@bongos/core 1.19.441 → 1.19.443

package/docs/design/mocks/hub/mine.html

@@ -8,7 +8,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003345 (docs/design/projects-hub-direction-v2.md §14). cosmos.css

package/docs/design/mocks/hub/picker.html

@@ -8,7 +8,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003347 (docs/design/projects-hub-direction-v2.md §16): the

package/docs/design/mocks/hub/planets.html

@@ -11,7 +11,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003319 (docs/design/projects-hub-direction-v2.md §11). cosmos.css

package/docs/design/mocks/hub/v1.html

@@ -11,7 +11,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 /* ═══════════════ v1 "the shelf" — the page tier ═══════════════════════════
    cosmos.css above carries the fifteen contract tokens, the sky, the orbs, the
@@ -757,7 +757,7 @@ not a width), --ok, --warn and --err keep cosmos's meaning and are not redeclare
   <div class="cardScrim" id="cardScrim" hidden>
     <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName" data-art="on" data-faces="on" data-figs="two" data-facts="on" data-hall="on" style="--acc:var(--accent)">
       <button type="button" class="cardX" id="cardClose" aria-label="Close"><svg viewBox="0 0 20 20" aria-hidden="true"><path d="M5.4 5.4l9.2 9.2M14.6 5.4l-9.2 9.2"/></svg></button>
-      <img class="cardArt" id="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" id="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="cardDot" id="cardDot"></span>
       <h2 class="cardName" id="cardName">Cloud Bongos</h2>
       <p class="cardTag" id="cardTag">Building Digitally, as simple as Bongos.</p>
@@ -903,7 +903,7 @@ not a width), --ok, --warn and --err keep cosmos's meaning and are not redeclare
   var AV = 'https://avatars.githubusercontent.com/u/';
   var PLATFORM = {
     acc: 'var(--accent)', name: 'Cloud Bongos', tag: 'Building Digitally, as simple as Bongos.',
-    rel: 'you build here', art: '../../../../public-landing/assets/world/og-card.jpg',
+    rel: 'you build here', art: '../../../../modules/public-landing/public/assets/world/og-card.jpg',
     faces: [[AV + '64553469?v=4', 'jaxri'], [AV + '283020391?v=4', 'lars589'], [AV + '290184380?v=4', 'IAMMASTERQUA'],
             [AV + '295990394?v=4', 'scootermack'], [AV + '35337514?v=4', 'LarsCode']],
     type: null, more: '+4', builders: '9', shipped: '30+', runs: 'cloudbongos.com',

package/docs/design/mocks/hub/v2.html

@@ -12,7 +12,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* v2 "the hairline" — the world's derived tier for this surface, by the recipes in DESIGN.md's
@@ -753,7 +753,7 @@ vocabulary its chips depend on). Two recipes are adapted because a mock may carr
   <div class="cardScrim" id="cardScrim" hidden>
     <div class="projCard has-art" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
       <button type="button" class="cardX" id="cardClose" aria-label="Close"><svg aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" id="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" id="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <p class="cardFigs" id="cardFigs">
         <span class="cardCall a" id="figA"><svg class="lead" viewBox="0 0 68 26" preserveAspectRatio="none" aria-hidden="true"><line x1="0" y1="25" x2="67" y2="1" stroke="currentColor" stroke-width="1" vector-effect="non-scaling-stroke"/></svg><span class="fig" id="figABig">9</span><span class="cap">builders</span></span>
         <span class="cardCall b" id="figB"><svg class="lead" viewBox="0 0 68 26" preserveAspectRatio="none" aria-hidden="true"><line x1="0" y1="25" x2="67" y2="1" stroke="currentColor" stroke-width="1" vector-effect="non-scaling-stroke"/></svg><span class="fig" id="figBBig">30+</span><span class="cap">shipped in 30 days</span></span>

package/docs/design/mocks/hub/v3.html

@@ -11,7 +11,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 /* ══ v3 THE GLASS STRIP. Page tier only. cosmos.css owns the fifteen contract
       tokens, the sky, the orbs, the hover card, the toolbar, the table, the
@@ -875,7 +875,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card"><span class="boardLbl">card</span>
     <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName" style="--acc:var(--accent)">
       <button type="button" class="cardX" id="cardClose" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot" id="cardDot"></span>
       <h3 class="cardName" id="cardName">Cloud Bongos</h3>
@@ -967,7 +967,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card-nofaces" hidden><span class="boardLbl">card-nofaces</span>
     <div class="projCard" style="--acc:var(--accent)">
       <button type="button" class="cardX" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot"></span>
       <h3 class="cardName" id="cardName-nofaces">Cloud Bongos</h3>
@@ -990,7 +990,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card-onefig" hidden><span class="boardLbl">card-onefig</span>
     <div class="projCard" style="--acc:var(--accent)">
       <button type="button" class="cardX" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot"></span>
       <h3 class="cardName" id="cardName-onefig">Cloud Bongos</h3>
@@ -1020,7 +1020,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card-nofig" hidden><span class="boardLbl">card-nofig</span>
     <div class="projCard" style="--acc:var(--accent)">
       <button type="button" class="cardX" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot"></span>
       <h3 class="cardName" id="cardName-nofig">Cloud Bongos</h3>

