@bongos/core 1.19.584 → 1.19.585

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.584",
-  "core_contract": "1.19.584",
-  "source_commit": "7c7b294c8826106fad152689caf15014afbaf444",
+  "core_version": "1.19.585",
+  "core_contract": "1.19.585",
+  "source_commit": "9352691bb382c387bdccba87b372194ba8c689b0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T21:57:27.222Z",
+  "built_at": "2026-09-07T22:05:13.505Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 453,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2056,
+    "functional_verbatim": 2057,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2533,
-  "tree_sha256": "1091075083386a5cf37d1f5736153ed4f8cb23a152f278b1120d408446e48f14",
+  "file_count": 2534,
+  "tree_sha256": "afd5fa885788c749e7a91e2ae3761266dc7c5ebe26278185542576129ecf7dd2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2707,7 +2707,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2e124b22362c309eb08016d25db0dfbcd5d7ee2930db895c21b5053a4565a782"
+      "sha256": "0aaa401d7dc70186f6b739772f0411eb9458e93e3266d1d4301e212ee7d9473b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6572,7 +6572,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "51dc6eac59a85e24336597e554e84c7e76294e389b443cc40dd4e75b1684079d"
+      "sha256": "17637a0fd4eafddcd3235dec51c0ff196a8b39360918ab7a4c0370fc21d3a20f"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -6832,7 +6832,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "79b713d994571f5f2405605fa19bd1b0ec05546f2ff606227afa9c91392bd969"
+      "sha256": "9c3a537d8c0ae0e5d8ddcdf2c69a859e1c72647203c8b177cc282dcad0c97e7f"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7577,12 +7577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1dedc1b50a922313443c0c20150eb85bff94a6b56d86009a39084220724e3080"
+      "sha256": "995314658da0abc7f33ea3719d38b99ee78336573d89c5af94b6a752bb840ea4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "03cb18f378e3d31ff342f11c865a8a97a9c08a1b6be530e35ca89fcb50632b3d"
+      "sha256": "d48fe5ff721c79f7f5673e1c1a9fa8aff96c5bc0bb86af3795ec5b6bb15f0fe9"
     },
     {
       "path": "public-docs/index.html",
@@ -9292,7 +9292,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "21ef11c8ad8fe92b37ecb6279f79cbbf8d61a25283bb2623d50cf6db210414f7"
+      "sha256": "1f7f432992c33dfa9ab9c06722b952fd6f4ae1239b3ddb591be5f1c72ae77319"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10914,6 +10914,11 @@
       "mode": "0000644",
       "sha256": "7d384cd84cdc93b8e7b57df291a4600a40f43346fd2a52168324ecde219f1388"
     },
+    {
+      "path": "tests/hub_map_orb_states.mjs",
+      "mode": "0000644",
+      "sha256": "cdbee4e7f252f01e4a72feb1b63a5e340d1110c3f7a88aa6db77da95bc1268cb"
+    },
     {
       "path": "tests/hub_profile_leak.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1617,5 +1617,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.582 with no explicit bump. run 34162998083. (task 1002620)
   1.19.584 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.583 with no explicit bump. run 34164936809. (task 1002620)
+  1.19.585 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.584 with no explicit bump. run 34165392436. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/public-landing/public/assets/cosmos.css

@@ -50,6 +50,10 @@
 
   /* the gate's locked space palette (dark mode's sky) */
   --space-deep:#05060f; --space-mid:#0a0c20; --space-high:#0d0f28; --nebula:#2b2456;
+  /* the black hole's interior (task 1002328) — the one colour that is NOT
+     theme-relative: a black hole is the absence of a surface in either sky, so it
+     is declared once here and never restated dark. Explore's own --orb-void. */
+  --orb-void:#0b0b10;
   --sun-lit:#fb923c; --gold:#ffd98a; --gold-soft:#f6c976;
 
   /* semantic state tier — each is painted as 12px/700 chip TEXT on its own
@@ -822,6 +826,60 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .worldOrb[data-material="obsidian"][data-shape="blob"]{--tpl-src:var(--plate-obsidian-blob-cut);--tpl-ar:.794;--tpl-zoom:1.55448;--tpl-px:-.2697;--tpl-py:-.15965;}
 .worldOrb[data-material="obsidian"][data-shape="pair"]{--tpl-src:var(--plate-obsidian-pair-cut);--tpl-ar:2.23705;--tpl-zoom:1.0248;--tpl-px:-.01015;--tpl-py:-.30191;}
 .worldOrb[data-material="obsidian"][data-shape="bead"]{--tpl-src:var(--plate-obsidian-bead-cut);--tpl-ar:1.0027;--tpl-zoom:1.34698;--tpl-px:-.17053;--tpl-py:-.17255;}
+/* ── THE VISIBILITY RENDER-TYPE (data-orb), a SECOND axis over the planet above
+   (BV1.R09, task 1002328; ADR 0182 D1, criterion proj-visibility-states). The
+   planet is what a project LOOKS like — the owner's chosen shape and material.
