@bongos/core 1.25.4 → 1.25.6

package/tests/hall_start_screen.mjs

@@ -23,17 +23,20 @@ const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const CITY = fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'home__city.json'), 'utf8');
 
 // ---------- in a vm: the pure parts and the welcome's hand-off ----------
-function sandbox({ store = {}, game = true } = {}) {
-  const started = [], asked = [];
+function sandbox({ store = {}, session = {}, game = true } = {}) {
+  const started = [], asked = [], went = [];
   const window = {
-    location: { search: '', pathname: '/', hash: '' },
+    location: { search: '', pathname: '/', hash: '', assign: (h) => went.push(h) },
     __BRANDING__: { identity: { worldName: 'Harbor' } },
     localStorage: {
       getItem: (k) => (k in store ? store[k] : null),
       setItem: (k, v) => { store[k] = String(v); },
       removeItem: (k) => { delete store[k]; },
     },
-    sessionStorage: { getItem: () => null, setItem() {} },
+    sessionStorage: {
+      getItem: (k) => (k in session ? session[k] : null),
+      setItem: (k, v) => { session[k] = String(v); },
+    },
     OTBCraftMode: { markAsked: () => asked.push('marked'), onAccess: (a, b) => asked.push(['picker', a.authed, b.id]) },
   };
   const document = { documentElement: { dataset: {}, classList: { add() {}, remove() {} } }, addEventListener() {} };
@@ -44,7 +47,7 @@ function sandbox({ store = {}, game = true } = {}) {
     window.OTBShellGame.start = (o) => { started.push(o); return true; };
   }
   vm.runInContext(read('welcome-boot.js'), box, { filename: 'welcome-boot.js' });
-  return { window, store, started, asked };
+  return { window, store, session, started, asked, went };
 }
 
 test('the menu is Start, Options, Achievements, Extras, Quit, in that order', () => {
@@ -105,10 +108,27 @@ test('a fresh sign-in is handed to the start screen with the still, and the craf
   assert.deepEqual(s.asked, [['picker', true, 7]], 'the picker is asked once the world is showing');
 });
 
-test('a visit that is not a fresh sign-in keeps the welcome, and a hall without shell-game.js greets a sign-in as before', () => {
-  const daily = sandbox();
+test('every visit to Home opens on Game or Classic, signed in or not (task 1005219)', () => {
+  const visit = sandbox();
+  assert.equal(visit.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
+  assert.deepEqual([visit.started.length, visit.asked], [1, []], 'a new visit, signed in, is the chooser, not the welcome');
+  const deep = sandbox();
+  deep.window.location.pathname = '/goals';
+  assert.equal(deep.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
+  assert.equal(deep.started.length, 0, 'only Home asks; a page deeper in keeps the day\'s welcome');
+  const out = sandbox();
+  assert.equal(out.window.OTBWelcome.onAccess({ authed: false }, null), true);
+  assert.equal(out.started.length, 1, 'signed out, the chooser stands in for the painted welcome');
+  assert.equal(typeof out.started[0].signIn, 'function', 'and a pick goes on to sign in');
+  out.started[0].signIn();
+  assert.deepEqual([out.went, out.store['hall-welcome-signin']], [['/api/bongos/auth/web/start'], '1'],
+    'to GitHub, remembered as a sign-in so the return opens the picked menu');
+});
+
+test('within one visit, Home asks once; the day\'s welcome stays for a later page, and a hall without shell-game.js greets a sign-in as before', () => {
+  const daily = sandbox({ session: { 'hall-chooser-seen': '1' } });
   assert.equal(daily.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
-  assert.deepEqual([daily.started.length, daily.asked], [0, ['marked']], 'the day\'s first visit is the welcome\'s');
+  assert.deepEqual([daily.started.length, daily.asked], [0, ['marked']], 'asked already this visit: the day\'s first visit is the welcome\'s');
   const bare = sandbox({ store: { 'hall-welcome-signin': '1' }, game: false });
   assert.equal(bare.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
   assert.deepEqual(bare.asked, ['marked']);
@@ -286,6 +306,40 @@ test('choosing Classic at sign-in closes the screen, leaves game mode off, and s
   await ctx.close();
 });
 
