@bongos/core 1.19.428 → 1.19.430

package/tests/profile_connections_ui.mjs

@@ -544,6 +544,44 @@ test('a 2nd-degree connection names the mutuals it was computed from', async ()
   assert.match(page.html(), /data-handle="bo"/, 'the write must address the canonical handle, never the login the page happened to hold');
 });
 
+// The gap ADR 0212 stated honestly and left to task 1002804: the login hop
+// resolves against the current handle or ONE previous-handle slot, so a builder
+// who renamed twice matched neither and got no section at all. Now that
+// GET /builders/:id/profile carries the canonical `handle` (ADR 0214 D3), the
+// page addresses by that and the login is only the fallback.
+test('the canonical handle from the profile response is what gets addressed, not the login', async () => {
+  reset();
+  const page = boot();
+  // A twice-renamed builder: 'bo' is current, 'bo-was' is the single previous
+  // slot, and the login the page holds ('bo-ancient') matches NEITHER.
+  await page.render({ builder: { id: 12, github_login: 'bo-ancient' }, handle: 'bo' }, 99);
+  assert.equal(page.$('#conn-scroll').hidden, false,
+    'a twice-renamed builder used to get no connections section at all — that is the hole the widened response closes');
+  assert.match(page.html(), />2nd</);
+  assert.ok(asked.some((p) => p.includes('/connections/degree/bo')),
+    'the canonical handle must be what is asked for');
+  assert.ok(!asked.some((p) => p.includes('bo-ancient')),
+    'the stale login must not be sent once the response names the builder canonically');
+});
+
+test('a profile response with no handle still falls back to the login hop', async () => {
+  reset();
+  const page = boot();
+  // An instance whose server predates the widening sends no `handle` key at all.
+  await page.render(profileOf('bo-was', 12), 99);
+  assert.match(page.html(), />2nd</);
+  assert.ok(asked.some((p) => p.includes('/connections/degree/bo-was')),
+    'without a handle the page must still hand over the login it holds');
+});
+
+test('an empty-string handle is not treated as an address', async () => {
+  reset();
+  const page = boot();
+  await page.render({ builder: { id: 12, github_login: 'bo-was' }, handle: '' }, 99);
+  assert.ok(asked.some((p) => p.includes('/connections/degree/bo-was')),
+    'a falsy handle must fall through to the login, never be sent as an empty path segment');
+});
+
 test('a 3rd-degree connection renders "3rd"', async () => {
   reset();
   const page = boot();

package/tests/profile_route.mjs

@@ -470,11 +470,36 @@ await t('R06.1 the record is viewer-INDEPENDENT — another account sees the sam
 await t('R06.1 the profile read takes NO auth middleware — the portfolio is shareable', () => {
   // A future PR walling this behind requireBuilder would break "another account
   // can see it" while every assertion above still passed, so pin the shape.
-  const line = sourceOf('src/bongos/routes/builders.js').split('\n')
-    .find((l) => l.includes("router.get('/builders/:id/profile'"));
-  assert.ok(line, 'the profile route registration is findable');
-  assert.match(line, /router\.get\('\/builders\/:id\/profile', async \(req, res\) => \{/,
-    'nothing may sit between the path and the handler — that is what makes the record public');
+  //
+  // Asserted against the REAL ROUTER STACK rather than the registration line
+  // (task 1002804). The old line-regex demanded the handler be the only thing on
+  // the route, which caught an inline `requireBuilder` — but missed one mounted
+  // by `router.use`, and could not tell an auth gate from a rate limiter. This
+  // form catches both mounting styles and names what it forbids: AUTH. Throttling
+  // is not authentication — /public/* is rate-limited and public — so the shared
+  // public read limiter is allowed BY IDENTITY (a private copy would be a second
+  // budget, ADR 0209), and nothing else is.
+  const auth = require('../src/bongos/auth.js');
+  const { publicReadRateLimitMiddleware } = require('../src/bongos/middleware/rate-limit.js');
+  const router = buildBuildersRouter();
+  const layer = router.stack.find(
+    (l) => l.route && l.route.path === '/builders/:id/profile' && l.route.methods.get,
+  );
+  assert.ok(layer, 'the profile route registration is findable');
+
+  const bare = router.stack.filter((l) => !l.route).map((l) => l.handle);
+  assert.deepEqual(bare, [], 'a router-level middleware would gate EVERY route here, this one included');
+
+  const handlers = layer.route.stack.map((s) => s.handle);
+  const authGates = new Set(Object.values(auth).filter((v) => typeof v === 'function'));
+  for (const h of handlers) {
+    assert.ok(!authGates.has(h),
+      'an auth gate sits on the profile read — that is what would stop another account seeing the record');
+  }
+  const ALLOWED = new Set([publicReadRateLimitMiddleware]);
+  const extra = handlers.slice(0, -1).filter((h) => !ALLOWED.has(h));
+  assert.deepEqual(extra, [],
+    'only the shared public read limiter may sit between the path and the handler — anything else must justify itself here first');
 });
 
