@bongos/core 1.19.513 → 1.19.514

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.513",
-  "core_contract": "1.19.513",
-  "source_commit": "9e6d801ba8dcecaefcb3b75033642211d8275198",
+  "core_version": "1.19.514",
+  "core_contract": "1.19.514",
+  "source_commit": "b092f2a3e4ee99d6f856ae4d1440ed723f1dcba8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T19:22:17.457Z",
+  "built_at": "2026-09-03T19:32:24.004Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 430,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1956,
+    "functional_verbatim": 1958,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2410,
-  "tree_sha256": "a794da9ad6fee320c375a0fe3bea353d508f6d1fe6cba0dd1761da71a9ef5f32",
+  "file_count": 2412,
+  "tree_sha256": "4ea8c8583161c137a8be9e3d96b1db2589a64bd504a47f7e75ebeb15232753d2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1407,7 +1407,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "9474378cf54f6d66269797edf6cd1d0d76014cecbfc657f53cd5892999599f20"
+      "sha256": "273133f1ce79a6e67b3beaa6d993c7aa3dda23daba0beeb2e9aedf9250152e6f"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -1712,12 +1712,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "af226ff669081accc330b8797ec6ac766bef9066a9fc97e834c66ad61fcec22c"
+      "sha256": "36baedec0a98a17dd013bf264cdb5502624de9529ed62e69aa88590574b1b236"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "34cd50bf2154126c9a402235972642f4430281434852977c4e7277febc959a18"
+      "sha256": "718e7ab37e024cce51fb82da0b3a535aff961d04fb0dc5e25b8ec31a61e64851"
     },
     {
       "path": "docs/architecture.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "326d065772f944339af791ceb779b2724c0feef4d4937d1aa9e13c9bc5b8a38e"
+      "sha256": "decebcba9ee02ff15412e119309d9a37203ee82159922157b37c7cd7ddc21926"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5817,7 +5817,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "1b626dfb9b8aec98c95d94d8a831e5343018bb6164ef76a160ae6ff5e026a3ad"
+      "sha256": "c58dad2f4aee4030bfc2e93904760f70185c799b388a20d715ebe70812b942ed"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -5829,6 +5829,11 @@
       "mode": "0000644",
       "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
+    {
+      "path": "modules/platform-identity/projects-feed.js",
+      "mode": "0000644",
+      "sha256": "7ba4e7f2a375a1197524106605ff5dd6e4e597b2926bf6498f784ede5099a447"
+    },
     {
       "path": "modules/platform-identity/publish-gate.js",
       "mode": "0000644",
@@ -5857,7 +5862,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "8652dbbc243f9bb10d759dd140163471d41687b405742f02b5936be818a93472"
+      "sha256": "ec297f39a3d7f23b05b24ea6837bb9bfd07a12f99734788e9332769c59acc7b7"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -5887,7 +5892,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "6151b6e7d5c4336fece03d0c29dbc94493329ba3bd4d8782702a2d581e5a4cc7"
+      "sha256": "a0ed65254f629cc29f4f1093c54d5e78a148d5bc7f072fb98819562a96f7dd37"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -7257,12 +7262,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "afcb15b2197925baf012e363e7af8de096c9e2f6bbdd6cf50015b4039a2e0441"
+      "sha256": "9c126ed4b632afd9452b01fa9e08eb97295699e99efc9c7d4040a761cac7f58d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a9827319a035ff87ca5805284b7296d80d1148390a3bb99ae03f46307a6952e8"
+      "sha256": "7cc213de070341042dae24c32b6fc458ae6912399a715d50b18dd92c52548fd8"
     },
     {
       "path": "public-docs/index.html",
@@ -8932,7 +8937,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "86d6ba39dbe1e2b39067a2fd2328284fd950a9f9060450f87e55b3be84f5fef9"
+      "sha256": "ace7f9365df0b8019d1fbc1758832db878c9b00ff59583a5ddcd839bbb69b1eb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11137,7 +11142,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "eeb54786e5cb1211f0036d7c72119082fe47c023502c017b0092c6b22f60f0c1"
+      "sha256": "22461d4febf616202af96aa37fc940a686841bbf68155094526455ae85ab9886"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
@@ -12019,6 +12024,11 @@
       "mode": "0000644",
       "sha256": "2a381bab380342e4fc556211d4821c85fdde1f676a6c5c6aa2421a89a573cd27"
     },
+    {
+      "path": "tests/visible_projects_feed.mjs",
+      "mode": "0000644",
+      "sha256": "4bf47b6aee92c54099c583726d05421a433ac5b5e82792a848d11c80d7ee7bd1"
+    },
     {
       "path": "tests/wandering_prefs.mjs",
       "mode": "0000644",

package/docs/adr/0182-project-visibility-two-axes.md

@@ -161,6 +161,8 @@ Until then: `stealth` unqualified in product code and copy means the project sta
 - Anything reading `featured = true AND status = 'active'` as "is this public" is now wrong and must be found. `modules/platform-identity/routes/projects.js` is the known site.
 - **R16 makes D3's bound real, and D4's gate reach a second module.** Shipping R16 (task 1002335) surfaced one thing this ADR left implicit. D3 says `featured` may never put an unpublishable project on the map, so `PATCH /projects/:id/featured` now refuses a dark-matter row (409 `not_publishable`, `missing` in the details); un-featuring stays unconditional, since an already-featured husk must remain removable. And D4's "name what is missing" is owed to the owner *before* their project is ever catalogued on the hub — which is the `provisioning` plane, a different module that ADR 0083 forbids from importing `platform-identity`. Rather than let a two-field rule exist twice, the gate is published as a kernel seam port, `project.publishGate` (`modules/platform-identity/publish-gate.js`). `provisioning` resolves it **optionally** and declares no `consumes`: `platform-identity` is hub-only, the public map is a hub concept, and a platform without one must answer "no verdict" rather than invent a local rule — which is the same drift-avoidance argument that produced `publishableSql` in the first place.
 
