@bongos/core 1.19.533 → 1.19.535

package/tests/hall_reading_world.mjs

@@ -520,3 +520,156 @@ test('the vouched shapes still become links, exactly as before', () => {
   const degraded = MD.parseMarkdown('[t](../../CLAUDE.md)\n', MD.makeResolveLinkHref({ baseDir: 'docs/onboarding/' })).html;
   assert.ok(degraded.includes('<a href="../../CLAUDE.md"'), 'and with no bases a repo path still degrades to a link, as §10 pins above');
 });
+
+// ---- the deck draws its dates (task 1003447, `legibility-series-are-drawn`) --
+//
+// /public/versions has always carried started_at and shipped_at per version, and
+// the deck drew NEITHER: both dates reached the browser and came out as "Sep
+// 2026" on a shipped pill. The SERIES lives in roadmap-timeline.js and
+// tests/hall_kit_charts.mjs runs it against the real fixture; what belongs here
+// is the deck's half — that the section is composed, gated and placed the way
+// the reading rooms compose everything else.
+
+test('the deck asks the kit to draw its timeline, and hand-rolls nothing', () => {
+  const js = read('roadmap.js');
+  assert.match(js, /window\.OTBRoadmapTimeline/, 'the series comes from its own module');
+  assert.match(js, /timelineCardHtml\(all, now\)/, 'over the merged versions');
+  assert.match(js, /html \+= timelineHtml\(all, Date\.now\(\)\)/, 'and lands in the deck');
+  // §6b holds this globally; pinned here because a Gantt is the shape most
+  // likely to be reached for as "just a few divs with a left offset".
+  for (const f of ['roadmap.js', 'roadmap-timeline.js']) {
+    assert.doesNotMatch(read(f), /<(?:path|polyline|rect)\b[^>]*\b(?:d|points)="\$\{/,
+      `${f} builds no SVG geometry by hand`);
+    assert.doesNotMatch(read(f), /class="[^"]*(?:__|-)(?:fill|bar|track)[^"]*"[^>]*style="width:/,
+      `${f} draws no bar by hand`);
+  }
+  assert.match(read('roadmap-timeline.js'), /k\.barSeriesHtml\(/, 'the spans are the kit\'s bar series');
+});
+
+test('a missing timeline module leaves the deck exactly as it was', () => {
+  // The section is additive: the module is a <script> that can 404 behind a bad
+  // deploy, and when it does the deck must render its hero and its cards rather
+  // than an empty band or a thrown boot.
+  const js = read('roadmap.js');
+  const fn = js.slice(js.indexOf('function timelineHtml'), js.indexOf('function sectionHtml'));
+  assert.match(fn, /mod \? mod\.timelineCardHtml/, 'the module is checked before it is called');
+  assert.match(fn, /card \? sectionHtml\([\s\S]*?\) : ''/, 'and a null card renders no section at all');
+});
+
+// Boot roadmap.js in a stub DOM with the real dom-utils, the real kit and the
+// real timeline module, answer /public/progress + /public/versions with the
+// checked-in fixtures, and hand back what landed in #rm-root.
+//
+// This is the half the source pins and the kit's own RUN test both miss: the
+// GLUE. `mergeVersions()` maps `m.started_at`/`m.shipped_at` onto `start`/`ship`
+// and the timeline reads those names — a rename or a typo on either side leaves
+// every span unparsable, the section renders nothing, and every other test in
+// this file still passes because none of them run the mapping.
+async function bootRoadmap({ progress, versions } = {}) {
+  const FIX = path.join(ROOT, 'scripts', 'hall-preview', 'fixtures');
+  const fx = (f) => JSON.parse(fs.readFileSync(path.join(FIX, f), 'utf8'));
+  const prog = progress || fx('public__progress.json');
+  // public__versions.json, not versions.json: the deck calls the PUBLIC route.
+  const vers = versions || fx('public__versions.json');
+
+  const els = new Map();
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; },
+    addEventListener() {}, appendChild() {}, insertAdjacentHTML(_, h) { this._html += h; },
+    closest() { return null; }, querySelector() { return null; }, querySelectorAll() { return []; },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelector(sel) {
+      const s = String(sel);
+      return s.startsWith('#') ? this.getElementById(s.slice(1)) : makeEl();
+    },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+  const client = {
+    request: async (_m, urlPath) => {
+      if (urlPath.includes('/public/progress')) return { ok: true, status: 200, data: prog };
+      if (urlPath.includes('/public/versions')) return { ok: true, status: 200, data: vers };
+      // No goals: goalSummary() swallows the failure by design, and the goal
+      // layer is not what this test is about.
