@bongos/core 1.19.532 → 1.19.534

package/tests/project_modules_ui.mjs

@@ -0,0 +1,318 @@
+// tests/project_modules_ui.mjs — adding and removing a project's extras AFTER
+// creation, EXECUTED (BV1.R23, task 1002342, ADR 0245).
+//
+// tests/provisioning_module_selection.mjs pins the ROUTE half of "add modules
+// later"; this file pins the surface an owner actually uses. It lifts the manage
+// page's extras region out of modules/public-landing/public/projects.html —
+// ensureModsCatalog, modsSelected, renderMods, doModToggle and the delegated
+// click — runs it in a vm under a minimal DOM stub, PARSES the markup it writes
+// into innerHTML, and drives a real click on a toggle.
+//
+// The precedent is tests/project_door_ui.mjs beside it (there is no jsdom in this
+// repo), including its rule that the slice boundaries are themselves asserted, so
+// a rename can never leave this file quietly executing an empty string.
+//
+// What it proves, and why each matters:
+//   • the optional CATALOG renders — one row per module the server offers, with
+//     the owner-facing line, and nothing the server did not offer
+//   • the project's CURRENT set is what is switched on, resolved by the SERVER
+//     (a skipped picker reads as its bundle, and this page never re-derives that
+//     rule — the one way two surfaces name different modules for one project)
+//   • a toggle issues the write, as the WHOLE list in catalog order, on the
+//     own-scoped detail channel
+//   • the band repaints from the platform's answer, never from what was sent —
+//     and a refusal puts it back to what the row still says
+//   • the always-on core is stated and is not on the band at all
+//   • the done panel carries one pointer at this surface for the project just
+//     created, so a skipped picker is never a dead end
+//
+// Run:  node --test --test-reporter=tap tests/project_modules_ui.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8')
+  .replace(/\r\n/g, '\n');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+const START = SCRIPT.indexOf('var modsCatalog = null;');
+const END = SCRIPT.indexOf('/* ── on the map (task 1002324)');
+assert.ok(START > 0, 'the extras region must start at modsCatalog');
+assert.ok(END > START, 'the extras region must end before the join-door section');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureModsCatalog(', 'function renderMods(', 'function doModToggle(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the fixture catalog ──────────────────────────────────────────────────────
+// A FIXTURE, not a live require: this file asserts the band reads the shape, and
+// tests/provisioning_starter_bundles.mjs asserts the route emits it. Two files,
+// one shape, neither taking the other's word for it (the module-picker rule).
+const CATALOG = {
+  core: ['memory', 'lifecycle', 'hall-ui'],
+  optional: [
+    { key: 'dev-box', label: 'Dev box', summary: 'A shared machine your builders work on.' },
+    { key: 'discord', label: 'Discord', summary: 'Mirrors what ships into a Discord channel.' },
+    { key: 'agents', label: 'Agents', summary: 'Lets AI builders claim and ship work on their own.' },
+  ],
+};
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+// Narrow on purpose (the task_detail_ui.mjs rule): it supports exactly what the
+// region uses, so it stays honest about what it can prove.
+
+const ROW = /<button type="button" class="modOpt" data-mod="([^"]*)" aria-pressed="(true|false)"( disabled)?><b>([^<]*)<\/b><small>([^<]*)<\/small><\/button>/g;
+
+function parseRows(html) {
+  return [...String(html).matchAll(ROW)].map((m) => ({
+    key: m[1], on: m[2] === 'true', disabled: !!m[3], label: m[4], summary: m[5],
+  }));
+}
+
+// Boot the region against a scripted catalog + detail channel and hand back the
+// handles a test drives it with.
+function boot({ selected = ['dev-box'], source = 'chosen', catalog = CATALOG, catalogOk = true, patchAnswer } = {}) {
+  const requests = [];
+  const els = new Map();
+  const listeners = new Map();
+
+  const makeEl = (id) => ({
+    _id: id, _html: '', textContent: '', className: '', disabled: false,
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+    addEventListener(type, fn) {
+      if (type !== 'click') return;
+      if (!listeners.has(id)) listeners.set(id, []);
+      listeners.get(id).push(fn);
+    },
+  });
+  const $ = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const slotHtml = () => ($('mMods')._html || '');
+
+  // `_json` is what jsonOrEmpty hands back (the PATCH path); `json()` is what
+  // ensureModsCatalog calls directly (the GET path) — the region uses both.
