@bongos/core 1.20.73 → 1.20.75

package/tests/projects_hub_look.mjs

@@ -106,17 +106,17 @@ test('every colour the previews paint is its pack\'s, and the night shares are t
 });
 
 test('the step sits between App and Review: look 10, review 11, done 12, draft v7, a beat on the rail', () => {
-  assert.match(HUB, /9: 'panel-app', 10: 'panel-look', 11: 'panel-review', 12: 'panel-done' \};/);
-  assert.match(HUB, /var DRAFT_KEY = 'cb-create-draft-v7';/);
-  assert.match(HUB, /<li data-step="10"><span class="snum">8<\/span><span class="slbl">Look<\/span><\/li>\n\s*<li data-step="11"><span class="snum">9<\/span><span class="slbl">Create<\/span><\/li>/);
+  assert.match(HUB, /10: 'panel-app', 11: 'panel-look', 12: 'panel-review', 13: 'panel-done' \};/);
+  assert.match(HUB, /var DRAFT_KEY = 'cb-create-draft-v8';/);
+  assert.match(HUB, /<li data-step="11"><span class="snum">9<\/span><span class="slbl">Look<\/span><\/li>\r?\n\s*<li data-step="12"><span class="snum">10<\/span><span class="slbl">Create<\/span><\/li>/);
   const panel = (HUB.match(/<section class="panel" id="panel-look"[\s\S]*?<\/section>/) || [''])[0];
   assert.match(panel, /<h1 id="look-h">Give it a look<\/h1>/);
-  assert.match(panel, /<form data-next="11">/);
-  assert.match(panel, /data-back="9"/);
+  assert.match(panel, /<form data-next="12">/);
+  assert.match(panel, /data-back="10"/);
   assert.match(panel, /<div class="lookPick" id="wizLook"><\/div>/);
   assert.ok(HUB.indexOf('id="panel-app"') < HUB.indexOf('id="panel-look"') && HUB.indexOf('id="panel-look"') < HUB.indexOf('id="panel-review"'), 'in document order too');
-  assert.match(HUB, /if \(step === 10\) renderLook\(\);\n\s*if \(step === 11\) renderReview\(\);/);
-  assert.match(fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8'), /#view-new \.steps\{display:grid;grid-template-columns:repeat\(9,1fr\);/, 'a track per numbered step');
+  assert.match(HUB, /if \(step === 11\) renderLook\(\);\r?\n\s*if \(step === 12\) renderReview\(\);/);
+  assert.match(fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8'), /#view-new \.steps\{display:grid;grid-template-columns:repeat\(10,1fr\);/, 'a track per numbered step');
 });
 
 test('every kit walk past the App step passes the Look step, and the kit has a state on it', () => {

package/tests/projects_hub_module_picker.mjs

@@ -41,7 +41,7 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
 
 const START = '/* ── the module picker (task 1002339, BV1.R20) ──';
-const END = "$('skipModules').addEventListener('click', function () { show(7, true); });";
+const END = "$('skipModules').addEventListener('click', function () { show(8, true); });";
 const from = HUB.indexOf(START);
 const to = HUB.indexOf(END);
 assert.ok(from > -1, 'the picker block opens with its sentinel comment');
@@ -160,7 +160,7 @@ function boot({ state: seed = {}, fetchOk = true, payload = PAYLOAD } = {}) {
   const els = new Map();
   const $ = (id) => { if (!els.has(id)) els.set(id, makeEl(id)); return els.get(id); };
   const form = makeEl('panel-modules-form');
-  const state = { step: 6, projType: null, teamShape: null, modules: null, ...seed };
+  const state = { step: 7, projType: null, teamShape: null, modules: null, ...seed };
   const shown = [];
   let saves = 0;
   let fetches = 0;
@@ -312,7 +312,7 @@ test('Skip walks past WITHOUT answering, so the server applies the bundle the pa
 
