@bongos/core 1.20.49 → 1.20.51

package/tests/projects_hub_module_picker.mjs

@@ -41,7 +41,7 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
 
 const START = '/* ── the module picker (task 1002339, BV1.R20) ──';
-const END = "$('skipModules').addEventListener('click', function () { show(5, true); });";
+const END = "$('skipModules').addEventListener('click', function () { show(7, true); });";
 const from = HUB.indexOf(START);
 const to = HUB.indexOf(END);
 assert.ok(from > -1, 'the picker block opens with its sentinel comment');
@@ -160,7 +160,7 @@ function boot({ state: seed = {}, fetchOk = true, payload = PAYLOAD } = {}) {
   const els = new Map();
   const $ = (id) => { if (!els.has(id)) els.set(id, makeEl(id)); return els.get(id); };
   const form = makeEl('panel-modules-form');
-  const state = { step: 4, projType: null, teamShape: null, modules: null, ...seed };
+  const state = { step: 6, projType: null, teamShape: null, modules: null, ...seed };
   const shown = [];
   let saves = 0;
   let fetches = 0;
@@ -312,7 +312,7 @@ test('Skip walks past WITHOUT answering, so the server applies the bundle the pa
 
   // Assert — skipping is the one path that must leave nothing said, because the
   // preselect and the server's fallback are the same declaration (ADR 0237)
-  assert.deepEqual(h.shown, [5], 'it advances to the Home step');
+  assert.deepEqual(h.shown, [7], 'it advances to the Home step (7 since task 1004417)');
   assert.equal(h.state.modules, null, 'and answers nothing');
   assert.equal(h.forCreate(), undefined);
   assert.deepEqual(h.picked(), ['npm-release', 'discord'], 'while the set they were shown is still the set they get');
@@ -377,7 +377,7 @@ test('a catalog that will not load degrades to a clause — it never blocks a pr
   assert.match(h.coreNote(), /couldn’t load/, 'the panel says so in the owner\'s words');
   assert.equal(h.state.modules, null, 'nothing is answered on their behalf');
   h.skip();
-  assert.deepEqual(h.shown, [5], 'and the wizard still walks on — the server applies the bundle');
+  assert.deepEqual(h.shown, [7], 'and the wizard still walks on — the server applies the bundle');
 });
 
 test('every rendered value goes through the page escaper', async () => {
@@ -415,7 +415,7 @@ test('the review names the set even when the picker was never opened (task 10023
   // and the module NAMES are not known. "None — just the core" would be a false
   // promise on the last screen before Create: the server is about to apply the
   // type's bundle. The row says that instead, then repaints when the read lands.
-  const h = boot({ state: { projType: 'game', step: 8 } });   // 8 = the review since task 1004351
+  const h = boot({ state: { projType: 'game', step: 10 } });   // 10 = the review since task 1004417 (8 since 1004351)
 
   // Arrange + Act — the review asks for the value before the read can answer
   const first = h.extrasRow();
@@ -510,7 +510,7 @@ test('Skip after an answered About step still yields the set the panel showed',
 
   h.skip();
 
-  assert.deepEqual(h.shown, [5]);
+  assert.deepEqual(h.shown, [7]);
   assert.equal(h.state.modules, null, 'skipping answers nothing, tailored or not');
   assert.equal(h.forCreate(), undefined, 'so the create request still carries no modules key');
   assert.deepEqual(h.picked(), ['discord'], 'while the set they were shown is still the set they get');
@@ -821,7 +821,7 @@ test('with nothing switched on the count says only what is shown', async () => {
 });
 
 test('the review names the hidden picks too — a filter never reaches the create request', async () => {
-  const h = boot({ state: { projType: 'game', step: 8 } });   // 8 = the review since task 1004351
+  const h = boot({ state: { projType: 'game', step: 10 } });   // 10 = the review since task 1004417 (8 since 1004351)
   await h.open();
   h.click('agents');
   assert.deepEqual(h.forCreate(), ['agents', 'npm-release', 'discord']);

