@bongos/core 1.19.511 → 1.19.512

package/docs/module-api-changelog.md

@@ -1459,5 +1459,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.509 with no explicit bump. run 33791237400. (task 1002620)
   1.19.511 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.510 with no explicit bump. run 33792868990. (task 1002620)
+  1.19.512 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.511 with no explicit bump. run 33793208383. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/provisioning.js

@@ -118,11 +118,37 @@ const RESTART_SHAPES = new Set(['co-tenant', 'standalone']);
 // (migration provisioning_009) is a dumb store with room for future keys.
 // DEFAULT_SETTINGS is TODAY's behavior (public surfaces, apply-to-join),
 // applied at read time so pre-existing rows need no data backfill.
+//
+// `visibility` is ADR 0182's STORED JOIN DOOR (BV1.R05, task 1002324) and it is a
+// third axis, not a synonym of its neighbours — the three answer three different
+// questions and an owner may set them independently:
+//
+//   platform_visibility  who may READ this project's own pages (its sign-in door)
+//   joinability          HOW someone becomes a member (self-join / apply / invite)
+//   visibility           how the project stands on the PLATFORM's map: named and
+//                        open (public), named and closed (private), or present but
+//                        anonymous (stealth)
+//
+// The name is ADR 0182 D1's deliberate choice — `goals.visibility` established the
+// word and one word across both planes beat an accurate name used in one place —
+// and D1 also records that it is a mild lie: this key does NOT decide whether the
+// project is on the map. PUBLISHABILITY does (a name + a description, ADR 0182 D4),
+// it is derived and never stored, and no value here can put a husk on the map.
+//
+// It is a POLICY, not a platform-drawn key: ADR 0182 D6 makes the door the CEILING
+// that `joinability` may only narrow, and D1/D5 put that authority on the instance —
+// so it rides web.env like its two neighbours and a restart applies it. The instance
+// reads it back as `project.visibility` (src/branding.js), which is what lets a later
+// task enforce the door there and report the value to the hub catalog (R08).
 const SETTINGS_VOCAB = Object.freeze({
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
+  visibility: ['public', 'private', 'stealth'],
 });
-const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply' });
+// Default = today's behavior on every axis, including the join door: ADR 0182's
+// migration gives the hub column the same `public` default, "existing rows keep
+// today's behaviour".
+const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
 
 // The project's PLANET (task 1003347, direction record §16): how the platform
 // DRAWS it on the sky, in the owner's list and on the card — its template

package/modules/provisioning/tests/provisioning.mjs

@@ -263,21 +263,24 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
-    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x' } }),
-    { platform_visibility: 'public', joinability: 'invite_only' },
+    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted' } }),
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'a non-object settings value reads as defaults');
+  // the join door reads back like any other policy key (task 1002324)
+  assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' }, 'a stored door overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {
@@ -336,7 +339,7 @@ t('the planet (task 1003347): PLANET_TEMPLATES mirrors platform-identity\'s PROJ
   assert.equal(P.PLANET_TEMPLATES.length, 36);
   assert.deepEqual([...P.PLANET_ACCENTS], ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent']);
   for (const a of P.PLANET_ACCENTS) assert.doesNotMatch(a, /^#|rgb|hsl/, 'a name, never a colour (the Fifteen Rule)');
-  assert.deepEqual(Object.keys(P.PLANET_VOCAB), ['planet_template', 'planet_accent']);
+  assert.deepEqual(Object.keys(P.PLANET_VOCAB), ['planet_template', 'planet_accent', 'card_backdrop']);
   // the deliberate asymmetry: the planet is NOT a setting — no default, never in SETTINGS_VOCAB
   for (const k of Object.keys(P.PLANET_VOCAB)) {
     assert.ok(!(k in P.SETTINGS_VOCAB), `${k} is not a policy the instance obeys`);
@@ -345,12 +348,12 @@ t('the planet (task 1003347): PLANET_TEMPLATES mirrors platform-identity\'s PROJ
 });
 
