o of ui.options()) assert.ok(o.blurb.length > 20, `${o.label} says what it changes`);
+});
+
+test('the project’s current door is the one preselected — never a default that misreports it', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'stealth' } });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  const checked = ui.options().filter((o) => o.checked);
+  assert.equal(checked.length, 1, 'exactly one option is preselected');
+  assert.equal(checked[0].value, 'stealth');
+});
+
+test('only the values the SERVER offered are rendered', async () => {
+  // Arrange — a server that offers two (an older platform, or a narrowed list)
+  const ui = boot({ settings: { visibility: 'public' }, options: ['public', 'private'] });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  assert.deepEqual(ui.options().map((o) => o.value), ['public', 'private']);
+});
+
+test('saving PATCHes the own-scoped settings channel with exactly { visibility }', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  const patch = ui.requests.find((r) => r.method === 'PATCH');
+  assert.ok(patch, 'a PATCH was sent');
+  assert.equal(patch.url, '/api/bongos/provisioning/instances/18/settings');
+  assert.deepEqual(JSON.parse(patch.body), { visibility: 'private' }, 'exactly the one key this section owns');
+  assert.equal(patch.credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+});
+
+test('the platform’s receipt is shown verbatim — the page never writes its own promise', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+  await ui.load();
+  ui.pick('stealth');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().textContent,
+    'Saved. Your project will restart to pick this up — until then it keeps its current setting.');
+  assert.equal(ui.msg().className, 'projMsg ok');
+});
+
+test('a refusal is SAID, and the radio never moves to a value the server did not accept', async () => {
+  // Arrange
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 400, _json: { error: { code: 'validation_failed', message: 'visibility is not one of: public, private, stealth' } } }),
+  });
+  await ui.load();
+  ui.pick('unlisted');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /not one of: public, private, stealth/, 'the server’s own sentence');
+  assert.equal(ui.sandbox.mDoorSettings.value, 'public', 'the stored choice is untouched by a refused save');
+});
+
+test('a 409 intent_conflict is saved-but-waiting, not a failure', async () => {
+  // Arrange — the settings row IS written; another run holds the restart slot
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 409, _json: { error: { code: 'intent_conflict', message: 'The change was saved, but a \'provision\' run is currently running for this project.' } } }),
+  });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().className, 'projMsg', 'not painted as an error — the change is recorded');
+  assert.match(ui.msg().textContent, /The change was saved/);
+});
+
+test('a signed-out save offers a way back in rather than a dead end', async () => {
+  // Arrange
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 401, _json: {} }),
+  });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.match(ui.msg().innerHTML, /Sign in again/);
+});

package/tests/projects_hub.mjs

@@ -1135,7 +1135,7 @@ test('the manage view ships as real markup with the four settings homes (C7)', (
   assert.match(HUB, /id="view-manage"/);
   for (const id of ['mGate', 'mSignin', 'mMissing', 'mAlert', 'mLoading', 'mMain',
     'mName', 'mChip', 'mMeta', 'mAddr', 'mCreated',
-    'mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    'mVisibility', 'mJoinability', 'mDoorState', 'mRepoVisibility', 'mDelete']) {
     assert.match(HUB, new RegExp(`id="${id}"`), `${id} must be real markup`);
   }
   // every settings home is live now (tasks 1003042 / 1003043 / 1003044) — no not-yet copy remains
@@ -1475,6 +1475,78 @@ test('the joinability section is live markup with its body slot and a sibling fo
   assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
 });
 