+   This is what its door SAYS, derived server-side and read off the feed. The
+   three readings are the Explore page's (task 1002326, modules/status-ui/public/
+   explore.html), so the two in-repo surfaces that draw this feed agree.
+
+   PUBLIC is the baseline and takes no rule: the planet as drawn is the public
+   planet. Only the two states that differ from it declare anything here. ── */
+
+/* PRIVATE — a star: visible from anywhere, with no surface to land on. The object
+   keeps its own artwork and its own name (D1: private is on the map UNDER its
+   name; what it withholds is the door, not the identity) and gains a star's light.
+   A drop-shadow on the disc's own filter, the .worldOrb.match idiom below: the
+   object is a MASK, so an outline or a box-shadow would be clipped away. Composed
+   after the contact shadow, which dark states as a no-op filter for this reason.
+
+   Carried as a VARIABLE rather than written into the filter directly, because the
+   search spotlight below sets `filter` on the same element and is later in the
+   cascade: written inline it would be clobbered, and a private project would
+   quietly draw as a planet for as long as a query matched it. */
+.worldOrb[data-orb="star"]{
+  --star-light:drop-shadow(0 0 7px color-mix(in srgb,var(--acc,var(--accent)) 75%,transparent))
+    drop-shadow(0 0 20px color-mix(in srgb,var(--acc,var(--accent)) 40%,transparent));}
+.worldOrb[data-orb="star"] .disc{filter:var(--orb-shadow) var(--star-light);}
+/* the corona sits BEHIND the object (the relationship ring's grammar, z-index:-1),
+   so the star reads as a point of light the object is standing in */
+.worldOrb[data-orb="star"] .disc::after{content:"";position:absolute;
+  left:50%;top:50%;width:calc(100% + 34px);aspect-ratio:1;translate:-50% -50%;border-radius:50%;z-index:-1;
+  background:radial-gradient(circle,color-mix(in srgb,var(--acc,var(--accent)) 26%,transparent) 0 34%,transparent 70%);}
+/* the ring wins the ::after when the viewer owns or builds on the project — the
+   relationship is the more useful thing to say, and the glow above still reads */
+.worldOrb[data-orb="star"][data-rel="owner"] .disc::after,
+.worldOrb[data-orb="star"][data-rel="builder"] .disc::after{background:none;}
+
+/* STEALTH — a black hole: existence without identity. The object is REPLACED, not
+   decorated: ::before is where the planet plate is painted, so switching it off is
+   what makes this the one orb on the map carrying no artwork. Nothing here reads a
+   per-project value — every black hole is drawn identically, on the page's own
+   accent, because interchangeable is the whole point of the metaphor (D2a). With
+   the mask gone a box-shadow is no longer clipped, so the ring is a real ring. */
+.worldOrb[data-orb="black-hole"]{cursor:default;}
+.worldOrb[data-orb="black-hole"] .disc{border-radius:50%;background:var(--orb-void);
+  box-shadow:0 0 0 1.5px var(--accent),0 0 14px 2px color-mix(in srgb,var(--accent) 55%,transparent);}
+.worldOrb[data-orb="black-hole"] .disc::before{display:none;}
+/* it does not rise to meet the pointer: there is nothing behind it to open */
+.worldOrb[data-orb="black-hole"]:hover .disc{translate:none;}
+/* the placeholder name is not a project's name, and does not dress as one */
+.worldOrb[data-orb="black-hole"] .nm{color:var(--ink-soft);font-style:italic;}
+/* the table's anonymous row: same rule, and no pointer, since the row's click
+   target (its address) is exactly what the row does not have */
+.tbl .tblRow.anon{cursor:default;}
+.tbl .tblRow.anon .ptitle{color:var(--ink-soft);font-style:italic;}
+
 /* the relationship ring: yours takes the accent (the one live thing about the
    orb); building there is a hairline of it */
 .worldOrb[data-rel="owner"] .disc::after,.worldOrb[data-rel="builder"] .disc::after{content:"";position:absolute;
@@ -986,8 +1044,12 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* the spotlight is a drop-shadow in the accent on the disc's own filter — a
    glow that follows the silhouette (the object is a mask, so an outline or a
    box-shadow would be clipped away). Composed after the contact shadow, which
-   dark states as a no-op filter for exactly this. */
-.worldOrb.match .disc{filter:var(--orb-shadow) drop-shadow(0 0 16px color-mix(in srgb,var(--acc,var(--accent)) 60%,transparent));}
+   dark states as a no-op filter for exactly this.
