@bongos/core 1.19.441 → 1.19.443

package/tests/projects_hub.mjs

@@ -19,8 +19,10 @@ import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
-const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
 const STYLE = (HUB.match(/<style>([\s\S]*?)<\/style>/) || [, ''])[1];
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
@@ -71,7 +73,7 @@ test('?view= is the deep-link contract, read on boot and written with replaceSta
   assert.match(SCRIPT, /'&id=' \+ encodeURIComponent\(manageId\)/,
     'the URL writer must carry the manage id, encoded');
   // the landing page's CTAs have always pointed here — this is the bug they hit
-  const landing = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
+  const landing = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
   assert.match(landing, /href="\/projects\?view=new"/,
     'the landing CTA target must stay a view the hub knows');
 });
@@ -255,8 +257,8 @@ test('the gate is retired — no route, no files, no links into it', () => {
   // the FILES, not the directory: git cannot track an empty dir, so a stale
   // working tree may keep the folder while the commit is clean
   for (const f of ['index.html', 'space.js', 'space.css']) {
-    assert.equal(fs.existsSync(path.join(ROOT, 'public-landing', 'gate', f)), false,
-      `public-landing/gate/${f} must be gone: express.static would keep serving it`);
+    assert.equal(fs.existsSync(path.join(LANDING, 'gate', f)), false,
+      `the landing surface’s gate/${f} must be gone: express.static would keep serving it`);
   }
   const server = fs.readFileSync(path.join(ROOT, 'src', 'platform-server.js'), 'utf8');
   assert.doesNotMatch(server, /res\.redirect\(302, '\/gate\/'\)/,
@@ -272,7 +274,7 @@ test('/create is absorbed — the wizard lives here and the route only redirects
   // are real markup inside the new view (C7), create.html is deleted — the
   // gate precedent above: express.static would keep serving the raw file —
   // and the name handoff became an in-page step advance.
-  assert.equal(fs.existsSync(path.join(ROOT, 'public-landing', 'create.html')), false,
+  assert.equal(fs.existsSync(path.join(LANDING, 'create.html')), false,
     'create.html must be gone: express.static would keep serving it raw and unbranded');
   assert.doesNotMatch(SCRIPT, /location\.assign\('\/create'/,
     'naming a project advances the wizard in place — no navigation');
@@ -449,8 +451,8 @@ test('the count includes the platform when it is shown', () => {
    and the hub's. ── */
 
 test('neither the landing hero nor the hub types (tasks 1003298, 1003300)', () => {
-  const LANDING = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
-  assert.doesNotMatch(LANDING, /id="typed"|setTimeout\(type\b/, 'the landing hero does not type');
+  const LANDING_HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
+  assert.doesNotMatch(LANDING_HTML, /id="typed"|setTimeout\(type\b/, 'the landing hero does not type');
   assert.doesNotMatch(SCRIPT, /function typeMark\(\)|HOLD_HOME|setTimeout\(type\b/, 'the hub has no typing loop');
 });
 
@@ -558,7 +560,7 @@ test('the ladder: each region hides on null and the other figure stands alone',
   assert.match(art, /classList\.toggle\('has-art', !!url\)/, 'art switches the whole layout');
   assert.match(SCRIPT, /\$\('cardArt'\)\.addEventListener\('error', function \(\) \{ cardArt\(''\); \}\);/,
     'a broken image demotes to the no-art layout, never a broken glyph');
-  assert.match(SCRIPT, /cardArt\(p\.isSelf \? '' : safeHttpUrl\(p\.art_url\)\)/, 'the art URL is scheme-checked client-side too');
+  assert.match(SCRIPT, /safeHttpUrl\(p\.art_url\)\)\);/, 'the art URL is scheme-checked client-side too (behind the owner\'s plate since task 1003352)');
 });
 
 test('exactly one hall-URL derivation: the DOM for the hub, the feed for a project, safeHttpUrl for both, and only where the hall is elsewhere', () => {
@@ -1569,9 +1571,9 @@ test('the walk assigns the template by canonical position beside the accent; a c
 });
 
