@bongos/core 1.19.429 → 1.19.431

package/tests/account_privacy_flags.mjs

@@ -32,6 +32,12 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
+// The sliver's own key lists — the copy guard below is written against THESE,
+// not against a transcription of them, so a sixth granted field cannot be added
+// without the Settings copy being made to name it (privacy spec D3: the toggle's
+// copy "must state exactly this grant").
+import { SLIVER_KEYS, SLIVER_KEYS_HIDDEN } from '../modules/platform-identity/recruiter-sliver.js';
+
 const require = createRequire(import.meta.url);
 const express = require('express');
 
@@ -173,6 +179,51 @@ test('setAccountPrivacy accepts an explicit null discoverable — the reset to "
   assert.equal(calls[0].params[7], true, 'and it counts as sent');
 });
 
+/**
+ * Resolve what the UPDATE branch would store in `recruiter_discoverable`, from
+ * the statement's OWN text — the WHERE-derived-fake principle applied to a CASE.
+ * Each arm is recognised, and an arm this reader cannot see simply is not
+ * modelled, so deleting one from the SQL genuinely changes the answer here.
+ */
+function resolveStoredReach(sql, params, stored) {
+  const from = sql.indexOf('recruiter_discoverable = CASE');
+  assert.ok(from >= 0, 'the reach column lost its CASE entirely');
+  const body = sql.slice(from, sql.indexOf('END', from));
+  const [visibilityWritten, reachWritten, setVisibility, setReach] = params.slice(4, 8);
+  assert.match(body, /ELSE platform_identity_accounts\.recruiter_discoverable/,
+    'the CASE must still fall through to the STORED value — without the ELSE every PATCH would clear the flag');
+  if (/WHEN \$8::boolean THEN EXCLUDED\.recruiter_discoverable/.test(body) && setReach) return reachWritten;
+  if (/WHEN \$7::boolean AND EXCLUDED\.account_visibility = 'private' THEN NULL/.test(body)
+      && setVisibility && visibilityWritten === 'private') return null;
+  return stored;
+}
+
+test('GOING PRIVATE re-arms the reach default, so a consent given while public is not silently reused', async () => {
+  // THE DEFECT THIS CLOSES (found in adversarial review of task 1002968). A
+  // public builder toggles "Discoverable by recruiters" off and on again: the
+  // column is now an explicit `true`, not NULL. They later set the profile to
+  // Private, reading a row that promises the page "answers not found to every
+  // visitor". That stale `true` used to be INERT — every recruiting surface
+  // floored on the existence axis. The D3 sliver does not, by design, so it
+  // would have served them under a consent they gave to a different question.
+  //
+  // Each row is resolved from the statement's own CASE, so removing the new arm
+  // makes the first row answer `true` and this test red.
+  const cases = [
+    ['private, reach unnamed → RESET', { account_visibility: 'private' }, true, null],
+    ['private, reach named true → the owner re-consented, so it stands', { account_visibility: 'private', recruiter_discoverable: true }, true, true],
+    ['private, reach named false → explicit off', { account_visibility: 'private', recruiter_discoverable: false }, true, false],
+    ['public, reach unnamed → untouched', { account_visibility: 'public' }, true, true],
+    ['reach alone, no visibility change → untouched', { recruiter_discoverable: false }, true, false],
+    ['private on an account that never opted in → still the default', { account_visibility: 'private' }, null, null],
+  ];
+  for (const [name, fields, stored, want] of cases) {
+    expect({ rows: [row({ recruiter_discoverable: want })] });
+    await pi.setAccountPrivacy({ githubId: SESSION.github_id, fields }, { pool });
+    assert.equal(resolveStoredReach(calls[0].text, calls[0].params, stored), want, name);
+  }
+});
+
 test('setAccountPrivacy refuses a value outside the model, before any query', async () => {
   expect();
   assert.equal((await pi.setAccountPrivacy(
@@ -271,15 +322,45 @@ test('neither flag crosses a PUBLIC response — the /u/<handle> read stays a wh
 
