@bongos/core 1.21.4 → 1.21.6

package/tests/settings_main_role.mjs

@@ -0,0 +1,190 @@
+// tests/settings_main_role.mjs — the Settings main-role picker (task 1004541 /
+// WA6.RP12, goal 1000095, criterion wa6-roles-read-true-in-public).
+//
+// The owner's rule (2026-09-30): the builder CHOOSES their main role. The server
+// side existed (builders.main_discipline, PATCH /me/disciplines main_discipline,
+// task 1004433) with nothing in the hall to make the choice. This EXECUTES the
+// real modules/hall-ui/public/settings.js in a minimal DOM stub against a canned
+// /me and a recording PATCH, and pins the control's contract:
+//
+//   - it seeds from GET /me's main_discipline (and /me now carries it:
+//     db-kernel getBuilderById selects the column);
+//   - the options are "Let my work decide" plus exactly the roles ticked above,
+//     and ticking/unticking a role adds/removes its option;
+//   - unticking the main role hands the choice back to "Let my work decide";
+//   - Save sends main_discipline in the same PATCH — the pick, or null to clear —
+//     and re-seeds from the server's echo.
+//
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
+const HTML = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+const KERNEL = fs.readFileSync(path.join(ROOT, 'src/bongos/db-kernel.js'), 'utf8');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+const DISCIPLINES = ['engineer', 'artist', 'ideator', 'ui'];
+
+// A permissive element: everything settings.js touches at boot, with listeners
+// recorded so a test can fire them.
+function makeEl() {
+  const listeners = {};
+  return {
+    hidden: false, textContent: '', value: '', disabled: false, href: '', className: '',
+    dataset: {}, style: {}, children: [], _html: '',
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+    addEventListener(type, fn) { (listeners[type] || (listeners[type] = [])).push(fn); },
+    fire(type, ev) { for (const fn of listeners[type] || []) fn(ev); },
+    appendChild(c) { this.children.push(c); return c; },
+    append() {}, prepend() {}, remove() {}, setAttribute() {}, removeAttribute() {}, getAttribute() { return null; },
+    querySelector() { return null; }, querySelectorAll() { return []; }, closest() { return null; },
+    classList: { add() {}, remove() {}, toggle() {}, contains() { return false; } },
+    focus() {},
+  };
+}
+
+async function boot({ builder }) {
+  const els = new Map();
+  const $ = (sel) => { if (!els.has(sel)) els.set(sel, makeEl()); return els.get(sel); };
+  const patches = [];
+  const api = {
+    async request(method, url, opts = {}) {
+      if (method === 'GET' && url === '/api/bongos/me') return { status: 200, ok: true, data: { builder } };
+      if (method === 'PATCH' && url === '/api/bongos/me/disciplines') {
+        const body = opts.body;
+        patches.push(body);
+        const prefs = DISCIPLINES.filter((d) => body.preferred_disciplines.includes(d));
+        const main = body.main_discipline === undefined ? builder.main_discipline : body.main_discipline;
+        return { status: 200, ok: true, data: { builder: { ...builder, preferred_disciplines: prefs, main_discipline: main } } };
+      }
+      return { status: 404, ok: false, data: null };
+    },
+  };
+  const escapeHtml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const document = {
+    getElementById: (id) => $(`#${id}`),
+    createElement: () => makeEl(),
+    dispatchEvent() {}, addEventListener() {},
+    querySelector: () => null, querySelectorAll: () => [],
+  };
+  const window = {
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => api },
+    OTB: {
+      $, escapeHtml, toast() {},
+      disciplines: () => DISCIPLINES,
+      roleLabel: (d) => (d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      hubOrigin: () => null,
+      settingsPanels: () => [],
+    },
+    OTBKit: { emptyStateHtml: (m) => m, makeSectionRail: () => ({ refresh() {}, activate() {} }) },
+    location: { hash: '', pathname: '/settings', search: '', assign() {} },
+    scrollTo() {}, confirm: () => false, addEventListener() {},
+  };
+  const sandbox = {
+    window, document, console: { log() {}, warn() {}, error() {}, info() {} },
+    history: { replaceState() {} }, URLSearchParams, setTimeout, clearTimeout,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'settings.js' });
+  for (let i = 0; i < 12; i++) await new Promise((r) => setImmediate(r));
+
+  // The control as a test sees it.
