@bongos/core 1.19.563 → 1.19.565

package/modules/platform-identity/routes/projects.js

@@ -15,6 +15,9 @@
 //   POST  /projects/invite     — a `project.curate` holder OR the project's OWN owner:
 //                                pre-seed a 'pending' membership (invite-authz.js)
 //   PATCH /projects/:id/featured — Archon: the feature / unfeature control
+//   PATCH /projects/:id/status   — `project.curate`: the TAKEDOWN lever (R08, ADR 0252
+//                                §5.1). Setting 'hidden' pins the row so the ADR 0246
+//                                projection cannot quietly put it back on the map.
 //
 // Reaches core only through the doorway (ADR 0083). Archon routes declared first so
 // route-rank-check's look-ahead never misclassifies the trailing public GET.
@@ -181,12 +184,56 @@ module.exports = function projectsRoutes() {
     }
   });
 
+  // rank: metic — THE TAKEDOWN LEVER (R08, task 1002327; ADR 0252 §5.1). Until this
+  // route, `platform_identity_projects.status` had no writer on the API at all: the
+  // column shipped in migration 004, the public feed requires 'active', and removing a
+  // project from the map meant hand-written SQL against production.
+  //
+  // IT SHIPS IN THE SAME TASK AS AUTO-APPEAR, NOT AFTER IT. ADR 0252 §3 lets a
+  // self-hosted project put itself on the public map with no human act, and the Archon
+  // took that decision explicitly conditional on retraction landing beside it — ADR 0047's
+  // rule that a straight-through path and its abuse guard are one piece of work. A
+  // one-way door onto a public surface is not a door.
+  //
+  // Setting 'hidden' PINS the row (project-catalog.js), which is what makes the
+  // retraction survive: the ADR 0246 projection re-takes `status` on every provisioning
+  // write, so without the pin an owner's next settings save would quietly undo the
+  // takedown. PATCHing back to 'active' releases the pin and returns the row to automatic
+  // management, so un-hiding is exactly as deliberate an act as hiding.
+  router.patch('/projects/:id/status', requireBuilder, requirePermission('project.curate'), async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_project_id', positiveInt: true });
+    if (id === null) return;
+    if (validateOrRespond(req, res, { status: { required: true, type: 'string' } })) return;
+    if (!projectCatalog.CATALOG_STATUSES.includes(req.body.status)) {
+      return res.fail('bad_project_status', 400, { valid: projectCatalog.CATALOG_STATUSES });
+    }
+    try {
+      const project = await projectCatalog.setProjectStatus(id, req.body.status, { pool });
+      if (!project) return res.fail('project_not_found', 404);
+      res.json({ project });
+    } catch (err) {
+      log.error({ err: err.message }, 'PATCH /projects/:id/status');
+      res.fail('status_change_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // The PUBLIC projects feed — every project ON THE MAP (active + publishable),
   // public projection. CORS-enabled cross-origin read (a status page / the apex /
   // the static orbs site fetches it pre-auth).
   router.use('/projects/featured', corsPublicGet('/projects/featured'));
   // rank: public — the public map of projects; no auth by design.
-  router.get('/projects/featured', async (_req, res) => {
+  //
+  // THE PER-IP CEILING IS PART OF THE ROUTE, not a decoration on it (ADR 0252 §5.3).
+  // This GET is unauthenticated and CORS-open, and it was unmetered by construction: the
+  // two global limiters return early for reads, and the /public/* read limiter is mounted
+  // on a prefix this route does not sit under. It is also the platform's most expensive
+  // anonymous read — a cold cache turns one request into as many as 500 rows × 4 outbound
+  // fetches at OTHER PEOPLE's servers, so leaving it open aims our fan-out, not just our
+  // database. Auto-appear removed the old bound (the set of projects the operator had
+  // provisioned) and replaced it with "whoever points a domain at us", which is what makes
+  // the ceiling load-bearing rather than prudent. It runs BEFORE the handler, so a refused
+  // read costs no query and no fetch.
+  router.get('/projects/featured', api.publicProjectFeedRateLimit, async (_req, res) => {
     try {
       const projects = await pi.listPublicProjects({ pool });
       // A stealth project is on the map ANONYMOUSLY (ADR 0182 D2a), so its origin