+// task 1005219: the hall's front opens on the chooser signed out; the pick goes to sign-in and the
+// return opens that menu without asking again — the start screen for Game, the plain hall for Classic.
+test('signed out, a pick goes to sign-in, and the return opens the picked menu without asking again', { skip }, async () => {
+  for (const pick of ['game', 'classic']) {
+    const ctx = await hall();
+    await ctx.route(ORIGIN + '/api/bongos/auth/web/start', (route) => route.fulfill({ contentType: 'text/html', body: 'github' }));
+    const page = await ctx.newPage();
+    await page.goto(ORIGIN + '/');
+    await page.waitForFunction(() => !!window.OTBShell && !!window.OTBWelcome && !!window.OTBShellGame);
+    await page.evaluate(() => window.OTBShell.applyAccess({ authed: false }));
+    await page.waitForSelector('#game-start');
+    assert.equal((await state(page)).welcome, false, 'the chooser, not the painted welcome');
+    await Promise.all([page.waitForURL(ORIGIN + '/api/bongos/auth/web/start'), page.click(`[data-gs="view-${pick}"]`)]);
+    assert.deepEqual(await page.evaluate(() => [localStorage.getItem('hall-view-pending'), localStorage.getItem('hall-welcome-signin')]), [pick, '1']);
+
+    // back from GitHub, signed in
+    await page.goto(ORIGIN + '/');
+    await page.waitForFunction(() => !!window.OTBShell && !!window.OTBWelcome && !!window.OTBShellGame);
+    await page.evaluate(() => { const me = { authed: true, rank: 'metic', builder: { id: 7, display_name: 'Ada', github_login: 'ada' } }; window.OTBShell.applyAccess(me); window.OTBShell.applyAccess(me); });
+    await page.evaluate(() => new Promise((r) => setTimeout(r, 100)));
+    const s = await state(page);
+    if (pick === 'game') {
+      assert.equal(s.start, true, 'Game: the start screen');
+      assert.equal(await page.isVisible('#gs-items'), true, 'on its menu');
+      assert.equal(await page.isVisible('#gs-views'), false, 'not asked again');
+      assert.equal(s.game, 'on');
+    } else {
+      assert.deepEqual([s.start, s.welcome, s.game], [false, false, null], 'Classic: the hall, no screen, game mode off');
+    }
+    assert.equal(await page.evaluate(() => localStorage.getItem('hall-view-pending')), null, 'the pick is spent');
+    await ctx.close();
+  }
+});
+
 test('on a phone the panel is the whole width, nothing scrolls sideways and every choice clears the floor (task 1005192)', { skip }, async () => {
   for (const [w, h] of [[390, 844], [320, 700]]) {
     const ctx = await hall({ viewport: { width: w, height: h } });

package/tests/provision_settings_apply.mjs

@@ -80,6 +80,7 @@ ${NEUTRAL_PREFIX}_FOUNDING_GENESIS=
 ${NEUTRAL_PREFIX}_DEMO_PEOPLE=
 ${NEUTRAL_PREFIX}_DEMO_HOURS=
 ${NEUTRAL_PREFIX}_SHIP_MODE=
+${NEUTRAL_PREFIX}_TEST_PROJECT=
 ${NEUTRAL_PREFIX}_HUB_UPGRADE_URL=
 `;
 
@@ -151,7 +152,7 @@ t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at stan
     // the birth marker and a demo's box (task 1004506), empty on an un-stamped row
     [`${NEUTRAL_PREFIX}_FOUNDING_BIRTH`]: '', [`${NEUTRAL_PREFIX}_FOUNDING_GENESIS`]: '', [`${NEUTRAL_PREFIX}_DEMO_PEOPLE`]: '', [`${NEUTRAL_PREFIX}_DEMO_HOURS`]: '',
     // the wizard's ship mode (task 1004629), empty when none was picked
-    [`${NEUTRAL_PREFIX}_SHIP_MODE`]: '',
+    [`${NEUTRAL_PREFIX}_SHIP_MODE`]: '', [`${NEUTRAL_PREFIX}_TEST_PROJECT`]: '',
     // where the hall's Update button goes (task 1004608), empty when no hub origin resolves
     [`${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`]: '',
   });

package/tests/provisioning_paid_shape_gate.mjs

@@ -243,6 +243,22 @@ await ta('cloud-host: ADMITTED past the limit for a builder holding provisioning
   assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
 });
 