package/docs/design/mocks/hub/wizard.html

@@ -8,7 +8,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003346 (docs/design/projects-hub-direction-v2.md §15). cosmos.css

package/docs/design/mocks/landing/v1.html

@@ -803,7 +803,7 @@ in the h1 is the server-stamped {{tagline}}. Apex-only regions are stripped on a
 <!--apex-only:start-->
   <section class="band">
     <div class="wrap verro">
-      <img src="../../../../public-landing/assets/verro-medallion.png" width="384" height="384"
+      <img src="../../../../modules/public-landing/public/assets/verro-medallion.png" width="384" height="384"
            alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
       <div>
         <h2>VERRO LABS</h2>

package/docs/design/mocks/landing/v2.html

@@ -614,7 +614,7 @@ data-link-hall); the h1 string is the server-stamped {{tagline}}.
 <!--apex-only:start-->
   <section class="page">
     <div class="wrap verro">
-      <img src="../../../../public-landing/assets/verro-medallion.png" width="292" height="292"
+      <img src="../../../../modules/public-landing/public/assets/verro-medallion.png" width="292" height="292"
            alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
       <div>
         <span class="wordmark">VERRO LABS</span>

package/docs/design/mocks/landing/v3.html

@@ -825,7 +825,7 @@ composition A, pinned by the owner 2026-08-27. No roll.
 <!--apex-only:start-->
   <section class="band">
     <div class="wrap verro">
-      <img src="../../../../public-landing/assets/verro-medallion.png"
+      <img src="../../../../modules/public-landing/public/assets/verro-medallion.png"
            alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
       <div>
         <p class="wordmark">VERRO LABS</p>

package/docs/design/mocks/landing-page-mock.html

@@ -32,7 +32,7 @@
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap">
 <!-- Same convention as projects-page-mock.html: this links the REAL token layer
      the live pages use, so what you review is what ships. Toggle ☾/☀ in the header. -->
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <!-- Candidate palettes. MOCK-ONLY: on a real instance exactly one of these
      exists and arrives via config/branding.json → themeMarkup(). See the file
      header for the contrast audit. -->
@@ -339,7 +339,7 @@ body:not([data-mascot="bongos"]) .mascot-bongos{display:none;}
       </div>
     </div>
     <div class="mascot">
-      <img class="mascot-buddha" id="buddha" src="../../../public-landing/buddha.png"
+      <img class="mascot-buddha" id="buddha" src="../../../modules/public-landing/public/buddha.png"
            alt="A laughing Cloud Bongos buddha playing the bongos on a cloud">
 
       <svg class="mascot-bongos bongos" viewBox="0 0 440 320" role="img"
@@ -611,7 +611,7 @@ body:not([data-mascot="bongos"]) .mascot-bongos{display:none;}
      only ever been visible behind a 401. buddha.png stays the poster so the
      hero is never blank while frames load. */
   if(!reduce){
-    var img=document.getElementById('buddha'), FR=44, base='../../../public-landing/assets/anim/idle/frame_';
+    var img=document.getElementById('buddha'), FR=44, base='../../../modules/public-landing/public/assets/anim/idle/frame_';
     var srcs=[], loaded=0;
     for(var i=0;i<FR;i++){
       var p=new Image();

package/docs/design/mocks/projects-hub-mock.html

@@ -8,7 +8,7 @@
 <!-- The mock links the SHIPPING stylesheet by relative path so what you see is
      what the build inherits. Serve over HTTP (python -m http.server 8899) — a
      file:// open still resolves this, but the fonts do not. -->
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap" rel="stylesheet">

package/docs/design/mocks/projects-hub-variants.html

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>The hub's ground — three candidates (task 1002758)</title>
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap" rel="stylesheet">
 <style>
 /* Contact sheet — the same pattern landing-palettes.html used for the palette

package/docs/design/mocks/projects-page-mock.html

@@ -9,7 +9,7 @@
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap">
 <!-- This mock links the REAL token/component layer the live pages use, so what
      you review here is what ships. Toggle ☾/☀ in the header to see both modes. -->
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <script>
 try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')document.documentElement.setAttribute('data-mode',_m);}catch(e){}
 </script>

package/docs/design/projects-hub-direction-v2.md

@@ -312,3 +312,26 @@ Three mastheads, rendered dark and light at 1440 / 390 / 320 (ALL CLEAN) and mea
 **Retargeted.** Every table pin: the self row's extraction (`<li class="tblRow" id="selfRow">`), the generated-row template, the six-cell parity test (now "every row lays the same five parts", which reads the planet expression too, so dropping the planet cannot pass), the column-source test (now fact-source), the fixed-tracks test (now asserts the two views' tracks line for line and that **no table rule outlived the table**), the `—`/0 pin, the Runs pin, `.rowHall`'s box, the placeholder-href guard, and `projects_hub_pre_uat.mjs`'s keyboard-sort test. One test is new: the sort control's own contract.
 
