@bongos/core 1.19.90 → 1.19.92

package/scripts/gds/upgrade.js

@@ -324,6 +324,42 @@ function runMigrate(instanceDir, run = spawnSync) {
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
 
+// WHICH database will migrate target? (task 1002755)
+//
+// The pre-flight probe below is only meaningful if it tests the SAME database the migration
+// will later use. It used to be handed `process.env.PGDATABASE` — undefined on a normal box —
+// so psql fell through to a database named after the OS user, failed for an unrelated reason,
+// and soft-skipped with "psql failed for another reason". migrate then picked its own name and
+// hit a database that did not exist. Two soft failures composing into a hard one, discovered
+// only AFTER the pin had moved.
+//
+// So resolve it here, up front, by asking the core's OWN resolver in a child pointed at this
+// instance — the same precedence migrate.sh uses (PGDATABASE wins, else the instance's branding
+// pack) and the same function, so the probe and the migration cannot disagree. Spawned rather
+// than required because requiring pool.js constructs a pg Pool in this process.
+// Returns { db, ran }:
+//   { db: 'name', ran: true }  — resolved
+//   { db: null,  ran: true  }  — the resolver RAN and this instance names no database. Fatal:
+//                                migrate cannot proceed and we know it before the pin moves.
+//   { db: null,  ran: false }  — the resolver could not run at all (no node_modules yet, a
+//                                stubbed spawn in tests). NOT fatal: that is a different problem
+//                                from "no database configured", and guessing which one it is would
+//                                block bumps for the wrong reason. migrate.sh makes the same
+//                                distinction and still fails loudly later, so the net holds.
+function resolveInstanceDb({ instanceDir }, run = spawnSync) {
+  if (process.env.PGDATABASE) return { db: process.env.PGDATABASE, ran: true };
+  const poolPath = path.join(instanceDir, 'node_modules', CORE_PKG, 'src', 'bongos', 'pool');
+  // the module path rides as argv, never interpolated into JS source — a Windows-shaped path's
+  // backslashes are escape sequences inside a string literal
+  const r = run(process.execPath, ['-e', "process.stdout.write(require(process.argv[1]).instanceDbName() || '')", poolPath], {
+    cwd: instanceDir,
+    encoding: 'utf8',
+    env: { ...process.env, CLOUDBONGOS_INSTANCE_ROOT: instanceDir },
+  });
+  if (!r || r.error || r.status !== 0 || typeof r.stdout !== 'string') return { db: null, ran: false };
+  return { db: String(r.stdout).trim() || null, ran: true };
+}
+
 // Regenerate the per-instance API artifacts (OpenAPI spec + api-reference + typed
 // client) from the NEW core's routes — the claude-materialize sibling (task 2051).
 // WHY: the routes + generators ship WITH core, and the generated spec/docs/client also
@@ -748,10 +784,17 @@ async function runUpgrade(opts, deps = {}) {
   // mistake, and finding it at migrate means unwinding a pin that never should have
   // been written (task 1002712).
   if (!opts.skipMigrate) {
-    const dbId = (deps.preflightDbIdentity || preflightDbIdentity)({ instanceDir, db: process.env.PGDATABASE }, run);
+    const { db, ran } = (deps.resolveInstanceDb || resolveInstanceDb)({ instanceDir }, run);
+    if (ran && !db) {
+      return { ok: false, error: 'cannot determine which database to migrate.\n'
+        + '    Set PGDATABASE, or give this instance a db.database in config/branding.json.\n'
+        + '    Checked BEFORE the pin moves: migrate runs after the install, so a name that\n'
+        + '    cannot be resolved there costs a full rollback to discover (task 1002755).' };
+    }
+    const dbId = (deps.preflightDbIdentity || preflightDbIdentity)({ instanceDir, db }, run);
     if (!dbId.ok) return { ok: false, error: dbId.reason };
-    if (dbId.skipped) log(`  • db identity pre-check: ${dbId.skipped}`);
-    else log('  ✓ pre-flight: database reachable as the current user');
+    if (dbId.skipped) log(`  • db identity pre-check${db ? ` (${db})` : ''}: ${dbId.skipped}`);
+    else log(`  ✓ pre-flight: database${db ? ` "${db}"` : ''} reachable as the current user`);
   }
 