+/* the join door (task 1002324, ADR 0182 D1): the third settings axis — how the
+   project stands on the platform's MAP, beside its own sign-in door and its own
+   membership door. Its labels are the goal's interview decision: PLAIN words,
+   because the space metaphor belongs to the drawn orb and never to the copy. */
+
+test('the join-door section is live markup with its body slot and a sibling fold (C7)', () => {
+  assert.match(HUB, /id="mDoor"/, 'the volatile slot is real markup, not JS-built');
+  assert.match(HUB, /id="mDoorWhat"/, 'the what-changes fold ships with the page');
+  const card = (HUB.match(/<div class="card mSec" id="mDoorState">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the join-door card must be extractable');
+  const slotAt = card.indexOf('id="mDoor"');
+  const foldAt = card.indexOf('id="mDoorWhat"');
+  assert.ok(slotAt > 0 && foldAt > slotAt, 'the fold sits outside the slot it must survive');
+  const fold = (HUB.match(/<details class="finePrint" id="mDoorWhat">[\s\S]*?<\/details>/) || [''])[0];
+  for (const label of ['Public', 'Private', 'Stealth']) {
+    assert.match(fold, new RegExp(`<b>${label}</b>`), `${label} is explained in the fold`);
+  }
+  // ADR 0182 D4: the bar is identity, and the gate must NAME what is missing
+  assert.match(fold, /only once it has a name and a description/, 'the publish bar is stated, so a Public pick that shows nowhere is never a mystery');
+  assert.match(fold, /separate from “Who can see it”/, 'the two doors are named as separate settings');
+  assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
+});
+
+test('the join-door labels are PLAIN — the space metaphor is the orb’s, never the copy’s (the goal’s interview decision)', () => {
+  assert.match(SCRIPT, /var DOOR_OPTIONS = \{\s*public: \{ label: 'Public'/);
+  assert.match(SCRIPT, /private: \{ label: 'Private'/);
+  assert.match(SCRIPT, /stealth: \{ label: 'Stealth'/);
+  // the card is the whole owner-facing surface of this setting: its markup plus
+  // the option table the render reads its words from
+  const card = (HUB.match(/<div class="card mSec" id="mDoorState">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const options = (SCRIPT.match(/var DOOR_OPTIONS = \{[\s\S]*?\n  \};/) || [''])[0];
+  assert.ok(card && options, 'both the card and the option table must be extractable');
+  // whole words only — "restarts" legitimately contains "star"
+  for (const word of ['planet', 'star', 'black hole', 'dark matter', 'dark-matter']) {
+    const re = new RegExp(`\\b${word}\\b`);
+    assert.doesNotMatch(card.toLowerCase(), re, `"${word}" must not reach the owner’s copy`);
+    assert.doesNotMatch(options.toLowerCase(), re, `"${word}" must not reach a choice’s label or blurb`);
+  }
+  // and the derived fourth state is never offered as a pick (ADR 0182 D2)
+  assert.doesNotMatch(options, /unlisted/i, 'dark matter is DERIVED — there is deliberately no way to choose it');
+});
+
+test('the join-door pick is a real radio group built from the server’s own options list', () => {
+  const render = fnHub('renderDoor');
+  assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!DOOR_OPTIONS\[v\]; \}\)/,
+    'only values the page can describe are offered — the server’s options list is the source');
+  assert.match(render, /role="radiogroup"/);
+  assert.match(render, /type="radio" name="mDoorPick"/);
+  assert.match(render, /v === s\.value \? ' checked' : ''/, 'the project’s current door is the preselected one');
+  assert.match(render, /data-door-save/, 'one Save control');
+});
+
+test('the join-door save sends the one key and shows the platform’s receipt verbatim', () => {
+  const save = fnHub('doDoorSave');
+  assert.match(save, /method: 'PATCH'/);
+  assert.match(save, /\/settings'/, 'PATCH /provisioning/instances/:id/settings — the own-scoped channel its two siblings use');
+  assert.match(save, /JSON\.stringify\(\{ visibility: value \}\)/, 'the body is the one key this section owns');
+  assert.match(save, /\(data\.push && data\.push\.message\)/, 'push.message is rendered as the server wrote it');
+  assert.match(save, /e\.code === 'intent_conflict' \? 'projMsg' : 'projMsg err'/,
+    'a 409 intent_conflict is saved-but-waiting — shown as the server’s sentence, not as a failure');
+  assert.match(save, /loadManage\(true, true\)/, 'the strip + in-flight line re-read open_intent after a save');
+});
+
+test('the join door is read on entry + tab return, like every other settings section', () => {
+  assert.match(SCRIPT, /if \(!keepRepo\) loadDoor\(\);/, 'never from the in-flight tick');
+  // deliberately NOT a manifest read-back: an already-deployed project reports no
+  // door yet, and a line that could only ever say "your project doesn’t report
+  // this" is worse than no line. The read-back lands with the enforcement.
+  const load = fnHub('loadDoor');
+  assert.doesNotMatch(load, /api\/gds\/instance/, 'this section asks the project’s manifest nothing');
+});
+
 test('the joinability choices are the platform’s vocabulary, each in plain words, and the pick is a real radio group', () => {
   assert.match(SCRIPT, /var JOIN_OPTIONS = \{\s*open: \{ label: 'Anyone can join'/);
   assert.match(SCRIPT, /apply: \{ label: 'Apply to join'/);
@@ -1995,6 +2067,19 @@ test('the wizard takes the world by scope: no card ground, the six-step strip as
   assert.doesNotMatch(block, /#[0-9a-f]{3,8}\b/i, 'every colour is a token');
 });
 
