@bongos/core 1.19.511 → 1.19.513

package/tests/joinability_invite_only.mjs

@@ -187,6 +187,14 @@ test('the Watch page offers the Archon an invite by username — the way in when
   assert.match(watch, /nobody can apply, so this is how people get in/);
   const gate = (watch.match(/function renderGate\(data, target\) \{[\s\S]*?\n  \}\n/) || [''])[0];
   assert.ok(gate, 'renderGate() must exist');
-  assert.equal((gate.match(/wireInviteForm\(target\)/g) || []).length, 2, 'the form is wired in BOTH branches — an empty queue and a listed one');
-  assert.equal((gate.match(/inviteFormHtml\(\)/g) || []).length, 2, 'and rendered in both');
+  // The form used to be rendered and wired once per branch, and this counted the
+  // pair. Task 1002332 unified the empty and listed branches onto one `head`, so
+  // the count is now 1 and the invariant it stood for is STRONGER: the form is
+  // rendered and wired UNCONDITIONALLY, outside the split, so neither branch can
+  // drop it. tests/watch_applications_queue.mjs EXECUTES both cases ("an empty
+  // view still offers the invite form and the switch out of it") — the proof a
+  // source read like this one can only ever approximate.
+  assert.equal((gate.match(/inviteFormHtml\(\)/g) || []).length, 1, 'rendered once');
+  assert.match(gate, /const head = inviteFormHtml\(\)/, 'into the head BOTH branches are built from');
+  assert.match(gate, /\n {4}wireInviteForm\(target\);\n/, 'and wired at renderGate top level, never inside a branch');
 });