 // ---- 5. the settings copy states the grant ---------------------------------
 
-test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, name-only when hidden', () => {
+// How each granted FIELD has to read to a person. Keyed by the module's export,
+// so this map is the place a sixth key must be described before it can ship —
+// and the "every key is described" assertion below is what makes that binding.
+const GRANT_WORDS = {
+  handle: /your name/,
+  display_name: /your name/,
+  avatar_url: /your picture/,
+  disciplines: /your disciplines/,
+  active_recently: /active in the last 30 days/,
+};
+
+test('the discoverable toggle names EXACTLY what it grants — checked against SLIVER_KEYS itself', () => {
   const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
   const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
-  assert.match(js, /your name, your disciplines, and whether you have been active in the last 30 days/,
-    'the sliver is name + disciplines + a coarse activity signal — spelled out, not implied');
+  // Privacy spec D3 makes this a MUST: "The discoverable toggle's settings copy
+  // must state exactly this grant." It was checked against three transcribed
+  // phrases, and the transcription had gone stale in the direction that matters:
+  // the copy said the hidden sliver was "your name and nothing else" while
+  // SLIVER_KEYS_HIDDEN also ships avatar_url, and the shown branch never named
+  // the picture at all. A user was being told something false about their own
+  // privacy. It is now checked against the shipped key lists.
+  const shown = /: 'They will see ([^']+)'/.exec(js);
+  const hidden = /\? 'Because your cross-project record is hidden, ([^']+)'/.exec(js);
+  assert.ok(shown && hidden, 'both branches of the grant string must still be findable');
+
+  for (const key of SLIVER_KEYS) {
+    assert.ok(GRANT_WORDS[key], `SLIVER_KEYS grew "${key}" and nothing here says how to describe it — spec D3 says the copy must state the grant, so a new granted field cannot ship undescribed`);
+    assert.match(shown[1], GRANT_WORDS[key], `the toggle must name "${key}" — it is in the sliver a recruiter receives`);
+  }
+  for (const key of SLIVER_KEYS_HIDDEN) {
+    assert.match(hidden[1], GRANT_WORDS[key], `hidden, the sliver still ships "${key}", so the name-only copy must still name it`);
+  }
+  for (const key of SLIVER_KEYS.filter((k) => !SLIVER_KEYS_HIDDEN.includes(k))) {
+    assert.doesNotMatch(hidden[1], GRANT_WORDS[key], `"${key}" drops under hide_stats, so the copy must not keep promising it`);
+  }
   assert.match(js, /never your credits, works shipped, karma, or the projects you build on/,
     'and the copy says what it does NOT grant');
-  assert.match(js, /cross-project record is hidden, they will see your name and nothing else/,
-    'hide_stats shrinks the grant to name-only, because the rest is rollup-derived');
+  assert.match(js, /the one thing a recruiter can see while your profile page is private/,
+    'a private account is told the sliver is the exception to "not found to every visitor" — the surprising half of D2/D3');
   assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
     'the section ships hidden — it reveals only where the hub module answers');
 });
@@ -304,13 +385,38 @@ test('each toggle claims exactly what is enforced — and BOTH are now in force'
     'recruiting reach is enforced now (task 1002290), so the row promises it in the present tense');
   assert.doesNotMatch(js, /will be able to find you/,
     'the future tense outlived its truth the moment listScoutingRollup joined the reach predicate');
-  assert.match(js, /takes you out of the People directory straight away/,
-    'and the row names the ONE surface that reads the flag today — a promise you can go and check');
+  // WIDENED BY TASK 1002968, on the same rule that narrowed it. 1002290 cut this
+  // to "the People directory" because the D3 sliver was unbuilt and no guard here
+  // could hold a wider claim. The sliver is now built and gated, so BOTH
+  // recruiting reads join the reach axis and the row may name both — and the
+  // wider claim is held by the guard below rather than by this sentence.
+  assert.match(js, /removes you from both recruiting surfaces/,
+    'the row names both surfaces that read the flag today — a promise you can go and check');
   assert.doesNotMatch(js, /every recruiting view/,
-    'never a promise over surfaces that do not exist yet: the D3 recruiter sliver is unbuilt, so no '
-    + 'guard here could hold that claim, and the copy rule is that a toggle promises exactly what is enforced');
+    'still never an OPEN-ENDED promise: "both" is a claim a guard can hold, "every" is not — a third '
+    + 'recruiting read would make it false with nothing to notice');
   assert.match(html, /profile page setting applies now[\s\S]*Recruiter discoverability applies now too/,
     'the section note now says both are live, rather than splitting them');
   assert.doesNotMatch(html, /starts applying as the recruiting surfaces land/,
     'the "recorded and waiting" note must not outlive the surface that started reading it');
 });
+
+test('the recruiting surface really is exactly two reads, and each one joins REACH', () => {
+  // This is what makes the widened copy above checkable rather than a slogan.
+  // Both halves are enumerated from source: a third route on the recruiting
+  // surface, or either reader dropping the reach axis, reds here — which is the
+  // signal that the toggle's promise has stopped being true.
+  const route = readFileSync(join(ROOT, 'modules/platform-identity/routes/scouting.js'), 'utf8');
+  const mounted = route.match(/router\.get\(\s*\n?\s*'([^']+)'/g) || [];
+  assert.equal(mounted.length, 2,
+    `the recruiting surface mounts ${mounted.length} route(s), not 2 — the Settings copy promises "both recruiting surfaces" and can no longer name them`);
+  assert.match(route, /'\/scouting'/, 'the directory');
+  assert.match(route, /'\/scouting\/:handle'/, 'and the pre-accept sliver');
+
+  const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
+  for (const composed of ['scoutingListableSql', 'recruiterSliverVisibleSql']) {
+    const body = av.slice(av.indexOf(`function ${composed}(`));
+    assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,
+      `${composed} stopped composing the reach axis — opting out would no longer empty that surface`);
+  }
+});

package/tests/effective_visibility_predicate.mjs

@@ -79,6 +79,8 @@ import {
   isRecruiterDiscoverable,
   recruiterReachSql,
   scoutingListableSql,
+  recruiterSliverVisibleSql,
+  isRecruiterSliverVisible,
 } from '../modules/platform-identity/account-visibility.js';
 