 t('planetChoice: null for a bare row or an unset key; a stored on-vocabulary value reads back; junk reads null, never leaks', () => {
-  assert.deepEqual(P.planetChoice(null), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({}), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: { platform_visibility: 'gated' } }), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' } }), { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' });
-  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'cube', planet_accent: '#fff' } }), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: ['nope'] }), { planet_template: null, planet_accent: null });
+  assert.deepEqual(P.planetChoice(null), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({}), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { platform_visibility: 'gated' } }), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' } }), { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit', card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'cube', planet_accent: '#fff' } }), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: ['nope'] }), { planet_template: null, planet_accent: null, card_backdrop: null });
 });
 
 t('publicInstance carries the planet — both keys, null when unset — so the list and the manage page read it off the row', () => {

package/modules/public-landing/public/projects.html

@@ -792,6 +792,25 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002324: the join door (ADR 0182 D1) — how the project
+           stands on the platform's map. The third axis, deliberately its own
+           section: the two above are about the project's OWN pages and its OWN
+           membership; this one is about the map everyone else reads. Same two
+           reads, key for key, as its siblings: the choice shown is the platform's
+           REQUEST (its settings row) and the save's reply is a receipt, never a
+           claim the project already runs it. Plain labels only — Public, Private,
+           Stealth — because the space words are the drawn orb's, not the copy's
+           (the goal's interview decision). The fold is a SIBLING of the volatile
+           slot so no re-render can drop it. -->
+      <div class="card mSec" id="mDoorState">
+        <h2>On the map</h2>
+        <div id="mDoor"><p class="finePrint">Reading the project’s settings…</p></div>
+        <details class="finePrint" id="mDoorWhat">
+          <summary>What each choice changes</summary>
+          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
+        </details>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -5168,6 +5187,7 @@ summary{min-height:24px;padding:3px 0;}
            the GitHub read: entry + tab return, never the in-flight tick */
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
+        if (!keepRepo) loadDoor();
         /* the publish gate (task 1002335) needs no second read — the verdict
            rode in on the instance itself. It sits behind the same keepRepo
            guard because its card holds a textarea the in-flight tick must
@@ -5953,6 +5973,111 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-join-save')) doJoinSave();
   });
 