+- **R06 landed the predicate swap and the redaction, and settled three things this ADR left to the implementer** (task 1002325, `modules/platform-identity/projects-feed.js`). (a) **A black hole carries no stable per-project key.** D2a lists `name`/`tagline`/`art_url`/`origin`, and an id looks harmless beside them — but any identifier that survives a state change lets an observer who kept yesterday's public feed diff it against today's and *name* the project that went stealth. So stealth rows are byte-identical to one another and the feed grew no public id at all; the orbs page keys by position. (b) **The redaction is an ALLOW-list, not a deny-list** — every key nulled except `state` and `orb` — so a column added to the feed later is anonymous without anyone remembering to come back to it, and it NULLS rather than deletes, keeping the feed's "never drop a key" contract. (c) **An unrecognised `visibility` draws as a black hole, not a planet**: this mapping is a privacy boundary, so a fourth enum value added without mapping it must fail closed. Two smaller notes: the route PATH keeps the word `featured` (it is rank:public and CORS-open, already fetched by a static site and other origins — renaming it would break them for nothing, and `ORDER BY featured DESC` is where the flag's D3 ranking job now lives); and `getRollupForBuilder`'s `is_public` was deliberately left on the OLD `featured AND active` predicate rather than widened with the feed, because a stealth project is on the map *anonymously* and naming it in a builder's profile would be the exact leak D2a forbids — how much of a cross-project record may be NAMED is ADR 0171 D2's question, and under-naming is the safe direction meanwhile.
+
 ## Alternatives rejected
 
 - **A stored four-valued enum including `unlisted`.** Rejected: it makes "unlisted" a choice competing with `private`, and it lets a project be simultaneously "publishable" and "unlisted" — two sources of truth for one question, which is the bug the derived gate prevents by construction.

package/docs/api/openapi.json

@@ -10786,7 +10786,7 @@
           "projects"
         ],
         "summary": "GET /projects/featured",
-        "description": "a curated public showcase; no auth by design.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "the public map of projects; no auth by design.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/platform-identity/routes/projects.js",
         "responses": {

package/docs/api-reference.md

@@ -439,7 +439,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/projects` | `metic+archon` | — | the full curation list (includes unfeatured + owner attribution). |
 | POST | `/api/bongos/projects` | `metic+archon` | `origin`, `name`, `tagline`, `description`, `art_url`, `type`, `template` | create / update a catalog entry (manual seed for hand-wired instances; federated projects auto-catalogue at registration). |
 | PATCH | `/api/bongos/projects/:id/featured` | `metic+archon` | `featured` | the feature / unfeature control (the ADR 0141 §5 curation gate), BOUNDED BY THE PUBLISH GATE (ADR 0182 D3, task 1002335). |
-| GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
+| GET | `/api/bongos/projects/featured` | `public` | — | the public map of projects; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
 
 ## `provisioning` (21)

package/docs/module-api-changelog.md

@@ -1463,5 +1463,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.511 with no explicit bump. run 33793208383. (task 1002620)
   1.19.513 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.512 with no explicit bump. run 33795977371. (task 1002620)
+  1.19.514 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.513 with no explicit bump. run 33796959752. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/platform-identity.js

@@ -313,6 +313,13 @@ const {
   publishGatePort,
 } = require('./publish-gate');
 
+// The public projects feed — who is on the map, and what each row may say (ADR 0182
+// D1/D2a/D3; R06, task 1002325). Its own file for the publish-gate.js reason: this
+// file is at the size ratchet. Re-exported below, so the surface is unchanged.
+const {
+  ORB_BY_STATE, orbForState, isStealthProject, feedShapeFor, listPublicProjects,
+} = require('./projects-feed');
+
 // Upsert a catalog row (keyed by origin). Called when a client registers (so every
 // federated project is catalogued, unfeatured) and by the Archon create/curate route.
 // Never touches `featured` on update — that is Archon-only via setProjectFeatured.
@@ -360,21 +367,9 @@ async function getProject(id, { pool = defaultPool } = {}) {
   return { ...rows[0], ...projectPublishability(rows[0]) };
 }
 
-// The PUBLIC Explore listing — featured + active projects only, public projection
-// (no owner_github_id, no status). Newest first. created_at is the LISTED date —
-// when the hub first catalogued the row, not when the project began — and the
-// card labels it "Listed" for exactly that reason (task 1002778). updated_at may
-// sort but is never projected: feature toggles and client re-registration bump
-// it, so as a public "last updated" it would lie.
-async function listFeaturedProjects({ pool = defaultPool } = {}) {
-  const { rows } = await pool.query(
-    `SELECT origin, name, tagline, art_url, type, template, created_at
-       FROM platform_identity_projects
-      WHERE featured = true AND status = 'active'
-      ORDER BY updated_at DESC`,
-  );
-  return rows;
-}
+// The PUBLIC projects feed lives in projects-feed.js (R06, task 1002325) — the
+// predicate, the orb mapping and the stealth redaction are one concern, and each is
+// only safe given the other two.
 