+
+   A star composes its own light in after the spotlight (--star-light, set above;
+   the empty fallback makes this a no-op for every other orb), so a private project
+   the query matched does not stop looking private for as long as it matches. */
+.worldOrb.match .disc{filter:var(--orb-shadow) drop-shadow(0 0 16px color-mix(in srgb,var(--acc,var(--accent)) 60%,transparent)) var(--star-light,);}
 .field .hoverCard{position:absolute;z-index:6;pointer-events:none;display:flex;flex-direction:column;gap:2px;
   background:var(--bg-card);border:1px solid var(--rule);border-radius:var(--radius-sm);
   padding:9px 13px;max-width:240px;}

package/modules/public-landing/public/projects.html

@@ -1553,6 +1553,39 @@ summary{min-height:24px;padding:3px 0;}
   ORB_SHAPES.forEach(function (s) { ['tint', 'wash', 'chrome'].forEach(function (y) { ORB_TEMPLATES.push(s + '-' + y); }); });
   ORB_SHAPES.forEach(function (s) { ORB_MATERIALS.forEach(function (m) { ['tint', 'wash', 'plain'].forEach(function (y) { ORB_TEMPLATES.push(s + '-' + m + '-' + y); }); }); });
   var ORB_WALK = ['blob-tint', 'pair-gold-wash', 'bead-obsidian-plain', 'blob-frost-wash', 'pair-chrome', 'bead-gold-tint', 'blob-obsidian-wash', 'pair-frost-tint', 'bead-wash', 'blob-gold-plain', 'pair-obsidian-tint', 'bead-frost-wash'];
+  /* THE VISIBILITY RENDER-TYPE — a SECOND axis, and not the planet above (BV1.R09,
+     task 1002328; ADR 0182 D1, criterion proj-visibility-states). The planet is
+     what a project LOOKS like — the owner's chosen shape and material. This is what
+     its door SAYS: public draws a planet, private a star, stealth a black hole.
+     Dark matter never arrives; the feed excludes it in SQL, because a client-side
+     filter ships the husk to anyone who opens a network tab.