   // Assert — skipping is the one path that must leave nothing said, because the
   // preselect and the server's fallback are the same declaration (ADR 0237)
-  assert.deepEqual(h.shown, [7], 'it advances to the Home step (7 since task 1004417)');
+  assert.deepEqual(h.shown, [8], 'it advances to the Home step (8 since task 1004418, 7 since 1004417)');
   assert.equal(h.state.modules, null, 'and answers nothing');
   assert.equal(h.forCreate(), undefined);
   assert.deepEqual(h.picked(), ['npm-release', 'discord'], 'while the set they were shown is still the set they get');
@@ -377,7 +377,7 @@ test('a catalog that will not load degrades to a clause — it never blocks a pr
   assert.match(h.coreNote(), /couldn’t load/, 'the panel says so in the owner\'s words');
   assert.equal(h.state.modules, null, 'nothing is answered on their behalf');
   h.skip();
-  assert.deepEqual(h.shown, [7], 'and the wizard still walks on — the server applies the bundle');
+  assert.deepEqual(h.shown, [8], 'and the wizard still walks on — the server applies the bundle');
 });
 
 test('every rendered value goes through the page escaper', async () => {
@@ -415,7 +415,7 @@ test('the review names the set even when the picker was never opened (task 10023
   // and the module NAMES are not known. "None — just the core" would be a false
   // promise on the last screen before Create: the server is about to apply the
   // type's bundle. The row says that instead, then repaints when the read lands.
-  const h = boot({ state: { projType: 'game', step: 11 } });   // 11 = the review since task 1004421 (10 since 1004417, 8 since 1004351)
+  const h = boot({ state: { projType: 'game', step: 12 } });   // 12 = the review since task 1004418 (11 since 1004421, 10 since 1004417, 8 since 1004351)
 
   // Arrange + Act — the review asks for the value before the read can answer
   const first = h.extrasRow();
@@ -430,14 +430,14 @@ test('the review names the set even when the picker was never opened (task 10023
 });
 
 test('the review reads an answered picker back, empty included', async () => {
-  const chosen = boot({ state: { projType: 'game', modules: ['agents'], step: 7 } });
+  const chosen = boot({ state: { projType: 'game', modules: ['agents'], step: 8 } });
   // before the catalog lands the row says the true thing without the names —
   // never the raw module keys, which are jargon on an owner-facing screen
   assert.equal(chosen.extrasRow(), 'The extras you picked');
   await chosen.settle();
   assert.equal(chosen.extrasRow(), 'Extra agents', 'and names them once it has');
 
-  const none = boot({ state: { projType: 'game', modules: [], step: 7 } });
+  const none = boot({ state: { projType: 'game', modules: [], step: 8 } });
   none.extrasRow();
   await none.settle();
   assert.equal(none.extrasRow(), 'None — just the core', 'a deliberate "none" is stated as one');
@@ -510,7 +510,7 @@ test('Skip after an answered About step still yields the set the panel showed',
 
   h.skip();
 
-  assert.deepEqual(h.shown, [7]);
+  assert.deepEqual(h.shown, [8]);
   assert.equal(h.state.modules, null, 'skipping answers nothing, tailored or not');
   assert.equal(h.forCreate(), undefined, 'so the create request still carries no modules key');
   assert.deepEqual(h.picked(), ['discord'], 'while the set they were shown is still the set they get');
@@ -821,7 +821,7 @@ test('with nothing switched on the count says only what is shown', async () => {
 });
 
 test('the review names the hidden picks too — a filter never reaches the create request', async () => {
-  const h = boot({ state: { projType: 'game', step: 11 } });   // 11 = the review since task 1004421 (10 since 1004417, 8 since 1004351)
+  const h = boot({ state: { projType: 'game', step: 12 } });   // 12 = the review since task 1004418 (11 since 1004421, 10 since 1004417, 8 since 1004351)
   await h.open();
   h.click('agents');
   assert.deepEqual(h.forCreate(), ['agents', 'npm-release', 'discord']);

package/tests/projects_hub_pre_uat.mjs

@@ -552,7 +552,8 @@ test('the rail at the done panel keeps its marker on Create until the project an
     'the done-panel poll repaints when the status moves');
   // the first NUMBERED beat carries it — since task 1004417 the front door's two screens come
   // before the rail, and the card statically wears wizFront so a no-script visitor sees no rail there
-  assert.match(HUB, new RegExp(`<li class="now" data-step="${STEP['panel-name']}" aria-current="step"><span class="snum">1</span>`), 'the static rail starts with the same marker');
+  // (since task 1004418 that beat is planet physics, the first numbered step)
+  assert.match(HUB, new RegExp(`<li class="now" data-step="${STEP['panel-physics']}" aria-current="step"><span class="snum">1</span>`), 'the static rail starts with the same marker');
   assert.match(HUB, /<section id="view-new" hidden>\s*<div class="wrap viewWrap">\s*<div class="card wizFront">/, 'and steps aside on the static first screen');
 });
 