 await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is planted', async () => {

package/tests/projects_hub.mjs

@@ -187,8 +187,10 @@ test('the mine row draws the project\'s planet — the catalog\'s template when
   assert.doesNotMatch(orb, /class="orb/, 'the sphere is gone');
   const planet = (SCRIPT.match(/function planetOf\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.match(planet, /hostOf\(catalog\[i\]\.origin\) === h/, 'matched by host, the same join the map makes');
-  assert.match(planet, /tpl: templateOf\(catalog\[i\]\), acc: accentOf\(catalog\[i\]\)/, 'a catalog match takes the catalog\'s template + accent');
-  assert.match(planet, /tpl: slugTemplate\(inst\.slug\), acc: ORB_ACCENTS\[slugAccent\(inst\.slug\)\]/, 'owned-only walks by slug');
+  assert.match(planet, /var own = \{ tpl: knownTemplate\(inst\.planet_template\), acc: accentVar\(inst\.planet_accent\) \};/, 'the owner\'s own choice is read off the row first (task 1003347)');
+  assert.match(planet, /tpl: own\.tpl \|\| templateOf\(c\), acc: own\.acc \|\| accentOf\(c\)/, 'a catalog match takes the catalog\'s template + accent under the owner\'s choice');
+  assert.match(planet, /tpl: own\.tpl \|\| slugTemplate\(inst\.slug\), acc: own\.acc \|\| ORB_ACCENTS\[slugAccent\(inst\.slug\)\]/, 'owned-only walks by slug under the owner\'s choice');
+  assert.match(planet, /chosen: !!\(own\.tpl \|\| own\.acc\)/, 'the row says whose pick it is');
   assert.match(SCRIPT, /assignAccents\(\); applyMapFilter\(\); repaintPlanets\(\);/, 'a catalog that lands late repaints the rows');
   assert.doesNotMatch(COSMOS, /\n\.orb\{/, 'cosmos no longer carries the sphere');
 });
@@ -1531,8 +1533,9 @@ test('the planet templates: shape × material × style; the walk changes all thr
 test('the walk assigns the template by canonical position beside the accent; a curated template wins; the platform is the pair in chrome', () => {
   assert.match(SCRIPT, /function assignAccents[\s\S]*?p\._acc = ORB_ACCENTS\[i % ORB_ACCENTS\.length\];\s*p\._tpl = ORB_WALK\[i % ORB_WALK\.length\];/,
     'one walk, two assignments');
-  assert.match(SCRIPT, /function templateOf\(p\) \{\s*return ORB_TEMPLATES\.indexOf\(p\.template\) !== -1 \? p\.template : \(p\._tpl \|\| ORB_WALK\[0\]\);/,
-    'a curated name wins; an unknown name is not a choice');
+  assert.match(SCRIPT, /function templateOf\(p\) \{\s*if \(knownTemplate\(p\.planet_template\)\) return p\.planet_template;\s*return ORB_TEMPLATES\.indexOf\(p\.template\) !== -1 \? p\.template : \(p\._tpl \|\| ORB_WALK\[0\]\);/,
+    'the owner\'s choice wins, then a curated name; an unknown name is not a choice (task 1003347)');
+  assert.match(SCRIPT, /function accentOf\(p\) \{ return accentVar\(p\.planet_accent\) \|\| p\._acc \|\| ORB_ACCENTS\[0\]; \}/, 'the owner\'s colour by NAME, then the walk');
   assert.match(SCRIPT, /_acc: ORB_ACCENTS\[slugAccent\(inst\.slug\)\], _tpl: slugTemplate\(inst\.slug\)/, 'an owned-only entry walks by its slug');
   assert.match(SCRIPT, /function slugTemplate\(slug\) \{ return ORB_WALK\[slugHash\(slug\) % ORB_WALK\.length\]; \}/, 'by the walk, not the whole set');
   assert.match(SCRIPT, /var tpl = templateOf\(p\), tplParts = tpl\.split\('-'\);\s*a\.setAttribute\('data-template', tpl\);\s*a\.setAttribute\('data-shape', tplParts\[0\]\);\s*a\.setAttribute\('data-material', tplParts\.length === 3 \? tplParts\[1\] : 'chrome'\);\s*a\.setAttribute\('data-style', tplParts\[tplParts\.length - 1\]\);/,
@@ -1647,13 +1650,125 @@ test('the kit proves the field path: the fixture carries a curated template and
