From aac9445a965227313131a8808042fd32a6dc5457 Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 10:39:05 +0200
Subject: [PATCH 1/2] fix(map): take every tile URL and attribution from the
 configured provider
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keyless CARTO raster tiles have been stamped "API KEY REQUIRED" since
August 2026, and this fork has no CARTO basemap-key plumbing. Several
maps still built their tile URL from a hard-coded CARTO template instead
of the operator's configured dark/light provider, so they rendered
watermarked tiles even on an instance configured for Esri/OpenTopoMap.

- map-tile-providers.js: the built-in fallback defaults become the
  keyless OSM baseline ('osm-dark' / 'osm-standard') instead of
  'carto-dark' / 'carto-light'. Those two ids are now registered
  regardless of provider gating, so the active id always resolves and
  stays selectable in the layer picker. New MC_getTileSpec(type) is the
  single resolver for url + attribution + refUrl + maxZoom +
  invertFilter, per theme.
- roles.js: TILE_DARK / TILE_LIGHT are no longer CARTO templates, and
  getTileUrl() honours the configured provider in LIGHT mode too — it
  previously returned TILE_LIGHT unconditionally, ignoring
  map.tiles.lightDefault. getActiveTileProvider() resolves both themes,
  so the node-detail inset map credits the configured light provider.
- customize-v2.js: both geo-filter preview maps resolve the configured
  light provider through a shared _cv2PreviewTile() helper.
- live.js / map.js: the tile resolvers go through MC_getTileSpec, and
  their url + attribution fallbacks no longer name CARTO.
- geofilter-builder.html: this standalone page has no registry, so it
  uses the same keyless OSM baseline plus a tile-pane invert filter to
  keep its dark look.
- config.example.json: defaults updated, with a note on why CARTO is no
  longer the default.

Relates to #332

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/deploy.yml             |   4 +
 config.example.json                      |   7 +-
 public/customize-v2.js                   |  25 +-
 public/geofilter-builder.html            |  15 +-
 public/live.js                           |  31 +-
 public/map-tile-providers.js             |  52 ++-
 public/map.js                            |  31 +-
 public/roles.js                          |  87 ++--
 test-all.sh                              |   1 +
 test-issue-1420-tile-providers.js        |  44 +-
 test-issue-1470-node-tile-helper.js      |  15 +-
 test-issue-332-no-carto-tiles-e2e.js     | 210 +++++++++
 test-issue-332-tile-provider-fallback.js | 545 +++++++++++++++++++++++
 13 files changed, 984 insertions(+), 83 deletions(-)
 create mode 100644 test-issue-332-no-carto-tiles-e2e.js
 create mode 100644 test-issue-332-tile-provider-fallback.js

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 229aa62b7..61b41af36 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -418,6 +418,10 @@ jobs:
           BASE_URL=http://localhost:13581 node test-channels-client-state-152-e2e.js 2>&1 | tee -a e2e-output.txt
           CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-channels-154-155-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-map-modal-fluid-e2e.js 2>&1 | tee -a e2e-output.txt
+          # #332 — no map may request a tile from basemaps.cartocdn.com.
+          # No config.json here, so this exercises the built-in non-CARTO
+          # fallback (tile.openstreetmap.org) a default install resolves to.
+          CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-issue-332-no-carto-tiles-e2e.js 2>&1 | tee -a e2e-output.txt
           CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-map-nodes-pagination-e2e.js 2>&1 | tee -a e2e-output.txt
           CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-issue-123-map-lifecycle-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-observer-iata-1188-e2e.js 2>&1 | tee -a e2e-output.txt
diff --git a/config.example.json b/config.example.json
index a89aff342..52896d086 100644
--- a/config.example.json
+++ b/config.example.json
@@ -94,10 +94,11 @@
   },
   "map": {
     "tiles": {
-      "darkDefault": "carto-dark",
-      "lightDefault": "carto-light",
+      "_comment_defaults": "#332 — the built-in defaults are 'osm-dark' / 'osm-standard' (keyless OpenStreetMap, tiles to zoom 19). Set darkDefault/lightDefault to any enabled style id to override; they take priority over the built-in fallback. Carto is NOT the default any more: since August 2026 keyless Carto raster tiles come back HTTP 200 with 'API KEY REQUIRED' stamped into the PNG, and CoreScope has no Carto basemap-key plumbing.",
+      "darkDefault": "osm-dark",
+      "lightDefault": "osm-standard",
       "providers": {
-        "_comment_carto": "Carto is the default free-tier provider. Optional: specify 'domain' for Carto enterprise (e.g. 'mycompany' for 'https://{s}.mycompany.cartocdn.com').",
+        "_comment_carto": "Carto styles stay available and selectable, but keyless raster tiles are watermarked 'API KEY REQUIRED' (see _comment_defaults). Optional: specify 'domain' for Carto enterprise (e.g. 'mycompany' for 'https://{s}.mycompany.cartocdn.com').",
         "carto": {
           "enabled": true,
           "domain": ""
diff --git a/public/customize-v2.js b/public/customize-v2.js
index d1d844cfd..b18a9379e 100644
--- a/public/customize-v2.js
+++ b/public/customize-v2.js
@@ -1766,6 +1766,21 @@
     '</div>';
   }
 
+  /* #332 — both geo-filter preview maps used to hard-code the CARTO
+   * light_all template, so they rendered "API KEY REQUIRED" tiles even on
+   * instances configured for Esri/OpenTopoMap/OSM. Resolve the operator's
+   * configured LIGHT provider instead (these previews are always
+   * light-styled regardless of the app theme), falling back to roles.js
+   * TILE_LIGHT, which is itself non-CARTO. */
+  function _cv2PreviewTile() {
+    var spec = (typeof window.MC_getTileSpec === 'function') ? window.MC_getTileSpec('light') : null;
+    return {
+      url: (spec && spec.url) || window.TILE_LIGHT,
+      attribution: (spec && spec.attribution) || '© OpenStreetMap contributors',
+      maxZoom: (spec && spec.maxZoom) || 19
+    };
+  }
+
   function _gfOpenModal(container) {
     var existing = document.getElementById('cv2-gf-modal-overlay');
     if (existing) existing.remove();
@@ -1835,8 +1850,9 @@
     var modalClosingLine = null;
 
     _gfModalMap = L.map(mapDiv, { zoomControl: true });
-    L.tileLayer('https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png', {
-      attribution: '© OpenStreetMap © CartoDB', maxZoom: 19
+    var _cv2Tile = _cv2PreviewTile();
+    L.tileLayer(_cv2Tile.url, {
+      attribution: _cv2Tile.attribution, maxZoom: _cv2Tile.maxZoom
     }).addTo(_gfModalMap);
 
     function renderModal() {
@@ -2044,8 +2060,9 @@
     if (!mapEl || typeof L === 'undefined') return;
 