package/tests/wizard_demo.mjs

@@ -251,7 +251,7 @@ test('Name my demo planet carries the demo into the ordinary wizard: the idea, t
   assert.deepEqual(JSON.parse(JSON.stringify(h.state.demo)), { people: 3, hours_each: 4, idea: 'A shared reading list.', invites: ['avery'] });
   assert.equal(h.state.description, 'A shared reading list.', 'the idea is the description');
   assert.equal(h.state.teamShape, 'small-team');
-  assert.deepEqual(h.shown, [3], 'on to the name step');
+  assert.deepEqual(h.shown, [4], 'on to the name step, past planet physics (task 1004418)');
 });
 
 test('the create sends the demo, the review names it, and the project page asks the question', () => {

package/tests/wizard_draft_resume.mjs

@@ -92,7 +92,7 @@ test('a draft already at step 1 is unchanged, and an out-of-range step is not re
   assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
   // 12 is the done panel (11 before task 1004421's Look step, 9 before task 1004417's front door, 8 before task 1004351), reached by its own branch
   // above this slice; 0 is the gate. Neither is a resumable wizard position, so the placeholder is allowed to stand.
-  for (const bad of [0, 12, 99]) {
+  for (const bad of [0, 13, 99]) {
     assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
   }
 });

package/tests/wizard_front_door.mjs

@@ -42,18 +42,21 @@ test('the front door stands between sign-in and the name step: gate 0, terms 1,
   assert.equal(MAP['panel-gate'], 0, 'sign-in stays where it is today, first');
   assert.equal(MAP['panel-terms'], 1);
   assert.equal(MAP['panel-fork'], 2);
-  assert.equal(MAP['panel-name'], 3, 'and today\'s wizard continues unchanged after it');
+  // task 1004418: planet physics (questions 1 to 4) sits between the fork and the name step
+  assert.equal(MAP['panel-physics'], 3, 'the fork opens planet creation with the physics questions');
+  assert.equal(MAP['panel-name'], 4, 'and today\'s wizard continues unchanged after them');
   assert.ok(HUB.indexOf('id="panel-gate"') < HUB.indexOf('id="panel-terms"')
     && HUB.indexOf('id="panel-terms"') < HUB.indexOf('id="panel-fork"')
-    && HUB.indexOf('id="panel-fork"') < HUB.indexOf('id="panel-name"'), 'the markup reads in the same order');
+    && HUB.indexOf('id="panel-fork"') < HUB.indexOf('id="panel-physics"')
+    && HUB.indexOf('id="panel-physics"') < HUB.indexOf('id="panel-name"'), 'the markup reads in the same order');
   assert.match(TERMS, /<form data-next="2">/, 'the terms go on to the fork');
-  assert.match(FORK, /<form data-next="3">/, 'the fork\'s primary door goes on to the name step');
+  assert.match(FORK, /<form data-next="3">/, 'the fork\'s primary door goes on to planet physics');
   assert.match(FORK, /data-back="1"/, 'and the way back is the terms');
 });
 
 test('the rail is the numbered steps\' — it steps aside on both front-door screens, statically too', () => {
   const beats = [...HUB.matchAll(/<li[^>]*data-step="(\d+)"/g)].map((m) => Number(m[1]));
-  assert.deepEqual(beats, [3, 4, 5, 6, 7, 8, 9, 10, 11], 'the rail numbers name…create, never the front door');
+  assert.deepEqual(beats, [3, 4, 5, 6, 7, 8, 9, 10, 11, 12], 'the rail numbers physics…create, never the front door');
   assert.match(HUB, /<div class="card wizFront">/, 'a no-script visitor on the static first screen sees no rail');
   assert.match(STYLE, /#view-new \.card\.wizFront \.steps\{display:none;\}/);
 });
@@ -215,7 +218,7 @@ function runShow(step) {
     root: { querySelector: (sel) => (sel === '.card' ? { classList: card } : { classList: split }) },
     paintRail() {}, saveDraft() {}, authKnown: false, repoAccess: null,
     renderModules() {}, syncHome() {}, ensureRepoAccess() {}, checkSlugAvailable() {}, renderAddrPanel() {},
-    syncAppStep() {}, syncRenderSetup() {}, renderReview() {},
+    syncAppStep() {}, syncRenderSetup() {}, renderReview() {}, renderLook() {}, paintPhysics() {},
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -225,10 +228,11 @@ function runShow(step) {
 
