@bongos/core 1.19.564 → 1.19.566

package/tests/manage_settings_shared_read.mjs

@@ -0,0 +1,146 @@
+// tests/manage_settings_shared_read.mjs — one read of the project's settings
+// row per manage entry, EXECUTED (task 1003582).
+//
+// The defect this pins shut: entering /projects?view=manage fired
+// GET /provisioning/instances/:id/settings three times in a row, because the
+// three cards that render off that row — how the project is reached, how people
+// join, and its door on the map — each fetched it for themselves. Three round
+// trips and three DB reads for one row, growing by one with every settings-
+// backed card added to the page.
+//
+// tests/projects_hub.mjs pins that all three cards go through the shared
+// reader; this file lifts the reader itself out of modules/public-landing/
+// public/projects.html, runs it in a vm under a scripted fetch, and counts the
+// round trips. The vm-harness precedent is tests/project_door_ui.mjs.
+//
+// What it proves, and why each matters:
+//   • three callers in one entry cost ONE round trip — the defect itself
+//   • forgetSettings() makes the next read real, so entry and tab return each
+//     see the row as it is now, never the one from the last visit
+//   • that is also what lets the alert's "Try again" retry after a failure: a
+//     rejected promise left memoised would answer with the failure forever
+//   • switching projects is never served the previous project's row, even with
+//     the memo still warm — the cache is keyed on the project, not just present
+//   • a refusal RESOLVES carrying its status, so each card can still tell a
+//     lapsed session apart from an outage in its own words
+//
+// Run:  node --test --test-reporter=tap tests/manage_settings_shared_read.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The reader, sliced from the page verbatim. Both boundaries are asserted so a
+// rename cannot leave this file executing an empty string and passing.
+const START = SCRIPT.indexOf('  var settingsPromise = null;');
+const END = SCRIPT.indexOf('  function loadVisibility(');
+assert.ok(START > 0, 'the shared reader must start at its memo declaration');
+assert.ok(END > START, 'the shared reader must sit above its first consumer');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureSettings(', 'function forgetSettings(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the harness ──────────────────────────────────────────────────────────────
+// Narrow on purpose: the region touches fetch, jsonOrEmpty, API and manageId,
+// and nothing else — so the stub stays honest about what it can prove.
+
+function boot({ ok = true, status = 200, body = { settings: { visibility: 'public' } }, reject = false } = {}) {
+  const requests = [];
+  const sandbox = {
+    Promise, JSON, String, Object, Error, encodeURIComponent,
+    API: '/api/bongos',
+    manageId: '18',
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    fetch: (url, init = {}) => {
+      requests.push({ url, credentials: init.credentials });
+      return reject ? Promise.reject(new Error('network')) : Promise.resolve({ ok, status, _json: body });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#shared-settings-read' });
+
+  const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
+  return { requests, sandbox, settle };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the three cards of one manage entry cost ONE round trip, not three', async () => {
+  // Arrange — the page's own entry pass: three readers, back to back
+  const ui = boot();
+
+  // Act
+  const answers = await Promise.all([
+    ui.sandbox.ensureSettings(),
+    ui.sandbox.ensureSettings(),
+    ui.sandbox.ensureSettings(),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 1, 'one GET served all three cards');
+  assert.equal(ui.requests[0].url, '/api/bongos/provisioning/instances/18/settings');
+  assert.equal(ui.requests[0].credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+  for (const a of answers) assert.deepEqual(a.data.settings, { visibility: 'public' }, 'every caller got the same row');
+});
+
+test('forgetSettings makes the next read real — entry and tab return never reuse the last visit’s row', async () => {
+  // Arrange
+  const ui = boot();
+  await ui.sandbox.ensureSettings();
+
+  // Act — what loadManage does at the top of every entry + tab return pass
+  ui.sandbox.forgetSettings();
+  await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the second entry asked the server again');
+});
+
+test('a failed read can be retried — the rejection is not memoised past forgetSettings', async () => {
+  // Arrange — the outage the manage alert's "Try again" exists for
+  const ui = boot({ reject: true });
+  await assert.rejects(ui.sandbox.ensureSettings(), /network/);
+
+  // Act — the retry runs loadManage again, which forgets first
+  ui.sandbox.forgetSettings();
+  await assert.rejects(ui.sandbox.ensureSettings(), /network/);
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the retry was a real second attempt, not the stored failure');
+});
+
+test('switching projects is never served the previous project’s row', async () => {
+  // Arrange — the memo is warm for project 18
+  const ui = boot();
+  await ui.sandbox.ensureSettings();
+
+  // Act — the owner opens a different project; loadManage has not forgotten yet
+  ui.sandbox.manageId = '19';
+  await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
+  assert.equal(ui.requests[1].url, '/api/bongos/provisioning/instances/19/settings');
+});
+
+test('a refusal RESOLVES carrying its status, so each card can still say what happened', async () => {
+  // Arrange — a lapsed session: the card must offer sign-in, not report an outage
+  const ui = boot({ ok: false, status: 401, body: {} });
+
+  // Act
+  const ans = await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ans.ok, false);
+  assert.equal(ans.status, 401, 'the status reaches the card — 401 reads differently from 500');
+  assert.deepEqual(ans.data, {}, 'an empty body is an object, so a card can read through it without guarding');
+});

