@bongos/core 1.19.576 → 1.19.578

package/tests/cli_package.mjs

@@ -0,0 +1,217 @@
+// tests/cli_package.mjs — the public @cloudbongos/cli package is client-only AND actually runs.
+//
+// Guards task 1003679. Two halves, and the second is the one that matters:
+//
+//  1. Shape: the generated tree carries no server surface, and the redaction gate really fails
+//     a build when instance identity or a credential shape appears in it.
+//
+//  2. BEHAVIOUR: pack the tarball, install it into an empty directory with NO repo present, and
+//     run every advertised verb. This is the only instrument that can prove the file list is
+//     complete. A static require-closure cannot: src/module-api.js is the module doorway
+//     (ADR 0083) and by design *names* every kernel capability, so a static walk sees the whole
+//     server even though the getters are lazy and never resolve. If a real code path needs a
+//     file the manifest omits, the verb exits with MODULE_NOT_FOUND and this test says so.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const BUILDER = path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js');
+
+const mod = await import(path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js'));
+const { build, FILES, VERBS, CHECKOUT_ONLY, ALLOWED_SRC_BONGOS, PACKAGE_NAME } = mod.default ?? mod;
+
+function tmpdir(tag) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), `cli-pkg-${tag}-`));
+}
+
+// ── 1. Shape ────────────────────────────────────────────────────────────────────────────────
+
+test('the generated package contains no server surface', () => {
+  const out = tmpdir('shape');
+  const { files } = build({ out, quiet: true });
+
+  const kernel = files.filter((f) => f.startsWith('src/bongos/'));
+  assert.deepEqual(kernel, [...ALLOWED_SRC_BONGOS],
+    `only ${[...ALLOWED_SRC_BONGOS].join(', ')} may ship from the kernel, got ${kernel.join(', ')}`);
+
+  for (const f of files) {
+    assert.ok(!f.startsWith('src/bongos/routes/'), `${f}: routes must never ship`);
+    assert.ok(!/(^|\/)(pool|db|server|serve-internal)\.js$/.test(f), `${f}: server surface must never ship`);
+    assert.ok(!f.startsWith('migrations/'), `${f}: migrations must never ship`);
+    assert.ok(!f.startsWith('infra/'), `${f}: infra must never ship`);
+  }
+  fs.rmSync(out, { recursive: true, force: true });
+});
+
+test('the one kernel file that ships imports nothing', () => {
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'src', 'bongos', 'api-prefix.js'), 'utf8');
+  const rel = [...src.matchAll(/require\(\s*['"](\.[^'"]+)['"]\s*\)/g)].map((m) => m[1]);
+  assert.deepEqual(rel, [], `api-prefix.js must stay dependency-free, found: ${rel.join(', ')}`);
+});
+
+test('every file in the manifest exists', () => {
+  for (const rel of FILES) {
+    assert.ok(fs.existsSync(path.join(REPO_ROOT, rel)), `manifest names a missing file: ${rel}`);
+  }
+});
+
+test('every advertised verb maps to a script the manifest ships', () => {
+  for (const [verb, def] of Object.entries(VERBS)) {
+    assert.ok(FILES.includes(`scripts/gds/${def.script}`),
+      `verb "${verb}" runs scripts/gds/${def.script}, which the manifest does not ship`);
+  }
+});
+
+test('the redaction gate fails the build on an injected needle and on a credential shape', () => {
+  const out = tmpdir('gate');
+
+  // A domain that really is in the tree, supplied as forbidden → must refuse to emit.
+  const withNeedle = spawnSync(process.execPath, [BUILDER, '--out', out, '--quiet'], {
+    cwd: REPO_ROOT, encoding: 'utf8',
+    env: { ...process.env, CLI_PACKAGE_FORBIDDEN: 'cli-lib' },
+  });
+  assert.notEqual(withNeedle.status, 0, 'an instance needle present in the tree must fail the build');
+  assert.match(withNeedle.stderr, /redaction gate FAILED/);
+
+  // A planted credential shape must fail too, with no needle configured at all.