package/tests/projects_hub_pre_uat.mjs

@@ -550,7 +550,10 @@ test('the rail at the done panel keeps its marker on Create until the project an
   assert.doesNotMatch(fn('show'), /classList\.toggle\('done'/, 'and no longer marks the rail on its own');
   assert.ok(SCRIPT.includes(`if (state.step === ${DONE}) paintRail(${DONE});`),
     'the done-panel poll repaints when the status moves');
-  assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
+  // the first NUMBERED beat carries it — since task 1004417 the front door's two screens come
+  // before the rail, and the card statically wears wizFront so a no-script visitor sees no rail there
+  assert.match(HUB, new RegExp(`<li class="now" data-step="${STEP['panel-name']}" aria-current="step"><span class="snum">1</span>`), 'the static rail starts with the same marker');
+  assert.match(HUB, /<section id="view-new" hidden>\s*<div class="wrap viewWrap">\s*<div class="card wizFront">/, 'and steps aside on the static first screen');
 });
 
 test('every action result announces, nothing under the pointer is deleted, and focus stays where it was', () => {

package/tests/provisioning_terms_ack.mjs

@@ -0,0 +1,216 @@
+// tests/provisioning_terms_ack.mjs
+//
+// The create wizard's terms screen, as the server records it (task 1004417, BV2.PS05;
+// migration provisioning_033). The founder ticks one box; the project row keeps WHEN and
+// WHICH terms version. The owner's call (2026-09-30): the record lives on the PROJECT,
+// not on the person's account — ADR 0213's account stamp is a different record, written
+// only at a witnessed sign-in.
+//
+// The one property every case below protects: the VERSION is the server's answer. The
+// request can say only "the box was ticked"; the version comes from platform-identity's
+// TERMS_VERSION through the platform-identity.hub port, so a body cannot record agreement
+// to a text it names itself.
+//
+// Four layers:
+//   • the port      — platform-identity's hub provider answers TERMS_VERSION
+//   • createInstance — what reaches the INSERT
+//   • POST /instances — validation, and that no body field reaches the version
+//   • the migration  — the columns exist and do not collide with the account's
+//
+// DB-free: a recording pool, stubbed data-access functions, a loopback listener.
+//
+// Run:  node tests/provisioning_terms_ack.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+
+const require = createRequire(import.meta.url);
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const api = require('../src/module-api.js');
+const { TERMS_VERSION } = require('../modules/platform-identity/terms-acceptance.js');
+
+// ── the port: the hub answers the version /terms states ───────────────────────
+await ta('the platform-identity.hub port answers the current TERMS_VERSION, and it is a read', async () => {
+  // Capture what the SSO route factory registers, without touching the real registry.
+  const realHas = api.hasProvider, realReg = api.registerProvider;
+  const registered = {};
+  api.hasProvider = () => false;
+  api.registerProvider = (name, provider) => { registered[name] = provider; };
+  try {
+    require('../modules/platform-identity/routes/sso.js')();
+  } finally {
+    api.hasProvider = realHas; api.registerProvider = realReg;
+  }
+  const hub = registered['platform-identity.hub'];
+  assert.ok(hub, 'the SSO factory registers the hub port');
+  assert.equal(typeof hub.termsVersion, 'function', 'the port carries termsVersion');
+  assert.equal(hub.termsVersion(), TERMS_VERSION, 'and it is the version /terms states');
+  assert.match(TERMS_VERSION, /^\d{4}-\d{2}-\d{2}$/, 'a date-stamped version, as the page prints it');
+});
+
+// ── createInstance: what reaches the INSERT ───────────────────────────────────
+const provisioning = require('../modules/provisioning/provisioning.js');
+const realCreate = provisioning.createInstance;
+
+function recordingDb() {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params) => { calls.push({ text, params }); return { rows: [{ id: 1, owner_builder_id: 7, slug: 'demo' }] }; },
+  };
+}
+function insertOf(db) {
+  const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
+  assert.ok(insert, 'issued an INSERT');
+  return insert;
+}
+
+await ta('createInstance: an acknowledgement stores the time and the server-resolved version', async () => {
+  const db = recordingDb();
+  await realCreate(db, { ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', termsAck: { version: '2026-08-29' } });
+  const { text, params } = insertOf(db);
+  assert.match(text, /terms_ack_at, terms_ack_version\)/, 'both columns are in the column list');
+  assert.match(text, /CASE WHEN \$15::boolean THEN now\(\) END, \$16\)/, 'the time is the database clock, never a caller value');
+  assert.equal(params[14], true);
+  assert.equal(params[15], '2026-08-29');
+});
+
+await ta('createInstance: no acknowledgement leaves both columns NULL — a row that never saw the screen says so', async () => {
+  for (const termsAck of [undefined, null]) {
+    const db = recordingDb();
+    await realCreate(db, { ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', termsAck });
+    const { params } = insertOf(db);