 // The curation list — every active project, its featured flag, its stored door, and the
 // DERIVED publish verdict. `publishable` is computed in SQL from publishableSql() so this
@@ -779,10 +774,15 @@ function isNumericGithubId(githubId) {
 // table, the disciplines union computed separately (never a pre-GROUP-BY unnest
 // fan-out — bug task 1002911). Per-project rows join the module-internal
 // client_id → sso_clients.origin → projects.origin two-hop; a project is NAMED
-// only when its catalog row is publicly listed today (featured + active — the
-// exact set listFeaturedProjects publishes; goal 1000046's visibility states
-// will widen this predicate when they land). Everything else is counted in
-// more_projects, never named ("the aggregate is not the leak, the name is").
+// only when its catalog row is publicly listed today (featured + active).
+// Everything else is counted in more_projects, never named ("the aggregate is
+// not the leak, the name is").
+//
+// Deliberately NARROWER than the public feed since R06 (task 1002325), and left so
+// rather than widened here: a STEALTH project is on the map ANONYMOUSLY (ADR 0182
+// D2a), so naming it in a builder's profile would be the leak the feed exists to
+// prevent, and how much of a record may be NAMED is ADR 0171 D2's question, not
+// R06's. Narrower under-names, which is safe. The widening is its own task.
 // client_id never appears in the returned shape.
 async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
@@ -1436,9 +1436,13 @@ module.exports = {
   PROJECT_MATERIALS,
   PROJECT_SHAPES,
   getProject,
-  listFeaturedProjects,
+  listPublicProjects,
   listAllProjects,
   setProjectFeatured,
+  ORB_BY_STATE,
+  orbForState,
+  isStealthProject,
+  feedShapeFor,
   // memberships
   MEMBERSHIP_KINDS,
   membershipKindFromLegacy,

package/modules/platform-identity/projects-feed.js

@@ -0,0 +1,142 @@
+// modules/platform-identity/projects-feed.js — THE public projects feed: WHO is on
+// the map, and WHAT each row is allowed to say (R06, task 1002325; ADR 0182 D1/D2a/D3).
+// The in-repo lever the orbs page reads. The publish-gate.js precedent — one question,
+// one file, so no two surfaces can answer it differently.
+//
+// THREE ANSWERS, and they belong together because each is only safe given the others:
+//
+//   • WHO — `listPublicProjects`. A project is on the map iff `status = 'active' AND
+//     publishable`, the derived identity gate, taken from publishableSql() so this feed
+//     and the curation list read ONE definition. It used to be `featured = true`, which
+//     made Archon curation load-bearing for visibility at all: an owner could set their
+//     project public and see nothing happen (ADR 0182 D3). `featured` keeps the only job
+//     D3 leaves it — RANKING among rows already on the map. Dark matter is excluded HERE,
+//     in SQL, because a client-side filter ships the husk to anyone who opens a network tab.
+//
+//   • WHAT IT DRAWS AS — `orbForState`, the ADR 0182 D1 mapping:
+//        public → planet   (identified, anyone may join)
+//        private → star    (identified, no self-join, applications accepted)
+//        stealth → black hole (ANONYMOUS, no self-join, applications refused)
+//     Three surfaces render it — this feed, Explore (R07, task 1002326) and the static
+//     orbs site (R09, task 1002328) — and the last is a different repo. A mapping copied
+//     into each is a mapping that drifts.
+//
+//   • WHAT IT MAY SAY — `feedShapeFor`, the D2a privacy boundary in code: a stealth
+//     project exposes EXISTENCE, never IDENTITY. Redaction is server-side because the
+//     naive version sends the row and lets the orbs page hide it, which leaks the whole
+//     project to anyone who opens the network tab — and that page is a static site
+//     outside this repo, so we could not enforce it there even in principle.
+//
+// TWO DELIBERATE FAIL-CLOSED CHOICES, because this is a privacy boundary, not a
+// rendering detail:
+//   1. AN UNKNOWN STATE DRAWS AS A BLACK HOLE. A fourth enum value added later and not
+//      mapped here would otherwise ship its project's name as a planet.
+//   2. THE STEALTH SHAPE IS AN ALLOW-LIST, NOT A DENY-LIST — everything is nulled except
+//      the two keys a black hole may carry, so a column added to the feed next year is
+//      anonymous without anyone remembering to come back here. A deny-list of "the
+//      identifying fields" is correct exactly until the feed grows.
+//
+// WHY ITS OWN FILE. The account-visibility.js / publish-gate.js reason: platform-identity.js
+// sits at the file-size ratchet. The caller-facing symbols (listPublicProjects, feedShapeFor,
+// orbForState, isStealthProject, ORB_BY_STATE) are re-exported there so the module's public