package/tests/project_door_ui.mjs

@@ -0,0 +1,267 @@
+// tests/project_door_ui.mjs — the owner's join-door control, EXECUTED (BV1.R05,
+// task 1002324, ADR 0182 D1).
+//
+// tests/projects_hub.mjs pins this section's source text; this file pins its
+// BEHAVIOUR. It lifts the real region out of modules/public-landing/public/
+// projects.html — the option table, renderDoor, loadDoor, doDoorSave and the
+// delegated click — runs it in a vm under a minimal DOM stub, PARSES the markup
+// it writes into innerHTML, and drives a real click on the Save control.
+//
+// Why a vm harness rather than jsdom: there is no jsdom in this repo. The
+// precedent is tests/task_detail_ui.mjs (after tests/goal_criterion_confirm_ui.mjs);
+// this one differs in where the source comes from — the hub's script is INLINE in
+// the page, so the region is sliced out rather than read from a .js file, and the
+// slice boundaries are asserted so a rename can never quietly test nothing.
+//
+// What it proves, and why each matters:
+//   • the three choices render with the goal's PLAIN interview labels
+//   • the project's CURRENT door is the preselected one — an owner opening the
+//     page reads their own setting, never a default that misreports it
+//   • only values the SERVER offered are rendered (the options list is the source)
+//   • Save PATCHes the own-scoped settings channel with exactly { visibility }
+//   • the platform's receipt is shown verbatim, and a refusal is SAID — the radio
+//     never moves to a value the server did not accept
+//
+// Run:  node --test --test-reporter=tap tests/project_door_ui.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The region under test, sliced from the page verbatim. Both boundaries are
+// asserted: a rename that moved either one would otherwise leave this file
+// executing an empty string and passing.
+const START = SCRIPT.indexOf('var DOOR_OPTIONS = {');
+const END = SCRIPT.indexOf('/* ── delete the project');
+assert.ok(START > 0, 'the join-door region must start at DOOR_OPTIONS');
+assert.ok(END > START, 'the join-door region must end before the delete section');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function renderDoor(', 'function loadDoor(', 'function doDoorSave(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+// Narrow on purpose (the task_detail_ui.mjs rule): it supports exactly the
+// selectors the region uses, so it stays honest about what it can prove.
+
+const RADIO = /<input type="radio" name="mDoorPick" value="([^"]*)"( checked)?>/g;
+const OPTION = /<label class="visOpt"><input type="radio" name="mDoorPick" value="([^"]*)"( checked)?><span><b>([^<]*)<\/b>([^<]*)<\/span><\/label>/g;
+
+function parseOptions(html) {
+  const out = [];
+  for (const m of String(html).matchAll(OPTION)) {
+    out.push({ value: m[1], checked: !!m[2], label: m[3], blurb: m[4] });
+  }
+  return out;
+}
+
+// Boot the region against a scripted settings channel and hand back the handles
+// a test drives it with.
+function boot({ settings, options = ['public', 'private', 'stealth'], patchAnswer } = {}) {
+  const requests = [];
+  const els = new Map();
+  const listeners = new Map();
+
+  const makeEl = (id) => ({
+    _id: id, _html: '', textContent: '', className: '', disabled: false,
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+    addEventListener(type, fn) {
+      if (type !== 'click') return;
+      if (!listeners.has(id)) listeners.set(id, []);
+      listeners.get(id).push(fn);
+    },
+  });
+  const $ = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+
+  // what the owner has clicked; starts as whatever the render marked checked
+  let picked = null;
+  const slotHtml = () => ($('mDoor')._html || '');
+  const saveBtn = { hasAttribute: (a) => a === 'data-door-save', disabled: false };
+
+  const document = {
+    querySelector(sel) {
+      if (sel === '#mDoor input[name="mDoorPick"]:checked') {
+        if (picked !== null) return { value: picked };
+        const found = [...slotHtml().matchAll(RADIO)].find((m) => m[2]);
+        return found ? { value: found[1] } : null;
+      }
+      if (sel === '#mDoor [data-door-save]') return slotHtml().includes('data-door-save') ? saveBtn : null;
+      throw new Error(`the stub does not support the selector ${sel}`);
+    },
+  };
+
+  const answer = (body, { ok = true, status = 200 } = {}) => Promise.resolve({ ok, status, _json: body });
+  const fetch = (url, init = {}) => {
+    requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
+    if ((init.method || 'GET') === 'GET') {
+      return answer({ ok: true, settings, options: { visibility: options } });
+    }
+    return patchAnswer || answer({ ok: true, saved: { ...settings, visibility: JSON.parse(init.body).visibility }, push: { queued: true, message: 'Saved. Your project will restart to pick this up — until then it keeps its current setting.' } });
+  };
+
+  const sandbox = {
+    $, document, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    encodeURIComponent, setTimeout, clearTimeout,