+await ta('cloud-host: a TEST project holds no free place, so it does not make the next one a second (task 1005036)', async () => {
+  // Only an archon makes a test project, and it is for trying features: counting it would
+  // charge a builder's one free place for a project nobody meant to keep.
+  held = [];
+  owned = [{ ...LIVE_HOSTED, slug: 'sandbox', settings: { test_project: 'on' } }];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  assert.equal(res.status, 201, 'a test project alone leaves the free place free: ' + res.raw);
+  held = [];
+  owned = [LIVE_HOSTED, { ...LIVE_HOSTED, slug: 'sandbox', settings: { test_project: 'on' } }];
+  lastCreateArgs = null;
+  const second = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
+  assert.equal(second.status, 403, 'a real project plus a test one still counts the real one');
+});
+
 // ── control-plane is not requestable AT ALL (task 1003370) ────────────────────────
 
 await ta('control-plane: refused for an unprivileged builder, and the refusal is not a permission', async () => {

package/tests/provisioning_settings_env.mjs

@@ -128,7 +128,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     // route never stamped, which is every row made before it shipped (spec D8).
     CLOUDBONGOS_FOUNDING_BIRTH: '', CLOUDBONGOS_FOUNDING_GENESIS: '', CLOUDBONGOS_DEMO_PEOPLE: '', CLOUDBONGOS_DEMO_HOURS: '',
     // The wizard's ship mode (task 1004629): empty when none was picked.
-    CLOUDBONGOS_SHIP_MODE: '',
+    CLOUDBONGOS_SHIP_MODE: '', CLOUDBONGOS_TEST_PROJECT: '',
   });
   // varsOf splits on '=', so an empty value reads as '' on both sides — the point
   // of the comparison is that the standup lines carry exactly the same key set.
@@ -137,7 +137,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
     X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '', X_SPEND_PAYER: 'none',
     X_LOOK: 'own', X_NIGHT_TINT: 'on', X_LOOK_ACCENT: '', X_LOGO_URL: '',
-    X_FOUNDING_BIRTH: '', X_FOUNDING_GENESIS: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '',
+    X_FOUNDING_BIRTH: '', X_FOUNDING_GENESIS: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '', X_TEST_PROJECT: '',
   }, 'defaults, explicitly');
 });
 