+  /* ── on the map (task 1002324): the join door, ADR 0182 D1 — the third axis,
+     beside "who can see it" (the project's own sign-in door) and "how people
+     join" (its membership door). The two reads above, key for key: the CHOICE
+     comes from the platform's settings row and the save's reply is a RECEIPT —
+     its push.message is shown verbatim and never painted as the live state,
+     because the value reaches a running project only by the restart the runner
+     performs. Unlike its siblings this section asks the project's manifest
+     nothing: an already-deployed project reports no door yet, and a line that
+     could only ever say "your project doesn't report this" is worse than no
+     line. The read-back arrives with the enforcement (BV1.R11/R12).
+     Labels are PLAIN — Public / Private / Stealth — per the goal's interview:
+     the space metaphor is the drawn orb's, never the copy's. ── */
+
+  var DOOR_OPTIONS = {
+    public: { label: 'Public', blurb: 'The project is on the map under its name, and anyone who finds it can join.' },
+    private: { label: 'Private', blurb: 'On the map under its name, but nobody joins on their own — people ask, and you decide.' },
+    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join.' }
+  };
+  var mDoorSettings = null;  /* the platform row's last answer: { value, options } */
+
+  function doorMsg(html) { $('mDoor').innerHTML = html; }
+
+  function renderDoor() {
+    var s = mDoorSettings;
+    if (!s) return;
+    var opts = (s.options || []).filter(function (v) { return !!DOOR_OPTIONS[v]; });
+    doorMsg('<div role="radiogroup" aria-label="On the map">' + opts.map(function (v) {
+      var o = DOOR_OPTIONS[v];
+      return '<label class="visOpt"><input type="radio" name="mDoorPick" value="' + esc(v) + '"' +
+        (v === s.value ? ' checked' : '') + '><span><b>' + esc(o.label) + '</b>' + esc(o.blurb) + '</span></label>';
+    }).join('') + '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-door-save>Save</button></div>' +
+      '<div class="projMsg" id="mDoorMsg" role="status" aria-live="polite"></div>');
+  }
+
+  function loadDoor() {
+    mDoorSettings = null;
+    doorMsg('<p class="finePrint">Reading the project’s settings…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) {
+            mDoorSettings = {
+              value: (data.settings || {}).visibility,
+              options: (data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
+            };
+            renderDoor();
+            return;
+          }
+          doorMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        doorMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* the save sends the CHOICE and shows the platform's receipt verbatim */
+  function doDoorSave() {
+    if (!manageInst || !mDoorSettings) return;
+    var picked = document.querySelector('#mDoor input[name="mDoorPick"]:checked');
+    if (!picked) return;
+    var value = picked.value;
+    var box = $('mDoorMsg');
+    var btn = document.querySelector('#mDoor [data-door-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ visibility: value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice — the radio follows it, and nothing
+             here claims the project is already running it */
+          mDoorSettings.value = (data.saved || {}).visibility || value;
+          box.className = 'projMsg ok';
+          box.textContent = (data.push && data.push.message) || 'Saved.';
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        /* 409 intent_conflict: the change IS saved (recorded) — the server's
+           sentence says so and names the run holding the slot; show it as is */
+        box.className = e.code === 'intent_conflict' ? 'projMsg' : 'projMsg err';
+        box.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      if (btn) btn.disabled = false;
+      /* the strip + the sibling sections read open_intent — re-read it */
+      loadManage(true, true);
+    });
+  }
+
+  $('mDoor').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-door-save')) doDoorSave();
+  });
+
   /* ── delete the project (task 1003042): the manage page's teardown control.
      It renders from status + open_intent only — no second request — so the
      minute tick can repaint it and a queued teardown appears without a reload.

package/modules/ui-design/kit/serve.js

@@ -134,7 +134,7 @@ const FLOW_RECEIPTS = {
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
   // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
   provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
-  settings: { settings: { platform_visibility: 'public', joinability: 'open' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
+  settings: { settings: { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
 };
 // a teardown or restart ask is REMEMBERED for the run: the page re-reads the project right
 // after a receipt (doDelete → loadManage), and what it must then see is the queued intent —
@@ -160,6 +160,7 @@ function readBody(req, cb) {
 const STUB_VOCAB = {
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
+  visibility: ['public', 'private', 'stealth'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],
@@ -178,7 +179,7 @@ function settingsPatch(res, id, body) {
   const bad = settingsRejection(body);
   if (bad) return json(res, 400, { error: { code: 'validation_failed', message: bad } });
   if (PLANET_KEYS.some((k) => k in body)) PLANETS.set(String(id), Object.fromEntries(PLANET_KEYS.map((k) => [k, body[k] || null])));
-  const policy = ['platform_visibility', 'joinability'].some((k) => k in body);
+  const policy = ['platform_visibility', 'joinability', 'visibility'].some((k) => k in body);
   const push = policy ? FLOW_RECEIPTS.settings.push
     : { queued: false, restart: false, message: 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.' };
   return json(res, 200, { ok: true, saved: FLOW_RECEIPTS.settings.settings, planet: PLANETS.get(String(id)) || NO_PLANET, push });
@@ -209,7 +210,7 @@ function instances(res, id, settings) {
   if (id === null) return json(res, 200, { instances: list });
   const inst = list.find((i) => String(i.id) === String(id));
   if (!inst) return json(res, 404, { error: { code: 'not_found', message: 'no such instance' } });
-  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open' }, planet: PLANETS.get(String(id)) || NO_PLANET, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] } });
+  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, planet: PLANETS.get(String(id)) || NO_PLANET, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'], visibility: ['public', 'private', 'stealth'] } });
   return json(res, 200, { instance: inst, open_intent: inst.open_intent || null });
 }
 // A project's art in the featured fixture may be root-relative (the surface's