+  const answer = (body, { ok = true, status = 200 } = {}) =>
+    Promise.resolve({ ok, status, _json: body, json: () => Promise.resolve(body) });
+  const fetch = (url, init = {}) => {
+    const method = init.method || 'GET';
+    requests.push({ url, method, body: init.body, credentials: init.credentials, headers: init.headers });
+    if (method === 'GET') {
+      return catalogOk ? answer(catalog) : answer({}, { ok: false, status: 500 });
+    }
+    if (patchAnswer) return patchAnswer;
+    // the platform's own answer: what the row now resolves to (effectiveModules)
+    const sent = JSON.parse(init.body).modules;
+    return answer({ ok: true, modules: { core: catalog.core, selected: sent, modules: catalog.core.concat(sent), source: 'chosen', adjustments: [] } });
+  };
+
+  const sandbox = {
+    $, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    encodeURIComponent, setTimeout, clearTimeout,
+    API: '/api/bongos',
+    manageId: '18',
+    manageInst: { id: 18, status: 'active', modules: { core: catalog.core, selected: selected.slice(), modules: catalog.core.concat(selected), source, adjustments: [] } },
+    esc: (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    apiError: (data, status) => ({ code: (data && data.error && data.error.code) || 'error', message: (data && data.error && data.error.message) || `HTTP ${status}` }),
+    signInAgain: () => '<a href="/signin">Sign in again</a>',
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#project-extras' });
+
+  const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
+  return {
+    requests, sandbox, settle,
+    rows: () => parseRows(slotHtml()),
+    slot: () => slotHtml(),
+    msg: () => $('mModMsg'),
+    async render() { sandbox.renderMods(sandbox.manageInst); await settle(); },
+    async click(key) {
+      const handlers = listeners.get('mMods') || [];
+      assert.equal(handlers.length, 1, 'the section wires exactly one delegated click handler');
+      const row = parseRows(slotHtml()).find((r) => r.key === key);
+      assert.ok(row, `the band carries a row for ${key}`);
+      handlers[0]({
+        target: {
+          closest: (sel) => (sel === '.modOpt[data-mod]'
+            ? { disabled: row.disabled, getAttribute: (a) => (a === 'data-mod' ? key : null) }
+            : null),
+        },
+      });
+      await settle();
+    },
+  };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the band renders the optional catalog the server offered — a row and a sentence each', async () => {
+  // Arrange
+  const ui = boot({ selected: ['dev-box'] });
+
+  // Act
+  await ui.render();
+
+  // Assert
+  assert.deepEqual(ui.rows().map((r) => r.key), ['dev-box', 'discord', 'agents']);
+  assert.deepEqual(ui.rows().map((r) => r.label), ['Dev box', 'Discord', 'Agents']);
+  for (const r of ui.rows()) assert.ok(r.summary.length > 20, `${r.label} says what it is for`);
+});
+
+test('what the project runs today is what is switched on — resolved by the server, not re-derived here', async () => {
+  // A project that SKIPPED the picker reads as its own starter bundle, and the
+  // band must show that set rather than an empty one: the whole point of
+  // effectiveModules resolving `source: 'bundle'` on the way out.
