@bongos/core 1.19.515 → 1.19.517

package/modules/ui-design/kit/serve.js

@@ -108,6 +108,32 @@ const FEEDS = {
 const AUTHED = { '/my-projects': 'my-projects' };
 const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' } };
 
+// GET /provisioning/starter-bundles as the create wizard's module picker reads it
+// (task 1002339 / BV1.R19's route, ADR 0237). A fixture rather than an import —
+// the kit stub deliberately requires no module — kept honest by
+// tests/provisioning_starter_bundles.mjs, which reads this file and compares it
+// against the real declaration. `core` is the count the panel's clause names, so
+// only its length matters here; `optional` and `bundles` are byte-for-byte.
+const STARTER_BUNDLES_FIXTURE = {
+  core: [
+    'autonomy', 'builder-settings', 'copy-desk', 'economy', 'government', 'grading',
+    'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'public-landing',
+    'security', 'sessions', 'status-ui', 'ui-design',
+  ],
+  bundles: [
+    { type: 'game', bundle: ['dev-box', 'discord'] },
+    { type: 'research', bundle: ['agents'] },
+    { type: 'business', bundle: ['agents', 'dev-box'] },
+    { type: 'non-profit', bundle: ['discord'] },
+    { type: 'not-sure', bundle: [] },
+  ],
+  optional: [
+    { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets, for reading, research and review.' },
+    { key: 'dev-box', label: 'Dev boxes', summary: 'A cloud workspace where a change can be tried out before anyone else sees it. Nothing is charged until someone asks for one.' },
+    { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.' },
+  ],
+};
+
 function json(res, status, body) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(body)); }
 function fixture(name, res, origin) {
   if (FAIL.has(name)) return json(res, 500, { error: { code: 'stub_failure', message: `FAIL=${name}` } });
@@ -277,6 +303,12 @@ const server = http.createServer((req, res) => {
     }
     if (rest.startsWith('/github/repo')) return AUTH ? json(res, 200, { repo: { private: false, admin: true } }) : json(res, 401, UNAUTH);
     if (rest.startsWith('/provisioning/slug-available')) return json(res, 200, { available: true }); /* the wizard's handle check (task 1003346): every handle is free on the stub */
+    /* the module picker's one read (task 1002339). A FIXTURE, like everything
+       else here — the stub imports no module — but not a free-hand one:
+       tests/provisioning_starter_bundles.mjs pins it against the real
+       starter-bundles.js declaration, so the picture the kit renders and the
+       payload the route serves cannot drift apart silently. */
+    if (rest === '/provisioning/starter-bundles') return json(res, 200, STARTER_BUNDLES_FIXTURE);
     if (rest === '/auth/logout') return json(res, 200, { ok: true });
     if (rest.startsWith('/auth/web/start')) { res.writeHead(302, { location: PREFIX }); return res.end(); }
     if (rest === '/instance') { const b = pages.size ? pages.values().next().value.brand : {}; return json(res, 200, { brand: { productName: (b && b.productName) || '', project: {} }, modules: {} }); }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.515",
+  "version": "1.19.517",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.515",
+      "version": "1.19.517",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.515",
+  "version": "1.19.517",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.515'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.517'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_kit_charts.mjs

@@ -76,6 +76,55 @@ test('cumulate is a running total that survives holes', () => {
   assert.deepEqual(kit.cumulate([]), []);
 });
 