 const require = createRequire(import.meta.url);
@@ -119,6 +121,10 @@ const SPELLING_EXEMPTIONS = [
       text: 'hide_stats = true',
       count: 1,
       why: "hiddenGithubIds asks the OPPOSITE question to visibility — 'which of these accounts have hidden themselves' — for the closeness-graph consent gate. It must stay fail-closed on hide alone (ADR 0171 D4), so it is not expressible as the shared predicate and is not a variant of it.",
+    }, {
+      text: "account_visibility = '",
+      count: 1,
+      why: "setAccountPrivacy's ON CONFLICT branch, and a WRITE rather than a read gate — it reads EXCLUDED, the value being written, to decide whether this PATCH re-arms recruiter_discoverable to its 'follow visibility' default. Going private without naming reach must clear an explicit true, because that true was set while PUBLIC and meant 'recruiters may see my public profile' (ADR 0215, task 1002968); the D3 sliver has no existence floor and would otherwise read that stale consent as fresh. It gates no read, so it cannot be expressed as the shared predicate and is not a variant of one — the SPELLINGS comment already excludes writes in principle, and this is the occurrence its regex cannot tell apart.",
     }],
     obligation: (code) => /require\(\s*'\.\/account-visibility'\s*\)/.test(code),
     demands: 'still imports the shared predicate rather than re-deriving one',
@@ -341,8 +347,14 @@ function accountStatements(code) {
  * recruiterReachSql inside the owner file, so a reader that joins it has adopted
  * the shared rule — but it must be named here, or wiring the recruiting reach in
  * would read as a reader that stopped adopting anything.
+ * recruiterSliverVisibleSql (task 1002968) is here on the same terms and one
+ * caveat: it is the ONE composed answer that deliberately omits the existence
+ * axis, because the private-but-discoverable account is the D3 sliver's subject.
+ * That is a decision recorded in the owner file and asserted above — not a
+ * reader quietly dropping a term, which is what this regex would otherwise let
+ * through unnoticed.
  */
-const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|isAccountVisible|isAccountActive|isRollupVisible)\s*\(/;
+const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|recruiterSliverVisibleSql|isAccountVisible|isAccountActive|isRollupVisible|isRecruiterSliverVisible)\s*\(/;
 
 // ===========================================================================
 // Self-tests — the machinery is the guard, so it gets proved too.
@@ -513,6 +525,30 @@ t('the recruiter-reach predicate still lives here, and is still the only COALESC
     'reach never buys addressability — that is what the D3 sliver is for');
 });
 
+t('recruiterSliverVisibleSql is COMPOSED from consent AND reach, and omits existence ON PURPOSE (task 1002968)', () => {
+  // The pre-accept sliver is the one effective answer that must NOT floor on the
+  // existence axis: the privacy spec's D2 "private · discoverable" row is the
+  // account it exists to serve, and ANDing accountVisibleSql would empty it of
+  // exactly that account while leaving every test above still green.
+  assert.ok(recruiterSliverVisibleSql('pa').includes(accountActiveSql('pa')),
+    'the consent floor, literally contained — a provisional account is never recruiter-visible (spec D3)');
+  assert.ok(recruiterSliverVisibleSql('pa').includes(recruiterReachSql('pa')),
+    'and the reach axis, literally contained — the opt-out empties this surface too');
+  assert.ok(!recruiterSliverVisibleSql('pa').includes(accountVisibleSql('pa')),
+    'and NOT the existence axis: dropping it is safe only because reach is an explicit opt-IN for a private account');
+  assert.doesNotMatch(recruiterSliverVisibleSql(), /hide_stats/,
+    'hide changes the SHAPE of the sliver (name-only), never who appears in it');
+  // The JS twin, over the same D2 matrix the SQL is judged on.
+  const accepted = { terms_accepted_at: 'T1' };  // the T&C half of the consent floor (ADR 0213)
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), true);
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'active', account_visibility: 'private', recruiter_discoverable: null }), false);
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'provisional', account_visibility: 'public', recruiter_discoverable: true }), false);
+  assert.equal(isRecruiterSliverVisible({ profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), false,
+    'and the sliver inherits the T&C floor by COMPOSITION — an account that never accepted is not recruiter-visible');
+  assert.equal(isRecruiterSliverVisible(null), false, 'fail-closed on an absent account');
+  assert.throws(() => recruiterSliverVisibleSql('pa; DROP TABLE x --'), /bare SQL identifier/);
+});
+
 // ===========================================================================
 // 2. The sole-owner rule — nothing else spells a variant
 // ===========================================================================
@@ -640,6 +676,27 @@ t('the shared predicate has real adopters (the wiring did not silently unwire it
   }
 });
 
+t('the EXISTENCE-LESS predicate has exactly one reader, and it is the sliver (task 1002968)', () => {
+  // recruiterSliverVisibleSql counts as adoption in ADOPTS above, which is what
+  // lets the sliver's own read pass the classification rule — and that is a hole
+  // unless the predicate is also PINNED to its one caller. It is the only shared
+  // answer that omits `account_visibility = 'public'`, so a future public read
+  // that joined it would look adopted while quietly serving private accounts.
+  // BOTH FORMS, because the same diff put both into ADOPTS. Pinning only the SQL
+  // one left the JS twin as an open door: a new module file doing
+  // `rows.filter(isRecruiterSliverVisible)` over an ungated
+  // `SELECT … FROM platform_identity_accounts WHERE handle ILIKE $1` passed this
+  // entire guard — that is the hub profile search this file's own header names
+  // as the read that must fail the build, sailing through on the one predicate
+  // that omits the existence axis (found in adversarial review, task 1002968).
+  // Enumerated from source, so a second reader fails here rather than in review.
+  const readers = scanned
+    .filter((f) => f.rel !== PREDICATE_OWNER && /\b(?:recruiterSliverVisibleSql|isRecruiterSliverVisible)\s*\(/.test(f.code))
+    .map((f) => f.rel);
+  assert.deepEqual(readers, ['modules/platform-identity/recruiter-sliver.js'],
+    'the pre-accept predicate is the recruiting sliver\'s alone — every other read must floor on the existence axis');
+});
+
 t('getPublicProfileExtras gates on the shared JS port (its SQL carries no predicate to join)', () => {
   const pi = scanned.find((f) => f.rel === 'modules/platform-identity/platform-identity.js');
   const span = functionSpans(pi.code).find((s) => s.name === 'getPublicProfileExtras');