package/tests/module_api.mjs

@@ -25,6 +25,7 @@ const PUBLISHED_SURFACE = [
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
   'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
+  'publicProjectFeedRateLimit', // task 1002327 (ADR 0252 §5.3): the per-IP ceiling on GET /projects/featured — the platform's most expensive anonymous read (a cold call fans out to up to 500 third-party origins). One instance for the same reason as its neighbour
   'routeRankCheck', 'permissionPathCheck', // BV1.R73: kernel trust classifiers (1.6.0)
   'repoInfo', 'moduleScopeMap', 'pathMatch', // BV1.R86: kernel repo-identity + scope-wall + touches-overlap for the carved lifecycle (1.12.0)
   'goalScopeCheck', // BV1.R60: kernel scope wall for the goal-authored-task create gate (1.13.0; ADR 0086 §3)

package/tests/project_door_ui.mjs

@@ -13,6 +13,10 @@
 // the page, so the region is sliced out rather than read from a .js file, and the
 // slice boundaries are asserted so a rename can never quietly test nothing.
 //
+// Since task 1003582 the settings row is read once per manage entry by a shared
+// ensureSettings(), declared ABOVE this region — so the sandbox injects it (see
+// tests/manage_settings_shared_read.mjs for that reader's own behaviour).
+//
 // What it proves, and why each matters:
 //   • the three choices render with the goal's PLAIN interview labels
 //   • the project's CURRENT door is the preselected one — an owner opening the
@@ -105,13 +109,23 @@ function boot({ settings, options = ['public', 'private', 'stealth'], patchAnswe
   const fetch = (url, init = {}) => {
     requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
     if ((init.method || 'GET') === 'GET') {
-      return answer({ ok: true, settings, options: { visibility: options } });
+      // the row is read through ensureSettings() below — a GET arriving here
+      // means this section grew a second reader, which is the whole defect
+      throw new Error('this section reads the settings row through ensureSettings(), never its own GET');
     }
     return patchAnswer || answer({ ok: true, saved: { ...settings, visibility: JSON.parse(init.body).visibility }, push: { queued: true, message: 'Saved. Your project will restart to pick this up — until then it keeps its current setting.' } });
   };
+  // The shared read the three settings cards live off (task 1003582). Answers
+  // in ensureSettings()'s own shape — resolved, status carried, never thrown —
+  // and still records the round trip, so a card that stopped reading the row
+  // would show up here as a missing request rather than as silence.
+  const ensureSettings = () => {
+    requests.push({ url: '/api/bongos/provisioning/instances/18/settings', method: 'GET', credentials: 'same-origin' });
+    return Promise.resolve({ ok: true, status: 200, data: { settings, options: { visibility: options } } });
+  };
 