+  const planted = path.join(REPO_ROOT, 'scripts', 'gds', '.cli-pkg-gate-probe.js');
+  const victim = path.join(REPO_ROOT, 'scripts', 'gds', 'preflight.js');
+  const original = fs.readFileSync(victim, 'utf8');
+  try {
+    fs.writeFileSync(victim, `${original}\n// ghp_0123456789abcdefghijABCDEFGHIJ0123\n`);
+    const withToken = spawnSync(process.execPath, [BUILDER, '--out', out, '--quiet'], {
+      cwd: REPO_ROOT, encoding: 'utf8',
+    });
+    assert.notEqual(withToken.status, 0, 'a github token shape must fail the build');
+    assert.match(withToken.stderr, /github token/);
+  } finally {
+    fs.writeFileSync(victim, original);
+    fs.rmSync(planted, { force: true });
+  }
+  fs.rmSync(out, { recursive: true, force: true });
+});
+
+test('a clean build emits and reports itself', () => {
+  const out = tmpdir('clean');
+  const res = spawnSync(process.execPath, [BUILDER, '--out', out], { cwd: REPO_ROOT, encoding: 'utf8' });
+  assert.equal(res.status, 0, `clean build failed:\n${res.stderr}`);
+  assert.match(res.stdout, /redaction gate: clean/);
+  assert.ok(fs.existsSync(path.join(out, 'package.json')));
+  assert.ok(fs.existsSync(path.join(out, 'bin', 'bongos.js')));
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(out, 'package.json'), 'utf8'));
+  assert.equal(pkg.name, PACKAGE_NAME);
+  assert.deepEqual(Object.keys(pkg.dependencies), ['undici'], 'exactly one runtime dependency');
+  assert.equal(pkg.bin.bongos, 'bin/bongos.js');
+  assert.equal(pkg.publishConfig.access, 'public');
+  assert.ok(!('repository' in pkg), 'no repository URL while the core repo is private');
+  fs.rmSync(out, { recursive: true, force: true });
+});
+
+// ── 2. Behaviour: install the tarball where there is no repo, and run it ─────────────────────
+
+test('the packed tarball installs and every verb runs with no repo present', (t) => {
+  const buildOut = tmpdir('pack');
+  const home = tmpdir('home');
+  const site = tmpdir('site');
+
+  const built = spawnSync(process.execPath, [BUILDER, '--out', buildOut, '--quiet'], {
+    cwd: REPO_ROOT, encoding: 'utf8',
+  });
+  assert.equal(built.status, 0, `build failed:\n${built.stderr}`);
+
+  const packed = spawnSync('npm', ['pack', '--silent', '--pack-destination', site], {
+    cwd: buildOut, encoding: 'utf8',
+  });
+  assert.equal(packed.status, 0, `npm pack failed:\n${packed.stderr}`);
+  const tarball = fs.readdirSync(site).find((f) => f.endsWith('.tgz'));
+  assert.ok(tarball, `no tarball produced in ${site}`);
+
+  // An empty directory: no repo, no core, no config, and a HOME of its own so a real session
+  // file on this machine cannot make a verb look healthier than it is.
+  fs.writeFileSync(path.join(site, 'package.json'), JSON.stringify({ name: 'probe', private: true }));
+  const installed = spawnSync('npm', ['install', '--no-audit', '--no-fund', '--silent', path.join(site, tarball)], {
+    cwd: site, encoding: 'utf8', env: { ...process.env, HOME: home },
+  });
+  assert.equal(installed.status, 0, `npm install failed:\n${installed.stderr}`);
+
+  const bongos = path.join(site, 'node_modules', '.bin', 'bongos');
+  assert.ok(fs.existsSync(bongos), 'the package did not install a `bongos` binary');
+
+  const runVerb = (args) => spawnSync(bongos, args, {
+    cwd: site, encoding: 'utf8', input: '',
+    env: { ...process.env, HOME: home, CLOUDBONGOS_API_BASE: 'http://127.0.0.1:45999', NO_COLOR: '1' },
+  });
+
+  // help and version must work with nothing configured at all.
+  const help = runVerb(['help']);
+  assert.equal(help.status, 0, `bongos help failed:\n${help.stderr}`);
+  assert.match(help.stdout, /bongos login https:\/\//, 'help must lead with how to sign in');
+
+  const version = runVerb(['version']);
+  assert.equal(version.status, 0);
+  assert.match(version.stdout, /^bongos \d+\.\d+\.\d+/m);
+
+  // Every advertised verb must actually LOAD its script. Args are chosen so the dispatcher
+  // cannot answer on the script's behalf — `--help` on a non-selfHelp verb is intercepted by
+  // the dispatcher and would leave the script untouched, which is how this test could pass
+  // while proving nothing. Each verb below reaches its own code, then fails on the dead API
+  // base or on missing arguments. Failing that way is fine; failing to find a file is not.