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.511",
+  "version": "1.19.512",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.511",
+      "version": "1.19.512",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.511",
+  "version": "1.19.512",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/branding.js

@@ -60,6 +60,11 @@ const ENV_OVERRIDES = [
   // — which is exactly why applying a change RESTARTS the instance.
   ['PLATFORM_VISIBILITY', ['project', 'platformVisibility']],
   ['JOINABILITY', ['project', 'joinability']],
+  // The join door the owner set on the platform (ADR 0182 D1, task 1002324) —
+  // public | private | stealth. Distinct from PLATFORM_VISIBILITY above, which is
+  // this instance's own sign-in door; this one is how the project stands on the
+  // platform's map, and D6 makes it the ceiling JOINABILITY may only narrow.
+  ['VISIBILITY', ['project', 'visibility']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
@@ -215,6 +220,10 @@ function clientBranding(b = branding()) {
     project: {
       platformVisibility: b.project?.platformVisibility || 'public',
       joinability: b.project?.joinability || 'apply',
+      // The join door (task 1002324). Public by nature for the same reason as its
+      // two neighbours: it is how the project asks to be seen on the map, and it is
+      // the READ-BACK a manage page needs to tell a saved choice from a live one.
+      visibility: b.project?.visibility || 'public',
     },
   };
 }

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.511'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.512'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/currency_label.mjs

@@ -48,10 +48,11 @@ test('R57: clientBranding exposes theme.ui (web), NOT theme.palette (server-only
 });
 
 test('clientBranding exposes project policy — the settings read-back (task 1003140), defaulting to today\'s behavior', () => {
-  assert.deepEqual(clientBranding({}).project, { platformVisibility: 'public', joinability: 'apply' });
+  // `visibility` — the join door — joined the block in task 1002324 (ADR 0182 D1)
+  assert.deepEqual(clientBranding({}).project, { platformVisibility: 'public', joinability: 'apply', visibility: 'public' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -70,7 +71,7 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // `project` joined the allow-list in task 1003140: the per-project policy is public
   // by nature and is the settings read-back a manage page needs (see clientBranding).
   assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'project', 'rankLabels', 'reward', 'theme']);
-  assert.deepEqual(Object.keys(projected.project).sort(), ['joinability', 'platformVisibility']);
+  assert.deepEqual(Object.keys(projected.project).sort(), ['joinability', 'platformVisibility', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }

package/tests/project_door_ui.mjs

@@ -0,0 +1,267 @@
+// tests/project_door_ui.mjs — the owner's join-door control, EXECUTED (BV1.R05,
+// task 1002324, ADR 0182 D1).
+//
+// tests/projects_hub.mjs pins this section's source text; this file pins its
+// BEHAVIOUR. It lifts the real region out of modules/public-landing/public/
+// projects.html — the option table, renderDoor, loadDoor, doDoorSave and the
+// delegated click — runs it in a vm under a minimal DOM stub, PARSES the markup
+// it writes into innerHTML, and drives a real click on the Save control.
+//
+// Why a vm harness rather than jsdom: there is no jsdom in this repo. The
+// precedent is tests/task_detail_ui.mjs (after tests/goal_criterion_confirm_ui.mjs);
+// this one differs in where the source comes from — the hub's script is INLINE in
+// the page, so the region is sliced out rather than read from a .js file, and the
+// slice boundaries are asserted so a rename can never quietly test nothing.
+//
+// What it proves, and why each matters:
+//   • the three choices render with the goal's PLAIN interview labels
+//   • the project's CURRENT door is the preselected one — an owner opening the
+//     page reads their own setting, never a default that misreports it
+//   • only values the SERVER offered are rendered (the options list is the source)
+//   • Save PATCHes the own-scoped settings channel with exactly { visibility }
+//   • the platform's receipt is shown verbatim, and a refusal is SAID — the radio
+//     never moves to a value the server did not accept
+//
+// Run:  node --test --test-reporter=tap tests/project_door_ui.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The region under test, sliced from the page verbatim. Both boundaries are
+// asserted: a rename that moved either one would otherwise leave this file
+// executing an empty string and passing.
+const START = SCRIPT.indexOf('var DOOR_OPTIONS = {');
+const END = SCRIPT.indexOf('/* ── delete the project');
+assert.ok(START > 0, 'the join-door region must start at DOOR_OPTIONS');
+assert.ok(END > START, 'the join-door region must end before the delete section');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function renderDoor(', 'function loadDoor(', 'function doDoorSave(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+// Narrow on purpose (the task_detail_ui.mjs rule): it supports exactly the
+// selectors the region uses, so it stays honest about what it can prove.
+
+const RADIO = /<input type="radio" name="mDoorPick" value="([^"]*)"( checked)?>/g;
+const OPTION = /<label class="visOpt"><input type="radio" name="mDoorPick" value="([^"]*)"( checked)?><span><b>([^<]*)<\/b>([^<]*)<\/span><\/label>/g;
+
+function parseOptions(html) {
+  const out = [];
+  for (const m of String(html).matchAll(OPTION)) {
+    out.push({ value: m[1], checked: !!m[2], label: m[3], blurb: m[4] });
+  }
+  return out;
+}
+
+// Boot the region against a scripted settings channel and hand back the handles
+// a test drives it with.
+function boot({ settings, options = ['public', 'private', 'stealth'], patchAnswer } = {}) {
+  const requests = [];
+  const els = new Map();
+  const listeners = new Map();
+
+  const makeEl = (id) => ({
+    _id: id, _html: '', textContent: '', className: '', disabled: false,
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+    addEventListener(type, fn) {
+      if (type !== 'click') return;
+      if (!listeners.has(id)) listeners.set(id, []);
+      listeners.get(id).push(fn);
+    },
+  });
+  const $ = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+
+  // what the owner has clicked; starts as whatever the render marked checked
+  let picked = null;
+  const slotHtml = () => ($('mDoor')._html || '');
+  const saveBtn = { hasAttribute: (a) => a === 'data-door-save', disabled: false };
+
+  const document = {
+    querySelector(sel) {
+      if (sel === '#mDoor input[name="mDoorPick"]:checked') {
+        if (picked !== null) return { value: picked };
+        const found = [...slotHtml().matchAll(RADIO)].find((m) => m[2]);
+        return found ? { value: found[1] } : null;
+      }
+      if (sel === '#mDoor [data-door-save]') return slotHtml().includes('data-door-save') ? saveBtn : null;
+      throw new Error(`the stub does not support the selector ${sel}`);
+    },
+  };
+
+  const answer = (body, { ok = true, status = 200 } = {}) => Promise.resolve({ ok, status, _json: body });
+  const fetch = (url, init = {}) => {
+    requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
+    if ((init.method || 'GET') === 'GET') {
+      return answer({ ok: true, settings, options: { visibility: options } });
+    }
+    return patchAnswer || answer({ ok: true, saved: { ...settings, visibility: JSON.parse(init.body).visibility }, push: { queued: true, message: 'Saved. Your project will restart to pick this up — until then it keeps its current setting.' } });
+  };
+
+  const sandbox = {