+    assert.equal(params[14], false, `termsAck=${termsAck} records no time`);
+    assert.equal(params[15], null, 'and no version');
+  }
+});
+
+await ta('createInstance: an acknowledgement with no hub to ask keeps the time and a NULL version', async () => {
+  const db = recordingDb();
+  await realCreate(db, { ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', termsAck: { version: null } });
+  const { params } = insertOf(db);
+  assert.equal(params[14], true, 'the founder did tick the box');
+  assert.equal(params[15], null, 'but nothing names a version this instance cannot vouch for');
+});
+
+// ── POST /instances over a mounted router ─────────────────────────────────────
+let lastCreateArgs = null;
+provisioning.getInstanceBySlug = async () => null;
+provisioning.getInstanceByDomain = async () => null;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  return { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'byo-host', detail: {} }, created: true };
+};
+provisioning.enqueueIntent = async (_db, _id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
+provisioning.getOpenIntent = async () => null;
+provisioning.recordEvent = async () => {};
+
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+// The hub port, as the route will see it. `hubVersion === undefined` = no hub at all.
+let hubVersion;
+const realResolveOptional = api.resolveOptional;
+api.resolveOptional = (name, fallback = null) => {
+  if (name !== 'platform-identity.hub') return realResolveOptional(name, fallback);
+  return hubVersion === undefined ? fallback : { termsVersion: () => hubVersion };
+};
+
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', require('../modules/provisioning/routes/provisioning.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload), Connection: 'close' },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+await ta('POST /instances: a ticked box records the version the SERVER names', async () => {
+  lastCreateArgs = null; hubVersion = '2026-08-29';
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', terms_acknowledged: true });
+  assert.equal(res.status, 201, res.raw);
+  assert.deepEqual(lastCreateArgs.termsAck, { version: '2026-08-29' });
+});
+
+await ta('POST /instances: a caller-named version is refused outright, never recorded', async () => {
+  // Every spelling a forger might try, beside a real tick. The schema is closed, so each
+  // one is named back as an unknown field and nothing is created at all.
+  for (const forged of ['terms_version', 'terms_ack_version', 'termsVersion']) {
+    lastCreateArgs = null; hubVersion = '2026-08-29';
+    const res = await post('/provisioning/instances', {
+      slug: 'mercury', hosting_shape: 'byo-host', terms_acknowledged: true, [forged]: '1999-01-01',
+    });
+    assert.equal(res.status, 400, res.raw);
+    assert.equal(res.body.error.code, 'validation_failed');
+    assert.match(res.raw, new RegExp(`"field":"${forged}","reason":"unknown_field"`), `${forged} is named as unknown`);
+    assert.equal(lastCreateArgs, null, `${forged}: nothing was created`);
+  }
+});
+
+await ta('POST /instances: no tick is still a valid create — the CLI and older clients never showed the screen', async () => {
+  lastCreateArgs = null; hubVersion = '2026-08-29';
+  for (const body of [{}, { terms_acknowledged: false }]) {
+    const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', ...body });
+    assert.equal(res.status, 201, res.raw);
+    assert.equal(lastCreateArgs.termsAck, null, `${JSON.stringify(body)} records nothing`);
+  }
+});
+
+await ta('POST /instances: an instance with no hub keeps the tick with a NULL version', async () => {
+  lastCreateArgs = null; hubVersion = undefined;
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', terms_acknowledged: true });
+  assert.equal(res.status, 201, res.raw);
+  assert.deepEqual(lastCreateArgs.termsAck, { version: null });
+});
+
+await ta('POST /instances: terms_acknowledged must be a boolean — "yes" is refused, not read as a tick', async () => {
+  lastCreateArgs = null; hubVersion = '2026-08-29';
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', terms_acknowledged: 'yes' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'validation_failed');
+  assert.equal(lastCreateArgs, null, 'nothing was created');
+});
+
+server.close();
+api.resolveOptional = realResolveOptional;
+
+// ── the migration ─────────────────────────────────────────────────────────────
+await ta('provisioning_033 adds both columns, nullable, and never names the account\'s acceptance columns', async () => {
+  const sql = fs.readFileSync(new URL('../modules/provisioning/migrations/provisioning_033_terms_ack.sql', import.meta.url), 'utf8');
+  const code = sql.replace(/--.*$/gm, '');
+  assert.match(code, /ADD COLUMN IF NOT EXISTS terms_ack_at timestamptz;/);
+  assert.match(code, /ADD COLUMN IF NOT EXISTS terms_ack_version text;/);
+  assert.doesNotMatch(code, /NOT NULL|DEFAULT|UPDATE /i, 'no backfill: a project that never saw the screen stays NULL');
+  assert.doesNotMatch(code, /\bterms_(?:accepted_at|version|accepted_source)\b/, 'the account\'s columns belong to terms-acceptance.js alone');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/wizard_draft_resume.mjs

