@bongos/core 1.19.511 → 1.19.512

package/tests/projects_hub.mjs

@@ -1135,7 +1135,7 @@ test('the manage view ships as real markup with the four settings homes (C7)', (
   assert.match(HUB, /id="view-manage"/);
   for (const id of ['mGate', 'mSignin', 'mMissing', 'mAlert', 'mLoading', 'mMain',
     'mName', 'mChip', 'mMeta', 'mAddr', 'mCreated',
-    'mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    'mVisibility', 'mJoinability', 'mDoorState', 'mRepoVisibility', 'mDelete']) {
     assert.match(HUB, new RegExp(`id="${id}"`), `${id} must be real markup`);
   }
   // every settings home is live now (tasks 1003042 / 1003043 / 1003044) — no not-yet copy remains
@@ -1475,6 +1475,78 @@ test('the joinability section is live markup with its body slot and a sibling fo
   assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
 });
 
+/* the join door (task 1002324, ADR 0182 D1): the third settings axis — how the
+   project stands on the platform's MAP, beside its own sign-in door and its own
+   membership door. Its labels are the goal's interview decision: PLAIN words,
+   because the space metaphor belongs to the drawn orb and never to the copy. */
+
+test('the join-door section is live markup with its body slot and a sibling fold (C7)', () => {
+  assert.match(HUB, /id="mDoor"/, 'the volatile slot is real markup, not JS-built');
+  assert.match(HUB, /id="mDoorWhat"/, 'the what-changes fold ships with the page');
+  const card = (HUB.match(/<div class="card mSec" id="mDoorState">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the join-door card must be extractable');
+  const slotAt = card.indexOf('id="mDoor"');
+  const foldAt = card.indexOf('id="mDoorWhat"');
+  assert.ok(slotAt > 0 && foldAt > slotAt, 'the fold sits outside the slot it must survive');
+  const fold = (HUB.match(/<details class="finePrint" id="mDoorWhat">[\s\S]*?<\/details>/) || [''])[0];
+  for (const label of ['Public', 'Private', 'Stealth']) {
+    assert.match(fold, new RegExp(`<b>${label}</b>`), `${label} is explained in the fold`);
+  }
+  // ADR 0182 D4: the bar is identity, and the gate must NAME what is missing
+  assert.match(fold, /only once it has a name and a description/, 'the publish bar is stated, so a Public pick that shows nowhere is never a mystery');
+  assert.match(fold, /separate from “Who can see it”/, 'the two doors are named as separate settings');
+  assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
+});
+
+test('the join-door labels are PLAIN — the space metaphor is the orb’s, never the copy’s (the goal’s interview decision)', () => {
+  assert.match(SCRIPT, /var DOOR_OPTIONS = \{\s*public: \{ label: 'Public'/);
+  assert.match(SCRIPT, /private: \{ label: 'Private'/);
+  assert.match(SCRIPT, /stealth: \{ label: 'Stealth'/);
+  // the card is the whole owner-facing surface of this setting: its markup plus
+  // the option table the render reads its words from
+  const card = (HUB.match(/<div class="card mSec" id="mDoorState">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const options = (SCRIPT.match(/var DOOR_OPTIONS = \{[\s\S]*?\n  \};/) || [''])[0];
+  assert.ok(card && options, 'both the card and the option table must be extractable');
+  // whole words only — "restarts" legitimately contains "star"
+  for (const word of ['planet', 'star', 'black hole', 'dark matter', 'dark-matter']) {
+    const re = new RegExp(`\\b${word}\\b`);
+    assert.doesNotMatch(card.toLowerCase(), re, `"${word}" must not reach the owner’s copy`);
+    assert.doesNotMatch(options.toLowerCase(), re, `"${word}" must not reach a choice’s label or blurb`);
+  }
+  // and the derived fourth state is never offered as a pick (ADR 0182 D2)
+  assert.doesNotMatch(options, /unlisted/i, 'dark matter is DERIVED — there is deliberately no way to choose it');
+});
+
+test('the join-door pick is a real radio group built from the server’s own options list', () => {
+  const render = fnHub('renderDoor');
+  assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!DOOR_OPTIONS\[v\]; \}\)/,
+    'only values the page can describe are offered — the server’s options list is the source');
+  assert.match(render, /role="radiogroup"/);
+  assert.match(render, /type="radio" name="mDoorPick"/);
+  assert.match(render, /v === s\.value \? ' checked' : ''/, 'the project’s current door is the preselected one');
+  assert.match(render, /data-door-save/, 'one Save control');
+});
+
+test('the join-door save sends the one key and shows the platform’s receipt verbatim', () => {
+  const save = fnHub('doDoorSave');
+  assert.match(save, /method: 'PATCH'/);
+  assert.match(save, /\/settings'/, 'PATCH /provisioning/instances/:id/settings — the own-scoped channel its two siblings use');
+  assert.match(save, /JSON\.stringify\(\{ visibility: value \}\)/, 'the body is the one key this section owns');
+  assert.match(save, /\(data\.push && data\.push\.message\)/, 'push.message is rendered as the server wrote it');
+  assert.match(save, /e\.code === 'intent_conflict' \? 'projMsg' : 'projMsg err'/,
+    'a 409 intent_conflict is saved-but-waiting — shown as the server’s sentence, not as a failure');
+  assert.match(save, /loadManage\(true, true\)/, 'the strip + in-flight line re-read open_intent after a save');
+});
+
+test('the join door is read on entry + tab return, like every other settings section', () => {
+  assert.match(SCRIPT, /if \(!keepRepo\) loadDoor\(\);/, 'never from the in-flight tick');
+  // deliberately NOT a manifest read-back: an already-deployed project reports no
+  // door yet, and a line that could only ever say "your project doesn’t report
+  // this" is worse than no line. The read-back lands with the enforcement.
+  const load = fnHub('loadDoor');
+  assert.doesNotMatch(load, /api\/gds\/instance/, 'this section asks the project’s manifest nothing');
+});
+
 test('the joinability choices are the platform’s vocabulary, each in plain words, and the pick is a real radio group', () => {
   assert.match(SCRIPT, /var JOIN_OPTIONS = \{\s*open: \{ label: 'Anyone can join'/);
   assert.match(SCRIPT, /apply: \{ label: 'Apply to join'/);