+    $, document, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    encodeURIComponent, setTimeout, clearTimeout,
+    API: '/api/bongos',
+    manageId: '18',
+    manageInst: { id: 18, status: 'active' },
+    esc: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    apiError: (data, status) => ({ code: (data && data.error && data.error.code) || 'error', message: (data && data.error && data.error.message) || `HTTP ${status}` }),
+    signInAgain: () => '<a href="/signin">Sign in again</a>',
+    loadManage: () => { requests.push({ url: 'loadManage' }); },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#join-door' });
+
+  const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
+  return {
+    requests, sandbox, settle,
+    options: () => parseOptions(slotHtml()),
+    slot: () => slotHtml(),
+    msg: () => $('mDoorMsg'),
+    pick: (v) => { picked = v; },
+    async load() { sandbox.loadDoor(); await settle(); },
+    async clickSave() {
+      const handlers = listeners.get('mDoor') || [];
+      assert.equal(handlers.length, 1, 'the section wires exactly one delegated click handler');
+      handlers[0]({ target: { closest: (sel) => (sel === 'button' ? saveBtn : null) } });
+      await settle();
+    },
+  };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the three choices render with the goal’s plain interview labels', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  assert.deepEqual(ui.options().map((o) => o.label), ['Public', 'Private', 'Stealth']);
+  assert.deepEqual(ui.options().map((o) => o.value), ['public', 'private', 'stealth']);
+  assert.match(ui.slot(), /role="radiogroup"/, 'the pick is a real radio group, not a list of buttons');
+  for (const o of ui.options()) assert.ok(o.blurb.length > 20, `${o.label} says what it changes`);
+});
+
+test('the project’s current door is the one preselected — never a default that misreports it', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'stealth' } });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  const checked = ui.options().filter((o) => o.checked);
+  assert.equal(checked.length, 1, 'exactly one option is preselected');
+  assert.equal(checked[0].value, 'stealth');
+});
+
+test('only the values the SERVER offered are rendered', async () => {
+  // Arrange — a server that offers two (an older platform, or a narrowed list)
+  const ui = boot({ settings: { visibility: 'public' }, options: ['public', 'private'] });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  assert.deepEqual(ui.options().map((o) => o.value), ['public', 'private']);
+});
+
+test('saving PATCHes the own-scoped settings channel with exactly { visibility }', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  const patch = ui.requests.find((r) => r.method === 'PATCH');
+  assert.ok(patch, 'a PATCH was sent');
+  assert.equal(patch.url, '/api/bongos/provisioning/instances/18/settings');
+  assert.deepEqual(JSON.parse(patch.body), { visibility: 'private' }, 'exactly the one key this section owns');
+  assert.equal(patch.credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+});
+
+test('the platform’s receipt is shown verbatim — the page never writes its own promise', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+  await ui.load();
+  ui.pick('stealth');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().textContent,
+    'Saved. Your project will restart to pick this up — until then it keeps its current setting.');
+  assert.equal(ui.msg().className, 'projMsg ok');
+});
+
+test('a refusal is SAID, and the radio never moves to a value the server did not accept', async () => {
+  // Arrange
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 400, _json: { error: { code: 'validation_failed', message: 'visibility is not one of: public, private, stealth' } } }),
+  });
+  await ui.load();
+  ui.pick('unlisted');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /not one of: public, private, stealth/, 'the server’s own sentence');
+  assert.equal(ui.sandbox.mDoorSettings.value, 'public', 'the stored choice is untouched by a refused save');
+});
+
+test('a 409 intent_conflict is saved-but-waiting, not a failure', async () => {
+  // Arrange — the settings row IS written; another run holds the restart slot
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 409, _json: { error: { code: 'intent_conflict', message: 'The change was saved, but a \'provision\' run is currently running for this project.' } } }),
+  });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().className, 'projMsg', 'not painted as an error — the change is recorded');
+  assert.match(ui.msg().textContent, /The change was saved/);
+});
+
+test('a signed-out save offers a way back in rather than a dead end', async () => {
+  // Arrange
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 401, _json: {} }),
+  });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.match(ui.msg().innerHTML, /Sign in again/);
+});