 test('show() takes the rail away on the two front-door screens only, and gives the fork the whole card', () => {
   assert.ok(showSlice, 'show() was not found in projects.html');
-  const terms = runShow(1), fork = runShow(2), name = runShow(3), done = runShow(MAP['panel-done']);
+  const terms = runShow(1), fork = runShow(2), physics = runShow(3), name = runShow(4), done = runShow(MAP['panel-done']);
   assert.deepEqual(terms.on, ['panel-terms']);
   assert.ok(terms.card.has('wizFront') && !terms.split.has('wizFork'), 'terms: no rail, the bongo pair stays');
   assert.ok(fork.card.has('wizFront') && fork.split.has('wizFork'), 'fork: no rail, and the seed takes the pair\'s place');
+  assert.ok(!physics.card.has('wizFront') && physics.split.has('wizFork'), 'physics (task 1004418): the rail is back, and the forming planet keeps the whole card');
   assert.ok(!name.card.has('wizFront') && !name.split.has('wizFork'), 'the name step has its rail back');
   assert.ok(done.split.has('wizDone') && !done.card.has('wizFront'), 'the done panel is untouched by the front door');
 });
@@ -246,7 +250,7 @@ test('the create carries the tick, and is never filed without it', () => {
 test('the tick is part of the draft and of the reset, and the draft key moved with the renumbering', () => {
   assert.match(SCRIPT, /var state = \{ step: 0,[^}]*termsAck: false \};/, 'the initial state declares it');
   assert.match(SCRIPT, /state = \{ step: 1,[^}]*termsAck: false \};/, 'and "start another project" clears it — each project records its own');
-  assert.match(SCRIPT, /var DRAFT_KEY = 'cb-create-draft-v7';/, 'a draft saved under the old numbering is ignored, not replayed onto the wrong screen');
+  assert.match(SCRIPT, /var DRAFT_KEY = 'cb-create-draft-v8';/, 'a draft saved under the old numbering is ignored, not replayed onto the wrong screen');
 });
 
 // ── the look-before-you-ship kit walks it ─────────────────────────────────────

package/tests/wizard_intent_resume.mjs

@@ -58,8 +58,8 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
   assert.ok(offerSlice, 'paintResumeOffer() was not found in projects.html');
   assert.match(enterSlice, /if \(focus && !resumeIntent\) \{/, 'the intent branch is part of the slice');
   assert.match(enterSlice, /startProgress\(created\.id\);/, 'so is the resume branch it guards');
-  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 11/,
-    'the STORED draft\'s step decides, not state.step — state.step is 12 for the whole life of a finished standup');
+  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 12/,
+    'the STORED draft\'s step decides, not state.step — state.step is 13 for the whole life of a finished standup');
   assert.match(SCRIPT, /if \(created && created\.id\) \{ enterCreated\(created, !!focus\); return; \}/,
     'enter() still hands the created record straight to it');
 });
@@ -73,7 +73,7 @@ function runEnter({ focus, resumeIntent = false, draft = null, record }) {
   const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0 };
   // state.step is the DONE step for the whole life of a finished standup — the value
   // a draft-blind reading would have trusted
-  const state = { step: draft ? draft.step : 12, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
+  const state = { step: draft ? draft.step : 13, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
   const sandbox = {
     record, focus, resumeIntent, state,
     DRAFT_KEY: 'draft',
@@ -99,7 +99,7 @@ const REC = { id: 'inst-1', name: 'Acme', slug: 'acme', domain: 'acme.example',
 
 test('a reload / Back / identity settle (focus false) still resumes the done panel, watch and all', () => {
   const { calls, state } = runEnter({ focus: false, record: REC });
-  assert.deepEqual(calls.show, [[12, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
+  assert.deepEqual(calls.show, [[13, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
   assert.equal(calls.resets, 0, 'nothing is reset — this is the same standup continuing');
   assert.equal(calls.done, 1, 'the checklist is re-rendered');
   assert.deepEqual(calls.progress, ['inst-1'], 'the progress watch is restarted from the record');
@@ -127,7 +127,7 @@ test('…and the standup stays one click away, named, on the resume link', () =>
 