+/* ── one fold for the whole wizard (task 1003538, a task 1003346 follow-up). The rail folded
+   at the sheet's 900 while the wizard's fields, choice bands and review ledger folded at the
+   page's 840 (cosmos's createSplit collapse), so between the two the rail was already three-up
+   beside full-width bands. Both sheets now name the same width. ── */
+test('the wizard folds at one width: the rail\'s media rule sits at 840px with the bands, and no 900px rule is left in the #view-new block (task 1003538)', () => {
+  const at = COSMOS.indexOf('THE CREATE WIZARD, IN THE WORLD');
+  assert.ok(at > -1, 'the #view-new block exists in cosmos.css');
+  const block = COSMOS.slice(at);
+  assert.match(block, /@media \(max-width:840px\)\{\s*#view-new \.steps\{grid-template-columns:repeat\(3,1fr\);/, 'the rail folds to three columns at 840, the width the bands fold at');
+  assert.doesNotMatch(block, /@media \(max-width:900px\)/, 'no 900px rule is left in the wizard block');
+  assert.match(STYLE, /@media \(max-width:840px\)\{[\s\S]*?\.review\{grid-template-columns:1fr;/, 'the page\'s own wizard block still folds its bands and ledger at that same 840');
+});
+
 test('the wizard\'s own structures wear the world: hairline fields, cells of one band, the review as a ledger, the human steps as a numbered ledger, the standup strip as the rail (task 1003346)', () => {
   const at = STYLE.indexOf('the create wizard (task 1002763');
   assert.ok(at > -1, 'the wizard block is still the page\'s own');

package/tests/projects_hub_pre_uat.mjs

@@ -267,8 +267,11 @@ test('the manage sections keep their order, and no placeholder copy remains (tas
   const repo = HUB.indexOf('id="mRepoVisibility"');
   const vis = HUB.indexOf('id="mVisibility"');
   const join = HUB.indexOf('id="mJoinability"');
+  // the join door (task 1002324) sits with the other two doors, before delete
+  const door = HUB.indexOf('id="mDoorState"');
   const del = HUB.indexOf('id="mDelete"');
-  assert.ok(repo > 0 && repo < vis && vis < join && join < del, 'repo visibility → who can see it → how people join → delete');
+  assert.ok(repo > 0 && repo < vis && vis < join && join < door && door < del,
+    'repo visibility → who can see it → how people join → on the map → delete');
   // "who can see it" is live since task 1003043 — its not-yet line is gone
   const visCard = HUB.slice(vis, join);
   assert.doesNotMatch(visCard, /isn’t wired up|For now, every project’s pages are open to everyone/);

package/tests/provision_settings_apply.mjs

@@ -59,6 +59,7 @@ PGDATABASE=spike
 # 1003139). Written at standup from the platform's provisioning_instances.settings;
 ${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOINABILITY=apply
+${NEUTRAL_PREFIX}_VISIBILITY=public
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -111,7 +112,7 @@ t('is PURE: same input, same output; empty body yields just the lines', () => {
 t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at standup, under the pack prefix', () => {
   const inst = { slug: 'spike', port: 3010, db_name: 'spike', hosting_shape: 'standalone', target_ref: 'jaxri/spike', settings: { platform_visibility: 'gated' } };
   const vars = P.settingsEnvVarsFor(inst);
-  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply' });
+  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply', [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public' });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
 });
@@ -122,10 +123,10 @@ const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_o
 const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
 
 t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' }), GATED), true);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' }), GATED), true);
 });
 t('false when the instance still reports a different value', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public' }), GATED), false);
   assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
 });
 t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
@@ -143,8 +144,8 @@ t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
 function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
   manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
   const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
-  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' })
-    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply' })
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' })
+    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public' })
     : manifest === 'none' ? manifestWith(undefined) : 'nope';
   const exec = (cmd, opts = {}) => {
     cmds.push(cmd);
@@ -212,7 +213,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });
@@ -397,7 +398,7 @@ await ta("cmdRunIntents (--apply) routes a 'settings-apply' intent to the leg, w
       claimNextOAuthManifest: async () => null,
       resolveOAuthManifest: async () => {},
     },
-    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open' }) } : { ok: true, stdout: '{"ok":true}' }; },
+    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open', visibility: 'public' }) } : { ok: true, stdout: '{"ok":true}' }; },
     writeFile: (p, body) => { writes.push(body); return { ok: true }; }, doApi: null,
   };
   const r = await P.cmdRunIntents(deps);

package/tests/provisioning_settings.mjs

@@ -164,11 +164,14 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
     platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'],
+    // the join door (task 1002324, ADR 0182 D1) — the third policy axis, offered
+    // to the form the same way as its two neighbours
+    visibility: ['public', 'private', 'stealth'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -181,14 +184,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -216,7 +219,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -229,7 +232,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -257,6 +260,62 @@ await ta('an off-vocabulary value → 400 validation_failed (nothing written)',
   assert.equal(updateCalls.length, 0);
 });
 
