@bongos/core 1.19.565 → 1.19.566

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.565",
-  "core_contract": "1.19.565",
-  "source_commit": "d4d7fdc583b75f4519d2f284349c53475e27f8dc",
+  "core_version": "1.19.566",
+  "core_contract": "1.19.566",
+  "source_commit": "b344a2bcd27acb87fd8d8bcac11241639954f7be",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T19:48:06.968Z",
+  "built_at": "2026-09-06T20:04:22.237Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 446,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2034,
+    "functional_verbatim": 2035,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2504,
-  "tree_sha256": "32eef9b483861a2a84b7778a4fb37713f88901efef248266aaa73c278a519d2b",
+  "file_count": 2505,
+  "tree_sha256": "b8a38f68a219ad5d19cb432356353fa520857e09c5a5a8726caa463e577a99c1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2672,7 +2672,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "17b7c3671b0652839a0983e0cbee2b00ca2438cb90e5d79771a1c7dd9415e64f"
+      "sha256": "7073e3d898b2a0d80c9cad6f2ed3a142f2071b9cd4095dae8c580acb2f2095e3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6772,7 +6772,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "edc38e4ae7859c1dfc5422a4a0351c10f31cf119cab878dae0e25461c6121578"
+      "sha256": "7aa74c059670bd351bf8a4295e408aef4a908e3095711aee93f75408ccd837d5"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7517,12 +7517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "405ae99d31e8bad9522feb9eeaa8adf7154d0c018d2ea8a88661391e0ff512f6"
+      "sha256": "319b45c1535e293ea0c0223c730ec9a08b1059469eb86edc61d3c3d8b9976eee"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8766e1ea5753cf0dcc31419c38775984d84fed2170f81cc6ce715d87471c9ec8"
+      "sha256": "3884c6ddda900305c539824babe08c00fbf942a50c5f7c23bd805d674cae32dc"
     },
     {
       "path": "public-docs/index.html",
@@ -9222,7 +9222,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6571323e133d1a8ce8cb6ecf15a668b0482c40352d64b0543739ba7407ae1da8"
+      "sha256": "feb3d851877e533d53226ddb6b71bf5d2aa5a47c3a9b38d2bd4801d3a1e8a64b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11114,6 +11114,11 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/manage_settings_shared_read.mjs",
+      "mode": "0000644",
+      "sha256": "68a429b47a1ca36a41433c0d8c3298a0f54745a19b050675aedba658a2cea0ef"
+    },
     {
       "path": "tests/me_ship_days_bound.mjs",
       "mode": "0000644",
@@ -11507,7 +11512,7 @@
     {
       "path": "tests/project_door_ui.mjs",
       "mode": "0000644",
-      "sha256": "29f59ab64b231a7ec5d17a3e784d451f75d80c19efd4cb6a523d263e8f88b581"
+      "sha256": "97d570d16414bb5c71d54223702058018a13c58cdf563448c7d28e2fcf80488e"
     },
     {
       "path": "tests/project_invite_ownership.mjs",
@@ -11562,7 +11567,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "56b1ecd69244798b704b787e13fd9fc74ec07e575a847ef6603df7430b63a51e"
+      "sha256": "f93044429430c9fff4fe6860bae87ff8f67bc49a485391e659422e63f209e08c"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",

package/docs/module-api-changelog.md

@@ -1579,5 +1579,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.563 with no explicit bump. run 34052578659. (task 1002620)
   1.19.565 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.564 with no explicit bump. run 34055981223. (task 1002620)
+  1.19.566 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.565 with no explicit bump. run 34056809932. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/public-landing/public/projects.html

@@ -5586,7 +5586,10 @@ summary{min-height:24px;padding:3px 0;}
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
         /* the settings row + the project's own manifest — the same cadence as
-           the GitHub read: entry + tab return, never the in-flight tick */
+           the GitHub read: entry + tab return, never the in-flight tick. The
+           three cards below share ONE read of the row (task 1003582), so
+           dropping the memo here is what keeps each entry a fresh read */
+        if (!keepRepo) forgetSettings();
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
         if (!keepRepo) loadDoor();
@@ -5936,30 +5939,67 @@ summary{min-height:24px;padding:3px 0;}
       .then(function () { if (timer) clearTimeout(timer); });
   }
 