   // 1b. mandatory post-restart health check (audit H9 / task 1002222, finding F5). A bump that
@@ -1005,7 +1048,7 @@ async function main(argv = process.argv.slice(2)) {
 module.exports = {
   runUpgrade, parseArgs, main, rollback,
   versionFromTgzPath, versionFromDep, readInstalledCoreVersion, readPinnedCoreVersion, writePin, writeRegistryPin, restorePin,
-  vendorTarball, gitTreeClean, persistPin, dirtyPinFiles, gitCurrentBranch, PIN_FILES, preflightDbIdentity, preflightModules, reportModulePreflight, npmInstall, runMigrate, regenerateApiArtifacts, regenerateNavDocs, NAV_WHOLE_FILE_GENERATORS, missingDocAssets, healDocAssets, DOC_ASSET_GENERATORS, restartService, recordLedger, pollHealth,
+  vendorTarball, gitTreeClean, persistPin, dirtyPinFiles, gitCurrentBranch, PIN_FILES, preflightDbIdentity, resolveInstanceDb, preflightModules, reportModulePreflight, npmInstall, runMigrate, regenerateApiArtifacts, regenerateNavDocs, NAV_WHOLE_FILE_GENERATORS, missingDocAssets, healDocAssets, DOC_ASSET_GENERATORS, restartService, recordLedger, pollHealth,
   readManifest, resolveReferenceManifest, verifyInstalledPin, // task 1002216 (audit H8) — integrity-pin verification
   CORE_PKG, ARTIFACT,
 };

package/scripts/migrate.sh

@@ -32,7 +32,13 @@ INVOKE_CWD="${INIT_CWD:-$PWD}"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 DEFAULT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 CORE_ROOT="$(cd "$DEFAULT_ROOT" && node -e "process.stdout.write(require('./src/instance-config').resolveCoreRoot())" 2>/dev/null || echo "$DEFAULT_ROOT")"
-INSTANCE_ROOT="$(cd "$INVOKE_CWD" && node -e "process.stdout.write(require('$DEFAULT_ROOT/src/instance-config').resolveInstanceRootExplicit() || '')" 2>/dev/null || true)"
+# The module path rides in as argv rather than being interpolated into the JS source: a
+# Windows-shaped DEFAULT_ROOT contains backslashes, which are ESCAPE SEQUENCES inside a JS
+# string literal ("\U", "\r", "\D"), so interpolating corrupts the path, the require throws,
+# and this silently falls back to DEFAULT_ROOT — precisely the F6 shape described above, just
+# triggered by the path separator instead of the cwd. Fixed alongside task 1002755, which hit
+# the identical bug one resolution further down.
+INSTANCE_ROOT="$(cd "$INVOKE_CWD" && node -e "process.stdout.write(require(process.argv[1]).resolveInstanceRootExplicit() || '')" "$DEFAULT_ROOT/src/instance-config" 2>/dev/null || true)"
 INSTANCE_ROOT="${INSTANCE_ROOT:-$DEFAULT_ROOT}"
 # Run from the instance root so instance-relative paths resolve (the post-deploy art check below)
 # AND so the enabledModules() read finds the instance's config/modules.json (resolveInstanceRoot
@@ -49,17 +55,68 @@ if [ "${1:-}" = "--print-roots" ]; then
   exit 0
 fi
 