 **Flagged to the copy desk, not changed here.** `typeHtml`'s "not declared" now speaks in the row's voice but is still the formatter the create wizard's review reads through `typeLabel`; the two are not in conflict, but a copy pass over the row's four fact lines as a set would be worth one sitting.
+
+## 19. The card's backdrop: a plate set the owner picks, beside the planet (task 1003352)
+
+**Date:** 2026-08-30 · deferred out of the planet round (§16) when the owner said, on that review, *"this could also house project card backdrop customization."* It waited because a card plate set is an art round of its own and the free image coverage had ended; the owner confirmed the spend for this session.
+
+**The art round.** Four **5:2** bands — the shape a poster card's banner actually is. Round 3's four space plates are 16:9 field grounds; a 5:2 crop of one puts its density wherever it happens to fall, so the round generated for the card's own composition instead: the interest centre-right, the left third and both lower corners near-black, because the card puts its disc and name lower-left and its two figure callouts upper-left and lower-right.
+
+| Key | What it is |
+|---|---|
+| `nebula` | a violet-and-bronze nebula wash, sparse stars — the field's own language in the card's shape |
+| `dust` | warm bronze dust lanes, very low contrast; a haze rather than a shape |
+| `deepfield` | a deep field of very distant galaxies on near-black; the quietest of the four |
+| `chrome` | a sweeping ribbon of liquid chrome — the world's own material with no object in it |
+
+**Two things worth recording about the round.** `nano_banana_pro` was asked first (the model round 3 used); after twenty-five minutes not one of its four jobs had left `waiting`, while the same four prompts on `soul_location` returned in fifteen seconds — a stuck provider queue, not a bad request. And the nebula came back too dark to read at the card's 560px: a **gamma** lift (1.75) raises the wash without crushing the black the disc and the name sit on, which is what a contrast lift did instead when it was tried first. Both are in the sidecars, so the plates can be remade.
+
+**The key is the planet's kind, not a new kind.** `card_backdrop` joins `PLANET_VOCAB` rather than getting a vocabulary of its own, because everything true of the planet is true of it: a closed list, no default, the platform's to draw, pushed to no instance, restarting nothing. That one line is the whole server change — `planetChoice()` loops the vocab, the settings route builds both its validator and its `settingKeys` from it, and `publicInstance()` spreads it — so the key reaches the row, the own-scoped read and the public wire with no new branch. Two edits beyond it: `planetChoicesForHosts` now admits a host that chose **only** a backdrop, and `/projects/featured` carries the third key.
+
+**On the page.** `openCard` reads `backdropPlate(p.card_backdrop) || safeHttpUrl(p.art_url)` — the owner's plate stands in front of the project's own picture, and a key this platform does not draw resolves to `''` rather than a broken `src`. The picker is **its own section beside the planet**, not a control inside it: the owner's words were "beside the planet", and one heading is how a project is drawn *everywhere* while the other is one surface's backdrop, so folding them together would have made both headings lie. It is the planet section's twin otherwise — one band of hairline cells (five: "its own picture" and the four plates), the preview at the planet preview's width as a 5:2 band, one save door, the settings PATCH, the receipt the page repaints from. The preview's caption speaks for the ROW, so a pick that is ahead of the row reads **"not saved yet"** rather than "nothing chosen" under a plate the owner can already see.
+
+**What the grade caught, and the class it closed.** The first round shipped `card_backdrop` into `PLANET_VOCAB` and stopped there — and the settings route's `validateOrRespond` schema was a **hand-written field list**, not the vocabulary. Strict mode rejects any field a schema does not declare, so `settingKeys` would have copied the key that the validator had already 400'd: every real save from the manage page would have failed. Nothing caught it, because the kit's stub accepted any body key, so 47 probes and a clean render all passed against a request the server refuses. Both halves are fixed rather than patched: the route's schema is now **derived from the vocabularies** (`vocabSchema(SETTINGS_VOCAB)` + `vocabSchema(PLANET_VOCAB)`), so a key can no longer exist in one and not the other; the stub validates against the same closed lists (copied — a kit module may not import core — and pinned to their source by a test); and `provisioning_settings.mjs` now PATCHes the **real** router with `card_backdrop`, refuses an off-vocabulary one, and walks every declared key of both vocabularies asserting a 200, which is the guard that would have failed on the first round.
+
+**The kit.** The read path renders where the hub's own catalog is served — `projects-floor.states.json` is the sibling allowed to alias a fixture, so `featured-hub.json` gives Example a `card_backdrop` and the new `card-backdrop` state pins the plate's `src` on the card. `render.js --page /projects` **ALL CLEAN** (with `in-manage-card`), the two sibling states files ALL CLEAN, `probe.js` **47/47** (two new: the pick saves with the route's no-restart receipt; handing it back restores the project's own picture). `projects_hub` 138/138, `projects_hub_pre_uat` 56/56, `<redacted>` 34/34, `provisioning_settings` 26/26, `provisioning_settings_env` 12/12, `validate-design --strict` valid, `fitness` all checks passed, the copy registry regenerated. DESIGN.md carries the round-4 table.