+    API: '/api/bongos',
+    manageId: '18',
+    manageInst: { id: 18, status: 'active' },
+    esc: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    apiError: (data, status) => ({ code: (data && data.error && data.error.code) || 'error', message: (data && data.error && data.error.message) || `HTTP ${status}` }),
+    signInAgain: () => '<a href="/signin">Sign in again</a>',
+    loadManage: () => { requests.push({ url: 'loadManage' }); },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#join-door' });
+
+  const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
+  return {
+    requests, sandbox, settle,
+    options: () => parseOptions(slotHtml()),
+    slot: () => slotHtml(),
+    msg: () => $('mDoorMsg'),
+    pick: (v) => { picked = v; },
+    async load() { sandbox.loadDoor(); await settle(); },
+    async clickSave() {
+      const handlers = listeners.get('mDoor') || [];
+      assert.equal(handlers.length, 1, 'the section wires exactly one delegated click handler');
+      handlers[0]({ target: { closest: (sel) => (sel === 'button' ? saveBtn : null) } });
+      await settle();
+    },
+  };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the three choices render with the goal’s plain interview labels', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  assert.deepEqual(ui.options().map((o) => o.label), ['Public', 'Private', 'Stealth']);
+  assert.deepEqual(ui.options().map((o) => o.value), ['public', 'private', 'stealth']);
+  assert.match(ui.slot(), /role="radiogroup"/, 'the pick is a real radio group, not a list of buttons');
+  for (const o of ui.options()) assert.ok(o.blurb.length > 20, `${o.label} says what it changes`);
+});
+
+test('the project’s current door is the one preselected — never a default that misreports it', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'stealth' } });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  const checked = ui.options().filter((o) => o.checked);
+  assert.equal(checked.length, 1, 'exactly one option is preselected');
+  assert.equal(checked[0].value, 'stealth');
+});
+
+test('only the values the SERVER offered are rendered', async () => {
+  // Arrange — a server that offers two (an older platform, or a narrowed list)
+  const ui = boot({ settings: { visibility: 'public' }, options: ['public', 'private'] });
+
+  // Act
+  await ui.load();
+
+  // Assert
+  assert.deepEqual(ui.options().map((o) => o.value), ['public', 'private']);
+});
+
+test('saving PATCHes the own-scoped settings channel with exactly { visibility }', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  const patch = ui.requests.find((r) => r.method === 'PATCH');
+  assert.ok(patch, 'a PATCH was sent');
+  assert.equal(patch.url, '/api/bongos/provisioning/instances/18/settings');
+  assert.deepEqual(JSON.parse(patch.body), { visibility: 'private' }, 'exactly the one key this section owns');
+  assert.equal(patch.credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+});
+
+test('the platform’s receipt is shown verbatim — the page never writes its own promise', async () => {
+  // Arrange
+  const ui = boot({ settings: { visibility: 'public' } });
+  await ui.load();
+  ui.pick('stealth');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().textContent,
+    'Saved. Your project will restart to pick this up — until then it keeps its current setting.');
+  assert.equal(ui.msg().className, 'projMsg ok');
+});
+
+test('a refusal is SAID, and the radio never moves to a value the server did not accept', async () => {
+  // Arrange
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 400, _json: { error: { code: 'validation_failed', message: 'visibility is not one of: public, private, stealth' } } }),
+  });
+  await ui.load();
+  ui.pick('unlisted');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /not one of: public, private, stealth/, 'the server’s own sentence');
+  assert.equal(ui.sandbox.mDoorSettings.value, 'public', 'the stored choice is untouched by a refused save');
+});
+
+test('a 409 intent_conflict is saved-but-waiting, not a failure', async () => {
+  // Arrange — the settings row IS written; another run holds the restart slot
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 409, _json: { error: { code: 'intent_conflict', message: 'The change was saved, but a \'provision\' run is currently running for this project.' } } }),
+  });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.equal(ui.msg().className, 'projMsg', 'not painted as an error — the change is recorded');
+  assert.match(ui.msg().textContent, /The change was saved/);
+});
+
+test('a signed-out save offers a way back in rather than a dead end', async () => {
+  // Arrange
+  const ui = boot({
+    settings: { visibility: 'public' },
+    patchAnswer: Promise.resolve({ ok: false, status: 401, _json: {} }),
+  });
+  await ui.load();
+  ui.pick('private');
+
+  // Act
+  await ui.clickSave();
+
+  // Assert
+  assert.match(ui.msg().innerHTML, /Sign in again/);
+});