+test('cumulateByDay groups a day, cumulates it, and drops what will not parse', () => {
+  // The third caller of this shape put it in the kit (task 1003446): the
+  // profile's two lines and /drachmae's treasury.
+  const pts = kit.cumulateByDay([
+    { day: '2026-05-02T10:00:00Z', v: 1 },
+    { day: '2026-05-02T22:00:00Z', v: 2 },   // same day → one point
+    { day: '2026-05-04T00:00:00Z', v: 4 },
+  ], { valueOf: (r) => r.v });
+  assert.deepEqual(pts.map((p) => p.value), [3, 7], 'summed within a day, cumulative across');
+  assert.equal(pts.length, 2, 'a day with no row is not invented');
+  assert.ok(pts[0].x < pts[1].x, 'ascending');
+});
+
+test('an unparsable date is dropped, not counted at the epoch', () => {
+  // Counted at 0 it would stretch the axis back to 1970 and flatten every real
+  // point onto the floor — the failure mode is a chart, not an exception.
+  const pts = kit.cumulateByDay([
+    { day: 'not a date', v: 99 },
+    { day: '2026-05-02T10:00:00Z', v: 5 },
+  ], { valueOf: (r) => r.v });
+  assert.deepEqual(pts.map((p) => p.value), [5]);
+  assert.ok(pts[0].x > Date.parse('2020-01-01'), 'and the axis starts in this decade');
+});
+
+test('cumulateByDay reads the date column the caller names', () => {
+  // shipped_at on an activity row, recorded_at on a credits row, day on a
+  // gap-filled feed — only the caller knows which.
+  const pts = kit.cumulateByDay(
+    [{ recorded_at: '2026-05-02T10:00:00Z', delta: 8 }],
+    { dateOf: (r) => r.recorded_at, valueOf: (r) => r.delta },
+  );
+  assert.deepEqual(pts.map((p) => p.value), [8]);
+  assert.deepEqual(kit.cumulateByDay(null), [], 'and no rows is no points');
+});
+
+test('a plot with no readout ships no focus stop and no dead crosshair', () => {
+  // A role="img" with tabindex="0" is a focus stop a keyboard reader lands on
+  // with nothing to do; a crosshair nothing moves only looks like a feature.
+  const inert = kit.plotSvgHtml({ series: '<path/>', ariaLabel: 'Spent', interactive: false });
+  assert.doesNotMatch(inert, /tabindex/);
+  assert.doesNotMatch(inert, /kit-plot__hair/);
+  assert.match(inert, /aria-label="Spent"/, 'the label is still the reading');
+  assert.match(inert, /kit-plot__axis/, 'and the axis is still drawn');
+  // The default stays interactive, because the profile wires a readout.
+  const live = kit.plotSvgHtml({ series: '<path/>' });
+  assert.match(live, /tabindex="0"/);
+  assert.match(live, /kit-plot__hair/);
+});
+
 test('the line is scaled to its own min and max, and a flat series sits mid-box', () => {
   const g = kit.linePoints([0, 10], { width: 100, height: 50, pad: 0 });
   const ys = g.points.split(' ').map((p) => Number(p.split(',')[1]));