@@ -71,7 +71,7 @@ function runStep({ authKnown, draftStep }) {
 
 test('pre-auth: the placeholder renders step 1 but the draft KEEPS the real step', () => {
   const { rendered, persisted } = runStep({ authKnown: false, draftStep: 5 });
-  assert.deepEqual(rendered, [1], 'still renders the name step before identity settles');
+  assert.deepEqual(rendered, [1], 'still renders step 1 (the terms, since task 1004417) before identity settles');
   assert.equal(persisted.step, 5, 'the draft must not be overwritten with the placeholder');
 });
 
@@ -90,9 +90,9 @@ test('post-auth: the real step is rendered', () => {
 
 test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
   assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
-  // 9 is the done panel (8 before task 1004351), reached by its own branch above this slice; 0 is the gate. Neither
-  // is a resumable wizard position, so the placeholder is allowed to stand.
-  for (const bad of [0, 9, 99]) {
+  // 11 is the done panel (9 before task 1004417's front door, 8 before task 1004351), reached by its own branch
+  // above this slice; 0 is the gate. Neither is a resumable wizard position, so the placeholder is allowed to stand.
+  for (const bad of [0, 11, 99]) {
     assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
   }
 });

package/tests/wizard_front_door.mjs

@@ -0,0 +1,271 @@
+// tests/wizard_front_door.mjs — the create wizard's front door (task 1004417, BV2.PS05;
+// goal 1000121, docs/design/project-startup-direction.md "Front door").
+//
+// Two screens now stand in front of the wizard's numbered steps:
+//   1 · terms — "anything you want to make": one tick, recorded on the project against
+//       the terms version the SERVER stamps (tests/provisioning_terms_ack.mjs holds that half);
+//   2 · fork  — "you are now creating a digital planet": the world's door pill, two equal
+//       doors, try the demo / begin planet creation. The demo is its own task (BV2.PS09), so
+//       its door says the demo is not open yet rather than leading anywhere.
+// Sign-in stays where it was: the gate (step 0) comes first.
+//
+// Most of this RUNS the page's own script, the vm-slice idiom of tests/wizard_draft_resume.mjs:
+// validateStep(), the front door's wiring, and show()'s class toggles are sliced out of the
+// inline script and executed under a minimal DOM stub. Every slice boundary is asserted, so a
+// rename fails loudly instead of leaving this file quietly testing nothing.
+//
+// projects.html is CRLF on a Windows checkout; this file normalises at read time.
+//
+// Run:  node --test tests/wizard_front_door.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+const STYLE = HUB.slice(HUB.indexOf('<style>'), HUB.indexOf('</style>'));
+
+const panel = (id) => (HUB.match(new RegExp(`<section class="panel[^"]*" id="${id}"[\\s\\S]*?\\n {10}</section>`)) || [''])[0];
+const TERMS = panel('panel-terms');
+const FORK = panel('panel-fork');
+const MAP = {};
+for (const m of ((SCRIPT.match(/var panels = \{([^}]*)\}/) || [, ''])[1]).matchAll(/(\d+):\s*'([a-z-]+)'/g)) MAP[m[2]] = Number(m[1]);
+
+// ── the order ───────────────────────────────────────────────────────────────────
+test('the front door stands between sign-in and the name step: gate 0, terms 1, fork 2, name 3', () => {
+  assert.equal(MAP['panel-gate'], 0, 'sign-in stays where it is today, first');
+  assert.equal(MAP['panel-terms'], 1);
+  assert.equal(MAP['panel-fork'], 2);
+  assert.equal(MAP['panel-name'], 3, 'and today\'s wizard continues unchanged after it');
+  assert.ok(HUB.indexOf('id="panel-gate"') < HUB.indexOf('id="panel-terms"')
+    && HUB.indexOf('id="panel-terms"') < HUB.indexOf('id="panel-fork"')
+    && HUB.indexOf('id="panel-fork"') < HUB.indexOf('id="panel-name"'), 'the markup reads in the same order');