package/tests/projects_hub.mjs

@@ -1135,7 +1135,7 @@ test('the manage view ships as real markup with the four settings homes (C7)', (
   assert.match(HUB, /id="view-manage"/);
   for (const id of ['mGate', 'mSignin', 'mMissing', 'mAlert', 'mLoading', 'mMain',
     'mName', 'mChip', 'mMeta', 'mAddr', 'mCreated',
-    'mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    'mVisibility', 'mJoinability', 'mDoorState', 'mRepoVisibility', 'mDelete']) {
     assert.match(HUB, new RegExp(`id="${id}"`), `${id} must be real markup`);
   }
   // every settings home is live now (tasks 1003042 / 1003043 / 1003044) — no not-yet copy remains
@@ -1475,6 +1475,78 @@ test('the joinability section is live markup with its body slot and a sibling fo
   assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
 });
 
+/* the join door (task 1002324, ADR 0182 D1): the third settings axis — how the
+   project stands on the platform's MAP, beside its own sign-in door and its own
+   membership door. Its labels are the goal's interview decision: PLAIN words,
+   because the space metaphor belongs to the drawn orb and never to the copy. */
+
+test('the join-door section is live markup with its body slot and a sibling fold (C7)', () => {
+  assert.match(HUB, /id="mDoor"/, 'the volatile slot is real markup, not JS-built');
+  assert.match(HUB, /id="mDoorWhat"/, 'the what-changes fold ships with the page');
+  const card = (HUB.match(/<div class="card mSec" id="mDoorState">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the join-door card must be extractable');
+  const slotAt = card.indexOf('id="mDoor"');
+  const foldAt = card.indexOf('id="mDoorWhat"');
+  assert.ok(slotAt > 0 && foldAt > slotAt, 'the fold sits outside the slot it must survive');
+  const fold = (HUB.match(/<details class="finePrint" id="mDoorWhat">[\s\S]*?<\/details>/) || [''])[0];
+  for (const label of ['Public', 'Private', 'Stealth']) {
+    assert.match(fold, new RegExp(`<b>${label}</b>`), `${label} is explained in the fold`);
+  }
+  // ADR 0182 D4: the bar is identity, and the gate must NAME what is missing
+  assert.match(fold, /only once it has a name and a description/, 'the publish bar is stated, so a Public pick that shows nowhere is never a mystery');
+  assert.match(fold, /separate from “Who can see it”/, 'the two doors are named as separate settings');
+  assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
+});
+
+test('the join-door labels are PLAIN — the space metaphor is the orb’s, never the copy’s (the goal’s interview decision)', () => {
+  assert.match(SCRIPT, /var DOOR_OPTIONS = \{\s*public: \{ label: 'Public'/);
+  assert.match(SCRIPT, /private: \{ label: 'Private'/);
+  assert.match(SCRIPT, /stealth: \{ label: 'Stealth'/);
+  // the card is the whole owner-facing surface of this setting: its markup plus
+  // the option table the render reads its words from
+  const card = (HUB.match(/<div class="card mSec" id="mDoorState">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const options = (SCRIPT.match(/var DOOR_OPTIONS = \{[\s\S]*?\n  \};/) || [''])[0];
+  assert.ok(card && options, 'both the card and the option table must be extractable');
+  // whole words only — "restarts" legitimately contains "star"
+  for (const word of ['planet', 'star', 'black hole', 'dark matter', 'dark-matter']) {
+    const re = new RegExp(`\\b${word}\\b`);
+    assert.doesNotMatch(card.toLowerCase(), re, `"${word}" must not reach the owner’s copy`);
+    assert.doesNotMatch(options.toLowerCase(), re, `"${word}" must not reach a choice’s label or blurb`);
+  }
+  // and the derived fourth state is never offered as a pick (ADR 0182 D2)
+  assert.doesNotMatch(options, /unlisted/i, 'dark matter is DERIVED — there is deliberately no way to choose it');
+});
+
+test('the join-door pick is a real radio group built from the server’s own options list', () => {
+  const render = fnHub('renderDoor');
+  assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!DOOR_OPTIONS\[v\]; \}\)/,
+    'only values the page can describe are offered — the server’s options list is the source');
+  assert.match(render, /role="radiogroup"/);
+  assert.match(render, /type="radio" name="mDoorPick"/);
+  assert.match(render, /v === s\.value \? ' checked' : ''/, 'the project’s current door is the preselected one');
+  assert.match(render, /data-door-save/, 'one Save control');
+});
+
+test('the join-door save sends the one key and shows the platform’s receipt verbatim', () => {
+  const save = fnHub('doDoorSave');
+  assert.match(save, /method: 'PATCH'/);
+  assert.match(save, /\/settings'/, 'PATCH /provisioning/instances/:id/settings — the own-scoped channel its two siblings use');
+  assert.match(save, /JSON\.stringify\(\{ visibility: value \}\)/, 'the body is the one key this section owns');
+  assert.match(save, /\(data\.push && data\.push\.message\)/, 'push.message is rendered as the server wrote it');
+  assert.match(save, /e\.code === 'intent_conflict' \? 'projMsg' : 'projMsg err'/,
+    'a 409 intent_conflict is saved-but-waiting — shown as the server’s sentence, not as a failure');
+  assert.match(save, /loadManage\(true, true\)/, 'the strip + in-flight line re-read open_intent after a save');
+});
+
+test('the join door is read on entry + tab return, like every other settings section', () => {
+  assert.match(SCRIPT, /if \(!keepRepo\) loadDoor\(\);/, 'never from the in-flight tick');
+  // deliberately NOT a manifest read-back: an already-deployed project reports no
+  // door yet, and a line that could only ever say "your project doesn’t report
+  // this" is worse than no line. The read-back lands with the enforcement.
+  const load = fnHub('loadDoor');
+  assert.doesNotMatch(load, /api\/gds\/instance/, 'this section asks the project’s manifest nothing');
+});
+
 test('the joinability choices are the platform’s vocabulary, each in plain words, and the pick is a real radio group', () => {
   assert.match(SCRIPT, /var JOIN_OPTIONS = \{\s*open: \{ label: 'Anyone can join'/);
   assert.match(SCRIPT, /apply: \{ label: 'Apply to join'/);