+      return { ok: false, status: 500, data: {} };
+    },
+  };
+  const windowObj = {
+    BongosClient: { createClient: () => client },
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    localStorage: { getItem: () => null, setItem() {}, removeItem() {} },
+    location: { hash: '', pathname: '/roadmap', search: '', assign() {} },
+    addEventListener() {}, matchMedia: () => ({ matches: false, addEventListener() {} }),
+  };
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    localStorage: windowObj.localStorage,
+    CSS: { escape: (s) => String(s) }, history: { replaceState() {} },
+    console: { ...console, error() {}, warn() {} },
+    setTimeout, clearTimeout, URLSearchParams, Intl,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  for (const f of ['dom-utils.js', 'hall-kit.js', 'roadmap-timeline.js', 'roadmap.js']) {
+    vm.runInContext(read(f), sandbox, { filename: f });
+  }
+  for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+  return { html: documentObj.getElementById('rm-root').innerHTML, prog, vers };
+}
+
+test('RUN: the deck really draws its timeline — mergeVersions\' field mapping included', async () => {
+  const { html, vers } = await bootRoadmap();
+  assert.ok(html.length > 0, 'the deck rendered');
+  assert.match(html, /class="rm-sec__t">In time</, 'the timeline section is on the page');
+  assert.match(html, /class="kit-bars"/, 'and it is the kit drawing it');
+  assert.doesNotMatch(html, /NaN|Infinity|undefined/, 'no broken geometry reaches the DOM');
+
+  // Every version the fixture gives a start date has a bar, labelled by its id.
+  // This is the assertion that fails if `start`/`ship` ever drift from
+  // `started_at`/`shipped_at`: the mapping breaks, no date parses, and the
+  // section quietly disappears.
+  const started = vers.versions.filter((v) => v.started_at);
+  assert.ok(started.length >= 2, 'the fixture has enough started versions to be a timeline');
+  for (const v of started) {
+    assert.ok(html.includes(`class="kit-bars__label">${v.id}<`), `${v.id} has a bar`);
+  }
+  // A version still running says "now" rather than naming a date nothing recorded.
+  if (vers.versions.some((v) => v.started_at && !v.shipped_at)) {
+    assert.match(html, /→ now</, 'an open span reads "now"');
+  }
+  // Later versions sit further along the shared axis — the whole point of a
+  // timeline, and the thing a plain bar series would NOT show.
+  const offsets = [...html.matchAll(/margin-left:(\d+)%/g)].map((m) => Number(m[1]));
+  assert.ok(offsets.length >= 1, 'spans are offset, not all flush left');
+  assert.deepEqual(offsets, [...offsets].sort((a, b) => a - b), 'offsets grow with start date');
+});
+
+test('RUN: a deck whose versions carry no dates renders every other section unharmed', async () => {
+  // The degradation that matters: /public/versions is fetched with a
+  // `.catch(() => [])`, so a 404 or a stripped payload must cost the timeline
+  // and nothing else. Before this task the whole page relied on that silently.
+  const { html } = await bootRoadmap({
+    versions: { versions: [{ id: 'BONGOS-V1', name: 'x', status: 'building', started_at: null, shipped_at: null }] },
+  });
+  assert.doesNotMatch(html, /In time</, 'no timeline section');
+  assert.match(html, /rm-hero/, 'but the hero still renders');
+  assert.doesNotMatch(html, /NaN|undefined/);
+});
+
+test('the timeline module is a pure builder, so it is testable and cannot boot itself', () => {
+  const src = read('roadmap-timeline.js');
+  // The node-require-safe tail (the hall-kit.js / dom-utils.js contract): the
+  // ONLY eval-time side effect is the assignment, and only when a window exists.
+  assert.match(src, /if \(typeof window !== 'undefined'\) window\.OTBRoadmapTimeline = api;/);
+  assert.match(src, /if \(typeof module !== 'undefined' && module\.exports\) module\.exports = api;/);
+  // It must not reach for the page: no document, no fetch, no client.