 test('the resume link gets the done panel back — the record was never cleared', () => {
   const { calls, sandbox } = runEnter({ focus: true, resumeIntent: true, record: REC });
-  assert.deepEqual(calls.show, [[12, true]], 'a deliberate resume moves focus to the done panel');
+  assert.deepEqual(calls.show, [[13, true]], 'a deliberate resume moves focus to the done panel');
   assert.deepEqual(calls.progress, ['inst-1'], 'the watch comes back with it');
   assert.equal(sandbox.resumeIntent, false, 'the flag is ONE-SHOT — the next plain nav click must mean "new" again');
   assert.deepEqual(calls.offer, [null], 'and the offer comes down behind it');
@@ -148,7 +148,7 @@ test('the done panel\'s own saved step is NOT a second draft — it must not blo
   // Caught in a render, not in a unit test: show(12) calls saveDraft(), so DRAFT_KEY is
   // non-empty again the moment a create lands. Reading "is there a draft?" left the
   // finished project's name in the fresh form, under a line offering to resume it.
-  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 12, name: 'Mercury' } });
+  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 13, name: 'Mercury' } });
   assert.equal(calls.resets, 1, 'the done step is bookkeeping, not a project being typed');
   assert.deepEqual(calls.show, [[1, false]], 'out-of-range steps land on step 1, the front door');
   assert.equal(state.name, '', 'and the finished project\'s name does not survive into it');
@@ -159,7 +159,7 @@ test('a draft on the app step, the Look step or the review is live too — the l
   // The app step moved the review from 7 to 8, the front door (task 1004417) to 10 and the
   // Look step (task 1004421) to 11. A guard left behind would reset a second project
   // sitting on its review, silently wiping it.
-  for (const step of [9, 10, 11]) {
+  for (const step of [10, 11, 12]) {
     const { calls, state } = runEnter({ focus: true, record: REC, draft: { step } });
     assert.equal(calls.resets, 0, `step ${step} is a live draft`);
     assert.deepEqual(calls.show, [[step, true]]);
@@ -175,8 +175,8 @@ test('a draft on the front door is live too — a founder part-way through it ke
   }
 });
 
-test('a draft whose step is missing or junk resets too — only 1-11 preserves anything', () => {
-  for (const draft of [{ step: 0 }, { step: 12 }, { name: 'half-typed' }]) {
+test('a draft whose step is missing or junk resets too — only 1-12 preserves anything', () => {
+  for (const draft of [{ step: 0 }, { step: 13 }, { name: 'half-typed' }]) {
     const { calls } = runEnter({ focus: true, record: REC, draft });
     assert.equal(calls.resets, 1, `step ${JSON.stringify(draft.step)} is not a wizard step`);
     assert.deepEqual(calls.show, [[1, false]]);