package/tests/government_require_permission.mjs

@@ -352,6 +352,28 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     // worth doing — it means minting an atom over the write — but it is the
     // continuing R107/R108 migration's job, not this ADR's.
     'security/routes/scans.js',
+    // Still requireRank after BV1.R105 — and for a reason the other holdouts do
+    // not have: the atom this gate WANTS is specified, named, and deliberately
+    // owned by another wave. `GET /scouting/:handle` is the privacy spec's D3
+    // pre-accept recruiter sliver (task 1002968, ADR 0215 D4), and D3 gates it on
+    // `project.recruit` — declared in spec D1 as FLOOR ARCHON, widenable per
+    // instance. That atom does not exist: ADR 0201 D3 and ADR 0210 both refuse to
+    // mint it outside the project-admin-console wave that defines it (spike
+    // 1002786 R3), because a third definition before any had shipped is the drift
+    // they were avoiding.
+    //
+    // The three ways out are all worse. Minting it here forks its definition.
+    // Borrowing a different archon atom (`access_request.review`, say) would name
+    // the wrong authority on a privacy surface. And reusing the sibling route's
+    // `project.curate`-or-project-owner door — the tidy option, and what the first
+    // draft did — is WIDER than the signed floor on both halves, on the first
+    // surface on this platform that discloses a PRIVATE account.
+    //
+    // So the floor is held by rank until the atom lands, which is the one spelling
+    // that neither invents authority nor widens it. It is temporary by
+    // construction: blocker 1000126 carries the audience question to the owner,
+    // and spike 1002786 R3 mints the atom that removes this entry.
+    'platform-identity/routes/scouting.js',
   ].sort();
 
   const modulesDir = path.join(ROOT, 'modules');

package/tests/profile_route.mjs

@@ -159,6 +159,9 @@ require.cache[authPath] = {
     requireBuilder: (_req, _res, next) => next(),
     requireRank: () => (_req, _res, next) => next(),
     requirePermission: () => (_req, _res, next) => next(),
+    // ADR 0215 D4: the sliver route beside the directory gates on RANK, so the
+    // partial doorway must answer requireRank too or the router will not load.
+    requireRank: () => (_req, _res, next) => next(),
   },
 };
 
@@ -434,6 +437,9 @@ require.cache[moduleApiPath] = {
     pool: engine,
     requireBuilder: (_req, _res, next) => next(),
     requirePermission: () => (_req, _res, next) => next(),
+    // ADR 0215 D4: the sliver route beside the directory gates on RANK, so the
+    // partial doorway must answer requireRank too or the router will not load.
+    requireRank: () => (_req, _res, next) => next(),
     parsePagination: () => ({ limit: 100, offset: 0 }),
     corsPublicGet: () => (_req, _res, next) => next(),
   },