+  assert.match(TERMS, /<form data-next="2">/, 'the terms go on to the fork');
+  assert.match(FORK, /<form data-next="3">/, 'the fork\'s primary door goes on to the name step');
+  assert.match(FORK, /data-back="1"/, 'and the way back is the terms');
+});
+
+test('the rail is the numbered steps\' — it steps aside on both front-door screens, statically too', () => {
+  const beats = [...HUB.matchAll(/<li[^>]*data-step="(\d+)"/g)].map((m) => Number(m[1]));
+  assert.deepEqual(beats, [3, 4, 5, 6, 7, 8, 9, 10], 'the rail numbers name…create, never the front door');
+  assert.match(HUB, /<div class="card wizFront">/, 'a no-script visitor on the static first screen sees no rail');
+  assert.match(STYLE, /#view-new \.card\.wizFront \.steps\{display:none;\}/);
+});
+
+// ── screen 1 · the terms ────────────────────────────────────────────────────────
+test('screen 1 is the canvas\'s "anything you want to make": two ledes, one tick, a read-the-terms link, one door', () => {
+  assert.ok(TERMS, '#panel-terms ships as real markup (C7)');
+  assert.match(TERMS, /^<section class="panel on" id="panel-terms"/, 'it carries the static `on` — step 1 for a no-script visitor');
+  assert.match(TERMS, /<h1 id="terms-h">Anything you want to make<\/h1>/);
+  assert.equal((TERMS.match(/<p class="lede">/g) || []).length, 2, 'two lede paragraphs');
+  assert.match(TERMS, /<input type="checkbox" id="termsAck" aria-describedby="h-terms">/, 'one checkbox, named by its hint');
+  assert.match(TERMS, /<label class="termsAck">\s*<input[^>]*>\s*<span>I can sign legally, or can get a signature, for the use of this platform, and I acknowledge the terms and conditions\.<\/span>/,
+    'the whole row is its label, so the target is the sentence, not a 20px box');
+  assert.match(TERMS, /<a class="termsRead" href="\/terms" target="_blank" rel="noopener">Read the terms<\/a>/,
+    'the platform\'s own /terms, in a new tab so the draft is not left behind');
+  assert.equal((TERMS.match(/type="submit"/g) || []).length, 1, 'one primary door');
+  assert.match(TERMS, /<span data-brand-product-inline>Cloud Bongos<\/span>/, 'the product name is the pack\'s, re-branded on a child');
+});
+
+test('the page never names a terms version — the server stamps which text was acknowledged', () => {
+  // A version baked here would be a second copy of TERMS_VERSION that drifts, and worse, a
+  // value a caller could send. The create request carries only the tick.
+  assert.doesNotMatch(HUB, /terms_version|termsVersion|terms_ack_version/, 'no version travels from the page');
+  assert.doesNotMatch(TERMS, /\b20\d\d-\d\d-\d\d\b/, 'and none is printed on the screen');
+});
+
+test('the resume offer moved with step 1 — it lives on the terms screen, once', () => {
+  assert.equal((HUB.match(/id="wizResume"/g) || []).length, 1);
+  assert.ok(TERMS.includes('id="wizResume"'), 'a deliberate "New project" lands here, so the offer does too');
+});
+
+// ── the validator, executed ────────────────────────────────────────────────────
+const VALIDATE_RE = /function validateStep\(step\) \{[\s\S]*?\n {4}\}/;
+const validateSlice = (SCRIPT.match(VALIDATE_RE) || [null])[0];
+
+function runValidate(step, termsAck) {
+  const els = {};
+  const $ = (id) => (els[id] = els[id] || { textContent: '', className: '', classList: { add() {} }, focus() {} });
+  const sandbox = { $, state: { termsAck, name: 'Mercury', projType: 'game' }, validateRender: () => true, repoAccess: true };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(`${validateSlice}\nvar ok = validateStep(${step});`, sandbox);
+  return { ok: sandbox.ok, hint: els['h-terms'] };
+}
+
+test('validateStep is still findable, with the terms clause inside it', () => {
+  assert.ok(validateSlice, 'validateStep() was not found in projects.html');