+  for (const forbidden of [/\bdocument\./, /\bfetch\(/, /BongosClient/]) {
+    assert.doesNotMatch(src, forbidden, `roadmap-timeline.js touches ${forbidden} — it is a builder, not a page`);
+  }
+});

package/tests/module_api.mjs

@@ -36,6 +36,7 @@ const PUBLISHED_SURFACE = [
   'resolveStaleClaimHours', 'staleClaimMinutes', // added by task 1003476 (ADR 0226; goal 1000072): the PROJECT's stale-claim timer — the sweep that releases a silent claim and the Archon roster that reports one read the same number through here, after eighteen hours of disagreeing (6 vs 24)
   'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
+  'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',

package/tests/project_catalog_bridge.mjs

@@ -0,0 +1,355 @@
+// tests/project_catalog_bridge.mjs — THE CATALOG BRIDGE (task 1003576, ADR 0246).
+//
+// The bug: the owner's publish verdict is computed over `provisioning_instances` and the
+// public map reads `platform_identity_projects`, and the only thing that ever carried the
+// first into the second was federation — co-tenant-only, once, at provision time. A wizard-
+// made standalone project reached `publishable: true` with an empty map (the BV1.R18 proof,
+// task 1002337 §3).
+//
+// What this file pins:
+//   1. THE PROJECTION is blind to hosting shape. A standalone, a co-tenant and a dedicated
+//      instance project identically — the thing the old gate got wrong.
+//   2. THE ROW STAYS CURRENT. `description` and `visibility` are ASSIGNED by the upsert, not
+//      COALESCEd: a description added later reaches the map and one cleared later leaves it.
+//      The COALESCE is literally the bug, so the assertion is on the SQL.
+//   3. THE TWO CLAIM RULES, which are the security half. The bridge writes rows keyed on
+//      values an owner supplies (a slug, a bring-your-own domain) and neither table proves
+//      who owns an origin, so: a credentialed client is never rewritten, and a catalog row
+//      whose owner does not already match is never claimed.
+//   4. THE CHAIN TO THE MAP — the projected fields are exactly what the publish gate and the
+//      orb mapping read, so a published project lands on the map in the right orb and a
+//      described-nothing one stays dark matter.
+//
+// DB-free: a recording fake pool for the SQL, the real modules for everything else.
+//
+// Run:  node --test --test-reporter=tap tests/project_catalog_bridge.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const catalog = require('../modules/platform-identity/project-catalog.js');
+const feed = require('../modules/platform-identity/projects-feed.js');
+const gate = require('../modules/platform-identity/publish-gate.js');
+const bridge = require('../modules/provisioning/catalog-bridge.js');
+
+// A recording fake pool: returns queued responses in order, records every call.
+function mockPool(responses = []) {
+  const calls = [];
+  let i = 0;
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text: String(text), params: params || [] });
+      return responses[i++] || { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+// A live standalone instance that has answered the optional detail step — the exact row the
+// R18 proof watched reach `publishable: true` and never reach the map.
+const STANDALONE = Object.freeze({
+  id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
+  hosting_shape: 'standalone', status: 'active', owner_builder_id: 42,
+  description: 'A harbour for spikes.', type: 'research',
+  settings: { visibility: 'public', joinability: 'apply' },
+});
+
+// ── 1. the projection ────────────────────────────────────────────────────────
+
+test('a standalone instance projects a complete catalog entry', () => {
+  // Arrange / Act
+  const entry = bridge.catalogEntryForInstance(STANDALONE, { ownerGithubId: 9001 });
+
+  // Assert — the slug is BOTH the project's name on this plane (what publishVerdict feeds
+  // the gate) and its client_id on the hub (what federateInstance uses), so a later real
+  // federation rotates the SAME row rather than orphaning it.
+  assert.equal(entry.clientId, 'spike-harbor');
+  assert.equal(entry.origin, 'https://spike-harbor.cloudbongos.test');
+  assert.equal(entry.name, 'spike-harbor');
+  assert.equal(entry.description, 'A harbour for spikes.');
+  assert.equal(entry.type, 'research');
+  assert.equal(entry.visibility, 'public');
+  assert.equal(entry.status, 'active');
+  assert.equal(entry.ownerGithubId, 9001);
+});
+
+test('the projection is BLIND to hosting shape — the old gate is what this task deletes', () => {
+  // shouldFederate() refused anything that was not 'co-tenant', which made hosting topology
+  // decide who is on the map. ADR 0182 D4 says the gate is IDENTITY. Three shapes, one row.