-DB="${PGDATABASE:-amazonprimea}"
-
 # Test/ops seam (added with the 1.18.19 space-in-path fix): --print-migrations walks the REAL core-migration loop but reports
 # each path instead of applying it, and touches NO DB. tests/migrate_root_resolution.mjs uses it to
 # assert that a checkout whose path contains a space still yields whole, readable paths. Reporting
 # through the real loop (rather than a copy of it in the test) is the point: if the loop ever reverts
 # to an unquoted `for f in $MIGRATIONS`, this seam fragments the paths and the test fails. Also handy
 # in the field — `npm run migrate -- --print-migrations` shows exactly what migrate would apply.
+#
+# Resolved BEFORE the database name below, because a dry run touches no DB (every psql call is
+# guarded by DRY_RUN) and so must not require one.
 DRY_RUN=0
 if [ "${1:-}" = "--print-migrations" ]; then DRY_RUN=1; fi
 
+# --- Which database? (task 1002755) ---------------------------------------
+# SAME precedence as src/bongos/pool.js: an explicit PGDATABASE wins, else the instance's own
+# branding pack names it (config/branding.json db.database, else the neutral starter). Resolved by
+# CALLING pool.instanceDbName() rather than re-reading the config here, so the migrator and the
+# running server can never disagree about which database this instance is.
+#
+# There is deliberately NO literal fallback. This script ships inside the core to EVERY instance,
+# so a baked-in default is one host's database name pointed at everyone else's box: on a co-hosted
+# machine it silently targets a stranger's data, and everywhere else it dies with a confusing
+# "database ... does not exist" long after the caller has moved its version pin. pool.js already
+# made exactly this call for the server ("NOT hard-defaulting to a host's DB name", pool.js:10-16);
+# this is the migrator catching up, not a new policy.
+# The module path rides in as argv, NOT interpolated into the JS source: a Windows-shaped
+# CORE_ROOT contains backslashes, and inside a JS string literal those are escape sequences
+# ("\U", "\r"), so interpolating silently corrupts the path and this resolution degrades to
+# empty. argv values are never parsed as JS.
+DB="${PGDATABASE:-}"
+DB_RESOLVER_ERR=""
+if [ -z "$DB" ]; then
+  # stderr is CAPTURED, not discarded: "the pack names no database" and "the resolver could not
+  # run at all" are different problems with different fixes, and collapsing both into an empty
+  # string sends the operator to edit a config file when the real answer is `npm install`.
+  # (pool.js requires pg, so an instance with no node_modules fails here rather than resolving.)
+  if DB_RESOLVED="$(node -e "process.stdout.write(require(process.argv[1]).instanceDbName() || '')" "$CORE_ROOT/src/bongos/pool" 2>&1)"; then
+    DB="$DB_RESOLVED"
+  else
+    DB_RESOLVER_ERR="$DB_RESOLVED"
+  fi
+fi
+if [ -z "$DB" ] && [ "$DRY_RUN" = 0 ]; then
+  echo "migrate: cannot determine which database to migrate." >&2
+  if [ -n "$DB_RESOLVER_ERR" ]; then
+    echo "  the db-name resolver did not run: $(printf '%s' "$DB_RESOLVER_ERR" | head -n 1)" >&2
+    echo "  if the core's dependencies are not installed yet, run: npm install" >&2
+  else
+    echo "  Set PGDATABASE, or give this instance a db.database in config/branding.json." >&2
+  fi
+  echo "  Refusing to guess: a baked-in default would target another instance's database." >&2
+  exit 2
+fi
+
+# Test/ops seam: --print-db reports the database this run WOULD migrate, and exits before any DB
+# work. `bongos upgrade` calls it to learn the name up front, so its pre-flight can prove the DB is
+# reachable BEFORE the version pin moves — otherwise an unresolvable name is only discovered at
+# migrate time, and the pin has to be unwound (task 1002755).
+if [ "${1:-}" = "--print-db" ]; then
+  printf '%s\n' "$DB"
+  exit 0
+fi
+
 # --- Instance-seed policy (task 1704 / ADR 0105) --------------------------
 # OTB/product scope-truth (versions, goals, done_when_criteria) lives in seed
 # migrations under migrations/instance/ (plus a few guarded blocks embedded in the