 test("the planet is the landing's object on the landing's crop maths: the three rectangles are byte-equal across the two sheets", () => {
-  const LANDING = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
+  const LANDING_HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
   const landingCrop = (cls) => {
-    const m = LANDING.match(new RegExp(`\\.${cls}\\{[^}]*--bead-ar:([^;]+);--bead-zoom:([^;]+);--bead-px:([^;]+);--bead-py:([^;}]+)`));
+    const m = LANDING_HTML.match(new RegExp(`\\.${cls}\\{[^}]*--bead-ar:([^;]+);--bead-zoom:([^;]+);--bead-px:([^;]+);--bead-py:([^;}]+)`));
     assert.ok(m, `the landing declares .${cls}`);
     return m.slice(1, 5).map((s) => s.trim());
   };
@@ -1604,7 +1606,7 @@ test('the materials (task 1003337): a whole object per plate, the crop recompute
     const rule = `.worldOrb[data-material="${material}"][data-shape="${shape}"]{--tpl-src:var(--plate-${material}-${shape}-cut);--tpl-ar:${f5(w / h)};--tpl-zoom:${f5(zoom)};--tpl-px:${f5(-U0 * zoom)};--tpl-py:${f5(-V0 * zoom)};}`;
     assert.ok(COSMOS.includes(rule), `the ${key} crop follows from its box: ${rule}`);
     assert.ok(COSMOS.includes(`--plate-${material}-${shape}-cut:url(/assets/world/r3-${material}-${shape}-cut.webp);`), `the ${key} plate token`);
-    const file = path.join(ROOT, 'public-landing', 'assets', 'world', `r3-${material}-${shape}-cut.webp`);
+    const file = path.join(LANDING, 'assets', 'world', `r3-${material}-${shape}-cut.webp`);
     assert.ok(fs.existsSync(file), `${key}: the cutout ships`);
     assert.ok(fs.existsSync(file + '.json'), `${key}: with its sidecar`);
     const head = fs.readFileSync(file).subarray(0, 40).toString('latin1');
@@ -1620,7 +1622,7 @@ test('the field carries a rendered backdrop (task 1003337): one token, cover, a
   assert.match(COSMOS, /\.field \.ground\{position:absolute;inset:-4%;background:var\(--sky-bg\) var\(--field-plate\) center\/cover no-repeat;\}/);
   assert.match(COSMOS, /@media \(prefers-reduced-motion:no-preference\)\{\s*\.field \.ground\{animation:groundDrift 90s ease-in-out infinite alternate;\}/, 'the drift only runs where motion is welcome');
   assert.match(COSMOS, /@keyframes groundDrift\{from\{transform:translate3d\([^)]*\) scale\(1\.02\);\}to\{transform:translate3d\([^)]*\) scale\(1\.06\);\}\}/, 'transform only');
-  const plate = path.join(ROOT, 'public-landing', 'assets', 'world', 'r3-space-nebula.jpg');
+  const plate = path.join(LANDING, 'assets', 'world', 'r3-space-nebula.jpg');
   assert.ok(fs.existsSync(plate) && fs.existsSync(plate + '.json'), 'the plate and its sidecar ship');
   const side = JSON.parse(fs.readFileSync(plate + '.json', 'utf8'));
   assert.equal(side.kind, 'backdrop');
@@ -1680,7 +1682,7 @@ test('the kit proves the field path: the fixture carries a curated template and
   assert.equal(demo.planet_template, 'pair-obsidian-tint', 'the owner\'s choice rides the same wire (task 1003347)');
   assert.equal(demo.planet_accent, 'sea', 'a token NAME, never a colour');
   assert.ok(fixture.projects.every((p) => 'template' in p && 'planet_template' in p && 'planet_accent' in p), 'the wire never drops a key');
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
   const attrs = states.states['in-map'].expect.attr.map((a) => a.join(' '));
   assert.ok(attrs.includes('#selfOrb data-template pair-chrome'));
   assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
@@ -1756,7 +1758,7 @@ test('the picker wears the world by scope: the preview left and four bands right
 });
 