package/tests/projects_hub.mjs

@@ -187,8 +187,10 @@ test('the mine row draws the project\'s planet — the catalog\'s template when
   assert.doesNotMatch(orb, /class="orb/, 'the sphere is gone');
   const planet = (SCRIPT.match(/function planetOf\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.match(planet, /hostOf\(catalog\[i\]\.origin\) === h/, 'matched by host, the same join the map makes');
-  assert.match(planet, /tpl: templateOf\(catalog\[i\]\), acc: accentOf\(catalog\[i\]\)/, 'a catalog match takes the catalog\'s template + accent');
-  assert.match(planet, /tpl: slugTemplate\(inst\.slug\), acc: ORB_ACCENTS\[slugAccent\(inst\.slug\)\]/, 'owned-only walks by slug');
+  assert.match(planet, /var own = \{ tpl: knownTemplate\(inst\.planet_template\), acc: accentVar\(inst\.planet_accent\) \};/, 'the owner\'s own choice is read off the row first (task 1003347)');
+  assert.match(planet, /tpl: own\.tpl \|\| templateOf\(c\), acc: own\.acc \|\| accentOf\(c\)/, 'a catalog match takes the catalog\'s template + accent under the owner\'s choice');
+  assert.match(planet, /tpl: own\.tpl \|\| slugTemplate\(inst\.slug\), acc: own\.acc \|\| ORB_ACCENTS\[slugAccent\(inst\.slug\)\]/, 'owned-only walks by slug under the owner\'s choice');
+  assert.match(planet, /chosen: !!\(own\.tpl \|\| own\.acc\)/, 'the row says whose pick it is');
   assert.match(SCRIPT, /assignAccents\(\); applyMapFilter\(\); repaintPlanets\(\);/, 'a catalog that lands late repaints the rows');
   assert.doesNotMatch(COSMOS, /\n\.orb\{/, 'cosmos no longer carries the sphere');
 });
@@ -1531,8 +1533,9 @@ test('the planet templates: shape × material × style; the walk changes all thr
 test('the walk assigns the template by canonical position beside the accent; a curated template wins; the platform is the pair in chrome', () => {
   assert.match(SCRIPT, /function assignAccents[\s\S]*?p\._acc = ORB_ACCENTS\[i % ORB_ACCENTS\.length\];\s*p\._tpl = ORB_WALK\[i % ORB_WALK\.length\];/,
     'one walk, two assignments');
-  assert.match(SCRIPT, /function templateOf\(p\) \{\s*return ORB_TEMPLATES\.indexOf\(p\.template\) !== -1 \? p\.template : \(p\._tpl \|\| ORB_WALK\[0\]\);/,
-    'a curated name wins; an unknown name is not a choice');
+  assert.match(SCRIPT, /function templateOf\(p\) \{\s*if \(knownTemplate\(p\.planet_template\)\) return p\.planet_template;\s*return ORB_TEMPLATES\.indexOf\(p\.template\) !== -1 \? p\.template : \(p\._tpl \|\| ORB_WALK\[0\]\);/,
+    'the owner\'s choice wins, then a curated name; an unknown name is not a choice (task 1003347)');
+  assert.match(SCRIPT, /function accentOf\(p\) \{ return accentVar\(p\.planet_accent\) \|\| p\._acc \|\| ORB_ACCENTS\[0\]; \}/, 'the owner\'s colour by NAME, then the walk');
   assert.match(SCRIPT, /_acc: ORB_ACCENTS\[slugAccent\(inst\.slug\)\], _tpl: slugTemplate\(inst\.slug\)/, 'an owned-only entry walks by its slug');
   assert.match(SCRIPT, /function slugTemplate\(slug\) \{ return ORB_WALK\[slugHash\(slug\) % ORB_WALK\.length\]; \}/, 'by the walk, not the whole set');
   assert.match(SCRIPT, /var tpl = templateOf\(p\), tplParts = tpl\.split\('-'\);\s*a\.setAttribute\('data-template', tpl\);\s*a\.setAttribute\('data-shape', tplParts\[0\]\);\s*a\.setAttribute\('data-material', tplParts\.length === 3 \? tplParts\[1\] : 'chrome'\);\s*a\.setAttribute\('data-style', tplParts\[tplParts\.length - 1\]\);/,
@@ -1647,13 +1650,125 @@ test('the kit proves the field path: the fixture carries a curated template and
   const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'featured.json'), 'utf8'));
   const otb = fixture.projects.find((p) => p.origin === 'https://amazonprimea.com');
   assert.equal(otb.template, 'bead-wash');
-  assert.equal(fixture.projects.find((p) => p.origin === 'https://demo.cloudbongos.com').template, 'pair-gold-wash', 'a material template rides the wire (task 1003337)');
-  assert.ok(fixture.projects.every((p) => 'template' in p), 'the wire never drops the key');
+  const demo = fixture.projects.find((p) => p.origin === 'https://demo.cloudbongos.com');
+  assert.equal(demo.template, 'pair-gold-wash', 'a material template rides the wire (task 1003337)');
+  assert.equal(demo.planet_template, 'pair-obsidian-tint', 'the owner\'s choice rides the same wire (task 1003347)');
+  assert.equal(demo.planet_accent, 'sea', 'a token NAME, never a colour');
+  assert.ok(fixture.projects.every((p) => 'template' in p && 'planet_template' in p && 'planet_accent' in p), 'the wire never drops a key');
   const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
   const attrs = states.states['in-map'].expect.attr.map((a) => a.join(' '));
   assert.ok(attrs.includes('#selfOrb data-template pair-chrome'));
   assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
-  assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material gold')), 'the material reaches the orb as its own attribute');
+  assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material obsidian')), 'the material reaches the orb as its own attribute');
+  assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-template pair-obsidian-tint')), 'the owner\'s choice outranks the curated template on the sky (task 1003347)');
+});
+
+/* ── the planet picker (task 1003347; direction record §16, v1 the bands): the owner's own
+   choice, read first everywhere a planet is drawn; the "its planet" section on the manage
+   page; a settings save that restarts nothing ── */
+test('the picker: the owner\'s choice is one of the sky\'s thirty-six names and one of the five accents BY NAME — the same lists the server validates (task 1003347)', () => {
+  const req = createRequire(import.meta.url);
+  const prov = req(path.join(ROOT, 'modules', 'provisioning', 'provisioning.js'));
+  assert.match(SCRIPT, /var ORB_ACCENT_NAMES = \['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'\];/, 'the five by name, in the palette\'s order');