   const sandbox = {
-    $, document, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    $, document, fetch, ensureSettings, console, Promise, JSON, String, Object, Array, Error, RegExp,
     encodeURIComponent, setTimeout, clearTimeout,
     API: '/api/bongos',
     manageId: '18',

package/tests/project_takedown_lever.mjs

@@ -0,0 +1,177 @@
+// tests/project_takedown_lever.mjs — the retraction lever and its per-IP ceiling
+// (R08, task 1002327; ADR 0252 §5, corrected by ADR 0253).
+//
+// ADR 0252 §3 lets a self-hosted project put itself on the public map with NO human act,
+// and the Archon took that decision explicitly conditional on retraction shipping beside
+// it. So these are not follow-up tests — they are the tests for the half of R08 that made
+// auto-appear safe to take at all (ADR 0047: the straight-through path and its abuse
+// guard are one piece of work).
+//
+// The one that matters most is `hidden` surviving the ADR 0246 projection. ADR 0252 §5
+// asserts "no route writes [status]" and defends the takedown against the visibility
+// pull — but the pull is not the writer that undoes takedowns. `upsertOwnedProject` is,
+// and it fires on every provisioning write. Defending against the pull alone would leave
+// the lever decorative for exactly the reason the ADR gives, one writer over.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+// ESM named imports for the limiter, deliberately, and NOT createRequire: knip does not
+// trace a createRequire() call, so a core export whose only consumer is a MODULE (this one
+// is reached through the doorway, `api.publicProjectFeedRateLimit`) reads as dead code and
+// trips the dead-code ratchet. An ESM import from the test is what credits it — and the
+// test is a real consumer, so this is the honest fix rather than a baseline bump.
+import {
+  publicProjectFeedRateLimit,
+  accountExistenceReadRateLimit,
+  PROJECT_FEED_LIMIT,
+  PROJECT_FEED_WINDOW_MS,
+} from '../src/bongos/middleware/rate-limit.js';
+
+const require = createRequire(import.meta.url);
+const catalog = require('../modules/platform-identity/project-catalog.js');
+const moduleApi = require('../src/module-api.js');
+
+function recordingPool(responses = []) {
+  const calls = [];
+  const queue = [...responses];
+  return {
+    calls,
+    query(text, params) {
+      calls.push({ text, params });
+      return Promise.resolve(queue.shift() || { rows: [] });
+    },
+  };
+}
+
+// ── The lever ──
+
+test('setProjectStatus writes the status AND pins the row when hiding', async () => {
+  const pool = recordingPool([{ rows: [{ id: 4, status: 'hidden', status_pinned: true }] }]);
+  const out = await catalog.setProjectStatus(4, 'hidden', { pool });
+  assert.equal(out.status, 'hidden');
+  const { text, params } = pool.calls[0];
+  assert.match(text, /SET status = \$2/);
+  assert.match(text, /status_pinned = \(\$2 = 'hidden'\)/);
+  assert.deepEqual(params, [4, 'hidden']);
+});
+
+test('PATCHing back to active RELEASES the pin — un-hiding is as deliberate as hiding', async () => {
+  // The pin is derived from the value in the same statement, so 'active' clears it and
+  // the row returns to automatic management. A pin that only ever set would make the
+  // first takedown permanent.
+  const pool = recordingPool([{ rows: [{ id: 4, status: 'active', status_pinned: false }] }]);
+  await catalog.setProjectStatus(4, 'active', { pool });
+  assert.match(pool.calls[0].text, /status_pinned = \(\$2 = 'hidden'\)/);
+});
+
+test('an unknown status is refused before it reaches the database', async () => {
+  const pool = recordingPool();
+  await assert.rejects(() => catalog.setProjectStatus(1, 'deleted', { pool }), /unknown status/);
+  assert.equal(pool.calls.length, 0);
+});
+
+test('a missing row is null, not a silent success', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  assert.equal(await catalog.setProjectStatus(999, 'hidden', { pool }), null);
+});
+
+// ── The lever survives the writer that actually undoes takedowns ──
+
+test('the ADR 0246 projection CANNOT move status on a pinned row', async () => {
+  // The regression this exists to catch: hide a project, its owner saves any setting,
+  // the bridge re-takes the projection with status 'active', and the takedown is gone.