package/tests/hall_reference_world.mjs

@@ -220,3 +220,132 @@ test('the reference renders exactly one h1, the page head\'s', () => {
   assert.equal([...html.matchAll(/<h1\b/g)].length, 1);
   assert.match(html, /<h1 class="page-head__h">/);
 });
+
+// ---- 9. the treasury section (task 1003446) --------------------------------
+//
+// The sharpest version of goal 1000072's thesis. /drachmae is labelled Economy
+// in the nav and was a markdown reader with ZERO live numbers, while the
+// signed-out status page already drew this very endpoint's cumulative line and
+// the Work board fetched the same payload to read ONE scalar off it. The
+// stranger got the chart; the builder got the number.
+//
+// The section's ARITHMETIC is not asserted here — it is the kit's
+// (`cumulateByDay`, `timeStepSeriesHtml`, `barSeriesHtml`) and
+// tests/hall_kit_charts.mjs runs the real kit against it. What these hold is
+// the page's half of the contract, the half a kit test cannot see.
+
+const costSummaryFixture = JSON.parse(
+  fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'cost-summary.json'), 'utf8'),
+);
+
+test('the treasury reads the endpoint that already carried the series — no new route', () => {
+  // The whole point of the task: the payload had both series all along, and the
+  // route's own comment calls daily[] "the treasury chart's cumulative line".
+  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/gds\/public\/cost-summary'/);
+  assert.ok(costSummaryFixture.daily.length, 'the payload really carries daily[]');
+  assert.ok(costSummaryFixture.daily_credits.length, 'and daily_credits[]');
+  assert.ok(Number(costSummaryFixture.total_usd) > 0, 'and the totals the prose states');
+  assert.ok(Number(costSummaryFixture.total_value_credits) > 0);
+});
+
+test('RUN: the cumulative line ends exactly on the total the prose states', async () => {
+  // The invariant that matters, and the one a source-text assertion cannot
+  // reach: the chart and the sentence above it are derived from the SAME
+  // payload, so they can never disagree. Run against the real kit and the real
+  // checked-in summary, which is where a units or gap-fill mistake would show
+  // up as a line ending somewhere other than the headline number.
+  const kitPath = path.join(HALL, 'hall-kit.js');
+  const kit = await import(`file://${kitPath.replace(/\\/g, '/')}`).then((m) => m.default);
+  const spend = kit.cumulateByDay(costSummaryFixture.daily, { valueOf: (r) => r.amount_usd });
+  const earned = kit.cumulateByDay(costSummaryFixture.daily_credits, { valueOf: (r) => r.credits });
+  assert.ok(spend.length > 1 && earned.length > 1, 'both series have depth');
+  assert.ok(Math.abs(spend[spend.length - 1].value - Number(costSummaryFixture.total_usd)) < 1,
+    'the spend line ends on total_usd');
+  assert.equal(earned[earned.length - 1].value, Number(costSummaryFixture.total_value_credits),
+    'and the awarded line ends on total_value_credits');
+  // Whatever the plot draws from that must be finite — a NaN in a path `d`
+  // renders as an invisible chart with no error anywhere.
+  const series = kit.timeStepSeriesHtml(spend, {
+    x0: spend[0].x, x1: spend[spend.length - 1].x, yMax: spend[spend.length - 1].value,
+  });
+  assert.doesNotMatch(series.body, /NaN|Infinity/);
+  assert.doesNotMatch(
+    kit.barSeriesHtml(costSummaryFixture.by_category.map((c) => ({ label: c.category, value: c.total_usd }))),
+    /NaN|Infinity/,
+  );
+});
+
+test('the page loads the chart primitive BEFORE the script that reads it', () => {
+  // window.OTBKit read at insert time with the kit loaded after it is an empty
+  // section in production and a green unit suite.
+  const loaded = [...drachmaeHtml.matchAll(/<script[^>]+src="([^"?]+)/g)].map((m) => m[1].split('/').pop());
+  const kitAt = loaded.indexOf('hall-kit.js');
+  const pageAt = loaded.indexOf('drachmae.js');