+  const ui = boot({ selected: ['dev-box', 'discord'], source: 'bundle' });
+
+  await ui.render();
+
+  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(ui.rows().filter((r) => !r.on).map((r) => r.key), ['agents']);
+});
+
+test('the always-on core is COUNTED and stated, and is not a row anyone can switch off', async () => {
+  const ui = boot({ selected: [] });
+
+  await ui.render();
+
+  assert.match(ui.slot(), /the same 3 core parts/, 'the clause names how many, from the server\'s own list');
+  assert.deepEqual(ui.rows().map((r) => r.key), ['dev-box', 'discord', 'agents'], 'and no core key is on the band');
+  for (const key of CATALOG.core) {
+    assert.equal(ui.rows().some((r) => r.key === key), false, `${key} is not a choice`);
+  }
+});
+
+test('a toggle issues the write — the WHOLE list, in catalog order, on the own-scoped detail channel', async () => {
+  // Arrange
+  const ui = boot({ selected: ['discord'] });
+  await ui.render();
+
+  // Act — switch the dev box ON
+  await ui.click('dev-box');
+
+  // Assert
+  const patch = ui.requests.find((r) => r.method === 'PATCH');
+  assert.ok(patch, 'a PATCH was sent');
+  assert.equal(patch.url, '/api/bongos/provisioning/instances/18/detail');
+  assert.deepEqual(JSON.parse(patch.body), { modules: ['dev-box', 'discord'] },
+    'catalog order, exactly as the column stores it — never append order');
+  assert.equal(patch.credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+});
+
+test('a toggle can REMOVE one too — the same list, one key shorter', async () => {
+  const ui = boot({ selected: ['dev-box', 'agents'] });
+  await ui.render();
+
+  await ui.click('agents');
+
+  const patch = ui.requests.find((r) => r.method === 'PATCH');
+  assert.deepEqual(JSON.parse(patch.body), { modules: ['dev-box'] });
+});
+
+test('switching the last one off sends an empty list — a real answer, not a skipped write', async () => {
+  const ui = boot({ selected: ['agents'] });
+  await ui.render();
+
+  await ui.click('agents');
+
+  const patch = ui.requests.find((r) => r.method === 'PATCH');
+  assert.ok(patch, 'the write still happens');
+  assert.deepEqual(JSON.parse(patch.body), { modules: [] });
+});
+
+test('the band repaints from the PLATFORM’S answer, and says the save changed nothing running', async () => {
+  const ui = boot({ selected: [] });
+  await ui.render();
+
+  await ui.click('discord');
+
+  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['discord']);
+  assert.equal(ui.sandbox.manageInst.modules.source, 'chosen', 'the row is answered now, not still reading its bundle');
+  assert.equal(ui.msg().className, 'projMsg ok');
+  assert.match(ui.msg().textContent, /nothing to restart/i, 'this channel pushes nothing at the instance');
+});
+
+test('a refusal is SAID in the server’s own words, and the band goes back to what the row still holds', async () => {
+  const ui = boot({
+    selected: ['dev-box'],
+    patchAnswer: Promise.resolve({ ok: false, status: 400, _json: { error: { code: 'bad_modules', message: 'Unknown module "discrod" — the choices are: dev-box, discord, agents.' } } }),
+  });
+  await ui.render();
+
+  await ui.click('discord');
+
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /Unknown module "discrod"/);
+  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['dev-box'],
+    'a refused write leaves the band showing the project’s real set');
+});
+
+test('a signed-out save offers a way back in rather than a dead end', async () => {
+  const ui = boot({
+    selected: [],
+    patchAnswer: Promise.resolve({ ok: false, status: 401, _json: {} }),
+  });
+  await ui.render();
+
+  await ui.click('agents');
+
+  assert.match(ui.msg().innerHTML, /Sign in again/);
+});
+
+test('a catalog that ANSWERED badly says so; nothing about the project is claimed to have changed', async () => {
+  const ui = boot({ selected: ['dev-box'], catalogOk: false });
+
+  await ui.render();
+  await ui.settle();
+  await ui.render();
+
+  assert.match(ui.slot(), /couldn’t load the list of extras/i);
+  assert.match(ui.slot(), /Nothing about your project has changed/);
+  assert.equal(ui.rows().length, 0, 'and no band is painted from a catalog we do not have');
+});
+
+test('the catalog is read ONCE however often the section repaints', async () => {
+  const ui = boot({ selected: [] });
+
+  await ui.render();
+  await ui.render();
+  await ui.click('agents');
+
+  const gets = ui.requests.filter((r) => r.method === 'GET');
+  assert.equal(gets.length, 1, 'memoised like the wizard picker’s own read');
+  assert.equal(gets[0].url, '/api/bongos/provisioning/starter-bundles');
+});
+
+// ── the done panel's one pointer (criterion B) ───────────────────────────────
+// A source pin, the tests/projects_hub.mjs idiom: the line is one sentence in a
+// panel this file does not execute. What matters is that it exists, that it
+// names THIS project rather than the list, and that it stays one line.