package/scripts/status-mirror-sync.js

@@ -57,17 +57,23 @@ const { branding, clientBranding } = require('../src/branding');
 // with src/bongos/serve-internal.js applyBrandTokens. `brand` is the client-safe pack
 // and `publicOrigin` the resolved origin — both injected, never read ambiently, so the
 // transform stays pure and testable.
-function brandTokens(html, brand = {}, publicOrigin = '') {
+function brandTokens(html, brand = {}, publicOrigin = '', buildersOrigin = '') {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
+  const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
+  const esc = (s) => String(s == null ? '' : s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
   return html
-    .split('{{worldName}}').join(world)
-    .split('{{productName}}').join(product)
-    .split('{{Currency}}').join(Cur)
-    .split('{{currency}}').join(cur)
-    .split('{{publicOrigin}}').join(publicOrigin || '');
+    .split('{{worldName}}').join(esc(world))
+    .split('{{productName}}').join(esc(product))
+    .split('{{Currency}}').join(esc(Cur))
+    .split('{{currency}}').join(esc(cur))
+    .split('{{tagline}}').join(esc(tagline))
+    .split('{{publicOrigin}}').join(esc(publicOrigin || ''))
+    .split('{{buildersOrigin}}').join(esc(buildersOrigin || publicOrigin || ''));
 }
 
 // ---- the three off-box index.html injections -------------------------------

package/src/bongos/serve-internal.js

@@ -153,21 +153,45 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // stays brand-free (the fitness identity gate). Runs BEFORE the __BRANDING__
 // script is inserted; the injected JSON holds resolved values (never tokens), so
 // order is immaterial. Tokens: {{worldName}} {{productName}} {{currency}}
-// (lowercase label) {{Currency}} (Capitalized) {{publicOrigin}} (the apex origin,
-// for the one functional cross-instance link — sourced from the FULL pack's
-// domains, which clientBranding deliberately omits). Pure + exported for the test;
-// `origin` is injectable so the test drives it with zero I/O.
-function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin()) {
+// (lowercase label) {{Currency}} (Capitalized) {{tagline}} (the pack's one-line
+// pitch), plus the two ORIGINS — {{publicOrigin}} (this instance's apex) and
+// {{buildersOrigin}} (its hall). Both origins are sourced from the FULL pack's
+// `domains`, which clientBranding deliberately omits, so they are the only way a
+// served page can carry a correct cross-host href or canonical/og: URL: a client
+// fill cannot reach them, and a baked one would make every instance advertise
+// whichever instance happened to author the file (task 1002748, direction C5/C6).
+// Pure + exported for the test; both origins are injectable so it drives with zero I/O.
+function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl()) {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
+  const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
   return String(html == null ? '' : html)
-    .split('{{worldName}}').join(world)
-    .split('{{productName}}').join(product)
-    .split('{{Currency}}').join(Cur)
-    .split('{{currency}}').join(cur)
-    .split('{{publicOrigin}}').join(origin || '');
+    .split('{{worldName}}').join(esc(world))
+    .split('{{productName}}').join(esc(product))
+    .split('{{Currency}}').join(esc(Cur))
+    .split('{{currency}}').join(esc(cur))
+    .split('{{tagline}}').join(esc(tagline))
+    .split('{{publicOrigin}}').join(esc(origin || ''))
+    // a pack that names no hall of its own resolves to its OWN apex — never to
+    // whichever instance authored the file
+    .split('{{buildersOrigin}}').join(esc(hallOrigin || origin || ''))
+    .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''));
+}
+// Every token lands in HTML — as element text, or inside a double-quoted
+// attribute (href/content). Escaping is defence in depth, not a live fix: the
+// only source is config/branding.json, which is committed, code-reviewed and
+// Archon-only, never request-supplied. But a pack string carrying a quote or a
+// '<' would otherwise break out of its attribute or close <title> early, and
+// the values now reach four times as many places as when this was written.
+// No token is ever emitted into a <script> or a CSS context (checked across
+// public-landing/, hall-ui/, status-ui/) — that would need different escaping.
+// Ampersand first, or the other replacements get double-escaped.
+function esc(s) {
+  return String(s == null ? '' : s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
 }
 // The instance apex origin from the full branding pack (domains is server-only,
 // so it never rides clientBranding). Best-effort so a branding hiccup can't crash
@@ -175,6 +199,25 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
 function safePublicOrigin() {
   try { return branding().domains.publicOrigin || ''; } catch { return ''; }
 }
+// The instance's OWN builders' hall origin, same server-only source. Empty is fine:
+// applyBrandTokens falls back to the apex, so a pack that names no hall still gets
+// a same-instance link rather than a dangling href.
+function safeBuildersOrigin() {
+  try { return branding().domains.buildersOrigin || ''; } catch { return ''; }
+}
+// The instance's own source repo, from the pack's `repo: {owner, name}` binding —
+// another server-only field (the branding contract keeps repo off clientBranding
+// alongside domains). A page that wants to link "read the source" must take it
+// from here: the authorship audit fails any hardcoded owner/name, and rightly so,
+// since a baked one would point every instance at whoever authored the file.
+// '' when the pack names no repo — the page drops the link rather than emit a
+// dangling href.
+function safeSourceRepoUrl() {
+  try {
+    const repo = branding().repo;
+    return repo && repo.owner && repo.name ? `https://github.com/${repo.owner}/${repo.name}` : '';
+  } catch { return ''; }
+}
 // Instance product/world name for the API-discovery index (task 1918). Best-effort:
 // a branding hiccup must not break the JSON response.
 function safeProductName() {