package/modules/platform-identity/visibility-pull.js

@@ -0,0 +1,201 @@
+// modules/platform-identity/visibility-pull.js — HOW A SELF-HOSTED PROJECT'S JOIN DOOR
+// REACHES THE HUB (BV1.R08, task 1002327; ADR 0252, corrected by ADR 0253).
+//
+// The hub does not receive a pushed report. It READS the instance's already-public
+// manifest — `GET <origin>/api/bongos/instance` → `brand.project.visibility` — and caches
+// the answer. ADR 0252 §2: a self-hosted instance holds no credential and minting one
+// walks into ADR 0144/0145's tripwire, so the channel that does not need a credential
+// is the only one that can be built today. A pull also has no message to replay, adds
+// no required wire field to anyone else's upgrade clock, and authorizes nothing.
+//
+// WHAT THIS FILE OWNS. Three rules, and each is only safe given the others:
+//
+//   • WHAT A MANIFEST IS ALLOWED TO SAY — `visibilityFromManifest`. A three-value closed
+//     enum and nothing else. No name, tagline or art reaches the catalog through this
+//     channel: today no project owner controls a free-text field that reaches the public
+//     feed, and ADR 0252 §7 refuses to spend that property on a visibility report. An
+//     off-vocabulary or absent answer is NO VERDICT — never a default, because defaulting
+//     would let a project that said nothing be read as having said 'public'.
+//
+//   • WHAT A READ MAY CHANGE — `pullDecision`. The tri-state, which is the part that is
+//     easy to get wrong in the direction that empties the map. See below.
+//
+//   • WHICH ROWS MAY BE READ AT ALL — `PULLABLE_SQL`. Rows the control plane has never
+//     claimed. The bridge (ADR 0246) assigns `visibility` for the projects the operator
+//     provisions, and the two writers must never touch the same row; `visibility_source`
+//     is what makes that an invariant the SQL enforces rather than a convention someone
+//     has to remember. The catalog row carries no `hosting_shape` and may not import the
+//     module that does (ADR 0083's one-way rule), so provenance is recorded here instead
+//     of asked for across a seam on every sweep.
+//
+// THE TRI-STATE, AND WHY IT IS THREE STATES AND NOT TWO (ADR 0252 §4). `null` (never
+// read) ≠ `false` (read, and negative). A project does not leave the map because its
+// server was down for one sweep:
+//
+//   never successfully read      → dark matter. ADR 0182 D5's fail-closed default,
+//                                  doing its job, and scoped to rows that have genuinely
+//                                  never answered.
+//   read before, unreachable now → KEEP the last known state and its stamp. Reporting
+//                                  may degrade where enforcement must refuse (ADR 0226);
+//                                  liveness is an overlay, never a lifecycle state
+//                                  (ADR 0199). Implemented by writing NOTHING — the
+//                                  stamp means "last SUCCESSFUL read", so a failed read
+//                                  must not touch it.
+//   read, narrower than before   → applied immediately and unconditionally. A report
+//                                  that REDUCES exposure needs no trust at all: the
+//                                  worst a lying instance achieves is hiding itself.
+//                                  Narrowing is free; widening is what costs.
+//
+// AND THE ONE THING A PULL MAY NEVER MOVE: `status`. Retraction is a hub decision about
+// the hub's own surface. A project taken down that keeps reporting `public` STAYS down —
+// without that, the next sweep silently undoes every takedown and the lever is
+// decorative (ADR 0252 §5.2). The pull moves `visibility`; `status` is not in any