+  const pool = recordingPool([{ rows: [{ id: 1 }] }]);
+  await catalog.upsertOwnedProject(
+    { origin: 'https://p.example', clientId: 'p', name: 'p', ownerGithubId: 5, visibility: 'public', status: 'active' },
+    { pool },
+  );
+  const { text } = pool.calls[0];
+  assert.match(
+    text,
+    /status\s*=\s*CASE WHEN platform_identity_projects\.status_pinned/,
+    'the projection must honour the pin instead of assigning status outright',
+  );
+  assert.ok(
+    !/\bstatus\s*=\s*EXCLUDED\.status\b/.test(text),
+    'an unconditional status assignment silently reverts every takedown',
+  );
+});
+
+test('the projection stamps its rows control-plane, so the pull can never reach them', async () => {
+  const pool = recordingPool([{ rows: [{ id: 1 }] }]);
+  await catalog.upsertOwnedProject(
+    { origin: 'https://p.example', clientId: 'p', name: 'p', ownerGithubId: 5, visibility: 'private', status: 'active' },
+    { pool },
+  );
+  const { text } = pool.calls[0];
+  assert.match(text, /visibility_source/, 'the insert must record provenance');
+  assert.match(text, /visibility_source = 'control-plane'/, 'the UPDATE branch must claim the row too');
+});
+
+test('retireOwnedProject deliberately does NOT honour the pin', async () => {
+  // A re-point retirement is a SAFETY retraction: an abandoned origin left 'active' keeps
+  // drawing an orb at a host the project no longer answers on (the ADR 0181 §2 leak). A
+  // curator's 'active' pin must not be able to keep a dead origin on the map. Narrowing
+  // is always allowed; it is widening that costs.
+  const pool = recordingPool([{ rows: [{ id: 1, status: 'hidden' }] }]);
+  await catalog.retireOwnedProject({ origin: 'https://old.example', ownerGithubId: 5 }, { pool });
+  assert.ok(!/status_pinned/.test(pool.calls[0].text), 'retirement must stay unconditional');
+});
+
+// ── The ceiling ──
+
+test('the public feed limiter is ONE exported instance, not a factory (ADR 0209)', () => {
+  // Two call sites that each build their own limiter from matching config look identical
+  // in review and hand a caller double the rate. Identity is the property.
+  assert.equal(typeof publicProjectFeedRateLimit, 'function');
+  assert.equal(
+    moduleApi.publicProjectFeedRateLimit,
+    publicProjectFeedRateLimit,
+    'the doorway must re-export the SAME instance, never a copy',
+  );
+});
+
+test('the ceiling is 120 reads per 60s — the /public/* posture, stated in both halves', () => {
+  // Both numbers are asserted because both are load-bearing: the limit without the window
+  // is meaningless, and a later edit that changed only one would otherwise pass.
+  assert.equal(PROJECT_FEED_LIMIT, 120);
+  assert.equal(PROJECT_FEED_WINDOW_MS, 60 * 1000);
+});
+
+test('it refuses past the limit with the ADR 0116 envelope and a Retry-After', () => {
+  const limiter = publicProjectFeedRateLimit;
+  const headers = {};
+  let failed = null;
+  const res = {
+    set: (k, v) => { headers[k] = v; },
+    fail: (code, status, details) => { failed = { code, status, details }; },
+  };
+  const req = { ip: '203.0.113.77' };
+
+  let allowed = 0;
+  for (let i = 0; i < PROJECT_FEED_LIMIT; i++) limiter(req, res, () => { allowed++; });
+  assert.equal(allowed, PROJECT_FEED_LIMIT, 'every read inside the budget passes through');
+  assert.equal(failed, null);
+
+  limiter(req, res, () => { allowed++; });
+  assert.equal(allowed, PROJECT_FEED_LIMIT, 'the read past the ceiling must not reach the handler');
+  assert.equal(failed.code, 'rate_limited');
+  assert.equal(failed.status, 429);
+  assert.equal(headers['X-RateLimit-Scope'], 'public-project-feed');
+  assert.ok(Number(headers['Retry-After']) >= 1);
+});
+
+test('the budget is per-IP — one abusive address cannot close the map for anyone else', () => {
+  const limiter = publicProjectFeedRateLimit;
+  const res = { set: () => {}, fail: () => { throw new Error('refused'); } };
+  let ok = false;
+  limiter({ ip: '198.51.100.9' }, res, () => { ok = true; });
+  assert.equal(ok, true);
+});
+
+test('the feed limiter does NOT share the account-existence budget', () => {
+  // Separate questions get separate budgets; the ADR 0209 sharing rule is about two
+  // routes answering ONE question, which these are not.
+  assert.notEqual(publicProjectFeedRateLimit, accountExistenceReadRateLimit);
+});