     _gfMap = L.map(mapEl, { zoomControl: false, dragging: false, scrollWheelZoom: false, doubleClickZoom: false, touchZoom: false });
-    L.tileLayer('https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png', {
-      attribution: '© OpenStreetMap © CartoDB', maxZoom: 19
+    var _cv2Tile = _cv2PreviewTile();
+    L.tileLayer(_cv2Tile.url, {
+      attribution: _cv2Tile.attribution, maxZoom: _cv2Tile.maxZoom
     }).addTo(_gfMap);
 
     if (!_gfLoaded) {
diff --git a/public/geofilter-builder.html b/public/geofilter-builder.html
index 2a55ca840..c2ae0fd5f 100644
--- a/public/geofilter-builder.html
+++ b/public/geofilter-builder.html
@@ -21,6 +21,11 @@
   #btnClear:hover { background: #7a2020; }
   .hint { font-size: 0.8rem; color: #888; margin-left: auto; }
   #map { flex: 1; }
+  /* #332 — the keyless OSM basemap is a LIGHT style; invert the tile pane so
+     this builder keeps the dark map it had while it hard-coded CARTO
+     dark_all. Same filter string as INVERT_CSS in map-tile-providers.js.
+     Scoped to the tile pane, so markers and the polygon stay true-colour. */
+  #map .leaflet-tile-pane { filter: invert(1) hue-rotate(180deg) brightness(0.9) contrast(1.05); }
   #output-panel { background: #0f0f23; border-top: 1px solid #333; padding: 12px 16px; display: flex; gap: 12px; align-items: flex-start; }
   #output-panel label { font-size: 0.75rem; color: #888; white-space: nowrap; padding-top: 6px; }
   #output { flex: 1; background: #111; border: 1px solid #333; border-radius: 6px; padding: 10px 12px; font-family: monospace; font-size: 0.78rem; color: #7ec8e3; white-space: pre; overflow-x: auto; min-height: 54px; max-height: 140px; overflow-y: auto; cursor: text; }
@@ -88,8 +93,14 @@ <h1>GeoFilter Builder</h1>
 <script>
 const map = L.map('map').setView([50.5, 4.4], 8);
 
-L.tileLayer('https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png', {
-  attribution: '© OpenStreetMap © CartoDB',
+// #332 — this standalone builder loads neither roles.js nor
+// map-tile-providers.js, so it has no provider registry to consult. It used
+// to hard-code the CARTO dark template, which now returns tiles stamped
+// "API KEY REQUIRED" on every keyless request. Use the same keyless OSM
+// baseline the registry falls back to; the #map .leaflet-tile-pane invert
+// filter in the stylesheet above restores the dark look.
+L.tileLayer('https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
+  attribution: '© OpenStreetMap contributors',
   maxZoom: 19
 }).addTo(map);
 
diff --git a/public/live.js b/public/live.js
index 2b5622b7b..294eae7cb 100644
--- a/public/live.js
+++ b/public/live.js
@@ -1541,21 +1541,30 @@
       (document.documentElement.getAttribute('data-theme') !== 'light' && window.matchMedia('(prefers-color-scheme: dark)').matches);
     // #1420 — multi-provider dark-tile picker. Light mode unchanged.
     let _liveDarkRefLayer = null;
+    // #332 — every tile URL and attribution comes from the configured
+    // dark/light provider. The old body hard-coded CARTO in three places
+    // (the light-mode url fallback, the 'carto-dark' registry fallback and
+    // the '© OpenStreetMap © CartoDB' credit), so a map on an instance
+    // configured for Esri/OpenTopoMap still fetched keyless CARTO tiles —
+    // which have been stamped "API KEY REQUIRED" since August 2026.
     function _liveResolveTile(dark) {
-      const reg = window.MC_TILE_PROVIDERS || {};
-      if (!dark) {
-        const lightId = (typeof window.MC_getLightTileProvider === 'function') ? window.MC_getLightTileProvider() : null;
-        const lp = lightId ? (reg[lightId] || null) : null;
-        if (lp && lp.url) {
-          return { url: (typeof lp.url === 'function' ? lp.url() : lp.url), attribution: lp.attribution || '© OpenStreetMap © CartoDB', refUrl: null };
+      // Preferred path: the registry's single resolver. It picks the
+      // provider for this theme and invokes lazy `url` functions, so url
+      // AND attribution always come from the configured provider.
+      if (typeof window.MC_getTileSpec === 'function') {
+        const s = window.MC_getTileSpec(dark ? 'dark' : 'light');
+        if (s && s.url) {
+          return { url: s.url, attribution: s.attribution || '© OpenStreetMap contributors', refUrl: s.refUrl || null };
         }
-        return { url: TILE_LIGHT, attribution: '© OpenStreetMap © CartoDB', refUrl: null };
       }
-      const id  = (typeof window.MC_getDarkTileProvider === 'function') ? window.MC_getDarkTileProvider() : 'carto-dark';
-      const p   = reg[id] || reg['carto-dark'] || {};
+      // Legacy/partial registry: accessors without getTileSpec.
+      const reg = window.MC_TILE_PROVIDERS || {};
+      const getId = dark ? window.MC_getDarkTileProvider : window.MC_getLightTileProvider;
+      const id = (typeof getId === 'function') ? getId() : null;
+      const p = (id && reg[id]) || {};
       return {
-        url: (typeof p.url === 'function' ? p.url() : p.url) || (typeof p.baseUrl === 'function' ? p.baseUrl() : p.baseUrl) || TILE_DARK,
-        attribution: p.attribution || '© OpenStreetMap © CartoDB',
+        url: (typeof p.url === 'function' ? p.url() : p.url) || (typeof p.baseUrl === 'function' ? p.baseUrl() : p.baseUrl) || (dark ? TILE_DARK : TILE_LIGHT),
+        attribution: p.attribution || '© OpenStreetMap contributors',
         refUrl: p.refUrl || null
       };
     }
diff --git a/public/map-tile-providers.js b/public/map-tile-providers.js
index 7926f80f9..8b64383e6 100644
--- a/public/map-tile-providers.js
+++ b/public/map-tile-providers.js
@@ -17,8 +17,17 @@
   var STORAGE_KEY  = 'mc-dark-tile-provider';
   var STORAGE_KEY_LIGHT = 'mc-light-tile-provider';
 
