@bongos/core 1.21.82 → 1.21.84

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.82",
+  "version": "1.21.84",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.82",
+      "version": "1.21.84",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.82",
+  "version": "1.21.84",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9318,5 +9318,17 @@
       "id": "1004481",
       "text": "Custom ranks can now be deleted from the Government page, so trying a recommended rank set is no longer a permanent choice. A rank someone still holds can't be deleted, and the page says who holds it. The four built-in ranks c"
     }
+  ],
+  "1.21.83": [
+    {
+      "id": "1004646",
+      "text": "Project invites now reach people on cloudbongos.com. Before, an invite sent by GitHub username was silently lost if the person had never signed in to a project through cloudbongos.com, which is almost every new invitee, so the"
+    }
+  ],
+  "1.21.84": [
+    {
+      "id": "1004629",
+      "text": "New projects now ask how finished work should ship: Auto (recommended) or Manual. The answer becomes the project's ship mode, which the owner can change later on the settings page."
+    }
   ]
 }

package/src/bongos/project-settings.js

@@ -226,14 +226,26 @@ function parseShipMode(raw) {
 // resolveShipMode() — the project's ship mode and where it came from.
 // Returns { mode, source, chosen, invalid }:
 //   mode    — always 'auto' or 'manual'
-//   source  — 'project_settings' | 'default'
+//   source  — 'project_settings' | 'wizard' | 'default'
 //   chosen  — true only when someone actually SET a usable value. "Never chosen" is
 //             a real answer the first-ship prompt (task 1004630) asks about, so it
 //             must not be confused with "chose the default".
 //   invalid — null, or { where, raw, reason } for a stored value that is unusable.
 // A database that cannot be read answers the default rather than failing a ship —
 // the same reporting posture as resolveRotDays.
-async function resolveShipMode() {
+//
+// 'wizard' (task 1004629): the founder picked a mode in the project-creation wizard,
+// which reaches this instance as the server-only branding value founding.shipMode
+// (the hub cannot write this database). It counts as chosen, but only while no row
+// exists: the settings page and the CLI write the row, so a later change always wins.
+// `deps.branding` is the test seam; production reads the process's own pack.
+function wizardShipMode(deps) {
+  let pack;
+  try { pack = deps.branding ? deps.branding() : require('../branding').branding(); } catch (_) { return null; }
+  return parseShipMode(pack && pack.founding && pack.founding.shipMode).mode || null;
+}
+
+async function resolveShipMode(deps = {}) {
   let row = null;
   try {
     row = await getSetting(SETTING_KEYS.SHIP_MODE);
@@ -251,6 +263,8 @@ async function resolveShipMode() {
       invalid: { where: `project_settings['${SETTING_KEYS.SHIP_MODE}']`, raw: String(row.value), reason: got.reason },
     };
   }
+  const fromWizard = wizardShipMode(deps);
+  if (fromWizard) return { mode: fromWizard, source: 'wizard', chosen: true, invalid: null };
   return { mode: DEFAULT_SHIP_MODE, source: 'default', chosen: false, invalid: null };
 }
 

package/src/branding.js

@@ -103,6 +103,9 @@ const ENV_OVERRIDES = [
   ['FOUNDING_BIRTH', ['founding', 'birth']],
   ['DEMO_PEOPLE', ['founding', 'demoPeople']],
   ['DEMO_HOURS', ['founding', 'demoHours']],
+  // The ship mode the founder picked in the wizard (task 1004629), empty when none was.
+  // resolveShipMode reads it only while project_settings['ship.mode'] is unset.
+  ['SHIP_MODE', ['founding', 'shipMode']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.82'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.84'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hub_invite_badge.mjs