   const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'featured.json'), 'utf8'));
   const otb = fixture.projects.find((p) => p.origin === 'https://amazonprimea.com');
   assert.equal(otb.template, 'bead-wash');
-  assert.equal(fixture.projects.find((p) => p.origin === 'https://demo.cloudbongos.com').template, 'pair-gold-wash', 'a material template rides the wire (task 1003337)');
-  assert.ok(fixture.projects.every((p) => 'template' in p), 'the wire never drops the key');
+  const demo = fixture.projects.find((p) => p.origin === 'https://demo.cloudbongos.com');
+  assert.equal(demo.template, 'pair-gold-wash', 'a material template rides the wire (task 1003337)');
+  assert.equal(demo.planet_template, 'pair-obsidian-tint', 'the owner\'s choice rides the same wire (task 1003347)');
+  assert.equal(demo.planet_accent, 'sea', 'a token NAME, never a colour');
+  assert.ok(fixture.projects.every((p) => 'template' in p && 'planet_template' in p && 'planet_accent' in p), 'the wire never drops a key');
   const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
   const attrs = states.states['in-map'].expect.attr.map((a) => a.join(' '));
   assert.ok(attrs.includes('#selfOrb data-template pair-chrome'));
   assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
-  assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material gold')), 'the material reaches the orb as its own attribute');
+  assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material obsidian')), 'the material reaches the orb as its own attribute');
+  assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-template pair-obsidian-tint')), 'the owner\'s choice outranks the curated template on the sky (task 1003347)');
+});
+
+/* ── the planet picker (task 1003347; direction record §16, v1 the bands): the owner's own
+   choice, read first everywhere a planet is drawn; the "its planet" section on the manage
+   page; a settings save that restarts nothing ── */
+test('the picker: the owner\'s choice is one of the sky\'s thirty-six names and one of the five accents BY NAME — the same lists the server validates (task 1003347)', () => {
+  const req = createRequire(import.meta.url);
+  const prov = req(path.join(ROOT, 'modules', 'provisioning', 'provisioning.js'));
+  assert.match(SCRIPT, /var ORB_ACCENT_NAMES = \['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'\];/, 'the five by name, in the palette\'s order');
+  assert.deepEqual([...prov.PLANET_ACCENTS], ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'], 'the server\'s allow-list is the same five');
+  assert.match(SCRIPT, /function accentVar\(name\) \{ var i = ORB_ACCENT_NAMES\.indexOf\(name\); return i === -1 \? '' : ORB_ACCENTS\[i\]; \}/, 'a name maps to its var(); an unknown name is nothing');
+  // the client mirror of PROJECT_TEMPLATES (pinned above) and the server's PLANET mirror agree
+  const pi = req(path.join(ROOT, 'modules', 'platform-identity', 'platform-identity.js'));
+  assert.deepEqual([...prov.PLANET_TEMPLATES], [...pi.PROJECT_TEMPLATES], 'provisioning validates the very names the catalog and the sky know');
+  assert.match(SCRIPT, /function pickTemplate\(s\) \{\s*if \(s\.material === 'chrome'\) return s\.shape \+ '-' \+ \(s\.style === 'plain' \? 'chrome' : s\.style\);\s*return s\.shape \+ '-' \+ s\.material \+ '-' \+ s\.style;/, 'shape × material × style composes a stored name; the chrome material\'s plain is spelled chrome');
+  assert.match(SCRIPT, /function pickFrom\(pl\) \{[\s\S]*?style: style === 'chrome' \? 'plain' : style,\s*accent: ORB_ACCENT_NAMES\[ORB_ACCENTS\.indexOf\(pl\.acc\)\] \|\| ORB_ACCENT_NAMES\[0\] \};/, 'and a drawn planet decomposes back into the four fields');