-  var DEFAULT_ID   = 'carto-dark';
-  var DEFAULT_ID_LIGHT = 'carto-light';
+  // #332 — the built-in fallback must NOT be CARTO. Since August 2026 CARTO
+  // stamps "API KEY REQUIRED" into every keyless raster tile, and this fork
+  // has no basemap-key plumbing, so an unconfigured instance that defaulted
+  // to 'carto-dark' / 'carto-light' rendered watermarked maps. OSM Standard
+  // is the keyless baseline: no token, tiles to zoom 19, and it is already
+  // the unconditional provider for the home mini-map, node-reach, packet-path
+  // and area maps — so this default introduces no new third party. Operators
+  // who want CARTO (or anything else) still set map.tiles.darkDefault /
+  // lightDefault, which keep priority over these.
+  var DEFAULT_ID   = 'osm-dark';
+  var DEFAULT_ID_LIGHT = 'osm-standard';
   var EVENT_NAME   = 'mc-tile-provider-changed';
   
   var _serverDefault = null;
@@ -84,6 +93,16 @@
       if (style.provider === 'esri' && HAS_ESRI) REGISTRY[key] = style;
     }
 
+    // #332 — the fallback defaults must stay resolvable no matter how the
+    // optional providers are gated. Without this a config that disables
+    // everything leaves REGISTRY without the active id, every caller falls
+    // through to a URL of its own, and that is exactly how the hard-coded
+    // CARTO templates spread in the first place. It also keeps the default
+    // selectable in the layer picker, so a user who switches away can
+    // switch back. `enabled` still governs every other style of a provider.
+    if (!REGISTRY[DEFAULT_ID])       REGISTRY[DEFAULT_ID]       = BASE_STYLES[DEFAULT_ID];
+    if (!REGISTRY[DEFAULT_ID_LIGHT]) REGISTRY[DEFAULT_ID_LIGHT] = BASE_STYLES[DEFAULT_ID_LIGHT];
+
     // Keep the public reference in sync with the newly rebuilt REGISTRY
     window.MC_TILE_PROVIDERS = REGISTRY;
 
@@ -179,6 +198,34 @@
   }
 
 
+  /* #332 — getTileSpec(type): the ONE place a map resolves the active
+   * provider. `type` is 'dark' or 'light'; anything else is read as 'dark'.
+   * Returns a plain object so no caller needs to know that a style's `url`
+   * may be a lazy function, nor to carry its own fallback URL/attribution:
+   *
+   *   { id, url, attribution, refUrl, maxZoom, invertFilter }
+   *
+   * `url` is always a string template (or null if a style is malformed) and
+   * `attribution` always comes from the resolved provider — never from a
+   * hard-coded CARTO credit. Re-resolved on every call so config landing
+   * after map init still applies.
+   */
+  function getTileSpec(type) {
+    var isLight  = (type === 'light');
+    var id       = isLight ? getActiveLightId() : getActiveId();
+    var fallback = isLight ? DEFAULT_ID_LIGHT : DEFAULT_ID;
+    var p        = REGISTRY[id] || BASE_STYLES[id] || BASE_STYLES[fallback];
+    var u        = p ? (p.url || p.baseUrl) : null;
+    return {
+      id: id,
+      url: (typeof u === 'function' ? u() : u) || null,
+      attribution: (p && p.attribution) || BASE_STYLES[fallback].attribution,
+      refUrl: (p && p.refUrl) || null,
+      maxZoom: (p && p.maxZoom) || 19,
+      invertFilter: (p && p.invertFilter) || null
+    };
+  }
+
   // ── Public surface ──────────────────────────────────────────────────────
   
   window.MC_DARK_TILE_DEFAULT           = DEFAULT_ID;
@@ -190,6 +237,7 @@
   window.MC_setServerDefaultTileProvider = setServerDefault;
   window.MC_setServerDefaultLightTileProvider = setServerDefaultLight;
   window.MC_applyTileFilter             = applyTileFilter;
+  window.MC_getTileSpec                 = getTileSpec;
 
 
   /**
diff --git a/public/map.js b/public/map.js
index b94c2e415..116c7fa92 100644
--- a/public/map.js
+++ b/public/map.js
@@ -351,21 +351,30 @@
       (document.documentElement.getAttribute('data-theme') !== 'light' && window.matchMedia('(prefers-color-scheme: dark)').matches);
     // #1420 — multi-provider dark-tile picker. Light mode unchanged.
     let _darkRefLayer = null;  // Esri-only: labels overlay
+    // #332 — every tile URL and attribution comes from the configured
+    // dark/light provider. The old body hard-coded CARTO in three places
+    // (the light-mode url fallback, the 'carto-dark' registry fallback and
+    // the '© OpenStreetMap © CartoDB' credit), so a map on an instance
+    // configured for Esri/OpenTopoMap still fetched keyless CARTO tiles —
+    // which have been stamped "API KEY REQUIRED" since August 2026.
     function _resolveTileUrl(dark) {
-      const reg = window.MC_TILE_PROVIDERS || {};
-      if (!dark) {
-        const lightId = (typeof window.MC_getLightTileProvider === 'function') ? window.MC_getLightTileProvider() : null;
-        const lp = lightId ? (reg[lightId] || null) : null;
-        if (lp && lp.url) {
-          return { url: (typeof lp.url === 'function' ? lp.url() : lp.url), attribution: lp.attribution || '© OpenStreetMap © CartoDB', refUrl: null };
+      // Preferred path: the registry's single resolver. It picks the
+      // provider for this theme and invokes lazy `url` functions, so url
+      // AND attribution always come from the configured provider.
+      if (typeof window.MC_getTileSpec === 'function') {
+        const s = window.MC_getTileSpec(dark ? 'dark' : 'light');
+        if (s && s.url) {
+          return { url: s.url, attribution: s.attribution || '© OpenStreetMap contributors', refUrl: s.refUrl || null };
         }
-        return { url: TILE_LIGHT, attribution: '© OpenStreetMap © CartoDB', refUrl: null };
       }
-      const id  = (typeof window.MC_getDarkTileProvider === 'function') ? window.MC_getDarkTileProvider() : 'carto-dark';
-      const p   = reg[id] || reg['carto-dark'] || {};
+      // Legacy/partial registry: accessors without getTileSpec.
+      const reg = window.MC_TILE_PROVIDERS || {};
+      const getId = dark ? window.MC_getDarkTileProvider : window.MC_getLightTileProvider;
+      const id = (typeof getId === 'function') ? getId() : null;
+      const p = (id && reg[id]) || {};
       return {
-        url: (typeof p.url === 'function' ? p.url() : p.url) || (typeof p.baseUrl === 'function' ? p.baseUrl() : p.baseUrl) || TILE_DARK,
-        attribution: p.attribution || '© OpenStreetMap © CartoDB',
+        url: (typeof p.url === 'function' ? p.url() : p.url) || (typeof p.baseUrl === 'function' ? p.baseUrl() : p.baseUrl) || (dark ? TILE_DARK : TILE_LIGHT),
+        attribution: p.attribution || '© OpenStreetMap contributors',
         refUrl: p.refUrl || null
       };
     }
diff --git a/public/roles.js b/public/roles.js
index c7253e407..2edbb5fdb 100644
--- a/public/roles.js
+++ b/public/roles.js
@@ -588,47 +588,70 @@
   };
 