+
+     THE VALUE IS READ, NEVER DERIVED. `orb` is computed server-side in
+     modules/platform-identity/projects-feed.js, which holds the only copy of the
+     state→orb mapping in the repo; this page reads that field and does not own a
+     `state` table of its own. The three words below are LABELS for the states, not
+     a second mapping — and they are explore.js's words (R07, task 1002326), so the
+     two in-repo surfaces say the same thing. */
+  var ORB_STATE = { planet: 'Public', star: 'Private', 'black-hole': 'Stealth' };
+  /* FAIL-CLOSED, the choice projects-feed.js makes for the same question: a row
+     whose render-type this page does not recognise is NOT DRAWN. The risk is a
+     fourth state shipped by a newer server and read by an older page — drawing it
+     as the default would publish, as a public planet, a project that chose not to
+     be one. Applied to CATALOG rows only: the viewer's own provisioning rows never
+     came from the feed and carry no `orb`. */
+  function drawableCatalogRow(p) {
+    return Object.prototype.hasOwnProperty.call(ORB_STATE, String((p && p.orb) || ''));
+  }
+  /* Is this row anonymous on the map? The one predicate the sky and the table both
+     ask, so neither can answer it differently (ADR 0182 D2a). */
+  function isBlackHole(p) { return String((p && p.orb) || '') === 'black-hole'; }
+  /* What a black hole is allowed to say. Deliberately takes no project argument:
+     there is no identifying value in scope to leak by accident, now or when the
+     feed grows a column. explore.js's anonymousCard() makes the same choice. */
+  function anonymousName() { return 'A project'; }
+  function anonymousBlurb() {
+    return 'Something is here. Its name, and everything else about it, stay with its owner.';
+  }
   var catalog = [];
   var mineOrigins = {};   /* normalized host → 'owner' | 'builder' */
   var ownedInstances = []; /* the viewer's OWN provisioning rows (never torn_down) */
@@ -1696,6 +1729,27 @@ summary{min-height:24px;padding:3px 0;}
     (spot ? list.concat(dimmed) : list).forEach(function (p, i) {
       var slot = ORB_SLOTS[i % ORB_SLOTS.length];
       var isDim = spot && i >= list.length;
+      /* A BLACK HOLE IS DRAWN FROM NOTHING BUT ITS EXISTENCE (ADR 0182 D2a).
+         A <span>, not an <a>: there is nowhere to go. No name, no address, no
+         badge, no liveness chip — and no planet artwork, because the shape /
+         material walk is an identity THIS PAGE assigns, and an identity assigned
+         to rows that are supposed to be interchangeable is exactly what lets an
+         observer follow one of them from yesterday's feed into today's. The
+         server redacted the row; this is the page declining to re-identify it. */
+      if (isBlackHole(p)) {
+        var bh = document.createElement('span');
+        bh.className = 'worldOrb blackHole' + (spot ? (isDim ? ' dim' : ' match') : '');
+        bh.setAttribute('data-generated', '');
+        bh.setAttribute('data-orb', 'black-hole');
+        if (isDim) bh.setAttribute('aria-hidden', 'true');
+        /* no --acc: the accent is per-project identity too, so a black hole takes
+           the page's own and is the same colour as every other black hole */
+        bh.style.cssText = '--d:' + slot[2] + 'px;left:' + slot[0] + '%;top:' + slot[1] + '%';
+        bh.title = anonymousBlurb();
+        bh.innerHTML = '<span class="disc"></span><span class="nm">' + esc(anonymousName()) + '</span>';
+        layer.appendChild(bh);
+        return;
+      }
       var a = document.createElement('a');
       a.className = 'worldOrb' + (spot ? (isDim ? ' dim' : ' match') : '');
       /* a dimmed orb is BACKDROP: at .25 opacity its label cannot carry
@@ -1705,6 +1759,12 @@ summary{min-height:24px;padding:3px 0;}
       a.setAttribute('data-generated', '');
       var rel = relOf(p);
       a.setAttribute('data-rel', rel);
+      /* the door the project chose, as the feed derived it. An IDENTIFIED state —
+         public or private — is on the map under its own name; what the state
+         changes is how it is drawn and who may walk in, never whether it is named.
