@bongos/core 1.20.82 → 1.21.1

package/tests/founding_birth.mjs

@@ -0,0 +1,200 @@
+// tests/founding_birth.mjs — A NEW PROJECT IS BORN INTO GENESIS, and a demo's genesis is
+// expedited (task 1004506 / BV2.PS18, goal 1000121; spec step 5, D4, D8, D9).
+//
+// Done-when: a new real project and a new demo each open their hall already in genesis;
+// the demo's decide stage needs no choices and its stages fit its time box; a
+// pre-existing hall is unchanged. These tests RUN the instance half
+// (modules/onboarding/founding-birth.js) over an in-memory project_settings store and
+// fake lifecycle port: the birth hook runs once, is idempotent, never runs without the
+// marker, and never after the project came alive. The hub half (the marker on the row
+// and in web.env) is pinned in tests/provisioning_settings_env.mjs and
+// tests/wizard_demo.mjs.
+//
+// Run:  node --test tests/founding_birth.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const birth = require('../modules/onboarding/founding-birth.js');
+const gh = require('../modules/onboarding/genesis-home.js');
+const fm = require('../modules/onboarding/founding-mode.js');
+
+const BORN = { born: true, demo: null };
+const BORN_DEMO = { born: true, demo: { people: 3, hours_each: 4 } };
+
+function world({ marker = BORN, settings = {}, withLifecycle = true } = {}) {
+  const store = new Map(Object.entries(settings));
+  const writes = [];
+  let seeds = 0;
+  const lifecycle = withLifecycle ? {
+    seedGenesis: async () => { seeds += 1; return { seeded: 5 }; },
+    genesisTasks: async () => ({}),
+  } : null;
+  const deps = () => ({
+    marker,
+    getSetting: async (k) => (store.has(k) ? { key: k, value: store.get(k) } : null),
+    setSetting: async (k, v) => { writes.push(k); store.set(k, String(v)); return { key: k, value: String(v) }; },
+    lifecycle, government: null, now: new Date('2026-10-01T09:00:00Z'),
+  });
+  return { store, writes, deps, seeds: () => seeds };
+}
+
+// ── the marker ───────────────────────────────────────────────────────────────
+
+test('the marker: born only with a readable birth stamp; a demo box only inside its limits', () => {
+  assert.deepEqual(birth.birthMarker(undefined), { born: false, demo: null });
+  assert.deepEqual(birth.birthMarker({}), { born: false, demo: null });
+  assert.deepEqual(birth.birthMarker({ birth: 'whenever' }), { born: false, demo: null });
+  assert.deepEqual(birth.birthMarker({ birth: '2026-10-01T00:00:00.000Z' }), { born: true, demo: null });
+  assert.deepEqual(birth.birthMarker({ birth: '2026-10-01T00:00:00.000Z', demoPeople: '3', demoHours: '4' }),
+    { born: true, demo: { people: 3, hours_each: 4 } });
+  assert.deepEqual(birth.birthMarker({ birth: '2026-10-01T00:00:00.000Z', demoPeople: '99', demoHours: '4' }),
+    { born: true, demo: null }, 'a malformed box still founds, with the ordinary plan');
+  assert.deepEqual(birth.birthMarker({ demoPeople: '3', demoHours: '4' }), { born: false, demo: null },
+    'a demo box without a birth is not a birth');
+});
+
+// ── the birth hook ───────────────────────────────────────────────────────────
+
+test('no marker: nothing runs, and the database is never read (a pre-existing hall is unchanged)', async () => {
+  const r = await birth.bornFounding({
+    marker: { born: false, demo: null },