   // ─── Tile URLs ───
-  window.TILE_DARK  = 'https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png';
-  window.TILE_LIGHT = 'https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png';
+  // #332 — these are the LAST-RESORT templates, used only when
+  // map-tile-providers.js has not loaded (standalone pages, unit tests) or
+  // when the active style is malformed. They must not be CARTO: keyless
+  // CARTO raster tiles have been stamped "API KEY REQUIRED" since August
+  // 2026, so a CARTO default produced watermarked maps on every instance
+  // that had not changed providers. Keyless OSM Standard is the baseline
+  // the rest of the app already uses for its registry-less maps.
+  // Operators can still override both via the legacy `tiles.dark` /
+  // `tiles.light` and `map.tiles.darkUrl` / `lightUrl` config keys.
+  window.TILE_DARK  = 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png';
+  window.TILE_LIGHT = 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png';
 
-  window.getTileUrl = function () {
-    var isDark = document.documentElement.getAttribute('data-theme') === 'dark' ||
+  function _tileThemeIsDark() {
+    return document.documentElement.getAttribute('data-theme') === 'dark' ||
       (document.documentElement.getAttribute('data-theme') !== 'light' &&
        window.matchMedia('(prefers-color-scheme: dark)').matches);
-    if (!isDark) return TILE_LIGHT;
-    // #1461 followup: honor customizer's dark-tile-provider pick (#1420 / #1430)
-    // when the registry is loaded. Falls back to TILE_DARK if absent.
+  }
+
+  /* #332 — resolve the configured provider for the current theme.
+   * Returns the registry style object, or null when no registry applies.
+   * Both themes are honoured: before #332 only dark consulted the
+   * registry, so a light-mode map ignored map.tiles.lightDefault entirely
+   * and fell through to the hard-coded CARTO template above. */
+  function _activeTileStyle() {
+    var isDark = _tileThemeIsDark();
     try {
-      if (window.MC_getDarkTileProvider && window.MC_TILE_PROVIDERS) {
-        var id = window.MC_getDarkTileProvider();
-        var p = window.MC_TILE_PROVIDERS[id];
-        if (p && (p.url || p.baseUrl)) {
-          // #1614: providers added in #1533 (carto/osm/stamen) declare
-          // `url` as a function for lazy config resolution. Invoke it so
-          // we always return a string URL template; L.tileLayer otherwise
-          // stringifies the function source and every tile request 404s.
-          var u = p.url || p.baseUrl;
-          return (typeof u === 'function') ? u() : u;
-        }
+      var reg = window.MC_TILE_PROVIDERS;
+      if (!reg) return null;
+      var getId = isDark ? window.MC_getDarkTileProvider : window.MC_getLightTileProvider;
+      if (typeof getId !== 'function') return null;
+      return reg[getId()] || null;
+    } catch (_e) { return null; }
+  }
+
+  window.getTileUrl = function () {
+    var isDark = _tileThemeIsDark();
+    try {
+      // Preferred path: the registry's own resolver already invokes lazy
+      // `url` functions and picks the right provider per theme.
+      if (typeof window.MC_getTileSpec === 'function') {
+        var spec = window.MC_getTileSpec(isDark ? 'dark' : 'light');
+        if (spec && spec.url) return spec.url;
+      }
+      // Older/partial registries (and tests that mock only the accessors)
+      // expose MC_TILE_PROVIDERS + MC_get*TileProvider without getTileSpec.
+      var p = _activeTileStyle();
+      if (p && (p.url || p.baseUrl)) {
+        // #1614: providers added in #1533 (carto/osm/stamen) declare
+        // `url` as a function for lazy config resolution. Invoke it so
+        // we always return a string URL template; L.tileLayer otherwise
+        // stringifies the function source and every tile request 404s.
+        var u = p.url || p.baseUrl;
+        return (typeof u === 'function') ? u() : u;
       }
     } catch (_e) {}
-    return TILE_DARK;
+    return isDark ? TILE_DARK : TILE_LIGHT;
   };
   /* Helper: get the full provider object (for callers that also need the
-   * invertFilter or refUrl/attribution). Returns null when no customizer
-   * provider applies (light mode, or registry not loaded). */
+   * invertFilter or refUrl/attribution). Returns null when no registry
+   * provider applies. #332: light mode resolves too, so the node-detail
+   * inset map credits the configured light provider instead of a generic
+   * fallback. */
   window.getActiveTileProvider = function () {
-    var isDark = document.documentElement.getAttribute('data-theme') === 'dark' ||
-      (document.documentElement.getAttribute('data-theme') !== 'light' &&
-       window.matchMedia('(prefers-color-scheme: dark)').matches);
-    if (!isDark) return null;
-    try {
-      if (window.MC_getDarkTileProvider && window.MC_TILE_PROVIDERS) {
-        var id = window.MC_getDarkTileProvider();
-        return window.MC_TILE_PROVIDERS[id] || null;
-      }
-    } catch (_e) {}
-    return null;
+    return _activeTileStyle();
   };
 