package/tests/projects_hub_pre_uat.mjs

@@ -267,8 +267,11 @@ test('the manage sections keep their order, and no placeholder copy remains (tas
   const repo = HUB.indexOf('id="mRepoVisibility"');
   const vis = HUB.indexOf('id="mVisibility"');
   const join = HUB.indexOf('id="mJoinability"');
+  // the join door (task 1002324) sits with the other two doors, before delete
+  const door = HUB.indexOf('id="mDoorState"');
   const del = HUB.indexOf('id="mDelete"');
-  assert.ok(repo > 0 && repo < vis && vis < join && join < del, 'repo visibility → who can see it → how people join → delete');
+  assert.ok(repo > 0 && repo < vis && vis < join && join < door && door < del,
+    'repo visibility → who can see it → how people join → on the map → delete');
   // "who can see it" is live since task 1003043 — its not-yet line is gone
   const visCard = HUB.slice(vis, join);
   assert.doesNotMatch(visCard, /isn’t wired up|For now, every project’s pages are open to everyone/);

package/tests/provision_settings_apply.mjs

@@ -59,6 +59,7 @@ PGDATABASE=spike
 # 1003139). Written at standup from the platform's provisioning_instances.settings;
 ${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOINABILITY=apply
+${NEUTRAL_PREFIX}_VISIBILITY=public
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -111,7 +112,7 @@ t('is PURE: same input, same output; empty body yields just the lines', () => {
 t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at standup, under the pack prefix', () => {
   const inst = { slug: 'spike', port: 3010, db_name: 'spike', hosting_shape: 'standalone', target_ref: 'jaxri/spike', settings: { platform_visibility: 'gated' } };
   const vars = P.settingsEnvVarsFor(inst);
-  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply' });
+  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply', [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public' });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
 });
@@ -122,10 +123,10 @@ const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_o
 const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
 