+// statement in this file, which is the cheapest possible proof of it.
+//
+// Proof: ../../tests/visibility_pull.mjs
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { ORB_BY_STATE } = require('./projects-feed');
+const projectStats = require('./project-stats');
+
+// The manifest route every Cloud Bongos instance already serves, unauthenticated and
+// CORS-open (ADR 0114's discovery surface; `src/bongos/routes/instance.js`). Nothing is
+// added to it by this task — ADR 0252 §2.3: the field already ships in every core, so
+// there is no wire change on anyone else's upgrade schedule. The API router is
+// dual-mounted at `/api/bongos` (canonical) and at the permanent legacy alias ADR 0252
+// happened to write, so either prefix reaches it; the fetch uses the canonical one.
+const MANIFEST_ROUTE = '/api/bongos/instance';
+
+// Rows the PULL may write: the ones the ADR 0246 control-plane bridge has never claimed.
+// `IS DISTINCT FROM` rather than `<> `, deliberately — a NULL source is the unclaimed
+// state and plain inequality would drop exactly those rows on a NULL comparison.
+const PULLABLE_SQL = "visibility_source IS DISTINCT FROM 'control-plane'";
+
+// visibilityFromManifest — the ONLY value this channel carries, or null for NO VERDICT.
+//
+// Reads `brand.project.visibility`: `buildInstanceManifest` projects the branding pack
+// under the key `brand`, and `clientBranding()` puts the join door at `project.visibility`
+// (`src/branding.js`). `branding` is accepted as a second spelling because ADR 0252 §2 and
+// this task's own body both name it that way — costing one `??` here is cheaper than a
+// silent null on a shape nobody re-checked.
+//
+// Third-party input, so it is validated against the enum rather than trusted: an unknown
+// string, a number, an object, a missing key and a missing `project` all yield null. PURE.
+function visibilityFromManifest(body) {
+  const project = body?.brand?.project ?? body?.branding?.project;
+  const v = project?.visibility;
+  if (typeof v !== 'string') return null;
+  const trimmed = v.trim();
+  return Object.prototype.hasOwnProperty.call(ORB_BY_STATE, trimmed) ? trimmed : null;
+}
+
+// pullDecision — what ONE sweep of ONE row should do. The whole tri-state, in one pure
+// function so it is testable without a database or a network.
+//
+// Returns { write: false, reason } or { write: true, visibility }. There is deliberately
+// no third shape: everything that is not a successful, in-vocabulary read leaves the row
+// exactly as it is, including its stamp.
+function pullDecision(row, reported) {
+  if (row?.visibility_source === 'control-plane') {
+    return { write: false, reason: 'control_plane_row' };
+  }
+  if (reported === null || reported === undefined) {
+    // No verdict. Either the instance is unreachable, or it answered something this
+    // channel does not accept. Both are silence, and silence never moves a row: an
+    // unread project stays dark, and a project that answered before keeps what it said.
+    return {
+      write: false,
+      reason: row?.visibility_reported_at ? 'unreachable_keeps_last_state' : 'never_reported',
+    };
+  }
+  if (row?.visibility === reported && row?.visibility_source === 'pull') {
+    // Same answer as last time. Skipping the write keeps `updated_at` still, which
+    // matters more than it looks: the public feed orders on it, so bumping it every
+    // sweep would make a row's position track the sweep clock rather than the project.
+    return { write: false, reason: 'unchanged' };
+  }
+  return { write: true, visibility: reported };
+}
+
+// The pullable rows, oldest reading first so a sweep that is cut short by its budget