package/tests/wizard_physics.mjs

@@ -0,0 +1,264 @@
+// tests/wizard_physics.mjs — planet physics, questions 1 to 4, in the create wizard
+// (task 1004418 / BV2.PS07, goal 1000121).
+//
+// Done-when: the four questions and their branches work end to end (state incl. the
+// existing-project branch and the stop screen; geography; ages with the guardian
+// tiers; entity, intent when new and legal type when it exists), the planet states
+// match the canvas, answers save through the create's `detail`, and the options the
+// soft-limit table hides or greys show their reason (spec D6).
+//
+// Three layers, all RUN: the server's pre-create check over a mounted router; the
+// page's vocabularies against planet-physics.js (a page cannot require a module, so
+// its copies are held equal here); and the page's own physics controller sliced out
+// of projects.html and driven in a vm under a DOM stub. The kit walk
+// (projects.probes.json) is the rendered half.
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const physics = require('../modules/provisioning/planet-physics.js');
+const { STOP_MESSAGE } = require('../modules/provisioning/screening.js');
+
+// ── the server: POST /provisioning/physics-check ─────────────────────────────
+const api = require('../src/module-api.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+let writes = 0;
+provisioning.createInstance = async () => { writes += 1; return {}; };
+let builderId = 7;
+api.requireBuilder = (req, _res, next) => { req.builder = { id: builderId, github_login: 'owner' }; next(); };
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', require('../modules/provisioning/routes/provisioning.js')());
+const server = app.listen(0);
+after(() => server.close());
+const check = async (body) => {
+  await new Promise((r) => (server.listening ? r() : server.once('listening', r)));
+  const res = await fetch(`http://127.0.0.1:${server.address().port}/api/bongos/provisioning/physics-check`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json() };
+};
+
+test('the check answers the soft-limit table for the answers so far, and creates nothing', async () => {
+  const r = await check({ description: 'A co-op farming game.', detail: { project_state: 'new' } });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.stop, false);
+  assert.equal(r.body.soft_limits.enforced, false, 'advice, and says so');
+  const hidden = r.body.soft_limits.limits.filter((l) => l.effect === 'hide').map((l) => l.option).sort();
+  assert.deepEqual(hidden, ['existing_work', 'main_work'], 'a new planet has nothing built to describe');
+  assert.equal(writes, 0);
+});
+
+test('a description the screen stops answers the stop screen in the create\'s own words', async () => {
+  const r = await check({ description: 'We will build ransomware for sale.', detail: {} });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.stop, true);
+  assert.equal(r.body.message, STOP_MESSAGE);
+  assert.equal(writes, 0, 'nothing exists to undo');
+});
+
+test('an answer off the vocabulary, or a field the check does not read, is refused', async () => {
+  assert.equal((await check({ detail: { project_state: 'ancient' } })).status, 400);
+  assert.equal((await check({ detail: { home_country: 'US', home_region: 'CA-ON' } })).status, 400, 'a region outside its country');
+  assert.equal((await check({ slug: 'sneaky' })).status, 400, 'the body is validated strictly');
+});
+
+test('a builder who loops the check is slowed down, and another builder is not', async () => {
+  builderId = 901;
+  try {
+    for (let i = 0; i < 60; i += 1) assert.equal((await check({ detail: {} })).status, 200, `call ${i + 1} is within the minute`);
+    const over = await check({ detail: {} });
+    assert.equal(over.status, 429);
+    assert.equal(over.body.error, 'rate_limited');
+    builderId = 902;
+    assert.equal((await check({ detail: {} })).status, 200, 'the bucket is per builder');
+  } finally { builderId = 7; }
+});
+
+// ── the page's vocabularies are the server's ─────────────────────────────────
+const SCRIPT = HUB.slice(HUB.indexOf('/* ── planet physics, questions 1 to 4 (task 1004418, BV2.PS07) ──'),
+  HUB.indexOf('    /* per-panel validation on Next */'));
+
+test('the page carries the server\'s countries, regions and entity forms, exactly', () => {
+  assert.ok(SCRIPT.length > 1000, 'the physics controller was found');
+  const box = {};