 t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' }), GATED), true);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' }), GATED), true);
 });
 t('false when the instance still reports a different value', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public' }), GATED), false);
   assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
 });
 t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
@@ -143,8 +144,8 @@ t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
 function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
   manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
   const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
-  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' })
-    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply' })
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' })
+    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public' })
     : manifest === 'none' ? manifestWith(undefined) : 'nope';
   const exec = (cmd, opts = {}) => {
     cmds.push(cmd);
@@ -212,7 +213,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });
@@ -397,7 +398,7 @@ await ta("cmdRunIntents (--apply) routes a 'settings-apply' intent to the leg, w
       claimNextOAuthManifest: async () => null,
       resolveOAuthManifest: async () => {},
     },
-    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open' }) } : { ok: true, stdout: '{"ok":true}' }; },
+    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open', visibility: 'public' }) } : { ok: true, stdout: '{"ok":true}' }; },
     writeFile: (p, body) => { writes.push(body); return { ok: true }; }, doApi: null,
   };
   const r = await P.cmdRunIntents(deps);

package/tests/provisioning_settings.mjs

@@ -164,11 +164,14 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
     platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'],
+    // the join door (task 1002324, ADR 0182 D1) — the third policy axis, offered
+    // to the form the same way as its two neighbours
+    visibility: ['public', 'private', 'stealth'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -181,14 +184,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -216,7 +219,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -229,7 +232,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -257,6 +260,62 @@ await ta('an off-vocabulary value → 400 validation_failed (nothing written)',
   assert.equal(updateCalls.length, 0);
 });
 
+// ── the join door (BV1.R05, task 1002324) ────────────────────────────────────
+// ADR 0182 D1's STORED axis — Public / Private / Stealth — reaching the owner on
+// the same own-scoped channel as its two neighbours. What these pin: the server,
+// not the form, decides a value is legal; a fourth state cannot be picked because
+// dark matter is DERIVED (D2); and the door is a POLICY, so it rides the push.
+console.log('\nPATCH /provisioning/instances/:id/settings — the join door (task 1002324):');
+
+await ta('the owner sets the door to stealth — stored, echoed effective, audited, and pushed like the policy it is', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
+  assert.equal(events[0].actor, 'api:self');
+  assert.match(events[0].detail, /visibility=stealth/);
+  // ADR 0182 D6 makes the door the CEILING joinability may only narrow, and D1/D5
+  // put that authority on the instance — so it must ride web.env + the restart,
+  // not the planet's draw-only channel.
+  assert.equal(r.body.push.queued, true, 'the door is a policy the instance obeys — it pushes');
+  assert.equal(r.body.push.restart, true, 'and a restart is what applies it');
+});
+
+await ta('each of the three states is accepted', async () => {
+  for (const value of ['public', 'private', 'stealth']) {
+    reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { visibility: value === 'public' ? 'stealth' : 'public' } } });
+    const r = await patch('/provisioning/instances/18/settings', { visibility: value });
+    assert.equal(r.status, 200, `${value}: ${r.raw}`);
+    assert.equal(r.body.saved.visibility, value);
+  }
+});
+
+await ta('a fourth state is refused server-side — dark matter is DERIVED, never picked (ADR 0182 D2)', async () => {
+  for (const bogus of ['unlisted', 'dark-matter', 'gated', 'hidden', '']) {
+    reset();
+    const r = await patch('/provisioning/instances/18/settings', { visibility: bogus });
+    assert.equal(r.status, 400, `${JSON.stringify(bogus)} must be refused: ${r.raw}`);
+    assert.equal(r.body.error.code, 'validation_failed');
+    assert.equal(updateCalls.length, 0, 'nothing written on a refused value');
+  }
+});
+
+await ta('the OWN-SCOPE WALL holds for the door: another builder\'s PATCH → 404, nothing written', async () => {
+  reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
+  const r = await patch('/provisioning/instances/18/settings', { visibility: 'private' });
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found', 'no existence leak');
+  assert.equal(updateCalls.length, 0);
+  assert.equal(events.length, 0);
+});
+
+await ta('an unknown project → 404 for the door too, archon included', async () => {
+  reset({ inst: null, as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await patch('/provisioning/instances/999/settings', { visibility: 'private' });
+  assert.equal(r.status, 404, r.raw);
+});
+
 await ta('an unknown key → 400 (strict: a typo fails loudly, never silently dropped)', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinabilty: 'open' });
@@ -272,7 +331,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');