+// makes progress on the staleness it exists to fix rather than re-reading fresh rows.
+// NULLS FIRST puts the never-read projects — the ones currently dark — at the head.
+async function pullableProjects({ pool = defaultPool, limit = 200 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, origin, visibility, visibility_source, visibility_reported_at
+       FROM platform_identity_projects
+      WHERE ${PULLABLE_SQL}
+      ORDER BY visibility_reported_at ASC NULLS FIRST
+      LIMIT $1`,
+    [limit],
+  );
+  return rows;
+}
+
+// Record one successful read. The WHERE re-asserts PULLABLE_SQL rather than trusting the
+// row the caller read a moment ago: a bridge projection can land between the SELECT and
+// this UPDATE, and the invariant that the two writers never touch the same row has to
+// hold at the write, not merely at the read. `status` is absent, and so is `featured` —
+// this statement can only move the door.
+async function recordVisibilityPull(id, visibility, { pool = defaultPool } = {}) {
+  if (!Object.prototype.hasOwnProperty.call(ORB_BY_STATE, visibility)) {
+    throw new Error(`visibility-pull: refusing to write off-vocabulary value ${JSON.stringify(visibility)}`);
+  }
+  const { rows } = await pool.query(
+    `UPDATE platform_identity_projects
+        SET visibility = $2,
+            visibility_source = 'pull',
+            visibility_reported_at = now(),
+            updated_at = now()
+      WHERE id = $1 AND ${PULLABLE_SQL}
+      RETURNING id, origin, visibility, visibility_reported_at`,
+    [id, visibility],
+  );
+  return rows[0] || null;
+}
+
+// One row, end to end. Never throws: a sweep runs over projects the hub does not control,
+// so one hostile or broken instance must not stop the others being read.
+async function pullOne(row, { pool = defaultPool, fetchVisibility = projectStats.fetchInstanceVisibility } = {}) {
+  let reported = null;
+  try {
+    reported = visibilityFromManifest(await fetchVisibility(row.origin));
+  } catch {
+    reported = null;   // unreachable, refused by the SSRF guard, timed out, or not JSON
+  }
+  const decision = pullDecision(row, reported);
+  if (!decision.write) return { origin: row.origin, written: false, reason: decision.reason };
+  const written = await recordVisibilityPull(row.id, decision.visibility, { pool });
+  return {
+    origin: row.origin,
+    written: !!written,
+    reason: written ? 'updated' : 'claim_lost',
+    visibility: decision.visibility,
+  };
+}
+
+// The sweep. Sequential on purpose: this is a background reconciler with no reader
+// waiting on it, and the fan-out it walks is the same population the public feed already
+// fetches from on every cold load. Doing it serially keeps the hub from becoming a
+// burst source against every listed instance at once — the feed's own concurrency is
+// bounded by a page load; a sweep's would be bounded by nothing.
+async function sweepVisibilityOnce({ pool = defaultPool, limit = 200, fetchVisibility } = {}) {
+  const rows = await pullableProjects({ pool, limit });
+  const results = [];
+  for (const row of rows) {
+    results.push(await pullOne(row, { pool, fetchVisibility }));
+  }
+  return { scanned: rows.length, updated: results.filter((r) => r.written).length, results };
+}
+
+module.exports = {
+  MANIFEST_ROUTE,
+  PULLABLE_SQL,
+  visibilityFromManifest,
+  pullDecision,
+  pullableProjects,
+  recordVisibilityPull,
+  pullOne,
+  sweepVisibilityOnce,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.563",
+  "version": "1.19.565",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.563",
+      "version": "1.19.565",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.563",
+  "version": "1.19.565",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/middleware/rate-limit.js