+  const options = () => [...$('#craft-main-opts').innerHTML.matchAll(/value="([^"]*)"(\s*checked)?>([^<]*)<\/label>/g)]
+    .map((m) => ({ value: m[1], checked: !!m[2], label: m[3] }));
+  const checked = () => (options().find((o) => o.checked) || {}).value;
+  const toggleRole = (d, on) => {
+    const chip = { dataset: {} };
+    const box = { value: d, checked: on, closest: (sel) => (sel === '.craft-pref' ? box : sel === '.craft-chip' ? chip : null) };
+    $('#craft-chips').fire('change', { target: box });
+  };
+  const pickMain = (v) => {
+    const pick = { value: v, closest: (sel) => (sel === '.craft-main-pick' ? pick : null) };
+    $('#craft-main-opts').fire('change', { target: pick });
+  };
+  const save = async () => {
+    $('#craft-save').fire('click', {});
+    for (let i = 0; i < 6; i++) await new Promise((r) => setImmediate(r));
+  };
+  return { $, options, checked, toggleRole, pickMain, save, patches };
+}
+
+const B = (over = {}) => ({ id: 4, github_login: 'b4', display_name: 'Builder 4', preferred_disciplines: ['engineer', 'ideator'], main_discipline: null, ...over });
+
+console.log('\nthe main-role picker:');
+
+await t('the markup carries the Main role group inside Preferred roles', () => {
+  const craft = HTML.slice(HTML.indexOf('id="craft-scroll"'), HTML.indexOf('id="craft-save"'));
+  assert.match(craft, /<fieldset class="craft-main" id="craft-main">/);
+  assert.match(craft, /<legend class="craft-main__h">Main role<\/legend>/);
+  assert.match(craft, /id="craft-main-opts"/);
+  assert.match(craft, /leads your profile and your leaderboard entry/, 'it says what a main role does');
+});
+
+await t('GET /me carries the saved main role (getBuilderById selects the column)', () => {
+  const sel = KERNEL.slice(KERNEL.indexOf('async function getBuilderById'), KERNEL.indexOf('FROM builders WHERE id = $1'));
+  assert.match(sel, /\bmain_discipline\b/);
+});
+
+await t('options are "Let my work decide" plus exactly the ticked roles; nothing saved → by work', async () => {
+  const p = await boot({ builder: B() });
+  assert.deepEqual(p.options().map((o) => o.value), ['', 'engineer', 'ideator']);
+  assert.equal(p.options()[0].label, 'Let my work decide');
+  assert.deepEqual(p.options().map((o) => o.label).slice(1), ['Engineer', 'Ideator']);
+  assert.equal(p.checked(), '', 'no saved main role → "Let my work decide" is chosen');
+});
+
+await t('a saved main role is the one chosen on load', async () => {
+  const p = await boot({ builder: B({ main_discipline: 'ideator' }) });
+  assert.equal(p.checked(), 'ideator');
+});
+
+await t('ticking a role adds its option; unticking the MAIN role hands the choice back to your work', async () => {
+  const p = await boot({ builder: B({ main_discipline: 'ideator' }) });
+  p.toggleRole('artist', true);
+  assert.deepEqual(p.options().map((o) => o.value), ['', 'engineer', 'artist', 'ideator'], 'in the instance\'s role order');
+  assert.equal(p.checked(), 'ideator', 'adding a role keeps the pick');
+  p.toggleRole('ideator', false);
+  assert.deepEqual(p.options().map((o) => o.value), ['', 'engineer', 'artist']);
+  assert.equal(p.checked(), '', 'a role you no longer have cannot lead');
+});
+
+await t('Save sends the pick in the same PATCH, and the echo re-seeds it', async () => {
+  const p = await boot({ builder: B() });
+  p.pickMain('ideator');
+  await p.save();
+  assert.equal(p.patches.length, 1);
+  assert.deepEqual(JSON.parse(JSON.stringify(p.patches[0])), { preferred_disciplines: ['engineer', 'ideator'], main_discipline: 'ideator' });
+  assert.equal(p.checked(), 'ideator', 'the server\'s echo is what the control shows after saving');
+  assert.match(p.$('#craft-status').textContent, /Main role: Ideator\./);
+});
+
+await t('"Let my work decide" saves null, which clears a saved main role', async () => {
+  const p = await boot({ builder: B({ main_discipline: 'engineer' }) });
+  p.pickMain('');
+  await p.save();
+  assert.equal(p.patches[0].main_discipline, null);
+  assert.equal(p.checked(), '');
+  assert.doesNotMatch(p.$('#craft-status').textContent, /Main role/);
+});
+
+await t('unticking the main role, then saving, sends null — never a role outside the set', async () => {
+  const p = await boot({ builder: B({ main_discipline: 'ideator' }) });
+  p.toggleRole('ideator', false);
+  await p.save();
+  assert.deepEqual(JSON.parse(JSON.stringify(p.patches[0])), { preferred_disciplines: ['engineer'], main_discipline: null });
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/software_update.mjs