package/tests/provisioning_update_subscription_route.mjs

@@ -0,0 +1,141 @@
+// tests/provisioning_update_subscription_route.mjs
+//
+// Task 1004150 (ADR 0325 decision 5): POST /provisioning/instances/:id/update-subscription — the
+// operator's switch for "does the nightly sweep move this instance on its own".
+//
+// The load-bearing assertions:
+//   • the fleet permission gate is what stands in front of it (an ungated route could arm any
+//     instance for unattended upgrades)
+//   • the body is strict and boolean: a string, a missing field or an extra field is a 400 and
+//     nothing is written
+//   • a real change writes the column and one audit event; a no-op writes and records nothing
+//   • an unknown id is a 404
+//
+// DB-free: the pool and data access are stubbed on the cached module objects over a real mounted
+// router (the provisioning_repo_private_route.mjs pattern).
+//
+// Run:  node tests/provisioning_update_subscription_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+const api = require('../src/module-api.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+let instance = null;
+let writes = [];
+let events = [];
+let permissionAsked = null;
+let allowed = true;
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+api.pool.query = async (sql, params) => { writes.push({ sql, params }); return { rows: [] }; };
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_login: 'op', rank: 'metic' }; next(); };
+api.requirePermission = (atom) => {
+  permissionAsked = atom;
+  return (req, res, next) => (allowed ? next() : res.status(403).json({ error: { code: 'forbidden' } }));
+};
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/update-subscription.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json' } }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+function reset(patch = {}) {
+  instance = { owner_builder_id: 7, slug: 'spike', update_subscribed: false, ...patch };
+  writes = []; events = []; allowed = true;
+}
+const URL_18 = '/provisioning/instances/18/update-subscription';
+
+console.log('POST /provisioning/instances/:id/update-subscription:');
+
+await ta('is gated on the fleet permission, and a caller without it writes nothing', async () => {
+  reset(); allowed = false;
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(permissionAsked, 'provisioning.fleet.manage');
+  assert.equal(r.status, 403, r.raw);
+  assert.equal(writes.length, 0);
+});
+
+await ta('arming writes the column once and records one audit event', async () => {
+  reset();
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body, { ok: true, update_subscribed: true, previous: false, changed: true });
+  assert.equal(writes.length, 1);
+  assert.match(writes[0].sql, /SET update_subscribed = \$2/);
+  assert.deepEqual(writes[0].params, [18, true]);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'update-subscription-changed');
+});
+
+await ta('a no-op (already in that state) writes nothing and records nothing', async () => {
+  reset({ update_subscribed: true });
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.changed, false);
+  assert.equal(writes.length, 0);
+  assert.equal(events.length, 0);
+});
+
+await ta('disarming is symmetric', async () => {
+  reset({ update_subscribed: true });
+  const r = await post(URL_18, { subscribed: false });
+  assert.equal(r.body.update_subscribed, false);
+  assert.deepEqual(writes[0].params, [18, false]);
+});
+
+await ta('a non-boolean, a missing field and an extra field are all 400 with nothing written', async () => {
+  for (const body of [{ subscribed: 'yes' }, {}, { subscribed: true, channel: 'minor' }]) {
+    reset();
+    const r = await post(URL_18, body);
+    assert.equal(r.status, 400, `${JSON.stringify(body)} → ${r.raw}`);
+    assert.equal(writes.length, 0);
+  }
+});
+
+await ta('an unknown id is 404', async () => {
+  reset(); instance = null;
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/test_project.mjs