@@ -0,0 +1,204 @@
+// tests/hub_invite_badge.mjs — what is waiting on you, said where you already look
+// (task 1004646; the owner's report of 2026-10-08 that invitations "aren't obvious").
+//
+// The REAL assets/invite-badge.js, executed in a node:vm under a small DOM stub: the
+// count on the identity chip and on the profile band's Invitations item, the line on
+// the mine view, nothing at all when nothing waits or nobody is signed in, and no
+// read at all on a child instance (its Invitations item is stripped as apex-only).
+// Then the pages: every page that wears the hub's bar loads it.
+//
+// Run:  node --test tests/hub_invite_badge.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const BADGE = fs.readFileSync(path.join(LANDING, 'assets', 'invite-badge.js'), 'utf8');
+
+// ── a DOM just big enough for this file ──────────────────────────────────────
+
+class El {
+  constructor(tag, attrs = {}) {
+    this.tagName = tag.toUpperCase();
+    this.children = [];
+    this.parentNode = null;
+    this.attrs = { ...attrs };
+    this.className = attrs.class || '';
+    this.id = attrs.id || '';
+    this._text = '';
+  }
+  get firstChild() { return this.children[0] || null; }
+  get lastChild() { return this.children[this.children.length - 1] || null; }
+  get nextSibling() { const k = this.parentNode.children; return k[k.indexOf(this) + 1] || null; }
+  set textContent(v) { this.children = []; this._text = String(v); }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(''); }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  set href(v) { this.attrs.href = v; }
+  get href() { return this.attrs.href; }
+  appendChild(c) { return this.insertBefore(c, null); }
+  insertBefore(c, ref) {
+    if (c.parentNode) c.remove();
+    c.parentNode = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  remove() { const p = this.parentNode; if (p) p.children.splice(p.children.indexOf(this), 1); this.parentNode = null; }
+  *walk() { for (const c of this.children) { yield c; yield* c.walk(); } }
+  matches(sel) {
+    if (sel === '.invBadge') return this.className.split(' ').includes('invBadge');
+    if (sel === '.hero') return this.className === 'hero';
+    if (sel === 'svg.cv') return this.tagName === 'SVG' && this.className === 'cv';
+    if (sel === 'a[href="/invitations"]') return this.tagName === 'A' && this.attrs.href === '/invitations';
+    throw new Error(`stub selector: ${sel}`);
+  }
+  querySelector(sel) { for (const n of this.walk()) if (n.matches(sel)) return n; return null; }
+}
+
+function world({ child = false, mineView = false } = {}) {
+  const body = new El('body');
+  const who = body.appendChild(new El('button', { id: 'who', class: 'trig who' }));
+  who.appendChild(new El('span', { class: 'whoName' }));
+  who.appendChild(new El('svg', { class: 'cv' }));
+  const band = body.appendChild(new El('div', { id: 'menuProfile' }));
+  const mine = band.appendChild(new El('a', { href: '/projects?view=mine' }));
+  mine.textContent = 'My projects';
+  let inv = null;
+  if (!child) { inv = band.appendChild(new El('a', { href: '/invitations', class: 'bandT' })); inv.textContent = 'Invitations'; }
+  let section = null;
+  if (mineView) {
+    const view = body.appendChild(new El('section', { id: 'view-mine' }));
+    section = view.appendChild(new El('div', { class: 'hero' }));
+    section.appendChild(new El('h1')).textContent = 'Your projects';
+    section.appendChild(new El('p', { class: 'lede' }));
+    view.appendChild(new El('ul', { id: 'projectsList' }));
+  }
+  const byId = (id) => { for (const n of body.walk()) if (n.id === id) return n; return null; };
+  const document = { getElementById: byId, createElement: (t) => new El(t) };
+  return { body, who, inv, section, document, byId };
+}
+
+async function run(w, answers) {
+  const asked = [];
+  const fetch = async (url) => {
+    asked.push(url);
+    const a = answers[url];
+    if (a === undefined) return { ok: false, status: 404, json: async () => ({}) };
+    if (a instanceof Error) throw a;
+    return { ok: a.status === undefined, status: a.status || 200, json: async () => a };
+  };
+  const window = {};
+  vm.runInNewContext(BADGE, { window, document: w.document, fetch, Promise });
+  await window.InviteBadge.refresh();
+  return { asked, window };
+}
+
+const INVITES = '/api/bongos/my-projects/invites';
+const GUILDS = '/api/bongos/me/guild-requests';
+const badgeOf = (el) => el && el.querySelector('.invBadge');
+
+// ── the count ────────────────────────────────────────────────────────────────
+
+test('project invites and guild asks add up, on the chip and on the Invitations item', async () => {
+  const w = world();
+  await run(w, {
+    [INVITES]: { invites: [{ client_id: 'a' }, { client_id: 'b' }] },