+  const LOAD_ARGS = {
+    login:   ['login'],
+    reauth:  ['reauth'],
+    setup:   ['setup'],
+    box:     ['box'],
+    shell:   ['shell'],
+    code:    ['code'],
+    start:   ['start'],
+    status:  ['status'],
+    task:    ['task', 'show', '1'],
+    recall:  ['recall', 'probe'],
+    cost:    ['cost'],
+    release: ['release'],
+    api:     ['api', 'GET', '/api/gds/me'],
+  };
+  assert.deepEqual(
+    Object.keys(LOAD_ARGS).sort(), Object.keys(VERBS).sort(),
+    'every advertised verb needs an entry here, or it goes unexercised',
+  );
+
+  for (const [verb, args] of Object.entries(LOAD_ARGS)) {
+    const res = runVerb(args);
+    const all = `${res.stdout}\n${res.stderr}`;
+    assert.ok(!/Cannot find module|MODULE_NOT_FOUND|ERR_MODULE_NOT_FOUND/.test(all),
+      `bongos ${verb} hit a missing file — the manifest is incomplete:\n${all}`);
+    assert.ok(!/ERR_REQUIRE_ESM|SyntaxError|ReferenceError/.test(all),
+      `bongos ${verb} failed to load:\n${all}`);
+    // `TypeError: fetch failed` is what an unreachable API base looks like and is expected
+    // here; any OTHER TypeError means the package itself is broken.
+    assert.ok(!/TypeError(?!: fetch failed)/.test(all),
+      `bongos ${verb} threw a real TypeError:\n${all}`);
+    assert.notEqual(res.status, null, `bongos ${verb} was killed by a signal:\n${all}`);
+    // The dispatcher's own help card is proof the script was never reached.
+    assert.ok(!/^bongos \w+ — .*\nForwards to scripts/m.test(all),
+      `bongos ${verb} was answered by the dispatcher instead of loading:\n${all}`);
+  }
+
+  // The excluded verbs must teach the next step, not print a bare "unknown command".
+  for (const verb of Object.keys(CHECKOUT_ONLY)) {
+    const res = runVerb([verb]);
+    const all = `${res.stdout}\n${res.stderr}`;
+    assert.match(all, /is not in the public CLI/, `bongos ${verb} must say why it is absent`);
+    assert.match(all, /bongos shell/, `bongos ${verb} must point at a way to get a checkout`);
+    assert.ok(!/unknown command/.test(all), `bongos ${verb} must not read as a typo`);
+  }
+
+  // An unknown verb still behaves like one.
+  const bogus = runVerb(['definitely-not-a-verb']);
+  assert.match(bogus.stderr, /unknown command/);
+
+  for (const d of [buildOut, home, site]) fs.rmSync(d, { recursive: true, force: true });
+});

package/tests/manage_manifest_shared_read.mjs

@@ -0,0 +1,205 @@
+// tests/manage_manifest_shared_read.mjs — one read of the project's OWN
+// manifest per manage entry, EXECUTED (task 1003554).
+//
+// The defect this pins shut: entering /projects?view=manage fetched
+// https://<project>/api/gds/instance twice, identically and cross-origin,
+// because the two cards that render a "what it runs right now" line — how the
+// project is reached (brand.project.platformVisibility) and how people join
+// (brand.project.joinability) — each asked the project for themselves. Two
+// round trips to somebody else's server, each with its own 8s budget, for one
+// answer.
+//
+// It is the sibling of tests/manage_settings_shared_read.mjs, and the reason it
+// is a separate reader rather than the same memo: the settings row is read once
+// per entry and never again, so a memo that lives for the entry is right. This
+// answer goes stale the moment a settings push is queued, and the re-read once
+// that push settles is the ONLY thing that can say the new value took. So the
+// memo is dropped for as long as the push is open. A lifetime memo here would
+// freeze both lines at their pre-restart value — an efficiency cleanup turned
+// into a wrong answer on screen.
+//
+// tests/projects_hub.mjs pins that both cards go through the shared reader;
+// this file lifts the reader out of modules/public-landing/public/projects.html,
+// runs it in a vm under a scripted fetch, and counts the round trips. The
+// vm-harness precedent is tests/project_door_ui.mjs.