+// surface is unchanged; orbStateOf, FALLBACK_PROJECT_STATE and STEALTH_ANONYMOUS_KEEPS are
+// this file's own internals and are reached only from here and its test.
+// Proof: ../../tests/visible_projects_feed.mjs
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { publishableSql } = require('./publish-gate');
+
+// ADR 0182 D1's mapping, and the only copy of it in the repo. The three words are locked
+// by goal 1000046's `proj-visibility-states` criterion, not chosen here.
+const ORB_BY_STATE = Object.freeze({
+  public: 'planet',
+  private: 'star',
+  stealth: 'black-hole',
+});
+
+// What an unrecognised (or absent) stored value is treated as — the ANONYMOUS state,
+// deliberately. A project whose door we cannot read is one whose name we must not publish.
+const FALLBACK_PROJECT_STATE = 'stealth';
+
+// The ONLY keys a black hole may carry; everything else on the row is nulled. No stable
+// per-project key appears here on purpose: an id, a slug or a hash of the origin would
+// each let an observer who kept yesterday's public feed name the project that went stealth
+// today. Black holes are interchangeable, which is the whole point of the metaphor.
+const STEALTH_ANONYMOUS_KEEPS = Object.freeze(['state', 'orb']);
+
+// The stored join door, normalised to a state this file knows. Never echoes an
+// unvalidated value onto the wire.
+function orbStateOf(visibility) {
+  const v = String(visibility ?? '').trim();
+  return Object.prototype.hasOwnProperty.call(ORB_BY_STATE, v) ? v : FALLBACK_PROJECT_STATE;
+}
+
+// The render type for a state — the one mapping R07 and R09 both read. PURE.
+function orbForState(state) {
+  return ORB_BY_STATE[orbStateOf(state)];
+}
+
+// Is this row anonymous on the map? Exported so the feed route can keep a stealth
+// project's origin out of the per-project enrichment fetches entirely — asking its own
+// public API for its builders' avatars would both put identity on the wire and tell that
+// project it was being enumerated.
+function isStealthProject(project) {
+  return orbStateOf(project?.visibility) === 'stealth';
+}
+
+// ONE catalog row → the public wire row. Spends `visibility` deriving `state` + `orb` (it
+// never doubles it on the wire), then either passes the identified row through or rebuilds
+// it from the allow-list above. The redaction NULLS rather than DELETES: the feed's
+// standing contract is that an unanswerable value is null and never absent, because
+// JSON.stringify drops the absent one and a client would read `undefined` on some rows and
+// null on others. A redacted row is a full-width row that says nothing. PURE.
+function feedShapeFor(project) {
+  const { visibility, ...rest } = project || {};
+  const state = orbStateOf(visibility);
+  const shaped = { ...rest, state, orb: ORB_BY_STATE[state] };
+  if (state !== 'stealth') return shaped;
+  const anonymous = {};
+  for (const key of Object.keys(shaped)) {
+    anonymous[key] = STEALTH_ANONYMOUS_KEEPS.includes(key) ? shaped[key] : null;
+  }
+  return anonymous;
+}
+
+// The feed's hard ceiling. Until R06 the listing was bounded by an Archon choosing to
+// feature a project; the swap to `publishable` replaced that human bound with self-service,
+// on a route that is public, CORS-open, unauthenticated AND drives one outbound stats fetch
+// per row. A cap is the cheap half of that trade — the honest half is pagination, which is
+// its own task; this constant only stops the tail from being unbounded meanwhile. Set far
+// above the live catalog, so it truncates nothing today.
+const PUBLIC_FEED_MAX_PROJECTS = 500;
+
+// Every project ON THE MAP, in the public projection (no owner_github_id, no status).
+// `visibility` is projected because feedShapeFor() derives each row's state + orb from it;
+// it is spent there and never reaches the wire. created_at is the LISTED date — when the
+// hub first catalogued the row, not when the project began (task 1002778). updated_at may
+// sort but never projects: feature toggles and client re-registration bump it, so as a
+// public "last updated" it would lie. `description` is the publish BAR, spent in the
+// predicate, never a card field.
+async function listPublicProjects({ pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT origin, name, tagline, art_url, type, template, created_at, visibility
+       FROM platform_identity_projects
+      WHERE status = 'active' AND ${publishableSql()}
+      ORDER BY featured DESC, updated_at DESC
+      LIMIT ${PUBLIC_FEED_MAX_PROJECTS}`,
+  );
+  return rows;
+}
+
+module.exports = {
+  ORB_BY_STATE,
+  FALLBACK_PROJECT_STATE,
+  STEALTH_ANONYMOUS_KEEPS,
+  orbStateOf,
+  orbForState,
+  isStealthProject,
+  feedShapeFor,
+  PUBLIC_FEED_MAX_PROJECTS,
+  listPublicProjects,
+};