+    [GUILDS]: { incoming: [{ id: '1' }], owner_incoming: [{ id: '2' }], outgoing: [{ id: '3' }] },
+  });
+  for (const host of [w.who, w.inv]) {
+    const b = badgeOf(host);
+    assert.ok(b, 'a badge is drawn');
+    assert.equal(b.firstChild.textContent, '4', 'two project invites, a guild invite and a request to a guild you own');
+    assert.equal(b.firstChild.getAttribute('aria-hidden'), 'true');
+    assert.equal(b.lastChild.className, 'vh');
+    assert.equal(b.lastChild.textContent, ', 4 invitations waiting', 'a screen reader hears what the number means');
+  }
+  assert.equal(w.who.children.indexOf(badgeOf(w.who)), 1, 'on the chip, before its chevron');
+});
+
+test('one invitation reads in the singular, and a large count is capped', async () => {
+  let w = world();
+  await run(w, { [INVITES]: { invites: [{}] }, [GUILDS]: {} });
+  assert.equal(badgeOf(w.inv).lastChild.textContent, ', 1 invitation waiting');
+  w = world();
+  await run(w, { [INVITES]: { invites: Array.from({ length: 120 }, () => ({})) }, [GUILDS]: {} });
+  assert.equal(badgeOf(w.who).firstChild.textContent, '99+');
+});
+
+test('the mine view says it in a line that links to the invitations page', async () => {
+  const w = world({ mineView: true });
+  await run(w, { [INVITES]: { invites: [{}, {}] }, [GUILDS]: {} });
+  const p = w.byId('mineInvitesWaiting');
+  assert.ok(p, 'the line is drawn');
+  assert.equal(w.section.children[2], p, 'at the top of the view, under its heading and lede — not below a long list');
+  assert.equal(p.firstChild.tagName, 'A');
+  assert.equal(p.firstChild.href, '/invitations');
+  assert.equal(p.textContent, 'You have 2 invitations waiting →');
+});
+
+test('nothing waiting, signed out, or a failed read: nothing is drawn', async () => {
+  for (const answers of [
+    { [INVITES]: { invites: [] }, [GUILDS]: { incoming: [], owner_incoming: [] } },
+    { [INVITES]: { status: 401 }, [GUILDS]: { status: 401 } },
+    { [INVITES]: new Error('offline'), [GUILDS]: new Error('offline') },
+  ]) {
+    const w = world({ mineView: true });
+    await run(w, answers);
+    assert.equal(badgeOf(w.who), null);
+    assert.equal(badgeOf(w.inv), null);
+    assert.equal(w.byId('mineInvitesWaiting'), null);
+  }
+});
+
+test('a refresh after an answer takes the badge and the line away again', async () => {
+  const w = world({ mineView: true });
+  const answers = { [INVITES]: { invites: [{}] }, [GUILDS]: {} };
+  const { window } = await run(w, answers);
+  assert.ok(badgeOf(w.who));
+  window.InviteBadge.paint(0);
+  assert.equal(badgeOf(w.who), null);
+  assert.equal(badgeOf(w.inv), null);
+  assert.equal(w.byId('mineInvitesWaiting'), null);
+});
+
+test('a child instance, with no Invitations item, reads nothing', async () => {
+  const w = world({ child: true });
+  const { asked } = await run(w, { [INVITES]: { invites: [{}] }, [GUILDS]: {} });
+  assert.deepEqual(asked, [], 'the hub-only routes are never asked');
+  assert.equal(badgeOf(w.who), null);
+});
+
+test('the file builds nodes only and makes only its two reads', () => {
+  assert.doesNotMatch(BADGE, /innerHTML|insertAdjacentHTML|outerHTML/);
+  const calls = [...BADGE.matchAll(/readCount\('([^']+)'/g)].map((m) => m[1]);
+  assert.deepEqual(calls, ['/my-projects/invites', '/me/guild-requests']);
+});
+
+// ── the pages ────────────────────────────────────────────────────────────────
+
+test('every page that wears the hub bar loads it once, before the Artist review tag', () => {
+  for (const page of ['projects', 'account', 'invitations', 'guild', 'privacy', 'terms', 'contact']) {
+    const html = fs.readFileSync(path.join(LANDING, `${page}.html`), 'utf8');
+    const tags = html.match(/<script src="\/assets\/invite-badge\.js"><\/script>/g) || [];
+    assert.equal(tags.length, 1, `${page}: one tag`);
+    assert.ok(html.indexOf(tags[0]) < html.lastIndexOf('<script src="/assets/artist-review.js"'), `${page}: before the review button`);
+  }
+});
+
+test('the hub page repaints the count after it rebuilds the chip, and the invitations page after an answer', () => {
+  const hub = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+  assert.match(hub, /renderWho\(\);\r?\n[^\n]*\r?\n\s*if \(window\.InviteBadge\) window\.InviteBadge\.refresh\(\);/);
+  const inv = fs.readFileSync(path.join(LANDING, 'invitations.html'), 'utf8');
+  assert.equal((inv.match(/recount\(\);/g) || []).length, 4, 'a decline, a guild decline, a guild accept and a request accepted');
+});
+
+test('the badge is the accent with its own ink, the .btn pairing', () => {
+  const css = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
+  assert.match(css, /\.invBadge\{[^}]*background:var\(--accent\);color:var\(--accent-on\);/);
+});