   // ─── SNR thresholds ───
diff --git a/test-all.sh b/test-all.sh
index 1b13852ea..6a1654fd8 100755
--- a/test-all.sh
+++ b/test-all.sh
@@ -109,6 +109,7 @@ run test-issue-1418-deeplink-hops-channels.js
 run test-issue-1418-polish-review.js
 run test-issue-1420-tile-providers.js
 run test-issue-1614-tile-url-function.js
+run test-issue-332-tile-provider-fallback.js
 run test-issue-1438-marker-css-vars.js
 run test-issue-1438-customizer-mcrole.js
 run test-issue-1446-cb-preset-cascade.js
diff --git a/test-issue-1420-tile-providers.js b/test-issue-1420-tile-providers.js
index 4c28e7de6..8499e8dc8 100644
--- a/test-issue-1420-tile-providers.js
+++ b/test-issue-1420-tile-providers.js
@@ -82,19 +82,26 @@ const ALL_CARTO_IDS  = ['carto-dark', 'carto-light', 'carto-voyager', 'carto-voy
 const ALL_OSM_IDS    = ['osm-standard', 'osm-dark'];
 const ALL_STAMEN_IDS = ['stamen-toner-lite', 'stamen-toner-dark'];
 const ALL_ESRI_IDS   = ['esri-darkgray-labels'];
+// #332 — the built-in non-CARTO defaults; registered regardless of gating.
+const FALLBACK_IDS   = ['osm-dark', 'osm-standard'];
 const ALL_IDS        = [...ALL_CARTO_IDS, ...ALL_OSM_IDS, ...ALL_STAMEN_IDS, ...ALL_ESRI_IDS];
 
 console.log('\u2500\u2500 #1420 Tile provider registry \u2500\u2500');
 
 // ─── Registry shape ──────────────────────────────────────────────────────────
 
-test('Default registry (no MC_MAP_CFG) contains only Carto providers', () => {
+test('Default registry (no MC_MAP_CFG) has Carto plus the #332 fallback defaults', () => {
   const ctx = makeSandbox();
   loadProviders(ctx);
   const reg = ctx.window.MC_TILE_PROVIDERS;
   assert.ok(reg, 'registry must exist on window');
   for (const id of ALL_CARTO_IDS) assert.ok(reg[id], 'should have ' + id);
-  for (const id of [...ALL_OSM_IDS, ...ALL_STAMEN_IDS]) assert.ok(!reg[id], 'should NOT have ' + id + ' without config');
+  // #332 — 'osm-dark' / 'osm-standard' are the keyless fallback defaults and
+  // are registered unconditionally so the active id always resolves (and
+  // stays selectable in the layer picker). The token-gated Stamen styles and
+  // the rest of the OSM family still need config.
+  for (const id of FALLBACK_IDS) assert.ok(reg[id], 'should have fallback default ' + id);
+  for (const id of ALL_STAMEN_IDS) assert.ok(!reg[id], 'should NOT have ' + id + ' without config');
 });
 
 test('Every registry entry has a url function or string with {z}', () => {
@@ -227,7 +234,12 @@ test('OSM providers absent when osm.enabled=false', () => {
   ctx.window.MC_MAP_CFG = { tiles: { providers: { osm: { enabled: false } } } };
   ctx.window.MC_initTileRegistry(false);
   const reg = ctx.window.MC_TILE_PROVIDERS;
-  for (const id of ALL_OSM_IDS) assert.ok(!reg[id], id + ' should be absent when disabled');
+  // #332 — 'osm-dark' / 'osm-standard' are the built-in fallback defaults and
+  // stay registered even here; `enabled` governs every other OSM style.
+  for (const id of ALL_OSM_IDS) {
+    if (FALLBACK_IDS.includes(id)) assert.ok(reg[id], id + ' is a #332 fallback default — must stay registered');
+    else assert.ok(!reg[id], id + ' should be absent when disabled');
+  }
 });
 
 test('Stamen providers appear when stamen.enabled=true and token provided', () => {
@@ -299,11 +311,11 @@ test('MC_setDarkTileProvider rejects unknown IDs', () => {
   assert.strictEqual(ctx.events.length, 0, 'should not dispatch event on invalid ID');
 });
 
-test('MC_getDarkTileProvider falls back: localStorage > server default > carto-dark', () => {
+test('MC_getDarkTileProvider falls back: localStorage > server default > osm-dark (#332)', () => {
   const ctx = makeSandbox();
   loadProviders(ctx);
-  // No state → default
-  assert.strictEqual(ctx.window.MC_getDarkTileProvider(), 'carto-dark');
+  // No state → built-in default. #332 made this non-CARTO.
+  assert.strictEqual(ctx.window.MC_getDarkTileProvider(), 'osm-dark');
   // Server default surfaces
   ctx.window.MC_setServerDefaultTileProvider('carto-voyager-dark');
   assert.strictEqual(ctx.window.MC_getDarkTileProvider(), 'carto-voyager-dark');
@@ -334,11 +346,11 @@ test('MC_setLightTileProvider rejects unknown IDs', () => {
   assert.strictEqual(ctx.events.length, 0, 'should not dispatch event on invalid ID');
 });
 
-test('MC_getLightTileProvider falls back: localStorage > server default > carto-light', () => {
+test('MC_getLightTileProvider falls back: localStorage > server default > osm-standard (#332)', () => {
   const ctx = makeSandbox();
   loadProviders(ctx);
-  // No state → default
-  assert.strictEqual(ctx.window.MC_getLightTileProvider(), 'carto-light');
+  // No state → built-in default. #332 made this non-CARTO.
+  assert.strictEqual(ctx.window.MC_getLightTileProvider(), 'osm-standard');
   // Server light default
   ctx.window.MC_setServerDefaultLightTileProvider('carto-voyager');
   assert.strictEqual(ctx.window.MC_getLightTileProvider(), 'carto-voyager');
@@ -352,8 +364,9 @@ test('MC_getLightTileProvider ignores stored dark-type providers', () => {
   loadProviders(ctx);
   // Manually jam a dark id into the light storage key to simulate stale state
   ctx.localStorage.setItem('mc-light-tile-provider', 'carto-dark');
-  // Should fall back to default because 'carto-dark' has type === 'dark'
-  assert.strictEqual(ctx.window.MC_getLightTileProvider(), 'carto-light');
+  // Should fall back to the built-in light default because 'carto-dark' has
+  // type === 'dark'.
+  assert.strictEqual(ctx.window.MC_getLightTileProvider(), 'osm-standard');
 });
 
 // ─── CSS filter behavior ──────────────────────────────────────────────────────
@@ -411,12 +424,13 @@ test('MC_initTileRegistry(false) does NOT dispatch mc-tile-provider-changed', ()
 test('MC_TILE_PROVIDERS reference stays in sync after MC_initTileRegistry rebuild', () => {
   const ctx = makeSandbox();
   loadProviders(ctx);
-  // Initially carto only
-  assert.ok(!ctx.window.MC_TILE_PROVIDERS['osm-standard'], 'osm absent before config');
-  ctx.window.MC_MAP_CFG = { tiles: { providers: { osm: { enabled: true } } } };
+  // #332 keeps the fallback defaults registered, so use a token-gated style
+  // to observe the rebuild instead.
+  assert.ok(!ctx.window.MC_TILE_PROVIDERS['stamen-toner-lite'], 'stamen absent before config');
+  ctx.window.MC_MAP_CFG = { tiles: { providers: { stamen: { enabled: true, token: 'x' } } } };
   ctx.window.MC_initTileRegistry(false);
   // After re-init, window.MC_TILE_PROVIDERS must reflect the new registry
-  assert.ok(ctx.window.MC_TILE_PROVIDERS['osm-standard'], 'osm present after re-init');
+  assert.ok(ctx.window.MC_TILE_PROVIDERS['stamen-toner-lite'], 'stamen present after re-init');
 });
 