@@ -0,0 +1,122 @@
+// tests/test_project.mjs — A TEST PROJECT: one made to try features that are not live yet
+// (task 1005036, idea 1001299; owner, 2026-11-01).
+//
+// Done-when: only an archon can ask for one; it is stamped once on the row just made; it is
+// kept off the public map; it reaches the instance as project.test; and the not-yet-live
+// genesis switch opens on a test project and nowhere else. The free-place count is pinned in
+// tests/provisioning_paid_shape_gate.mjs and the create route in tests/wizard_demo.mjs.
+//
+// Run:  node --test tests/test_project.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const tp = require('../modules/provisioning/test-project.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const bridge = require('../modules/provisioning/catalog-bridge.js');
+const gh = require('../modules/onboarding/genesis-home.js');
+const fm = require('../modules/onboarding/founding-mode.js');
+
+const ARCHON = { id: 1, rank: 'archon' };
+const METIC = { id: 2, rank: 'metic' };
+const ROW = (settings) => ({ id: 41, slug: 'sandbox', domain: 'sandbox.example.test', status: 'active', hosting_shape: 'cloud-host', settings });
+
+test('only an archon can ask for a test project, and genesis means nothing without one', () => {
+  assert.deepEqual(tp.parseTestAsk({ test: true }, ARCHON), { ok: true, test: true, genesis: false });
+  assert.deepEqual(tp.parseTestAsk({ test: true, genesis: true }, ARCHON), { ok: true, test: true, genesis: true });
+  assert.deepEqual(tp.parseTestAsk({}, METIC), { ok: true, test: false, genesis: false }, 'a request that asks for nothing is fine for anyone');
+  const refused = tp.parseTestAsk({ test: true }, METIC);
+  assert.equal(refused.ok, false);
+  assert.equal(refused.status, 403);
+  assert.equal(refused.code, 'test_project_forbidden');
+  assert.equal(tp.parseTestAsk({ test: true }, undefined).ok, false, 'no builder, no test project');
+  assert.equal(tp.parseTestAsk({ test: 'yes' }, METIC).ok, true, 'only a real boolean true asks');
+  const alone = tp.parseTestAsk({ genesis: true }, ARCHON);
+  assert.equal(alone.ok, false);
+  assert.equal(alone.code, 'genesis_needs_test');
+  assert.equal(alone.status, 400);
+});
+
+test('the mark: stamped on the row it is given, once; read only when it says on', async () => {
+  const seen = [];
+  await tp.stampTestProject({ query: async (sql, params) => { seen.push({ sql, params }); return { rows: [] }; } }, 41);
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].sql, /WHERE id = \$1 AND NOT \(COALESCE\(settings, '\{\}'::jsonb\) \? \$2::text\)/, 'write-once');
+  assert.deepEqual(seen[0].params, [41, 'test_project']);
+  assert.equal(tp.isTestProject(ROW({ test_project: 'on' })), true);
+  for (const bad of [undefined, null, {}, { test_project: 'yes' }, { test_project: true }, 'on']) {
+    assert.equal(tp.isTestProject(ROW(bad)), false, JSON.stringify(bad));
+  }
+  assert.equal(tp.isTestProject(null), false);
+});
+
+test('the owner view says it, and it reaches web.env as TEST_PROJECT, empty on every other project', () => {
+  assert.equal(provisioning.publicInstance(ROW({ test_project: 'on' })).is_test, true);
+  assert.equal(provisioning.publicInstance(ROW({})).is_test, false);
+  assert.equal(provisioning.settingsEnvVars(ROW({ test_project: 'on' }), 'X').X_TEST_PROJECT, 'on');
+  assert.equal(provisioning.settingsEnvVars(ROW({}), 'X').X_TEST_PROJECT, '', 'a line that came and went would leave a stale one behind');
+  assert.equal(provisioning.settingsEnvVars(ROW({ test_project: 'maybe' }), 'X').X_TEST_PROJECT, '');
+});
+
+test('a test project is never on the public map; the same row without the mark is', () => {
+  assert.equal(bridge.catalogEntryForInstance(ROW({ test_project: 'on' }), { ownerGithubId: 99 }), null);
+  const plain = bridge.catalogEntryForInstance(ROW({}), { ownerGithubId: 99 });
+  assert.ok(plain && plain.clientId === 'sandbox', 'an ordinary project still projects');
+});
+
+test('the instance reads TEST_PROJECT into project.test, and publishes it as a boolean beside project, not in it', () => {
+  const read = (env) => JSON.parse(execFileSync(process.execPath, ['-e',
+    "const b=require('./src/branding.js');const r=(b.branding||b)();console.log(JSON.stringify({p:r.project&&r.project.test,c:b.clientBranding(r).testProject}))"],
+    { cwd: ROOT, encoding: 'utf8', env: { ...process.env, ...env } }));
+  assert.deepEqual(read({}), { c: false }, 'no env, not a test project');
+  assert.deepEqual(read({ CLOUDBONGOS_TEST_PROJECT: 'on' }), { p: 'on', c: true });
+  assert.deepEqual(read({ CLOUDBONGOS_TEST_PROJECT: '' }), { c: false }, 'the empty line every other project carries');
+});
+
+// ── the genesis switch, on the instance ────────────────────────────────────────
+
+function world({ test = true, settings = {} } = {}) {
+  const store = new Map(Object.entries(settings));
+  const deps = {
+    branding: { project: { test: test ? 'on' : '' } },
+    getSetting: async (k) => (store.has(k) ? { key: k, value: store.get(k) } : null),
+    setSetting: async (k, v) => { store.set(k, String(v)); return { key: k, value: String(v) }; },
+    lifecycle: { seedGenesis: async () => ({ seeded: 0 }), genesisTasks: async () => ({}) },
+    government: null,
+    now: new Date('2026-11-02T09:00:00Z'),
+  };
+  return { store, deps };
+}
+
+test('genesis cannot be switched on from a project that is not a test project', async () => {
+  const w = world({ test: false });
+  assert.deepEqual(await gh.setEnabled(true, 1, w.deps), { ok: false, reason: 'not_a_test_project' });
+  assert.deepEqual(await gh.ownerStart(1, w.deps), { ok: false, reason: 'not_a_test_project' });
+  assert.equal(w.store.size, 0, 'nothing is written');
+});
+
+test('on a test project the switch starts genesis, pauses it, and brings it back', async () => {
+  const w = world();
+  const on = await gh.setEnabled(true, 1, w.deps);
+  assert.equal(on.ok, true);
+  assert.equal(on.mode.active, true);
+  assert.equal(w.store.get(fm.KEYS.ENABLED), 'true');
+  const off = await gh.setEnabled(false, 1, w.deps);
+  assert.equal(off.ok, true);
+  assert.equal(off.mode, null, 'paused: the hall opens full');
+  assert.equal(w.store.get(fm.KEYS.ACTIVE), 'true', 'the founding record is kept');
+  const again = await gh.setEnabled(true, 1, w.deps);
+  assert.equal(again.mode.active, true, 'it comes back where it was');
+  assert.equal((await gh.ownerStart(1, world().deps)).ok, true, 'the owner\'s own start works on a test project');
+});
+
+test('a genesis that came alive cannot be switched back on', async () => {
+  const w = world({ settings: { [fm.KEYS.STARTED_AT]: '2026-11-01T00:00:00Z', [fm.KEYS.ENDED_AT]: '2026-11-01T05:00:00Z' } });
+  assert.deepEqual(await gh.setEnabled(true, 1, w.deps), { ok: false, reason: 'already_alive' });
+});