+    getSetting: async () => { throw new Error('read without a marker'); },
+    setSetting: async () => { throw new Error('write without a marker'); },
+  });
+  assert.deepEqual(r, { ran: false, reason: 'no_marker' });
+});
+
+test('a new real project is born deciding: founding on, stage decide, no plan, nothing filed', async () => {
+  const w = world();
+  const r = await birth.bornFounding(w.deps());
+  assert.deepEqual(r, { ran: true, started: true, plan: false, demo: false });
+  const mode = await fm.foundingModeFor({ getSetting: w.deps().getSetting, government: null });
+  assert.equal(mode.active, true);
+  assert.equal(mode.stage, 'decide');
+  assert.equal(w.store.get(gh.PLAN_KEY), undefined, 'a real founder settles their own plan');
+  assert.equal(w.seeds(), 0);
+});
+
+test('idempotent: a second run (a restart, a settings push) changes nothing', async () => {
+  const w = world();
+  await birth.bornFounding(w.deps());
+  const before = new Map(w.store);
+  w.writes.length = 0;
+  assert.deepEqual(await birth.bornFounding(w.deps()), { ran: false, reason: 'already_started' });
+  assert.deepEqual(w.writes, [], 'no write at all');
+  assert.deepEqual([...w.store], [...before]);
+});
+
+test('never after the project came alive: genesis happens once', async () => {
+  const w = world({ settings: {
+    [fm.KEYS.ACTIVE]: 'false', [fm.KEYS.STARTED_AT]: '2026-09-01T00:00:00.000Z', [fm.KEYS.ENDED_AT]: '2026-09-10T00:00:00.000Z',
+  } });
+  assert.deepEqual(await birth.bornFounding(w.deps()), { ran: false, reason: 'already_alive' });
+  assert.deepEqual(w.writes, []);
+  assert.equal(await fm.foundingModeFor({ getSetting: w.deps().getSetting, government: null }), null, 'the hall stays alive');
+});
+
+test('a founding already under way (started by hand, mid-stage) is left exactly where it is', async () => {
+  const w = world({ marker: BORN_DEMO, settings: {
+    [fm.KEYS.ACTIVE]: 'true', [fm.KEYS.STAGE]: 'strategize', [fm.KEYS.STARTED_AT]: '2026-09-28T00:00:00.000Z',
+  } });
+  assert.deepEqual(await birth.bornFounding(w.deps()), { ran: false, reason: 'already_started' });
+  assert.deepEqual(w.writes, []);
+  assert.equal(w.seeds(), 0);
+});
+
+test('a new demo is born past decide: the plan is settled from the demo, and its stages are filed', async () => {
+  const w = world({ marker: BORN_DEMO });
+  const r = await birth.bornFounding(w.deps());
+  assert.deepEqual(r, { ran: true, started: true, plan: true, demo: true });
+  assert.equal(w.seeds(), 1, 'the five stages filed as tasks, once');
+  const plan = JSON.parse(w.store.get(gh.PLAN_KEY));
+  assert.equal(plan.government, 'monarchy', 'Monarchy / BDFL: the founder\'s one yes closes each stage (D4)');
+  assert.equal(plan.passes, 1);
+  assert.equal(plan.advisors, 'none');
+  assert.equal(plan.expected_builders, 3, 'the demo\'s people');
+  assert.deepEqual(plan.demo, { people: 3, hours_each: 4 });
+  const mode = await fm.foundingModeFor({ getSetting: w.deps().getSetting, government: null });
+  assert.equal(mode.stage, 'scope', 'the decide stage needs no choices: it is already behind');
+  // Again: nothing more.
+  w.writes.length = 0;
+  assert.deepEqual(await birth.bornFounding(w.deps()), { ran: false, reason: 'already_started' });
+  assert.deepEqual(w.writes, []);
+  assert.equal(w.seeds(), 1, 'never filed twice');
+});
+