package/docs/file-map.md

@@ -11,7 +11,7 @@
 ├── README.md                    ← public-facing one-paragraph summary
 ├── PRODUCT.md                   ← durable product truth for the apex/hall/status surfaces (impeccable init, task 1003296): users, positioning, constraints, brand commitments, principles — no palette, no type
 ├── DESIGN.md                    ← the visual rulebook written FROM the built landing (task 1003298, ADR 0196): palette + derived recipes, type, materials (the chrome plates), components, the motion grammar, both modes; what H1 (hall) and S1 (status) build against. Sidecar .impeccable/design.json
-├── .impeccable/                 ← impeccable skill artifacts: config.json (buildPath: code), surfaces/<route>.md (per-route briefs), mocks/world-assets/ (Higgsfield renders + prompt sidecars; the SOURCE of public-landing/assets/world/), mocks/decision/ (A1 comps), design.json (DESIGN.md sidecar), review/ (finish captures)
+├── .impeccable/                 ← impeccable skill artifacts: config.json (buildPath: code), surfaces/<route>.md (per-route briefs), mocks/world-assets/ (Higgsfield renders + prompt sidecars; the SOURCE of modules/public-landing/public/assets/world/), mocks/decision/ (A1 comps), design.json (DESIGN.md sidecar), review/ (finish captures)
 ├── .gitignore
 ├── package.json / package-lock.json
 ├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/gds/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
@@ -130,7 +130,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav.
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (public-landing/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. Reserved home styles/ (1003323) with a README. config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. Reserved home styles/ (1003323) with a README. config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.
@@ -254,7 +254,7 @@
 │   ├── assets/tray/ + build-resources/ ← generated icons (scripts/gen-icons.js; build-resources name dodges the global build/ gitignore)
 │   └── test/unit.mjs               ← hermetic unit tests (run by the CI workflow, not the root gate)
 │
-├── public-landing/                 ← the APEX front door + hub surfaces served by src/platform-server.js (landingPage(): apex-only strip → brand-token stamp → theme injection → ?v= asset stamp). Ships to EVERY instance; <!--apex-only:start/end--> regions are removed on a child
+├── modules/public-landing/public/   ← the APEX front door + hub surfaces. Its OWN MODULE since task 1003322 / ADR 0218 (manifest declares { apexRoot: true, dir: "public" } — the apex is not a Host prefix), still served by src/platform-server.js (landingPage(): apex-only strip → brand-token stamp → theme injection → ?v= asset stamp). Ships to EVERY instance; <!--apex-only:start/end--> regions are removed on a child
 │   ├── index.html                  ← the landing (/) — v3 "the template's page" of the chrome world (task 1003298, ADR 0196): server-stamped head, the breath (CSS-only signature), live figures/ledger/orbs from the public feeds baked inside sentinels; page-local <style> only (no :root), links /assets/world.css
 │   ├── projects.html               ← the hub (/projects?view=map|mine|manage|new) on cosmos.css (A4, task 1003299, rebuilds it in the world)
 │   ├── privacy.html / terms.html / contact.html ← the footer doors (task 1003251), on cosmos.css

package/docs/module-api-changelog.md

@@ -1319,5 +1319,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.439 with no explicit bump. run 33321131006. (task 1002620)
   1.19.441 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.440 with no explicit bump. run 33323478836. (task 1002620)
+  1.19.442 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.441 with no explicit bump. run 33326781131. (task 1002620)
+  1.19.443 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.442 with no explicit bump. run 33330337830. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -99,7 +99,9 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
     "disciplines": ["artist"],        //   builder disciplines this module adds
     "skills":      ["otb-tile-generate"], // slash-command skills it ships
     "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__
-    "webSurfaces": [{ "host": "status.", "dir": "public" }], // host-routed static web surfaces (BV1.R84)
+    "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces: a Host PREFIX (BV1.R84)…
+                                                            // …or { "apexRoot": true, "dir": "public" } for the
+                                                            // apex root (ADR 0218). One or the other, never both.
     "migrations":  true               //   true → modules/<key>/migrations/*.sql applied if enabled
   },
   "provides": ["box.hasEverConnected"], // OPTIONAL. Seam PORTS this module registers a provider for.
@@ -152,7 +154,11 @@ At boot the loader (called from `src/modules.js` and the route mounter) runs:
 4. **Enablement filter** — check `isModuleEnabled(key)` (env override → `config/modules.json` → `config/modules.neutral.json` → `manifest.default`); disabled modules are skipped.
 5. **Mount routes** — for each `contributes.routes` key, `require(`modules/<key>/routes/<routeKey>.js`)` and call the factory. Audit is already composed at the kernel level (routes.js runs `auditMiddleware` before the loader mounts anything); each route self-gates at the appropriate rank via `api.requireBuilder` / `api.requireRank`. The fitness check (`BV1.R44`) ensures every write route is rank-gated.
 6. **Start pollers** — call each `contributes.pollers` file's `start()` on successful mount.
-7. **Serve web surfaces** — for each `contributes.webSurfaces` entry `{ host, dir }`, `serve-internal.js` (via `loader.moduleWebSurfaces`) serves `modules/<key>/<dir>/` on the matching Host prefix (the content-hash-stamped index + branding injection the status page always used). This is how the status dashboard (`status-ui`) reaches `status.<apex>` with no core edit (BV1.R84). A disabled module's surface is never built, so its host routes nowhere.
+7. **Serve web surfaces** — a `contributes.webSurfaces` entry says WHERE the surface answers in exactly one of two ways, never both and never neither ([ADR 0218](adr/<redacted>.md)):
+   - `{ host: "status.", dir: "public" }` — a **Host-header prefix**. `serve-internal.js` (via `loader.moduleWebSurfaces`) serves `modules/<key>/<dir>/` on the matching host, with the content-hash-stamped index + branding injection the status page always used. This is how the status dashboard (`status-ui`) reaches `status.<apex>` with no core edit (BV1.R84).
+   - `{ apexRoot: true, dir: "public" }` — the **apex root**: whatever host is left once the subdomains are taken (`isApexHost` = `!isStatusHost && !isBuildersHost`). Declared by `public-landing`, the front door, and served by `platform-server.js`'s dedicated block. **`host: ""` is rejected, not read as "the root"** — the routers match with `host.startsWith(s.host)` and every string starts with `""`, so an empty prefix would answer on `builders.`/`status.` too and make `isModuleSurfaceHost()` true for every request, silently un-serving the hall.
+
+   A disabled module's surface is never built, so its host routes nowhere — and for the apex root that means the front door is gone and the 404 tail answers.
 8. **Apply migrations** — enabled-gated; `migrate.sh` discovers `modules/<key>/migrations/*.sql` only when the module is enabled.
 