package/tests/hub_invite_notices.mjs

@@ -55,6 +55,8 @@ const pool = {
     }
     if (/^\s*INSERT INTO platform_identity_project_memberships/.test(sql)) return { rows: [{ id: '1', membership_kind: 'pending' }] };
     if (/^\s*DELETE FROM platform_identity_project_memberships/.test(sql)) return { rowCount: 1, rows: [] };
+    if (/^\s*INSERT INTO platform_identity_parked_invite_notices/.test(sql)) return { rowCount: 1, rows: [] };
+    if (/^\s*DELETE FROM platform_identity_parked_invite_notices/.test(sql)) return { rowCount: 0, rows: [] };
     throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
   },
 };
@@ -119,13 +121,15 @@ test('clear drops ONLY a pending row on the calling project', async () => {
   assert.equal(res.status, 200);
   assert.deepEqual(res.body, { ok: true });
   const w = writes();
-  assert.equal(w.length, 1);
-  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
+  assert.equal(w.length, 2, 'the parked notice under the login, then the pending row on the account');
+  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_parked_invite_notices WHERE client_id = \$1 AND login_lower = \$2/);
+  assert.deepEqual(w[0].params, ['mercury', 'octo']);
+  assert.match(w[1].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
     'a rescind can never remove someone who has signed in');
-  assert.deepEqual(w[0].params, ['mercury', '4242']);
+  assert.deepEqual(w[1].params, ['mercury', '4242']);
 });
 