+//
+// What it proves, and why each matters:
+//   • both cards of one entry cost ONE round trip — the defect itself
+//   • forgetManifest() makes the next read real, so entry and tab return each
+//     ask the project as it is now, never as it was last visit
+//   • the push-open drop is what makes the settle re-read real, and the two
+//     cards re-reading after one settle still cost one round trip
+//   • switching projects is never served the previous project's manifest
+//   • a refusal RESOLVES carrying its status and an unreachable project
+//     resolves with status 0 — so ONE failure reaches BOTH lines and neither
+//     card goes silent waiting on a rejection nobody handed it
+//   • the 8s abort budget is the shared read's, and it is cleared once
+//
+// Run:  node --test --test-reporter=tap tests/manage_manifest_shared_read.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The reader, sliced from the page verbatim. Both boundaries are asserted so a
+// rename cannot leave this file executing an empty string and passing.
+const START = SCRIPT.indexOf('  var manifestPromise = null;');
+const END = SCRIPT.indexOf('  function loadVisRuns(');
+assert.ok(START > 0, 'the shared reader must start at its memo declaration');
+assert.ok(END > START, 'the shared reader must sit above its first consumer');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureManifest(', 'function forgetManifest(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the harness ──────────────────────────────────────────────────────────────
+// Narrow on purpose: the region touches fetch, manageId and the abort timer,
+// and nothing else — so the stub stays honest about what it can prove.
+
+function boot({ ok = true, status = 200, body = { brand: { project: { platformVisibility: 'public', joinability: 'open' } } }, reject = false } = {}) {
+  const requests = [];
+  const timers = { set: 0, cleared: 0 };
+  const sandbox = {
+    Promise, JSON, String, Object, Error, AbortController,
+    manageId: '18',
+    setTimeout: (fn, ms) => { timers.set++; timers.ms = ms; return { fn }; },
+    clearTimeout: () => { timers.cleared++; },
+    fetch: (url, init = {}) => {
+      requests.push({ url, mode: init.mode });
+      return reject
+        ? Promise.reject(new Error('network'))
+        : Promise.resolve({ ok, status, json: () => Promise.resolve(body) });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#shared-manifest-read' });
+
+  return { requests, timers, sandbox };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the two cards of one manage entry cost ONE round trip, not two', async () => {
+  // Arrange — the page's own entry pass: the reach card, then the join card
+  const ui = boot();
+
+  // Act
+  const answers = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 1, 'one cross-origin GET served both lines');
+  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/gds/instance');
+  assert.equal(ui.requests[0].mode, 'cors', 'the project is somebody else’s origin');
+  for (const a of answers) {
+    assert.equal(a.ok, true);
+    assert.equal(a.data.brand.project.joinability, 'open', 'both callers got the same manifest');
+  }
+});
+
+test('forgetManifest makes the next read real — entry and tab return never reuse the last visit’s answer', async () => {
+  // Arrange
+  const ui = boot();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Act — what loadManage does at the top of every entry + tab return pass
+  ui.sandbox.forgetManifest();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the second entry asked the project again');
+});
+
+test('a settled push re-reads for real, and the two cards still share ONE round trip', async () => {
+  // Arrange — the reason this memo is not ensureSettings()'s: an answer read
+  // before a push cannot say whether the restart took
+  const ui = boot();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Act — the push opens (renderVisState/renderJoinState each drop the memo on
+  // every repaint while it is open), then it settles and both cards re-read
+  ui.sandbox.forgetManifest();
+  ui.sandbox.forgetManifest();
+  const after = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'one re-read after the settle — not one per card, and not zero');
+  assert.equal(after[0].ok, true);
+});
+
+test('switching projects is never served the previous project’s manifest', async () => {
+  // Arrange — the memo is warm for project 18
+  const ui = boot();
+  await ui.sandbox.ensureManifest('one.example.com');
+
+  // Act — the owner opens a different project; loadManage has not forgotten yet
+  ui.sandbox.manageId = '19';
+  await ui.sandbox.ensureManifest('two.example.com');
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
+  assert.equal(ui.requests[1].url, 'https://two.example.com/api/gds/instance');
+});
+
+test('a project that answered-and-refused RESOLVES carrying its status — both lines can say so', async () => {
+  // Arrange — a pre-launch gate or a proxy error page, which is NOT an older core
+  const ui = boot({ ok: false, status: 403 });
+
+  // Act
+  const [a, b] = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(a.ok, false);
+  assert.equal(a.status, 403, 'the status reaches the card, which prints it verbatim');
+  assert.equal(a.data, null, 'no body is claimed for a refusal');
+  assert.deepEqual(b, a, 'the second card is handed the same refusal, not left waiting');