+  assert.ok(kitAt > -1, 'drachmae.html must load hall-kit.js');
+  assert.ok(pageAt > -1, 'and drachmae.js');
+  assert.ok(kitAt < pageAt, 'kit first');
+});
+
+test('every mark on the page is drawn by the kit, none by hand', () => {
+  const js = dejscomment(drachmaeJs);
+  for (const fn of ['cumulateByDay', 'timeStepSeriesHtml', 'plotSvgHtml', 'plotValueLabelHtml', 'barSeriesHtml']) {
+    assert.match(js, new RegExp(`(kit|window\\.OTBKit)\\.${fn}\\(`), `the treasury draws through ${fn}`);
+  }
+  // The §6b audit rule holds this globally; asserted here too because THIS is
+  // the page that had no chart at all and so the easiest place to hand-roll one.
+  assert.doesNotMatch(js, /<(?:path|polyline|rect)\b[^>]*\b(?:d|points)="\$\{/,
+    'no hand-built SVG geometry on the reference page');
+});
+
+test('the section degrades to NOTHING rather than an empty panel', () => {
+  const js = dejscomment(drachmaeJs);
+  // The bounty section's contract, kept: a failed read leaves the prose alone
+  // and adds no outline entry that leads nowhere.
+  const fn = js.slice(js.indexOf('async function insertTreasurySection'));
+  const body = fn.slice(0, fn.indexOf('\n  }\n'));
+  assert.match(body, /console\.warn\([^)]*cost summary unavailable/);
+  assert.equal((body.match(/return false;/g) || []).length, 3,
+    'three honest exits: no kit, an unreadable summary, and a treasury with nothing in it');
+  assert.match(body, /if \(!spend\.length && !earned\.length\) return false;/,
+    'both series empty is one honest nothing, not two empty plots');
+});
+
+test('the plots ship no focus stop, because nothing here wires a readout', () => {
+  // A role="img" with tabindex="0" is a focus stop a keyboard reader lands on
+  // with nothing to do, and a crosshair nothing moves only looks like a
+  // feature. The kit half is asserted in tests/hall_kit_charts.mjs.
+  assert.match(dejscomment(drachmaeJs), /interactive: false/);
+});
+
+test('the currency is the branding pack\'s, never a hardcoded word', () => {
+  const js = dejscomment(drachmaeJs);
+  assert.match(js, /__BRANDING__ && window\.__BRANDING__\.currency/);
+  assert.match(js, /\|\| 'credits'/, 'with a neutral fallback, not a world-specific one');
+  assert.doesNotMatch(js.replace(/\|\| 'credits'/g, ''), /drachmae'/i,
+    'the instance\'s own currency name is not spelled into the core page');
+});
+
+test('the treasury lands ahead of the rate card, so the doc still ends on "dig deeper"', () => {
+  const js = dejscomment(drachmaeJs);
+  // The bounty section goes in first and the treasury anchors on its id, so the
+  // order is prose → what happened → the published rates → the closing links.
+  const boot = js.slice(js.indexOf('async function boot()'));
+  assert.ok(boot.indexOf('insertBountySection(article)') < boot.indexOf('insertTreasurySection(article)'),
+    'the rate card is inserted first, so the treasury can anchor ahead of it');
+  assert.match(js, /article\.querySelector\(`#\$\{BOUNTY_SECTION_ID\}`\)/);
+  assert.match(js, /CLOSING_H2\.test/, 'and it falls back to the closing links, then to appending');
+});
+
+test('the figure chrome is shared, because a second page now draws figures', () => {
+  // .pchart* moved from profile.css to style.css with this task. drachmae.html
+  // loads style.css and NOT profile.css, so a copy left behind would render
+  // this page's figures unstyled.
+  const style = decomment(read('style.css'));
+  const profile = decomment(read('profile.css'));
+  for (const sel of ['.pcharts', '.pchart ', '.pchart__title', '.pchart__twin', '.pchart__foot']) {
+    assert.ok(style.includes(sel), `${sel} is in the shared sheet`);
+  }
+  assert.ok(!/^\.pcharts\s*\{/m.test(profile), 'and not left duplicated in profile.css');
+  assert.match(drachmaeHtml, /style\.css/);
+  assert.doesNotMatch(drachmaeHtml, /profile\.css/, 'the reference page must not need the profile sheet');
+});