-test('a login with no hub account writes nothing — and the answer is byte-identical', async () => {
+test('a login with no hub account is PARKED by login — and the answer is byte-identical (task 1004646)', async () => {
   // The project must not learn from this route which GitHub logins have platform accounts.
   for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
     calls = [];
@@ -133,9 +137,60 @@ test('a login with no hub account writes nothing — and the answer is byte-iden
     const unknown = await notice(route, { github_login: 'nobody-here' });
     assert.deepEqual(unknown, known, `${route}: same status, same body`);
   }
+  // Before task 1004646 this wrote nothing, so a new invitee — no account until they sign
+  // in to a project through the hub — never saw the invite. Now it waits under the login.
   calls = [];
-  await notice('/sso/invites/notify', { github_login: 'nobody-here' });
-  assert.equal(writes().length, 0);
+  await notice('/sso/invites/notify', { github_login: '@Nobody-Here' });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /^\s*INSERT INTO platform_identity_parked_invite_notices \(client_id, login_lower\)/);
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, login_lower\) DO UPDATE SET noted_at = now\(\)/, 'a re-invite restarts its 30 days in place');
+  assert.deepEqual(w[0].params, ['mercury', 'nobody-here'], 'the calling project, and the login folded: no @, lower case');
+  assert.equal(w.filter((x) => /project_memberships/.test(x.sql)).length, 0, 'no membership row for a login with no account');
+});
+
+test('the invitations read lists a parked notice for whoever signs in with that login', async () => {
+  const seen = [];
+  const readPool = {
+    async query(text, params = []) {
+      const sql = String(text);
+      seen.push({ sql, params });
+      if (/FROM platform_identity_project_memberships m\s+LEFT JOIN/.test(sql)) {
+        return { rows: [{ client_id: 'mercury', invited_at: 't2', project_name: 'Mercury', project_origin: 'https://mercury.test' }] };
+      }
+      if (/FROM platform_identity_parked_invite_notices n/.test(sql)) {
+        return { rows: [
+          { client_id: 'mercury', invited_at: 't1', project_name: 'Mercury', project_origin: 'https://mercury.test' },
+          { client_id: 'venus', invited_at: 't0', project_name: 'Venus', project_origin: 'https://venus.test' },
+        ] };
+      }
+      throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
+    },
+  };
+  const out = await inviteNotices.listInvitesForBuilder({ githubId: '4242', githubLogin: 'Octo' }, { pool: readPool });
+  assert.deepEqual(out.map((r) => r.client_id), ['mercury', 'venus'], 'one row per project: the pending row wins over its parked twin');
+  const parked = seen.find((c) => /parked_invite_notices/.test(c.sql));
+  assert.deepEqual(parked.params, ['octo', 30, '4242'], 'keyed on the SESSION login, folded; the 30 days; the session account');
+  assert.match(parked.sql, /n\.noted_at > now\(\) - make_interval\(days => \$2\)/, 'a lapsed invite is not shown (ADR 0356)');
+  assert.match(parked.sql, /NOT EXISTS \([\s\S]*m\.github_id = \$3 AND m\.membership_kind <> 'pending'\)/,
+    'a project the reader already builds on is not listed: signing in there accepted it');
+});
+
+test('a decline drops the parked notice too, keyed on the session login', async () => {
+  const seen = [];
+  const p = { async query(text, params) { seen.push({ sql: String(text), params }); return { rowCount: 1, rows: [] }; } };
+  const out = await inviteNotices.removeParkedInvite({ clientId: 'venus', githubLogin: 'Octo' }, { pool: p });
+  assert.deepEqual(out, { removed: true });
+  assert.deepEqual(seen[0].params, ['venus', 'octo']);
+  assert.deepEqual(await inviteNotices.removeParkedInvite({ clientId: 'venus', githubLogin: '' }, { pool: p }), { removed: false });
+  assert.equal(seen.length, 1, 'no login, no statement');
+});
+
+test('the invitations routes read and decline through the parked notices', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/my-projects.js'), 'utf8');
+  assert.match(src, /inviteNotices\.listInvitesForBuilder\(\s*\{ githubId: req\.builder\.github_id, githubLogin: req\.builder\.github_login \}/);
+  assert.match(src, /inviteNotices\.removeParkedInvite\(\{ clientId, githubLogin: req\.builder\.github_login \}/);
+  assert.match(src, /if \(!out\.removed && !parked\.removed\) return res\.fail\('no_pending_invite', 404\)/);
 });
 
 test('only an authenticated, active, credentialed project may speak — and writes nothing otherwise', async () => {

package/tests/landing_legal_pages.mjs

@@ -207,7 +207,7 @@ for (const p of PAGES) {
     const styles = [...html.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
     assert.doesNotMatch(styles, /\.(shell|bar|barMark|barLeft|barRight|trig|who|signinDoor|menuBand|band[A-Z]\w*)\b[^{}]*\{/, 'no bar or band rule in the page');
     // then the Artist review button's loader (task 1004499), the page's last tag
-    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
+    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<script src="\/assets\/invite-badge\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'the shared bar and its waiting count (task 1004646), after the markup they drive');
     assert.doesNotMatch(html, /<script>/, 'and no inline copy of the bands');
     assert.match(html, /<a data-link-hall href="\{\{buildersOrigin\}\}">Builders' hall<\/a><\/nav><\/footer>/, 'the hall keeps a door in the footer row now the bar has no Hall pill, as on /account');
   });