@@ -1,8 +1,8 @@
 // src/bongos/middleware/rate-limit.js — V3.R34 (#255).
 //
-// Four sliding-window in-memory limiters. The first two are the GLOBAL pair and
+// Five sliding-window in-memory limiters. The first two are the GLOBAL pair and
 // protect write methods on /api/gds/* only — read methods (GET, HEAD, OPTIONS)
-// bypass them entirely; #3 and #4 are mounted per-surface to close exactly that
+// bypass them entirely; #3, #4 and #5 are mounted per-surface to close exactly that
 // gap where an unauthenticated READ is itself the abuse.
 //
 //   1. Per-IP limiter      — 30 writes / 60s. Anchors on req.ip (which honors
@@ -50,6 +50,26 @@
 //                            the access-pending page polls every 3s (20/min) —
 //                            while capping a scraper at ~2 logins/s.
 //
+//   5. Public-project-feed limiter — 120 reads / 60s per IP on GET /projects/featured
+//                            (task 1002327, ADR 0252 §5.3). That route is
+//                            unauthenticated, CORS-open and, until this limiter,
+//                            unmetered by construction: the two write limiters
+//                            bypass reads, and #3 is mounted only under /public/*,
+//                            which this route is not. It is also the most
+//                            EXPENSIVE public read on the platform — a cold cache
+//                            drives up to 500 catalog rows × 4 outbound fetches to
+//                            other people's servers, so an unmetered caller is not
+//                            just scraping us, they are aiming our fan-out at
+//                            third parties. ADR 0252 opened the catalog to
+//                            auto-appear, which replaced "bounded by who the
+//                            operator provisioned" with "bounded by whoever points
+//                            a domain at us" — this ceiling is the counterweight
+//                            that made that decision safe to take. 120/min clears
+//                            any real consumer (the static orbs site and the apex
+//                            fetch it once per page load, and both honour the
+//                            route's Cache-Control) while capping a
+//                            cache-ignoring scraper at ~2 req/s.
+//
 // Any limiter tripping → 429 with Retry-After (seconds rounded up to the
 // nearest whole second). Audit middleware still fires on a write 429 — the row
 // in audit_log is forensic value for "who tried too hard." (Reads are never
@@ -74,6 +94,8 @@ const PUBLIC_READ_WINDOW_MS = 60 * 1000;
 const PUBLIC_READ_LIMIT     = 120;
 const ACCOUNT_EXISTENCE_WINDOW_MS = 60 * 1000;
 const ACCOUNT_EXISTENCE_LIMIT     = 120;
+const PROJECT_FEED_WINDOW_MS = 60 * 1000;
+const PROJECT_FEED_LIMIT     = 120;
 const SWEEP_MS              = 5 * 60 * 1000;
 