package/tests/update_channel_db.mjs

@@ -129,3 +129,27 @@ test('update-sweep.js reads the DB from its own env, never an entry env (which n
   // A core too old to carry the reader must keep the roster rather than crash the sweep.
   assert.match(src, /typeof channel\.readDbChannels === 'function'/);
 });
+
+// ---- task 1004150: the subscription roster lives on the project row too ----
+
+const subDb = (subs) => ({ ok: true, channels: new Map(), subscribed: new Map(Object.entries(subs)) });
+
+test('subscribed on the row: reported as deploy-sourced; a file-only entry is kept as an override', () => {
+  const { instances, unreachable } = uc.applyDbSubscriptions([entry(), entry({ slug: 'charter' })], subDb({ cloudbongos: true, charter: false }));
+  assert.equal(instances[0].subscribedSource, uc.CHANNEL_SOURCE_DEPLOY);
+  assert.equal(instances[1].subscribedSource, uc.CHANNEL_SOURCE_ROSTER);
+  assert.match(instances[1].subscribedNote, /roster file only/);
+  assert.deepEqual(unreachable, []);
+});
+
+test('subscribed on the row with no roster entry: surfaced as unreachable, never dropped', () => {
+  const { instances, unreachable } = uc.applyDbSubscriptions([], subDb({ mercury: true, venus: false }));
+  assert.equal(instances.length, 0);
+  assert.deepEqual(unreachable, ['mercury']);
+});
+
+test('database unreachable: the roster alone decides and nothing is reported unreachable', () => {
+  const { instances, unreachable } = uc.applyDbSubscriptions([entry()], { ok: false, reason: 'psql not found' });
+  assert.equal(instances.length, 1);
+  assert.deepEqual(unreachable, []);
+});