package/modules/platform-identity/routes/projects.js

@@ -1,7 +1,14 @@
 // modules/platform-identity/routes/projects.js — the hub projects catalog + the
 // curated public Explore showcase (ADR 0141 §5, task #1002110).
 //
-//   GET   /projects/featured   — PUBLIC Explore listing (featured + active only)
+//   GET   /projects/featured   — PUBLIC projects feed: every project on the map
+//                                (active + publishable), each carrying its `state`
+//                                and `orb` render type, stealth rows anonymised
+//                                server-side, dark matter excluded (ADR 0182 D2a/D3).
+//                                The PATH keeps the old word: it is a rank:public,
+//                                CORS-open URL that a static site and other origins
+//                                already fetch, and renaming it would break them for
+//                                nothing. `featured` now only RANKS the feed.
 //   GET   /projects            — Archon: full curation list (+ featured flags, the stored
 //                                join door, and the DERIVED publish verdict — ADR 0182)
 //   POST  /projects            — Archon: create / update a catalog entry
@@ -141,13 +148,20 @@ module.exports = function projectsRoutes() {
     }
   });
 
-  // The PUBLIC Explore showcase — featured + active projects only, public projection.
-  // CORS-enabled cross-origin read (a status page / the apex fetches it pre-auth).
+  // The PUBLIC projects feed — every project ON THE MAP (active + publishable),
+  // public projection. CORS-enabled cross-origin read (a status page / the apex /
+  // the static orbs site fetches it pre-auth).
   router.use('/projects/featured', corsPublicGet('/projects/featured'));
-  // rank: public — a curated public showcase; no auth by design.
+  // rank: public — the public map of projects; no auth by design.
   router.get('/projects/featured', async (_req, res) => {
     try {
-      const projects = await pi.listFeaturedProjects({ pool });
+      const projects = await pi.listPublicProjects({ pool });
+      // A stealth project is on the map ANONYMOUSLY (ADR 0182 D2a), so its origin
+      // is kept out of both enrichments below: asking its own public API for its
+      // builders and their avatars would put identity on the wire, and tell that
+      // project it was being enumerated. feedShapeFor() redacts the row either
+      // way — this is the half that never makes the request at all.
+      const identified = projects.filter((p) => !pi.isStealthProject(p));
       // Builders + tags come from each project's OWN public API, because the
       // apex catalog does not know them and the membership tables would report
       // zero for every hand-wired project (task 1002771; see project-stats.js).
@@ -156,7 +170,7 @@ module.exports = function projectsRoutes() {
       // listing — a broken stats fetch cannot take the catalog down with it.
       let stats = {};
       try {
-        stats = await projectStats.getProjectStats(projects.map((p) => p.origin));
+        stats = await projectStats.getProjectStats(identified.map((p) => p.origin));
       } catch (err) {
         console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
       }
@@ -168,7 +182,7 @@ module.exports = function projectsRoutes() {
       // a failed read leaves every project on the platform's own pick.
       let planets = {};
       try {
-        planets = await api.resolveOptional('provisioning.projectPlanets', async () => ({}))(projects.map((p) => hostOfOrigin(p.origin)));
+        planets = await api.resolveOptional('provisioning.projectPlanets', async () => ({}))(identified.map((p) => hostOfOrigin(p.origin)));
       } catch (err) {
         log.warn('project planets enrichment failed (non-fatal):', err.message);
       }
@@ -183,8 +197,13 @@ module.exports = function projectsRoutes() {
       // catalog's; a project that did not answer carries the ONE shared null
       // shape, so the wire never drops a key. art_url is catalog text an Archon
       // typed — scheme-checked here, and again on the client, before it is a src.
+      // feedShapeFor() is the LAST thing each row passes through, deliberately: it
+      // derives `state` + `orb` from the stored door and, for a stealth project,
+      // rebuilds the row from an allow-list of the two keys a black hole may carry
+      // (ADR 0182 D2a). Redacting any earlier would be silently undone by the
+      // spreads above.
       res.json({
-        projects: projects.map((p) => ({
+        projects: projects.map((p) => pi.feedShapeFor({
           ...p,
           art_url: projectStats.httpUrl(p.art_url, 2048),
           ...(stats[p.origin] || projectStats.NULL_STATS),

package/modules/platform-identity/tests/platform-identity.mjs

@@ -261,17 +261,21 @@ await ta('upsertProject carries the planet template, COALESCE-preserved; an unkn
   for (const t of P.PROJECT_TEMPLATES.slice(0, 9)) assert.ok(mig12.includes(`'${t}'`), `migration 012 named ${t}`);
   // and the public projection carries it, so the sky can read a curated choice
   const pool3 = mockPool([{ rows: [] }]);
-  await P.listFeaturedProjects({ pool: pool3 });
+  await P.listPublicProjects({ pool: pool3 });
   const sel = (pool3.calls[0].text.match(/SELECT([\s\S]*?)FROM/i) || [, ''])[1];
-  assert.match(sel, /\btemplate\b/, 'the featured projection carries the template');
+  assert.match(sel, /\btemplate\b/, 'the public projection carries the template');
 });
 
-await ta('listFeaturedProjects returns a PUBLIC projection (featured+active only, no owner/status)', async () => {
+await ta('listPublicProjects returns a PUBLIC projection (on-the-map only, no owner/status)', async () => {
   const pool = mockPool([{ rows: [{ origin: 'https://p', name: 'Proj', tagline: 't', art_url: null, created_at: '2026-08-01T00:00:00Z' }] }]);
-  const out = await P.listFeaturedProjects({ pool });
+  const out = await P.listPublicProjects({ pool });
   assert.equal(out.length, 1);
   const c = pool.calls[0];
-  assert.match(c.text, /WHERE featured = true AND status = 'active'/);
+  // R06 (task 1002325) replaced the `featured = true` gate with the derived publish
+  // gate: a project is on the map iff it is active AND publishable (ADR 0182 D3).
+  // The full predicate + the stealth redaction are pinned by tests/visible_projects_feed.mjs.
+  assert.match(c.text, /WHERE status = 'active' AND /);
+  assert.ok(c.text.includes(P.publishableSql()), 'the map predicate is the shared gate');
   // Pin the SELECT LIST itself, not the whole query — an ORDER BY mention must
   // not satisfy a projection guard, and SELECT * must never sneak owner/status
   // onto a CORS-open rank:public route.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.513",
+  "version": "1.19.514",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.513",
+      "version": "1.19.514",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.513",
+  "version": "1.19.514",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.513'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.514'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -1858,7 +1858,11 @@ test('the kit proves the picker: a state renders it on the owner\'s feed-carried
 
 test('the feed carries the owner\'s choice through a seam: platform-identity resolves provisioning.projectPlanets optionally and spreads every platform-drawn key on every project (tasks 1003347, 1003352)', () => {
   const route = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'routes', 'projects.js'), 'utf8');
-  assert.match(route, /api\.resolveOptional\('provisioning\.projectPlanets', async \(\) => \(\{\}\)\)\(projects\.map\(\(p\) => hostOfOrigin\(p\.origin\)\)\)/, 'optional — an instance without provisioning has no choices to carry');
+  // R06 (task 1002325) narrowed the hosts asked about from `projects` to `identified`:
+  // a stealth project is on the map ANONYMOUSLY (ADR 0182 D2a), so its host is kept out
+  // of this enrichment entirely rather than resolved and then redacted. The seam itself
+  // is unchanged — still optional, still host-matched, still spread on every project.
+  assert.match(route, /api\.resolveOptional\('provisioning\.projectPlanets', async \(\) => \(\{\}\)\)\(identified\.map\(\(p\) => hostOfOrigin\(p\.origin\)\)\)/, 'optional — an instance without provisioning has no choices to carry');
   assert.match(route, /return \{ planet_template: c\.planet_template \|\| null, planet_accent: c\.planet_accent \|\| null,\r?\n\s*card_backdrop: c\.card_backdrop \|\| null \};/, 'the wire always carries every key — null = nothing chosen');
   assert.match(route, /\.\.\.planetOf\(p\),/, 'spread beside the stats');
   assert.doesNotMatch(route, /require\(['"][^'"]*provisioning/, 'never an import across modules');