@@ -194,7 +194,7 @@ const STUB_UPDATE = { reading: 'ok', running: '1.19.10', offered: '1.19.13' };
 test('the platform\'s hall: the Update button goes to its own door', async () => {
   const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true, doorInputs: () => ({ provisioning: true, idp: null }) });
   assert.equal(r.status, 200);
-  assert.deepEqual(r.body.update, STUB_UPDATE);
+  assert.deepEqual(r.body.update, { ...STUB_UPDATE, channel_source: 'default' }, 'the reader\'s answer, plus which rule it used');
   assert.deepEqual(r.body.door, { kind: 'local', url: '/deploy' });
   assert.equal(r.body.can_update, true);
 });
@@ -447,3 +447,58 @@ test('the platform, which runs the door, keeps /deploy behind its own page gate'
   assert.equal(r.status, 302, 'a visitor with no session meets the page gate');
   assert.match(String(r.location), /auth|sign/i, 'and is sent to sign in, as before');
 });
+
+// ── the project's OWN update rule reaches the offer (task 1004535) ────────────
+//
+// The live defect, 2026-10-02: cloudbongos's rule on /deploy is `minor` and the sweep
+// follows it, but GET /software-update answered `"channel": "patch"` — the platform
+// default — so a step-up release would read "up to date" here while the sweep installed it.
+
+test('the route hands the reader the project\'s stored update rule (task 1004535)', async () => {
+  let seen;
+  const r = await drive({ softwareUpdate: async (a) => { seen = a; return STUB_UPDATE; }, selfChannel: async () => 'minor',
+    canUpdate: async () => true, doorInputs: () => ({ provisioning: true, idp: null }) });
+  assert.equal(r.status, 200);
+  assert.equal(seen.channel, 'minor', 'the rule set on /deploy, not the platform default');
+  assert.equal(r.body.update.channel_source, 'deploy', 'and the answer says which rule it used');
+});
+
+test('no stored rule, or a failed read of it, falls back to the default — never a 500 (task 1004535)', async () => {
+  for (const selfChannel of [async () => null, async () => { throw new Error('db down'); }]) {
+    let seen;
+    const r = await drive({ softwareUpdate: async (a) => { seen = a; return STUB_UPDATE; }, selfChannel,
+      canUpdate: async () => true, doorInputs: () => ({ provisioning: false, idp: null }) });
+    assert.equal(r.status, 200);
+    assert.equal(seen.channel, null, 'null → the reader applies DEFAULT_CHANNEL');
+    assert.equal(r.body.update.channel_source, 'default');
+  }
+});
+
+test('the REAL default reads the provisioning.selfUpdateChannel port — and with no provider, the default (task 1004535)', async () => {
+  // No selfChannel injected: the shipped storedSelfChannel → seams.resolveOptional path runs.
+  const seams = require('../src/module-seams.js');
+  const stub = { softwareUpdate: async (a) => ({ reading: 'ok', channel: a.channel }), canUpdate: async () => true, doorInputs: () => ({ provisioning: false, idp: null }) };
+  try {
+    seams._reset();
+    let r = await drive(stub);
+    assert.equal(r.status, 200);
+    assert.equal(r.body.update.channel, null, 'module off: no provider, so no rule is claimed');
+    assert.equal(r.body.update.channel_source, 'default');
+    seams.registerProvider('provisioning.selfUpdateChannel', async () => 'minor');
+    r = await drive(stub);
+    assert.equal(r.body.update.channel, 'minor', 'module on: the port the provisioning module registers is the one read');
+    assert.equal(r.body.update.channel_source, 'deploy');
+  } finally {
+    seams._reset();
+  }
+});
+
+test('[source] the port the route reads is the port the provisioning module registers and declares (task 1004535)', () => {
+  const port = 'provisioning.selfUpdateChannel';
+  const route = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/core-update.js'), 'utf8');
+  const reg = fs.readFileSync(path.join(ROOT, 'modules/provisioning/seams.js'), 'utf8');
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/provisioning/module.json'), 'utf8'));
+  assert.ok(route.includes(`'${port}'`), 'the route asks for it');
+  assert.ok(reg.includes(`'${port}'`), 'the module registers it');
+  assert.ok(manifest.provides.includes(port), 'and declares it');
+});