package/tests/wizard_demo.mjs

@@ -117,6 +117,9 @@ provisioning.getInstanceByDomain = async () => null;
 const order = [];
 const birth = require('../modules/provisioning/birth.js');
 birth.stampBirth = async (_db, id) => { order.push(`birth:${id}`); };
+const testProject = require('../modules/provisioning/test-project.js');
+testProject.stampTestProject = async (_db, id) => { order.push(`test:${id}`); };
+let rank = 'metic';   // who is asking: a test project is an archon's alone (task 1005036)
 provisioning.createInstance = async (_db, args) => {
   created = args;
   const fresh = args.slug !== 'old-one';
@@ -126,7 +129,7 @@ provisioning.enqueueIntent = async (_db, _id, action) => { order.push(`enqueue:$
 provisioning.getOpenIntent = async () => null;
 provisioning.recordEvent = async () => {};
 demo.startDemoProject = async (_db, _p, id, d) => { started = { id, d }; order.push(`demo:${id}`); return null; };
-api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner', rank }; next(); };
 let stored = null;
 provisioning.getInstanceById = async (_db, id) => (id === 41 ? { id: 41, owner_builder_id: 7, demo: stored } : null);
 api.pool.query = async (sql, params) => { if (/UPDATE provisioning_instances SET demo/.test(sql)) stored = JSON.parse(params[1]); return { rows: [] }; };
@@ -173,8 +176,26 @@ test('a new project is stamped born, once, before its provision intent; an exist
   assert.equal((await post('/provisioning/instances', { slug: 'born-real', hosting_shape: 'byo-host' })).status, 201);
   assert.deepEqual(order, ['enqueue:provision'], 'a real project opens as the full hall: genesis is off by default (owner, 2026-11-01)');
   order.length = 0;
-  assert.equal((await post('/provisioning/instances', { slug: 'born-test', hosting_shape: 'byo-host', genesis: true })).status, 201);
-  assert.deepEqual(order, ['birth:41', 'enqueue:provision'], 'the genesis toggle still births a test project, with no demo box');
+  // A test project (task 1005036): an archon's alone, marked once on the row, and the only way to be born with genesis.
+  const asked = await post('/provisioning/instances', { slug: 'sneaky', hosting_shape: 'byo-host', test: true });
+  assert.equal(asked.status, 403, 'a non-archon cannot make one');
+  assert.equal(asked.body.error.code, 'test_project_forbidden');
+  assert.deepEqual(order, [], 'and nothing is made, marked or queued');
+  const bare = await post('/provisioning/instances', { slug: 'bare-genesis', hosting_shape: 'byo-host', genesis: true });
+  assert.equal(bare.status, 400, 'genesis alone is no longer a way in');
+  assert.equal(bare.body.error.code, 'genesis_needs_test');
+  assert.deepEqual(order, []);
+  rank = 'archon';
+  try {
+    assert.equal((await post('/provisioning/instances', { slug: 'sandbox-a', hosting_shape: 'byo-host', test: true })).status, 201);
+    assert.deepEqual(order, ['test:41', 'enqueue:provision'], 'a test project is marked, not born into genesis');
+    order.length = 0;
+    assert.equal((await post('/provisioning/instances', { slug: 'sandbox-g', hosting_shape: 'byo-host', test: true, genesis: true })).status, 201);
+    assert.deepEqual(order, ['birth:41', 'test:41', 'enqueue:provision'], 'a test project that asks for genesis is born into it, marked, before the runner can read it');
+    order.length = 0;
+    assert.equal((await post('/provisioning/instances', { slug: 'archon-real', hosting_shape: 'byo-host' })).status, 201);
+    assert.deepEqual(order, ['enqueue:provision'], 'an ordinary project made by an archon is still an ordinary project');
+  } finally { rank = 'metic'; }
   order.length = 0;
   const again = await post('/provisioning/instances', { slug: 'old-one', hosting_shape: 'byo-host' });
   assert.ok(again.status < 300, JSON.stringify(again.body));
@@ -182,7 +203,7 @@ test('a new project is stamped born, once, before its provision intent; an exist
   const keep = birth.stampBirth;
   birth.stampBirth = async () => { throw new Error('db hiccup'); };
   try {
-    assert.equal((await post('/provisioning/instances', { slug: 'unlucky', hosting_shape: 'byo-host', genesis: true })).status, 201,
+    assert.equal((await post('/provisioning/instances', { slug: 'unlucky', hosting_shape: 'byo-host', demo: { people: 2, hours_each: 3 } })).status, 201,
       'a missed marker costs the project its genesis, never its creation');
   } finally { birth.stampBirth = keep; }
 });