+  assert.match(validateSlice, /if \(step === 1\) \{\s*if \(!state\.termsAck\)/, 'the clause is part of the slice');
+});
+
+test('Proceed is refused until the box is ticked, and the refusal says why in the hint', () => {
+  const refused = runValidate(1, false);
+  assert.equal(refused.ok, false, 'no tick, no fork');
+  assert.equal(refused.hint.className, 'hint err');
+  assert.match(refused.hint.textContent, /Tick the box to go on/);
+  const given = runValidate(1, true);
+  assert.equal(given.ok, true, 'a tick goes on');
+});
+
+test('the fork has no clause of its own — its doors are the answer', () => {
+  assert.equal(runValidate(2, false).ok, true, 'the fork asks nothing a validator could refuse');
+  assert.ok(!validateSlice.includes('if (step === 2) {'), 'and no clause for step 2 exists');
+});
+
+// ── the wiring, executed ───────────────────────────────────────────────────────
+const WIRE_START = "    $('termsAck').checked = !!state.termsAck;";
+const WIRE_END = '    /* ── field wiring ── */';
+const wireSlice = SCRIPT.includes(WIRE_START) ? SCRIPT.slice(SCRIPT.indexOf(WIRE_START), SCRIPT.indexOf(WIRE_END)) : null;
+
+function runWiring(initialAck) {
+  const handlers = {};
+  const mk = (id) => ({
+    id, checked: false, hidden: id === 'demoSoon', textContent: '', className: '', attrs: {},
+    addEventListener(type, fn) { handlers[id + ':' + type] = fn; },
+    setAttribute(k, v) { this.attrs[k] = v; },
+  });
+  const els = { termsAck: mk('termsAck'), wizDemo: mk('wizDemo'), demoSoon: mk('demoSoon'), 'h-terms': mk('h-terms') };
+  let saves = 0;
+  const sandbox = { $: (id) => els[id], state: { termsAck: initialAck }, saveDraft: () => { saves += 1; } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(wireSlice, sandbox);
+  return { els, handlers, sandbox, saves: () => saves };
+}
+
+test('the front door\'s wiring is still findable', () => {
+  assert.ok(wireSlice && wireSlice.length > 100, 'the wiring block was not found in projects.html');
+  assert.match(wireSlice, /\$\('wizDemo'\)\.addEventListener\('click'/, 'the demo door is part of the slice');
+});
+
+test('the tick mirrors into the draft both ways, and a resumed draft paints its own answer', () => {
+  const { els, handlers, sandbox, saves } = runWiring(true);
+  assert.equal(els.termsAck.checked, true, 'a draft that ticked comes back ticked (the GitHub round-trip keeps it)');
+  els.termsAck.checked = false; handlers['termsAck:change'].call(els.termsAck);
+  assert.equal(sandbox.state.termsAck, false, 'unticking is an answer too');
+  els['h-terms'].className = 'hint err';
+  els.termsAck.checked = true; handlers['termsAck:change'].call(els.termsAck);
+  assert.equal(sandbox.state.termsAck, true);
+  assert.equal(els['h-terms'].className, 'hint', 'ticking clears the refusal');
+  assert.equal(saves(), 2, 'each change is saved');
+});
+
+test('the demo door opens a line saying the demo is not open yet, and says so to a screen reader', () => {
+  const { els, handlers } = runWiring(false);
+  assert.equal(els.demoSoon.hidden, true, 'hidden at rest');
+  handlers['wizDemo:click'].call(els.wizDemo);
+  assert.equal(els.demoSoon.hidden, false, 'the placeholder opens');
+  assert.equal(els.wizDemo.attrs['aria-expanded'], 'true');
+  handlers['wizDemo:click'].call(els.wizDemo);
+  assert.equal(els.demoSoon.hidden, true, 'and closes again');
+  assert.equal(els.wizDemo.attrs['aria-expanded'], 'false');
+  assert.match(FORK, /id="wizDemo" aria-controls="demoSoon" aria-expanded="false"/, 'the door names what it opens');
+  assert.match(FORK, /<p class="demoSoon" id="demoSoon" hidden>The demo isn’t open yet\./, 'baked markup, never built by script');
+});
+
+// ── screen 2 · the fork ─────────────────────────────────────────────────────────