package/tests/projects_hub.mjs

@@ -1449,11 +1449,33 @@ test('the in-flight line reads open_intent only, and re-asks the manifest when t
 test('the settings reads fire on entry + tab return only — never on the in-flight tick', () => {
   assert.match(SCRIPT, /if \(!keepRepo\) loadVisibility\(inst\);/);
   const load = fnHub('loadVisibility');
-  assert.match(load, /\/settings', \{ credentials: 'same-origin' \}/, 'GET /provisioning/instances/:id/settings');
-  assert.match(load, /res\.status === 401 \? signInAgain\(\)/, 'a lapsed session is said as sign-in, not as an outage');
+  assert.match(load, /ensureSettings\(\)/, 'the row comes from the shared reader, not a GET of its own');
+  assert.match(load, /ans\.status === 401 \? signInAgain\(\)/, 'a lapsed session is said as sign-in, not as an outage');
   assert.match(load, /var asked = manageId;/, 'a stale answer must never describe a newer project');
 });
 
+/* One read of the settings row per manage entry (task 1003582). Three cards
+   render three different keys out of the SAME row, and each used to fetch it
+   for itself — three identical round trips per entry, one more with every card
+   added. tests/manage_settings_shared_read.mjs proves the reader's behaviour;
+   this pins that all three cards actually go through it. */
+test('the three settings cards share ONE read of the row per manage entry', () => {
+  const ensure = fnHub('ensureSettings');
+  assert.match(ensure, /\/settings', \{ credentials: 'same-origin' \}/, 'GET /provisioning/instances/:id/settings — the one reader');
+  assert.match(ensure, /if \(settingsPromise && settingsFor === manageId\) return settingsPromise;/,
+    'memoised AND keyed on the project — a switch must never be served the last one’s row');
+  for (const fn of ['loadVisibility', 'loadJoinability', 'loadDoor']) {
+    assert.match(fnHub(fn), /ensureSettings\(\)/, `${fn} reads the row through the shared reader`);
+    assert.doesNotMatch(fnHub(fn), /fetch\(/, `${fn} fires no GET of its own`);
+  }
+  assert.match(SCRIPT, /if \(!keepRepo\) forgetSettings\(\);/,
+    'the memo is dropped on entry + tab return, so neither is ever served a cached row');
+  /* only the READS are shared: each card still writes its own key */
+  for (const fn of ['doVisSave', 'doJoinSave', 'doDoorSave']) {
+    assert.match(fnHub(fn), /method: 'PATCH'/, `${fn} still PATCHes its own key`);
+  }
+});
+
 /* ── how people join (task 1003044): the joinability toggle — the visibility
    section's shape, key for key: the choice from the platform's row, what the
    project runs from its own manifest (brand.project.joinability), the save's