package/tests/projects_hub_pre_uat.mjs

@@ -267,8 +267,11 @@ test('the manage sections keep their order, and no placeholder copy remains (tas
   const repo = HUB.indexOf('id="mRepoVisibility"');
   const vis = HUB.indexOf('id="mVisibility"');
   const join = HUB.indexOf('id="mJoinability"');
+  // the join door (task 1002324) sits with the other two doors, before delete
+  const door = HUB.indexOf('id="mDoorState"');
   const del = HUB.indexOf('id="mDelete"');
-  assert.ok(repo > 0 && repo < vis && vis < join && join < del, 'repo visibility → who can see it → how people join → delete');
+  assert.ok(repo > 0 && repo < vis && vis < join && join < door && door < del,
+    'repo visibility → who can see it → how people join → on the map → delete');
   // "who can see it" is live since task 1003043 — its not-yet line is gone
   const visCard = HUB.slice(vis, join);
   assert.doesNotMatch(visCard, /isn’t wired up|For now, every project’s pages are open to everyone/);

package/tests/provision_settings_apply.mjs

@@ -59,6 +59,7 @@ PGDATABASE=spike
 # 1003139). Written at standup from the platform's provisioning_instances.settings;
 ${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOINABILITY=apply
+${NEUTRAL_PREFIX}_VISIBILITY=public
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -111,7 +112,7 @@ t('is PURE: same input, same output; empty body yields just the lines', () => {
 t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at standup, under the pack prefix', () => {
   const inst = { slug: 'spike', port: 3010, db_name: 'spike', hosting_shape: 'standalone', target_ref: 'jaxri/spike', settings: { platform_visibility: 'gated' } };
   const vars = P.settingsEnvVarsFor(inst);
-  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply' });
+  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply', [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public' });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
 });
@@ -122,10 +123,10 @@ const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_o
 const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
 
 t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' }), GATED), true);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' }), GATED), true);
 });
 t('false when the instance still reports a different value', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public' }), GATED), false);
   assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
 });
 t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
@@ -143,8 +144,8 @@ t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
 function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
   manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
   const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
-  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' })
-    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply' })
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' })
+    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public' })
     : manifest === 'none' ? manifestWith(undefined) : 'nope';
   const exec = (cmd, opts = {}) => {
     cmds.push(cmd);
@@ -212,7 +213,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });
@@ -397,7 +398,7 @@ await ta("cmdRunIntents (--apply) routes a 'settings-apply' intent to the leg, w
       claimNextOAuthManifest: async () => null,
       resolveOAuthManifest: async () => {},
     },
-    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open' }) } : { ok: true, stdout: '{"ok":true}' }; },
+    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open', visibility: 'public' }) } : { ok: true, stdout: '{"ok":true}' }; },
     writeFile: (p, body) => { writes.push(body); return { ok: true }; }, doApi: null,
   };
   const r = await P.cmdRunIntents(deps);