+test('screen 2 is the door pill: two equal doors in one object, the accent only on the one that goes on', () => {
+  assert.match(FORK, /<h1 id="fork-h">You are now creating a digital planet<\/h1>/);
+  const pill = (FORK.match(/<div class="doorPill" role="group" aria-label="How to begin">[\s\S]*?<\/div>/) || [''])[0];
+  assert.ok(pill, 'one grouped pill');
+  const doors = [...pill.matchAll(/<button type="(button|submit)" class="([^"]+)"[^>]*>([^<]+)<\/button>/g)];
+  assert.equal(doors.length, 2, 'exactly two doors');
+  assert.deepEqual(doors.map((d) => d[3]), ['Try the demo', 'Begin planet creation']);
+  assert.equal(doors[0][2], 'btn big ghost', 'the demo door is the secondary: transparent at rest');
+  assert.equal(doors[1][2], 'btn big', 'begin carries the accent');
+  assert.equal(doors[1][1], 'submit', 'and is the form\'s one submit, so Enter goes on');
+  assert.match(STYLE, /\.doorPill\{display:inline-grid;grid-template-columns:1fr 1fr;/, 'two EQUAL tracks — the two routes are equal ways in');
+  assert.match(STYLE, /\.doorPill\{[^}]*border-radius:999px;/, 'pill or nothing');
+  assert.match(STYLE, /@media \(max-width:520px\)\{\s*\.doorPill\{display:grid;grid-template-columns:1fr;/, 'at a phone width the two stack, still one object');
+});
+
+test('the seed stands on the world\'s own field plate — nothing drawn but hairlines', () => {
+  assert.match(FORK, /<div class="forkStage" aria-hidden="true">/, 'decorative, so hidden from a screen reader');
+  assert.match(FORK, /<img class="forkSeed" src="\/assets\/world\/r2-chrome-blob-one-cut\.webp" alt="">/, 'a real plate, root-absolute so it is stamped');
+  assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-chrome-blob-one-cut.webp')), 'and it exists on disk');
+  assert.match(STYLE, /\.forkStage\{[^}]*background:var\(--sky-bg\) var\(--field-plate\) center\/cover no-repeat;/, 'the field is the plate token, not a new image');
+  assert.match(STYLE, /\.forkOrbit\{[^}]*border:1px solid var\(--rule\);border-radius:50%;/, 'the orbits are hairline circles');
+  const at = STYLE.indexOf('the front door (task 1004417');
+  const block = STYLE.slice(at, STYLE.indexOf('/* a field:', at));
+  assert.ok(at > -1 && block.includes('.forkStage{'), 'the front door\'s CSS block is findable');
+  assert.doesNotMatch(block, /#[0-9a-f]{3,8}\b|box-shadow:(?!none)|linear-gradient/i, 'every colour a token, no shadow, no gradient');
+});
+
+test('the two routes are described honestly for today: the demo says coming soon, creation promises no questions that do not exist yet', () => {
+  const routes = (FORK.match(/<div class="forkRoutes">[\s\S]*$/) || [''])[0];
+  assert.match(routes, /Route 1 · demo · coming soon/);
+  assert.match(routes, /Route 2 · planet creation/);
+  assert.doesNotMatch(routes, /seven questions/i, 'the seven planet questions are PS07\'s — the copy must not promise them before they ship');
+  assert.doesNotMatch(FORK, /\bBongos\b(?! pair)/, 'no product name baked where a child instance would ship it');
+});
+
+// ── show(): the class toggles, executed ────────────────────────────────────────
+const SHOW_RE = /function show\(step, moveFocus\) \{[\s\S]*?\n {4}\}/;
+const showSlice = (SCRIPT.match(SHOW_RE) || [null])[0];
+
+function runShow(step) {
+  const cls = (name) => { const set = new Set(); return { name, set, toggle(c, on) { if (on) set.add(c); else set.delete(c); } }; };
+  const card = cls('card'), split = cls('split');
+  const panels = {};
+  const $ = (id) => (panels[id] = panels[id] || { classList: cls(id), querySelector: () => null });
+  const sandbox = {
+    $, state: {}, panels: Object.fromEntries(Object.entries(MAP).map(([id, n]) => [n, id])),
+    root: { querySelector: (sel) => (sel === '.card' ? { classList: card } : { classList: split }) },
+    paintRail() {}, saveDraft() {}, authKnown: false, repoAccess: null,