 const ipBuckets         = new Map();
@@ -82,6 +104,8 @@ const publicReadBuckets = new Map();
 // ONE bucket map for limiter #4 — both account-existence probes key into it, so
 // the budget is genuinely shared rather than merely identically configured.
 const accountExistenceBuckets = new Map();
+// Limiter #5's bucket map — the public projects feed (task 1002327, ADR 0252 §5.3).
+const projectFeedBuckets = new Map();
 
 const WRITE_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 // HEAD is metered too: Express runs the GET handler (incl. the DB query) for a
@@ -132,6 +156,10 @@ function sweep() {
     pruneAndCount(arr, now, ACCOUNT_EXISTENCE_WINDOW_MS);
     if (arr.length === 0) accountExistenceBuckets.delete(k);
   }
+  for (const [k, arr] of projectFeedBuckets) {
+    pruneAndCount(arr, now, PROJECT_FEED_WINDOW_MS);
+    if (arr.length === 0) projectFeedBuckets.delete(k);
+  }
 }
 
 // Schedule the sweep. unref() so it doesn't keep the process alive during
@@ -245,10 +273,22 @@ const accountExistenceReadRateLimit = perIpSlidingWindow(accountExistenceBuckets
   scope: 'account-existence',
 });
 
+// publicProjectFeedRateLimit — limiter #5 in the header. ONE instance, mounted on the
+// public projects feed (task 1002327, ADR 0252 §5.3). Exported as an instance rather
+// than a factory for ADR 0209's reason: two call sites that each build their own from
+// matching config get two budgets, which looks identical in review and hands a caller
+// double the rate. A second surface answering "what is on the map" mounts THIS.
+const publicProjectFeedRateLimit = perIpSlidingWindow(projectFeedBuckets, {
+  limit: PROJECT_FEED_LIMIT,
+  windowMs: PROJECT_FEED_WINDOW_MS,
+  scope: 'public-project-feed',
+});
+
 module.exports = {
   rateLimitMiddleware,
   publicReadRateLimitMiddleware,
   accountExistenceReadRateLimit,
+  publicProjectFeedRateLimit,
   // exported for tests + the security-baseline-check script
   PER_IP_WINDOW_MS,
   PER_IP_LIMIT,
@@ -258,4 +298,6 @@ module.exports = {
   PUBLIC_READ_LIMIT,
   ACCOUNT_EXISTENCE_WINDOW_MS,
   ACCOUNT_EXISTENCE_LIMIT,
+  PROJECT_FEED_WINDOW_MS,
+  PROJECT_FEED_LIMIT,
 };

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.563'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.565'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -158,6 +158,17 @@ module.exports = {
   //     ADR 0209). Vendoring a second copy in a module is the failure this
   //     export exists to prevent.
   accountExistenceReadRateLimit: require('./bongos/middleware/rate-limit').accountExistenceReadRateLimit,
+  // publicProjectFeedRateLimit — the per-IP ceiling (120 reads/60s) on the PUBLIC
+  //     projects feed (task 1002327, ADR 0252 §5.3). Same reasoning as its
+  //     neighbour, and the same shape — ONE middleware instance, never a factory,
+  //     so a second surface answering "what is on the map" spends the same budget
+  //     instead of quietly doubling it. It guards the most expensive
+  //     unauthenticated read the platform has: a cold call fans out to as many as
+  //     500 third-party origins, so the ceiling protects other people's servers as
+  //     much as ours. ADR 0252 made this a condition of auto-appear, not a
+  //     follow-up — the straight-through path and its abuse guard ship together
+  //     (ADR 0047).
+  publicProjectFeedRateLimit: require('./bongos/middleware/rate-limit').publicProjectFeedRateLimit,
 
   // --- per-builder secrets at rest (AES-256-GCM box) — a kernel trust
   //     primitive; the full secretBox object is exposed so a module can call

package/tests/module_api.mjs

@@ -25,6 +25,7 @@ const PUBLISHED_SURFACE = [
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
   'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
+  'publicProjectFeedRateLimit', // task 1002327 (ADR 0252 §5.3): the per-IP ceiling on GET /projects/featured — the platform's most expensive anonymous read (a cold call fans out to up to 500 third-party origins). One instance for the same reason as its neighbour
   'routeRankCheck', 'permissionPathCheck', // BV1.R73: kernel trust classifiers (1.6.0)
   'repoInfo', 'moduleScopeMap', 'pathMatch', // BV1.R86: kernel repo-identity + scope-wall + touches-overlap for the carved lifecycle (1.12.0)
   'goalScopeCheck', // BV1.R60: kernel scope wall for the goal-authored-task create gate (1.13.0; ADR 0086 §3)