+  vm.createContext(box);
+  vm.runInContext(SCRIPT.slice(0, SCRIPT.indexOf('    var PHYS_LAST')).replace(/\bvar /g, 'this.'), box);
+  const plain = (v) => JSON.parse(JSON.stringify(v)); // values born in the vm
+  assert.deepEqual(plain(box.PHYS_COUNTRIES), [...physics.COUNTRY_CODES]);
+  assert.deepEqual(Object.keys(box.PHYS_REGIONS).sort(), [...physics.REGION_CODES].sort());
+  assert.deepEqual(plain(box.PHYS_ENTITY_FORMS), [...physics.ENTITY_FORMS]);
+  for (const k of Object.keys(box.PHYS_MATERIAL)) {
+    assert.notEqual(physics.canonicalAnswer(physics.PLANET_PHYSICS_QUESTIONS.entity, k), undefined, `${k} is an entity answer`);
+  }
+});
+
+test('every choice the questions offer is an answer the server accepts', () => {
+  const panel = HUB.slice(HUB.indexOf('id="panel-physics"'), HUB.indexOf('<!-- step 4 · name'));
+  const seen = [...panel.matchAll(/data-phys="([a-z_]+)" data-val="([^"]+)"/g)];
+  assert.ok(seen.length >= 20, 'the four questions\' choices');
+  for (const [, key, raw] of seen) {
+    const value = raw === 'true' ? true : raw === 'false' ? false : raw;
+    assert.notEqual(physics.canonicalAnswer(physics.PLANET_PHYSICS_QUESTIONS[key], value), undefined, `${key}=${raw}`);
+  }
+  for (const [, work] of panel.matchAll(/data-work="([^"]+)"/g)) {
+    assert.ok(physics.PLANET_PHYSICS_QUESTIONS.existing_work, 'existing_work is a question');
+    assert.notEqual(physics.canonicalAnswer(physics.PLANET_PHYSICS_QUESTIONS.existing_work, [work]), undefined, work);
+  }
+});
+
+test('the age tiers are described, never claimed as enforced (spec D6)', () => {
+  const ages = HUB.slice(HUB.indexOf('id="physAges"'), HUB.indexOf('<div class="physQ" data-q="4"'));
+  assert.match(ages, /13 to 15<\/dt><dd>Non-monetary tracks only/);
+  assert.match(ages, /the platform does not check ages for you yet/);
+  assert.doesNotMatch(ages, /apply automatically|enforced/i);
+});
+
+// ── the controller, RUN ──────────────────────────────────────────────────────
+class El {
+  constructor(id) {
+    this.id = id; this.hidden = false; this.disabled = false; this.value = ''; this.textContent = ''; this.className = '';
+    this.attrs = {}; this.listeners = {}; this.options = [{}]; this.children = [];
+    const self = this;
+    this.classList = { toggle(c, on) { self.attrs['class:' + c] = !!on; } };
+  }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  removeAttribute(k) { delete this.attrs[k]; }
+  addEventListener(t, fn) { this.listeners[t] = fn; }
+  appendChild(c) { this.options.push(c); return c; }
+  removeChild() { this.options.pop(); }
+  get lastChild() { return this.options[this.options.length - 1]; }
+  focus() {}
+}
+
+function boot({ checkAnswer = { stop: false, soft_limits: { limits: [] } } } = {}) {
+  const els = {};
+  const $ = (id) => (els[id] = els[id] || new El(id));
+  const shown = [];
+  const fetched = [];
+  const state = { description: '', teamShape: null, physics: null };
+  const sandbox = {
+    $, state, API: '/api/bongos', document: { createElement: () => new El('opt') },
+    root: { querySelectorAll: () => [], querySelector: () => null },
+    saveDraft() {}, show(n) { shown.push(n); }, Intl,
+    fetch: async (url, opts) => { fetched.push({ url, body: opts && opts.body && JSON.parse(opts.body) }); return { ok: true, json: async () => (url.includes('physics-check') ? checkAnswer : []) }; },
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(SCRIPT, sandbox, { filename: 'projects.html#physics' });
+  return { sandbox, state, $, shown, fetched, run: (code) => vm.runInContext(code, sandbox) };
+}
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+test('Continue walks the questions and moves the wizard on only after the last', async () => {
+  const w = boot();
+  const a = () => w.state.physics.answers;
+  assert.equal(w.run('physAdvance()'), false, 'the step never says yes itself');
+  assert.equal(w.state.physics.q, 1, 'from the start screen to question 1');
+  w.run('physAdvance()');
+  assert.equal(w.state.physics.q, 1, 'question 1 unanswered: it stays');
+  assert.match(w.$('h-phys').textContent, /new or existing/);
+  a().project_state = 'existing';
+  w.run('physAdvance()');
+  assert.match(w.$('h-phys').textContent, /what already exists/i, 'an existing planet must say what exists');
+  a().existing_work = ['code', 'digital-files']; a().main_work = 'code';
+  w.state.description = 'A co-op farming game.';