 test('the kit proves the picker: a state renders it on the owner\'s feed-carried choice, three probes save / hand back / fold, and both fixtures carry the choice (task 1003347)', () => {
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
   const st = states.states['in-manage-planet'];
   assert.ok(st && st.auth && st.url === '/projects?view=manage&id=101', 'the signed-in owner on Demo');
   assert.ok(st.expect.visible.includes('#mPlanetPick') && st.expect.visible.includes('#mPick [data-pick-reset]'));
@@ -1770,7 +1772,7 @@ test('the kit proves the picker: a state renders it on the owner\'s feed-carried
   const harbor = inst.instances.find((i) => i.slug === 'harbor');
   assert.equal(harbor.planet_template, 'blob-frost-tint');
   assert.equal(harbor.planet_accent, 'sun-lit');
-  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8'));
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8'));
   const names = probes.probes.map((p) => p.name);
   assert.ok(names.some((n) => n.startsWith('manage flows: its planet (task 1003347)')), 'the save probe');
   assert.ok(names.some((n) => n.includes('handed back to the platform')), 'the reset probe');
@@ -1782,10 +1784,10 @@ test('the kit proves the picker: a state renders it on the owner\'s feed-carried
   assert.match(stub, /planet: PLANETS\.get\(String\(id\)\) \|\| NO_PLANET/, 'and answers it on the settings read and the receipt');
 });
 
-test('the feed carries the owner\'s choice through a seam: platform-identity resolves provisioning.projectPlanets optionally and spreads both keys on every project (task 1003347)', () => {
+test('the feed carries the owner\'s choice through a seam: platform-identity resolves provisioning.projectPlanets optionally and spreads every platform-drawn key on every project (tasks 1003347, 1003352)', () => {
   const route = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'routes', 'projects.js'), 'utf8');
   assert.match(route, /api\.resolveOptional\('provisioning\.projectPlanets', async \(\) => \(\{\}\)\)\(projects\.map\(\(p\) => hostOfOrigin\(p\.origin\)\)\)/, 'optional — an instance without provisioning has no choices to carry');
-  assert.match(route, /return \{ planet_template: c\.planet_template \|\| null, planet_accent: c\.planet_accent \|\| null \};/, 'the wire always carries both keys');
+  assert.match(route, /return \{ planet_template: c\.planet_template \|\| null, planet_accent: c\.planet_accent \|\| null,\r?\n\s*card_backdrop: c\.card_backdrop \|\| null \};/, 'the wire always carries every key — null = nothing chosen');
   assert.match(route, /\.\.\.planetOf\(p\),/, 'spread beside the stats');
   assert.doesNotMatch(route, /require\(['"][^'"]*provisioning/, 'never an import across modules');
   const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'module.json'), 'utf8'));
@@ -1827,6 +1829,89 @@ test('the sort left the column head for a control the keyboard and a screen read
   assert.match(COSMOS, /\.tblSort button:focus-visible\{outline:2px solid var\(--accent\);outline-offset:2px;\}/, 'keyboard focus on the sort is visible');
 });
 