+});
+
+test('the picker is live markup on the manage page: the section, its body slot and a sibling fold (the .mSec shape), and the ledger row says whose pick it is', () => {
+  assert.match(HUB, /<div class="card mSec" id="mPlanetPick">\s*<h2>Its planet<\/h2>\s*<div id="mPick">/, 'the section with its volatile slot');
+  assert.match(HUB, /<details class="finePrint" id="mPickWhat">/, 'the fold is a SIBLING of the slot');
+  const sec = (HUB.match(/<div class="card mSec" id="mPlanetPick">([\s\S]*?)<\/details>/) || [, ''])[1];
+  assert.match(sec, /<b>shape<\/b>[\s\S]*<b>material<\/b>[\s\S]*<b>style<\/b>[\s\S]*<b>colour<\/b>/, 'the fold names the four choices');
+  assert.match(sec, /no restart, nothing to apply/, 'and says the planet is the platform\'s to draw');
+  assert.match(HUB, /id="mJoinability"[\s\S]*id="mPlanetPick"[\s\S]*id="mDelete"/, 'between how people join and the ender');
+  const pm = (SCRIPT.match(/function paintManagePlanet\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(pm, /pl\.chosen \? '<small>your choice\.<\/small>' : pl\.curated \? '' : '<small>chosen for it by the platform\.<\/small>'/, 'your choice · (curated, no clause) · chosen for it by the platform');
+  const rm = (SCRIPT.match(/function renderManage\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(rm, /renderPick\(inst\);/, 'renderManage paints the picker, fetch-free');
+});
+
+test('the picker\'s script: the preview planet and four radiogroups built from the sky\'s own names; a pick in progress survives the tick and a late catalog; the save is the settings PATCH and restarts nothing', () => {
+  const rp = (SCRIPT.match(/function renderPick\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(rp, /var pl = planetOf\(inst\);/, 'one resolution — the head, the row and the preview can never disagree');
+  assert.match(rp, /<span class="worldOrb"' \+ planetAttrs\(preview\) \+ ' style="--acc:' \+ preview\.acc \+ ';--d:132px"/, 'the preview is the sky\'s object with the template attributes');
+  assert.match(rp, /pickBand\('Shape', 'mPickShape', PICK_SHAPES, s\.shape\)[\s\S]*pickBand\('Material', 'mPickMaterial', PICK_MATERIALS, s\.material\)[\s\S]*pickBand\('Style', 'mPickStyle', PICK_STYLES, s\.style\)/, 'three bands of cells');
+  assert.match(rp, /<div class="pickSwatches" role="radiogroup" aria-label="Colour">/, 'the colour as a radiogroup of swatches');
+  assert.match(rp, /style="--sw:' \+ accentVar\(a\[0\]\) \+ '"/, 'a swatch is its token, never a literal');
+  assert.match(rp, /pl\.chosen \? '<button type="button" class="btn small ghost" data-pick-reset>Let the platform choose again<\/button>' : ''/, 'the way back to the platform\'s pick, only once a choice is stored');
+  assert.match(rp, /else if \(\$\('mPick'\)\.querySelector\('\.pick'\)\) return;/, 'the tick does not rebuild a pick in progress');
+  assert.match(SCRIPT, /if \(manageInst && !mPickTouched && JSON\.stringify\(pickFrom\(planetOf\(manageInst\)\)\) !== mPickSeed\) \{ mPick = null; renderPick\(manageInst\); \}/, 'a late catalog reseeds only an untouched pick whose resolution changed');
+  const save = (SCRIPT.match(/function doPickSave\(reset\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(save, /var body = reset \? \{ planet_template: null, planet_accent: null \} : \{ planet_template: pickTemplate\(mPick\), planet_accent: mPick\.accent \};/, 'null hands the pick back; a choice sends the name and the accent by name');