 // ─── OSM URL generation ───────────────────────────────────────────────────────
diff --git a/test-issue-1470-node-tile-helper.js b/test-issue-1470-node-tile-helper.js
index 9e6a9cd09..056483255 100644
--- a/test-issue-1470-node-tile-helper.js
+++ b/test-issue-1470-node-tile-helper.js
@@ -143,12 +143,21 @@ function assertProviderSet(ctx, id) {
 
 console.log('── #1470 node-detail inset-map tile-provider routing ──');
 
-test('roles.js + providers: getActiveTileProvider returns null in light mode', () => {
+// #332 — getActiveTileProvider() used to return null in light mode, so the
+// node-detail inset map credited a generic fallback instead of the operator's
+// configured light provider. It now resolves both themes; the light style
+// carries no invertFilter, so the rendered result is unchanged.
+test('roles.js + providers: getActiveTileProvider returns the LIGHT provider in light mode (#332)', () => {
   const ctx = makeSandbox({ theme: 'light', prefersDark: false });
   loadInto(ctx, 'public/map-tile-providers.js');
   loadInto(ctx, 'public/roles.js');
   const p = ctx.window.getActiveTileProvider();
-  assert.strictEqual(p, null, 'expected null in light mode, got ' + JSON.stringify(p));
+  assert.ok(p, 'expected a provider in light mode, got ' + JSON.stringify(p));
+  assert.strictEqual(p.type, 'light', 'must be a light style, got ' + p.type);
+  assert.strictEqual(p.invertFilter, null, 'a light style must not carry an invert filter');
+  assert.strictEqual(ctx.window.MC_setLightTileProvider('carto-light'), true);
+  const q = ctx.window.getActiveTileProvider();
+  assert.ok(/CartoDB/.test(q.attribution), 'follows the selected light provider, got ' + q.attribution);
 });
 
 test('roles.js + providers: getActiveTileProvider returns selected provider in dark mode', () => {
@@ -214,7 +223,7 @@ test('_applyTilesToNodeMap: dark + carto-dark (non-inverted) → no invert filte
     'no invert filter for carto-dark — got ' + JSON.stringify(mock.tilePane.style.filter));
 });
 