+/* ── the card's backdrop (task 1003352): the owner's plate, beside the planet ── */
+
+test('the kit stub refuses what the real route refuses, and its copied vocabulary cannot rot', async () => {
+  // A kit module may not import core, so serve.js copies the closed lists. The
+  // copy is what matters: it stayed permissive through a whole probe run while
+  // the real PATCH would have 400'd on card_backdrop (task 1003352, grade round
+  // 2), so the stub now validates — and this pins the copy to its source.
+  const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(stub, /function settingsRejection\(body\)/, 'the stub validates a settings body');
+  assert.match(stub, /if \(bad\) return json\(res, 400, \{ error: \{ code: 'validation_failed'/, 'and answers the real code');
+  const provisioning = createRequire(import.meta.url)('../modules/provisioning/provisioning.js');
+  const block = (stub.match(/const STUB_VOCAB = \{([\s\S]*?)\n\};/) || [, ''])[1];
+  assert.ok(block, 'STUB_VOCAB must keep its extractable shape');
+  const real = { ...provisioning.SETTINGS_VOCAB, ...provisioning.PLANET_VOCAB };
+  for (const [key, values] of Object.entries(real)) {
+    assert.match(block, new RegExp(`\\b${key}:`), `the stub must know ${key}`);
+    if (key === 'planet_template') continue;   // the template set is long: shape is checked, not membership
+    for (const v of values) assert.match(block, new RegExp(`'${v}'`), `the stub's ${key} is missing ${v}`);
+  }
+});
+
+test('the card backdrop is the same KIND of key as the planet: a closed platform-drawn list on the same channel, pushing nothing', () => {
+  const prov = fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'provisioning.js'), 'utf8');
+  assert.match(prov, /const CARD_BACKDROPS = Object\.freeze\(\['nebula', 'dust', 'deepfield', 'chrome'\]\);/, 'a closed list, frozen');
+  // riding PLANET_VOCAB is the whole point: planetChoice() loops it, the settings
+  // route builds its validator and its settingKeys from it, and publicInstance
+  // spreads it — so the key reaches the row, the read and the wire with no new branch
+  assert.match(prov, /planet_template: PLANET_TEMPLATES, planet_accent: PLANET_ACCENTS, card_backdrop: CARD_BACKDROPS,/, 'it rides the platform-drawn vocab');
+  // and the route's SCHEMA is that vocab, not a copy of it: a hand-written list
+  // is what let card_backdrop reach settingKeys while strict validation still
+  // 400'd every real save (grade round 2)
+  const settingsRoute = fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'), 'utf8');
+  assert.match(settingsRoute, /const vocabSchema = \(vocab\) => Object\.fromEntries\(/, 'the schema is derived');
+  assert.match(settingsRoute, /\.\.\.vocabSchema\(provisioning\.SETTINGS_VOCAB\),\r?\n\s*\.\.\.vocabSchema\(provisioning\.PLANET_VOCAB\),/, 'from both vocabularies');
+  assert.doesNotMatch(settingsRoute, /planet_template: \{ type: 'string', enum: provisioning\.PLANET_VOCAB/, 'no hand-written key survives to drift');
+  assert.match(prov, /if \(Object\.values\(choice\)\.some\(Boolean\)\) out\[r\.host\] = choice;/, 'a host that chose ONLY a backdrop still reaches the feed');
+  const route = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'routes', 'projects.js'), 'utf8');
+  assert.match(route, /card_backdrop: c\.card_backdrop \|\| null/, 'the wire always carries the key — null = nothing chosen');
+});
+
+test("the card paints the owner's plate before the project's own picture, and a key the platform does not draw paints nothing", () => {
+  assert.match(SCRIPT, /cardArt\(p\.isSelf \? '' : \(backdropPlate\(p\.card_backdrop\) \|\| safeHttpUrl\(p\.art_url\)\)\);/,
+    "the plate wins; the project's own art is the fallback, which is all the card read before");
+  const fn = (SCRIPT.match(/function backdropPlate\(key\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'backdropPlate() must exist');
+  assert.match(fn, /CARD_PLATES\[key\] \? '\/assets\/world\/' \+ CARD_PLATES\[key\] : ''/,
+    'an unknown key — a row written before a plate was retired — must never become a broken src');
+  const plates = (SCRIPT.match(/var CARD_PLATES = \{([^}]*)\}/) || [, ''])[1];
+  const offered = (SCRIPT.match(/var CARD_BACKDROPS = ([\s\S]*?);\r?\n/) || [, ''])[1];
+  for (const k of ['nebula', 'dust', 'deepfield', 'chrome']) {
+    assert.match(plates, new RegExp(`\\b${k}\\b`), `${k} has a plate`);
+    assert.match(offered, new RegExp(`'${k}'`), `${k} is offered in the picker`);
+  }
+});
+
+test('every plate the picker offers ships as a real file with its provenance sidecar', () => {
+  for (const k of ['nebula', 'dust', 'deepfield', 'chrome']) {
+    const file = path.join(LANDING, 'assets', 'world', `r4-card-${k}.jpg`);
+    assert.ok(fs.existsSync(file), `r4-card-${k}.jpg must ship — the picker offers it`);
+    const side = JSON.parse(fs.readFileSync(`${file}.json`, 'utf8'));
+    assert.equal(side.task, 1003352, 'the sidecar names the task that made it');
+    assert.ok(side.model && side.prompt, 'and the model and the prompt, so it can be remade');
+    assert.equal(side.aspect_ratio, '5:2', "a card band, not a field ground — the reason this round existed");
+  }
+});
+
+test("its card is the planet section's twin: its own heading, the same channel, no restart", () => {
+  // beside the planet rather than inside it, so each heading stays true: one is
+  // how the project is drawn everywhere, the other is one surface's backdrop
+  assert.match(HUB, /<div class="card mSec" id="mCard">\s*<h2>Its card<\/h2>/, 'its own section');
+  assert.ok(HUB.indexOf('id="mCard"') > HUB.indexOf('id="mPlanetPick"'), 'and it stands after the planet, where the owner asked for it');
+  assert.match(SCRIPT, /body: JSON\.stringify\(\{ card_backdrop: mCard \|\| null \}\)/, "the save is the settings PATCH; '' hands the pick back as null");
+  assert.match(SCRIPT, /manageInst\.card_backdrop = \(data\.planet \|\| \{\}\)\.card_backdrop \|\| null;/,
+    'the reply is a receipt — the page repaints from the row, never from words in the reply');
+  assert.match(SCRIPT, /renderPick\(inst\);\r?\n\s*renderCardPick\(inst\);/, 'both sections fill from the same manage read');
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
+  assert.ok(states.states['in-manage-card'], 'the section has a rendered state');
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8'));
+  const names = probes.probes.map((p) => p.name);
+  assert.ok(names.some((n) => n.startsWith('manage flows: its card (task 1003352)')), 'the save probe');
+  assert.ok(names.some((n) => n.includes("its card — handing it back")), 'the hand-back probe');
+});
+
 /* ── the create wizard in the world (task 1003346; direction record §15, the pick: v1 the
    rail above, the bongo pair kept). Two sheets carry it: cosmos.css draws the FRAME by scope
    (#view-new), projects.html's own wizard block draws the wizard's structures. ── */
@@ -1877,8 +1962,8 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(SCRIPT, /target_ref: state\.owner \+ '\/' \+ state\.repo,/, 'the repo ref is unchanged');
   assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \? 'adopt' : 'greenfield'/, 'the onboard mode is unchanged');
   // the kit walks every step and files against the stub
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8')).states;
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
   for (const s of ['type', 'about', 'home', 'address', 'review', 'done']) assert.ok(states['in-new-' + s], `the ${s} step has a kit state`);
-  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8')).probes;
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
   assert.ok(probes.some((p) => /the wizard driver \(task 1003346\)/.test(p.name) && p.steps.some((st) => st[1] === '#doCreate')), 'the wizard driver files a project end to end');
 });