package/tests/project_takedown_lever.mjs

@@ -0,0 +1,177 @@
+// tests/project_takedown_lever.mjs — the retraction lever and its per-IP ceiling
+// (R08, task 1002327; ADR 0252 §5, corrected by ADR 0253).
+//
+// ADR 0252 §3 lets a self-hosted project put itself on the public map with NO human act,
+// and the Archon took that decision explicitly conditional on retraction shipping beside
+// it. So these are not follow-up tests — they are the tests for the half of R08 that made
+// auto-appear safe to take at all (ADR 0047: the straight-through path and its abuse
+// guard are one piece of work).
+//
+// The one that matters most is `hidden` surviving the ADR 0246 projection. ADR 0252 §5
+// asserts "no route writes [status]" and defends the takedown against the visibility
+// pull — but the pull is not the writer that undoes takedowns. `upsertOwnedProject` is,
+// and it fires on every provisioning write. Defending against the pull alone would leave
+// the lever decorative for exactly the reason the ADR gives, one writer over.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+// ESM named imports for the limiter, deliberately, and NOT createRequire: knip does not
+// trace a createRequire() call, so a core export whose only consumer is a MODULE (this one
+// is reached through the doorway, `api.publicProjectFeedRateLimit`) reads as dead code and
+// trips the dead-code ratchet. An ESM import from the test is what credits it — and the
+// test is a real consumer, so this is the honest fix rather than a baseline bump.
+import {
+  publicProjectFeedRateLimit,
+  accountExistenceReadRateLimit,
+  PROJECT_FEED_LIMIT,
+  PROJECT_FEED_WINDOW_MS,
+} from '../src/bongos/middleware/rate-limit.js';
+
+const require = createRequire(import.meta.url);
+const catalog = require('../modules/platform-identity/project-catalog.js');
+const moduleApi = require('../src/module-api.js');
+
+function recordingPool(responses = []) {
+  const calls = [];
+  const queue = [...responses];
+  return {
+    calls,
+    query(text, params) {
+      calls.push({ text, params });
+      return Promise.resolve(queue.shift() || { rows: [] });
+    },
+  };
+}
+
+// ── The lever ──
+
+test('setProjectStatus writes the status AND pins the row when hiding', async () => {
+  const pool = recordingPool([{ rows: [{ id: 4, status: 'hidden', status_pinned: true }] }]);
+  const out = await catalog.setProjectStatus(4, 'hidden', { pool });
+  assert.equal(out.status, 'hidden');
+  const { text, params } = pool.calls[0];
+  assert.match(text, /SET status = \$2/);
+  assert.match(text, /status_pinned = \(\$2 = 'hidden'\)/);
+  assert.deepEqual(params, [4, 'hidden']);
+});
+
+test('PATCHing back to active RELEASES the pin — un-hiding is as deliberate as hiding', async () => {
+  // The pin is derived from the value in the same statement, so 'active' clears it and
+  // the row returns to automatic management. A pin that only ever set would make the
+  // first takedown permanent.
+  const pool = recordingPool([{ rows: [{ id: 4, status: 'active', status_pinned: false }] }]);
+  await catalog.setProjectStatus(4, 'active', { pool });
+  assert.match(pool.calls[0].text, /status_pinned = \(\$2 = 'hidden'\)/);
+});
+
+test('an unknown status is refused before it reaches the database', async () => {
+  const pool = recordingPool();
+  await assert.rejects(() => catalog.setProjectStatus(1, 'deleted', { pool }), /unknown status/);
+  assert.equal(pool.calls.length, 0);
+});
+
+test('a missing row is null, not a silent success', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  assert.equal(await catalog.setProjectStatus(999, 'hidden', { pool }), null);
+});
+
+// ── The lever survives the writer that actually undoes takedowns ──
+
+test('the ADR 0246 projection CANNOT move status on a pinned row', async () => {
+  // The regression this exists to catch: hide a project, its owner saves any setting,
+  // the bridge re-takes the projection with status 'active', and the takedown is gone.
+  const pool = recordingPool([{ rows: [{ id: 1 }] }]);
+  await catalog.upsertOwnedProject(
+    { origin: 'https://p.example', clientId: 'p', name: 'p', ownerGithubId: 5, visibility: 'public', status: 'active' },