+  /* ── the settings row, read ONCE per manage entry (task 1003582) ─────────
+     Three cards render off the SAME row — how the project is reached
+     (platform_visibility), how people join (joinability), and its door on the
+     map (visibility) — and each used to GET it for itself: three identical
+     round trips on every entry, growing by one with each card added.
+
+     Memoised like ensureModsCatalog()/ensureBundles(), with the one difference
+     that matters: those hold a catalog nothing rewrites, this holds a
+     per-project row every card's Save rewrites. So the memo is keyed on the
+     project AND dropped by forgetSettings() at the top of each entry pass —
+     nothing else may reuse it, or a card would paint a row the owner has since
+     changed. The saves stay separate: each card still PATCHes its own key.
+
+     It RESOLVES with the whole answer, status included, rather than throwing on
+     a refusal — each card keeps writing its own line for a lapsed session vs.
+     an outage. A transport failure still rejects, and every consumer catches it
+     privately, so one card's failure never silences its siblings. */
+  var settingsPromise = null;
+  var settingsFor = null;   /* which project the memo holds — a switch must not reuse it */
+
+  function ensureSettings() {
+    if (settingsPromise && settingsFor === manageId) return settingsPromise;
+    settingsFor = manageId;
+    settingsPromise = fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        return jsonOrEmpty(res).then(function (data) {
+          return { ok: res.ok, status: res.status, data: data || {} };
+        });
+      });
+    return settingsPromise;
+  }
+
+  /* Drop the memo so the next ensureSettings() is a real read. This is also
+     what makes the alert's "Try again" work: a rejected promise left memoised
+     would keep answering with the failure forever. */
+  function forgetSettings() { settingsPromise = null; settingsFor = null; }
+
   function loadVisibility(inst) {
     mVisSettings = null; mVisRunsHtml = ''; mVisPushSeen = false;
     visMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mVisSettings = {
-              value: (data.settings || {}).platform_visibility,
-              options: (data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
-            };
-            renderVis();
-            /* while a push is open the line is the intent's — the manifest is
-               asked the moment it settles (renderVisState), not now */
-            if (!visPushOpen(inst)) loadVisRuns(inst);
-            return;
-          }
-          visMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mVisSettings = {
+            value: (ans.data.settings || {}).platform_visibility,
+            options: (ans.data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
+          };
+          renderVis();
+          /* while a push is open the line is the intent's — the manifest is
+             asked the moment it settles (renderVisState), not now */
+          if (!visPushOpen(inst)) loadVisRuns(inst);
+          return;
+        }
+        visMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        /* the read is shared now, so its rejection reaches all three cards —
+           each one still only speaks for the project it was asked about */
+        if (asked !== manageId) return;
         visMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }
@@ -6313,24 +6353,22 @@ summary{min-height:24px;padding:3px 0;}
     mJoinSettings = null; mJoinRunsHtml = ''; mJoinPushSeen = false;
     joinMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mJoinSettings = {
-              value: (data.settings || {}).joinability,
-              options: (data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
-            };
-            renderJoin();
-            if (!visPushOpen(inst)) loadJoinRuns(inst);
-            return;
-          }
-          joinMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mJoinSettings = {
+            value: (ans.data.settings || {}).joinability,
+            options: (ans.data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
+          };
+          renderJoin();
+          if (!visPushOpen(inst)) loadJoinRuns(inst);
+          return;
+        }
+        joinMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        if (asked !== manageId) return;
         joinMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }
@@ -6539,23 +6577,21 @@ summary{min-height:24px;padding:3px 0;}
     mDoorSettings = null;
     doorMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mDoorSettings = {
-              value: (data.settings || {}).visibility,
-              options: (data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
-            };
-            renderDoor();
-            return;
-          }
-          doorMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mDoorSettings = {
+            value: (ans.data.settings || {}).visibility,
+            options: (ans.data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
+          };
+          renderDoor();
+          return;
+        }
+        doorMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        if (asked !== manageId) return;
         doorMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.565",
+  "version": "1.19.566",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.565",
+      "version": "1.19.566",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.565",
+  "version": "1.19.566",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.565'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.566'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/manage_settings_shared_read.mjs