 The loader is safe-by-construction: with no `modules/` dir it returns empty and all functions are no-ops — the instance behaves identically to before the module move.
@@ -246,6 +252,7 @@ Rules (enforced by the `BV1.R45` fitness check):
 | **`autonomy`** *(core-domain, default-on; R83)* | routes: `autonomy` (the `/autonomy/precheck`); pollers: `routine-timers` | — (registers NO port; reaches the lifecycle `tallyPeerVotes` via the doorway) | `^1.11.0` |
 | **`status-ui`** *(core-domain web surface, default-on; R84)* | webSurfaces: `{ host: "status.", dir: "public" }` (the status dashboard at `status.<apex>`) | — (registers NO port, NO routes; pure host-routed static surface) | `^1.11.0` |
 | **`hall-ui`** *(core-domain web surface, default-on; R85)* | webSurfaces: `{ host: "builders.", dir: "public" }` (the authenticated builders' hall) | — (registers NO port; keeps a DEDICATED serving block in `serve-internal.js`, unlike `status-ui`) | `^1.11.0` |
+| **`public-landing`** *(core-domain web surface, default-on; task 1003322 / ADR 0218)* | webSurfaces: `{ apexRoot: true, dir: "public" }` (the front door at the apex root: `/`, `/projects`, `/create`, `/privacy`, `/terms`, `/contact`) | — (registers NO port; the first surface that is not a subdomain, and like `hall-ui` it keeps a DEDICATED serving block — in `platform-server.js`) | `^1.19.0` |
 | **`lifecycle`** *(core-domain, default-on; R86)* | routes: `tasks`, `claims`, `versions`, `done-when`, `goals`, `dependencies`, `gate-approvals`, `analytics` | provides `lifecycle` (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads); resolves `reward`, `onboarding` | `^1.12.0` |
 | **`provisioning`** *(default-off; [ADR 0111](adr/<redacted>.md))* | routes: `provisioning` (own+Archon rank-gated) | provides `provisioning.instanceState` | `^1.14.0` |
 | **`ui-design`** *(core-domain, default-on; [ADR 0197](adr/<redacted>.md))* | skills: `design`, `design-sync`, `figma-design-sync` (the /design playbook + the two tool round-trips); the ADR 0081 adapters, sync CLIs and validator live in the module dir | — (registers NO port, NO routes; declaration-only — disabling it withdraws the skills and touches no served surface) | `^1.19.0` |