package/tests/visibility_pull.mjs

@@ -0,0 +1,213 @@
+// tests/visibility_pull.mjs — the self-hosted visibility PULL (R08, task 1002327;
+// ADR 0252, corrected by ADR 0253).
+//
+// DB-free. The three properties worth a test are the three that are easy to get wrong in
+// the direction that silently breaks the map:
+//
+//   1. THE TRI-STATE DOES NOT PURGE. A project that answered once and is unreachable now
+//      keeps its door AND its stamp. The naive version — treat "no answer" as a value —
+//      quietly empties the map one outage at a time.
+//   2. THE PULL NEVER TOUCHES A CONTROL-PLANE ROW, at the decision AND in the SQL. Two
+//      writers on one column is the drift ADR 0246's projection exists to prevent.
+//   3. THE PULL NEVER MOVES `status`. This is what makes the retraction lever real
+//      (ADR 0252 §5.2) — asserted against the statement text, so adding a status write
+//      later reds this test rather than silently undoing every takedown.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const vp = require('../modules/platform-identity/visibility-pull.js');
+const feed = require('../modules/platform-identity/projects-feed.js');
+
+// A pool that records every statement and answers from a queue.
+function recordingPool(responses = []) {
+  const calls = [];
+  const queue = [...responses];
+  return {
+    calls,
+    query(text, params) {
+      calls.push({ text, params });
+      return Promise.resolve(queue.shift() || { rows: [] });
+    },
+  };
+}
+
+const manifest = (visibility) => ({ brand: { project: { visibility } } });
+
+// ── 1. What a manifest is allowed to say ──
+
+test('reads the join door from the live manifest key, which is `brand`, not `branding`', () => {
+  // ADR 0252 §2 and task 1002327's body both write `branding.project.visibility`, but
+  // buildInstanceManifest projects the pack under `brand`. Reading only the documented
+  // spelling would have made every pull a silent no-verdict — the failure that looks
+  // exactly like "no self-hosted project ever reports".
+  assert.equal(vp.visibilityFromManifest({ brand: { project: { visibility: 'private' } } }), 'private');
+  assert.equal(vp.visibilityFromManifest({ branding: { project: { visibility: 'private' } } }), 'private');
+});
+
+test('an off-vocabulary or absent answer is NO VERDICT, never a default', () => {
+  // Defaulting to 'public' would let a project that said nothing be read as having asked
+  // to be on the map — ADR 0252 §2's "no verdict, never a default".
+  for (const body of [
+    {}, null, undefined,
+    { brand: {} },
+    { brand: { project: {} } },
+    { brand: { project: { visibility: 'unlisted' } } },
+    { brand: { project: { visibility: 'PUBLIC' } } },   // case is not normalised away
+    { brand: { project: { visibility: 42 } } },
+    { brand: { project: { visibility: { public: true } } } },
+  ]) {
+    assert.equal(vp.visibilityFromManifest(body), null, `expected no verdict for ${JSON.stringify(body)}`);
+  }
+});
+
+test('the channel carries visibility ONLY — no name, tagline or art can ride it', () => {
+  // ADR 0252 §7: today no project owner controls a free-text field that reaches the
+  // public feed. A visibility report is not the place to spend that property.
+  const out = vp.visibilityFromManifest({
+    brand: { project: { visibility: 'public' }, identity: { productName: 'Injected' } },
+    name: 'Injected', tagline: 'Injected', art_url: 'https://evil.example/x.png',
+  });
+  assert.equal(out, 'public');
+  assert.equal(typeof out, 'string');
+});
+
+// ── 2. The tri-state ──
+
+test('never read + no answer => stays dark; nothing is written', () => {
+  const d = vp.pullDecision({ visibility: 'public', visibility_reported_at: null, visibility_source: null }, null);
+  assert.equal(d.write, false);
+  assert.equal(d.reason, 'never_reported');
+});
+
+test('READ BEFORE + unreachable now => KEEPS its last state and its stamp', () => {
+  // The load-bearing half of the tri-state. A project does not leave the map because its
