@bongos/core 1.19.419 → 1.19.421

package/tests/module_api.mjs

@@ -24,6 +24,7 @@ const PUBLISHED_SURFACE = [
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
+  'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
   'routeRankCheck', 'permissionPathCheck', // BV1.R73: kernel trust classifiers (1.6.0)
   'repoInfo', 'moduleScopeMap', 'pathMatch', // BV1.R86: kernel repo-identity + scope-wall + touches-overlap for the carved lifecycle (1.12.0)
   'goalScopeCheck', // BV1.R60: kernel scope wall for the goal-authored-task create gate (1.13.0; ADR 0086 §3)

package/tests/onboard.mjs

@@ -31,6 +31,62 @@ test('onboardPlan is the canonical sequence: name+address first, the builders ha
   assert.ok(keys.indexOf('device-flow') < keys.indexOf('first-sign-in'), 'checkbox prompted before sign-in');
 });
 
+test('the OPTIONAL project-detail step sits in the canonical sequence, and optional means skippable (task 1002334)', () => {
+  const plan = ob.onboardPlan();
+  const keys = plan.map((s) => s.key);
+  const step = plan.find((s) => s.key === 'project-detail');
+  assert.ok(step, 'the interview is a real step in the sequence, not a wizard-only flourish');
+  assert.equal(keys.indexOf('project-detail'), keys.indexOf('name-address') + 1,
+    'it follows the name interview — the project is described before its repo and address are decided');
+  assert.equal(step.optional, true, 'the flag is what tells a form it may be walked past');
+  assert.equal(step.kind, 'auto',
+    "'auto' like name-address: the FORM collects it, so a done panel of outstanding human steps must not list it");
+  // one optional step keeps the flag meaningful; a second would need its own rule
+  assert.deepEqual(plan.filter((s) => s.optional).map((s) => s.key), ['project-detail']);
+  // and the adopt branch carries it identically — the sequence branches only at scaffold
+  assert.ok(ob.onboardPlan('adopt').some((s) => s.key === 'project-detail' && s.optional === true));
+});
+
+test('every form OFFERS the optional step and names what skipping costs — skill / CLI / wizard / route (task 1002334)', () => {
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const read = (rel) => readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
+
+  // the skill — the source of truth for the sequence
+  const skill = read('.claude/skills/new-project/SKILL.md');
+  assert.match(skill, /OPTIONAL/, 'the canonical runbook marks the step optional');
+  assert.match(skill, /team_shape/, 'and names the answers that ride the request');
+  assert.match(skill, /dark matter/i, 'and states what skipping costs');
+
+  // the CLI form
+  const cli = read('scripts/gds/onboard.js');
+  assert.match(cli, /Press Enter to skip/, 'the terminal form offers the skip in the prompt itself');
+  assert.match(cli, /off the public map/, 'and says what a missing description means');
+
+  // the web form
+  const hub = read('public-landing/projects.html');
+  assert.match(hub, /id="panel-detail"/, 'the wizard ships the panel');
+  assert.match(hub, /id="skipDetail"/, 'with a skip control of its own');
+
+  // the route that receives it
+  const route = read('modules/provisioning/routes/provisioning.js');
+  assert.match(route, /description: \{ type: 'string', maxLength: provisioning\.DESCRIPTION_MAX \}/,
+    'the create route accepts the description');
+  assert.match(route, /\/provisioning\/instances\/:id\/detail/,
+    'and there is a way back, or "optional" would mean permanently unpublishable');
+});
+
+test('the answers the CLI collects are the same body the web form files (buildProjectDetail)', () => {
+  assert.deepEqual(ob.buildProjectDetail({ description: '  a   b ', teamShape: 'Community' }),
+    { description: 'a b', detail: { team_shape: 'community' } });
+  // a skip files nothing — absent means skipped, and an empty string would read
+  // to the publish gate as an answered-but-blank description
+  assert.deepEqual(ob.buildProjectDetail({}), {});
+  assert.deepEqual(ob.buildProjectDetail({ description: '   ', teamShape: '' }), {});
+  // an off-vocabulary answer is dropped, never guessed into a recommendation
+  assert.deepEqual(ob.buildProjectDetail({ teamShape: 'a big guild' }), {});
+});
+
 test('onboardPlan(adopt): same sequence + human steps, but the scaffold-leg labels branch (task 2046)', () => {
   const green = ob.onboardPlan();
   const adopt = ob.onboardPlan('adopt');

package/tests/profile_route.mjs

@@ -341,6 +341,7 @@ await t('hub port returns null (hidden/provisional/none) → cross_project: null
 const HUB_GITHUB_ID = FULL_ROW.github_id;
 const HIDDEN_LOGIN = 'hidden-DO-NOT-LEAK-r06';
 const PROV_LOGIN = 'provisional-DO-NOT-LEAK-r06';
+const PRIVATE_LOGIN = 'private-DO-NOT-LEAK-r06';
 
 // TWO projects — one publicly catalogued, one not. Distinctive digits so the
 // "no partial numbers" scan below cannot pass by coincidence.
@@ -353,22 +354,28 @@ const PROOF_PROJECTS = [
 const sumOf = (k) => PROOF_PROJECTS.reduce((n, p) => n + p[k], 0);
 
 // The one account row the reads consult. setAccountHideStats mutates it.
-const hubAccount = { profile_state: 'active', hide_stats: false, handle: 'r06-handle' };
+const hubAccount = { profile_state: 'active', account_visibility: 'public', hide_stats: false, handle: 'r06-handle' };
 
-// The scouting "table": one visible builder plus the two that consent excludes.
+// The scouting "table": one visible builder plus the THREE that consent and
+// visibility exclude (the private row joined at task 1002967 — the same axis,
+// enforced by the same shared predicate).
 const SCOUTING_TABLE = [
-  { profile_state: 'active', hide_stats: false,
+  { profile_state: 'active', account_visibility: 'public', hide_stats: false,
     row: { github_id: '11', github_login: 'r06-visible', display_name: 'Visible', avatar_url: null,
       project_count: 2, total_credits: 5, total_tasks_shipped: 1, total_karma: 0,
       last_active: '2026-08-01T00:00:00.000Z', disciplines: ['engineer'] } },
-  { profile_state: 'active', hide_stats: true,
+  { profile_state: 'active', account_visibility: 'public', hide_stats: true,
     row: { github_id: '12', github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null,
       project_count: 7, total_credits: 88817, total_tasks_shipped: 6613, total_karma: 5519,
       last_active: '2026-08-02T00:00:00.000Z', disciplines: ['ui'] } },
-  { profile_state: 'provisional', hide_stats: false,
+  { profile_state: 'provisional', account_visibility: 'public', hide_stats: false,
     row: { github_id: '13', github_login: PROV_LOGIN, display_name: 'Provisional', avatar_url: null,
       project_count: 1, total_credits: 71713, total_tasks_shipped: 1, total_karma: 0,
       last_active: '2026-08-03T00:00:00.000Z', disciplines: [] } },
+  { profile_state: 'active', account_visibility: 'private', hide_stats: false,
+    row: { github_id: '14', github_login: PRIVATE_LOGIN, display_name: 'Private', avatar_url: null,
+      project_count: 3, total_credits: 63127, total_tasks_shipped: 4409, total_karma: 2287,
+      last_active: '2026-08-04T00:00:00.000Z', disciplines: ['engineer'] } },
 ];
 
 const engine = {
@@ -382,6 +389,7 @@ const engine = {
     if (/AS project_count/.test(sql)) {
       let rows = SCOUTING_TABLE;
       if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/pa\.account_visibility = 'public'/.test(sql)) rows = rows.filter((r) => r.account_visibility === 'public');
       if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
       return { rows: rows.map((r) => ({ ...r.row })) };
     }
@@ -390,9 +398,11 @@ const engine = {
       hubAccount.hide_stats = !!params[4];
       return { rows: [{ github_id: String(HUB_GITHUB_ID), github_login: 'jaxri', ...hubAccount }] };
     }
-    // getPublicProfileExtras' consent read.
-    if (/SELECT profile_state, hide_stats/.test(sql)) {
-      return { rows: [{ profile_state: hubAccount.profile_state, hide_stats: hubAccount.hide_stats }] };
+    // getPublicProfileExtras' consent read — three columns since task 1002967
+    // wired the existence axis in (the shared rollupIsVisible port reads them).
+    if (/SELECT profile_state, account_visibility, hide_stats/.test(sql)) {
+      return { rows: [{ profile_state: hubAccount.profile_state,
+        account_visibility: hubAccount.account_visibility, hide_stats: hubAccount.hide_stats }] };
     }
     // getRollupForBuilder's per-project rows (the client_id → origin two-hop).
     if (/platform_identity_sso_clients/.test(sql)) {
@@ -537,14 +547,15 @@ scoutApp.use(attachFail);
 scoutApp.use('/api/gds', buildScoutingRoutes());
 const scout = await listen(scoutApp);
 
-await t('R06.3 GET /scouting drops the hidden AND the provisional builder', async () => {
+await t('R06.3 GET /scouting drops the hidden, the provisional AND the private builder', async () => {
   engine.calls.length = 0;
   const r = await get(scout.port, '/api/gds/scouting');
   assert.equal(r.status, 200);
   const logins = r.json.builders.map((b) => b.github_login);
-  assert.deepEqual(logins, ['r06-visible'], 'only the consented, non-hidden builder is listed');
+  assert.deepEqual(logins, ['r06-visible'],
+    'only the consented, publicly-visible, non-hidden builder is listed (task 1002967 added the visibility axis)');
   assert.equal(engine.calls.length, 1, 'exactly ONE read — nothing can re-enter via a second, unfiltered query');
-  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, '88817', '6613', '5519', '71713']) {
+  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, PRIVATE_LOGIN, '88817', '6613', '5519', '71713', '63127', '4409', '2287']) {
     assert.ok(!r.text.includes(s), `the excluded builder leaks nothing — found "${s}"`);
   }
 });

package/tests/projects_hub.mjs

@@ -172,12 +172,40 @@ test('orb accents are tokens, never literal hexes (§6)', () => {
   for (const t of ['--sea', '--terracotta', '--accent', '--sun-lit', '--gold-soft']) {
     assert.match(accents, new RegExp(`var\\(${t}\\)`), `${t} must be one of the orb accents`);
   }
-  const glows = (SCRIPT.match(/var ORB_GLOWS = ([^;]*);/) || [, ''])[1];
-  assert.doesNotMatch(glows, /rgba?\(/, 'orb glows must derive from the accents, not literal rgba');
+  // the sphere's glow left with the sphere (task 1003345): a planet carries its accent only
+  assert.doesNotMatch(SCRIPT, /ORB_GLOWS|--glow:/, 'no glow — the row draws the sky\'s planet');
   assert.equal((SCRIPT.match(/var ORB_ACCENTS/g) || []).length, 1,
     'one palette, not two — the map and the manage cards must not drift apart');
 });
 
+/* ── the row's planet is the sky's object (task 1003345, direction record §14: v1 the ledger row) ── */
+test('the mine row draws the project\'s planet — the catalog\'s template when matched, the slug walk otherwise', () => {
+  const orb = (SCRIPT.match(/function orbFor\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(orb, /var pl = planetOf\(inst\);/, 'orbFor asks planetOf');
+  assert.match(orb, /class="' \+ cls \+ '"' \+ attrs/, 'the planet is a .worldOrb with the template attributes');
+  assert.match(orb, /<span class="disc"><\/span>/, 'the disc cosmos.css draws');
+  assert.doesNotMatch(orb, /class="orb/, 'the sphere is gone');
+  const planet = (SCRIPT.match(/function planetOf\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(planet, /hostOf\(catalog\[i\]\.origin\) === h/, 'matched by host, the same join the map makes');
+  assert.match(planet, /tpl: templateOf\(catalog\[i\]\), acc: accentOf\(catalog\[i\]\)/, 'a catalog match takes the catalog\'s template + accent');
+  assert.match(planet, /tpl: slugTemplate\(inst\.slug\), acc: ORB_ACCENTS\[slugAccent\(inst\.slug\)\]/, 'owned-only walks by slug');
+  assert.match(SCRIPT, /assignAccents\(\); applyMapFilter\(\); repaintPlanets\(\);/, 'a catalog that lands late repaints the rows');
+  assert.doesNotMatch(COSMOS, /\n\.orb\{/, 'cosmos no longer carries the sphere');
+});
+
+test('the mine list lays every row on one set of FIXED tracks (task 1003348) and the manage h1 stands outside #mMain', () => {
+  assert.match(COSMOS, /#view-mine \.projBody\{display:grid;grid-template-columns:minmax\(0,1\.1fr\) minmax\(0,1\.3fr\) minmax\(0,1fr\) 232px;/, 'no content minimum, so the tracks are the same on every row');
+  assert.match(COSMOS, /#view-mine \.proj\{display:grid;grid-template-columns:72px minmax\(0,1fr\);/, 'the planet column is a width');
+  assert.match(COSMOS, /#view-mine \.card,#view-manage \.card\{background:none;/, 'no card ground on either view');
+  assert.match(COSMOS, /#view-mine \.strip,#view-manage \.strip\{border:0;border-radius:0;padding:0;background:none;/, 'the strip is drawn as the rail');
+  assert.doesNotMatch(COSMOS.slice(COSMOS.indexOf('YOUR PROJECTS + THE MANAGE PAGE')), /box-shadow:(?!none)/, 'halos are outlines in the world, never box-shadow');
+  const title = HUB.indexOf('<h1 id="mTitle">');
+  const main = HUB.indexOf('<section id="mMain"');
+  assert.ok(title > -1 && main > -1 && title < main, 'the h1 renders in every manage state — signed out, not found, loading');
+  assert.match(HUB, /<h1 id="mTitle"><span id="mName">Manage<\/span><\/h1>/, '#mName is the heading\'s text, so renderManage names the page by filling it');
+  for (const id of ['mOrb', 'mFacts', 'mPlanet']) assert.match(HUB, new RegExp(`id="${id}"`), `#${id} is real markup`);
+});
+
 test('accents are assigned by canonical position, not by hashing the name', () => {
   // a name hash collided: with five tokens and four projects it put three of
   // them on the same ember and the sky stopped being readable
@@ -613,6 +641,75 @@ test('every table column has a source — Type is declared, never guessed', () =
   assert.match(SCRIPT, /type: state\.projType/, 'the create request carries the declared type');
 });
 
+test('every per-step hook in show() still points at the panel it belongs to (renumbering guard)', () => {
+  // The renumbering risk is NOT the data-next attributes (guarded above) — it is
+  // show()'s side-effect hooks, which key off bare integers. Point one at the
+  // wrong panel and the wizard still navigates perfectly while silently never
+  // probing repo access, never re-checking the handle, or rendering a stale
+  // review. Derived from the panels map so this survives the next renumbering.
+  const map = SCRIPT.match(/var panels = \{([^}]*)\}/)[1];
+  const STEP = {};
+  for (const m of map.matchAll(/(\d+):\s*'([a-z-]+)'/g)) STEP[m[2]] = Number(m[1]);
+  const show = SCRIPT.slice(SCRIPT.indexOf('function show(step, moveFocus)'));
+  const body = show.slice(0, show.search(/\n\s*\/\* One delegated pair on the rail/));
+
+  assert.ok(body.includes(`if (step === ${STEP['panel-home']}) { syncHome();`),
+    'the repo probe fires on the Home panel');
+  assert.ok(body.includes(`if (step === ${STEP['panel-address']}) { checkSlugAvailable(); renderAddrPanel(); }`),
+    'the handle re-check fires on the Address panel');
+  assert.ok(body.includes(`if (step === ${STEP['panel-review']}) renderReview();`),
+    'the review is rendered on the Review panel');
+  assert.ok(body.includes(`'wizDone', step === ${STEP['panel-done']}`),
+    'the done panel is the one that takes the whole card');
+  // and the About panel claims no hook of its own — it has nothing to fetch
+  assert.ok(!body.includes(`if (step === ${STEP['panel-detail']})`),
+    'the optional step needs no side effect; adding one would give it a way to fail');
+});
+
+test('the About step is OFFERED by every form and can be walked past — the skip is a real control (task 1002334)', () => {
+  const about = (HUB.match(/<section class="panel" id="panel-detail"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(about, '#panel-detail ships as real markup');
+  assert.match(about, /id="f-desc"/, 'it asks what the owner is building — the publish gate half');
+  assert.match(about, /id="teamCards"/, 'and who is building it — what the recommendations read');
+  // the skip must be its OWN button: "leave it blank and press Next" is an
+  // escape hatch the visitor has to infer, which is not an optional step
+  assert.match(about, /id="skipDetail"/, 'the skip is a control, not an inference');
+  assert.match(about, /Optional/, 'and the panel says so before it asks');
+  // the consequence of skipping is stated where the choice is made
+  assert.match(SCRIPT, /stays off the public map until it has one/,
+    'skipping names its cost (ADR 0182 D4), never leaves it to be discovered later');
+  // nothing in validateStep may gate the About step
+  const validate = SCRIPT.slice(SCRIPT.indexOf('function validateStep('));
+  const map = SCRIPT.match(/var panels = \{([^}]*)\}/)[1];
+  const aboutStep = Number((map.match(/(\d+):\s*'panel-detail'/) || [, 0])[1]);
+  assert.ok(aboutStep > 0, 'the About panel is in the map');
+  assert.ok(!validate.slice(0, validate.indexOf('function ', 1)).includes(`if (step === ${aboutStep}) {`),
+    'the optional step has no validation clause — Next past an empty answer is the point');
+});
+
+test('the About answers travel on the create request, and an empty one is OMITTED not blanked', () => {
+  assert.match(SCRIPT, /description: String\(state\.description \|\| ''\)\.trim\(\) \|\| undefined/,
+    'a skipped description is absent from the body — an empty string would read as answered');
+  assert.match(SCRIPT, /detail: state\.teamShape \? \{ team_shape: state\.teamShape \} : undefined/,
+    'and an unanswered team shape is never guessed into the request');
+  // the review is the last screen before Create, so the skip's cost is restated there
+  const review = (SCRIPT.match(/function renderReview\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.match(review, /off the public map until you add it/,
+    'the review row states the consequence rather than a bare dash');
+  assert.match(review, /\['About',/, 'and the About answer has a row of its own');
+});
+
+test('a renumbering of the wizard invalidates old drafts — the key carries the version', () => {
+  // task 1002772 renumbered once and bumped to -v2; task 1002334 renumbered again.
+  // A draft replayed under a different numbering lands on the wrong panel with the
+  // rail already marking the skipped steps done.
+  const key = (SCRIPT.match(/var DRAFT_KEY = '([^']+)'/) || [, ''])[1];
+  assert.match(key, /-v\d+$/, 'the draft key is versioned');
+  const panels = (SCRIPT.match(/var panels = \{([^}]*)\}/) || [, ''])[1];
+  const count = [...panels.matchAll(/\d+:\s*'panel-/g)].length;
+  assert.equal(count, 8, 'gate + six numbered steps + done — bump DRAFT_KEY when this changes');
+});
+
 test('header and body agree on the column count', () => {
   // a stray <td> shifts every cell after it — silent, and only visible on screen
   const n = ((HUB.match(/<thead>([\s\S]*?)<\/thead>/) || [, ''])[1].match(/<th/g) || []).length;
@@ -1173,7 +1270,7 @@ test('the delete section is live markup with its body slot (C7)', () => {
   assert.match(HUB, /id="mDel"/, 'the volatile slot is real markup, not JS-built');
   assert.match(HUB, /id="mDelWhat"/, 'the teardown-vs-delete fold ships with the page');
   // the fold is a SIBLING of the volatile slot, so no re-render can drop it
-  const card = (HUB.match(/<div class="card" id="mDelete">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const card = (HUB.match(/<div class="card mSec" id="mDelete">[\s\S]*?\n      <\/div>/) || [''])[0];
   assert.ok(card, 'the delete card must be extractable');
   const slotAt = card.indexOf('id="mDel"');
   const foldAt = card.indexOf('id="mDelWhat"');
@@ -1253,7 +1350,7 @@ const fnHub = (name) => {
 test('the visibility section is live markup with its body slot and a sibling fold (C7)', () => {
   assert.match(HUB, /id="mVis"/, 'the volatile slot is real markup, not JS-built');
   assert.match(HUB, /id="mVisWhat"/, 'the what-changes fold ships with the page');
-  const card = (HUB.match(/<div class="card" id="mVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const card = (HUB.match(/<div class="card mSec" id="mVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
   assert.ok(card, 'the visibility card must be extractable');
   const slotAt = card.indexOf('id="mVis"');
   const foldAt = card.indexOf('id="mVisWhat"');
@@ -1335,7 +1432,7 @@ test('the settings reads fire on entry + tab return only — never on the in-fli
 test('the joinability section is live markup with its body slot and a sibling fold', () => {
   assert.match(HUB, /id="mJoin"/, 'the volatile slot is real markup, not JS-built');
   assert.match(HUB, /id="mJoinWhat"/, 'the what-changes fold ships with the page');
-  const card = (HUB.match(/<div class="card" id="mJoinability">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const card = (HUB.match(/<div class="card mSec" id="mJoinability">[\s\S]*?\n      <\/div>/) || [''])[0];
   assert.ok(card, 'the joinability card must be extractable');
   const slotAt = card.indexOf('id="mJoin"');
   const foldAt = card.indexOf('id="mJoinWhat"');

package/tests/projects_hub_pre_uat.mjs

@@ -28,6 +28,20 @@ const fn = (name) => {
   return next < 0 ? rest : rest.slice(0, next);
 };
 
+// The step indices are DERIVED from the panels map, not typed (task 1002334
+// renumbered them a second time and every literal below broke). What these
+// blocks actually claim is "the DONE panel" and "the step before it" — say
+// that, and the next renumbering costs nothing.
+const PANELS = (() => {
+  const m = SCRIPT.match(/var panels = \{([^}]*)\}/);
+  assert.ok(m, 'the panels map must exist');
+  const map = {};
+  for (const p of m[1].matchAll(/(\d+):\s*'([a-z-]+)'/g)) map[Number(p[1])] = p[2];
+  return map;
+})();
+const STEP = Object.fromEntries(Object.entries(PANELS).map(([n, id]) => [id, Number(n)]));
+const DONE = STEP['panel-done'];
+
 /* ── the gate says why GitHub will ask for repository access ── */
 test('the gate explains the repo scope BEFORE GitHub does — on the path every founder takes', () => {
   const gate = (HUB.match(/<section class="panel" id="panel-gate"[\s\S]*?<\/section>/) || [''])[0];
@@ -203,7 +217,9 @@ test('the wizard’s 401 recoveries keep the repo scope they already granted', (
 });
 
 test('a resumed draft past Home still probes repo access before Create', () => {
-  assert.match(SCRIPT, /else if \(step > 3 && step < 6 && authKnown && repoAccess === null\) ensureRepoAccess\(\);/);
+  assert.ok(SCRIPT.includes(
+    `else if (step > ${STEP['panel-home']} && step < ${DONE} && authKnown && repoAccess === null) ensureRepoAccess();`),
+    'every step between Home and the done panel re-probes');
 });
 
 test('a half-typed custom domain says why Next is dead; a taken handle silences the format cheer', () => {
@@ -288,9 +304,19 @@ test('the bar is the page ground closed by a hairline, holds one row on a phone,
   assert.match(HUB, /#view-mine \.hero,#view-manage \.hero\{max-width:none;\}/, 'titles align with their cards');
 });
 
-test('card metadata is span-wrapped so a separator can never strand', () => {
+test('card metadata is span-wrapped so a separator can never strand; the manage page lays its facts as a ledger', () => {
   assert.match(fn('renderCard'), /meta\.map\(function \(m\) \{ return '<span>' \+ m \+ '<\/span>'; \}\)\.join\(''\)/);
-  assert.match(fn('renderManage'), /meta\.map\(function \(m\) \{ return '<span>' \+ m \+ '<\/span>'; \}\)\.join\(''\)/);
+  /* task 1003345: the manage page's facts are label · value rows on hairlines — one
+     pair per fact, each fact keeping its id so a missing answer still hides */
+  assert.match(SCRIPT, /function ledgerRow\(r\) \{ return '<span class="k">' \+ r\[0\] \+ '<\/span><span class="v">' \+ r\[1\] \+ '<\/span>'; \}/);
+  const rm = fn('renderManage');
+  assert.match(rm, /\$\('mMeta'\)\.innerHTML = rows\.map\(ledgerRow\)\.join\(''\);/);
+  assert.match(rm, /\$\('mAddr'\)\.innerHTML = addr \? ledgerRow\(\['address', addr\]\) : '';/);
+  assert.match(rm, /paintManagePlanet\(inst\);/, 'the head and the planet row paint through one fn');
+  const pm = fn('paintManagePlanet');
+  assert.match(pm, /\$\('mPlanet'\)\.innerHTML = ledgerRow\(\['planet', planetWords\(pl\)/, 'the planet row is the slot the picker (task 1003347) fills');
+  assert.match(pm, /\$\('mOrb'\)\.innerHTML = orbFor\(inst\);/, 'the same planet the row shows, at the head');
+  assert.match(fn('repaintPlanets'), /if \(manageInst\) paintManagePlanet\(manageInst\);/, 'a catalog that lands after the manage page rendered repaints its head too');
 });
 
 test('an open teardown confirm survives the minute re-render', () => {
@@ -377,7 +403,7 @@ test('a heartbeat re-render keeps an open fold open and a half-typed domain type
 
 /* ── the owner's five calls of 2026-08-24 (task 1003250) ── */
 test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying nothing erases', () => {
-  const del = (HUB.match(/<div class="card" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
+  const del = (HUB.match(/<div class="card mSec" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
   assert.ok(del, '#mDelete exists');
   assert.match(del, /<h2[^>]*>Take it offline<\/h2>/, 'the heading says what the control does');
   assert.doesNotMatch(HUB, /Delete the project/, 'the word "Delete" no longer promises an erase anywhere on the page');
@@ -447,13 +473,16 @@ test('a manifest error says a plain sentence, folds the route text, and sends a
 
 test('the rail at the done panel keeps its marker on Create until the project answers', () => {
   const rail = fn('paintRail');
-  assert.match(rail, /var landed = step === 6 && !!\(live && live\.instStatus === 'active'\);/);
-  assert.match(rail, /var cur = step === 6 \? 5 : step;/);
+  assert.ok(rail.includes(`var landed = step === ${DONE} && !!(live && live.instStatus === 'active');`),
+    'the rail only finishes on the done panel');
+  assert.ok(rail.includes(`var cur = step === ${DONE} ? ${DONE - 1} : step;`),
+    'the done panel keeps the marker on the last numbered beat');
   assert.match(rail, /li\.classList\.toggle\('done', landed \|\| n < cur\);/);
   assert.match(rail, /if \(now\) li\.setAttribute\('aria-current', 'step'\); else li\.removeAttribute\('aria-current'\);/);
   assert.match(fn('show'), /paintRail\(step\);/, 'show() paints through it');
   assert.doesNotMatch(fn('show'), /classList\.toggle\('done'/, 'and no longer marks the rail on its own');
-  assert.match(SCRIPT, /live\.instStatus = inst\.status; renderSteps\(\);\n\s*if \(state\.step === 6\) paintRail\(6\);/, 'the done-panel poll repaints when the status moves');
+  assert.ok(SCRIPT.includes(`if (state.step === ${DONE}) paintRail(${DONE});`),
+    'the done-panel poll repaints when the status moves');
   assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
 });
 
@@ -560,7 +589,10 @@ test('the hub has one main landmark, a heading for the map, a footer, and a skip
 });
 
 test('completed rail steps are a way back, the repo picker is honest ARIA, the card inerts the page', () => {
-  assert.match(fn('paintRail'), /if \(step < 6 && n < cur\) \{\n\s*li\.setAttribute\('role', 'button'\);\n\s*li\.setAttribute\('tabindex', '0'\);\n\s*li\.setAttribute\('data-goto', String\(n\)\);/, 'only answered steps become buttons, and none once the project is filed');
+  assert.ok(fn('paintRail').includes(`if (step < ${DONE} && n < cur) {`),
+    'only answered steps become buttons, and none once the project is filed');
+  assert.ok(fn('paintRail').includes("li.setAttribute('data-goto', String(n));"),
+    'and an answered step carries the goto the delegated handler reads');
   assert.match(SCRIPT, /railEl\.addEventListener\('click'/);
   assert.match(SCRIPT, /railEl\.addEventListener\('keydown'/);
   assert.match(SCRIPT, /show\(Number\(li\.getAttribute\('data-goto'\)\), true\)/, 'a deliberate step: focus moves');
@@ -582,9 +614,11 @@ test('completed rail steps are a way back, the repo picker is honest ARIA, the c
 });
 
 test('control nits: orb cursor, caret under reduced motion, no mode switch, home label, held reduce-motion query, target sizes', () => {
-  assert.doesNotMatch(COSMOS, /\.orb\{flex:0 0 54px;[^}]*cursor:pointer/, 'the base orb is not a pointer');
-  assert.match(COSMOS, /\na\.orb\{cursor:pointer;\}/, 'only the linked orb is');
-  assert.doesNotMatch(COSMOS, /\.orb\.ghost\{[^}]*cursor:default/);
+  /* task 1003345: the row's object is the planet (.worldOrb, docked); only the live
+     project's, a link to its site, is a pointer */
+  assert.match(COSMOS, /#view-mine \.worldOrb,#view-manage \.worldOrb\{[^}]*cursor:default/, 'the docked planet is not a pointer');
+  assert.match(COSMOS, /\n#view-mine a\.worldOrb,#view-manage a\.worldOrb\{cursor:pointer;\}/, 'only the linked one is');
+  assert.doesNotMatch(COSMOS, /\n\.orb\{/, 'the sphere is gone');
   assert.doesNotMatch(HUB, /\.shell \.caret/, 'no caret to hide — the hub mark is static (task 1003300)');
   assert.doesNotMatch(SCRIPT, /modeToggle|paintModeToggle|resolvedMode|cb-color-mode/, 'the mode switch left the hub — the apex is dark only (task 1003336)');
   assert.doesNotMatch(HUB, /id="modeToggle"|class="modeBtn"/);

package/tests/provision.mjs

@@ -1673,6 +1673,26 @@ await ta('federateInstance(--apply): registers the client on the hub bound to th
   });
 });
 
+await ta('federateInstance: the project-detail answers ride to the catalog row — and a SKIP stays skipped (task 1002334)', async () => {
+  await withEnv(HUB_ENV, async () => {
+    // The instance row holds what the owner said at creation; the catalog row is
+    // where the publish gate reads it (ADR 0182 D4). Dropping the answer on this
+    // one hop would leave a project that DID describe itself in dark matter,
+    // which would make the whole optional step decorative.
+    const told = { ...coTenantWithDomain, type: 'game', description: 'A co-op farming game.' };
+    const pi = fakePI();
+    const deps = { apply: true, log: () => {}, platformIdentity: pi, hubKeys: hubKeysOn, db: { query: async () => ({ rows: [{ github_id: 'gh-owner-1' }] }) } };
+    await P.federateInstance(told, deps);
+    assert.equal(pi.calls[0].description, 'A co-op farming game.', 'the description reaches the hub registration');
+    assert.equal(pi.calls[0].type, 'game', 'alongside the declared type it follows');
+
+    // the skipped case: absent, never an empty string invented on the way
+    const skipped = fakePI();
+    await P.federateInstance(coTenantWithDomain, { ...deps, platformIdentity: skipped });
+    assert.equal(skipped.calls[0].description, undefined, 'a skipped interview passes nothing — upsertProject COALESCEs, so it nulls nothing either');
+  });
+});
+
 await ta('federateInstance(dry-run): registers NOTHING, returns a placeholder block (so webEnvBody can still compose)', async () => {
   await withEnv(HUB_ENV, async () => {
     const pi = fakePI();

package/tests/ui_design_kit.mjs

@@ -33,11 +33,12 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['public-landing/projects.states.json', 'public-landing/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['public-landing/projects.states.json', 'public-landing/projects-empty.states.json', 'public-landing/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
-    assert.equal(path.basename(rel), `${lib.pageName(json.page)}.states.json`, `${rel} is named for its page`);
+    if (!json.stub || !json.stub.fixtures) assert.equal(path.basename(rel), `${lib.pageName(json.page)}.states.json`, `${rel} is named for its page`);
+    else assert.ok(path.basename(rel).startsWith(`${lib.pageName(json.page)}-`), `${rel}: a fixture-aliased sibling is named <page>-<variant>.states.json`);
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
@@ -66,6 +67,8 @@ test('a states file that breaks the contract is refused with the reason named',
   assert.ok(bad.errors.some((e) => /states\.ok\.auth/.test(e)));
   const stub = lib.validateStatesFile({ page: '/x', stub: { prefix: 'builders' }, states: { a: {} } });
   assert.ok(stub.errors.some((e) => /stub\.prefix/.test(e)));
+  assert.ok(lib.validateStatesFile({ page: '/x', stub: { fixtures: { a: 'Not Kebab' } }, states: { a: {} } }).errors.some((e) => /stub\.fixtures/.test(e)), 'a fixture alias names a kebab-case file');
+  assert.deepEqual(lib.validateStatesFile({ page: '/x', stub: { fixtures: { 'provisioning-instances': 'provisioning-instances-empty' } }, states: { a: {} } }).errors, [], 'the empty-list alias is the shape');
   const modes = lib.validateStatesFile({ page: '/x', modes: ['sepia'], states: { a: {} } });
   assert.ok(modes.errors.some((e) => e.startsWith('modes:')), 'an unknown mode is refused');
   assert.ok(lib.validateStatesFile({ page: '/x', modes: [], states: { a: {} } }).errors.some((e) => e.startsWith('modes:')), 'an empty modes list is refused');
@@ -146,6 +149,33 @@ test('checkMock: the platform rules catch a page :root, a literal colour, a pinn
   assert.ok(f5.some((r) => r.startsWith('every dark rule written twice')), f5.join(' | '));
 });
 
+test('serve.js answers the manage flows with the routes\' receipts, signed in only (task 1003345)', async () => {
+  const s = await lib.startStub({ surface: 'public-landing', auth: true });
+  try {
+    const post = (p, method = 'POST', body = '{}') => fetch(s.base + p, { method, headers: { 'content-type': 'application/json' }, body });
+    for (const [p, msg] of [['/api/bongos/provisioning/instances/101/teardown', 'Teardown queued.'], ['/api/bongos/provisioning/instances/105/restart', 'Restart queued.'],
+      ['/api/bongos/provisioning/instances/101/domain', 'Address recorded.'], ['/api/bongos/provisioning/instances', 'Queued. The platform picks it up from here.']]) {
+      const r = await post(p); assert.equal(r.status, 200, p); assert.equal((await r.json()).message, msg, p);
+    }
+    const patched = await post('/api/bongos/provisioning/instances/101/settings', 'PATCH', '{"joinability":"apply"}');
+    assert.equal(patched.status, 200); assert.equal((await patched.json()).push.message, 'Saved. The project restarts to apply it.');
+    assert.equal((await post('/api/bongos/provisioning/instances/101/settings')).status, 404, 'settings take PATCH, not POST');
+    assert.equal((await post('/api/bongos/provisioning/instances/101/nope')).status, 404, 'no invented flow');
+    const asked = await (await fetch(s.base + '/api/bongos/provisioning/instances/101')).json();
+    assert.deepEqual(asked.open_intent && { action: asked.open_intent.action, state: asked.open_intent.state }, { action: 'teardown', state: 'queued' }, 'a teardown ask is remembered for the run — the page re-reads the project as queued');
+    assert.match(String(asked.open_intent.created_at), /^\d{4}-\d{2}-\d{2}T/, 'stamped like the route stamps it');
+    const untouched = await (await fetch(s.base + '/api/bongos/provisioning/instances/104')).json();
+    assert.equal(untouched.open_intent, null, 'an instance nobody asked about is unchanged');
+    const list = await (await fetch(s.base + '/api/bongos/provisioning/instances')).json();
+    assert.equal(list.instances.length, 5, 'the fifth row (Mooring) is served');
+    assert.equal(list.instances.find((i) => i.id === 105).open_intent.action, 'restart', 'the list carries the asks too');
+  } finally { s.stop(); }
+  const out = await lib.startStub({ surface: 'public-landing', auth: false });
+  try {
+    assert.equal((await fetch(out.base + '/api/bongos/provisioning/instances/101/teardown', { method: 'POST' })).status, 401, 'signed out, every ask is refused');
+  } finally { out.stop(); }
+});
+
 test('checkMock: a taste ban applies only when the instance declared it', () => {
   const dashed = GOOD_MOCK.replace('Plain copy.', 'Plain — copy.');
   const withBan = mock.checkMock(dashed, { bans: new Set(['em-dash']) });