package/docs/recipes/ui-look-before-you-ship.md

@@ -15,7 +15,7 @@ Edge or Chrome must be installed. If neither launches, every kit command prints
 ## 1. Stub — serve the surface the way the instance would
 
 ```
-node modules/ui-design/kit/serve.js                          # public-landing at http://127.0.0.1:3412/
+node modules/ui-design/kit/serve.js                          # the front door at http://127.0.0.1:3412/
 AUTH=1 STUB_PORT=3413 node modules/ui-design/kit/serve.js    # the same, signed in (/me answers { builder })
 SURFACE=hall-ui PREFIX=/builders/ node modules/ui-design/kit/serve.js
 CHILD=1 node modules/ui-design/kit/serve.js                  # the child-instance shape (apex-only regions stripped)
@@ -25,7 +25,7 @@ FAIL=featured,progress node modules/ui-design/kit/serve.js   # those feeds answe
 
 The stub runs the page through the **instance's real transforms** — the apex-only strip, the brand-token stamp, the pack's theme injection, run by the core-side command `scripts/gds/ui-kit-transform.js` (a module may not require core, so the stub spawns the command and memoises the page) — then the content-hash `?v=` stamp, with the instance's own branding pack, and answers the public feeds from `kit/fixtures/`. It also serves `docs/` raw, so a mock under `docs/design/mocks/` renders with its relative links: `http://127.0.0.1:3412/docs/design/mocks/hub/v2.html`.
 
-`SURFACE` is a checkout directory (`public-landing`, `modules/hall-ui/public`) or a module key whose manifest declares a `webSurfaces` dir. `PREFIX` is the URL prefix the surface's pages and assets live under (the hall's is `/builders/`).
+`SURFACE` is a checkout directory (`modules/hall-ui/public`) or a module key whose manifest declares a `webSurfaces` dir (`public-landing`, `hall-ui`). `PREFIX` is the URL prefix the surface's pages and assets live under (the hall's is `/builders/`).
 
 ## 2. Render — every state, every width, both modes, audited
 
@@ -74,7 +74,7 @@ Then a state's own `expect` (a band open, a dialog present, a field's value, a c
 
 Actions: `click`, `focus`, `press`, `fill`, `wait`, `clickAt x y`, `clickIfVisible`, `dispatchClick`, `check`, `back`, `forward`. Expectations: `expanded`, `dialog`, `visible[]`, `hidden[]`, `open`, `closed`, `activeId`, `activeText`, `expandedIds[]`, `param{}`, `attr[[sel,name,value]]`, `text[[sel,value]]`, `href[[sel,value]]`, `count[[sel,n]]`, `value[[sel,v]]`, `hasClass[[sel,class,bool]]`, `checked`, `noOverflow`, `top[[sel,px]]` (an element's viewport top — assert it closed, open a band, assert it again: the proof an overlay did not push the page). The kit validates the file before it opens a browser and names every problem.
 
-The worked examples: `public-landing/projects.states.json` (the hub's thirteen), `public-landing/index.states.json` (the landing's four), `modules/hall-ui/public/ranks.states.json` (a second surface under its own prefix — it renders **red**, deliberately: the hall predates the 24px floor and Ranks has no `<h1>`, and the states file declares the shell's un-fixtured feeds rather than hiding the findings; idea 1000863 carries them).
+The worked examples: `modules/public-landing/public/projects.states.json` (the hub's thirteen), `modules/public-landing/public/index.states.json` (the landing's four), `modules/hall-ui/public/ranks.states.json` (a second surface under its own prefix — it renders **red**, deliberately: the hall predates the 24px floor and Ranks has no `<h1>`, and the states file declares the shell's un-fixtured feeds rather than hiding the findings; idea 1000863 carries them).
 
 ## 3. Probe — the interaction contract, as PASS/FAIL lines
 
@@ -83,7 +83,7 @@ node modules/ui-design/kit/probe.js --page /projects
 node modules/ui-design/kit/probe.js --page / --only "Escape"
 ```
 
-A **probes file** (`<surface>/<page>.probes.json`) is a sequence: each probe opens the page (or continues the previous probe's page with `"continue": true`), drives steps from the same action vocabulary, and states what must be true with the same expectations. An uncaught page error during a probe fails it. The disclosure contract ships first — `public-landing/projects.probes.json` (24 probes: Enter opens on the first item, arrows cycle and skip hidden cells, Escape returns focus, Tab out closes, a click outside closes, one band closes the other, the views, the card yields Escape, the fold under 480, signed out nothing throws) and `index.probes.json` (10, the landing).
+A **probes file** (`<surface>/<page>.probes.json`) is a sequence: each probe opens the page (or continues the previous probe's page with `"continue": true`), drives steps from the same action vocabulary, and states what must be true with the same expectations. An uncaught page error during a probe fails it. The disclosure contract ships first — `modules/public-landing/public/projects.probes.json` (24 probes: Enter opens on the first item, arrows cycle and skip hidden cells, Escape returns focus, Tab out closes, a click outside closes, one band closes the other, the views, the card yields Escape, the fold under 480, signed out nothing throws) and `index.probes.json` (10, the landing).
 