+         An owned-only entry never came from the feed, so it claims no state. */
+      var orbState = drawableCatalogRow(p) ? String(p.orb) : '';
+      if (orbState) a.setAttribute('data-orb', orbState);
       /* the planet: shape, material and style as data attributes (shape[-material]-style;
          no material = chrome), cosmos.css does the rest */
       var tpl = templateOf(p), tplParts = tpl.split('-');
@@ -1731,7 +1791,10 @@ summary{min-height:24px;padding:3px 0;}
         if (href) { a.target = '_blank'; a.rel = 'noopener'; }
       }
       a.setAttribute('data-origin', String(p.origin || ''));
-      a.title = p.tagline || p.name || '';
+      /* the state in words as well as in the drawing — a visitor should not have
+         to have learned the shapes to tell a planet from a star (the explore
+         page's rule: the orb is decorative, the plain word carries the meaning) */
+      a.title = [p.tagline || p.name || '', ORB_STATE[orbState] || ''].filter(Boolean).join(' · ');
       a.style.cssText = '--acc:' + accentOf(p) +
         ';--d:' + slot[2] + 'px;left:' + slot[0] + '%;top:' + slot[1] + '%';
       a.innerHTML =
@@ -1772,7 +1835,21 @@ summary{min-height:24px;padding:3px 0;}
        not a peer in the catalog's sort order. */
     body.querySelectorAll('li[data-generated]').forEach(function (n) { n.remove(); });
     body.insertAdjacentHTML('beforeend', list.map(function (p) {
+      /* The table is a PEER VIEW of the map, not a back door around D2a: a black
+         hole says exactly as little here as it does in the sky. No name, no
+         address, no facts, no doors — and no liveness chip, because a chip is a
+         claim about a specific project. The row exists so the count is honest;
+         that is the whole of what it publishes. */
+      if (isBlackHole(p)) {
+        return '<li class="tblRow anon" data-generated data-orb="black-hole">' +
+          '<span class="worldOrb blackHole" data-orb="black-hole" style="--d:64px" aria-hidden="true">' +
+          '<span class="disc"></span></span>' +
+          '<div class="tWho"><span class="ptitle">' + esc(anonymousName()) + '</span></div>' +
+          '<p class="ptag">' + esc(anonymousBlurb()) + '</p>' +
+          '</li>';
+      }
       var rel = relOf(p);
+      var orbState = drawableCatalogRow(p) ? String(p.orb) : '';
       var pill = rel === 'owner' ? '<span class="pill">yours</span>'
         : rel === 'builder' ? '<span class="pill">you build here</span>' : '';
       /* the project's own planet, the object the sky and the Your-projects row
@@ -1782,6 +1859,7 @@ summary{min-height:24px;padding:3px 0;}
       var planet = '<span class="worldOrb"' + planetAttrs({ tpl: templateOf(p) }) +
         ' style="--acc:' + accentOf(p) + ';--d:64px" aria-hidden="true"><span class="disc"></span></span>';
       return '<li class="tblRow" data-generated ' + (p._inst ? 'data-manage="' + esc(String(p._inst.id)) + '" ' : '') +
+        (orbState ? 'data-orb="' + esc(orbState) + '" ' : '') +
         'data-origin="' + esc(String(p.origin || '')) + '">' + planet +
         '<div class="tWho">' + (p._inst
             ? '<a class="ptitle" data-manage="' + esc(String(p._inst.id)) + '" href="?view=manage&id=' + esc(String(p._inst.id)) + '">' + esc(p.name) + '</a>'
@@ -1817,7 +1895,13 @@ summary{min-height:24px;padding:3px 0;}
        entries. The sky, the table, the search box and the count read the same
        list and can never disagree about what exists. */
     var catalogHosts = {};
-    catalog.forEach(function (p) {
+    /* FAIL-CLOSED FIRST, before anything else reads these rows (task 1002328): a
+       render-type this page does not recognise is not drawn, not counted, and —
+       the reason it is filtered HERE rather than inside the renderers — not allowed
+       to claim a host either, or it would suppress the viewer's own entry for that
+       same project in the loop below. */
+    var drawnCatalog = catalog.filter(drawableCatalogRow);
+    drawnCatalog.forEach(function (p) {
       var h = hostOf(p.origin);
       catalogHosts[h] = 1;
       p._inst = ownedByHost[h] || null;
@@ -1825,7 +1909,7 @@ summary{min-height:24px;padding:3px 0;}
          create — their own instance row is a truthful source, never a guess */
       if (p.type == null && p._inst && p._inst.type) p.type = p._inst.type;
     });
-    var browse = catalog.slice();
+    var browse = drawnCatalog.slice();
     ownedInstances.forEach(function (inst) {
       var h = inst.domain ? hostOf(inst.domain) : '';
       if (h && catalogHosts[h]) return;   /* annotated onto its catalog row above */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.584",
+  "version": "1.19.585",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.584",
+      "version": "1.19.585",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.584",
+  "version": "1.19.585",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.584'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.585'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_map_orb_states.mjs

@@ -0,0 +1,255 @@
+// tests/hub_map_orb_states.mjs — the hub map draws the VISIBILITY render-type,
+// EXECUTED (BV1.R09, task 1002328; ADR 0182 D1/D2a, criterion proj-visibility-states).