+  const shapes = ['standalone', 'co-tenant', 'dedicated'].map((hosting_shape) =>
+    bridge.catalogEntryForInstance({ ...STANDALONE, hosting_shape }, { ownerGithubId: 9001 }));
+  assert.deepEqual(shapes[0], shapes[1]);
+  assert.deepEqual(shapes[1], shapes[2]);
+});
+
+test('an instance with NO address is refused, because the catalog is keyed on origin', () => {
+  // `no_address: true` is a deliberate opt-out from having a public address, and a project
+  // with no address has nothing to key a public map row on. An honest refusal, not a failure.
+  assert.equal(bridge.catalogEntryForInstance({ ...STANDALONE, domain: null }, { ownerGithubId: 9001 }), null);
+});
+
+test('an instance with NO owner github id is refused rather than written un-refreshable', () => {
+  // The hub's claim rule compares owners, so a row stamped with a null owner could never be
+  // updated again. Refusing beats stranding.
+  for (const owner of [null, undefined, 0, NaN, 'nine']) {
+    assert.equal(bridge.catalogEntryForInstance(STANDALONE, { ownerGithubId: owner }), null,
+      `ownerGithubId ${String(owner)} must not produce an entry`);
+  }
+});
+
+test('a reclaimed instance projects a HIDDEN row; every other state is a project that exists', () => {
+  // 'requested' / 'provisioning' / 'error' are all "the owner is standing this up" — the map
+  // is a directory of projects, not an uptime board.
+  const statusOf = (status) => bridge.catalogEntryForInstance({ ...STANDALONE, status }, { ownerGithubId: 9001 }).status;
+  assert.equal(statusOf('tearing_down'), 'hidden');
+  assert.equal(statusOf('torn_down'), 'hidden');
+  for (const live of ['requested', 'provisioning', 'active', 'error']) {
+    assert.equal(statusOf(live), 'active', `${live} is a project that exists`);
+  }
+});
+
+test('the door comes from effectiveSettings, so an off-vocabulary stored value never leaks', () => {
+  // Same rule every other provisioning surface applies: an unknown stored value resolves to
+  // today's behaviour rather than travelling to a table with a CHECK constraint on it.
+  const entry = bridge.catalogEntryForInstance(
+    { ...STANDALONE, settings: { visibility: 'members-only' } }, { ownerGithubId: 9001 });
+  assert.equal(entry.visibility, 'public');
+  const stealth = bridge.catalogEntryForInstance(
+    { ...STANDALONE, settings: { visibility: 'stealth' } }, { ownerGithubId: 9001 });
+  assert.equal(stealth.visibility, 'stealth');
+});
+
+// ── 2. the row stays current ─────────────────────────────────────────────────
+
+const ENTRY = Object.freeze({
+  clientId: 'spike-harbor', origin: 'https://spike-harbor.cloudbongos.test',
+  name: 'spike-harbor', description: 'A harbour for spikes.', type: 'research',
+  visibility: 'public', status: 'active', ownerGithubId: 9001,
+});
+
+test('the project upsert ASSIGNS description and visibility — the COALESCE was the bug', async () => {
+  // Arrange
+  const pool = mockPool([{ rows: [{ id: 4 }] }]);
+
+  // Act
+  await catalog.upsertOwnedProject(ENTRY, { pool });
+
+  // Assert — the SET clause, because that is where the bug lived: registerClient's
+  // upsertProject COALESCEs description, so a description written AFTER provisioning could
+  // never reach the catalog and the project stayed dark matter forever.