package/tests/projects_hub.mjs

@@ -729,7 +729,7 @@ test('the About answers travel on the create request, and an empty one is OMITTE
   // wizard PREFILLED, and the sentence is never prefilled, so it has no row there — its
   // cost is stated on its own field (pinned above)
   assert.doesNotMatch(SCRIPT, /function renderReview\(|\$\('reviewList'\)/, 'no ledger review is left');
-  assert.match(SCRIPT, /var ROWS = \['code', 'address', 'app', 'extras', 'team', 'rewards', 'run'\];/,
+  assert.match(SCRIPT, /var ROWS = \['code', 'address', 'app', 'extras', 'team', 'rewards', 'run', 'ship'\];/,
     'the review rows are the seven prefilled answers');
 });
 

package/tests/projects_hub_app_step.mjs

@@ -168,7 +168,7 @@ test('the row is real markup: Render and Decide later, Decide later the default'
 
 test("the row sits in the review, between Address and Extras, and its checks are the old step's (task 1004504)", () => {
   assert.match(HUB, /var panels = \{ 0: 'panel-gate', 1: 'panel-fork', 2: 'panel-what', 3: 'panel-checks', 4: 'panel-review', 5: 'panel-look', 6: 'panel-done' \};/);
-  assert.match(HUB, /var ROWS = \['code', 'address', 'app', 'extras', 'team', 'rewards', 'run'\];/);
+  assert.match(HUB, /var ROWS = \['code', 'address', 'app', 'extras', 'team', 'rewards', 'run', 'ship'\];/);
   assert.doesNotMatch(HUB, /<li[^>]*data-step="\d+"/, 'no rail beat names the step any more');
   assert.match(HUB, /if \(step === 4\) \{[^}]*syncAppStep\(\); syncRenderSetup\(\);\r?\n\s*paintSetup\(\);\r?\n\s*\}/, 'entering the review repaints the row, Render setup included');
   assert.match(HUB, /if \(key === 'app'\) \{ syncAppStep\(\); syncRenderSetup\(\); \}/, 'opening the row repaints it too');

package/tests/provision_settings_apply.mjs

@@ -78,6 +78,7 @@ ${NEUTRAL_PREFIX}_LOGO_URL=
 ${NEUTRAL_PREFIX}_FOUNDING_BIRTH=
 ${NEUTRAL_PREFIX}_DEMO_PEOPLE=
 ${NEUTRAL_PREFIX}_DEMO_HOURS=
+${NEUTRAL_PREFIX}_SHIP_MODE=
 ${NEUTRAL_PREFIX}_HUB_UPGRADE_URL=
 `;
 
@@ -148,6 +149,8 @@ t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at stan
     [`${NEUTRAL_PREFIX}_LOOK_ACCENT`]: '', [`${NEUTRAL_PREFIX}_LOGO_URL`]: '',
     // the birth marker and a demo's box (task 1004506), empty on an un-stamped row
     [`${NEUTRAL_PREFIX}_FOUNDING_BIRTH`]: '', [`${NEUTRAL_PREFIX}_DEMO_PEOPLE`]: '', [`${NEUTRAL_PREFIX}_DEMO_HOURS`]: '',
+    // the wizard's ship mode (task 1004629), empty when none was picked
+    [`${NEUTRAL_PREFIX}_SHIP_MODE`]: '',
     // where the hall's Update button goes (task 1004608), empty when no hub origin resolves
     [`${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`]: '',
   });
@@ -250,7 +253,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_LOOK, .*_NIGHT_TINT, .*_ARTIST_GATE_SINCE, .*_LOOK_ACCENT, .*_LOGO_URL, .*_FOUNDING_BIRTH, .*_DEMO_PEOPLE, .*_DEMO_HOURS, .*_HUB_UPGRADE_URL in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_LOOK, .*_NIGHT_TINT, .*_ARTIST_GATE_SINCE, .*_LOOK_ACCENT, .*_LOGO_URL, .*_FOUNDING_BIRTH, .*_DEMO_PEOPLE, .*_DEMO_HOURS, .*_SHIP_MODE, .*_HUB_UPGRADE_URL in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });

package/tests/provisioning_settings_env.mjs

@@ -127,6 +127,8 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     // The birth marker and a demo's box (task 1004506): empty on a row the create
     // route never stamped, which is every row made before it shipped (spec D8).
     CLOUDBONGOS_FOUNDING_BIRTH: '', CLOUDBONGOS_DEMO_PEOPLE: '', CLOUDBONGOS_DEMO_HOURS: '',
+    // The wizard's ship mode (task 1004629): empty when none was picked.
+    CLOUDBONGOS_SHIP_MODE: '',
   });
   // varsOf splits on '=', so an empty value reads as '' on both sides — the point
   // of the comparison is that the standup lines carry exactly the same key set.
@@ -135,7 +137,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
     X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '', X_SPEND_PAYER: 'none',
     X_LOOK: 'own', X_NIGHT_TINT: 'on', X_LOOK_ACCENT: '', X_LOGO_URL: '',
-    X_FOUNDING_BIRTH: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '',
+    X_FOUNDING_BIRTH: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '',
   }, 'defaults, explicitly');
 });
 

package/tests/wizard_physics_more.mjs

@@ -377,13 +377,13 @@ test('rewards are hidden for a solo founder: the real table hides the row, and t
   assert.equal(w.run("rowApplies('rewards')"), false, 'the REAL softLimitsFor hides reward_intents for one-and-one');
   assert.equal(w.row('rewards').hidden, true, 'and the row goes with it');
   assert.ok(!w.run('unconfirmedRows()').includes('rewards'), 'nothing to confirm for a question never asked');
-  assert.equal(w.run('unconfirmedRows()').length, 6, 'six rows apply');
+  assert.equal(w.run('unconfirmedRows()').length, 7, 'seven rows apply');
   assert.equal(w.run('createDetail()').reward_intents, undefined);
   w.change('team');
   w.q('[data-phys-solo="many"]')[0].click();
   await w.settle();
   assert.equal(w.row('rewards').hidden, false, 'a team brings the question back, once the table is asked again');
-  assert.equal(w.run('unconfirmedRows()').length, 7);
+  assert.equal(w.run('unconfirmedRows()').length, 8);
 });
 
 test('rewards: a greyed option is disabled and leaves the list, and each reason is said once', async () => {
@@ -482,9 +482,9 @@ test('one "Looks right, continue" confirms every row that applies, each through
   assert.equal(w.go().disabled, false, 'Continue is never locked: it is the confirmation');
   assert.equal(w.go().textContent, 'Looks right, continue');
   assert.equal(w.row('code').querySelector('[data-row-ok]'), null, 'no row carries a Looks right of its own');
-  assert.equal(w.run('unconfirmedRows()').length, 7, 'nothing is confirmed before the founder says so');
+  assert.equal(w.run('unconfirmedRows()').length, 8, 'nothing is confirmed before the founder says so');
   assert.equal(w.run('validateStep(4)'), true, 'one Continue confirms them all');
-  for (const key of ['code', 'address', 'app', 'extras', 'team', 'rewards', 'run']) assert.equal(w.state.confirmed[key], true, key);
+  for (const key of ['code', 'address', 'app', 'extras', 'team', 'rewards', 'run', 'ship']) assert.equal(w.state.confirmed[key], true, key);
   assert.equal(w.state.modules && plain(w.state.modules).join(), 'discord', 'confirming the extras is the answer the create sends');
   w.change('team');
   assert.equal(w.state.confirmed.team, undefined, 'Edit takes a row back');
@@ -629,7 +629,7 @@ test('no path reaches Look without the founder confirming the address: a prefill
     assert.equal(w.state.confirmed.address, undefined, `${label}: the prefills leave the address unconfirmed`);
     assert.equal(w.run("rowFixed('address')"), false, `${label}: the address is never a fixed row`);
     assert.equal(w.row('address').querySelector('[data-row-chg]').hidden, false, `${label}: it can always be changed`);
-    for (const key of ['code', 'app', 'extras', 'team', 'rewards', 'run']) if (w.run(`rowApplies('${key}')`)) w.ok(key);
+    for (const key of ['code', 'app', 'extras', 'team', 'rewards', 'run', 'ship']) if (w.run(`rowApplies('${key}')`)) w.ok(key);
     assert.deepEqual(plain(w.run('unconfirmedRows()')), ['address'], `${label}: every other row confirmed, the address still asked`);
     // the address is on the page the founder confirms (task 1004550): only their own
     // "Looks right, continue" — or Done on the row — confirms it, and its check still runs