+    renderModules() {}, syncHome() {}, ensureRepoAccess() {}, checkSlugAvailable() {}, renderAddrPanel() {},
+    syncAppStep() {}, syncRenderSetup() {}, renderReview() {},
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(`${showSlice}\nshow(${step}, false);`, sandbox);
+  return { card: card.set, split: split.set, on: Object.keys(panels).filter((id) => panels[id].classList.set.has('on')) };
+}
+
+test('show() takes the rail away on the two front-door screens only, and gives the fork the whole card', () => {
+  assert.ok(showSlice, 'show() was not found in projects.html');
+  const terms = runShow(1), fork = runShow(2), name = runShow(3), done = runShow(MAP['panel-done']);
+  assert.deepEqual(terms.on, ['panel-terms']);
+  assert.ok(terms.card.has('wizFront') && !terms.split.has('wizFork'), 'terms: no rail, the bongo pair stays');
+  assert.ok(fork.card.has('wizFront') && fork.split.has('wizFork'), 'fork: no rail, and the seed takes the pair\'s place');
+  assert.ok(!name.card.has('wizFront') && !name.split.has('wizFork'), 'the name step has its rail back');
+  assert.ok(done.split.has('wizDone') && !done.card.has('wizFront'), 'the done panel is untouched by the front door');
+});
+
+// ── the create ──────────────────────────────────────────────────────────────────
+test('the create carries the tick, and is never filed without it', () => {
+  const create = SCRIPT.slice(SCRIPT.indexOf("$('doCreate').addEventListener('click'"));
+  assert.match(create, /terms_acknowledged: state\.termsAck \? true : undefined,/,
+    'a real boolean when ticked, absent otherwise — the route refuses anything but a boolean');
+  const guard = create.indexOf('if (!state.termsAck) { show(1, true); validateStep(1); return; }');
+  assert.ok(guard > -1, 'an unticked draft is sent back to the terms');
+  assert.ok(guard < create.indexOf('ensureFreshRepo()'), 'BEFORE anything is created — the repo included');
+});
+
+test('the tick is part of the draft and of the reset, and the draft key moved with the renumbering', () => {
+  assert.match(SCRIPT, /var state = \{ step: 0,[^}]*termsAck: false \};/, 'the initial state declares it');
+  assert.match(SCRIPT, /state = \{ step: 1,[^}]*termsAck: false \};/, 'and "start another project" clears it — each project records its own');
+  assert.match(SCRIPT, /var DRAFT_KEY = 'cb-create-draft-v6';/, 'a draft saved under the old numbering is ignored, not replayed onto the wrong screen');
+});
+
+// ── the look-before-you-ship kit walks it ─────────────────────────────────────
+test('the kit has a state for each front-door screen, and every walk past it ticks and chooses first', () => {
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
+  for (const s of ['in-new', 'in-new-terms-refused', 'in-new-fork', 'in-new-fork-demo', 'in-new-name']) assert.ok(states[s], `the ${s} state exists`);
+  assert.deepEqual(states['in-new'].expect.visible, ['#panel-terms', '#termsAck'], 'arriving at ?view=new pictures the terms');
+  const FRONT = ['#termsAck', '#panel-terms button[type=submit]', '#panel-fork button[type=submit]'];
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
+  const walks = [...Object.entries(states).map(([k, v]) => [k, v.actions || []]), ...probes.map((p) => [p.name, p.steps])]
+    .filter(([, steps]) => steps.some((st) => st[1] === '#newName'));
+  assert.ok(walks.length >= 12, `every wizard walk is found (${walks.length})`);
+  for (const [name, steps] of walks) {
+    const clicks = steps.filter((st) => st[0] === 'click').map((st) => st[1]);
+    assert.deepEqual(clicks.slice(0, 3), FRONT, `${name}: the front door comes first`);
+  }
+  assert.ok(probes.some((p) => /the front door \(task 1004417\)/.test(p.name)), 'a probe drives the refusal, the demo door and the way on');
+});