package/tests/projects_hub.mjs

@@ -706,14 +706,15 @@ test('the About answers travel on the create request, and an empty one is OMITTE
 });
 
 test('a renumbering of the wizard invalidates old drafts — the key carries the version', () => {
-  // task 1002772 renumbered once and bumped to -v2; task 1002334 renumbered again.
-  // A draft replayed under a different numbering lands on the wrong panel with the
-  // rail already marking the skipped steps done.
+  // task 1002772 renumbered once and bumped to -v2; task 1002334 renumbered again;
+  // task 1002339 (the module picker) is the third. A draft replayed under a
+  // different numbering lands on the wrong panel with the rail already marking
+  // the skipped steps done.
   const key = (SCRIPT.match(/var DRAFT_KEY = '([^']+)'/) || [, ''])[1];
   assert.match(key, /-v\d+$/, 'the draft key is versioned');
   const panels = (SCRIPT.match(/var panels = \{([^}]*)\}/) || [, ''])[1];
   const count = [...panels.matchAll(/\d+:\s*'panel-/g)].length;
-  assert.equal(count, 8, 'gate + six numbered steps + done — bump DRAFT_KEY when this changes');
+  assert.equal(count, 9, 'gate + seven numbered steps + done — bump DRAFT_KEY when this changes');
 });
 