+  w.run('physAdvance()');
+  await tick(); await tick();
+  assert.equal(w.state.physics.q, 2, 'the screen passed it, on to geography');
+  assert.deepEqual(w.fetched.at(-1).body, { description: 'A co-op farming game.', detail: { project_state: 'existing', existing_work: ['code', 'digital-files'], main_work: 'code' } });
+  w.run('physAdvance()');
+  assert.equal(w.state.physics.q, 2, 'no country: it stays');
+  a().home_country = 'US'; a().home_region = 'US-CA'; a().builder_geography = 'us-eu';
+  w.run('physAdvance()');
+  assert.equal(w.state.physics.q, 3);
+  a().minors_on_board = true;
+  w.run('physAdvance()');
+  assert.equal(w.state.physics.q, 4);
+  w.run('physAdvance()');
+  assert.deepEqual(w.shown, [], 'no entity: still here');
+  a().entity = 'for-profit';
+  w.run('physAdvance()');
+  assert.deepEqual(w.shown, [4], 'and only now on to the name step');
+});
+
+test('a stopped description lands on the stop screen with the server\'s words', async () => {
+  const w = boot({ checkAnswer: { stop: true, message: STOP_MESSAGE, soft_limits: { limits: [] } } });
+  w.run('physAdvance()');
+  w.state.physics.answers.project_state = 'new';
+  w.state.description = 'ransomware';
+  w.run('physAdvance()');
+  await tick(); await tick();
+  assert.equal(w.state.physics.q, 'stop');
+  assert.equal(w.$('physStopMsg').textContent, STOP_MESSAGE);
+});
+
+test('the create sends the answers as detail: existing work only for an existing planet, the team shape beside them', () => {
+  const w = boot();
+  w.run('phys()');
+  Object.assign(w.state.physics.answers, { project_state: 'new', existing_work: ['code'], main_work: 'code', home_country: 'NL', builder_geography: 'global', minors_on_board: false, entity: 'intent-solo' });
+  w.state.teamShape = 'solo';
+  assert.deepEqual(JSON.parse(JSON.stringify(w.run('createDetail()'))), {
+    project_state: 'new', home_country: 'NL', builder_geography: 'global', minors_on_board: false, entity: 'intent-solo', team_shape: 'solo',
+  });
+  w.state.physics.answers = {}; w.state.teamShape = null;
+  assert.equal(w.run('createDetail()'), undefined, 'nothing answered: the detail is omitted, as before');
+});
+
+test('the planet forms from the answers: a seed, a formed planet, the protective ring, the core material', () => {
+  const w = boot();
+  w.run('phys()');
+  const src = () => w.$('physPlanet').getAttribute('src');
+  w.state.physics.q = 1; w.state.physics.answers.project_state = 'new';
+  w.run('physPaintStage()');
+  assert.equal(src(), '/assets/world/r2-chrome-blob-one-cut.webp', 'a seed');
+  w.state.physics.answers.project_state = 'existing';
+  w.run('physPaintStage()');
+  assert.equal(src(), '/assets/world/r2-chrome-blobs-set-cut.webp', 'terrain already formed');
+  assert.equal(w.$('physGuard').hidden, true);
+  w.state.physics.q = 3; w.state.physics.answers.minors_on_board = true;
+  w.run('physPaintStage()');
+  assert.equal(w.$('physGuard').hidden, false, 'the protective ring');
+  w.state.physics.q = 4;
+  for (const [entity, plate] of [['intent-solo', 'r3-frost-blob-cut'], ['for-profit', 'r3-gold-blob-cut'], ['nonprofit', 'r3-obsidian-blob-cut']]) {
+    w.state.physics.answers.entity = entity;
+    w.run('physPaintStage()');
+    assert.equal(src(), `/assets/world/${plate}.webp`, entity);
+  }
+  for (const plate of ['r3-frost-blob-cut', 'r3-gold-blob-cut', 'r3-obsidian-blob-cut', 'r2-chrome-blob-one-cut', 'r2-chrome-blobs-set-cut']) {
+    assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', `${plate}.webp`)), `${plate} is a world plate`);
+  }
+});
+
+test('a limit the table puts on an option shows its reason beside it, and a grey one is disabled', () => {
+  const w = boot();
+  const why = new El('why');
+  const btn = new El('btn');
+  w.sandbox.root.querySelector = (sel) => (sel.includes('data-why="existing_work"') ? why : null);
+  w.sandbox.root.querySelectorAll = (sel) => (sel.includes('data-phys="entity"][data-val="intent-solo"') ? [btn] : []);
+  w.run(`physLimits = [
+    { option: 'existing_work', effect: 'hide', reason: 'Your planet is new, so there is nothing built yet to describe.' },
+    { option: 'entity:intent-solo', effect: 'grey', reason: 'Because.' }
+  ]; physApplyLimits();`);
+  assert.equal(why.hidden, false);
+  assert.match(why.textContent, /nothing built yet/);
+  assert.equal(btn.disabled, true);
+  assert.equal(btn.title, 'Because.');
+});