+});
+
+test('an unreachable project RESOLVES with status 0, so one failure fans out to both lines', async () => {
+  // Arrange — the failure that used to reject into two separate catches
+  const ui = boot({ reject: true });
+
+  // Act
+  const [a, b] = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(a.ok, false);
+  assert.equal(a.status, 0, 'status 0 is "could not reach it at all" — a different sentence from a refusal');
+  assert.deepEqual(b, a, 'neither line goes silent on a shared rejection');
+  assert.equal(ui.requests.length, 1, 'one failed attempt, not one per card');
+});
+
+test('the 8s abort budget belongs to the shared read, and is cleared once', async () => {
+  // Arrange
+  const ui = boot();
+
+  // Act
+  await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.timers.set, 1, 'one timer for the pair, not one each');
+  assert.equal(ui.timers.ms, 8000, 'the budget the two cards used to keep separately');
+  assert.equal(ui.timers.cleared, 1, 'and it is cleared when the answer lands');
+});

package/tests/projects_hub.mjs

@@ -1418,14 +1418,17 @@ test('the save sends the choice and shows the platform’s receipt verbatim —
 
 test('what the project RUNS comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadVisRuns');
+  const manifest = fnHub('ensureManifest');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/,
+  assert.match(manifest, /'https:\/\/' \+ domain \+ '\/api\/gds\/instance'/,
     'the same public GET /instance the platform’s runner reads after a restart');
+  assert.doesNotMatch(runs, /fetch\(/, 'the card fires no GET of its own — one manifest read serves the pair (task 1003554)');
   assert.match(runs, /m\.brand && m\.brand\.project/);
   assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
   assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
   assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
-  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
+  assert.match(manifest, /if \(!res\.ok\) return \{ ok: false, status: res\.status, data: null \};/,
+    'a refusal is not an older core — its status is carried out to both cards, not thrown away');
   assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
   assert.doesNotMatch(runs, /mVisSettings\.value\)\s*\+\s*'<\/b>'|runs as <b>' \+ esc\(VIS_OPTIONS\[want\]/,
     'the platform’s stored choice is never painted as what the project runs');
@@ -1598,15 +1601,39 @@ test('the joinability save sends the one key and shows the platform’s receipt
 test('what the project RUNS for joinability comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadJoinRuns');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/, 'the same public GET /instance the runner reads');
+  assert.match(runs, /ensureManifest\(inst\.domain\)/, 'the same public GET /instance the runner reads, through the shared reader');
+  assert.doesNotMatch(runs, /fetch\(/, 'the second card of the pair adds no round trip of its own (task 1003554)');
   assert.match(runs, /p && p\.joinability/, 'the manifest key is brand.project.joinability');
   assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
   assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
   assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
-  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
   assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
 });
 
+/* One read of the project's own manifest per manage entry (task 1003554), the
+   sibling of the settings-row share above. Two cards read two keys out of the
+   SAME cross-origin GET and each used to fetch it for itself. The memo differs
+   from ensureSettings() in one load-bearing way — it is dropped for as long as
+   a push is open, because the re-read after it settles is the only thing that
+   can say the new value took. tests/manage_manifest_shared_read.mjs runs the
+   reader; this pins that both cards go through it and that the drop is there. */
+test('the two “what it runs” lines share ONE read of the project’s manifest', () => {
+  const ensure = fnHub('ensureManifest');
+  assert.match(ensure, /if \(manifestPromise && manifestFor === manageId\) return manifestPromise;/,
+    'memoised AND keyed on the project — a switch must never be served the last one’s manifest');
+  assert.match(ensure, /setTimeout\(function \(\) \{ ctl\.abort\(\); \}, 8000\)/, 'one 8s budget for the pair, not one each');
+  for (const fn of ['loadVisRuns', 'loadJoinRuns']) {
+    assert.match(fnHub(fn), /ensureManifest\(inst\.domain\)/, `${fn} reads the manifest through the shared reader`);
+    assert.doesNotMatch(fnHub(fn), /fetch\(/, `${fn} fires no GET of its own`);
+  }
+  assert.match(SCRIPT, /if \(!keepRepo\) forgetManifest\(\);/,
+    'the memo is dropped on entry + tab return, so neither is ever served the last visit’s answer');
+  for (const fn of ['renderVisState', 'renderJoinState']) {
+    assert.match(fnHub(fn), /forgetManifest\(\);/,
+      `${fn} drops the memo while a push is open — a lifetime memo would freeze the line at its pre-restart value`);
+  }
+});
+
 test('the joinability in-flight line shares the visibility section’s push predicate and re-asks the manifest when it settles', () => {
   const st = fnHub('renderJoinState');
   assert.match(st, /if \(visPushOpen\(inst\)\)/, 'one settings push carries every key — one predicate, shared');