package/tests/update_subscription_engine.mjs

@@ -500,7 +500,7 @@ test('both commitPin successes report committed:true', () => {
 
 // A resolveFrom/load pair standing in for the target instance's core, so the probe is
 // exercised without a second core on disk.
-function fakeCore({ api, willRewrite, upgradeThrows = false, materializeThrows = false } = {}) {
+function fakeCore({ api, willRewrite, upgradeThrows = false, materializeThrows = false, own = () => null } = {}) {
   const seen = [];
   const resolveFrom = (dir, rel) => {
     if (rel === 'scripts/gds/upgrade.js' && api === null) return null;
@@ -515,7 +515,7 @@ function fakeCore({ api, willRewrite, upgradeThrows = false, materializeThrows =
     if (materializeThrows) throw new Error('materialize blew up');
     return { materializeWillRewrite: willRewrite === undefined ? undefined : (args) => { seen.push(args); return willRewrite; } };
   };
-  return { resolveFrom, load, seen };
+  return { resolveFrom, load, seen, own };
 }
 
 test('laneGeneratedPaths unions the API artifacts with what materialize WOULD rewrite', () => {
@@ -545,7 +545,8 @@ test('laneGeneratedPaths is FAIL-SOFT in every direction — an empty set, never
   // The direction matters. An instance this cannot interrogate keeps the OLD, stricter guard
   // (still wedged, and visibly so), rather than gaining a looser one that commits a stranger's work.
   assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: null, willRewrite: null })), []);
-  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: {}, willRewrite: undefined })), []);
+  // A core that predates the preview, and no .claude/skills to walk under it: nothing to fall back on.
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: {}, willRewrite: undefined, own: () => () => ['CLAUDE.md'] })), []);
   assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ upgradeThrows: true, materializeThrows: true })), []);
   // A core that exports API_ARTIFACT_FILES but whose materialize throws still contributes the
   // half it could answer for.
@@ -555,6 +556,57 @@ test('laneGeneratedPaths is FAIL-SOFT in every direction — an empty set, never
   );
 });
 