package/tests/provisioning_settings_apply.mjs

@@ -212,7 +212,7 @@ await ta('ACTIVE standalone: the row is written FIRST, then a settings-apply int
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
   assert.equal(r.body.settings, undefined);
   assert.deepEqual(updateCalls.map((c) => c.patch), [{ platform_visibility: 'gated' }]);
   assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the runner reads the row — the write must precede the intent');
@@ -261,7 +261,7 @@ await ta('an enqueue that THROWS still answers 200 "saved" — never a 500 that
   enqueueThrows = new Error('db down');
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public' });
   assert.equal(updateCalls.length, 1, 'the write landed');
   receiptShape(r.body.push, { queued: false, restart: true, reachable: true });
   assert.match(r.body.push.message, /Saved, but the restart could not be queued/);
@@ -274,7 +274,7 @@ await ta('same values as already stored → no write, no event, no intent, "No c
   reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated', joinability: 'open' } } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public' });
   assert.equal(updateCalls.length, 0, 'nothing written (no updated_at reshuffle)');
   assert.equal(events.length, 0, 'no "settings changed" event for a change that is not one');
   assert.equal(enqueueCalls.length, 0, 'a whole-form save must not bounce a live project');

package/tests/provisioning_settings_env.mjs

@@ -55,7 +55,9 @@ t('a row with NO stored settings emits today\'s behavior EXPLICITLY, never nothi
   // an instance must never have to infer a policy from an absent variable
   assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
   assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
-  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length, 2, 'both keys always present');
+  // the join door rides the same transport (task 1002324, ADR 0182 D1)
+  assert.equal(v.CLOUDBONGOS_VISIBILITY, 'public');
+  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length, 3, 'every policy key always present');
 });
 
 t('an off-vocabulary stored value falls back to the default, never reaches the instance', () => {
@@ -94,11 +96,11 @@ t('it names the live push by the intent the runner actually dispatches (task 100
 });
 
 t('settingsEnvVars is the single source both legs derive from — same keys, same values as the lines', () => {
-  const row = { settings: { platform_visibility: 'gated', joinability: 'open' } };
+  const row = { settings: { platform_visibility: 'gated', joinability: 'open', visibility: 'stealth' } };
   const vars = provisioning.settingsEnvVars(row, 'CLOUDBONGOS');
-  assert.deepEqual(vars, { CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open' });
+  assert.deepEqual(vars, { CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open', CLOUDBONGOS_VISIBILITY: 'stealth' });
   assert.deepEqual(varsOf(provisioning.settingsEnvLines(row, 'CLOUDBONGOS')), vars, 'the standup lines ARE the vars');
-  assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), { X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply' }, 'defaults, explicitly');
+  assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), { X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public' }, 'defaults, explicitly');
 });
 
 console.log('\nwebEnvBody — the settings ride the real per-instance env file:');
@@ -131,12 +133,12 @@ t('clientBranding\'s project fallbacks are DEFAULT_SETTINGS, key for key — the
 
 t('the env override resolves onto project.* in a real process', () => {
   const read = (env) => JSON.parse(execFileSync(process.execPath, ['-e',
-    "const b=require('./src/branding.js');const r=(b.branding||b)();console.log(JSON.stringify({v:r.project.platformVisibility,j:r.project.joinability}))"],
+    "const b=require('./src/branding.js');const r=(b.branding||b)();console.log(JSON.stringify({v:r.project.platformVisibility,j:r.project.joinability,d:r.project.visibility}))"],
     { cwd: ROOT, encoding: 'utf8', env: { ...process.env, ...env } }));
-  assert.deepEqual(read({}), { v: 'public', j: 'apply' }, 'no env → the pack default');
+  assert.deepEqual(read({}), { v: 'public', j: 'apply', d: 'public' }, 'no env → the pack default');
   assert.deepEqual(
-    read({ CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'invite_only' }),
-    { v: 'gated', j: 'invite_only' },
+    read({ CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'invite_only', CLOUDBONGOS_VISIBILITY: 'stealth' }),
+    { v: 'gated', j: 'invite_only', d: 'stealth' },
     'the web.env the runner writes is what the instance reads');
 });