+  const set = (pool.calls[0].text.match(/DO UPDATE SET([\s\S]*?)WHERE/i) || [, ''])[1];
+  assert.match(set, /description\s*=\s*EXCLUDED\.description/);
+  assert.match(set, /visibility\s*=\s*EXCLUDED\.visibility/);
+  assert.doesNotMatch(set, /description\s*=\s*COALESCE/,
+    'a COALESCEd description can never be CLEARED, so clearing one could not un-publish');
+  assert.doesNotMatch(set, /visibility\s*=\s*COALESCE/);
+});
+
+test('a CLEARED description travels as a real null, so the project leaves the map', async () => {
+  const pool = mockPool([{ rows: [{ id: 4, description: null }] }]);
+  await catalog.upsertOwnedProject({ ...ENTRY, description: null }, { pool });
+  assert.equal(pool.calls[0].params[2], null, 'description is the third bound value');
+});
+
+test('the upsert never touches CURATION — featured, tagline, art_url, template', async () => {
+  // ADR 0182 D3: featuring may rank among projects already on the map, never put one there.
+  // The bridge is not curation, so it must not be able to feature anything.
+  const pool = mockPool([{ rows: [{ id: 4 }] }]);
+  await catalog.upsertOwnedProject(ENTRY, { pool });
+  const sql = pool.calls[0].text;
+  const set = (sql.match(/DO UPDATE SET([\s\S]*?)WHERE/i) || [, ''])[1];
+  for (const col of ['featured', 'tagline', 'art_url', 'template']) {
+    assert.doesNotMatch(set, new RegExp(`\\b${col}\\s*=`), `${col} is curation and stays untouched`);
+  }
+  const insertCols = (sql.match(/platform_identity_projects\s*\(([\s\S]*?)\)/i) || [, ''])[1];
+  assert.doesNotMatch(insertCols, /\bfeatured\b/);
+});
+
+// ── 3. the two claim rules (the security half) ───────────────────────────────
+
+test('the client row carries NO credential — the empty secret and allow-list are LITERALS', async () => {
+  // Not bound values: no caller of this function, now or later, can hand it a real secret or
+  // a redirect-URI allow-list entry. The row shape itself is what makes every SSO leg refuse.
+  const pool = mockPool([{ rows: [{ client_id: 'spike-harbor' }] }]);
+  await catalog.upsertCatalogOnlyClient(ENTRY, { pool });
+  const { text, params } = pool.calls[0];
+  assert.match(text, /VALUES\s*\(\s*\$1\s*,\s*''\s*,\s*\$2\s*,\s*'\{\}'::text\[\]/);
+  assert.equal(params.length, 4, 'client_id, name, origin, owner — no secret, no redirect uris');
+  assert.ok(!params.includes(''), 'the empty secret is SQL, never a value a caller supplied');
+});
+
+test('the client upsert can only ever refresh an UNCREDENTIALED row (claim rule 1)', async () => {
+  // A slug that collides with a real federated client must not have its `origin` rewritten —
+  // that origin is what binds the CLI device-mint audience (the task 1002108 fix) — and its
+  // secret must never be blanked.
+  const pool = mockPool([{ rows: [] }]);
+  const out = await catalog.upsertCatalogOnlyClient(ENTRY, { pool });
+  const text = pool.calls[0].text;
+  assert.match(text, /WHERE\s+platform_identity_sso_clients\.secret_hash\s*=\s*''/);
+  const set = (text.match(/DO UPDATE SET([\s\S]*?)WHERE/i) || [, ''])[1];
+  assert.doesNotMatch(set, /secret_hash/, 'the bridge may never write a secret');
+  assert.doesNotMatch(set, /redirect_uris/, 'nor an allow-list entry');
+  assert.doesNotMatch(set, /\bstatus\b/, 'a suspended client stays suspended');
+  assert.equal(out, null, 'a refused claim answers null, not a row');
+});
+
+test('the project upsert can only ever refresh a row this owner already holds (claim rule 2)', async () => {
+  // The hand-seeded catalog rows carry owner_github_id NULL, and `NULL = anything` is NULL,
+  // i.e. not true — so creating an instance at one of their addresses cannot claim them.
+  // First INSERT wins and stamps the owner; every later write must match it.