+// ---------------------------------------------------------------------------
+// task 1004519 — a core too old to preview its own rewrite. hoodify-finance took one bump to
+// 1.19.871 (before materializeWillRewrite, 1.19.933), was left with 33 materialized skills
+// uncommitted, and halted on them every sweep because its core answered nothing for them.
+// ---------------------------------------------------------------------------
+
+function oldCoreOnDisk(skills) {
+  const dir = mkdtempSync(path.join(tmpdir(), 'sweep-oldcore-'));
+  const core = path.join(dir, 'node_modules', '@bongos', 'core');
+  for (const name of skills) {
+    mkdirSync(path.join(core, '.claude', 'skills', name), { recursive: true });
+    writeFileSync(path.join(core, '.claude', 'skills', name, 'SKILL.md'), `# ${name}\n`);
+  }
+  // An instance-owned CLAUDE.md, so the starter is not "would write" here.
+  writeFileSync(path.join(dir, 'CLAUDE.md'), '# instance\n');
+  return dir;
+}
+
+test('laneGeneratedPaths falls back to the sweep\'s own preview when the instance core predates it', () => {
+  const dir = oldCoreOnDisk(['ask-for-help', 'blocker-review']);
+  // The instance's core resolves claude-materialize.js but exports no materializeWillRewrite.
+  const core = fakeCore({ api: { g: ['docs/api/openapi.json'] }, willRewrite: undefined, own: () => require('../scripts/gds/claude-materialize.js').materializeWillRewrite });
+  const got = S.laneGeneratedPaths(dir, core);
+  for (const f of ['.claude/skills/ask-for-help/SKILL.md', '.claude/skills/blocker-review/SKILL.md', 'docs/api/openapi.json']) {
+    assert.ok(got.includes(f), `${f} is the lane's own output and must be classified so`);
+  }
+  assert.ok(!got.includes('CLAUDE.md'), 'an instance-owned CLAUDE.md is never the lane\'s');
+});
+
+test('real git: the hoodify-finance wedge clears — old-core skills sort as generated, a hand-written skill still halts', () => {
+  const dir = oldCoreOnDisk(['ask-for-help']);
+  const g = (...a) => spawnSync('git', ['-C', dir, ...a], { encoding: 'utf8' });
+  writeFileSync(path.join(dir, '.gitignore'), 'node_modules/\n');
+  mkdirSync(path.join(dir, '.claude', 'skills', 'ask-for-help'), { recursive: true });
+  mkdirSync(path.join(dir, '.claude', 'skills', 'my-own'), { recursive: true });
+  writeFileSync(path.join(dir, '.claude', 'skills', 'ask-for-help', 'SKILL.md'), 'old\n');
+  writeFileSync(path.join(dir, '.claude', 'skills', 'my-own', 'SKILL.md'), 'mine\n');
+  g('init', '-q'); g('add', '-A'); g('-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'init');
+  const core = fakeCore({ api: {}, willRewrite: undefined, own: () => require('../scripts/gds/claude-materialize.js').materializeWillRewrite });
+  // The bump rewrote the materialized skill and left it uncommitted.
+  writeFileSync(path.join(dir, '.claude', 'skills', 'ask-for-help', 'SKILL.md'), 'new\n');
+  let pre = S.pinState(dir, spawnSync, S.laneGeneratedPaths(dir, core));
+  assert.deepEqual(pre.other, []);
+  assert.deepEqual(S.healDecision(pre, 'push').action, 'commit');
+  // An owner's own skill is not in the installed core's .claude/, so it is still a human's work.
+  writeFileSync(path.join(dir, '.claude', 'skills', 'my-own', 'SKILL.md'), 'edited\n');
+  pre = S.pinState(dir, spawnSync, S.laneGeneratedPaths(dir, core));
+  assert.deepEqual(pre.other.map((e) => e.file), ['.claude/skills/my-own/SKILL.md']);
+  assert.deepEqual(S.healDecision(pre, 'push'), { action: 'halt' });
+});
+
 test('the core still exports the two things the probe reads', () => {
   // laneGeneratedPaths reads them BY NAME off a module it resolves at runtime, so a rename in the
   // core degrades it silently to the empty set — the pre-fix wedge, back again and invisible.

package/tests/wizard_demo.mjs

@@ -238,51 +238,77 @@ function bootHub() {
     const b = new El(`step-${k}${by}`); b.attrs['data-demo-step'] = k; b.attrs['data-by'] = by; return b;
   });
   const shown = [];
-  const state = { demo: null, description: '', teamShape: null };
-  const sandbox = { $, state, saveDraft() {}, show: (n) => shown.push(n), root: { querySelectorAll: () => steppers } };
+  // the doors wait for the fork's tick (task 1004504), so the founder here has given it
+  const state = { step: 1, demo: null, description: '', teamShape: null, termsAck: true, confirmed: { team: true } };
+  const sandbox = { $, state, saveDraft() {}, show: (n) => shown.push(n), eyebrowFor: () => 'Demo', root: { querySelectorAll: () => steppers } };
   vm.createContext(sandbox);
   vm.runInContext(SLICE, sandbox);
   const click = (id) => $(id).listeners.click.call($(id));
   return { $, state, shown, steppers, click, sandbox };
 }
 