-test('_applyTilesToNodeMap: light mode → uses TILE_LIGHT (carto light_all), no invert', () => {
+test('_applyTilesToNodeMap: light mode → uses the configured light tile URL, no invert', () => {
   const ctx = makeSandbox({ theme: 'light', prefersDark: false });
   loadInto(ctx, 'public/map-tile-providers.js');
   loadInto(ctx, 'public/roles.js');
diff --git a/test-issue-332-no-carto-tiles-e2e.js b/test-issue-332-no-carto-tiles-e2e.js
new file mode 100644
index 000000000..05030f100
--- /dev/null
+++ b/test-issue-332-no-carto-tiles-e2e.js
@@ -0,0 +1,210 @@
+/**
+ * E2E (#332): no page may request a tile from basemaps.cartocdn.com.
+ *
+ * Several maps used to build their tile URL from a hard-coded CARTO
+ * template instead of the operator's configured dark/light provider.
+ * Keyless CARTO raster tiles have been stamped "API KEY REQUIRED" since
+ * August 2026, so those maps rendered watermarked tiles even on an
+ * instance configured for Esri/OpenTopoMap/OSM.
+ *
+ * This test drives a real browser over every surface named in the issue —
+ * node detail, the main map, Live, Areas and both customizer geo-filter
+ * previews — in BOTH themes, and asserts:
+ *
+ *   1. zero network requests to basemaps.cartocdn.com, and
+ *   2. at least one tile request that DOES go to the expected provider
+ *      host (so "no CARTO" can't pass by the map simply never loading).
+ *
+ * Third-party tile IMAGE requests are stubbed with a 1x1 PNG at the route
+ * level: the point is which URL the page asks for, not what comes back,
+ * and CI has no business reaching a tile CDN. Everything else off-origin
+ * (the Leaflet/Chart.js bundles the pages load from unpkg) is allowed
+ * through unchanged — stubbing those breaks the maps outright.
+ *
+ * Usage:
+ *   BASE_URL=http://localhost:13800 node test-issue-332-no-carto-tiles-e2e.js
+ *
+ * Optional: EXPECT_TILE_HOST_DARK / EXPECT_TILE_HOST_LIGHT override the
+ * host each theme's maps are expected to hit. Both default to
+ * 'tile.openstreetmap.org', the keyless built-in fallback a server with no
+ * map.tiles config resolves to (what CI runs). Point them at a configured
+ * provider's host to verify a specific operator configuration, e.g.
+ *   EXPECT_TILE_HOST_DARK=server.arcgisonline.com \
+ *   EXPECT_TILE_HOST_LIGHT=tile.opentopomap.org node <this file>
+ * against a server whose config.json sets darkDefault/lightDefault to
+ * 'esri-darkgray-labels' / 'opentopomap'.
+ */
+'use strict';
+const { chromium } = require('playwright');
+
+const BASE = process.env.BASE_URL || 'http://localhost:13800';
+const CARTO_HOST = 'basemaps.cartocdn.com';
+// The keyless built-in fallback (#332) — what a server with no map.tiles
+// config resolves to, in both themes.
+const OSM_HOST = 'tile.openstreetmap.org';
+const EXPECT = {
+  dark:  process.env.EXPECT_TILE_HOST_DARK  || OSM_HOST,
+  light: process.env.EXPECT_TILE_HOST_LIGHT || OSM_HOST,
+};
+// A node with lat/lon in test-fixtures/e2e-fixture.db, so the detail page
+// actually renders its inset map.
+const NODE_KEY = process.env.NODE_KEY ||
+  '988396af0ff369c2178a8c2a303661bf26193257136ed4452b6eadd9547011e9';
+
+// 1x1 transparent PNG — stands in for every third-party tile.
+const PNG_1X1 = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH/q842iQAAAABJRU5ErkJggg==',
+  'base64');
+
+let passed = 0, failed = 0;
+async function step(name, fn) {
+  try { await fn(); passed++; console.log('  ✓ ' + name); }
+  catch (e) { failed++; console.error('  ✗ ' + name + ': ' + e.message); }
+}
+function assert(c, m) { if (!c) throw new Error(m || 'assertion failed'); }
+
+(async () => {
+  const browser = await chromium.launch({
+    headless: true,
+    executablePath: process.env.CHROMIUM_PATH || undefined,
+    args: ['--no-sandbox', '--disable-gpu', '--disable-dev-shm-usage'],
+  });
+
+  console.log(`\n=== #332 no-CARTO tile requests against ${BASE} ===`);
+  console.log(`    expected tile host — dark: ${EXPECT.dark}  light: ${EXPECT.light}\n`);
+
+  // One fresh context per surface so the recorded request list is scoped,
+  // and so a tile cached by an earlier page can't mask a later regression.
+  async function withPage(theme, fn) {
+    const ctx = await browser.newContext();
+    const tiles = [];
+    // Record + stub off-origin IMAGE requests only (tiles). Scripts and
+    // stylesheets — Leaflet, Chart.js — must load for real or no map exists.
+    await ctx.route(/^https?:\/\/(?!localhost|127\.0\.0\.1)/i, async (route) => {
+      if (route.request().resourceType() !== 'image') { await route.continue(); return; }
+      tiles.push(route.request().url());
+      await route.fulfill({ status: 200, contentType: 'image/png', body: PNG_1X1 });
+    });
+    // Pin the theme before any app script runs, so the very first tile
+    // attach already uses the theme under test. addInitScript can run before
+    // <html> exists, so set it again on DOMContentLoaded.
+    // 'meshcore-theme' is the key index.html's inline bootstrap and
+    // app.js applyTheme() both read; setting data-theme alone is undone by
+    // them on load.
+    await ctx.addInitScript((t) => {
+      try { localStorage.setItem('meshcore-theme', t); } catch (_) {}
+      const apply = () => {
+        try { document.documentElement.setAttribute('data-theme', t); } catch (_) {}
+      };
+      apply();
+      document.addEventListener('DOMContentLoaded', apply);
+    }, theme);
+    const page = await ctx.newPage();
+    page.setDefaultTimeout(15000);
+    page.on('pageerror', (e) => console.error('    [pageerror]', e.message));
+    try { await fn(page, tiles); }
+    finally { await ctx.close(); }
+  }
+
+  function check(label, tiles, { requireHit = true, expectHost = null } = {}) {
+    const carto = tiles.filter((u) => u.indexOf(CARTO_HOST) !== -1);
+    assert(carto.length === 0,
+      `${label}: ${carto.length} request(s) to ${CARTO_HOST} — first: ${carto[0]}`);
+    if (requireHit) {
+      const host = expectHost || OSM_HOST;
+      const hits = tiles.filter((u) => u.indexOf(host) !== -1);
+      assert(hits.length > 0,
+        `${label}: no tile request to ${host} — the map did not load, ` +
+        `so "0 CARTO requests" proves nothing. Saw: ${JSON.stringify(tiles.slice(0, 5))}`);
+    }
+  }
+
+  for (const theme of ['dark', 'light']) {
+    console.log(`── theme: ${theme} ──`);
+
+    await step(`[${theme}] /#/map requests no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/map', { waitUntil: 'domcontentloaded' });
+        await page.waitForSelector('#leaflet-map .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        check('map', tiles, { expectHost: EXPECT[theme] });
+      });
+    });
+
+    await step(`[${theme}] /#/live requests no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/live', { waitUntil: 'domcontentloaded' });
+        await page.waitForSelector('.leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        check('live', tiles, { expectHost: EXPECT[theme] });
+      });
+    });
+
+    await step(`[${theme}] node detail inset map requests no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/nodes/' + NODE_KEY, { waitUntil: 'domcontentloaded' });
+        await page.waitForSelector('.leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        check('node detail', tiles, { expectHost: EXPECT[theme] });
+      });
+    });
+
+    await step(`[${theme}] Areas tab requests no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/analytics', { waitUntil: 'domcontentloaded' });
+        const tab = page.locator('.tab-btn[data-tab="areas"]');
+        await tab.waitFor({ timeout: 15000 });
+        await tab.click();
+        await page.waitForTimeout(2500);
+        // The Areas tab only mounts a map when the fixture has areas, so a
+        // tile hit is not guaranteed here — the CARTO assertion is.
+        check('areas', tiles, { requireHit: false });
+      });
+    });
+
+    await step(`[${theme}] customizer geo-filter previews request no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/map', { waitUntil: 'domcontentloaded' });
+        await page.waitForSelector('#customizeToggle', { timeout: 15000 });
+        // Drop the map's own tiles so the next requests come from the