package/tests/visible_projects_feed.mjs

@@ -0,0 +1,320 @@
+// tests/visible_projects_feed.mjs — the VISIBLE-PROJECTS FEED (task 1002325, BV1.R06;
+// ADR 0182 D2a / D3).
+//
+// The feed is the in-repo lever the orbs page reads, and this file pins the three
+// things R06 changed about it:
+//
+//   1. WHO IS ON THE MAP. The predicate stops being `featured = true` and becomes
+//      `status = 'active' AND publishable` — the publish gate R16 (task 1002335)
+//      already published as SQL. Dark matter (no name, or no description) is excluded
+//      SERVER-SIDE, so it never reaches a client that could choose to draw it.
+//      `featured` keeps a job — it RANKS among rows already on the map (D3) — and
+//      loses the one it should never have had, gating presence at all.
+//   2. WHAT EACH ORB IS. Every row carries `state` (public|private|stealth) and `orb`
+//      (planet|star|black-hole), derived from ONE mapping so the feed, the Explore
+//      view (R07) and the static orbs site (R09) cannot each invent their own.
+//   3. WHAT A BLACK HOLE MAY SAY. Stealth exposes EXISTENCE, never IDENTITY (D2a), and
+//      the redaction is at the boundary because the orbs page is a static site outside
+//      this repo and could not be trusted to redact even in principle.
+//
+// The stealth assertions are the security spec: they assert ABSENT FIELDS, not absent
+// pixels, which is what R10 (task 1002329) then demonstrates live.
+//
+// DB-free: a recording fake pool for the SQL, and the REAL router driven with a fake
+// req/res for the route composition.
+//
+// Run:  node --test --test-reporter=tap tests/visible_projects_feed.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const pi = require('../modules/platform-identity/platform-identity.js');
+const feed = require('../modules/platform-identity/projects-feed.js');
+const projectStats = require('../modules/platform-identity/project-stats.js');
+const projectsRoutes = require('../modules/platform-identity/routes/projects.js');
+
+// A recording fake pool: returns queued responses in order, records every call.
+function mockPool(responses = []) {
+  const calls = [];
+  let i = 0;
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text: String(text), params: params || [] });
+      return responses[i++] || { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+// ── the mapping: one state, one orb (ADR 0182 D1) ────────────────────────────
+
+test('orbForState maps each stored state to the orb ADR 0182 D1 names for it', () => {
+  // Arrange / Act / Assert — the mapping IS the assertion, and the criterion
+  // (`proj-visibility-states`) locks these three words.
+  assert.equal(feed.orbForState('public'), 'planet');
+  assert.equal(feed.orbForState('private'), 'star');
+  assert.equal(feed.orbForState('stealth'), 'black-hole');
+});
+
+test('the orb mapping is reached through the module surface, so no caller keeps a copy', () => {
+  // R07 (Explore) and R09 (the static orbs site) both render these; a second copy of
+  // the mapping is how two surfaces end up drawing one project two ways.
+  assert.equal(pi.orbForState, feed.orbForState);
+  assert.deepEqual({ ...pi.ORB_BY_STATE }, { public: 'planet', private: 'star', stealth: 'black-hole' });
+  assert.ok(Object.isFrozen(pi.ORB_BY_STATE), 'a caller must not be able to re-map an orb at runtime');
+});
+
+test('an unrecognised state falls back to the ANONYMOUS orb, never the identified one', () => {
+  // Fail-closed, because this mapping is a privacy boundary. A fourth enum value added
+  // later and not mapped here would otherwise ship its project's name as a planet; the
+  // safe degradation is to draw it as a black hole and say nothing about it.
+  assert.equal(feed.orbForState('members-only'), 'black-hole');
+  assert.equal(feed.orbForState(undefined), 'black-hole');
+  assert.equal(feed.orbForState(null), 'black-hole');
+  assert.equal(feed.orbForState(''), 'black-hole');
+});
+
+// ── the wire shape: identified for two states, anonymous for the third ───────
+
+const PUBLIC_ROW = Object.freeze({
+  origin: 'https://mercury.example', name: 'Mercury', tagline: 'A weather sim.',
+  art_url: 'https://mercury.example/art.png', type: 'game', template: 'blob-tint',
+  created_at: '2026-08-01T00:00:00Z', visibility: 'public',
+});
+
+test('feedShapeFor keeps a public project fully identified and marks it a planet', () => {
+  // Arrange
+  const row = { ...PUBLIC_ROW };
+
+  // Act
+  const wire = feed.feedShapeFor(row);
+
+  // Assert
+  assert.equal(wire.state, 'public');
+  assert.equal(wire.orb, 'planet');
+  assert.equal(wire.name, 'Mercury');
+  assert.equal(wire.origin, 'https://mercury.example');
+  assert.equal(wire.tagline, 'A weather sim.');
+  assert.equal(wire.art_url, 'https://mercury.example/art.png');
+  assert.equal(wire.created_at, '2026-08-01T00:00:00Z');
+  assert.ok(!('visibility' in wire), 'the stored column is spent deriving `state`; it never doubles it on the wire');
+});
+
+test('a private project stays IDENTIFIED — a star is visible, only its door is closed', () => {
+  // ADR 0182 D2, inherited unchanged from ADR 0112's private goals: private means
+  // visible-but-closed. Redacting a star would be the bug, not the safe choice.
+  const wire = feed.feedShapeFor({ ...PUBLIC_ROW, visibility: 'private' });
+  assert.equal(wire.state, 'private');
+  assert.equal(wire.orb, 'star');
+  assert.equal(wire.name, 'Mercury');