package/tests/projects_hub_pre_uat.mjs

@@ -11,11 +11,13 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 // LF-normalised: a Windows checkout (core.autocrlf) hands back CRLF, and the
 // anchored regexes below reason about line ends
-const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
-const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
-const INDEX = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8').replace(/\r\n/g, '\n');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
+const INDEX = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
 
 // a function's text runs from its declaration to the next declaration in the

package/tests/provisioning_settings.mjs

@@ -166,10 +166,13 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
-  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null });
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
     platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
+    // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
+    // closed list, no default, no push — so it rides the same vocab
+    card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],
   });
 });
 
@@ -177,7 +180,7 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { planet_template: 'bead-obsidian-tint', planet_accent: 'purple' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null });
+  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' }, 'the planet is not a setting: the policy read is untouched');
 });
 
@@ -268,7 +271,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   reset();
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
+  assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
   assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
@@ -283,7 +286,7 @@ await ta('null hands the pick back to the platform (stored as null, read back as
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', settings: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } } });
   const r = await patch('/provisioning/instances/18/settings', { planet_template: null, planet_accent: null });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null });
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: null, planet_accent: null } }]);
   assert.equal(enqueueCalls, 0);
 });
@@ -316,6 +319,48 @@ await ta('a policy change and a planet change in one save: the push queues for t
   assert.equal(enqueueCalls, 1);
 });
 
+await ta('the owner picks a card backdrop: the REAL router accepts it, echoes it, and still queues no push (task 1003352)', async () => {
+  // the regression this exists for: card_backdrop was added to PLANET_VOCAB (so
+  // settingKeys copied it) while the route's validator was a hand-written list
+  // that did not declare it — and strict mode 400s an undeclared field, so every
+  // real save from the manage page failed while the kit's probes stayed green
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { card_backdrop: 'nebula' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: 'nebula' });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { card_backdrop: 'nebula' } }]);
+  assert.equal(r.body.push.queued, false, 'the card is the platform\'s to draw — nothing is pushed');
+  assert.equal(r.body.push.restart, false);
+  assert.equal(enqueueCalls, 0, 'no settings-apply intent for a backdrop change');
+});
+
+await ta('null hands the card backdrop back to the platform, like the planet', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { card_backdrop: 'chrome' } } });
+  const r = await patch('/provisioning/instances/18/settings', { card_backdrop: null });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { card_backdrop: null } }]);
+});
+
+await ta('an off-vocabulary card backdrop → 400 validation_failed (a closed list, not a free string)', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { card_backdrop: 'sunset' });
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(r.body.error.code, 'validation_failed');
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('the route\'s schema IS its vocabularies — every declared key is accepted, so one can never drift out', async () => {
+  // the guard against this whole class: a key added to SETTINGS_VOCAB or
+  // PLANET_VOCAB must be accepted by the validator without anyone remembering
+  const every = { ...provisioning.SETTINGS_VOCAB, ...provisioning.PLANET_VOCAB };
+  for (const [key, values] of Object.entries(every)) {
+    reset();
+    const r = await patch('/provisioning/instances/18/settings', { [key]: values[0] });
+    assert.equal(r.status, 200, `${key}: ${r.raw}`);
+  }
+});
+
 await ta('an off-vocabulary planet → 400 validation_failed (a colour is a token NAME, never a hex)', async () => {
   reset();
   for (const body of [{ planet_accent: '#fb9569' }, { planet_accent: 'purple' }, { planet_template: 'cube-gold-wash' }]) {