+
+test('the wizard’s done panel points at the project’s settings for its extras', () => {
+  assert.match(HUB, /<p class="samePath" id="doneModules"><\/p>/, 'the panel carries the slot');
+  assert.match(SCRIPT, /\$\('doneModules'\)\.innerHTML = 'Add or remove modules later in ' \+ projectPageLink\('the project’s settings'\) \+ '\.';/,
+    'and renderDone fills it with one sentence pointing at the manage page');
+  assert.equal((SCRIPT.match(/doneModules/g) || []).length, 1, 'one line, written in one place');
+  assert.match(SCRIPT, /function projectPageLink\(label\) \{\s*return '<a href="' \+ \(instanceId \? '\?view=manage&id=' \+ encodeURIComponent\(instanceId\)/,
+    'and the link names the instance just created, not the list');
+});
+
+test('a manage link inside the wizard carries its project id through the in-page router', () => {
+  // setView reads `manageId`, never the href — so a done-panel link that only
+  // matched `view=(\w+)` would land every owner on a manage page with no
+  // project, which is what this pointer would have done.
+  const handler = SCRIPT.slice(SCRIPT.indexOf("var a = ev.target.closest && ev.target.closest('a[href^=\"?view=\"]');"));
+  assert.match(handler.slice(0, 900), /var mid = \(href\.match\(\/\[\?&\]id=\(\[\^&\]\*\)\/\) \|\| \[\]\)\[1\];/,
+    'the id is lifted out of the href');
+  assert.match(handler.slice(0, 900), /if \(to === 'manage' && mid\) return goToManage\(decodeURIComponent\(mid\)\);/,
+    'and handed to goToManage, which is what sets manageId');
+});

package/tests/projects_hub.mjs

@@ -2141,11 +2141,38 @@ test('the Modules step ships as real markup and is skippable like About (task 10
     'the optional step has no validation clause — Next past an untouched picker is the point');
 });
 
+test('the picker\'s search ships as real markup, in the wizard\'s own field grammar (task 1002340)', () => {
+  const panel = (HUB.match(/<section class="panel" id="panel-modules"[\s\S]*?<\/section>/) || [''])[0];
+  assert.match(panel, /<input type="text" id="modQ"[^>]*>/, 'the search is a real field, not one built by script');
+  assert.match(panel, /id="modQ"[^>]*aria-label="Search the extras by name"/, 'and it is named for a screen reader');
+  assert.match(panel, /id="modFilterNote"[^>]*aria-live="polite"/, 'the count under it is announced when it changes');
+  // it wears the wizard's own control skin (#view-new input[type=text]) rather
+  // than a class of its own — the C1 rule the type and team bands follow
+  assert.doesNotMatch(panel, /id="modQ"[^>]*class=/, 'no bespoke class for one field');
+  // the band, the field and the count are one wizField — a search that sat
+  // outside the field it filters would read as filtering the whole panel
+  const field = (panel.match(/<div class="wizField"><span id="modLbl"[\s\S]*?<\/div>\s*<\/div>/) || [''])[0];
+  assert.match(field, /id="modQ"/, 'the field holds the search');
+  assert.match(field, /id="modCards"/, 'and the band it filters');
+  // display only: the filter reaches the render, never state.modules (ADR 0244)
+  assert.match(SCRIPT, /function moduleMatches\(mod, terms\)/, 'the matcher is a named function the harness can run');
+  assert.match(SCRIPT, /function visibleModules\(\)/, 'and the rows it leaves are derived, not stored');
+  const onInput = SCRIPT.slice(SCRIPT.indexOf("$('modQ').addEventListener('input'"));
+  const body = onInput.slice(0, onInput.indexOf('});'));
+  assert.doesNotMatch(body, /state\.modules/, 'typing never writes an answer');
+  assert.doesNotMatch(body, /saveDraft/, 'and a search is not part of the draft');
+});
+
 test('the picker reads ONE public declaration, and it is the one the bundles come from (task 1002339)', () => {
   // A second source for "what may be chosen" is exactly what would let a
   // preselect name a module the panel has no row for (ADR 0237 §5).
   assert.match(SCRIPT, /fetch\(API \+ '\/provisioning\/starter-bundles'/, 'the picker reads the starter-bundles route');
-  assert.equal((SCRIPT.match(/'\/provisioning\/starter-bundles'/g) || []).length, 1, 'exactly once');
+  // Two READERS since task 1002342 — the wizard's panel and the manage page's
+  // extras band — but still ONE declaration: the count is what guards against a
+  // second SOURCE, so it moves only when a reader is added, and both of these
+  // name the same route.