+  assert.deepEqual([...prov.PLANET_ACCENTS], ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'], 'the server\'s allow-list is the same five');
+  assert.match(SCRIPT, /function accentVar\(name\) \{ var i = ORB_ACCENT_NAMES\.indexOf\(name\); return i === -1 \? '' : ORB_ACCENTS\[i\]; \}/, 'a name maps to its var(); an unknown name is nothing');
+  // the client mirror of PROJECT_TEMPLATES (pinned above) and the server's PLANET mirror agree
+  const pi = req(path.join(ROOT, 'modules', 'platform-identity', 'platform-identity.js'));
+  assert.deepEqual([...prov.PLANET_TEMPLATES], [...pi.PROJECT_TEMPLATES], 'provisioning validates the very names the catalog and the sky know');
+  assert.match(SCRIPT, /function pickTemplate\(s\) \{\s*if \(s\.material === 'chrome'\) return s\.shape \+ '-' \+ \(s\.style === 'plain' \? 'chrome' : s\.style\);\s*return s\.shape \+ '-' \+ s\.material \+ '-' \+ s\.style;/, 'shape × material × style composes a stored name; the chrome material\'s plain is spelled chrome');
+  assert.match(SCRIPT, /function pickFrom\(pl\) \{[\s\S]*?style: style === 'chrome' \? 'plain' : style,\s*accent: ORB_ACCENT_NAMES\[ORB_ACCENTS\.indexOf\(pl\.acc\)\] \|\| ORB_ACCENT_NAMES\[0\] \};/, 'and a drawn planet decomposes back into the four fields');
+});
+
+test('the picker is live markup on the manage page: the section, its body slot and a sibling fold (the .mSec shape), and the ledger row says whose pick it is', () => {
+  assert.match(HUB, /<div class="card mSec" id="mPlanetPick">\s*<h2>Its planet<\/h2>\s*<div id="mPick">/, 'the section with its volatile slot');
+  assert.match(HUB, /<details class="finePrint" id="mPickWhat">/, 'the fold is a SIBLING of the slot');
+  const sec = (HUB.match(/<div class="card mSec" id="mPlanetPick">([\s\S]*?)<\/details>/) || [, ''])[1];
+  assert.match(sec, /<b>shape<\/b>[\s\S]*<b>material<\/b>[\s\S]*<b>style<\/b>[\s\S]*<b>colour<\/b>/, 'the fold names the four choices');
+  assert.match(sec, /no restart, nothing to apply/, 'and says the planet is the platform\'s to draw');
+  assert.match(HUB, /id="mJoinability"[\s\S]*id="mPlanetPick"[\s\S]*id="mDelete"/, 'between how people join and the ender');
+  const pm = (SCRIPT.match(/function paintManagePlanet\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(pm, /pl\.chosen \? '<small>your choice\.<\/small>' : pl\.curated \? '' : '<small>chosen for it by the platform\.<\/small>'/, 'your choice · (curated, no clause) · chosen for it by the platform');
+  const rm = (SCRIPT.match(/function renderManage\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(rm, /renderPick\(inst\);/, 'renderManage paints the picker, fetch-free');
+});
+
+test('the picker\'s script: the preview planet and four radiogroups built from the sky\'s own names; a pick in progress survives the tick and a late catalog; the save is the settings PATCH and restarts nothing', () => {
+  const rp = (SCRIPT.match(/function renderPick\(inst\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(rp, /var pl = planetOf\(inst\);/, 'one resolution — the head, the row and the preview can never disagree');
+  assert.match(rp, /<span class="worldOrb"' \+ planetAttrs\(preview\) \+ ' style="--acc:' \+ preview\.acc \+ ';--d:132px"/, 'the preview is the sky\'s object with the template attributes');
+  assert.match(rp, /pickBand\('Shape', 'mPickShape', PICK_SHAPES, s\.shape\)[\s\S]*pickBand\('Material', 'mPickMaterial', PICK_MATERIALS, s\.material\)[\s\S]*pickBand\('Style', 'mPickStyle', PICK_STYLES, s\.style\)/, 'three bands of cells');
+  assert.match(rp, /<div class="pickSwatches" role="radiogroup" aria-label="Colour">/, 'the colour as a radiogroup of swatches');
+  assert.match(rp, /style="--sw:' \+ accentVar\(a\[0\]\) \+ '"/, 'a swatch is its token, never a literal');
+  assert.match(rp, /pl\.chosen \? '<button type="button" class="btn small ghost" data-pick-reset>Let the platform choose again<\/button>' : ''/, 'the way back to the platform\'s pick, only once a choice is stored');
+  assert.match(rp, /else if \(\$\('mPick'\)\.querySelector\('\.pick'\)\) return;/, 'the tick does not rebuild a pick in progress');
+  assert.match(SCRIPT, /if \(manageInst && !mPickTouched && JSON\.stringify\(pickFrom\(planetOf\(manageInst\)\)\) !== mPickSeed\) \{ mPick = null; renderPick\(manageInst\); \}/, 'a late catalog reseeds only an untouched pick whose resolution changed');
+  const save = (SCRIPT.match(/function doPickSave\(reset\) \{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(save, /var body = reset \? \{ planet_template: null, planet_accent: null \} : \{ planet_template: pickTemplate\(mPick\), planet_accent: mPick\.accent \};/, 'null hands the pick back; a choice sends the name and the accent by name');
+  assert.match(save, /\/settings', \{\s*method: 'PATCH'/, 'the settings PATCH the two sections above use');
+  assert.match(save, /manageInst\.planet_template = planet\.planet_template \|\| null;\s*manageInst\.planet_accent = planet\.planet_accent \|\| null;/, 'the row now holds the choice');
+  assert.match(save, /repaintPlanets\(\);/, 'the head, the ledger row and the list repaint from the row');
+  assert.match(save, /loadCatalog\(\);/, 'and the sky re-reads the feed that carries it');
+  assert.doesNotMatch(save, /loadManage\(/, 'no re-read for an open intent: a planet change queues none');
+  assert.match(save, /\(data\.push && data\.push\.message\) \|\| 'Saved\.'/, 'the receipt is shown verbatim');
+});
+
+test('the picker wears the world by scope: the preview left and four bands right on hairlines, cells with the dot, swatches as their tokens; under 900 the cells are the list\'s pills; no box shadow, no literal colour', () => {
+  const block = (COSMOS.match(/\/\* ── its planet \(task 1003347([\s\S]*?)\/\* this block stays HERE/) || [, ''])[1];
+  assert.ok(block, 'the block sits in the manage page\'s scope');
+  assert.match(block, /#view-manage \.pick\{display:grid;grid-template-columns:168px 1fr;gap:0 34px;align-items:start;\}/, 'the preview beside the bands');