+  // server was down for one sweep (ADR 0199 / 0226). Implemented as "write nothing",
+  // which is also what keeps `visibility_reported_at` meaning LAST SUCCESSFUL read.
+  const row = { visibility: 'public', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  const d = vp.pullDecision(row, null);
+  assert.equal(d.write, false);
+  assert.equal(d.reason, 'unreachable_keeps_last_state');
+});
+
+test('a NARROWING report is applied immediately — hiding yourself needs no trust', () => {
+  const row = { visibility: 'public', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  const d = vp.pullDecision(row, 'stealth');
+  assert.deepEqual(d, { write: true, visibility: 'stealth' });
+});
+
+test('a WIDENING report is applied too — the pull is the door\'s only source for these rows', () => {
+  const row = { visibility: 'stealth', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  assert.deepEqual(vp.pullDecision(row, 'public'), { write: true, visibility: 'public' });
+});
+
+test('an unchanged answer writes nothing, so a sweep cannot churn feed ordering', () => {
+  // listPublicProjects orders on updated_at, so bumping it every 15 minutes would make a
+  // row's position on the map track the sweep clock instead of the project.
+  const row = { visibility: 'public', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  assert.equal(vp.pullDecision(row, 'public').write, false);
+});
+
+test('a first successful read DOES write, even when the value equals the column default', () => {
+  // The row starts at the NOT NULL DEFAULT 'public' with no stamp. Treating that as
+  // "unchanged" would leave visibility_reported_at NULL forever, so the project would
+  // stay dark matter no matter how many times it answered — the bug the `visibility_source
+  // === 'pull'` half of the unchanged-check exists to prevent.
+  const row = { visibility: 'public', visibility_reported_at: null, visibility_source: null };
+  assert.deepEqual(vp.pullDecision(row, 'public'), { write: true, visibility: 'public' });
+});
+
+// ── 3. The two writers never share a row ──
+
+test('a control-plane row is refused at the decision, whatever it reports', () => {
+  for (const reported of ['public', 'private', 'stealth', null]) {
+    const d = vp.pullDecision({ visibility: 'private', visibility_source: 'control-plane' }, reported);
+    assert.equal(d.write, false);
+    assert.equal(d.reason, 'control_plane_row');
+  }
+});
+
+test('the exclusion is ALSO in the SQL, at both the read and the write', async () => {
+  // A bridge projection can land between the SELECT and the UPDATE, so the invariant has
+  // to hold at the write, not merely at the read. `IS DISTINCT FROM` and not `<>`: a NULL
+  // source is the unclaimed state, and plain inequality drops exactly those rows.
+  assert.match(vp.PULLABLE_SQL, /IS DISTINCT FROM 'control-plane'/);
+
+  const readPool = recordingPool([{ rows: [] }]);
+  await vp.pullableProjects({ pool: readPool });
+  assert.ok(readPool.calls[0].text.includes(vp.PULLABLE_SQL), 'the read must filter on PULLABLE_SQL');
+
+  const writePool = recordingPool([{ rows: [{ id: 1 }] }]);
+  await vp.recordVisibilityPull(1, 'public', { pool: writePool });
+  assert.ok(writePool.calls[0].text.includes(vp.PULLABLE_SQL), 'the write must re-assert PULLABLE_SQL');
+});
+
+test('the write refuses an off-vocabulary value rather than trusting its caller', async () => {
+  const pool = recordingPool();
+  await assert.rejects(() => vp.recordVisibilityPull(1, 'unlisted', { pool }), /off-vocabulary/);
+  assert.equal(pool.calls.length, 0, 'nothing may reach the database');
+});
+
+// ── 4. The pull may not move `status` ──
+
+test('NO statement in the pull writes `status` — the retraction lever stays real', async () => {
+  // ADR 0252 §5.2: a retracted project that keeps reporting `public` STAYS hidden. The
+  // cheapest possible proof is that the column never appears in a write this file issues.
+  const pool = recordingPool([{ rows: [{ id: 7 }] }]);