+test('a demo whose plan could not be saved yet (no board) asks for a retry, and the retry settles it', async () => {
+  birth.resetBirthForTests();
+  const store = new Map();
+  let seeds = 0;
+  const base = {
+    marker: BORN_DEMO,
+    getSetting: async (k) => (store.has(k) ? { key: k, value: store.get(k) } : null),
+    setSetting: async (k, v) => { store.set(k, String(v)); },
+    government: null,
+  };
+  const first = await birth.ensureBirth({ ...base, lifecycle: null });
+  assert.equal(first.retry, true);
+  assert.equal(first.reason, 'no_board');
+  assert.equal(store.get(fm.KEYS.STAGE) || 'decide', 'decide');
+  const second = await birth.ensureBirth({ ...base, lifecycle: { seedGenesis: async () => { seeds += 1; return { seeded: 5 }; } } });
+  assert.deepEqual(second, { ran: true, started: false, plan: true, demo: true }, 'the retry saves the plan without restarting founding');
+  assert.equal(seeds, 1);
+  assert.equal(store.get(fm.KEYS.STAGE), 'scope');
+  birth.resetBirthForTests();
+});
+
+test('once per process: concurrent first reads share ONE run', async () => {
+  birth.resetBirthForTests();
+  const w = world({ marker: BORN_DEMO });
+  const results = await Promise.all([birth.ensureBirth(w.deps()), birth.ensureBirth(w.deps()), birth.ensureBirth(w.deps())]);
+  assert.equal(results[0], results[1]);
+  assert.equal(results[1], results[2]);
+  assert.equal(w.seeds(), 1);
+  assert.equal(w.writes.filter((k) => k === fm.KEYS.STARTED_AT).length, 1, 'started once');
+  assert.equal(w.writes.filter((k) => k === gh.PLAN_KEY).length, 1, 'planned once');
+  // A later read reuses the settled run; it does not touch the store again.
+  w.writes.length = 0;
+  await birth.ensureBirth(w.deps());
+  assert.deepEqual(w.writes, []);
+  birth.resetBirthForTests();
+});
+
+test('a run that throws is forgotten, so a later read tries again; the read itself never fails', async () => {
+  birth.resetBirthForTests();
+  let fail = true;
+  const store = new Map();
+  const deps = {
+    marker: BORN,
+    getSetting: async (k) => { if (fail) throw new Error('db down'); return store.has(k) ? { value: store.get(k) } : null; },
+    setSetting: async (k, v) => { store.set(k, String(v)); },
+  };
+  assert.deepEqual(await birth.ensureBirth(deps), { ran: false, reason: 'error' });
+  fail = false;
+  assert.equal((await birth.ensureBirth(deps)).ran, true);
+  assert.equal(store.get(fm.KEYS.ACTIVE), 'true');
+  birth.resetBirthForTests();
+});
+
+// ── the wiring ───────────────────────────────────────────────────────────────
+
+test('the /me read (the port, no arguments) runs the birth first; a caller with its own deps does not', async () => {
+  const port = require('../modules/onboarding/port.js');
+  const orig = { ensure: birth.ensureBirth, read: fm.foundingModeFor };
+  const calls = [];
+  birth.ensureBirth = async () => { calls.push('birth'); };
+  fm.foundingModeFor = async (d) => { calls.push(d ? 'read:deps' : 'read'); return null; };
+  try {
+    await port.foundingModeFor();
+    assert.deepEqual(calls, ['birth', 'read'], 'the birth lands before the read, so the first hall paint is already founding');
+    calls.length = 0;
+    await port.foundingModeFor({ getSetting: async () => null });
+    assert.deepEqual(calls, ['read:deps']);
+  } finally {
+    birth.ensureBirth = orig.ensure;
+    fm.foundingModeFor = orig.read;
+  }
+});