+// ── the join door (BV1.R05, task 1002324) ────────────────────────────────────
+// ADR 0182 D1's STORED axis — Public / Private / Stealth — reaching the owner on
+// the same own-scoped channel as its two neighbours. What these pin: the server,
+// not the form, decides a value is legal; a fourth state cannot be picked because
+// dark matter is DERIVED (D2); and the door is a POLICY, so it rides the push.
+console.log('\nPATCH /provisioning/instances/:id/settings — the join door (task 1002324):');
+
+await ta('the owner sets the door to stealth — stored, echoed effective, audited, and pushed like the policy it is', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
+  assert.equal(events[0].actor, 'api:self');
+  assert.match(events[0].detail, /visibility=stealth/);
+  // ADR 0182 D6 makes the door the CEILING joinability may only narrow, and D1/D5
+  // put that authority on the instance — so it must ride web.env + the restart,
+  // not the planet's draw-only channel.
+  assert.equal(r.body.push.queued, true, 'the door is a policy the instance obeys — it pushes');
+  assert.equal(r.body.push.restart, true, 'and a restart is what applies it');
+});
+
+await ta('each of the three states is accepted', async () => {
+  for (const value of ['public', 'private', 'stealth']) {
+    reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { visibility: value === 'public' ? 'stealth' : 'public' } } });
+    const r = await patch('/provisioning/instances/18/settings', { visibility: value });
+    assert.equal(r.status, 200, `${value}: ${r.raw}`);
+    assert.equal(r.body.saved.visibility, value);
+  }
+});
+
+await ta('a fourth state is refused server-side — dark matter is DERIVED, never picked (ADR 0182 D2)', async () => {
+  for (const bogus of ['unlisted', 'dark-matter', 'gated', 'hidden', '']) {
+    reset();
+    const r = await patch('/provisioning/instances/18/settings', { visibility: bogus });
+    assert.equal(r.status, 400, `${JSON.stringify(bogus)} must be refused: ${r.raw}`);
+    assert.equal(r.body.error.code, 'validation_failed');
+    assert.equal(updateCalls.length, 0, 'nothing written on a refused value');
+  }
+});
+
+await ta('the OWN-SCOPE WALL holds for the door: another builder\'s PATCH → 404, nothing written', async () => {
+  reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
+  const r = await patch('/provisioning/instances/18/settings', { visibility: 'private' });
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found', 'no existence leak');
+  assert.equal(updateCalls.length, 0);
+  assert.equal(events.length, 0);
+});
+
+await ta('an unknown project → 404 for the door too, archon included', async () => {
+  reset({ inst: null, as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await patch('/provisioning/instances/999/settings', { visibility: 'private' });
+  assert.equal(r.status, 404, r.raw);
+});
+
 await ta('an unknown key → 400 (strict: a typo fails loudly, never silently dropped)', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinabilty: 'open' });
@@ -272,7 +331,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');

package/tests/provisioning_settings_apply.mjs

@@ -212,7 +212,7 @@ await ta('ACTIVE standalone: the row is written FIRST, then a settings-apply int
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
   assert.equal(r.body.settings, undefined);
   assert.deepEqual(updateCalls.map((c) => c.patch), [{ platform_visibility: 'gated' }]);
   assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the runner reads the row — the write must precede the intent');
@@ -261,7 +261,7 @@ await ta('an enqueue that THROWS still answers 200 "saved" — never a 500 that
   enqueueThrows = new Error('db down');
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public' });
   assert.equal(updateCalls.length, 1, 'the write landed');
   receiptShape(r.body.push, { queued: false, restart: true, reachable: true });
   assert.match(r.body.push.message, /Saved, but the restart could not be queued/);
@@ -274,7 +274,7 @@ await ta('same values as already stored → no write, no event, no intent, "No c
   reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated', joinability: 'open' } } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public' });
   assert.equal(updateCalls.length, 0, 'nothing written (no updated_at reshuffle)');
   assert.equal(events.length, 0, 'no "settings changed" event for a change that is not one');
   assert.equal(enqueueCalls.length, 0, 'a whole-form save must not bounce a live project');