+  const pool = mockPool([{ rows: [] }]);
+  const out = await catalog.upsertOwnedProject(ENTRY, { pool });
+  const text = pool.calls[0].text;
+  assert.match(text, /WHERE\s+platform_identity_projects\.owner_github_id\s*=\s*EXCLUDED\.owner_github_id/);
+  const set = (text.match(/DO UPDATE SET([\s\S]*?)WHERE/i) || [, ''])[1];
+  assert.doesNotMatch(set, /owner_github_id/, 'ownership is stamped once and never reassigned');
+  assert.equal(out, null);
+});
+
+test('publish reports a REFUSED claim rather than pretending the project is on the map', async () => {
+  const pool = mockPool([{ rows: [] }, { rows: [] }]);
+  const out = await catalog.publishControlPlaneProject(ENTRY, { pool });
+  assert.equal(out.claimed, false);
+  assert.equal(out.project, null);
+});
+
+test('an entry without an owner is refused BEFORE any SQL runs', async () => {
+  const pool = mockPool([]);
+  await assert.rejects(() => catalog.publishControlPlaneProject({ ...ENTRY, ownerGithubId: null }, { pool }),
+    /ownerGithubId required/);
+  assert.equal(pool.calls.length, 0);
+});
+
+test('an unreadable door or lifecycle normalises CLOSED, never open', () => {
+  // Both CHECK-constrained columns; both fall to the direction that says less. A caller that
+  // sends garbage loses visibility, it never gains it.
+  const e = catalog.normalizeEntry({ ...ENTRY, visibility: 'members-only', status: 'featured' });
+  assert.equal(e.visibility, feed.FALLBACK_PROJECT_STATE);
+  assert.equal(e.visibility, 'stealth');
+  assert.equal(e.status, 'hidden');
+});
+
+// ── the re-point: the address a project moved OFF leaves the map ─────────────
+
+test('a re-point retires the abandoned origin, owner-scoped', async () => {
+  const pool = mockPool([{ rows: [{ client_id: 'x' }] }, { rows: [{ id: 4 }] }, { rows: [{ id: 3 }] }]);
+  const out = await catalog.publishControlPlaneProject(ENTRY, { pool, retireOrigin: 'https://old.example' });
+  assert.equal(out.retired.id, 3);
+  const retire = pool.calls[2];
+  assert.match(retire.text, /SET status = 'hidden'/);
+  assert.match(retire.text, /WHERE origin = \$1 AND owner_github_id = \$2/);
+  assert.deepEqual(retire.params, ['https://old.example', 9001]);
+});
+
+test('re-publishing at the SAME origin retires nothing', async () => {
+  const pool = mockPool([{ rows: [{ client_id: 'x' }] }, { rows: [{ id: 4 }] }]);
+  const out = await catalog.publishControlPlaneProject(ENTRY, { pool, retireOrigin: ENTRY.origin });
+  assert.equal(out.retired, null);
+  assert.equal(pool.calls.length, 2, 'no third statement — the project did not move');
+});
+
+// ── 4. the chain to the map ──────────────────────────────────────────────────
+
+// The row the upsert writes, built from ITS OWN RETURNING list so this test cannot drift
+// from the statement: whatever the bridge stores is what the map then reads.
+function catalogRowFor(entry) {
+  return { origin: entry.origin, name: entry.name, description: entry.description,
+    type: entry.type, visibility: entry.visibility, status: entry.status };
+}
+
+test('a described standalone project is PUBLISHABLE and draws as its door\'s orb', () => {
+  // The end of the R18 proof's failing case: publish verdict true, and now the map agrees.
+  const entry = bridge.catalogEntryForInstance(STANDALONE, { ownerGithubId: 9001 });
+  const row = catalogRowFor(catalog.normalizeEntry(entry));
+  assert.deepEqual(gate.projectPublishability(row), { publishable: true, missing: [] });
+  assert.equal(feed.feedShapeFor(row).orb, 'planet');
+  assert.equal(feed.feedShapeFor({ ...row, visibility: 'private' }).orb, 'star');
+  assert.equal(feed.feedShapeFor({ ...row, visibility: 'stealth' }).orb, 'black-hole');
+});
+
+test('a STEALTH standalone project is on the map ANONYMOUSLY — the row names nothing', () => {
+  // D2a, re-asserted at the end of the bridge rather than only at the feed: the thing the
+  // bridge newly puts on the map must be redactable, and it is because it is an ordinary
+  // catalog row that goes through feedShapeFor like every other.