package/tests/founding_mode.mjs

@@ -278,7 +278,9 @@ test('/me carries founding_mode from the onboarding port, fail-open to null', ()
   assert.match(ME, /onboarding\.foundingModeFor\(\)/);
   const at = ME.indexOf('onboarding.foundingModeFor()');
   assert.match(ME.slice(at, at + 200), /catch \(_\) \{ return null; \}/);
-  assert.match(PORT, /foundingModeFor: \(\.\.\.a\) => foundingMode\.foundingModeFor\(\.\.\.a\)/);
+  // The port delegates at call time; a no-argument read (me.js) first runs the guarded
+  // birth (task 1004506, tests/founding_birth.mjs).
+  assert.match(PORT, /foundingModeFor: async \(\.\.\.a\) => \{\s*if \(!a\.length\) await foundingBirth\.ensureBirth\(\);\s*return foundingMode\.foundingModeFor\(\.\.\.a\);/);
 });
 
 test('BOTH applyAccess callers pass it, or the index would never show the band', () => {

package/tests/genesis_home.mjs

@@ -91,6 +91,58 @@ test('a plan out of range is refused with the reason', () => {
   assert.equal(gh.parsePlan({ expected_builders: 0 }).reason, 'bad_expected_builders');
 });
 
+// ── the demo's expedited plan (task 1004506) ────────────────────────────────
+
+test('a demo\'s stages are minutes, fitted to a fifth of its time box (10 min to 2 h)', () => {
+  const sum = (m) => Object.values(m).reduce((a, b) => a + b, 0);
+  assert.deepEqual(gh.demoMinutes(4), { scope: 14, strategize: 10, charter: 10, legalize: 5, legislation: 10 },
+    '3 people × 4 hours: about 48 minutes of genesis, then building');
+  assert.deepEqual(Object.keys(gh.demoMinutes(1)), STAGES5);
+  for (const h of [1, 2, 4, 8, 20, 40]) {
+    const total = sum(gh.demoMinutes(h));
+    assert.ok(total <= h * 60 * 0.25, `${h}h: genesis (${total} min) leaves most of the time box for building`);
+    assert.ok(total >= 8 && total <= 125, `${h}h: ${total} min is inside the bounds`);
+    assert.ok(Object.values(gh.demoMinutes(h)).every((m) => Number.isInteger(m) && m >= 1));
+  }
+});
+
+test('the demo plan is the settled one: Monarchy / BDFL, one pass, no advisors, the demo\'s people', () => {
+  const r = gh.parsePlan(gh.demoPlan({ people: 3, hours_each: 4 }));
+  assert.equal(r.ok, true, JSON.stringify(r));
+  assert.equal(r.plan.government, 'monarchy');
+  assert.equal(r.plan.passes, 1);
+  assert.equal(r.plan.advisors, 'none');
+  assert.equal(r.plan.expected_builders, 3);
+  assert.equal(r.plan.existing, false);
+  assert.deepEqual(r.plan.demo, { people: 3, hours_each: 4 });
+  assert.deepEqual(r.plan.minutes, gh.demoMinutes(4));
+  assert.equal(gh.parsePlan({ demo: { people: 0, hours_each: 4 } }).reason, 'bad_demo');
+  assert.equal(gh.parsePlan({ minutes: { scope: 5 } }).reason, 'bad_minutes', 'every stage needs its minutes');
+  assert.equal(gh.parsePlan({}).plan.minutes, undefined, 'a real project\'s plan stays in days');
+});
+
+test('the plan route does not name the demo fields, so only the birth can write a demo plan', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'onboarding', 'routes', 'onboarding.js'), 'utf8');
+  const schema = src.slice(src.indexOf("router.post('/founding/plan'"), src.indexOf("router.post('/founding/stages"));
+  assert.ok(schema.includes('validateOrRespond'));
+  assert.doesNotMatch(schema, /\bdemo\b|\bminutes\b/);
+});
+
+test('a demo genesis reads in minutes: each stage due minutes after it began', () => {
+  const plan = gh.parsePlan(gh.demoPlan({ people: 2, hours_each: 4 })).plan;
+  const g = gh.shapeGenesis({
+    mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 },
+    plan, stageAt: { scope: '2026-10-01T09:00:00.000Z' },
+  });
+  assert.deepEqual(g.demo, { people: 2, hours_each: 4 });
+  assert.equal(g.stages[0].minutes, 14);
+  assert.equal(g.stages[0].due, '2026-10-01T09:14:00.000Z');
+  const real = gh.shapeGenesis({ mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 }, plan: gh.parsePlan({}).plan, stageAt: { scope: '2026-10-01T09:00:00.000Z' } });
+  assert.equal(real.demo, null);
+  assert.equal(real.stages[0].minutes, null);
+  assert.equal(real.stages[0].due, '2026-10-08T09:00:00.000Z', 'a real project is unchanged: days');
+});
+
 // ── the flow, end to end over fakes ──────────────────────────────────────────
 
 function world({ withGovernment = true } = {}) {
@@ -232,7 +284,7 @@ test('every genesis write is the project owner\'s; the read is any signed-in bui
 
 const CARD = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'genesis-home.js'), 'utf8');
 