+  assert.equal(wire.origin, 'https://mercury.example');
+});
+
+test('a stealth project ships NO identifying field — every one of them is null', () => {
+  // Arrange — a fully populated row, so nothing is absent by accident.
+  const row = { ...PUBLIC_ROW, visibility: 'stealth' };
+
+  // Act
+  const wire = feed.feedShapeFor(row);
+
+  // Assert — ADR 0182 D2a names these four explicitly as fields that must not leave
+  // the server. Asserted BY NAME so the ADR's own list is executable.
+  for (const field of ['origin', 'name', 'tagline', 'art_url']) {
+    assert.equal(wire[field], null, `D2a: a stealth project's ${field} must not leave the server`);
+  }
+  // …and the general rule the four are only examples of: existence, never identity.
+  for (const [key, value] of Object.entries(wire)) {
+    if (key === 'state' || key === 'orb') continue;
+    assert.equal(value, null, `a black hole says nothing but that it is there — ${key} leaked`);
+  }
+  assert.equal(wire.state, 'stealth');
+  assert.equal(wire.orb, 'black-hole');
+});
+
+test('the wire never DROPS a key for a stealth row — it nulls it', () => {
+  // The feed's standing contract (the NULL_STATS shape): a value that could not be
+  // answered is null, never absent, because JSON.stringify drops the absent one and a
+  // client reading `p.builders` would then see `undefined` on some rows and null on
+  // others. Redaction must not become the one exception to that.
+  const wire = feed.feedShapeFor({ ...PUBLIC_ROW, visibility: 'stealth' });
+  for (const key of Object.keys(PUBLIC_ROW)) {
+    if (key === 'visibility') continue;
+    assert.ok(key in wire, `${key} must still be a KEY on the wire, carrying null`);
+  }
+});
+
+test('a field the redactor has never seen is anonymous by DEFAULT, not by being listed', () => {
+  // The property that keeps this correct as the feed grows: the stealth shape is an
+  // ALLOW-list of what may be said (state, orb), not a deny-list of what must be
+  // hidden. A column added to the feed next year is redacted without anyone
+  // remembering to add it here — which is the only version of this that stays true.
+  const wire = feed.feedShapeFor({
+    ...PUBLIC_ROW, visibility: 'stealth', owner_avatar: 'https://x/a.png', faces: ['https://x/b.png'],
+    some_field_invented_after_this_test: 'leak',
+  });
+  assert.equal(wire.owner_avatar, null);
+  assert.deepEqual(wire.faces, null);
+  assert.equal(wire.some_field_invented_after_this_test, null);
+  assert.deepEqual(Object.keys(wire).filter((k) => wire[k] !== null).sort(), ['orb', 'state']);
+});
+
+test('a black hole carries no stable key that yesterday\'s feed could be diffed against', () => {
+  // Deliberate: any per-project identifier that survives a state change (a row id, a
+  // slug, a hash of the origin) lets an observer who kept yesterday's public feed name
+  // the project that went stealth today. Black holes are interchangeable on purpose.
+  const a = feed.feedShapeFor({ ...PUBLIC_ROW, id: '7', visibility: 'stealth' });
+  const b = feed.feedShapeFor({ ...PUBLIC_ROW, id: '9', origin: 'https://venus.example', visibility: 'stealth' });
+  assert.deepEqual(a, b, 'two stealth projects must be indistinguishable on the wire');
+  assert.equal(a.id, null);
+});
+
+// ── who is on the map: the predicate (ADR 0182 D3) ───────────────────────────
+
+test('listPublicProjects excludes dark matter using the SHARED publish gate, not a copy', async () => {
+  // Arrange
+  const pool = mockPool([{ rows: [] }]);
+
+  // Act
+  await pi.listPublicProjects({ pool });
+
+  // Assert
+  const sql = pool.calls[0].text;
+  assert.ok(sql.includes(pi.publishableSql()),
+    'the gate rides in the WHERE, from the one SQL definition R16 published for this feed');
+  assert.match(sql, /status = 'active'/, 'a deprovisioned project is off the map too (D3)');
+});
+
+test('featuring no longer GATES presence — it only ranks among projects already on the map', async () => {
+  // ADR 0182 D3, and the behaviour change the whole goal turns on: an owner who sets
+  // their project public used to see nothing happen until an Archon featured them.
+  const pool = mockPool([{ rows: [] }]);
+  await pi.listPublicProjects({ pool });
+  const sql = pool.calls[0].text;
+  const where = (sql.match(/WHERE([\s\S]*?)ORDER BY/i) || [, ''])[1];
+  assert.doesNotMatch(where, /featured/, 'featured must not appear in the predicate at all');
+  assert.match(sql, /ORDER BY featured DESC/, 'it keeps the job D3 leaves it: ranking');
+});
+
+test('the public feed is CAPPED — the swap to self-service removed the human bound on its size', async () => {
+  // Until R06 the listing was bounded by an Archon choosing to feature a project. Making
+  // it `publishable` replaced that bound with self-service, on a route that is public,
+  // CORS-open, unauthenticated AND fans out one outbound stats fetch per row. The cap is
+  // the cheap half of that trade; pagination is its own task.
+  const pool = mockPool([{ rows: [] }]);
+  await pi.listPublicProjects({ pool });
+  assert.match(pool.calls[0].text, new RegExp(`LIMIT ${feed.PUBLIC_FEED_MAX_PROJECTS}\\b`));
+  assert.equal(Number.isInteger(feed.PUBLIC_FEED_MAX_PROJECTS), true,
+    'the cap is interpolated into SQL, so it must be a literal integer and never a caller value');
+  assert.ok(feed.PUBLIC_FEED_MAX_PROJECTS > 0);
+});
+
+test('listPublicProjects projects `visibility`, the column the orb is derived from', async () => {