+  const entry = bridge.catalogEntryForInstance(
+    { ...STANDALONE, settings: { visibility: 'stealth' } }, { ownerGithubId: 9001 });
+  const wire = feed.feedShapeFor(catalogRowFor(catalog.normalizeEntry(entry)));
+  for (const field of ['origin', 'name', 'description', 'type']) {
+    assert.equal(wire[field], null, `${field} must not leave the server for a black hole`);
+  }
+  assert.deepEqual(Object.keys(wire).filter((k) => wire[k] !== null).sort(), ['orb', 'state']);
+});
+
+test('a project that SKIPPED the detail step stays dark matter — the bridge publishes no husk', () => {
+  // The bridge puts the ROW on the map's table; the publish gate alone decides whether the
+  // map lists it. Catalogue-at-create must not smuggle an unnamed project onto the map.
+  const entry = bridge.catalogEntryForInstance({ ...STANDALONE, description: null }, { ownerGithubId: 9001 });
+  const row = catalogRowFor(catalog.normalizeEntry(entry));
+  assert.equal(row.description, null);
+  assert.deepEqual(gate.projectPublishability(row), { publishable: false, missing: ['description'] });
+});
+
+test('a reclaimed project is off the map even when it is fully described', () => {
+  // `status = 'active'` is the feed's other half of the predicate, and the projection is
+  // what supplies it.
+  const entry = bridge.catalogEntryForInstance({ ...STANDALONE, status: 'torn_down' }, { ownerGithubId: 9001 });
+  assert.equal(entry.status, 'hidden');
+  assert.equal(gate.projectPublishability(catalogRowFor(entry)).publishable, true,
+    'still publishable by IDENTITY — it is `status` that takes it off, which is the right axis');
+});
+
+// ── 5. the seam: provisioning reaches the catalog through the kernel, or not at all ──
+// Declared LAST on purpose: the port registry is process-global and single-provider, so the
+// "no provider" case has to be observed before anything registers one.
+
+const api = require('../src/module-api.js');
+
+test('with NO catalog provider the bridge reports "not published" — it is not an error', async () => {
+  // platform-identity is hub-only (`default: false`). An instance running provisioning
+  // without it has no map to be on, and the honest answer is a reason, never a throw.
+  assert.equal(api.hasProvider('project.catalog'), false, 'nothing has registered one yet');
+  const out = await bridge.publishInstanceToCatalog(mockPool(), STANDALONE);
+  assert.deepEqual(out, { published: false, reason: 'no_catalog' });
+});
+
+test('the bridge resolves the port and hands it the projection, owner id and all', async () => {
+  // Arrange — a recording provider standing in for platform-identity's own port.
+  const seen = [];
+  api.registerProvider('project.catalog', {
+    publish: async (entry, opts) => { seen.push({ entry, opts }); return { claimed: true }; },
+  });
+  const pool = mockPool([{ rows: [{ github_id: 9001 }] }]);
+
+  // Act
+  const out = await bridge.publishInstanceToCatalog(pool, STANDALONE, { retireOrigin: 'old.example' });
+
+  // Assert
+  assert.equal(out.published, true);
+  assert.equal(seen[0].entry.origin, 'https://spike-harbor.cloudbongos.test');
+  assert.equal(seen[0].entry.ownerGithubId, 9001);
+  assert.equal(seen[0].opts.retireOrigin, 'https://old.example', 'a bare hostname is made an origin here');
+  assert.match(pool.calls[0].text, /SELECT github_id FROM builders WHERE id = \$1/);
+  assert.deepEqual(pool.calls[0].params, [42]);
+});
+
+test('an owner with no github identity is refused before the port is called', async () => {
+  const pool = mockPool([{ rows: [] }]);
+  const out = await bridge.publishInstanceToCatalog(pool, STANDALONE);
+  assert.deepEqual(out, { published: false, reason: 'no_owner_identity' });
+});
+
+test('an instance with no address reports no_address, not a failure', async () => {
+  const pool = mockPool([{ rows: [{ github_id: 9001 }] }]);
+  const out = await bridge.publishInstanceToCatalog(pool, { ...STANDALONE, domain: null });
+  assert.deepEqual(out, { published: false, reason: 'no_address' });
+});
+
+test('a hub that throws is SWALLOWED — the durable write it follows must never be undone', async () => {
+  // Every call site runs after the route's real work is already committed. A catalog hiccup
+  // that surfaced as a 500 would tell an owner their description was lost when it was not.
+  const pool = { query: async () => { throw new Error('hub unreachable'); } };
+  const out = await bridge.publishInstanceToCatalog(pool, STANDALONE);
+  assert.deepEqual(out, { published: false, reason: 'error' });
+});