@@ -0,0 +1,146 @@
+// tests/manage_settings_shared_read.mjs — one read of the project's settings
+// row per manage entry, EXECUTED (task 1003582).
+//
+// The defect this pins shut: entering /projects?view=manage fired
+// GET /provisioning/instances/:id/settings three times in a row, because the
+// three cards that render off that row — how the project is reached, how people
+// join, and its door on the map — each fetched it for themselves. Three round
+// trips and three DB reads for one row, growing by one with every settings-
+// backed card added to the page.
+//
+// tests/projects_hub.mjs pins that all three cards go through the shared
+// reader; this file lifts the reader itself out of modules/public-landing/
+// public/projects.html, runs it in a vm under a scripted fetch, and counts the
+// round trips. The vm-harness precedent is tests/project_door_ui.mjs.
+//
+// What it proves, and why each matters:
+//   • three callers in one entry cost ONE round trip — the defect itself
+//   • forgetSettings() makes the next read real, so entry and tab return each
+//     see the row as it is now, never the one from the last visit
+//   • that is also what lets the alert's "Try again" retry after a failure: a
+//     rejected promise left memoised would answer with the failure forever
+//   • switching projects is never served the previous project's row, even with
+//     the memo still warm — the cache is keyed on the project, not just present
+//   • a refusal RESOLVES carrying its status, so each card can still tell a
+//     lapsed session apart from an outage in its own words
+//
+// Run:  node --test --test-reporter=tap tests/manage_settings_shared_read.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The reader, sliced from the page verbatim. Both boundaries are asserted so a
+// rename cannot leave this file executing an empty string and passing.
+const START = SCRIPT.indexOf('  var settingsPromise = null;');
+const END = SCRIPT.indexOf('  function loadVisibility(');
+assert.ok(START > 0, 'the shared reader must start at its memo declaration');
+assert.ok(END > START, 'the shared reader must sit above its first consumer');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureSettings(', 'function forgetSettings(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the harness ──────────────────────────────────────────────────────────────
+// Narrow on purpose: the region touches fetch, jsonOrEmpty, API and manageId,
+// and nothing else — so the stub stays honest about what it can prove.
+
+function boot({ ok = true, status = 200, body = { settings: { visibility: 'public' } }, reject = false } = {}) {
+  const requests = [];
+  const sandbox = {
+    Promise, JSON, String, Object, Error, encodeURIComponent,
+    API: '/api/bongos',
+    manageId: '18',
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    fetch: (url, init = {}) => {
+      requests.push({ url, credentials: init.credentials });
+      return reject ? Promise.reject(new Error('network')) : Promise.resolve({ ok, status, _json: body });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#shared-settings-read' });
+
+  const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
+  return { requests, sandbox, settle };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the three cards of one manage entry cost ONE round trip, not three', async () => {
+  // Arrange — the page's own entry pass: three readers, back to back
+  const ui = boot();
+
+  // Act
+  const answers = await Promise.all([
+    ui.sandbox.ensureSettings(),
+    ui.sandbox.ensureSettings(),
+    ui.sandbox.ensureSettings(),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 1, 'one GET served all three cards');
+  assert.equal(ui.requests[0].url, '/api/bongos/provisioning/instances/18/settings');
+  assert.equal(ui.requests[0].credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+  for (const a of answers) assert.deepEqual(a.data.settings, { visibility: 'public' }, 'every caller got the same row');
+});
+
+test('forgetSettings makes the next read real — entry and tab return never reuse the last visit’s row', async () => {
+  // Arrange
+  const ui = boot();
+  await ui.sandbox.ensureSettings();
+
+  // Act — what loadManage does at the top of every entry + tab return pass
+  ui.sandbox.forgetSettings();
+  await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the second entry asked the server again');
+});
+
+test('a failed read can be retried — the rejection is not memoised past forgetSettings', async () => {
+  // Arrange — the outage the manage alert's "Try again" exists for
+  const ui = boot({ reject: true });
+  await assert.rejects(ui.sandbox.ensureSettings(), /network/);
+
+  // Act — the retry runs loadManage again, which forgets first
+  ui.sandbox.forgetSettings();
+  await assert.rejects(ui.sandbox.ensureSettings(), /network/);
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the retry was a real second attempt, not the stored failure');
+});
+
+test('switching projects is never served the previous project’s row', async () => {
+  // Arrange — the memo is warm for project 18
+  const ui = boot();
+  await ui.sandbox.ensureSettings();
+
+  // Act — the owner opens a different project; loadManage has not forgotten yet
+  ui.sandbox.manageId = '19';
+  await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
+  assert.equal(ui.requests[1].url, '/api/bongos/provisioning/instances/19/settings');
+});
+
+test('a refusal RESOLVES carrying its status, so each card can still say what happened', async () => {
+  // Arrange — a lapsed session: the card must offer sign-in, not report an outage
+  const ui = boot({ ok: false, status: 401, body: {} });
+
+  // Act
+  const ans = await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ans.ok, false);
+  assert.equal(ans.status, 401, 'the status reaches the card — 401 reads differently from 500');
+  assert.deepEqual(ans.data, {}, 'an empty body is an object, so a card can read through it without guarding');
+});