 ## 4. Read the shots, fix in one batch, re-run once
 

package/modules/copy-desk/tests/copy_flags.mjs

@@ -32,7 +32,7 @@ const FAKE = {
   counts: { strings: 3, unique_ids: 2, certain: 3, heuristic: 0, duplicate_ids: 1 },
   surfaces: {
     'builders-hall': { at: 'modules/hall-ui/public', files: 2, strings: 2 },
-    landing: { at: 'public-landing', files: 1, strings: 1 },
+    landing: { at: 'modules/public-landing/public', files: 1, strings: 1 },
   },
   duplicates: [
     { id: 'dup1', surface: 'builders-hall', text: 'Could not save.', occurrences: 2,
@@ -41,7 +41,7 @@ const FAKE = {
   entries: [
     { id: 'dup1', surface: 'builders-hall', text: 'Could not save.', file: 'modules/hall-ui/public/a.js', line: 10, origin: 'js-notice', confidence: 'certain' },
     { id: 'dup1', surface: 'builders-hall', text: 'Could not save.', file: 'modules/hall-ui/public/b.js', line: 20, origin: 'js-notice', confidence: 'certain' },
-    { id: 'solo', surface: 'landing', text: 'Enter the future.', file: 'public-landing/index.html', line: 4, origin: 'html-text', confidence: 'certain' },
+    { id: 'solo', surface: 'landing', text: 'Enter the future.', file: 'modules/public-landing/public/index.html', line: 4, origin: 'html-text', confidence: 'certain' },
   ],
 };
 const INDEX = registry.indexRegistry(FAKE);
@@ -137,7 +137,7 @@ await test('the snapshot is taken from the registry', () => {
   const r = ok({ scope: 'string', surface: 'landing', string_id: 'solo', reason: GOOD_REASON });
   assert.equal(r.ok, true);
   assert.equal(r.value.text_at_flag, 'Enter the future.');
-  assert.equal(r.value.file_at_flag, 'public-landing/index.html');
+  assert.equal(r.value.file_at_flag, 'modules/public-landing/public/index.html');
   assert.equal(r.value.line_at_flag, 4);
   assert.equal(r.value.registry_schema, 1);
 });
@@ -153,7 +153,7 @@ await test('a caller-supplied snapshot is IGNORED', () => {
   });
   assert.equal(r.ok, true);
   assert.equal(r.value.text_at_flag, 'Enter the future.');
-  assert.equal(r.value.file_at_flag, 'public-landing/index.html');
+  assert.equal(r.value.file_at_flag, 'modules/public-landing/public/index.html');
   assert.equal(r.value.line_at_flag, 4);
 });
 

package/modules/platform-identity/routes/projects.js

@@ -148,7 +148,8 @@ module.exports = function projectsRoutes() {
       // the wire always carries both keys: null = the platform's own pick
       const planetOf = (p) => {
         const c = (planets && planets[hostOfOrigin(p.origin)]) || {};
-        return { planet_template: c.planet_template || null, planet_accent: c.planet_accent || null };
+        return { planet_template: c.planet_template || null, planet_accent: c.planet_accent || null,
+          card_backdrop: c.card_backdrop || null };
       };
       // The enrichment's keys (builders, tags, owner, owner_avatar, faces,
       // shipped_30d, shipped_30d_capped, hall_origin) never collide with the

package/modules/provisioning/provisioning.js

@@ -142,7 +142,16 @@ const PLANET_TEMPLATES = Object.freeze([
   ...PLANET_SHAPES.flatMap((s) => PLANET_MATERIALS.flatMap((m) => ['tint', 'wash', 'plain'].map((y) => `${s}-${m}-${y}`))),
 ]);
 const PLANET_ACCENTS = Object.freeze(['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent']);
-const PLANET_VOCAB = Object.freeze({ planet_template: PLANET_TEMPLATES, planet_accent: PLANET_ACCENTS });
+// The card's backdrop (task 1003352) is the same KIND of key as the planet, so it
+// rides the same vocab: a closed list of platform-drawn plates, null = the
+// project's own art (or none). It is not a policy either — nothing is pushed to
+// the instance and nothing restarts; the card simply reads the row.
+const CARD_BACKDROPS = Object.freeze(['nebula', 'dust', 'deepfield', 'chrome']);
+// Named PLANET_VOCAB for the keys it began with; what it actually holds is every
+// key the PLATFORM draws a project with — no default, no env transport, no restart.
+const PLANET_VOCAB = Object.freeze({
+  planet_template: PLANET_TEMPLATES, planet_accent: PLANET_ACCENTS, card_backdrop: CARD_BACKDROPS,
+});
 
 // The optional project-detail interview (BV1.R15, task 1002334) — the "tell us
 // about your project" step every creation form offers and every owner may skip.
@@ -1088,7 +1097,7 @@ async function planetChoicesForHosts(db, hosts) {
   for (const r of rows) {
     if (out[r.host]) continue;
     const choice = planetChoice(r);
-    if (choice.planet_template || choice.planet_accent) out[r.host] = choice;
+    if (Object.values(choice).some(Boolean)) out[r.host] = choice;
   }
   return out;
 }

package/modules/provisioning/routes/provisioning.js

@@ -796,12 +796,17 @@ module.exports = function provisioningRoutes() {
   router.patch('/provisioning/instances/:id/settings', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
+    // The schema IS the vocabularies, not a copy of them (task 1003352): strict
+    // mode rejects any field the schema does not declare, so a key added to a
+    // vocabulary but forgotten here reaches settingKeys and then 400s on every
+    // real save — which is exactly what card_backdrop did until the grader caught
+    // it. Deriving both from the same source makes that drift unrepresentable.
+    // The platform-drawn keys are nullable on purpose: null hands the pick back.
+    const vocabSchema = (vocab) => Object.fromEntries(
+      Object.entries(vocab).map(([key, values]) => [key, { type: 'string', enum: values }]));
     if (validateOrRespond(req, res, {
-      platform_visibility: { type: 'string', enum: provisioning.SETTINGS_VOCAB.platform_visibility },
-      joinability: { type: 'string', enum: provisioning.SETTINGS_VOCAB.joinability },
-      // the planet (task 1003347): nullable on purpose — null hands the pick back to the platform
-      planet_template: { type: 'string', enum: provisioning.PLANET_VOCAB.planet_template },
-      planet_accent: { type: 'string', enum: provisioning.PLANET_VOCAB.planet_accent },
+      ...vocabSchema(provisioning.SETTINGS_VOCAB),
+      ...vocabSchema(provisioning.PLANET_VOCAB),
     })) return;
     const settingKeys = [...Object.keys(provisioning.SETTINGS_VOCAB), ...Object.keys(provisioning.PLANET_VOCAB)];
     const patch = {};

package/modules/public-landing/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/public-landing/module.json