-function bootCard({ founding }) {
+function bootCard({ founding, data = { genesis: null } }) {
   const calls = [];
   let widget = null;
   let observer = null;
@@ -240,7 +292,7 @@ function bootCard({ founding }) {
   const sandbox = {
     window: {
       OTB: { escapeHtml: (s) => String(s), contributeHallWidget: (w) => { widget = w; } },
-      BongosClient: { createClient: () => ({ request: async (m, p) => { calls.push(`${m} ${p}`); return { ok: true, status: 200, data: { genesis: null } }; } }) },
+      BongosClient: { createClient: () => ({ request: async (m, p) => { calls.push(`${m} ${p}`); return { ok: true, status: 200, data }; } }) },
     },
     document: { documentElement: { getAttribute: (k) => attrs[k] || null } },
     MutationObserver: class { constructor(fn) { observer = fn; } observe() {} disconnect() {} },
@@ -277,6 +329,23 @@ test('founding mode stamped after mount still starts the card, once', async () =
   assert.deepEqual(b.calls, ['GET /api/bongos/founding/genesis']);
 });
 
+test('a demo\'s genesis card: no decide form, the settled plan in one line, each stage in minutes (task 1004506)', async () => {
+  const genesis = gh.shapeGenesis({
+    mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 },
+    plan: gh.parsePlan(gh.demoPlan({ people: 3, hours_each: 4 })).plan,
+    stageAt: { scope: '2026-10-01T09:00:00.000Z' },
+  });
+  const { host } = bootCard({ founding: true, data: { genesis, viewer_id: '1' } });
+  await new Promise((r) => setImmediate(r));
+  await new Promise((r) => setImmediate(r));
+  assert.equal(host.hidden, false);
+  assert.match(host.innerHTML, /Monarchy \/ BDFL, 3 people, 4 hours each/);
+  assert.match(host.innerHTML, /about 49 minutes/);
+  assert.match(host.innerHTML, /14 min, due /, 'the stage in progress is due at a time, not a date');
+  assert.match(host.innerHTML, /Stage 1 of 5 · scope · demo/);
+  assert.doesNotMatch(host.innerHTML, /data-genesis-plan/, 'a demo never shows the decide form');
+});
+
 test('the hall carries the five life plates byte-identical to the world\'s', () => {
   const world = path.join(ROOT, 'modules', 'public-landing', 'public', 'assets', 'world');
   const hall = path.join(ROOT, 'modules', 'hall-ui', 'public', 'genesis');

package/tests/goal_closure_invariants.mjs

@@ -95,6 +95,14 @@ function makeExec(w) {
         return { rows: closed.map((c) => ({ ...c, satisfied_by_task_id: scoped })) };
       }
 
+      // (1b) task 1004513: the shipping task's OWN goal, asked only when the ship
+      // flipped no criterion — the case where every criterion was already
+      // satisfied and the goal has nothing left but this task.
+      if (/SELECT goal_id FROM tasks WHERE id = \$1/.test(s)) {
+        const t = taskById(Number(params[0]));
+        return { rows: t && t.goal_id != null ? [{ goal_id: t.goal_id }] : [] };
+      }
+
       // (2) the cascade. NOT hand-coded: the model reads the statement it was
       // actually handed and honours only the clauses PRESENT in it — including
       // the terminal set, parsed out of the SQL rather than imported. That is
@@ -265,6 +273,66 @@ test('every statement goes through the caller exec — none reaches the module p
   assert.match(exec.calls[3].sql, /UPDATE versions v/);
 });
 