+  assert.match(save, /\/settings', \{\s*method: 'PATCH'/, 'the settings PATCH the two sections above use');
+  assert.match(save, /manageInst\.planet_template = planet\.planet_template \|\| null;\s*manageInst\.planet_accent = planet\.planet_accent \|\| null;/, 'the row now holds the choice');
+  assert.match(save, /repaintPlanets\(\);/, 'the head, the ledger row and the list repaint from the row');
+  assert.match(save, /loadCatalog\(\);/, 'and the sky re-reads the feed that carries it');
+  assert.doesNotMatch(save, /loadManage\(/, 'no re-read for an open intent: a planet change queues none');
+  assert.match(save, /\(data\.push && data\.push\.message\) \|\| 'Saved\.'/, 'the receipt is shown verbatim');
+});
+
+test('the picker wears the world by scope: the preview left and four bands right on hairlines, cells with the dot, swatches as their tokens; under 900 the cells are the list\'s pills; no box shadow, no literal colour', () => {
+  const block = (COSMOS.match(/\/\* ── its planet \(task 1003347([\s\S]*?)\/\* this block stays HERE/) || [, ''])[1];
+  assert.ok(block, 'the block sits in the manage page\'s scope');
+  assert.match(block, /#view-manage \.pick\{display:grid;grid-template-columns:168px 1fr;gap:0 34px;align-items:start;\}/, 'the preview beside the bands');
+  assert.match(block, /#view-manage \.pickBand\{display:grid;grid-template-columns:88px 1fr;[^}]*border-top:1px solid var\(--rule\);\}/, 'each band on a hairline, its label in a column');
+  assert.match(block, /#view-manage \.pickCells\[role="radiogroup"\]\{display:grid;grid-template-columns:none;grid-auto-flow:column;grid-auto-columns:1fr;border:0;\}/, 'the cells outrank the generic radiogroup rule');
+  assert.match(block, /#view-manage \.pickCell::before\{content:"";width:7px;height:7px;border-radius:50%;/, 'the dot');
+  assert.match(block, /#view-manage \.pickCell\.on::before\{background:var\(--accent\);border-color:var\(--accent\);outline:4px solid color-mix\(in srgb,var\(--accent\) 22%,transparent\);\}/, 'the chosen cell\'s dot on the accent with its halo');
+  assert.match(block, /#view-manage \.pickSw\{[^}]*background:var\(--sw\);/, 'a swatch paints its token');
+  assert.match(block, /#view-manage \.pickSw\.on\{outline:1px solid var\(--ink\);outline-offset:3px;\}/, 'the chosen swatch ringed by a hairline of the ink');
+  assert.doesNotMatch(block, /box-shadow/, 'hairlines only');
+  assert.doesNotMatch(block, /#[0-9a-fA-F]{3,8}\b/, 'no literal colour (the Fifteen Rule)');
+  const fold = (COSMOS.match(/@media \(max-width:900px\)\{[\s\S]*?#view-manage \.pick\{grid-template-columns:1fr;gap:22px 0;\}([\s\S]*?)\n\}/) || [, ''])[1];
+  assert.match(fold, /#view-manage \.pickCells\[role="radiogroup"\]\{display:flex;flex-wrap:wrap;gap:8px;padding:0 0 14px;\}/, 'the cells flow as pills');
+  assert.match(fold, /#view-manage \.pickCell\.on\{background:var\(--ink\);color:var\(--bg\);border-color:var\(--ink\);\}/, 'the chosen one inverted to ink, the filter pills\' grammar');
+  assert.match(fold, /#view-manage \.pickCell::before\{display:none;\}/, 'no dot on a pill');
+});
+
+test('the kit proves the picker: a state renders it on the owner\'s feed-carried choice, three probes save / hand back / fold, and both fixtures carry the choice (task 1003347)', () => {
+  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const st = states.states['in-manage-planet'];
+  assert.ok(st && st.auth && st.url === '/projects?view=manage&id=101', 'the signed-in owner on Demo');
+  assert.ok(st.expect.visible.includes('#mPlanetPick') && st.expect.visible.includes('#mPick [data-pick-reset]'));