+  assert.equal((SCRIPT.match(/'\/provisioning\/starter-bundles'/g) || []).length, 2,
+    'the create picker and the manage page, and nothing else');
   // and it is a public read — no other module-catalog call joins it
   assert.doesNotMatch(SCRIPT, /fetch\(API \+ '\/modules'/, 'no signed-in catalog read from a signed-out wizard');
 });

package/tests/projects_hub_module_picker.mjs

@@ -205,6 +205,13 @@ function boot({ state: seed = {}, fetchOk = true, payload = PAYLOAD } = {}) {
     skip: () => $('skipModules')._handlers.click(),
     forCreate: () => sandbox.modulesForCreate(),
     picked: () => sandbox.pickedModules(),
+    // BV1.R21 (task 1002340) — the search box. type() is the real `input` event
+    // the browser fires, so a test drives the same path a keystroke does.
+    type: (q) => { $('modQ')._handlers.input({ target: { value: q } }); },
+    filterNote: () => $('modFilterNote').textContent,
+    searchHidden: () => $('modQ').hidden === true,
+    // the pure matcher on its own, one row against one query
+    matches: (mod, q) => sandbox.moduleMatches(mod, sandbox.searchTerms(q)),
   };
 }
 
@@ -580,3 +587,203 @@ test('the picker and the server resolve the same set for every answer an owner c
     }
   }
 });
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BV1.R21 (task 1002340) — keyword search over the catalog. ADR 0244: the search
+// is a VIEW over the rows and never an edit to the answer, so everything below
+// asserts both halves — what the band shows, and that what is switched on did
+// not move.
+// ─────────────────────────────────────────────────────────────────────────────
+
+const DEV_BOX = PAYLOAD.optional[1];
+
+test('the matcher reads a row\'s own words — its name, its summary and its key', () => {
+  // Lexical, not semantic (idea 1000552 holds the by-meaning half): the only
+  // words it knows are the ones the owner can see, plus the key they cannot.
+  const h = boot({ state: { projType: 'game' } });
+
+  assert.equal(h.matches(DEV_BOX, 'boxes'), true, 'by a word in the name');
+  assert.equal(h.matches(DEV_BOX, 'workspace'), true, 'by a word in the summary');
+  assert.equal(h.matches(DEV_BOX, 'dev-box'), true, 'by the key');
+  assert.equal(h.matches(DEV_BOX, 'discord'), false, 'and never by a word that is in none of them');
+});
+
+test('a term matches as a SUBSTRING, so a half-typed word still finds its module', () => {
+  const h = boot({ state: { projType: 'game' } });
+
+  assert.equal(h.matches(DEV_BOX, 'work'), true, 'the owner is still typing');
+  assert.equal(h.matches(DEV_BOX, 'ace'), true, 'even mid-word — a dumb filter beats a clever one that finds nothing');
+});
+
+test('matching is case-insensitive in both directions', () => {
+  const h = boot({ state: { projType: 'game' } });
+
+  assert.equal(h.matches(DEV_BOX, 'DEV BOXES'), true, 'a shouted query finds a title-cased row');
+  assert.equal(h.matches(PAYLOAD.optional[0], 'ai'), true, 'and a quiet one finds a shouted row');
+});
+
+test('every term must match — typing more words narrows, it never widens', () => {
+  // AND, not OR. An owner adding a word is telling us the list is still too long.