+  assert.match(block, /#view-manage \.pickBand\{display:grid;grid-template-columns:88px 1fr;[^}]*border-top:1px solid var\(--rule\);\}/, 'each band on a hairline, its label in a column');
+  assert.match(block, /#view-manage \.pickCells\[role="radiogroup"\]\{display:grid;grid-template-columns:none;grid-auto-flow:column;grid-auto-columns:1fr;border:0;\}/, 'the cells outrank the generic radiogroup rule');
+  assert.match(block, /#view-manage \.pickCell::before\{content:"";width:7px;height:7px;border-radius:50%;/, 'the dot');
+  assert.match(block, /#view-manage \.pickCell\.on::before\{background:var\(--accent\);border-color:var\(--accent\);outline:4px solid color-mix\(in srgb,var\(--accent\) 22%,transparent\);\}/, 'the chosen cell\'s dot on the accent with its halo');
+  assert.match(block, /#view-manage \.pickSw\{[^}]*background:var\(--sw\);/, 'a swatch paints its token');
+  assert.match(block, /#view-manage \.pickSw\.on\{outline:1px solid var\(--ink\);outline-offset:3px;\}/, 'the chosen swatch ringed by a hairline of the ink');
+  assert.doesNotMatch(block, /box-shadow/, 'hairlines only');
+  assert.doesNotMatch(block, /#[0-9a-fA-F]{3,8}\b/, 'no literal colour (the Fifteen Rule)');
+  const fold = (COSMOS.match(/@media \(max-width:900px\)\{[\s\S]*?#view-manage \.pick\{grid-template-columns:1fr;gap:22px 0;\}([\s\S]*?)\n\}/) || [, ''])[1];
+  assert.match(fold, /#view-manage \.pickCells\[role="radiogroup"\]\{display:flex;flex-wrap:wrap;gap:8px;padding:0 0 14px;\}/, 'the cells flow as pills');
+  assert.match(fold, /#view-manage \.pickCell\.on\{background:var\(--ink\);color:var\(--bg\);border-color:var\(--ink\);\}/, 'the chosen one inverted to ink, the filter pills\' grammar');
+  assert.match(fold, /#view-manage \.pickCell::before\{display:none;\}/, 'no dot on a pill');
+});
+
+test('the kit proves the picker: a state renders it on the owner\'s feed-carried choice, three probes save / hand back / fold, and both fixtures carry the choice (task 1003347)', () => {
+  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const st = states.states['in-manage-planet'];
+  assert.ok(st && st.auth && st.url === '/projects?view=manage&id=101', 'the signed-in owner on Demo');
+  assert.ok(st.expect.visible.includes('#mPlanetPick') && st.expect.visible.includes('#mPick [data-pick-reset]'));
+  assert.deepEqual(st.expect.count.find((c) => c[0] === '#mPick .pickCell'), ['#mPick .pickCell', 10], 'three + four + three cells');
+  assert.deepEqual(st.expect.count.find((c) => c[0] === '#mPick .pickSw'), ['#mPick .pickSw', 5]);
+  assert.ok(st.expect.attr.some((a) => a[0] === '#mOrb .worldOrb' && a[2] === 'pair-obsidian-tint'), 'the head wears the owner\'s choice over the curated template');
+  assert.ok(st.expect.text.some((t) => t[0] === '#mPlanet .v small' && t[1] === 'your choice.'));
+  const mine = states.states['in-mine'].expect.count.find((c) => c[0] === '#projectsList .proj .worldOrb[data-template="blob-frost-tint"]');
+  assert.deepEqual(mine, ['#projectsList .proj .worldOrb[data-template="blob-frost-tint"]', 1], 'an owned-only row draws the choice off its own row');
+  const inst = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'provisioning-instances.json'), 'utf8'));
+  const harbor = inst.instances.find((i) => i.slug === 'harbor');
+  assert.equal(harbor.planet_template, 'blob-frost-tint');
+  assert.equal(harbor.planet_accent, 'sun-lit');
+  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8'));
+  const names = probes.probes.map((p) => p.name);
+  assert.ok(names.some((n) => n.startsWith('manage flows: its planet (task 1003347)')), 'the save probe');
+  assert.ok(names.some((n) => n.includes('handed back to the platform')), 'the reset probe');
+  assert.ok(names.some((n) => n.includes('its planet at 390')), 'the fold probe');
+  const saveProbe = probes.probes.find((p) => p.name.startsWith('manage flows: its planet (task 1003347)'));
+  assert.ok(saveProbe.expect.text.some((t) => t[1] === 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.'), 'the route\'s no-restart receipt, verbatim');
+  const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(stub, /const PLANETS = new Map\(\);/, 'the stub remembers a saved planet for the run');
+  assert.match(stub, /planet: PLANETS\.get\(String\(id\)\) \|\| NO_PLANET/, 'and answers it on the settings read and the receipt');
+});
+
+test('the feed carries the owner\'s choice through a seam: platform-identity resolves provisioning.projectPlanets optionally and spreads both keys on every project (task 1003347)', () => {
+  const route = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'routes', 'projects.js'), 'utf8');
+  assert.match(route, /api\.resolveOptional\('provisioning\.projectPlanets', async \(\) => \(\{\}\)\)\(projects\.map\(\(p\) => hostOfOrigin\(p\.origin\)\)\)/, 'optional — an instance without provisioning has no choices to carry');
+  assert.match(route, /return \{ planet_template: c\.planet_template \|\| null, planet_accent: c\.planet_accent \|\| null \};/, 'the wire always carries both keys');
+  assert.match(route, /\.\.\.planetOf\(p\),/, 'spread beside the stats');
+  assert.doesNotMatch(route, /require\(['"][^'"]*provisioning/, 'never an import across modules');
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'module.json'), 'utf8'));
+  assert.ok(manifest.provides.includes('provisioning.projectPlanets'), 'the port is declared');
+  const pi = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'module.json'), 'utf8'));
+  assert.ok(!(pi.consumes || []).includes('provisioning.projectPlanets'), 'not a required capability — the hub must boot without provisioning');
+  const prov = fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'), 'utf8');
+  assert.match(prov, /api\.registerProvider\('provisioning\.projectPlanets', \(hosts\) => provisioning\.planetChoicesForHosts\(pool, hosts\)\);/, 'registered beside instanceState');
 });
 