+  assert.deepEqual(st.expect.count.find((c) => c[0] === '#mPick .pickCell'), ['#mPick .pickCell', 10], 'three + four + three cells');
+  assert.deepEqual(st.expect.count.find((c) => c[0] === '#mPick .pickSw'), ['#mPick .pickSw', 5]);
+  assert.ok(st.expect.attr.some((a) => a[0] === '#mOrb .worldOrb' && a[2] === 'pair-obsidian-tint'), 'the head wears the owner\'s choice over the curated template');
+  assert.ok(st.expect.text.some((t) => t[0] === '#mPlanet .v small' && t[1] === 'your choice.'));
+  const mine = states.states['in-mine'].expect.count.find((c) => c[0] === '#projectsList .proj .worldOrb[data-template="blob-frost-tint"]');
+  assert.deepEqual(mine, ['#projectsList .proj .worldOrb[data-template="blob-frost-tint"]', 1], 'an owned-only row draws the choice off its own row');
+  const inst = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'provisioning-instances.json'), 'utf8'));
+  const harbor = inst.instances.find((i) => i.slug === 'harbor');
+  assert.equal(harbor.planet_template, 'blob-frost-tint');
+  assert.equal(harbor.planet_accent, 'sun-lit');
+  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8'));
+  const names = probes.probes.map((p) => p.name);
+  assert.ok(names.some((n) => n.startsWith('manage flows: its planet (task 1003347)')), 'the save probe');
+  assert.ok(names.some((n) => n.includes('handed back to the platform')), 'the reset probe');
+  assert.ok(names.some((n) => n.includes('its planet at 390')), 'the fold probe');
+  const saveProbe = probes.probes.find((p) => p.name.startsWith('manage flows: its planet (task 1003347)'));
+  assert.ok(saveProbe.expect.text.some((t) => t[1] === 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.'), 'the route\'s no-restart receipt, verbatim');
+  const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(stub, /const PLANETS = new Map\(\);/, 'the stub remembers a saved planet for the run');
+  assert.match(stub, /planet: PLANETS\.get\(String\(id\)\) \|\| NO_PLANET/, 'and answers it on the settings read and the receipt');
+});
+
+test('the feed carries the owner\'s choice through a seam: platform-identity resolves provisioning.projectPlanets optionally and spreads both keys on every project (task 1003347)', () => {
+  const route = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'routes', 'projects.js'), 'utf8');
+  assert.match(route, /api\.resolveOptional\('provisioning\.projectPlanets', async \(\) => \(\{\}\)\)\(projects\.map\(\(p\) => hostOfOrigin\(p\.origin\)\)\)/, 'optional — an instance without provisioning has no choices to carry');
+  assert.match(route, /return \{ planet_template: c\.planet_template \|\| null, planet_accent: c\.planet_accent \|\| null \};/, 'the wire always carries both keys');
+  assert.match(route, /\.\.\.planetOf\(p\),/, 'spread beside the stats');
+  assert.doesNotMatch(route, /require\(['"][^'"]*provisioning/, 'never an import across modules');
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'module.json'), 'utf8'));
+  assert.ok(manifest.provides.includes('provisioning.projectPlanets'), 'the port is declared');
+  const pi = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'module.json'), 'utf8'));
+  assert.ok(!(pi.consumes || []).includes('provisioning.projectPlanets'), 'not a required capability — the hub must boot without provisioning');
+  const prov = fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'), 'utf8');
+  assert.match(prov, /api\.registerProvider\('provisioning\.projectPlanets', \(hosts\) => provisioning\.planetChoicesForHosts\(pool, hosts\)\);/, 'registered beside instanceState');
 });
 