package/tests/project_door_ui.mjs

@@ -13,6 +13,10 @@
 // the page, so the region is sliced out rather than read from a .js file, and the
 // slice boundaries are asserted so a rename can never quietly test nothing.
 //
+// Since task 1003582 the settings row is read once per manage entry by a shared
+// ensureSettings(), declared ABOVE this region — so the sandbox injects it (see
+// tests/manage_settings_shared_read.mjs for that reader's own behaviour).
+//
 // What it proves, and why each matters:
 //   • the three choices render with the goal's PLAIN interview labels
 //   • the project's CURRENT door is the preselected one — an owner opening the
@@ -105,13 +109,23 @@ function boot({ settings, options = ['public', 'private', 'stealth'], patchAnswe
   const fetch = (url, init = {}) => {
     requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
     if ((init.method || 'GET') === 'GET') {
-      return answer({ ok: true, settings, options: { visibility: options } });
+      // the row is read through ensureSettings() below — a GET arriving here
+      // means this section grew a second reader, which is the whole defect
+      throw new Error('this section reads the settings row through ensureSettings(), never its own GET');
     }
     return patchAnswer || answer({ ok: true, saved: { ...settings, visibility: JSON.parse(init.body).visibility }, push: { queued: true, message: 'Saved. Your project will restart to pick this up — until then it keeps its current setting.' } });
   };
+  // The shared read the three settings cards live off (task 1003582). Answers
+  // in ensureSettings()'s own shape — resolved, status carried, never thrown —
+  // and still records the round trip, so a card that stopped reading the row
+  // would show up here as a missing request rather than as silence.
+  const ensureSettings = () => {
+    requests.push({ url: '/api/bongos/provisioning/instances/18/settings', method: 'GET', credentials: 'same-origin' });
+    return Promise.resolve({ ok: true, status: 200, data: { settings, options: { visibility: options } } });
+  };
 
   const sandbox = {
-    $, document, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    $, document, fetch, ensureSettings, console, Promise, JSON, String, Object, Array, Error, RegExp,
     encodeURIComponent, setTimeout, clearTimeout,
     API: '/api/bongos',
     manageId: '18',

package/tests/projects_hub.mjs

@@ -1449,11 +1449,33 @@ test('the in-flight line reads open_intent only, and re-asks the manifest when t
 test('the settings reads fire on entry + tab return only — never on the in-flight tick', () => {
   assert.match(SCRIPT, /if \(!keepRepo\) loadVisibility\(inst\);/);
   const load = fnHub('loadVisibility');
-  assert.match(load, /\/settings', \{ credentials: 'same-origin' \}/, 'GET /provisioning/instances/:id/settings');
-  assert.match(load, /res\.status === 401 \? signInAgain\(\)/, 'a lapsed session is said as sign-in, not as an outage');
+  assert.match(load, /ensureSettings\(\)/, 'the row comes from the shared reader, not a GET of its own');
+  assert.match(load, /ans\.status === 401 \? signInAgain\(\)/, 'a lapsed session is said as sign-in, not as an outage');
   assert.match(load, /var asked = manageId;/, 'a stale answer must never describe a newer project');
 });
 
+/* One read of the settings row per manage entry (task 1003582). Three cards
+   render three different keys out of the SAME row, and each used to fetch it
+   for itself — three identical round trips per entry, one more with every card
+   added. tests/manage_settings_shared_read.mjs proves the reader's behaviour;
+   this pins that all three cards actually go through it. */
+test('the three settings cards share ONE read of the row per manage entry', () => {
+  const ensure = fnHub('ensureSettings');
+  assert.match(ensure, /\/settings', \{ credentials: 'same-origin' \}/, 'GET /provisioning/instances/:id/settings — the one reader');
+  assert.match(ensure, /if \(settingsPromise && settingsFor === manageId\) return settingsPromise;/,
+    'memoised AND keyed on the project — a switch must never be served the last one’s row');
+  for (const fn of ['loadVisibility', 'loadJoinability', 'loadDoor']) {
+    assert.match(fnHub(fn), /ensureSettings\(\)/, `${fn} reads the row through the shared reader`);
+    assert.doesNotMatch(fnHub(fn), /fetch\(/, `${fn} fires no GET of its own`);
+  }
+  assert.match(SCRIPT, /if \(!keepRepo\) forgetSettings\(\);/,
+    'the memo is dropped on entry + tab return, so neither is ever served a cached row');
+  /* only the READS are shared: each card still writes its own key */
+  for (const fn of ['doVisSave', 'doJoinSave', 'doDoorSave']) {
+    assert.match(fnHub(fn), /method: 'PATCH'/, `${fn} still PATCHes its own key`);
+  }
+});
+
 /* ── how people join (task 1003044): the joinability toggle — the visibility
    section's shape, key for key: the choice from the platform's row, what the
    project runs from its own manifest (brand.project.joinability), the save's