-test('the door opens the setup, the steppers stay in their limits, and the first read follows them', () => {
+test('the door opens ONE setup screen, the steppers stay in their limits, and the first read follows them', () => {
   const h = bootHub();
+  h.state.termsAck = false;
+  h.click('wizDemo');
+  assert.equal(h.$('wizDemo').attrs['aria-expanded'], undefined, 'an unticked box opens nothing (task 1004504)');
+  assert.equal(h.$('forkIntro').hidden, false, 'the doors stay');
+  h.state.termsAck = true;
   h.click('wizDemo');
   assert.equal(h.$('forkIntro').hidden, true);
   assert.equal(h.$('demoSetup').hidden, false);
-  assert.equal(h.$('demoRing').hidden, false, 'the time-box ring on the planet');
   assert.equal(h.$('wizDemo').attrs['aria-expanded'], 'true');
+  assert.equal(h.$('wizBack').hidden, false, 'the one Back walks back to the doors');
   for (let i = 0; i < 20; i += 1) h.steppers[0].listeners.click.call(h.steppers[0]);
   assert.equal(h.$('demoPeople').textContent, '12', 'people stop at twelve');
   for (let i = 0; i < 20; i += 1) h.steppers[3].listeners.click.call(h.steppers[3]);
   assert.equal(h.$('demoHours').textContent, '1', 'hours stop at one');
   assert.equal(h.$('demoFitSum').textContent, '12 people × 1 hour = 12 builder-hours.');
   assert.equal(h.$('demoFitVerdict').textContent, demo.fitCheck(12, 1).sentence);
-  h.click('demoBack1');
+  h.sandbox.demoShow('intro');
   assert.equal(h.$('forkIntro').hidden, false, 'Back returns to the two doors');
   assert.equal(h.$('wizDemo').attrs['aria-expanded'], 'false');
+  assert.equal(h.$('wizBack').hidden, true);
+  assert.match(HUB, /if \(state\.step === 1 && !\$\('demoSetup'\)\.hidden\) \{ demoShow\('intro'\); \$\('wizDemo'\)\.focus\(\); return; \}/, 'which is what #wizBack does from the demo screen');
+  assert.doesNotMatch(HUB, /id="demoReady"|id="demoRing"|id="demoNext1"|id="demoBack1"|id="demoBack2"|id="demoStageCap"/, 'the second demo screen, its ring and its own Back buttons are gone');
 });
 
-test('Name my demo planet carries the demo into the ordinary wizard: the idea, the team, the invites', () => {
+test('the demo screen\'s Continue carries the demo into the ordinary wizard: the idea, the team, the invites', () => {
   const h = bootHub();
   h.click('wizDemo');
+  assert.equal(h.$('demoInvites').hidden, false, 'the invites sit on the same screen');
   h.$('demoIdea').value = 'A shared reading list.';
   h.$('demoIdea').listeners.input.call(h.$('demoIdea'));
-  h.click('demoNext1');
-  assert.equal(h.$('demoReady').hidden, false);
   h.$('demoInvite1').value = '@avery';
   h.$('demoInvite2').value = 'not a handle!';
   h.click('demoStart');
   assert.deepEqual(JSON.parse(JSON.stringify(h.state.demo)), { people: 3, hours_each: 4, idea: 'A shared reading list.', invites: ['avery'] });
   assert.equal(h.state.description, 'A shared reading list.', 'the idea is the description');
+  assert.equal(h.$('f-desc').value, 'A shared reading list.', 'and the sentence field shows it');
   assert.equal(h.state.teamShape, 'small-team');
-  assert.deepEqual(h.shown, [4], 'on to the name step, past planet physics (task 1004418)');
+  assert.deepEqual(JSON.parse(JSON.stringify(h.state.confirmed)), {}, 'the demo\'s own rows are asked again on the review');
+  assert.deepEqual(h.shown, [2], 'on to "What are you making?" (task 1004504)');
+  assert.match(HUB, /<input type="text" id="demoIdea" maxlength="600"/, 'the idea is one line now');
+  assert.match(HUB, /<button type="button" class="btn" id="demoStart">Continue<\/button>/);
+});
+
+test('a demo skips the quick checks and sends only its team shape', () => {
+  assert.match(HUB, /if \(next === 3 && state\.demo\) \{ physDefaults\(\); show\(4, true\); return; \}/, 'the What screen goes straight to the review for a demo');
+  const fn = (HUB.match(/function createDetail\(\) \{[\s\S]*?\n {4}\}/) || [null])[0];
+  assert.ok(fn, 'createDetail() was found');
+  const box = { physDetail: () => ({ framing: 'hybrid', reward_intents: ['cash'] }), state: {} };
+  vm.createContext(box);
+  vm.runInContext(fn, box);
+  box.state = { demo: { people: 3, hours_each: 4 }, teamShape: 'small-team' };
+  assert.deepEqual(JSON.parse(JSON.stringify(box.createDetail())), { team_shape: 'small-team' }, 'the server applies the demo\'s picked answers');
+  box.state = { demo: null, teamShape: 'small-team' };
+  assert.deepEqual(JSON.parse(JSON.stringify(box.createDetail())), { framing: 'hybrid', reward_intents: ['cash'], team_shape: 'small-team' }, 'a real project sends its answers');
+  assert.match(HUB, /if \(state\.demo && \(key === 'team' \|\| key === 'rewards' \|\| key === 'run'\)\) return true;/, 'the demo\'s own rows are fixed on the review');
 });
 