 /* ── the table's columns on FIXED tracks (task 1003348; the owner, 2026-08-29: "the

package/tests/provisioning_settings.mjs

@@ -44,7 +44,8 @@ provisioning.recordEvent = async (_db, e) => { events.push(e); };
 provisioning.getOpenIntent = async () => null;
 // The live push (task 1003140) — stubbed so the reachable path is deterministic here;
 // its own outcomes are covered in tests/provisioning_settings_apply.mjs.
-provisioning.enqueueSettingsApply = async () => ({ intent: { id: 9, action: 'settings-apply', state: 'pending' }, created: true });
+let enqueueCalls = 0;           // the live push — a planet change must never queue one (task 1003347)
+provisioning.enqueueSettingsApply = async () => { enqueueCalls++; return { intent: { id: 9, action: 'settings-apply', state: 'pending' }, created: true }; };
 let manifest = null;            // the latest manifest attempt the read surfaces (task 1003235)
 provisioning.getLatestOAuthManifestForInstance = async () => manifest;
 
@@ -100,6 +101,7 @@ function reset({ inst, as } = {}) {
   builder = as || { id: 7, github_login: 'owner', rank: 'thetes' };
   updateCalls = [];
   events = [];
+  enqueueCalls = 0;
 }
 
 console.log('GET /provisioning/instances/:id (the manage page\'s read — task 1003041):');
@@ -163,7 +165,20 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(r.body.options, { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] });
+  // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null });
+  assert.deepEqual(r.body.options, {
+    platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'],
+    planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
+  });
+});
+
+await ta('a stored planet reads back; a name that left the vocabulary reads null (task 1003347)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { planet_template: 'bead-obsidian-tint', planet_accent: 'purple' } } });
+  const r = await get('/provisioning/instances/18/settings');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
@@ -247,6 +262,70 @@ await ta('an unknown key → 400 (strict: a typo fails loudly, never silently dr
   assert.equal(updateCalls.length, 0);
 });
 
+console.log('\nPATCH …/settings — the planet (task 1003347):');
+
+await ta('the owner picks a planet: saved, echoed as `planet`, audited — and NO push, NO restart (the platform draws it)', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply' }, 'the policy half is untouched');
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
+  assert.equal(r.body.push.queued, false);
+  assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');
+  assert.match(r.body.push.message, /nothing on your project restarts/);
+  assert.equal(enqueueCalls, 0, 'no settings-apply intent for a planet change');
+  assert.equal(events.length, 1);
+  assert.match(events[0].detail, /planet_template=bead-obsidian-tint, planet_accent=sea/);
+});
+
+await ta('null hands the pick back to the platform (stored as null, read back as null)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } } });
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: null, planet_accent: null });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: null, planet_accent: null } }]);
+  assert.equal(enqueueCalls, 0);
+});
+
+await ta('the same planet re-sent → "No change", nothing written', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { planet_template: 'bead-obsidian-tint' } } });
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint' });
+  assert.equal(r.status, 200, r.raw);
+  assert.match(r.body.push.message, /^No change/);
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('a planet re-sent over a retired push\'s error_note does NOT re-kick the push (only a policy key does)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', error_note: 'settings-apply failed', settings: { planet_template: 'bead-obsidian-tint' } } });
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls, 0, 'the planet never restarts anything');
+  const r2 = await patch('/provisioning/instances/18/settings', { joinability: 'apply' });
+  assert.equal(r2.status, 200, r2.raw);
+  assert.equal(enqueueCalls, 1, 'the policy re-kick (the domain route\'s F19 shape) still works');
+});
+
+await ta('a policy change and a planet change in one save: the push queues for the policy, the planet rides along', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { joinability: 'open', planet_accent: 'gold-soft' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.push.queued, true);
+  assert.equal(r.body.planet.planet_accent, 'gold-soft');
+  assert.equal(r.body.saved.joinability, 'open');
+  assert.equal(enqueueCalls, 1);
+});
+
+await ta('an off-vocabulary planet → 400 validation_failed (a colour is a token NAME, never a hex)', async () => {
+  reset();
+  for (const body of [{ planet_accent: '#fb9569' }, { planet_accent: 'purple' }, { planet_template: 'cube-gold-wash' }]) {
+    const r = await patch('/provisioning/instances/18/settings', body);
+    assert.equal(r.status, 400, r.raw);
+    assert.equal(r.body.error.code, 'validation_failed');
+  }
+  assert.equal(updateCalls.length, 0);
+});
+
 await ta('an empty body → 400 bad_settings with a plain sentence naming the keys', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', {});

package/tests/provisioning_settings_env.mjs

@@ -71,6 +71,12 @@ t('the prefix is the pack\'s, not a guess — a wrong prefix silently never fire
   assert.ok(!('CLOUDBONGOS_PLATFORM_VISIBILITY' in v));
 });
 
+t('the planet never rides the env transport (task 1003347): it is the platform\'s to draw, not the instance\'s to run', () => {
+  const vars = provisioning.settingsEnvVars({ settings: { platform_visibility: 'gated', planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }, 'CB');
+  for (const k of Object.keys(vars)) assert.doesNotMatch(k, /PLANET/, k);
+  assert.doesNotMatch(provisioning.settingsEnvLines({ settings: { planet_template: 'bead-obsidian-tint' } }, 'CB'), /planet|PLANET/);
+});
+
 t('every emitted key is in SETTINGS_VOCAB — the two lists cannot drift', () => {
   const keys = linesOf(provisioning.settingsEnvLines({}, 'X')).map((l) => l.split('=')[0].replace(/^X_/, '').toLowerCase());
   assert.deepEqual(keys.sort(), Object.keys(provisioning.SETTINGS_VOCAB).sort(),