+  const h = boot({ state: { projType: 'game' } });
+
+  assert.equal(h.matches(DEV_BOX, 'cloud change'), true, 'both words are in the row');
+  assert.equal(h.matches(DEV_BOX, 'cloud discord'), false, 'one of them is not, so the row is out');
+});
+
+test('an empty search is not a search — every row stays', () => {
+  const h = boot({ state: { projType: 'game' } });
+
+  assert.equal(h.matches(DEV_BOX, ''), true);
+  assert.equal(h.matches(DEV_BOX, '   '), true, 'and a box holding only spaces is the same as an empty one');
+});
+
+test('typing filters the band to the rows that answer, in catalog order', async () => {
+  // Arrange
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  assert.equal(h.rows().length, 3, 'the whole catalog before anything is typed');
+
+  // Act — a word from one row's NAME
+  h.type('boxes');
+
+  // Assert
+  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box']);
+});
+
+test('a summary word and a key find their row just as a name word does', async () => {
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  h.type('workspace');
+  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box'], 'by summary');
+
+  h.type('dev-box');
+  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box'], 'by key');
+
+  h.type('DISCORD');
+  assert.deepEqual(h.rows().map((r) => r.key), ['discord'], 'and case is not part of the question');
+});
+
+test('two terms narrow to the rows that carry both', async () => {
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  h.type('cloud change');
+  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box']);
+
+  h.type('cloud discord');
+  assert.deepEqual(h.rows(), [], 'and no row carries both of these');
+});
+
+test('a search that matches nothing says so, and invents no rows', async () => {
+  // The band would otherwise just be empty, which reads as "the catalog failed"
+  // — the one thing the couldn't-load clause exists to distinguish.
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  h.type('kubernetes');
+
+  assert.deepEqual(h.rows(), []);
+  assert.match(h.filterNote(), /No extras match/, 'the panel says why the band is empty');
+});
+
+test('a switched-on module the search is HIDING is still switched on', async () => {
+  // The property ADR 0244 is about. A filter is a view; the answer is the set of
+  // toggles, and a view must not be able to edit it.
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  assert.deepEqual(h.picked(), ['dev-box', 'discord'], 'the game bundle is on');
+
+  // Act — search for the one module that is OFF, hiding both that are on
+  h.type('agents');
+
+  // Assert
+  assert.deepEqual(h.rows().map((r) => r.key), ['agents'], 'only the match is on screen');
+  assert.equal(h.rows()[0].pressed, false, 'and it is off, as it was');
+  assert.deepEqual(h.picked(), ['dev-box', 'discord'], 'the two hidden ones are still switched on');
+  assert.equal(h.state.modules, null, 'and typing answered nothing on the owner\'s behalf');
+  assert.match(h.filterNote(), /2 extras are switched on/, 'the count under the field says so out loud');
+  assert.match(h.filterNote(), /including any this search is hiding/, 'and that some of them are hidden');
+});
+
+test('the count under the field states what is shown and what is on, singular included', async () => {
+  const h = boot({ state: { projType: 'research' } });
+  await h.open();
+  assert.equal(h.filterNote(), '', 'with nothing typed there is nothing to explain');
+
+  h.type('agents');
+
+  assert.equal(h.filterNote(),
+    'Showing 1 of 3. 1 extra is switched on, including any this search is hiding.');
+});
+
+test('with nothing switched on the count says only what is shown', async () => {
+  const h = boot({ state: { projType: 'not-sure' } });
+  await h.open();
+
+  h.type('a');
+
+  assert.equal(h.filterNote(), 'Showing 3 of 3.', 'no "0 extras are switched on" noise');
+});
+
+test('the review names the hidden picks too — a filter never reaches the create request', async () => {
+  const h = boot({ state: { projType: 'game', step: 7 } });
+  await h.open();
+  h.click('agents');
+  assert.deepEqual(h.forCreate(), ['agents', 'dev-box', 'discord']);
+
+  h.type('discord');
+
+  assert.deepEqual(h.rows().map((r) => r.key), ['discord'], 'one row on screen');
+  assert.deepEqual(h.forCreate(), ['agents', 'dev-box', 'discord'], 'three modules in the answer');
+  assert.equal(h.extrasRow(), 'Extra agents, Dev boxes, Discord', 'and the review names all three');
+});
+
+test('clearing the search brings every row back, untouched', async () => {
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  h.type('agents');
+  assert.equal(h.rows().length, 1);
+
+  h.type('');
+
+  assert.deepEqual(h.rows().map((r) => r.key), ['agents', 'dev-box', 'discord']);
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord'],
+    'with the preselect exactly as it was before the search');
+  assert.equal(h.filterNote(), '', 'and the count goes quiet again');
+});
+
+test('a toggle made while filtered lands in the answer in catalog order, and the filter stands', async () => {
+  // The path BV1.R24 walks: preselect -> search -> add -> enabled.