+  // Without it every row would fall to the anonymous default and the whole map would
+  // go dark — silently, and in the safe direction, which is exactly why it needs a test.
+  const pool = mockPool([{ rows: [] }]);
+  await pi.listPublicProjects({ pool });
+  const sel = (pool.calls[0].text.match(/SELECT([\s\S]*?)FROM/i) || [, ''])[1];
+  assert.match(sel, /\bvisibility\b/);
+});
+
+test('listPublicProjects stays a PUBLIC projection — no owner, no status, no bookkeeping', async () => {
+  // Inherited from the feed this replaced, and re-asserted rather than assumed: the
+  // route is rank:public and CORS-open, so SELECT * must never sneak in behind it.
+  const pool = mockPool([{ rows: [] }]);
+  await pi.listPublicProjects({ pool });
+  const sql = pool.calls[0].text;
+  const sel = (sql.match(/SELECT([\s\S]*?)FROM/i) || [, ''])[1];
+  assert.ok(sel.trim(), 'the projection is an explicit SELECT list');
+  assert.doesNotMatch(sel, /\*/, 'no star projection on a public route');
+  assert.doesNotMatch(sel, /owner_github_id/, 'public projection must not leak owner id');
+  assert.doesNotMatch(sel, /updated_at/, 'curation noise — it may sort, it may never project');
+  assert.doesNotMatch(sel, /\bdescription\b/,
+    'description is the publish BAR, not a card field — it is spent in the predicate');
+  assert.match(sel, /created_at/, 'the LISTED date stays public');
+  assert.match(sel, /\btype\b/, 'the declared type stays public (task 1002772)');
+});
+
+// ── the route: the composition, executed ─────────────────────────────────────
+
+// The real router, driven with a fake req/res. `pi.listPublicProjects` and the stats
+// enrichment are stubbed so the test needs neither Postgres nor the network — what is
+// under test is the ROUTE's composition, not either dependency.
+async function callFeaturedFeed(rows) {
+  const router = projectsRoutes();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/projects/featured'
+    && l.route.methods.get);
+  assert.ok(layer, 'GET /projects/featured must still be a route on this router');
+
+  const askedFor = [];
+  const savedList = pi.listPublicProjects;
+  const savedStats = projectStats.getProjectStats;
+  pi.listPublicProjects = async () => rows;
+  projectStats.getProjectStats = async (origins) => { askedFor.push(...origins); return {}; };
+  try {
+    let body = null;
+    const res = {
+      json: (b) => { body = b; },
+      fail: (code, detail) => { throw new Error(`route failed: ${code} ${JSON.stringify(detail)}`); },
+    };
+    await layer.route.stack[0].handle({}, res, () => {});
+    return { body, askedFor };
+  } finally {
+    pi.listPublicProjects = savedList;
+    projectStats.getProjectStats = savedStats;
+  }
+}
+
+test('the feed renders all three visible states, each with its orb', async () => {
+  // Arrange
+  const rows = [
+    { ...PUBLIC_ROW, visibility: 'public' },
+    { ...PUBLIC_ROW, origin: 'https://venus.example', name: 'Venus', visibility: 'private' },
+    { ...PUBLIC_ROW, origin: 'https://pluto.example', name: 'Pluto', visibility: 'stealth' },
+  ];
+
+  // Act
+  const { body } = await callFeaturedFeed(rows);
+
+  // Assert
+  assert.equal(body.projects.length, 3);
+  assert.deepEqual(body.projects.map((p) => p.state), ['public', 'private', 'stealth']);
+  assert.deepEqual(body.projects.map((p) => p.orb), ['planet', 'star', 'black-hole']);
+  assert.equal(body.projects[0].name, 'Mercury');
+  assert.equal(body.projects[1].name, 'Venus');
+});
+
+test('the stealth row leaves the ROUTE anonymous — redaction survives the enrichment', async () => {
+  // The one that matters: the route spreads stats, planet choices and a scheme-checked
+  // art_url onto each row AFTER the domain read, so a redaction applied any earlier
+  // would be silently undone here.
+  const { body } = await callFeaturedFeed([{ ...PUBLIC_ROW, visibility: 'stealth' }]);
+  const wire = body.projects[0];
+  for (const field of ['origin', 'name', 'tagline', 'art_url']) {
+    assert.equal(wire[field], null, `D2a: ${field} must not leave the server`);
+  }
+  const said = Object.keys(wire).filter((k) => wire[k] !== null);
+  assert.deepEqual(said.sort(), ['orb', 'state']);
+  assert.ok(Object.keys(wire).length > 5, 'and it is a full-width row, not a stub — no key was dropped');
+});
+
+test('a stealth project\'s own API is never asked about its builders', async () => {
+  // The enrichment reads each project's public leaderboard for builder counts, owner
+  // and up to five AVATARS. Handing a stealth origin to it would both leak identity
+  // onto the wire and tell that project it was being enumerated.
+  const { askedFor } = await callFeaturedFeed([
+    { ...PUBLIC_ROW, visibility: 'public' },
+    { ...PUBLIC_ROW, origin: 'https://pluto.example', visibility: 'stealth' },
+  ]);
+  assert.deepEqual(askedFor, ['https://mercury.example']);
+});
+
+test('dark matter never reaches the route at all — the exclusion is in SQL', async () => {
+  // Stated as a structural fact rather than a behaviour, because that IS the decision:
+  // a client-side filter would ship the husk to anyone who opened the network tab.
+  const src = require('node:fs').readFileSync(
+    new URL('../modules/platform-identity/projects-feed.js', import.meta.url), 'utf8');
+  const fn = (src.match(/async function listPublicProjects[\s\S]*?\n\}/) || [''])[0];
+  assert.ok(fn.includes('publishableSql()'), 'the gate is applied in the query, not after it');
+});