+// ---------------------------------------------------------------------------
+// 2b. The ship that flips NO criterion still finishes its goal (task 1004513)
+//
+// The hole this pins: satisfy every criterion of a goal while one of its tasks is
+// still open. The manual door (achieveGoalIfComplete, off POST /done-when/:id/
+// satisfy) runs then and correctly declines — a task is unfinished. When that
+// task later ships, the cascade flips no criterion (they are already satisfied),
+// and before this fix the no-criteria early return meant the goal was never
+// re-asked: it sat `open` with everything done. Live on goal 1000119, 2026-10-01.
+// ---------------------------------------------------------------------------
+
+test('a goal whose criteria were ALL satisfied before its last task shipped still closes', async () => {
+  const w = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] });
+  const exec = makeExec(w);
+  const out = await autoSatisfyShippedCriteria(exec, { taskId: 200 });
+  assert.deepEqual(out.criteria, [], 'the ship flips no criterion — they were satisfied already');
+  assert.equal(out.goals.length, 1, 'and the goal still reaches achieved');
+  assert.equal(w.goals[0].status, 'achieved');
+  // The wiring, not just the verdict: it asks for the shipping task's own goal
+  // and then runs the SAME cascade statement, on the same exec.
+  assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
+  assert.match(exec.calls[1].sql, /SELECT goal_id FROM tasks WHERE id = \$1/);
+  assert.match(exec.calls[2].sql, /UPDATE goals g/);
+  assert.deepEqual(exec.calls[2].params, [[77]], 'scoped to the shipping task\'s goal, nothing wider');
+  assert.match(exec.calls[3].sql, /UPDATE goal_membership_requests/, 'an achieved goal closes its pending asks on this path too (task 1003660)');
+  assert.match(exec.calls[4].sql, /UPDATE versions v/, 'and the version close still rides along');
+});
+
+for (const status of HOLDS_OPEN) {
+  test(`the no-criterion re-check honours the same rule: a '${status}' sibling still holds the goal open`, async () => {
+    const w = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const out = await autoSatisfyShippedCriteria(makeExec(w), { taskId: 200 });
+    assert.deepEqual(out.goals, [], 'the re-check is the rule, not a bypass of it');
+    assert.equal(w.goals[0].status, 'open');
+  });
+}
+
+test('the no-criterion re-check reads through the exec it was handed', async () => {
+  // Same instant, two views. Inside the ship transaction task 200 is already
+  // `shipped`; on the module pool it is still `confirmed` — non-terminal — and
+  // the goal must not close. The pair is what proves the read goes through exec.
+  const inTxn = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] });
+  const outsideTxn = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [{ status: 'confirmed' }] });
+  assert.equal((await autoSatisfyShippedCriteria(makeExec(inTxn), { taskId: 200 })).goals.length, 1);
+  assert.deepEqual((await autoSatisfyShippedCriteria(makeExec(outsideTxn), { taskId: 200 })).goals, []);
+  assert.equal(outsideTxn.goals[0].status, 'open');
+});
+
+test('a goal-less task closes nothing, and the UNSCOPED sweep keeps its cheap early return', async () => {
+  const orphan = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED({ goal_id: null })] });
+  const orphanExec = makeExec(orphan);
+  assert.deepEqual((await autoSatisfyShippedCriteria(orphanExec, { taskId: 200 })).goals, []);
+  assert.equal(orphanExec.calls.length, 2, 'it asks for the goal, finds none, and stops');
+
+  const sweep = makeExec(world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] }));
+  const out = await autoSatisfyShippedCriteria(sweep, {});
+  assert.deepEqual(out, { criteria: [], goals: [] }, 'the sweep holds no task, so it has no goal to name');
+  assert.equal(sweep.calls.length, 1, 'and issues no second statement');
+});
+
 // ---------------------------------------------------------------------------
 // 3. A ship still LANDS while its goal is held open
 // ---------------------------------------------------------------------------

package/tests/hub_map_orb_states.mjs

@@ -66,6 +66,10 @@ const PA_START = SCRIPT.indexOf('function planetAttrs(');
 const PA_END = SCRIPT.indexOf('var PLANET_SHAPE_WORDS');
 assert.ok(PA_START > 0 && PA_END > PA_START, 'planetAttrs must still be sliceable');
 const PLANET_ATTRS = SCRIPT.slice(PA_START, PA_END);
+// The row's site door (task 1004505) and the rule it asks, sliced the same way.
+const ADDRESS_READY = (SCRIPT.match(/function addressReady\(inst\) \{[^\n]*\}/) || [''])[0];
+const SITE_HREF = (SCRIPT.match(/function siteHref\(p\) \{[^\n]*\}/) || [''])[0];
+assert.ok(ADDRESS_READY && SITE_HREF, 'addressReady and siteHref must still be sliceable');
 