+  const h = boot({ state: { projType: 'non-profit' } });
+  await h.open();
+
+  h.type('workspace');
+  h.click('dev-box');
+
+  assert.deepEqual(h.state.modules, ['dev-box', 'discord'], 'catalog order, not click order');
+  assert.deepEqual(h.rows().map((r) => r.key), ['dev-box'], 'and the search is still the search');
+  assert.equal(h.rows()[0].pressed, true, 'the row they just switched on shows it');
+});
+
+test('a search is not an answer: it saves no draft and costs no round trip', async () => {
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  const savesBefore = h.saves();
+
+  h.type('dev');
+  h.type('');
+
+  assert.equal(h.saves(), savesBefore, 'nothing is written to the draft');
+  assert.equal(h.fetches(), 1, 'and the catalog is already here — typing re-reads nothing');
+});
+
+test('with no catalog there is nothing to search, so the box is not offered', async () => {
+  // A search field over a list that failed to load is an affordance that can
+  // only disappoint.
+  const h = boot({ state: { projType: 'game' }, fetchOk: false });
+  await h.open();
+
+  assert.equal(h.searchHidden(), true);
+  assert.equal(h.filterNote(), '', 'and no count for a band with no rows');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -496,8 +496,8 @@ test('a manifest error says a plain sentence, folds the route text, and sends a
     'and it is named by id whenever the flow has one');
   // every done-panel pointer that names a CONTROL goes the same way; the ones
   // that only say "watch it there" still name the list, which does show it
-  assert.equal((SCRIPT.match(/projectPageLink\(/g) || []).length, 6,
-    'the helper and its five callers: the locked step, the domain_required snag, the domainless standup, the snagged retry, the torn-down revive');
+  assert.equal((SCRIPT.match(/projectPageLink\(/g) || []).length, 7,
+    'the helper and its six callers: the locked step, the domain_required snag, the domainless standup, the snagged retry, the torn-down revive, and the extras pointer (task 1002342)');
   for (const dead of ['Retry it \\(and see the technical details\\) from <a href="\\?view=mine">',
                       'Bring it back any time from <a href="\\?view=mine">']) {
     assert.doesNotMatch(SCRIPT, new RegExp(dead), 'a control the list no longer has must not be pointed at there');

package/tests/provision_settings_apply.mjs

@@ -60,6 +60,7 @@ PGDATABASE=spike
 ${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOINABILITY=apply
 ${NEUTRAL_PREFIX}_VISIBILITY=public
+${NEUTRAL_PREFIX}_JOIN_GRANT=full
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -112,7 +113,7 @@ t('is PURE: same input, same output; empty body yields just the lines', () => {
 t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at standup, under the pack prefix', () => {
   const inst = { slug: 'spike', port: 3010, db_name: 'spike', hosting_shape: 'standalone', target_ref: 'jaxri/spike', settings: { platform_visibility: 'gated' } };
   const vars = P.settingsEnvVarsFor(inst);
-  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply', [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public' });
+  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply', [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public', [`${NEUTRAL_PREFIX}_JOIN_GRANT`]: 'full' });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
 });
@@ -123,10 +124,10 @@ const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_o
 const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
 
 t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' }), GATED), true);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full' }), GATED), true);
 });
 t('false when the instance still reports a different value', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public', joinGrant: 'full' }), GATED), false);
   assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
 });
 t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
@@ -144,7 +145,7 @@ t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
 function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
   manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
   const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
-  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public' })
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full' })
     : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public' })
     : manifest === 'none' ? manifestWith(undefined) : 'nope';
   const exec = (cmd, opts = {}) => {
@@ -213,7 +214,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });