@bongos/core 1.19.420 → 1.19.422

package/tests/profile_route.mjs

@@ -341,6 +341,7 @@ await t('hub port returns null (hidden/provisional/none) → cross_project: null
 const HUB_GITHUB_ID = FULL_ROW.github_id;
 const HIDDEN_LOGIN = 'hidden-DO-NOT-LEAK-r06';
 const PROV_LOGIN = 'provisional-DO-NOT-LEAK-r06';
+const PRIVATE_LOGIN = 'private-DO-NOT-LEAK-r06';
 
 // TWO projects — one publicly catalogued, one not. Distinctive digits so the
 // "no partial numbers" scan below cannot pass by coincidence.
@@ -353,22 +354,28 @@ const PROOF_PROJECTS = [
 const sumOf = (k) => PROOF_PROJECTS.reduce((n, p) => n + p[k], 0);
 
 // The one account row the reads consult. setAccountHideStats mutates it.
-const hubAccount = { profile_state: 'active', hide_stats: false, handle: 'r06-handle' };
+const hubAccount = { profile_state: 'active', account_visibility: 'public', hide_stats: false, handle: 'r06-handle' };
 
-// The scouting "table": one visible builder plus the two that consent excludes.
+// The scouting "table": one visible builder plus the THREE that consent and
+// visibility exclude (the private row joined at task 1002967 — the same axis,
+// enforced by the same shared predicate).
 const SCOUTING_TABLE = [
-  { profile_state: 'active', hide_stats: false,
+  { profile_state: 'active', account_visibility: 'public', hide_stats: false,
     row: { github_id: '11', github_login: 'r06-visible', display_name: 'Visible', avatar_url: null,
       project_count: 2, total_credits: 5, total_tasks_shipped: 1, total_karma: 0,
       last_active: '2026-08-01T00:00:00.000Z', disciplines: ['engineer'] } },
-  { profile_state: 'active', hide_stats: true,
+  { profile_state: 'active', account_visibility: 'public', hide_stats: true,
     row: { github_id: '12', github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null,
       project_count: 7, total_credits: 88817, total_tasks_shipped: 6613, total_karma: 5519,
       last_active: '2026-08-02T00:00:00.000Z', disciplines: ['ui'] } },
-  { profile_state: 'provisional', hide_stats: false,
+  { profile_state: 'provisional', account_visibility: 'public', hide_stats: false,
     row: { github_id: '13', github_login: PROV_LOGIN, display_name: 'Provisional', avatar_url: null,
       project_count: 1, total_credits: 71713, total_tasks_shipped: 1, total_karma: 0,
       last_active: '2026-08-03T00:00:00.000Z', disciplines: [] } },
+  { profile_state: 'active', account_visibility: 'private', hide_stats: false,
+    row: { github_id: '14', github_login: PRIVATE_LOGIN, display_name: 'Private', avatar_url: null,
+      project_count: 3, total_credits: 63127, total_tasks_shipped: 4409, total_karma: 2287,
+      last_active: '2026-08-04T00:00:00.000Z', disciplines: ['engineer'] } },
 ];
 
 const engine = {
@@ -382,6 +389,7 @@ const engine = {
     if (/AS project_count/.test(sql)) {
       let rows = SCOUTING_TABLE;
       if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/pa\.account_visibility = 'public'/.test(sql)) rows = rows.filter((r) => r.account_visibility === 'public');
       if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
       return { rows: rows.map((r) => ({ ...r.row })) };
     }
@@ -390,9 +398,11 @@ const engine = {
       hubAccount.hide_stats = !!params[4];
       return { rows: [{ github_id: String(HUB_GITHUB_ID), github_login: 'jaxri', ...hubAccount }] };
     }
-    // getPublicProfileExtras' consent read.
-    if (/SELECT profile_state, hide_stats/.test(sql)) {
-      return { rows: [{ profile_state: hubAccount.profile_state, hide_stats: hubAccount.hide_stats }] };
+    // getPublicProfileExtras' consent read — three columns since task 1002967
+    // wired the existence axis in (the shared rollupIsVisible port reads them).
+    if (/SELECT profile_state, account_visibility, hide_stats/.test(sql)) {
+      return { rows: [{ profile_state: hubAccount.profile_state,
+        account_visibility: hubAccount.account_visibility, hide_stats: hubAccount.hide_stats }] };
     }
     // getRollupForBuilder's per-project rows (the client_id → origin two-hop).
     if (/platform_identity_sso_clients/.test(sql)) {
@@ -537,14 +547,15 @@ scoutApp.use(attachFail);
 scoutApp.use('/api/gds', buildScoutingRoutes());
 const scout = await listen(scoutApp);
 
-await t('R06.3 GET /scouting drops the hidden AND the provisional builder', async () => {
+await t('R06.3 GET /scouting drops the hidden, the provisional AND the private builder', async () => {
   engine.calls.length = 0;
   const r = await get(scout.port, '/api/gds/scouting');
   assert.equal(r.status, 200);
   const logins = r.json.builders.map((b) => b.github_login);
-  assert.deepEqual(logins, ['r06-visible'], 'only the consented, non-hidden builder is listed');
+  assert.deepEqual(logins, ['r06-visible'],
+    'only the consented, publicly-visible, non-hidden builder is listed (task 1002967 added the visibility axis)');
   assert.equal(engine.calls.length, 1, 'exactly ONE read — nothing can re-enter via a second, unfiltered query');
-  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, '88817', '6613', '5519', '71713']) {
+  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, PRIVATE_LOGIN, '88817', '6613', '5519', '71713', '63127', '4409', '2287']) {
     assert.ok(!r.text.includes(s), `the excluded builder leaks nothing — found "${s}"`);
   }
 });

package/tests/projects_hub.mjs

@@ -172,12 +172,40 @@ test('orb accents are tokens, never literal hexes (§6)', () => {
   for (const t of ['--sea', '--terracotta', '--accent', '--sun-lit', '--gold-soft']) {
     assert.match(accents, new RegExp(`var\\(${t}\\)`), `${t} must be one of the orb accents`);
   }
-  const glows = (SCRIPT.match(/var ORB_GLOWS = ([^;]*);/) || [, ''])[1];
-  assert.doesNotMatch(glows, /rgba?\(/, 'orb glows must derive from the accents, not literal rgba');
+  // the sphere's glow left with the sphere (task 1003345): a planet carries its accent only
+  assert.doesNotMatch(SCRIPT, /ORB_GLOWS|--glow:/, 'no glow — the row draws the sky\'s planet');
   assert.equal((SCRIPT.match(/var ORB_ACCENTS/g) || []).length, 1,
     'one palette, not two — the map and the manage cards must not drift apart');
 });
 
+/* ── the row's planet is the sky's object (task 1003345, direction record §14: v1 the ledger row) ── */
+test('the mine row draws the project\'s planet — the catalog\'s template when matched, the slug walk otherwise', () => {
+  const orb = (SCRIPT.match(/function orbFor\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(orb, /var pl = planetOf\(inst\);/, 'orbFor asks planetOf');
+  assert.match(orb, /class="' \+ cls \+ '"' \+ attrs/, 'the planet is a .worldOrb with the template attributes');
+  assert.match(orb, /<span class="disc"><\/span>/, 'the disc cosmos.css draws');
+  assert.doesNotMatch(orb, /class="orb/, 'the sphere is gone');
+  const planet = (SCRIPT.match(/function planetOf\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(planet, /hostOf\(catalog\[i\]\.origin\) === h/, 'matched by host, the same join the map makes');
+  assert.match(planet, /tpl: templateOf\(catalog\[i\]\), acc: accentOf\(catalog\[i\]\)/, 'a catalog match takes the catalog\'s template + accent');
+  assert.match(planet, /tpl: slugTemplate\(inst\.slug\), acc: ORB_ACCENTS\[slugAccent\(inst\.slug\)\]/, 'owned-only walks by slug');
+  assert.match(SCRIPT, /assignAccents\(\); applyMapFilter\(\); repaintPlanets\(\);/, 'a catalog that lands late repaints the rows');
+  assert.doesNotMatch(COSMOS, /\n\.orb\{/, 'cosmos no longer carries the sphere');
+});
+
+test('the mine list lays every row on one set of FIXED tracks (task 1003348) and the manage h1 stands outside #mMain', () => {
+  assert.match(COSMOS, /#view-mine \.projBody\{display:grid;grid-template-columns:minmax\(0,1\.1fr\) minmax\(0,1\.3fr\) minmax\(0,1fr\) 232px;/, 'no content minimum, so the tracks are the same on every row');
+  assert.match(COSMOS, /#view-mine \.proj\{display:grid;grid-template-columns:72px minmax\(0,1fr\);/, 'the planet column is a width');
+  assert.match(COSMOS, /#view-mine \.card,#view-manage \.card\{background:none;/, 'no card ground on either view');
+  assert.match(COSMOS, /#view-mine \.strip,#view-manage \.strip\{border:0;border-radius:0;padding:0;background:none;/, 'the strip is drawn as the rail');
+  assert.doesNotMatch(COSMOS.slice(COSMOS.indexOf('YOUR PROJECTS + THE MANAGE PAGE')), /box-shadow:(?!none)/, 'halos are outlines in the world, never box-shadow');
+  const title = HUB.indexOf('<h1 id="mTitle">');
+  const main = HUB.indexOf('<section id="mMain"');
+  assert.ok(title > -1 && main > -1 && title < main, 'the h1 renders in every manage state — signed out, not found, loading');
+  assert.match(HUB, /<h1 id="mTitle"><span id="mName">Manage<\/span><\/h1>/, '#mName is the heading\'s text, so renderManage names the page by filling it');
+  for (const id of ['mOrb', 'mFacts', 'mPlanet']) assert.match(HUB, new RegExp(`id="${id}"`), `#${id} is real markup`);
+});
+
 test('accents are assigned by canonical position, not by hashing the name', () => {
   // a name hash collided: with five tokens and four projects it put three of
   // them on the same ember and the sky stopped being readable
@@ -1242,7 +1270,7 @@ test('the delete section is live markup with its body slot (C7)', () => {
   assert.match(HUB, /id="mDel"/, 'the volatile slot is real markup, not JS-built');
   assert.match(HUB, /id="mDelWhat"/, 'the teardown-vs-delete fold ships with the page');
   // the fold is a SIBLING of the volatile slot, so no re-render can drop it
-  const card = (HUB.match(/<div class="card" id="mDelete">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const card = (HUB.match(/<div class="card mSec" id="mDelete">[\s\S]*?\n      <\/div>/) || [''])[0];
   assert.ok(card, 'the delete card must be extractable');
   const slotAt = card.indexOf('id="mDel"');
   const foldAt = card.indexOf('id="mDelWhat"');
@@ -1322,7 +1350,7 @@ const fnHub = (name) => {
 test('the visibility section is live markup with its body slot and a sibling fold (C7)', () => {
   assert.match(HUB, /id="mVis"/, 'the volatile slot is real markup, not JS-built');
   assert.match(HUB, /id="mVisWhat"/, 'the what-changes fold ships with the page');
-  const card = (HUB.match(/<div class="card" id="mVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const card = (HUB.match(/<div class="card mSec" id="mVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
   assert.ok(card, 'the visibility card must be extractable');
   const slotAt = card.indexOf('id="mVis"');
   const foldAt = card.indexOf('id="mVisWhat"');
@@ -1404,7 +1432,7 @@ test('the settings reads fire on entry + tab return only — never on the in-fli
 test('the joinability section is live markup with its body slot and a sibling fold', () => {
   assert.match(HUB, /id="mJoin"/, 'the volatile slot is real markup, not JS-built');
   assert.match(HUB, /id="mJoinWhat"/, 'the what-changes fold ships with the page');
-  const card = (HUB.match(/<div class="card" id="mJoinability">[\s\S]*?\n      <\/div>/) || [''])[0];
+  const card = (HUB.match(/<div class="card mSec" id="mJoinability">[\s\S]*?\n      <\/div>/) || [''])[0];
   assert.ok(card, 'the joinability card must be extractable');
   const slotAt = card.indexOf('id="mJoin"');
   const foldAt = card.indexOf('id="mJoinWhat"');
@@ -1627,3 +1655,24 @@ test('the kit proves the field path: the fixture carries a curated template and
   assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
   assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material gold')), 'the material reaches the orb as its own attribute');
 });
+
+/* ── the table's columns on FIXED tracks (task 1003348; the owner, 2026-08-29: "the
+   columns in that projects table view dont look aligned") ── */
+test('one column grammar: the table lays every row on one set of fixed tracks (each header over its cells), and the mine list shares the rule', () => {
+  assert.match(COSMOS, /\.tbl\{table-layout:fixed;min-width:860px;\}/, 'the header row\'s widths are the table\'s — no per-row content sizing');
+  // the task's other half — the Your projects list — landed with task 1003345 and is pinned above
+  // ('the mine list lays every row on one set of FIXED tracks'); it is asserted here too so the two
+  // halves of the grammar can never drift apart: fixed planet + doors, ratio tracks with no content minimum
+  assert.match(COSMOS, /#view-mine \.proj\{display:grid;grid-template-columns:72px minmax\(0,1fr\);/, 'the mine row: the planet track is a width');
+  assert.match(COSMOS, /#view-mine \.projBody\{display:grid;grid-template-columns:minmax\(0,1\.1fr\) minmax\(0,1\.3fr\) minmax\(0,1fr\) 232px;/, 'the mine row: name, facts and rail by ratio with no content minimum, the doors a width');
+  assert.match(COSMOS, /the same column grammar the every-project table takes/, 'the mine block names the table as its twin');
+  for (const [col, w] of [['colType', 88], ['colBuilders', 96], ['colTags', 168], ['colStatus', 224], ['colGo', 112]]) {
+    assert.match(COSMOS, new RegExp(`\\.tbl th\\.${col}\\{width:${w}px;\\}`), `${col} is a width, not a 1% hug`);
+  }
+  assert.doesNotMatch(COSMOS, /\.tbl \.col\w+\{width:1%/, 'no column hugs its widest cell any more');
+  assert.match(COSMOS, /\.tbl th\.colName\{padding-left:22px;\}/, 'the Project header sits over the name, past the dot and its gap');
+  assert.match(COSMOS, /\.tbl th\.right\{text-align:right;\}/, 'a right-aligned column\'s header is right-aligned too');
+  assert.match(HUB, /<th class="right colBuilders" data-sort="builders">/, 'the builders header names its column so its width can be set');
+  assert.match(COSMOS, /@media \(max-width:780px\)\{\.tbl \.colTags,\.tbl \.colType\{display:none;\}\.tbl\{min-width:600px;\}\}/, 'a phone scrolls the table inside its wrap');
+  assert.match(COSMOS, /#sub-table-body\{overflow-x:auto;\}/, 'the wrap scrolls, never the page');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -304,9 +304,19 @@ test('the bar is the page ground closed by a hairline, holds one row on a phone,
   assert.match(HUB, /#view-mine \.hero,#view-manage \.hero\{max-width:none;\}/, 'titles align with their cards');
 });
 
-test('card metadata is span-wrapped so a separator can never strand', () => {
+test('card metadata is span-wrapped so a separator can never strand; the manage page lays its facts as a ledger', () => {
   assert.match(fn('renderCard'), /meta\.map\(function \(m\) \{ return '<span>' \+ m \+ '<\/span>'; \}\)\.join\(''\)/);
-  assert.match(fn('renderManage'), /meta\.map\(function \(m\) \{ return '<span>' \+ m \+ '<\/span>'; \}\)\.join\(''\)/);
+  /* task 1003345: the manage page's facts are label · value rows on hairlines — one
+     pair per fact, each fact keeping its id so a missing answer still hides */
+  assert.match(SCRIPT, /function ledgerRow\(r\) \{ return '<span class="k">' \+ r\[0\] \+ '<\/span><span class="v">' \+ r\[1\] \+ '<\/span>'; \}/);
+  const rm = fn('renderManage');
+  assert.match(rm, /\$\('mMeta'\)\.innerHTML = rows\.map\(ledgerRow\)\.join\(''\);/);
+  assert.match(rm, /\$\('mAddr'\)\.innerHTML = addr \? ledgerRow\(\['address', addr\]\) : '';/);
+  assert.match(rm, /paintManagePlanet\(inst\);/, 'the head and the planet row paint through one fn');
+  const pm = fn('paintManagePlanet');
+  assert.match(pm, /\$\('mPlanet'\)\.innerHTML = ledgerRow\(\['planet', planetWords\(pl\)/, 'the planet row is the slot the picker (task 1003347) fills');
+  assert.match(pm, /\$\('mOrb'\)\.innerHTML = orbFor\(inst\);/, 'the same planet the row shows, at the head');
+  assert.match(fn('repaintPlanets'), /if \(manageInst\) paintManagePlanet\(manageInst\);/, 'a catalog that lands after the manage page rendered repaints its head too');
 });
 
 test('an open teardown confirm survives the minute re-render', () => {
@@ -393,7 +403,7 @@ test('a heartbeat re-render keeps an open fold open and a half-typed domain type
 
 /* ── the owner's five calls of 2026-08-24 (task 1003250) ── */
 test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying nothing erases', () => {
-  const del = (HUB.match(/<div class="card" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
+  const del = (HUB.match(/<div class="card mSec" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
   assert.ok(del, '#mDelete exists');
   assert.match(del, /<h2[^>]*>Take it offline<\/h2>/, 'the heading says what the control does');
   assert.doesNotMatch(HUB, /Delete the project/, 'the word "Delete" no longer promises an erase anywhere on the page');
@@ -550,7 +560,7 @@ test('the done panel’s progress region is stable, change-only, and says each s
 
 test('the map table sorts from the keyboard and an owned row’s name is a real link', () => {
   assert.match(HUB, /<th class="colName" data-sort="name" aria-sort="ascending"><button type="button" class="thSort">Project<\/button><\/th>/);
-  assert.match(HUB, /<th class="right" data-sort="builders"><button type="button" class="thSort">Builders<\/button><\/th>/);
+  assert.match(HUB, /<th class="right colBuilders" data-sort="builders"><button type="button" class="thSort">Builders<\/button><\/th>/);
   assert.match(SCRIPT, /var btn = th\.querySelector\('button'\);\n\s*if \(!btn\) return;\n\s*btn\.addEventListener\('click'/, 'the listener sits on the button, not the th');
   assert.doesNotMatch(SCRIPT, /th\.style\.cursor/, 'no JS-set cursor on the th');
   assert.match(COSMOS, /\.tbl th button\{all:unset;cursor:pointer;\}/);
@@ -604,9 +614,11 @@ test('completed rail steps are a way back, the repo picker is honest ARIA, the c
 });
 
 test('control nits: orb cursor, caret under reduced motion, no mode switch, home label, held reduce-motion query, target sizes', () => {
-  assert.doesNotMatch(COSMOS, /\.orb\{flex:0 0 54px;[^}]*cursor:pointer/, 'the base orb is not a pointer');
-  assert.match(COSMOS, /\na\.orb\{cursor:pointer;\}/, 'only the linked orb is');
-  assert.doesNotMatch(COSMOS, /\.orb\.ghost\{[^}]*cursor:default/);
+  /* task 1003345: the row's object is the planet (.worldOrb, docked); only the live
+     project's, a link to its site, is a pointer */
+  assert.match(COSMOS, /#view-mine \.worldOrb,#view-manage \.worldOrb\{[^}]*cursor:default/, 'the docked planet is not a pointer');
+  assert.match(COSMOS, /\n#view-mine a\.worldOrb,#view-manage a\.worldOrb\{cursor:pointer;\}/, 'only the linked one is');
+  assert.doesNotMatch(COSMOS, /\n\.orb\{/, 'the sphere is gone');
   assert.doesNotMatch(HUB, /\.shell \.caret/, 'no caret to hide — the hub mark is static (task 1003300)');
   assert.doesNotMatch(SCRIPT, /modeToggle|paintModeToggle|resolvedMode|cb-color-mode/, 'the mode switch left the hub — the apex is dark only (task 1003336)');
   assert.doesNotMatch(HUB, /id="modeToggle"|class="modeBtn"/);

package/tests/ui_design_kit.mjs

@@ -33,11 +33,12 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['public-landing/projects.states.json', 'public-landing/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['public-landing/projects.states.json', 'public-landing/projects-empty.states.json', 'public-landing/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
-    assert.equal(path.basename(rel), `${lib.pageName(json.page)}.states.json`, `${rel} is named for its page`);
+    if (!json.stub || !json.stub.fixtures) assert.equal(path.basename(rel), `${lib.pageName(json.page)}.states.json`, `${rel} is named for its page`);
+    else assert.ok(path.basename(rel).startsWith(`${lib.pageName(json.page)}-`), `${rel}: a fixture-aliased sibling is named <page>-<variant>.states.json`);
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
@@ -66,6 +67,8 @@ test('a states file that breaks the contract is refused with the reason named',
   assert.ok(bad.errors.some((e) => /states\.ok\.auth/.test(e)));
   const stub = lib.validateStatesFile({ page: '/x', stub: { prefix: 'builders' }, states: { a: {} } });
   assert.ok(stub.errors.some((e) => /stub\.prefix/.test(e)));
+  assert.ok(lib.validateStatesFile({ page: '/x', stub: { fixtures: { a: 'Not Kebab' } }, states: { a: {} } }).errors.some((e) => /stub\.fixtures/.test(e)), 'a fixture alias names a kebab-case file');
+  assert.deepEqual(lib.validateStatesFile({ page: '/x', stub: { fixtures: { 'provisioning-instances': 'provisioning-instances-empty' } }, states: { a: {} } }).errors, [], 'the empty-list alias is the shape');
   const modes = lib.validateStatesFile({ page: '/x', modes: ['sepia'], states: { a: {} } });
   assert.ok(modes.errors.some((e) => e.startsWith('modes:')), 'an unknown mode is refused');
   assert.ok(lib.validateStatesFile({ page: '/x', modes: [], states: { a: {} } }).errors.some((e) => e.startsWith('modes:')), 'an empty modes list is refused');
@@ -146,6 +149,33 @@ test('checkMock: the platform rules catch a page :root, a literal colour, a pinn
   assert.ok(f5.some((r) => r.startsWith('every dark rule written twice')), f5.join(' | '));
 });
 
+test('serve.js answers the manage flows with the routes\' receipts, signed in only (task 1003345)', async () => {
+  const s = await lib.startStub({ surface: 'public-landing', auth: true });
+  try {
+    const post = (p, method = 'POST', body = '{}') => fetch(s.base + p, { method, headers: { 'content-type': 'application/json' }, body });
+    for (const [p, msg] of [['/api/bongos/provisioning/instances/101/teardown', 'Teardown queued.'], ['/api/bongos/provisioning/instances/105/restart', 'Restart queued.'],
+      ['/api/bongos/provisioning/instances/101/domain', 'Address recorded.'], ['/api/bongos/provisioning/instances', 'Queued. The platform picks it up from here.']]) {
+      const r = await post(p); assert.equal(r.status, 200, p); assert.equal((await r.json()).message, msg, p);
+    }
+    const patched = await post('/api/bongos/provisioning/instances/101/settings', 'PATCH', '{"joinability":"apply"}');
+    assert.equal(patched.status, 200); assert.equal((await patched.json()).push.message, 'Saved. The project restarts to apply it.');
+    assert.equal((await post('/api/bongos/provisioning/instances/101/settings')).status, 404, 'settings take PATCH, not POST');
+    assert.equal((await post('/api/bongos/provisioning/instances/101/nope')).status, 404, 'no invented flow');
+    const asked = await (await fetch(s.base + '/api/bongos/provisioning/instances/101')).json();
+    assert.deepEqual(asked.open_intent && { action: asked.open_intent.action, state: asked.open_intent.state }, { action: 'teardown', state: 'queued' }, 'a teardown ask is remembered for the run — the page re-reads the project as queued');
+    assert.match(String(asked.open_intent.created_at), /^\d{4}-\d{2}-\d{2}T/, 'stamped like the route stamps it');
+    const untouched = await (await fetch(s.base + '/api/bongos/provisioning/instances/104')).json();
+    assert.equal(untouched.open_intent, null, 'an instance nobody asked about is unchanged');
+    const list = await (await fetch(s.base + '/api/bongos/provisioning/instances')).json();
+    assert.equal(list.instances.length, 5, 'the fifth row (Mooring) is served');
+    assert.equal(list.instances.find((i) => i.id === 105).open_intent.action, 'restart', 'the list carries the asks too');
+  } finally { s.stop(); }
+  const out = await lib.startStub({ surface: 'public-landing', auth: false });
+  try {
+    assert.equal((await fetch(out.base + '/api/bongos/provisioning/instances/101/teardown', { method: 'POST' })).status, 401, 'signed out, every ask is refused');
+  } finally { out.stop(); }
+});
+
 test('checkMock: a taste ban applies only when the instance declared it', () => {
   const dashed = GOOD_MOCK.replace('Plain copy.', 'Plain — copy.');
   const withBan = mock.checkMock(dashed, { bans: new Set(['em-dash']) });