@bongos/core 1.25.5 → 1.25.6

package/modules/hall-ui/records/start-screen.md

@@ -29,3 +29,13 @@ Tests: `tests/hall_start_screen.mjs` (the hand-off and pure parts in a vm; both
 Every sign-in now opens on a chooser before the start screen: **Game** or **Classic**, each with one line saying what it is. The view chosen last time (the browser's `hall-game` copy) is marked "Last time", lit with the accent on its edge, and focused, so Enter keeps it. Game goes on to the start screen as before; Classic closes the screen and the hall is as it always was. Either choice is saved to the account (`PATCH /api/bongos/me/hall-view`). The Extras list lost The docs: it is not a game place. Tests: `tests/hall_start_screen.mjs`.
 
 **In the start menu's shape (task 1005206, owner 2026-11-11, from the V3 Helm start-screen mock-up).** The chooser is drawn like the menu it leads to: "How do you want to see it?" is a small label in the name voice, and the view Enter takes (last time's, else Game) is the accent bar with its "Enter" key, exactly as Start is (`.gs__item--lit` shares Start's rules); the other view is a quiet row on a hairline. Each row keeps its one line; on the lit bar the line and the "Last time" tag take `--accent-on`. Focus starts on the lit row.
+
+## Land on the chooser (task 1005219, owner 2026-11-12)
+
+The hall's front (Home, `/builders`) now opens on the Game / Classic chooser **every time the site is opened**, signed in or not: one `sessionStorage` mark per tab (`hall-chooser-seen`), so moving about the hall — game mode sends a classic page Home — never asks twice. This supersedes "a new visit keeps the welcome" and "a signed-out visitor keeps the welcome" above; the painted welcome remains only for a hall without `shell-game.js` and for the day's first visit to a page other than Home.
+
+- **Signed out:** the pick is kept in `localStorage` (`hall-view-pending`) and the visitor goes to GitHub sign-in (`/api/bongos/auth/web/start`, which returns by the referer). On the return `start()` spends the pick: Game opens straight on the start screen's menu, Classic shows no screen and the hall is as it always was. Either is saved to the account then, as at the chooser.
+- **Signed in:** the pick goes straight to that menu, as at sign-in.
+- The marketing page at the apex root is unchanged (the owner's pick: the hall's front, not the apex).
+
+Tests: `tests/hall_start_screen.mjs` (the vm hand-off, and the signed-out round trip for both picks in a real browser).

package/modules/onboarding/genesis-home.js

@@ -276,6 +276,40 @@ async function startFounding(builderId, deps = {}) {
   return { ok: true, mode };
 }
 
+// isTestProject(deps) — is this hall a TEST project? The platform marks one (task 1005036,
+// modules/provisioning/test-project.js) and the mark arrives as branding project.test. Genesis is paused
+// for every other project (owner, 2026-11-01), so only a test project may switch it on by hand.
+function isTestProject(deps = {}) {
+  try {
+    const b = deps.branding !== undefined ? deps.branding : require('../../src/module-api').branding();
+    return !!(b && b.project && b.project.test === 'on');
+  } catch (_) { return false; }
+}
+
+// ownerStart(builderId, deps) — the owner's own start (POST /founding/start): a test project only.
+async function ownerStart(builderId, deps = {}) {
+  if (!isTestProject(deps)) return { ok: false, reason: 'not_a_test_project' };
+  return startFounding(builderId, deps);
+}
+
+// setEnabled(enabled, builderId, deps) — the Test features panel's genesis switch (task 1005036): a test
+// project only. On starts genesis if it never started (startFounding turns the switch on); if it already
+// began, it just turns the switch back on. Off pauses it — the founding record is kept, the hall opens full.
+async function setEnabled(enabled, builderId, deps = {}) {
+  if (!isTestProject(deps)) return { ok: false, reason: 'not_a_test_project' };
+  const s = seams(deps);
+  if (enabled === true) {
+    const started = await s.get(fm.KEYS.STARTED_AT);
+    if (!(started && started.value)) return startFounding(builderId, deps);
+    const ended = await s.get(fm.KEYS.ENDED_AT);
+    if (ended && ended.value) return { ok: false, reason: 'already_alive' };
+    await s.set(fm.KEYS.ENABLED, 'true', builderId);
+  } else {
+    await s.set(fm.KEYS.ENABLED, 'false', builderId);
+  }
+  return { ok: true, enabled: enabled === true, mode: await fm.foundingModeFor(modeDeps(s)) };
+}
+
 // savePlan — the decide stage's door: record the plan, file the five stages as tasks,
 // and move to scope. Only while deciding.
 async function savePlan(body, builderId, deps = {}) {
@@ -508,7 +542,7 @@ async function onTaskShipped(deps = {}) {
 
 module.exports = {
   PLAN_KEY, STAGE_INFO, PROPER, DEMO_PEOPLE, DEMO_HOURS, intIn, parsePlan, shapeGenesis, demoMinutes, demoPlan,
-  readGenesis, startFounding, savePlan, applyGovernmentChoice, closeStage, comeAlive, skipGenesis, onStagePassed,
+  readGenesis, startFounding, ownerStart, setEnabled, savePlan, applyGovernmentChoice, closeStage, comeAlive, skipGenesis, onStagePassed,
   putFinishedStages, onTaskShipped,
   // the founding-mode deps this file reads the mode with, for founding-birth.js (task 1004506)
   modeDepsFor: (deps) => modeDeps(seams(deps)),

package/modules/onboarding/routes/onboarding.js

@@ -124,7 +124,7 @@ const GENESIS_REFUSALS = {
   not_at_legislation: 409, legislation_not_passed: 409, stage_tasks_unfinished: 409,
   no_stage_tasks: 409, unknown_stage: 400, no_board: 503,
   bad_days: 400, bad_passes: 400, bad_advisors: 400, bad_government: 400, bad_expected_builders: 400,
-  bad_demo: 400, bad_minutes: 400,
+  bad_demo: 400, bad_minutes: 400, not_a_test_project: 403,
 };
 let genesisListening = false;
 
@@ -158,7 +158,12 @@ function mountGenesisRoutes(router) {
     await foundingBirth.ensureBirth();
     return { genesis: await genesis.readGenesis(), viewer_id: String(req.builder.id) };
   }));
-  router.post('/founding/start', api.requireBuilder, owns, handle((req) => genesis.startFounding(req.builder.id)));
+  router.post('/founding/start', api.requireBuilder, owns, handle((req) => genesis.ownerStart(req.builder.id)));
+  // The Test features panel's genesis switch (task 1005036): a test project only, the owner's call.
+  router.put('/founding/enabled', api.requireBuilder, owns, (req, res, next) => {
+    if (api.validateOrRespond(req, res, { enabled: { type: 'boolean' } })) return;
+    next();
+  }, handle((req) => genesis.setEnabled(req.body && req.body.enabled === true, req.builder.id)));
   // The plan's ranges and vocabularies are genesis-home.js parsePlan's (one source);
   // this schema only names the fields so an unknown one is refused.
   router.post('/founding/plan', api.requireBuilder, owns, (req, res, next) => {

package/modules/provisioning/catalog-bridge.js

@@ -19,6 +19,7 @@
 
 const api = require('../../src/module-api');
 const { effectiveSettings } = require('./provisioning');
+const { isTestProject } = require('./test-project');
 
 const log = api.logger('provisioning');
 
@@ -57,6 +58,8 @@ function catalogStatusForInstance(row) {
 }
 
 function catalogEntryForInstance(row, { ownerGithubId } = {}) {
+  // A test project is never on the public map (task 1005036, ./test-project.js): the honest refusal, not a failure.
+  if (isTestProject(row)) return null;
   const origin = catalogOriginForInstance(row);
   if (!origin) return null;
   const owner = Number(ownerGithubId);

package/modules/provisioning/paid-shape-gate.js

@@ -104,6 +104,7 @@ const ONE_FREE_SHAPES = Object.freeze(new Set(['cloud-host']));
 // the response closes, so a second request sent meanwhile — from any web process — is
 // refused (the wizard never sends two). ./free-place-lock.js says how it is held.
 const freePlace = require('./free-place-lock');
+const { isTestProject } = require('./test-project');
 
 // Shapes that are not requestable through this route AT ALL — no permission admits them,
 // because there is no rank at which "ask the API for a second control plane" is a
@@ -159,7 +160,8 @@ function shapeAuthority(rawShape) {
 async function otherLiveProjects(db, builderId, shape, rawSlug) {
   const slug = String(rawSlug || '').trim().toLowerCase();
   const rows = await provisioning.listInstancesForOwner(db, builderId);
-  return rows.filter((r) => r.hosting_shape === shape && r.status !== 'torn_down' && r.slug !== slug);
+  // A test project holds no free place (task 1005036): it is for trying features, and only an archon makes one.
+  return rows.filter((r) => r.hosting_shape === shape && r.status !== 'torn_down' && r.slug !== slug && !isTestProject(r));
 }
 
 // requireAuthorityForShape — the create route's shape gate. Mount it AFTER requireBuilder

package/modules/provisioning/provisioning.js

@@ -23,7 +23,7 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // pure declarations beside this file, for the same reason: storage and the read
 // projection both have to read them.
 const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
-const { softLimitsFor } = require('./soft-limits'); const { demoView } = require('./demo');   // the demo marker's owner view (task 1004420)
+const { softLimitsFor } = require('./soft-limits'); const { demoView } = require('./demo'); const { isTestProject, TEST_COMPANION_ENV } = require('./test-project');   // the demo marker's owner view (task 1004420); the test mark (task 1005036)
 const { dnsResolves, recordDnsResolved, lookupAnswers } = require('./dns-resolves');   // has the platform's lookup seen the address answer (task 1004505)
 const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look'); const { BIRTH_COMPANION_ENV } = require('./birth'); // born into genesis (task 1004506)
 
@@ -453,7 +453,7 @@ function publicInstance(row) {
     detail,
     // Which startup options those answers hide, grey or annotate, each with its reason
     // (BV2.PS02, spec D6). Advice only — `enforced: false` says so on every read.
-    soft_limits: softLimitsFor(detail), demo: demoView(row),   // null unless a demo nobody carried over (task 1004420, ./demo.js)
+    soft_limits: softLimitsFor(detail), demo: demoView(row), is_test: isTestProject(row),   // null unless a demo nobody carried over (task 1004420, ./demo.js)
     // The creation picker's module set (task 1002339): the always-on core, what
     // the owner ends up with, and whether that came from their own toggles or
     // from the type's starter bundle because they never answered. Resolved, not
@@ -513,7 +513,7 @@ function settingsEnvVars(row, prefix) {
 // cutoff and every unresolved review counts, which is the right answer for a
 // project that has been strict since it stood up.
 const SETTINGS_COMPANION_ENV = Object.freeze({
-  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, ...BIRTH_COMPANION_ENV, // + accent, logo (look.js); birth, demo box (birth.js)
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, ...BIRTH_COMPANION_ENV, ...TEST_COMPANION_ENV, // + accent, logo (look.js); birth, demo box (birth.js); test mark (test-project.js)
 });
 
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that

package/modules/provisioning/routes/provisioning.js

@@ -64,7 +64,7 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page'); const githubSetup = require('../github-setup');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth'); const testProject = require('../test-project');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
 const { requireProjectOwner, projectActor, isProjectOwner } = require('../route-helpers');   // the owner-or-archon gate (task 1004159, ADR 0328)
@@ -361,7 +361,7 @@ module.exports = function provisioningRoutes() {
       // exactly the set the panel preselected. An explicit [] is the different
       // answer "none of them". maxItems is a sanity ceiling well above a catalog
       // that is three modules wide today.
-      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' }, demo: { type: 'object' }, ship_mode: { type: 'string', enum: ['auto', 'manual'] }, genesis: { type: 'boolean' },   // the wizard's terms tick (task 1004417, ../terms-ack.js); the demo route's { people, hours_each } (task 1004420, ../demo.js)
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' }, demo: { type: 'object' }, ship_mode: { type: 'string', enum: ['auto', 'manual'] }, genesis: { type: 'boolean' }, test: { type: 'boolean' },   // the wizard's terms tick (task 1004417, ../terms-ack.js); the demo route's { people, hours_each } (task 1004420, ../demo.js)
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
@@ -372,6 +372,8 @@ module.exports = function provisioningRoutes() {
     if (screened) return res.fail('screened_out', screened);
     const demoAsk = demo.parseDemo(body.demo);   // a demo is a normal project marked demo, its picked answers under the owner's own (task 1004420)
     if (!demoAsk.ok) return res.fail('bad_demo', { status: 400, message: demoAsk.reason });
+    const testAsk = testProject.parseTestAsk(body, req.builder);   // a test project: archon only; genesis only on one (task 1005036, ../test-project.js)
+    if (!testAsk.ok) return res.fail(testAsk.code, { status: testAsk.status, message: testAsk.message });
     const slug = String(body.slug || '').trim().toLowerCase();
     if (!provisioning.isValidSlug(slug)) {
       return res.fail('bad_slug', 400, { reason: 'lowercase, 2–40 chars of [a-z0-9-], no leading/trailing/double dash' });
@@ -477,8 +479,9 @@ module.exports = function provisioningRoutes() {
       // provision intent exists, so the runner's web.env already carries the marker and the demo's box.
       // Best-effort: a project that misses its marker opens as an ordinary hall; the create still stands.
       // Genesis is OFF by default (owner, 2026-11-01): a new project opens as the full hall. Only a demo (its
-      // time box lives on the birth marker) or an explicit `genesis: true` (the test toggle) is born into it.
-      if (created && (demoAsk.demo || body.genesis === true)) await birth.stampBirth(pool, instance.id).catch((err) => log.error('[provisioning] birth marker not stamped', err));
+      // time box lives on the birth marker) or a test project asking for genesis is born into it.
+      if (created && (demoAsk.demo || testAsk.genesis)) await birth.stampBirth(pool, instance.id).catch((err) => log.error('[provisioning] birth marker not stamped', err));
+      if (created && testAsk.test) await testProject.stampTestProject(pool, instance.id).catch((err) => log.error('[provisioning] test mark not stamped', err));
       // The wizard's ship mode (task 1004629) rides beside it; a miss means the project asks at its first ship.
       if (created) await birth.stampShipMode(pool, instance.id, body.ship_mode).catch((err) => log.error('[provisioning] ship mode not stamped', err));
       const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;

package/modules/provisioning/test-project.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// modules/provisioning/test-project.js — a TEST project: one made to try features that are not
+// live yet (task 1005036, idea 1001299; owner, 2026-11-01).
+//
+// A test project is an ordinary project with a mark on it. The mark changes four things and
+// nothing else: it is labelled, it never reaches the public map, it does not count toward a
+// builder's one free hosted project, and it is the only kind that may switch not-yet-live
+// features on (genesis today; the opt-in modules through the hall's own toggle). A project
+// without the mark behaves exactly as before, which is the property the tests pin.
+//
+// WHO MAY MAKE ONE. Archon only — a plain rank test, as route-helpers.js's archon override
+// is, never a permission atom. Unfinished features are for the people building the platform,
+// and a test project is not a way around the one-free-project limit for anyone else.
+//
+// WHERE THE MARK LIVES. The reserved settings-jsonb key `test_project`, stamped once on the
+// row the create route just made (never on an existing row), like `founding_birth` beside it.
+// It is out of SETTINGS_VOCAB, so the settings PATCH cannot write it and effectiveSettings
+// never projects it. It reaches the instance as the companion TEST_PROJECT, which
+// src/branding.js maps onto `project.test` — that is how the hall labels itself and how the
+// instance refuses the feature switches on a project that is not a test one.
+
+const TEST_KEY = 'test_project';
+
+const storedOf = (row) => (row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings) ? row.settings : {});
+
+// isTestProject(row) — PURE. True only for a row stamped 'on'.
+function isTestProject(row) {
+  return storedOf(row)[TEST_KEY] === 'on';
+}
+
+// parseTestAsk(body, builder) — PURE. What the create request asks for: { ok: true, test, genesis },
+// or { ok: false, status, code, message }. `genesis: true` is the test project's way of being
+// born with genesis on, so it means nothing without `test: true`.
+function parseTestAsk(body, builder) {
+  const b = body && typeof body === 'object' ? body : {};
+  const test = b.test === true;
+  const genesis = b.genesis === true;
+  if (genesis && !test) {
+    return { ok: false, status: 400, code: 'genesis_needs_test', message: 'Genesis is only switched on for a test project: send "test": true as well.' };
+  }
+  if (test && !(builder && builder.rank === 'archon')) {
+    return { ok: false, status: 403, code: 'test_project_forbidden', message: 'Only an archon can create a test project.' };
+  }
+  return { ok: true, test, genesis };
+}
+
+// stampTestProject(db, instanceId) — the create route's one write, on the row it just made.
+// Write-once: a mark already there is kept (the WHERE says so).
+async function stampTestProject(db, instanceId) {
+  await db.query(
+    `UPDATE provisioning_instances
+        SET settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object($2::text, 'on')
+      WHERE id = $1 AND NOT (COALESCE(settings, '{}'::jsonb) ? $2::text)`,
+    [instanceId, TEST_KEY],
+  );
+}
+
+// The companion env (SETTINGS_COMPANION_ENV): 'on' for a test project, empty for every other,
+// so the runner's in-place patch never leaves a stale line behind.
+const TEST_COMPANION_ENV = Object.freeze({
+  TEST_PROJECT: (row) => (isTestProject(row) ? 'on' : ''),
+});
+
+module.exports = { isTestProject, parseTestAsk, stampTestProject, TEST_COMPANION_ENV };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.5",
+  "version": "1.25.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.5",
+      "version": "1.25.6",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.5",
+  "version": "1.25.6",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11728,5 +11728,15 @@
       "id": "1004150",
       "text": "The fleet view can now show which projects get automatic patch upgrades, and the nightly upgrade run says so out loud when it has nothing to do."
     }
+  ],
+  "1.25.6": [
+    {
+      "id": "1005036",
+      "text": "An archon can now create a test project: a project marked for trying features that are not finished. It stays off the public map, does not use up anyone's one free hosted project, and is the only kind where the guided setup ca"
+    },
+    {
+      "id": "1005219",
+      "text": "Opening the builders' hall now starts on the Game or Classic choice. Signed out, your pick takes you to sign in and then straight to that menu."
+    }
   ]
 }

package/scripts/bongos/government-walk.js

@@ -610,8 +610,8 @@ async function runWalk() {
   const instanceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'government-walk-'));
   process.env.BONGOS_INSTANCE_ROOT = instanceRoot;
   delete process.env.DATABASE_URL; // the walk never touches a real database
-  // The modules' info lines (a fence switched, a budget set) would bury the table.
-  if (!process.env.LOG_LEVEL) process.env.LOG_LEVEL = 'warn';
+  process.env.BONGOS_TEST_PROJECT = 'on'; // a TEST project: only one starts genesis by hand (task 1005036)
+  if (!process.env.LOG_LEVEL) process.env.LOG_LEVEL = 'warn'; // info lines would bury the table
 
   const req = (rel) => require(path.join(ROOT, rel));
   const api = req('src/module-api.js');

package/src/branding.js

@@ -94,6 +94,9 @@ const ENV_OVERRIDES = [
   ['NIGHT_TINT', ['project', 'nightTint']],
   ['LOOK_ACCENT', ['project', 'lookAccent']],
   ['LOGO_URL', ['project', 'logoUrl']],
+  // 'on' only on a TEST project (task 1005036, modules/provisioning/test-project.js): the hall labels itself
+  // and the not-yet-live feature switches open. Empty on every other project.
+  ['TEST_PROJECT', ['project', 'test']],
   // The birth marker (task 1004506): set by the platform only on a project created
   // through the startup flow, so a project made before that never has it (spec D8).
   // FOUNDING_BIRTH is when the platform made the row; DEMO_PEOPLE / DEMO_HOURS are the
@@ -258,6 +261,10 @@ function clientBranding(b = branding()) {
         mark: b.identity?.company?.mark || '',
       },
     },
+    // A TEST project (task 1005036, modules/provisioning/test-project.js): the hall labels itself and the
+    // not-yet-live feature switches open. Beside `project`, not in it: that block is the settings the
+    // platform pushes, key for key, and this is a mark, not a setting.
+    testProject: b.project?.test === 'on',
     currency: {
       label: b.currency?.label || 'credits',
       symbol: b.currency?.symbol || '',

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.6'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/currency_label.mjs

@@ -84,7 +84,9 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // had been failing since that landed (task 1002470).
   // `project` joined the allow-list in task 1003140: the per-project policy is public
   // by nature and is the settings read-back a manage page needs (see clientBranding).
-  assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'project', 'rankLabels', 'reward', 'theme']);
+  assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'project', 'rankLabels', 'reward', 'testProject', 'theme']);
+  // `testProject` joined in task 1005036: the platform's test-project mark ('on' or
+  // not), public by nature: the hall labels itself and opens its not-yet-live switches.
   // `artistGate` joined in task 1003575 (ADR 0241) — the project's artist strictness,
   // public for the same read-back reason as its neighbours. Its companion stamp
   // (artistGateSince) deliberately does NOT: that is platform bookkeeping the server

package/tests/hall_start_screen.mjs

@@ -23,17 +23,20 @@ const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const CITY = fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'home__city.json'), 'utf8');
 
 // ---------- in a vm: the pure parts and the welcome's hand-off ----------
-function sandbox({ store = {}, game = true } = {}) {
-  const started = [], asked = [];
+function sandbox({ store = {}, session = {}, game = true } = {}) {
+  const started = [], asked = [], went = [];
   const window = {
-    location: { search: '', pathname: '/', hash: '' },
+    location: { search: '', pathname: '/', hash: '', assign: (h) => went.push(h) },
     __BRANDING__: { identity: { worldName: 'Harbor' } },
     localStorage: {
       getItem: (k) => (k in store ? store[k] : null),
       setItem: (k, v) => { store[k] = String(v); },
       removeItem: (k) => { delete store[k]; },
     },
-    sessionStorage: { getItem: () => null, setItem() {} },
+    sessionStorage: {
+      getItem: (k) => (k in session ? session[k] : null),
+      setItem: (k, v) => { session[k] = String(v); },
+    },
     OTBCraftMode: { markAsked: () => asked.push('marked'), onAccess: (a, b) => asked.push(['picker', a.authed, b.id]) },
   };
   const document = { documentElement: { dataset: {}, classList: { add() {}, remove() {} } }, addEventListener() {} };
@@ -44,7 +47,7 @@ function sandbox({ store = {}, game = true } = {}) {
     window.OTBShellGame.start = (o) => { started.push(o); return true; };
   }
   vm.runInContext(read('welcome-boot.js'), box, { filename: 'welcome-boot.js' });
-  return { window, store, started, asked };
+  return { window, store, session, started, asked, went };
 }
 
 test('the menu is Start, Options, Achievements, Extras, Quit, in that order', () => {
@@ -105,10 +108,27 @@ test('a fresh sign-in is handed to the start screen with the still, and the craf
   assert.deepEqual(s.asked, [['picker', true, 7]], 'the picker is asked once the world is showing');
 });
 
-test('a visit that is not a fresh sign-in keeps the welcome, and a hall without shell-game.js greets a sign-in as before', () => {
-  const daily = sandbox();
+test('every visit to Home opens on Game or Classic, signed in or not (task 1005219)', () => {
+  const visit = sandbox();
+  assert.equal(visit.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
+  assert.deepEqual([visit.started.length, visit.asked], [1, []], 'a new visit, signed in, is the chooser, not the welcome');
+  const deep = sandbox();
+  deep.window.location.pathname = '/goals';
+  assert.equal(deep.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
+  assert.equal(deep.started.length, 0, 'only Home asks; a page deeper in keeps the day\'s welcome');
+  const out = sandbox();
+  assert.equal(out.window.OTBWelcome.onAccess({ authed: false }, null), true);
+  assert.equal(out.started.length, 1, 'signed out, the chooser stands in for the painted welcome');
+  assert.equal(typeof out.started[0].signIn, 'function', 'and a pick goes on to sign in');
+  out.started[0].signIn();
+  assert.deepEqual([out.went, out.store['hall-welcome-signin']], [['/api/bongos/auth/web/start'], '1'],
+    'to GitHub, remembered as a sign-in so the return opens the picked menu');
+});
+
+test('within one visit, Home asks once; the day\'s welcome stays for a later page, and a hall without shell-game.js greets a sign-in as before', () => {
+  const daily = sandbox({ session: { 'hall-chooser-seen': '1' } });
   assert.equal(daily.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
-  assert.deepEqual([daily.started.length, daily.asked], [0, ['marked']], 'the day\'s first visit is the welcome\'s');
+  assert.deepEqual([daily.started.length, daily.asked], [0, ['marked']], 'asked already this visit: the day\'s first visit is the welcome\'s');
   const bare = sandbox({ store: { 'hall-welcome-signin': '1' }, game: false });
   assert.equal(bare.window.OTBWelcome.onAccess({ authed: true }, { id: 7 }), true);
   assert.deepEqual(bare.asked, ['marked']);
@@ -286,6 +306,40 @@ test('choosing Classic at sign-in closes the screen, leaves game mode off, and s
   await ctx.close();
 });
 
+// task 1005219: the hall's front opens on the chooser signed out; the pick goes to sign-in and the
+// return opens that menu without asking again — the start screen for Game, the plain hall for Classic.
+test('signed out, a pick goes to sign-in, and the return opens the picked menu without asking again', { skip }, async () => {
+  for (const pick of ['game', 'classic']) {
+    const ctx = await hall();
+    await ctx.route(ORIGIN + '/api/bongos/auth/web/start', (route) => route.fulfill({ contentType: 'text/html', body: 'github' }));
+    const page = await ctx.newPage();
+    await page.goto(ORIGIN + '/');
+    await page.waitForFunction(() => !!window.OTBShell && !!window.OTBWelcome && !!window.OTBShellGame);
+    await page.evaluate(() => window.OTBShell.applyAccess({ authed: false }));
+    await page.waitForSelector('#game-start');
+    assert.equal((await state(page)).welcome, false, 'the chooser, not the painted welcome');
+    await Promise.all([page.waitForURL(ORIGIN + '/api/bongos/auth/web/start'), page.click(`[data-gs="view-${pick}"]`)]);
+    assert.deepEqual(await page.evaluate(() => [localStorage.getItem('hall-view-pending'), localStorage.getItem('hall-welcome-signin')]), [pick, '1']);
+
+    // back from GitHub, signed in
+    await page.goto(ORIGIN + '/');
+    await page.waitForFunction(() => !!window.OTBShell && !!window.OTBWelcome && !!window.OTBShellGame);
+    await page.evaluate(() => { const me = { authed: true, rank: 'metic', builder: { id: 7, display_name: 'Ada', github_login: 'ada' } }; window.OTBShell.applyAccess(me); window.OTBShell.applyAccess(me); });
+    await page.evaluate(() => new Promise((r) => setTimeout(r, 100)));
+    const s = await state(page);
+    if (pick === 'game') {
+      assert.equal(s.start, true, 'Game: the start screen');
+      assert.equal(await page.isVisible('#gs-items'), true, 'on its menu');
+      assert.equal(await page.isVisible('#gs-views'), false, 'not asked again');
+      assert.equal(s.game, 'on');
+    } else {
+      assert.deepEqual([s.start, s.welcome, s.game], [false, false, null], 'Classic: the hall, no screen, game mode off');
+    }
+    assert.equal(await page.evaluate(() => localStorage.getItem('hall-view-pending')), null, 'the pick is spent');
+    await ctx.close();
+  }
+});
+
 test('on a phone the panel is the whole width, nothing scrolls sideways and every choice clears the floor (task 1005192)', { skip }, async () => {
   for (const [w, h] of [[390, 844], [320, 700]]) {
     const ctx = await hall({ viewport: { width: w, height: h } });

package/tests/provision_settings_apply.mjs

@@ -80,6 +80,7 @@ ${NEUTRAL_PREFIX}_FOUNDING_GENESIS=
 ${NEUTRAL_PREFIX}_DEMO_PEOPLE=
 ${NEUTRAL_PREFIX}_DEMO_HOURS=
 ${NEUTRAL_PREFIX}_SHIP_MODE=
+${NEUTRAL_PREFIX}_TEST_PROJECT=
 ${NEUTRAL_PREFIX}_HUB_UPGRADE_URL=
 `;
 
@@ -151,7 +152,7 @@ t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at stan
     // the birth marker and a demo's box (task 1004506), empty on an un-stamped row
     [`${NEUTRAL_PREFIX}_FOUNDING_BIRTH`]: '', [`${NEUTRAL_PREFIX}_FOUNDING_GENESIS`]: '', [`${NEUTRAL_PREFIX}_DEMO_PEOPLE`]: '', [`${NEUTRAL_PREFIX}_DEMO_HOURS`]: '',
     // the wizard's ship mode (task 1004629), empty when none was picked
-    [`${NEUTRAL_PREFIX}_SHIP_MODE`]: '',
+    [`${NEUTRAL_PREFIX}_SHIP_MODE`]: '', [`${NEUTRAL_PREFIX}_TEST_PROJECT`]: '',
     // where the hall's Update button goes (task 1004608), empty when no hub origin resolves
     [`${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`]: '',
   });

package/tests/provisioning_paid_shape_gate.mjs

@@ -243,6 +243,22 @@ await ta('cloud-host: ADMITTED past the limit for a builder holding provisioning
   assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
 });
 
+await ta('cloud-host: a TEST project holds no free place, so it does not make the next one a second (task 1005036)', async () => {
+  // Only an archon makes a test project, and it is for trying features: counting it would
+  // charge a builder's one free place for a project nobody meant to keep.
+  held = [];
+  owned = [{ ...LIVE_HOSTED, slug: 'sandbox', settings: { test_project: 'on' } }];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  assert.equal(res.status, 201, 'a test project alone leaves the free place free: ' + res.raw);
+  held = [];
+  owned = [LIVE_HOSTED, { ...LIVE_HOSTED, slug: 'sandbox', settings: { test_project: 'on' } }];
+  lastCreateArgs = null;
+  const second = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
+  assert.equal(second.status, 403, 'a real project plus a test one still counts the real one');
+});
+
 // ── control-plane is not requestable AT ALL (task 1003370) ────────────────────────
 
 await ta('control-plane: refused for an unprivileged builder, and the refusal is not a permission', async () => {

package/tests/provisioning_settings_env.mjs

@@ -128,7 +128,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     // route never stamped, which is every row made before it shipped (spec D8).
     CLOUDBONGOS_FOUNDING_BIRTH: '', CLOUDBONGOS_FOUNDING_GENESIS: '', CLOUDBONGOS_DEMO_PEOPLE: '', CLOUDBONGOS_DEMO_HOURS: '',
     // The wizard's ship mode (task 1004629): empty when none was picked.
-    CLOUDBONGOS_SHIP_MODE: '',
+    CLOUDBONGOS_SHIP_MODE: '', CLOUDBONGOS_TEST_PROJECT: '',
   });
   // varsOf splits on '=', so an empty value reads as '' on both sides — the point
   // of the comparison is that the standup lines carry exactly the same key set.
@@ -137,7 +137,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
     X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '', X_SPEND_PAYER: 'none',
     X_LOOK: 'own', X_NIGHT_TINT: 'on', X_LOOK_ACCENT: '', X_LOGO_URL: '',
-    X_FOUNDING_BIRTH: '', X_FOUNDING_GENESIS: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '',
+    X_FOUNDING_BIRTH: '', X_FOUNDING_GENESIS: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '', X_TEST_PROJECT: '',
   }, 'defaults, explicitly');
 });