+    { pool },
+  );
+  const { text } = pool.calls[0];
+  assert.match(
+    text,
+    /status\s*=\s*CASE WHEN platform_identity_projects\.status_pinned/,
+    'the projection must honour the pin instead of assigning status outright',
+  );
+  assert.ok(
+    !/\bstatus\s*=\s*EXCLUDED\.status\b/.test(text),
+    'an unconditional status assignment silently reverts every takedown',
+  );
+});
+
+test('the projection stamps its rows control-plane, so the pull can never reach them', async () => {
+  const pool = recordingPool([{ rows: [{ id: 1 }] }]);
+  await catalog.upsertOwnedProject(
+    { origin: 'https://p.example', clientId: 'p', name: 'p', ownerGithubId: 5, visibility: 'private', status: 'active' },
+    { pool },
+  );
+  const { text } = pool.calls[0];
+  assert.match(text, /visibility_source/, 'the insert must record provenance');
+  assert.match(text, /visibility_source = 'control-plane'/, 'the UPDATE branch must claim the row too');
+});
+
+test('retireOwnedProject deliberately does NOT honour the pin', async () => {
+  // A re-point retirement is a SAFETY retraction: an abandoned origin left 'active' keeps
+  // drawing an orb at a host the project no longer answers on (the ADR 0181 §2 leak). A
+  // curator's 'active' pin must not be able to keep a dead origin on the map. Narrowing
+  // is always allowed; it is widening that costs.
+  const pool = recordingPool([{ rows: [{ id: 1, status: 'hidden' }] }]);
+  await catalog.retireOwnedProject({ origin: 'https://old.example', ownerGithubId: 5 }, { pool });
+  assert.ok(!/status_pinned/.test(pool.calls[0].text), 'retirement must stay unconditional');
+});
+
+// ── The ceiling ──
+
+test('the public feed limiter is ONE exported instance, not a factory (ADR 0209)', () => {
+  // Two call sites that each build their own limiter from matching config look identical
+  // in review and hand a caller double the rate. Identity is the property.
+  assert.equal(typeof publicProjectFeedRateLimit, 'function');
+  assert.equal(
+    moduleApi.publicProjectFeedRateLimit,
+    publicProjectFeedRateLimit,
+    'the doorway must re-export the SAME instance, never a copy',
+  );
+});
+
+test('the ceiling is 120 reads per 60s — the /public/* posture, stated in both halves', () => {
+  // Both numbers are asserted because both are load-bearing: the limit without the window
+  // is meaningless, and a later edit that changed only one would otherwise pass.
+  assert.equal(PROJECT_FEED_LIMIT, 120);
+  assert.equal(PROJECT_FEED_WINDOW_MS, 60 * 1000);
+});
+
+test('it refuses past the limit with the ADR 0116 envelope and a Retry-After', () => {
+  const limiter = publicProjectFeedRateLimit;
+  const headers = {};
+  let failed = null;
+  const res = {
+    set: (k, v) => { headers[k] = v; },
+    fail: (code, status, details) => { failed = { code, status, details }; },
+  };
+  const req = { ip: '203.0.113.77' };
+
+  let allowed = 0;
+  for (let i = 0; i < PROJECT_FEED_LIMIT; i++) limiter(req, res, () => { allowed++; });
+  assert.equal(allowed, PROJECT_FEED_LIMIT, 'every read inside the budget passes through');
+  assert.equal(failed, null);
+
+  limiter(req, res, () => { allowed++; });
+  assert.equal(allowed, PROJECT_FEED_LIMIT, 'the read past the ceiling must not reach the handler');
+  assert.equal(failed.code, 'rate_limited');
+  assert.equal(failed.status, 429);
+  assert.equal(headers['X-RateLimit-Scope'], 'public-project-feed');
+  assert.ok(Number(headers['Retry-After']) >= 1);
+});
+
+test('the budget is per-IP — one abusive address cannot close the map for anyone else', () => {
+  const limiter = publicProjectFeedRateLimit;
+  const res = { set: () => {}, fail: () => { throw new Error('refused'); } };
+  let ok = false;
+  limiter({ ip: '198.51.100.9' }, res, () => { ok = true; });
+  assert.equal(ok, true);
+});
+
+test('the feed limiter does NOT share the account-existence budget', () => {
+  // Separate questions get separate budgets; the ADR 0209 sharing rule is about two
+  // routes answering ONE question, which these are not.
+  assert.notEqual(publicProjectFeedRateLimit, accountExistenceReadRateLimit);
+});