+//
+// R06 (task 1002325) made the feed answer what each project draws as — `orb` is
+// planet / star / black-hole, derived server-side from the join door, with stealth
+// rows redacted before they leave the server and dark matter excluded in SQL. R07
+// (task 1002326) dogfooded it on the Explore page. This file pins the surface a
+// visitor actually lands on: the hub map at modules/public-landing/public/projects.html,
+// in both its views — the sky and the table.
+//
+// The original R09 scoped this to a separate-repo static gate site; that gate was
+// retired (src/platform-server.js: the apex 302 into /gate/ "is gone with the gate
+// itself"), and the orb sky became a view inside the hub. So the criterion's last
+// clause lands here.
+//
+// Harness: the tests/project_door_ui.mjs pattern — there is no jsdom in this repo,
+// so the real region is sliced out of the page verbatim, run in a vm under a narrow
+// DOM stub, and the markup it writes is parsed back. Both slice boundaries are
+// asserted so a rename can never leave this file executing an empty string.
+//
+// What it proves, and why each matters:
+//   • the three states draw as three different things — a private project stopped
+//     being indistinguishable from a public one
+//   • a black hole is drawn from NOTHING but its existence: no name, no address,
+//     no per-project artwork, and nothing to click. The server already redacted the
+//     row; this asserts the page cannot re-identify it from what it kept
+//   • an unrecognised render-type is DROPPED, not drawn — the fail-closed choice
+//     projects-feed.js makes for the same question, so a fourth state added later
+//     can never inherit the public planet
+//   • the mapping is never re-derived client-side from `state` — one copy, server-side
+//   • the search box cannot surface a black hole
+//   • the viewer's OWN provisioning rows, which carry no feed `orb`, still draw —
+//     fail-closed must not delete the owner's own sky
+//
+// Run:  node --test --test-reporter=tap tests/hub_map_orb_states.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// ── the region under test, sliced verbatim ───────────────────────────────────
+const START = SCRIPT.indexOf('var ORB_SLOTS = [');
+const END = SCRIPT.indexOf('function applyMapFilter(');
+assert.ok(START > 0, 'the map-render region must start at ORB_SLOTS');
+assert.ok(END > START, 'the map-render region must end before applyMapFilter');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['var ORB_STATE = {', 'function drawableCatalogRow(', 'function renderOrbs(', 'function renderRows(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// planetAttrs() lives further down the page (it is shared with the manage cards),
+// so it is sliced in rather than re-typed — a hand-copied stub would drift from the
+// thing whose output this file asserts about.
+const PA_START = SCRIPT.indexOf('function planetAttrs(');
+const PA_END = SCRIPT.indexOf('var PLANET_SHAPE_WORDS');
+assert.ok(PA_START > 0 && PA_END > PA_START, 'planetAttrs must still be sliceable');
+const PLANET_ATTRS = SCRIPT.slice(PA_START, PA_END);
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+// Narrow on purpose: it supports exactly what the region touches, so it stays
+// honest about what it can prove.