 // ── the DOM stub ─────────────────────────────────────────────────────────────
 // Narrow on purpose: it supports exactly what the region touches, so it stays
@@ -111,7 +115,7 @@ function boot() {
     listedDate: (iso) => String(iso),
   };
   vm.createContext(sandbox);
-  vm.runInContext(PLANET_ATTRS + '\n' + REGION, sandbox);
+  vm.runInContext(PLANET_ATTRS + '\n' + ADDRESS_READY + '\n' + SITE_HREF + '\n' + REGION, sandbox);
   return {
     sandbox,
     sky,

package/tests/npm_release_release.mjs

@@ -99,6 +99,41 @@ test('an unreadable registry and a missing dispatcher both release nothing, and
   assert.equal((await requestRelease({ version: '1.20.73', registry: REG, dispatch: null })).body.error.code, 'dispatch_unavailable');
 });
 
+// ── the refusal names the credential the server actually uses (task 1004518) ─────────
+
+test('a server on the access token is told to edit the ACCESS TOKEN', async () => {
+  const saved = process.env.GITHUB_PUSH_TOKEN;
+  process.env.GITHUB_PUSH_TOKEN = 'PAT';
+  try {
+    const d = await gp.dispatchWorkflow({ workflow: 'publish.yml' }, { appToken: async () => null, repoInfo: REPO, fetchImpl: async () => ({ ok: false, status: 403 }) });
+    assert.equal(d.credential, 'token');
+    const r = await requestRelease({ version: '1.20.73', registry: REG, dispatch: async () => d });
+    assert.match(r.body.error.message, /access token \(GITHUB_PUSH_TOKEN/);
+    assert.doesNotMatch(r.body.error.message, /GitHub App/);
+  } finally {
+    if (saved === undefined) delete process.env.GITHUB_PUSH_TOKEN; else process.env.GITHUB_PUSH_TOKEN = saved;
+  }
+});
+
+test('a server on a GitHub App is told to edit the APP — the App wins over a token, as resolveToken orders them', async () => {
+  const saved = process.env.GITHUB_PUSH_TOKEN;
+  process.env.GITHUB_PUSH_TOKEN = 'PAT';
+  try {
+    let auth = null;
+    const d = await gp.dispatchWorkflow({ workflow: 'publish.yml' }, {
+      appToken: async () => 'APPTOK', repoInfo: REPO,
+      fetchImpl: async (_u, opts) => { auth = opts.headers.Authorization || opts.headers.authorization; return { ok: false, status: 403 }; },
+    });
+    assert.equal(d.credential, 'app');
+    assert.match(String(auth), /APPTOK/, 'the App token is the one sent');
+    const r = await requestRelease({ version: '1.20.73', registry: REG, dispatch: async () => d });
+    assert.match(r.body.error.message, /the server's GitHub App needs/);
+    assert.doesNotMatch(r.body.error.message, /access token/);
+  } finally {
+    if (saved === undefined) delete process.env.GITHUB_PUSH_TOKEN; else process.env.GITHUB_PUSH_TOKEN = saved;
+  }
+});
+
 test('GitHub refusing for want of Actions: write is named as exactly that', async () => {
   const r = await requestRelease({ version: '1.20.73', registry: REG, dispatch: async () => ({ ok: false, code: 'REFUSED', status: 403 }) });
   assert.equal(r.status, 502);
@@ -113,7 +148,7 @@ test('dispatchWorkflow POSTs ref + inputs to the workflow\'s dispatches endpoint
   let captured = null;
   const fetchImpl = async (url, opts) => { captured = { url, opts, body: JSON.parse(opts.body) }; return { ok: false, status: 204 }; };
   const r = await gp.dispatchWorkflow({ workflow: 'publish.yml', ref: 'main', inputs: { release_version: '1.20.73' } }, { token: 'T', repoInfo: REPO, fetchImpl });
-  assert.deepEqual(r, { ok: true });
+  assert.deepEqual(r, { ok: true, credential: 'token' });
   assert.equal(captured.url, 'https://api.github.com/repos/someowner/somerepo/actions/workflows/publish.yml/dispatches');
   assert.equal(captured.opts.method, 'POST');
   assert.deepEqual(captured.body, { ref: 'main', inputs: { release_version: '1.20.73' } });
@@ -135,7 +170,7 @@ test('dispatchWorkflow: no credential is UNCONFIGURED; a 403 is REFUSED with its
   } finally {
     if (saved !== undefined) process.env.GITHUB_PUSH_TOKEN = saved;
   }
-  assert.deepEqual(await gp.dispatchWorkflow({ workflow: 'publish.yml' }, { token: 'T', repoInfo: REPO, fetchImpl: async () => ({ ok: false, status: 403 }) }), { ok: false, code: 'REFUSED', status: 403 });
+  assert.deepEqual(await gp.dispatchWorkflow({ workflow: 'publish.yml' }, { token: 'T', repoInfo: REPO, fetchImpl: async () => ({ ok: false, status: 403 }) }), { ok: false, code: 'REFUSED', status: 403, credential: 'token' });
   assert.equal((await gp.dispatchWorkflow({ workflow: 'publish.yml' }, { token: 'T', repoInfo: REPO, fetchImpl: async () => { throw new Error('down'); } })).code, 'UNREACHABLE');
 });
 