 test('every row lays the same five parts — the ledger has no ragged row', () => {
@@ -2058,7 +2059,9 @@ test('the wizard takes the world by scope: no card ground, the six-step strip as
   assert.ok(at > -1, 'the #view-new block exists in cosmos.css');
   const block = COSMOS.slice(at);
   assert.match(block, /#view-new \.card\{background:none;border-radius:0;box-shadow:none;/, 'no card ground');
-  assert.match(block, /#view-new \.steps\{display:grid;grid-template-columns:repeat\(6,1fr\);/, 'the strip lays its six steps on six tracks');
+  // seven tracks since task 1002339 added the Modules step; the count is the
+  // rail's own, so it moves with the panels map rather than being a magic number
+  assert.match(block, /#view-new \.steps\{display:grid;grid-template-columns:repeat\(7,1fr\);/, 'the strip lays a track per numbered step');
   assert.match(block, /#view-new \.steps li::before\{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;/, 'the connector becomes the 7px dot');
   assert.match(block, /#view-new \.steps li\.now::before\{background:var\(--accent\);border-color:var\(--accent\);outline:4px solid/, 'the lit step carries the accent and an outline halo');
   assert.match(block, /#view-new \.panel h1\{font-weight:300;[^}]*text-transform:lowercase;/, 'the step title in the display voice, lowercase');
@@ -2105,7 +2108,7 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(block, /\.addrBig code\{display:block;font-family:var\(--font-display\);/, 'the address stands in the display voice');
   assert.doesNotMatch(block, /linear-gradient/, 'no tinted plates');
   assert.doesNotMatch(block, /box-shadow:(?!none)/, 'no box shadow in the wizard block');
-  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="5">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
+  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="6">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
   assert.match(HUB, /<h2 class="stepsHead">Your steps — the parts only you can play<\/h2>/, 'the steps heading is the label face by class, not an inline style');
   // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
   assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');
@@ -2114,7 +2117,69 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \? 'adopt' : 'greenfield'/, 'the onboard mode is unchanged');
   // the kit walks every step and files against the stub
   const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
-  for (const s of ['type', 'about', 'home', 'address', 'review', 'done']) assert.ok(states['in-new-' + s], `the ${s} step has a kit state`);
+  for (const s of ['type', 'about', 'modules', 'home', 'address', 'review', 'done']) assert.ok(states['in-new-' + s], `the ${s} step has a kit state`);
   const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
   assert.ok(probes.some((p) => /the wizard driver \(task 1003346\)/.test(p.name) && p.steps.some((st) => st[1] === '#doCreate')), 'the wizard driver files a project end to end');
 });
+
+test('the Modules step ships as real markup and is skippable like About (task 1002339)', () => {
+  const panel = (HUB.match(/<section class="panel" id="panel-modules"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(panel, '#panel-modules ships as real markup, not built by script');
+  assert.match(panel, /id="modCards"/, 'the band the picker paints its rows into');
+  assert.match(panel, /class="typeCards"/, 'and it is the SAME band the type and team questions use — no new grammar');
+  assert.match(panel, /id="modCoreNote"/, 'the always-on core is stated on the panel');
+  // the skip must be its own control, not "leave it and press Next" — the rule
+  // task 1002334 wrote for the one other optional step
+  assert.match(panel, /id="skipModules"/, 'the skip is a control, not an inference');
+  assert.match(panel, /Optional/, 'and the panel says so before it asks');
+  // nothing in validateStep may gate it
+  const validate = SCRIPT.slice(SCRIPT.indexOf('function validateStep('));
+  const map = SCRIPT.match(/var panels = \{([^}]*)\}/)[1];
+  const modStep = Number((map.match(/(\d+):\s*'panel-modules'/) || [, 0])[1]);
+  assert.ok(modStep > 0, 'the Modules panel is in the map');
+  assert.ok(!validate.slice(0, validate.indexOf('function ', 1)).includes(`if (step === ${modStep}) {`),
+    'the optional step has no validation clause — Next past an untouched picker is the point');
+});
+
+test('the picker reads ONE public declaration, and it is the one the bundles come from (task 1002339)', () => {
+  // A second source for "what may be chosen" is exactly what would let a
+  // preselect name a module the panel has no row for (ADR 0237 §5).
+  assert.match(SCRIPT, /fetch\(API \+ '\/provisioning\/starter-bundles'/, 'the picker reads the starter-bundles route');
+  assert.equal((SCRIPT.match(/'\/provisioning\/starter-bundles'/g) || []).length, 1, 'exactly once');
+  // and it is a public read — no other module-catalog call joins it
+  assert.doesNotMatch(SCRIPT, /fetch\(API \+ '\/modules'/, 'no signed-in catalog read from a signed-out wizard');
+});
+
+test('the picker\'s answer rides the create request, and an untouched picker sends nothing (task 1002339)', () => {
+  // absent means SKIPPED, and the server then applies the same starter bundle
+  // the panel preselected — the same contract `description` and `detail` carry
+  const body = SCRIPT.slice(SCRIPT.indexOf('body: JSON.stringify({'));
+  assert.ok(body.includes('modules: modulesForCreate(),'), 'the create body carries the picker\'s ids');
+  assert.match(SCRIPT, /function modulesForCreate\(\) \{\s*return state\.modules === null \? undefined : state\.modules\.slice\(\);/,
+    'and modulesForCreate() omits the key while nothing has been said');
+});
+
+test('the review names what the project will actually come with (task 1002339)', () => {
+  // The picker is optional, so the last screen before Create must show the set
+  // the owner is about to get — their picks, or the preselect they walked past.
+  const render = SCRIPT.slice(SCRIPT.indexOf('function renderReview()'));
+  const rows = render.slice(0, render.indexOf('$(\'reviewList\').innerHTML'));
+  assert.match(rows, /\['Extras', extrasRow\(\)\]/, 'the ledger carries an Extras row');
+  // What that row SAYS has three cases (picked / preselect / catalog not loaded)
+  // and they live with the picker's own rules, executed by
+  // tests/projects_hub_module_picker.mjs. This pins that the review defers to them.
+  assert.match(SCRIPT, /function extrasRow\(\) \{/, 'and it is the picker that decides what it says');
+  assert.match(SCRIPT, /'None — just the core'/, 'an empty selection reads as a fact, not a blank');
+});
+
+test('the kit stub answers the picker\'s read, so the panel renders in the design kit (task 1002339)', () => {
+  // The stub is not the server (this module's CLAUDE.md trap): it serves
+  // fixtures. A 404 here would have rendered the couldn't-load clause in every
+  // state and probe, and nobody would have seen the picker at all.
+  const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(stub, /rest === '\/provisioning\/starter-bundles'/, 'the stub serves the picker\'s read');
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
+  assert.ok(probes.some((p) => /the wizard driver \(task 1003346\)/.test(p.name)
+    && p.steps.some((st) => st[1] === '#panel-modules button[type=submit]')),
+  'and the end-to-end driver walks the new step rather than stopping at it');
+});