-test('the create sends the demo, the review names it, and the project page asks the question', () => {
+test('the create sends the demo, the recap names it, and the project page asks the question', () => {
   assert.match(HUB, /demo: state\.demo \? \{ people: state\.demo\.people, hours_each: state\.demo\.hours_each \} : undefined,/);
-  assert.match(HUB, /if \(state\.demo\) \{\n\s*rows\.unshift\(\['Demo',/);
+  assert.match(HUB, /if \(state\.demo\) bits\.push\('demo'\);/, 'the look screen\'s recap says it is a demo');
   assert.match(HUB, /<p class="demoKeepH">Keep your planet\?<\/p>/);
   assert.match(HUB, /data-demo-settle="carried">Carry it over</);
   assert.match(HUB, /data-demo-settle="kept">Keep it as a demo</);

package/tests/wizard_draft_resume.mjs

@@ -24,7 +24,7 @@
 // NOT covered here, deliberately: the team shape. The first draft of this task claimed the
 // OAuth hop dropped it; that was wrong — teamShape, projType and modules all survive a
 // reload (verified live). What looked like a drop was the documented "clicking the chosen
-// pill again UNSAYS it" toggle being re-clicked by hand.
+// pill again UNSAYS it" toggle being re-clicked by hand (a toggle task 1004504 retired; slice 3).
 //
 // Run:  node --test --test-reporter=tap tests/wizard_draft_resume.mjs
 
@@ -70,29 +70,33 @@ function runStep({ authKnown, draftStep }) {
 }
 
 test('pre-auth: the placeholder renders step 1 but the draft KEEPS the real step', () => {
-  const { rendered, persisted } = runStep({ authKnown: false, draftStep: 5 });
-  assert.deepEqual(rendered, [1], 'still renders step 1 (the terms, since task 1004417) before identity settles');
-  assert.equal(persisted.step, 5, 'the draft must not be overwritten with the placeholder');
+  // step 4 is the review since task 1004504 — where the code row's repo access is granted
+  const { rendered, persisted } = runStep({ authKnown: false, draftStep: 4 });
+  assert.deepEqual(rendered, [1], 'still renders step 1 (the fork, since task 1004504) before identity settles');
+  assert.equal(persisted.step, 4, 'the draft must not be overwritten with the placeholder');
 });
 
 test('pre-auth: the in-memory step is restored too, so onAuth() can re-enter to it', () => {
   // onAuth() calls enter() again and reads state.step from MEMORY, not from storage — so
   // restoring only the stored copy would fix nothing.
-  const { state } = runStep({ authKnown: false, draftStep: 6 });
-  assert.equal(state.step, 6);
+  for (const step of [2, 3, 4, 5]) {
+    const { state } = runStep({ authKnown: false, draftStep: step });
+    assert.equal(state.step, step, `step ${step} comes back`);
+  }
 });
 
 test('post-auth: the real step is rendered', () => {
-  const { rendered, persisted } = runStep({ authKnown: true, draftStep: 5 });
-  assert.deepEqual(rendered, [5]);
-  assert.equal(persisted.step, 5);
+  const { rendered, persisted } = runStep({ authKnown: true, draftStep: 4 });
+  assert.deepEqual(rendered, [4]);
+  assert.equal(persisted.step, 4);
 });
 