package/src/module-api.js

@@ -607,8 +607,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.88 with no explicit bump. run 31657467485. (task 1002620)
 //   1.19.90 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.89 with no explicit bump. run 31717551308. (task 1002620)
+//   1.19.91 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.90 with no explicit bump. run 31722841411. (task 1002620)
+//   1.19.92 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.91 with no explicit bump. run 31727411036. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.90'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.92'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -65,12 +65,36 @@ function landingPage(file) {
   if (!_landingPages.has(file)) {
     let html = '';
     try {
-      html = injectBrandingGlobal(fs.readFileSync(path.join(LANDING_DIR, file), 'utf8'));
+      html = injectBrandingGlobal(stripApexOnly(fs.readFileSync(path.join(LANDING_DIR, file), 'utf8')));
     } catch { /* absent → '' */ }
     _landingPages.set(file, html);
   }
   return _landingPages.get(file);
 }
+
+// THE APEX CONDITIONAL (task 1002748). public-landing/ ships wholesale to every
+// instance, so one file has to render two shapes: the platform's own front door,
+// and a child project's. Sections that are true only of the platform — the
+// catalog of OTHER instances, the "capture-resistant commons" claim, the door
+// into the catalog — are wrapped in <!--apex-only:start--> … <!--apex-only:end-->
+// and REMOVED here on any instance that is not the hub.
+//
+// Removed, not CSS-hidden: a child instance must not ship the platform's claims
+// to a crawler, and hiding is not the same as not saying it.
+//
+// Comment sentinels rather than an attribute selector because this is a string
+// transform, not a DOM one — matching a balanced close tag with a regex is the
+// fragile shape, and a sentinel pair has no such failure mode.
+//
+// `platform-identity` IS the hub flag, not a proxy for it: its manifest reads
+// "Enabled ONLY on the hub instance; ordinary hosted + self-hosted instances
+// leave it off", and it is the module that owns the very /projects catalog these
+// sections point at. So this asks the instance what it IS, and nothing anywhere
+// has to know the platform's hostname (direction C5).
+const APEX_ONLY = /<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g;
+function stripApexOnly(html, isHub = isModuleEnabled('platform-identity')) {
+  return isHub ? html : String(html).replace(APEX_ONLY, '');
+}
 function landingHtml() { return landingPage('index.html'); }
 // The interactive landing gate (public-landing/gate/, ported from amazonprimea
 // in task 1002407). When an instance ships it, it is the apex front door
@@ -232,4 +256,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { buildPlatformApp, startBackgroundServices };
+module.exports = { buildPlatformApp, startBackgroundServices, stripApexOnly };