 /* ── the table's columns on FIXED tracks (task 1003348; the owner, 2026-08-29: "the

package/tests/provisioning_settings.mjs

@@ -44,7 +44,8 @@ provisioning.recordEvent = async (_db, e) => { events.push(e); };
 provisioning.getOpenIntent = async () => null;
 // The live push (task 1003140) — stubbed so the reachable path is deterministic here;
 // its own outcomes are covered in tests/provisioning_settings_apply.mjs.
-provisioning.enqueueSettingsApply = async () => ({ intent: { id: 9, action: 'settings-apply', state: 'pending' }, created: true });
+let enqueueCalls = 0;           // the live push — a planet change must never queue one (task 1003347)
+provisioning.enqueueSettingsApply = async () => { enqueueCalls++; return { intent: { id: 9, action: 'settings-apply', state: 'pending' }, created: true }; };
 let manifest = null;            // the latest manifest attempt the read surfaces (task 1003235)
 provisioning.getLatestOAuthManifestForInstance = async () => manifest;
 
@@ -100,6 +101,7 @@ function reset({ inst, as } = {}) {
   builder = as || { id: 7, github_login: 'owner', rank: 'thetes' };
   updateCalls = [];
   events = [];
+  enqueueCalls = 0;
 }
 
 console.log('GET /provisioning/instances/:id (the manage page\'s read — task 1003041):');
@@ -163,7 +165,20 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(r.body.options, { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] });
+  // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null });
+  assert.deepEqual(r.body.options, {
+    platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'],
+    planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
+  });
+});
+
+await ta('a stored planet reads back; a name that left the vocabulary reads null (task 1003347)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { planet_template: 'bead-obsidian-tint', planet_accent: 'purple' } } });
+  const r = await get('/provisioning/instances/18/settings');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
@@ -247,6 +262,70 @@ await ta('an unknown key → 400 (strict: a typo fails loudly, never silently dr
   assert.equal(updateCalls.length, 0);
 });
 
+console.log('\nPATCH …/settings — the planet (task 1003347):');
+
+await ta('the owner picks a planet: saved, echoed as `planet`, audited — and NO push, NO restart (the platform draws it)', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply' }, 'the policy half is untouched');
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
+  assert.equal(r.body.push.queued, false);
+  assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');
+  assert.match(r.body.push.message, /nothing on your project restarts/);
+  assert.equal(enqueueCalls, 0, 'no settings-apply intent for a planet change');
+  assert.equal(events.length, 1);
+  assert.match(events[0].detail, /planet_template=bead-obsidian-tint, planet_accent=sea/);
+});
+
+await ta('null hands the pick back to the platform (stored as null, read back as null)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } } });
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: null, planet_accent: null });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: null, planet_accent: null } }]);
+  assert.equal(enqueueCalls, 0);
+});
+
+await ta('the same planet re-sent → "No change", nothing written', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { planet_template: 'bead-obsidian-tint' } } });
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint' });
+  assert.equal(r.status, 200, r.raw);
+  assert.match(r.body.push.message, /^No change/);
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('a planet re-sent over a retired push\'s error_note does NOT re-kick the push (only a policy key does)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', error_note: 'settings-apply failed', settings: { planet_template: 'bead-obsidian-tint' } } });
+  const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls, 0, 'the planet never restarts anything');
+  const r2 = await patch('/provisioning/instances/18/settings', { joinability: 'apply' });
+  assert.equal(r2.status, 200, r2.raw);
+  assert.equal(enqueueCalls, 1, 'the policy re-kick (the domain route\'s F19 shape) still works');
+});
+
+await ta('a policy change and a planet change in one save: the push queues for the policy, the planet rides along', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { joinability: 'open', planet_accent: 'gold-soft' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.push.queued, true);
+  assert.equal(r.body.planet.planet_accent, 'gold-soft');
+  assert.equal(r.body.saved.joinability, 'open');
+  assert.equal(enqueueCalls, 1);
+});
+
+await ta('an off-vocabulary planet → 400 validation_failed (a colour is a token NAME, never a hex)', async () => {
+  reset();
+  for (const body of [{ planet_accent: '#fb9569' }, { planet_accent: 'purple' }, { planet_template: 'cube-gold-wash' }]) {
+    const r = await patch('/provisioning/instances/18/settings', body);
+    assert.equal(r.status, 400, r.raw);
+    assert.equal(r.body.error.code, 'validation_failed');
+  }
+  assert.equal(updateCalls.length, 0);
+});
+
 await ta('an empty body → 400 bad_settings with a plain sentence naming the keys', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', {});

package/tests/provisioning_settings_env.mjs

@@ -71,6 +71,12 @@ t('the prefix is the pack\'s, not a guess — a wrong prefix silently never fire
   assert.ok(!('CLOUDBONGOS_PLATFORM_VISIBILITY' in v));
 });
 
+t('the planet never rides the env transport (task 1003347): it is the platform\'s to draw, not the instance\'s to run', () => {
+  const vars = provisioning.settingsEnvVars({ settings: { platform_visibility: 'gated', planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }, 'CB');
+  for (const k of Object.keys(vars)) assert.doesNotMatch(k, /PLANET/, k);
+  assert.doesNotMatch(provisioning.settingsEnvLines({ settings: { planet_template: 'bead-obsidian-tint' } }, 'CB'), /planet|PLANET/);
+});
+
 t('every emitted key is in SETTINGS_VOCAB — the two lists cannot drift', () => {
   const keys = linesOf(provisioning.settingsEnvLines({}, 'X')).map((l) => l.split('=')[0].replace(/^X_/, '').toLowerCase());
   assert.deepEqual(keys.sort(), Object.keys(provisioning.SETTINGS_VOCAB).sort(),