package/tests/projects_hub.mjs

@@ -765,7 +765,9 @@ test('the table is in the world: a masthead, then ledger rows — no panel, no s
   assert.match(COSMOS, /\.tbl \.tblRow:hover\{border-top-color:var\(--ink-faint\);\}/, 'hover is the hairline taking ink, not an accent tint');
   assert.match(COSMOS, /\.rowGo\{[^}]*border:1px solid var\(--rule\);border-radius:var\(--radius-pill\);/, 'the row\'s door is the mine row\'s hairline pill');
   assert.match(HUB, /<a class="rowGo" href="\/">view<\/a>/, 'the self row\'s door');
-  assert.match(SCRIPT, /'<a class="rowGo" href="' \+ esc\(safeHttpUrl\(p\.origin\)\)/, 'the generated rows\' door');
+  assert.match(SCRIPT, /'<a class="rowGo" href="' \+ esc\(siteHref\(p\)\)/, 'the generated rows\' door');
+  assert.match(SCRIPT, /function siteHref\(p\) \{ return p\._inst && !addressReady\(p\._inst\) \? '' : safeHttpUrl\(p\.origin\); \}/,
+    'scheme-checked, and none for your own project until its address answers (task 1004505)');
   assert.match(COSMOS, /\.mastObj\{display:block;--dia:clamp\(96px,10vw,132px\);[^}]*background-image:var\(--plate-set-cut\);/, 'the object is the set\'s small bead by token, in both modes');
   assert.doesNotMatch(COSMOS, /mix-blend-mode:var\(--mast/, 'the cutout needs no blend — the view wrap is a stacking context');
 });
@@ -1426,7 +1428,7 @@ test('the save sends the choice and shows the platform’s receipt verbatim —
 test('what the project RUNS comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadVisRuns');
   const manifest = fnHub('ensureManifest');
-  assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
+  assert.match(runs, /inst\.status !== 'active' \|\| !addressReady\(inst\)/, 'only a live project whose address answers can be asked (task 1004505)');
   assert.match(manifest, /'https:\/\/' \+ domain \+ '\/api\/bongos\/instance'/,
     'the same public GET /instance the platform’s runner reads after a restart');
   assert.doesNotMatch(runs, /fetch\(/, 'the card fires no GET of its own — one manifest read serves the pair (task 1003554)');
@@ -1631,7 +1633,7 @@ test('the joinability save sends the one key and shows the platform’s receipt
 
 test('what the project RUNS for joinability comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadJoinRuns');
-  assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
+  assert.match(runs, /inst\.status !== 'active' \|\| !addressReady\(inst\)/, 'only a live project whose address answers can be asked (task 1004505)');
   assert.match(runs, /ensureManifest\(inst\.domain\)/, 'the same public GET /instance the runner reads, through the shared reader');
   assert.doesNotMatch(runs, /fetch\(/, 'the second card of the pair adds no round trip of its own (task 1003554)');
   assert.match(runs, /p && p\.joinability/, 'the manifest key is brand.project.joinability');