+
+function makeNode(tag) {
+  return {
+    tagName: String(tag).toUpperCase(),
+    _attrs: {},
+    _children: [],
+    className: '',
+    tabIndex: 0,
+    style: { cssText: '' },
+    innerHTML: '',
+    setAttribute(k, v) { this._attrs[k] = String(v); },
+    getAttribute(k) { return Object.prototype.hasOwnProperty.call(this._attrs, k) ? this._attrs[k] : null; },
+    hasAttribute(k) { return Object.prototype.hasOwnProperty.call(this._attrs, k); },
+    appendChild(n) { this._children.push(n); return n; },
+    querySelectorAll() { return []; },
+  };
+}
+
+function boot() {
+  const sky = makeNode('div');
+  let rowsHtml = '';
+  const rows = makeNode('ul');
+  rows.insertAdjacentHTML = (_where, html) => { rowsHtml += html; };
+
+  const els = { skyCam: sky, mapRows: rows };
+  const sandbox = {
+    // safeHttpUrl() (inside the region) scheme-checks through the URL parser — a vm
+    // context has no globals of its own, so it is handed the real one
+    URL,
+    document: { createElement: makeNode, getElementById: (id) => els[id] || null },
+    $: (id) => els[id] || null,
+    esc: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+      { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+    productName: 'Cloud Bongos',
+    // the surrounding page's own helpers, narrowed to what the region reads back
+    chipFor: () => '<span class="chip"></span>',
+    hallGlyphHtml: () => '',
+    shippedFigure: () => '',
+    listedDate: (iso) => String(iso),
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(PLANET_ATTRS + '\n' + REGION, sandbox);
+  return {
+    sandbox,
+    sky,
+    rowsHtml: () => rowsHtml,
+    orbs: () => sky._children,
+  };
+}
+
+// A feed row as the server actually shapes it (projects-feed.js): `state` and `orb`
+// on every row, and a stealth row nulled down to those two keys.
+const PUBLIC_ROW = {
+  origin: 'https://demo.example.com', name: 'Demo', tagline: 'a demo project',
+  art_url: null, created_at: '2026-01-01T00:00:00.000Z', builders: 3, tags: [],
+  type: null, state: 'public', orb: 'planet',
+};
+const PRIVATE_ROW = {
+  origin: 'https://circles.example.com', name: 'Circles', tagline: 'invite only',
+  art_url: null, created_at: '2026-01-02T00:00:00.000Z', builders: 2, tags: [],
+  type: null, state: 'private', orb: 'star',
+};
+const STEALTH_ROW = {
+  origin: null, name: null, tagline: null, art_url: null, created_at: null,
+  builders: null, tags: null, type: null, state: 'stealth', orb: 'black-hole',
+};
+
+test('the three states draw as three different orbs', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([PUBLIC_ROW, PRIVATE_ROW, STEALTH_ROW], []);
+  const drawn = h.orbs();
+  assert.equal(drawn.length, 3, 'every drawable row reaches the sky');
+  assert.deepEqual(drawn.map((n) => n.getAttribute('data-orb')),
+    ['planet', 'star', 'black-hole'],
+    'each orb carries the render-type the feed derived');
+});
+
+test('a public project keeps its planet: name, address and artwork', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([PUBLIC_ROW], []);
+  const [orb] = h.orbs();
+  assert.equal(orb.tagName, 'A', 'a public project is a real link');
+  assert.equal(orb.href, 'https://demo.example.com/');
+  assert.match(orb.innerHTML, /Demo/, 'it is named');
+  assert.ok(orb.getAttribute('data-template'), 'it carries its planet artwork');
+});
+
+test('a private project is a star, and is still itself', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([PRIVATE_ROW], []);
+  const [orb] = h.orbs();
+  assert.equal(orb.getAttribute('data-orb'), 'star');
+  // identified, per ADR 0182 D1: private is on the map UNDER ITS NAME — what
+  // changes is the door, not the anonymity
+  assert.match(orb.innerHTML, /Circles/);
+  assert.equal(orb.href, 'https://circles.example.com/');
+  assert.ok(orb.getAttribute('data-template'), 'it keeps its planet artwork');
+});
+
+test('a black hole is existence without identity — nothing to read, nothing to click', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([STEALTH_ROW], []);
+  const [orb] = h.orbs();
+  assert.equal(orb.getAttribute('data-orb'), 'black-hole');
+  assert.notEqual(orb.tagName, 'A', 'a black hole is not a link — there is nowhere to go');
+  assert.ok(!orb.href, 'and it carries no address');
+  assert.equal(orb.getAttribute('data-origin'), null, 'not even as a data attribute');
+  // no per-project artwork: the shape/material walk is an IDENTITY the page
+  // assigns, and assigning one to a black hole would make interchangeable rows
+  // individually recognisable across snapshots
+  for (const a of ['data-template', 'data-shape', 'data-material', 'data-style']) {
+    assert.equal(orb.getAttribute(a), null, `a black hole must not carry ${a}`);
+  }
+  assert.doesNotMatch(orb.innerHTML, /class="badge"|class="chip"/, 'no badge, no liveness chip');
+});
+
+test('an unrecognised render-type is dropped, not drawn (fail-closed)', () => {
+  const { sandbox } = boot();
+  for (const orb of ['planet', 'star', 'black-hole']) {
+    assert.equal(sandbox.drawableCatalogRow({ orb }), true, `${orb} is drawable`);
+  }
+  // the shape of the risk: a fourth state shipped by a newer server, read by an
+  // older page. It must not inherit the public planet.