package/tests/public_landing_projects.mjs

@@ -470,7 +470,7 @@ test('the stamp is derived from CONTENT, so it changes only when the file does',
   const cryptoMod = await import('node:crypto');
   const url = await import('node:url');
   const root = pathMod.dirname(url.fileURLToPath(import.meta.url));
-  const css = fsMod.readFileSync(pathMod.join(root, '..', 'public-landing', 'assets', 'cosmos.css'));
+  const css = fsMod.readFileSync(pathMod.join(root, '..', 'modules', 'public-landing', 'public', 'assets', 'cosmos.css'));
   const want = cryptoMod.createHash('sha256').update(css).digest('hex').slice(0, 8);
   const res = await request('/projects');
   assert.ok(res.body.includes(`cosmos.css?v=${want}`),
@@ -488,7 +488,7 @@ test('every landing surface is stamped, not just the one that broke', async () =
 });
 
 test('routes and API paths are never mistaken for assets', async () => {
-  // stamping resolves the URL against public-landing/ — a route names no file,
+  // stamping resolves the URL against the surface dir — a route names no file,
   // so it must come back untouched rather than acquiring a meaningless ?v=
   const res = await request('/projects');
   assert.match(res.body, /href="\/"/, "'/' is a route, not an asset");

package/tests/terms_acceptance.mjs

@@ -94,7 +94,7 @@ async function ta(name, fn) {
 
 console.log('the page (/terms carries the consent the ADR deferred to it):');
 
-const termsHtml = fs.readFileSync(path.join(repo, 'public-landing', 'terms.html'), 'utf8');
+const termsHtml = fs.readFileSync(path.join(repo, 'modules', 'public-landing', 'public', 'terms.html'), 'utf8');
 const { stripApexOnly } = require('../src/platform-server.js');
 
 t('the terms page states what crosses between projects', () => {

package/tests/ui_design_kit.mjs

@@ -33,7 +33,7 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['public-landing/projects.states.json', 'public-landing/projects-empty.states.json', 'public-landing/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
@@ -42,14 +42,14 @@ test('the shipped states files validate and sit beside the page they name', () =
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
-  for (const rel of ['public-landing/projects.states.json', 'public-landing/index.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json']) {
     assert.deepEqual(readJson(rel).modes, ['dark'], `${rel}: the apex renders dark only`);
     assert.equal(readJson(rel).modeQuery, false, `${rel}: no query walks a second mode`);
   }
 });
 
 test('the shipped probes files validate', () => {
-  for (const rel of ['public-landing/projects.probes.json', 'public-landing/index.probes.json']) {
+  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json']) {
     const v = lib.validateProbesFile(readJson(rel));
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
   }

package/tests/world_tokens.mjs

@@ -34,7 +34,8 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const LANDING = path.join(ROOT, 'public-landing');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const CSS = path.join(LANDING, 'assets', 'world.css');
 const src = fs.readFileSync(CSS, 'utf8');
 const PAGE = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
@@ -239,7 +240,7 @@ test('every plate is root-absolute and the file is there', () => {
   for (const u of urls) {
     if (!u.startsWith('/')) { bad.push(`${u} is not root-absolute`); continue; }
     const abs = path.join(LANDING, u.replace(/^\//, ''));
-    if (!fs.existsSync(abs)) bad.push(`${u} does not exist under public-landing/`);
+    if (!fs.existsSync(abs)) bad.push(`${u} does not exist under the landing surface`);
   }
   assert.deepEqual(bad, [], `\n  ${bad.join('\n  ')}\n`);
   // the pairs the world promises: a black-ground plate for dark, its alpha cutout