@@ -0,0 +1,15 @@
+{
+  "key": "public-landing",
+  "title": "The front door",
+  "description": "The instance's public front door served at the APEX ROOT — the landing page (/), the projects hub (/projects, and the /create redirect into its ?view=new wizard), the three footer doors (/privacy, /terms, /contact) and every asset behind them. The third WEB-SURFACE core-domain module after status-ui (BV1.R84) and hall-ui (BV1.R85), carved in task 1003322 (ADR 0218; named in ADR 0197 §8 — the front door keeps its own key, because a customer of the ui-design capability is not part of it). default-on: an instance ships its front door like it ships its hall. Registers no port and contributes no routes — it declares a webSurface, and where hall-ui and status-ui name a Host PREFIX this one declares apexRoot:true, since the apex is whatever host is left once the subdomains are taken (ADR 0218 §2; host:\"\" is rejected, because every host string startsWith \"\"). Like the hall, the declaration is the discovery + scope-map + window.__MODULES__ record: the bytes are served by platform-server.js's dedicated landing block, which keeps the apex-only sentinel strip, the branding-token stamp and the ?v= content stamp and only re-points its root at this module's public/ dir. Disabling the module removes the front door outright — the apex then answers the game-less 404 tail. The world it renders (DESIGN.md, the token contract, the direction records) is the INSTANCE's; the method for building one stays in modules/ui-design/.",
+  "coreVersion": "^1.19.0",
+  "default": true,
+  "maintenance": { "status": "core-maintained" },
+  "contributes": {
+    "webSurfaces": [
+      { "apexRoot": true, "dir": "public" }
+    ]
+  },
+  "provides": [],
+  "consumes": []
+}

package/{public-landing → modules/public-landing/public}/assets/cosmos.css

@@ -1377,6 +1377,14 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-manage .pickPreview{display:grid;gap:12px;justify-items:center;padding-top:6px;}
 #view-manage .pickWords{margin:0;font-size:14px;font-weight:400;line-height:1.45;color:var(--ink);text-align:center;max-width:168px;}
 #view-manage .pickWords small{display:block;font-size:12.5px;color:var(--ink-soft);}
+/* the card's backdrop preview (task 1003352): the poster's own 5:2 band at the
+   width the planet preview stands at, so the two sections read as one column.
+   No ground of its own — "its own picture" is an empty hairline frame, which is
+   the honest drawing of a project that may have no art at all. */
+#view-manage .cardBand{display:block;width:168px;aspect-ratio:5/2;background-size:cover;
+  background-position:center;background-repeat:no-repeat;background-color:var(--bg);
+  border:1px solid var(--rule-soft);}
+#view-manage .cardBand[data-own]{border-style:dashed;}
 #view-manage .pickBands{display:grid;border-bottom:1px solid var(--rule);}
 #view-manage .pickBand{display:grid;grid-template-columns:88px 1fr;gap:0 18px;align-items:center;border-top:1px solid var(--rule);}
 #view-manage .pickLabel{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);text-transform:uppercase;color:var(--ink-faint);padding:14px 0;}

package/modules/public-landing/public/assets/world/r4-card-chrome.jpg.json

@@ -0,0 +1,14 @@
+{
+  "kind": "card-band",
+  "model": "soul_location (Higgsfield) — nano_banana_pro was asked first; its queue had not started a job after 25 minutes, so the round moved to the model that answered",
+  "job_id": "a9e4cb59-7436-4f8f-9289-aba9b1fd567e",
+  "aspect_ratio": "5:2",
+  "source_aspect_ratio": "21:9",
+  "generated": "2026-08-30T17:09Z",
+  "round": 4,
+  "task": 1003352,
+  "prompt": "Ultra-wide studio photograph on a pure black ground: a single sweeping ribbon of liquid chrome, polished mirror metal with soft neutral specular highlights and a faint cool blue and warm bronze reflection, curving gently through the centre-right of the frame and fading into black at both ends. Abstract material study, not an object, no recognisable shape, no product. The left third and both lower corners stay almost pure black and empty. No text, no watermark, no logo, no border, no reflection of a studio or a person. Pure black dominates the frame.",
+  "source": ".impeccable/mocks/world-assets/r4-card-chrome-src.jpg",
+  "encoded": "ffmpeg crop=2560:1024:0:24 (21:9 → 5:2, centred), JPEG -q:v 4",
+  "use": "the poster card's backdrop on /projects, chosen by an owner as card_backdrop=\"chrome\": a sweeping ribbon of liquid chrome — the world's own material with no object in it. Dark only (ADR 0204); composed so the left third and the lower corners stay near-black, where the card puts its disc, its name and its two figure callouts."
+}