package/tests/cloud_bongos_pack.mjs

@@ -34,14 +34,16 @@ test('R74: the vanilla pack carries the Cloud Bongos LOOK (sunrise palette, Balo
   const c = clientBranding(vanilla());
   // fired down from the original #f97316 so white-on-accent clears WCAG AA
   // (2.80:1 -> 4.61:1, task 1002749) — same ember hue, readable
-  assert.equal(c.theme.colors.accent, '#ce4806', 'sunrise orange accent');
-  assert.equal(c.theme.colors.bg, '#fff7ed', 'warm sunrise base');
+  assert.equal(c.theme.colors.accent, '#ce4806', 'ember orange accent');
+  // ember marigold (task 1002748): the base is PIGMENTED, not near-white. The
+  // old #fff7ed sat within a few points of the cards and the page read as fog.
+  assert.equal(c.theme.colors.bg, '#f9d9a8', 'marigold base');
   assert.match(c.theme.fonts.display, /Baloo 2/);
   assert.match(c.theme.fonts.body, /Quicksand/);
   assert.ok(c.theme.fonts.links.some((l) => /Baloo\+2/.test(l) && /Quicksand/.test(l) && /Fira\+Code/.test(l)), 'loads Baloo 2 + Quicksand + Fira Code');
   assert.match(c.theme.favicon, /circle/, 'bongo-pair favicon (circles), not the Greek Α');
   assert.doesNotMatch(c.theme.favicon, /font-family='serif'>Α/);
-  assert.match(c.theme.backdrop, /linear-gradient\(180deg/, 'sunrise backdrop gradient');
+  assert.equal(c.theme.backdrop, '#f9d9a8', 'the marigold ground holds all the way down');
   assert.equal(c.copy.tagline, 'Building software is laying down a beat.');
   assert.equal(c.rankLabels.archon, 'Owner', 'plain rank labels, not "Archon"');
 });
@@ -50,9 +52,9 @@ test('R74: serving the hall on a vanilla boot injects the Cloud Bongos sunrise t
   const c = clientBranding(vanilla());
   const html = '<head><link rel="stylesheet" href="/builders/style.css"><title>x</title></head><body></body>';
   const out = injectBrandingGlobal(html, c);
-  // palette override + sunrise body backdrop + bongo favicon + the type links
+  // palette override + the marigold body backdrop + bongo favicon + the type links
   assert.match(out, /:root\{[^}]*--accent:#ce4806;/);
-  assert.match(out, /body\{background:linear-gradient\(180deg/);
+  assert.match(out, /body\{background:#f9d9a8;\}/);
   assert.match(out, /<link rel="icon" href="data:image\/svg\+xml[^"]*circle/);
   assert.match(out, /fonts\.googleapis\.com\/css2\?family=Baloo\+2/);
   // and it lands AFTER the stylesheet so the Cloud Bongos look wins
@@ -63,8 +65,10 @@ test('R74: themeMarkup paints the backdrop only when the pack supplies one', ()
   // OTB-shaped pack (no backdrop) → no body{background} rule.
   const otb = themeMarkup({ colors: { bg: '#ece0c2' }, fonts: { links: [] }, favicon: '', backdrop: '' });
   assert.doesNotMatch(otb, /body\{background/);
-  // Cloud Bongos pack → backdrop present.
-  assert.match(themeMarkup(clientBranding(vanilla()).theme), /body\{background:linear-gradient/);
+  // Cloud Bongos pack → backdrop present. Asserted by PRESENCE, not by shape:
+  // this test's subject is whether a backdrop paints at all, so it must not
+  // re-break every time the palette legitimately changes.
+  assert.match(themeMarkup(clientBranding(vanilla()).theme), /body\{background:.+\}/);
 });
 
 test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (task 1374)', () => {