+  for (const orb of ['wormhole', 'nebula', '', null, undefined]) {
+    assert.equal(sandbox.drawableCatalogRow({ orb }), false,
+      `an unknown render-type (${String(orb)}) is not drawn`);
+  }
+  assert.equal(sandbox.drawableCatalogRow({}), false, 'a row with no render-type at all is not drawn');
+});
+
+test('the drop is wired into the browse list, not left as an orphan predicate', () => {
+  // behaviour above proves the predicate; this proves the page actually asks it,
+  // and asks it of the CATALOG (the viewer's own provisioning rows carry no feed
+  // `orb` and must survive)
+  assert.match(SCRIPT, /catalog\.filter\(drawableCatalogRow\)/,
+    'applyMapFilter must filter the catalog through drawableCatalogRow');
+});
+
+test("the viewer's own provisioning rows still draw — fail-closed must not empty the owner's sky", () => {
+  const h = boot();
+  // the synthetic row applyMapFilter pushes for an owned instance the catalog
+  // does not carry: no feed `orb`, because it never came from the feed
+  const owned = {
+    name: 'my-project', tagline: 'my-project.example.com',
+    origin: 'https://my-project.example.com', builders: null, tags: null, type: null,
+    _inst: { id: '42', slug: 'my-project', domain: 'my-project.example.com' },
+  };
+  h.sandbox.renderOrbs([owned], []);
+  const [orb] = h.orbs();
+  assert.equal(h.orbs().length, 1, 'an owned-only entry is drawn');
+  assert.equal(orb.getAttribute('data-orb'), null, 'and is not labelled with a state it never claimed');
+  assert.ok(orb.getAttribute('data-template'), 'it keeps its slug-walked planet');
+});
+
+test('the state→orb mapping is read from the feed, never re-derived here', () => {
+  // projects-feed.js owns ORB_BY_STATE. A second copy on the client is a copy
+  // that drifts — the explicit rule R07 already follows in explore.js.
+  assert.doesNotMatch(REGION, /['"]public['"]\s*:\s*['"]planet['"]/,
+    'the page must not carry its own state→orb table');
+  assert.match(REGION, /p\.orb|\bORB_STATE\b/, 'it reads the feed’s own orb field');
+});
+
+test('a black hole cannot be surfaced by the search box', () => {
+  const { sandbox } = boot();
+  // it publishes no text, so there is nothing for a query to match — asserted
+  // rather than assumed, because a future row that gained a searchable field
+  // would silently make stealth projects probeable by guessing names
+  for (const q of ['a', 'project', 'demo', 'circles']) {
+    assert.equal(sandbox.matchesMapQuery(STEALTH_ROW, q), false,
+      `a query (${q}) must never match a black hole`);
+  }
+});
+
+test('the table view says the same three things as the sky', () => {
+  const h = boot();
+  h.sandbox.renderRows([PUBLIC_ROW, PRIVATE_ROW, STEALTH_ROW]);
+  const html = h.rowsHtml();
+  for (const orb of ['planet', 'star', 'black-hole']) {
+    assert.ok(html.includes('data-orb="' + orb + '"'), `the table marks its ${orb} row`);
+  }
+  // the anonymous row is anonymous HERE too: the table is a peer view of the map,
+  // not a back door around D2a
+  const anon = html.slice(html.indexOf('data-orb="black-hole"'));
+  assert.doesNotMatch(anon, /class="rowGo"/, 'a black hole has no "view" door');
+  assert.doesNotMatch(anon, /data-template=/, 'and no per-project artwork');
+});