+  await vp.recordVisibilityPull(7, 'public', { pool });
+  const sql = pool.calls.map((c) => c.text).join('\n');
+  assert.ok(!/\bSET\b[\s\S]*\bstatus\b/.test(sql), `a pull statement writes status:\n${sql}`);
+  assert.ok(!/status_pinned/.test(sql), 'a pull may not touch the takedown latch either');
+});
+
+// ── 5. End to end, and the failure isolation the sweep depends on ──
+
+test('an unreachable instance is a no-verdict, not a crash and not a value', async () => {
+  const pool = recordingPool();
+  const out = await vp.pullOne(
+    { id: 1, origin: 'https://a.example', visibility: 'public', visibility_reported_at: new Date(), visibility_source: 'pull' },
+    { pool, fetchVisibility: async () => { throw new Error('ECONNREFUSED'); } },
+  );
+  assert.equal(out.written, false);
+  assert.equal(out.reason, 'unreachable_keeps_last_state');
+  assert.equal(pool.calls.length, 0, 'a failed read must not write');
+});
+
+test('one hostile instance does not stop the sweep reading the others', async () => {
+  const rows = [
+    { id: 1, origin: 'https://bad.example', visibility: 'public', visibility_reported_at: null, visibility_source: null },
+    { id: 2, origin: 'https://good.example', visibility: 'public', visibility_reported_at: null, visibility_source: null },
+  ];
+  const pool = recordingPool([{ rows }, { rows: [{ id: 2 }] }]);
+  const out = await vp.sweepVisibilityOnce({
+    pool,
+    fetchVisibility: async (origin) => {
+      if (origin === 'https://bad.example') throw new Error('boom');
+      return manifest('stealth');
+    },
+  });
+  assert.equal(out.scanned, 2);
+  assert.equal(out.updated, 1);
+  assert.equal(out.results[1].visibility, 'stealth');
+});
+
+// ── 6. The feed predicate, and the trap it would be without its scoping ──
+
+test('the map predicate admits a control-plane row with no stamp — ADR 0247 D4\'s trap', () => {
+  // Every row on the live table has visibility_reported_at NULL, because the column is
+  // new. A predicate that required a stamp of EVERY row would empty the public map on
+  // deploy — the exact shape ADR 0247 D4 found live, one column over. The
+  // `visibility_source = 'control-plane'` disjunct plus migration 020's backfill are what
+  // keep the default scoped to rows that have genuinely never answered.
+  assert.match(feed.DOOR_KNOWN_SQL, /visibility_source = 'control-plane'/);
+  assert.match(feed.DOOR_KNOWN_SQL, /visibility_reported_at IS NOT NULL/);
+  assert.match(feed.DOOR_KNOWN_SQL, /\bOR\b/, 'the two halves must be a disjunction, not a conjunction');
+});
+
+test('the public feed actually carries the predicate', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  await feed.listPublicProjects({ pool });
+  assert.ok(pool.calls[0].text.includes(feed.DOOR_KNOWN_SQL), 'listPublicProjects must join DOOR_KNOWN_SQL');
+});

package/tests/visible_projects_feed.mjs

@@ -256,9 +256,20 @@ async function callFeaturedFeed(rows) {
     let body = null;
     const res = {
       json: (b) => { body = b; },
+      set: () => {},
       fail: (code, detail) => { throw new Error(`route failed: ${code} ${JSON.stringify(detail)}`); },
     };
-    await layer.route.stack[0].handle({}, res, () => {});
+    // Drive the WHOLE stack, not stack[0]. Since task 1002327 the per-IP feed limiter
+    // sits in front of the handler (ADR 0252 §5.3), so calling the first entry alone
+    // would exercise the ceiling and never reach the route — and, worse, would keep
+    // passing as a silent no-op if the handler were ever removed. A fresh req per call
+    // keeps each test's reads out of the previous one's budget.
+    const req = { ip: `198.51.100.${Math.floor(Math.random() * 200) + 1}` };
+    for (const entry of layer.route.stack) {
+      let advanced = false;
+      await entry.handle(req, res, () => { advanced = true; });
+      if (!advanced) break;   // something short-circuited (a refusal), or it was the handler
+    }
     return { body, askedFor };
   } finally {
     pi.listPublicProjects = savedList;