 test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
   assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
-  // 12 is the done panel (11 before task 1004421's Look step, 9 before task 1004417's front door, 8 before task 1004351), reached by its own branch
-  // above this slice; 0 is the gate. Neither is a resumable wizard position, so the placeholder is allowed to stand.
-  for (const bad of [0, 13, 99]) {
+  // 6 is the done panel since task 1004504 (12 before it, 11 before task 1004421's Look step, 9 before task
+  // 1004417's front door, 8 before task 1004351), reached by its own branch above this slice; 0 is the gate.
+  // Neither is a resumable wizard position, so the placeholder is allowed to stand.
+  for (const bad of [0, 6, 13, 99]) {
     assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
   }
 });
@@ -153,9 +157,11 @@ test('while the connect offer is up, the way back is not', () => {
 // ── slice 3 · why this task's original team-shape claim was wrong ─────────────────
 // The bug was filed claiming a GitHub round-trip drops the team shape. It does not: a
 // planted draft reads teamShape back intact after a reload (verified live on 1.19.580).
-// The real explanation is this handler — the pill is an UNSAY toggle, so re-clicking the
-// already-chosen shape clears it. During the R24 walk that second click was mine. Pinning
-// it here so the claim rests on the handler's actual behaviour rather than on prose.
+// The explanation then was this handler — the pill was an UNSAY toggle, so re-clicking the
+// already-chosen shape cleared it. Since task 1004504 the pills live on the review's Team
+// size row, where a team always has a shape ("solo" follows a team of one), so the pill is
+// a plain pick: a second click keeps the answer, and nothing in the handler can drop it.
+// Pinned here so the claim rests on the handler's actual behaviour rather than on prose.
 // Anchored on addEventListener: the same selector also appears inside paintTeam(), which
 // only writes aria-pressed. Matching that one instead yields a slice that will not parse.
 const TEAM_RE = /root\.querySelectorAll\('#teamCards \.tpill'\)\.forEach\(function \(b\) \{\s*b\.addEventListener[\s\S]*?\n {4}\}\);/;
@@ -166,17 +172,20 @@ test('the team-pill slice is still findable', () => {
   assert.match(teamSlice, /state\.teamShape/, 'the handler owns the team-shape answer');
 });
 
-test('the team pill UNSAYS on a second click — the answer is not dropped, it is toggled off', () => {
+test('the team pill is a plain pick on the Team size row — a second click keeps the answer (task 1004504)', () => {
   const state = { teamShape: null };
   const handlers = [];
+  const unconfirmed = [];
+  let saves = 0, paints = 0;
   const pill = (team) => ({
     getAttribute: (a) => (a === 'data-team' ? team : null),
     addEventListener: (_e, fn) => handlers.push({ team, fn }),
   });
   const sandbox = {
     state,
-    root: { querySelectorAll: () => [pill('solo'), pill('small-team'), pill('community')] },
-    paintTeam() {}, paintDetail() {}, saveDraft() {},
+    root: { querySelectorAll: () => [pill('small-team'), pill('community')] },
+    paintTeam() {}, saveDraft() { saves += 1; }, paintSetup() { paints += 1; },
+    unconfirm(keys) { unconfirmed.push(...keys); },
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -186,9 +195,12 @@ test('the team pill UNSAYS on a second click — the answer is not dropped, it i
   click('small-team');
   assert.equal(state.teamShape, 'small-team', 'first click answers');
   click('small-team');
-  assert.equal(state.teamShape, null, 'the SAME pill again unsays it — this is the mis-read bug');
-  click('small-team');
-  assert.equal(state.teamShape, 'small-team', 'and a third click answers again');
+  assert.equal(state.teamShape, 'small-team', 'the SAME pill again keeps it — a team always has a shape');
   click('community');
-  assert.equal(state.teamShape, 'community', 'a DIFFERENT pill replaces rather than clears');
+  assert.equal(state.teamShape, 'community', 'a DIFFERENT pill replaces it');
+  assert.equal(saves, 3, 'every pick is saved into the draft, so the GitHub round-trip keeps it');
+  assert.deepEqual([...new Set(unconfirmed)], ['extras'], 'the suggested extras follow the team, so the review asks about them again');
+  assert.equal(paints, 3, 'and the review repaints');
+  assert.deepEqual([...HUB.matchAll(/data-team="([a-z-]+)"/g)].map((m) => m[1]), ['small-team', 'community'],
+    'the row offers who can join a team; one person is the "One person" pill, not a team shape');
 });