+        // customizer previews alone.
+        await page.waitForTimeout(1200);
+        tiles.length = 0;
+        await page.click('#customizeToggle');
+        const gfTab = page.locator('.cust-tab[data-tab="geofilter"]');
+        await gfTab.waitFor({ timeout: 15000 });
+        await gfTab.click();
+        await page.waitForSelector('#cv2-gf-map .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        // Both previews are deliberately LIGHT-styled whatever the app theme
+        // is, so they resolve the configured light provider in both passes.
+        check('customizer geo-filter tab', tiles, { expectHost: EXPECT.light });
+
+        // Clicking the inset opens the full-screen modal preview — the
+        // second site that used to hard-code CARTO.
+        tiles.length = 0;
+        await page.click('#cv2-gf-map');
+        await page.waitForSelector('#cv2-gf-modal-map .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        check('customizer geo-filter modal', tiles, { expectHost: EXPECT.light });
+      });
+    });
+  }
+
+  // The standalone geo-filter builder has no provider registry at all; it
+  // used to hard-code the CARTO dark template.
+  await step('standalone /geofilter-builder.html requests no CARTO tiles', async () => {
+    await withPage('dark', async (page, tiles) => {
+      await page.goto(BASE + '/geofilter-builder.html', { waitUntil: 'domcontentloaded' });
+      await page.waitForSelector('#map .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+      await page.waitForTimeout(1500);
+      // The builder loads no registry, so it always uses the OSM baseline
+      // regardless of how the server is configured.
+      check('geofilter-builder', tiles, { expectHost: OSM_HOST });
+    });
+  });
+
+  await browser.close();
+  console.log(`\n#332 no-CARTO E2E: ${passed} passed, ${failed} failed`);
+  process.exit(failed === 0 ? 0 : 1);
+})().catch((e) => { console.error(e); process.exit(1); });
diff --git a/test-issue-332-tile-provider-fallback.js b/test-issue-332-tile-provider-fallback.js
new file mode 100644
index 000000000..161768ffd
--- /dev/null
+++ b/test-issue-332-tile-provider-fallback.js
@@ -0,0 +1,545 @@
+/* test-issue-332-tile-provider-fallback.js — #332.
+ *
+ * Bug: several maps still built their tile URL (and attribution) from a
+ * hard-coded CARTO template instead of the operator's configured
+ * dark/light provider. Since August 2026 keyless CARTO raster tiles come
+ * back HTTP 200 with "API KEY REQUIRED" stamped into the PNG, so those
+ * maps render watermarked tiles even on an instance configured for
+ * Esri/OpenTopoMap/OSM:
+ *
+ *   - public/roles.js        window.TILE_DARK / window.TILE_LIGHT were
+ *                            CARTO URLs, and getTileUrl() ignored the
+ *                            configured LIGHT provider entirely (it
+ *                            returned TILE_LIGHT unconditionally).
+ *   - public/customize-v2.js both geo-filter preview maps hard-coded
+ *                            CARTO light_all.
+ *   - public/live.js         the url + attribution fallbacks assumed CARTO.
+ *   - public/map.js          same two fallbacks as live.js.
+ *
+ * Contract under test:
+ *   M1  The registry's fallback defaults (no darkDefault/lightDefault in
+ *       config) are NON-CARTO, and are always resolvable in REGISTRY so
+ *       no caller has to invent a URL of its own.
+ *   M2  MC_getTileSpec(type) is the one resolver: it returns a string url
+ *       (function-valued `url` entries invoked) plus the provider's own
+ *       attribution.
+ *   M3  roles.js getTileUrl() honours the configured provider for EACH
+ *       provider and for BOTH themes, and its last-resort fallback is
+ *       non-CARTO. getActiveTileProvider() resolves in light mode too.
+ *   M4  The two customizer preview maps take url + attribution from the
+ *       configured light provider (asserted by running the production
+ *       L.tileLayer() call sites, not by grepping).
+ *   M5  live.js / map.js tile resolvers prefer MC_getTileSpec and their
+ *       fallback attribution does not name CartoDB.
+ *   M6  The only runtime `basemaps.cartocdn.com` literal left under
+ *       public/ is inside map-tile-providers.js _getCartoBase().
+ *
+ * Runs via: node test-issue-332-tile-provider-fallback.js
+ * Pure vm sandbox — no jsdom, no Playwright.
+ */
+'use strict';
+const vm     = require('vm');
+const fs     = require('fs');
+const path   = require('path');
+const assert = require('assert');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log('  ✅ ' + name); }
+  catch (e) { failed++; console.log('  ❌ ' + name + ': ' + e.message); }
+}
+
+const CARTO_HOST = 'cartocdn.com';
+
+function makeStorage() {
+  const store = {};
+  return {
+    getItem(k)    { return Object.prototype.hasOwnProperty.call(store, k) ? store[k] : null; },
+    setItem(k, v) { store[k] = String(v); },
+    removeItem(k) { delete store[k]; },
+    clear()       { for (const k of Object.keys(store)) delete store[k]; },
+  };
+}
+
+// ─── Sandbox ────────────────────────────────────────────────────────────
+// opts.theme      'dark' | 'light'  (document.documentElement data-theme)
+// opts.mapCfg     value for window.MC_MAP_CFG, applied BEFORE the registry
+//                 self-initialises at parse time.
+function makeSandbox(opts) {
+  opts = opts || {};
+  const tilePane = {
+    style: { filter: '' },
+    setAttribute: () => {},
+    getAttribute: () => null,
+    removeAttribute: () => {},
+  };
+  const ctx = {
+    console,
+    setTimeout, clearTimeout,
+    JSON, Date, Math, Object, Array, String, Number, Boolean, Set, Map,
+    fetch: () => Promise.resolve({ ok: false, json: () => Promise.resolve({}) }),
+    localStorage: makeStorage(),
+    document: {
+      documentElement: {
+        getAttribute: () => opts.theme || 'dark',
+        setAttribute: () => {},
+        style: { getPropertyValue: () => '', setProperty: () => {} },
+      },
+      querySelector: (sel) => (sel === '.leaflet-tile-pane' ? tilePane : null),
+      querySelectorAll: () => [],
+      getElementById: () => null,
+      createElement: () => ({ style: {}, appendChild: () => {}, setAttribute: () => {}, addEventListener: () => {} }),
+      addEventListener: () => {},
+      body: { appendChild: () => {}, style: {} },
+      head: { appendChild: () => {} },
+      readyState: 'complete',
+    },
+    window: {
+      addEventListener: () => {},
+      dispatchEvent: () => true,
+      matchMedia: () => ({ matches: (opts.theme || 'dark') === 'dark', addEventListener: () => {} }),
+    },
+    CustomEvent: function (type, init) { this.type = type; this.detail = (init && init.detail) || null; },
+  };
+  ctx.window.localStorage = ctx.localStorage;
+  ctx.window.document = ctx.document;
+  if (opts.mapCfg !== undefined) ctx.window.MC_MAP_CFG = opts.mapCfg;
+  ctx.globalThis = ctx;
+  ctx.tilePane = tilePane;
+  vm.createContext(ctx);
+  return ctx;
+}
+
+function loadInto(ctx, relPath) {
+  const src = fs.readFileSync(path.join(__dirname, relPath), 'utf8');
+  vm.runInContext(src, ctx, { filename: relPath });
+  // Mirror window.* back onto sandbox globals so bare-name refs inside the
+  // loaded files (TILE_DARK, getTileUrl, …) resolve like they do in a browser.
+  for (const k of Object.keys(ctx.window)) if (!(k in ctx)) ctx[k] = ctx.window[k];
+}
+
+// Full stack: registry + roles.js, with config already in place.
+function loadStack(opts) {
+  const ctx = makeSandbox(opts);
+  loadInto(ctx, path.join('public', 'map-tile-providers.js'));
+  loadInto(ctx, path.join('public', 'roles.js'));
+  return ctx;
+}
+
+// Brace-matched extraction of `function <name>(...) { … }` from a source file.
+function extractFn(relPath, name) {
+  const src = fs.readFileSync(path.join(__dirname, relPath), 'utf8');
+  const re = new RegExp('function\\s+' + name + '\\s*\\([^)]*\\)\\s*\\{');
+  const m = src.match(re);
+  if (!m) throw new Error(name + ' definition not found in ' + relPath);
+  const start = m.index;
+  let depth = 0, i = start;
+  for (; i < src.length; i++) {
+    if (src[i] === '{') depth++;
+    else if (src[i] === '}') { depth--; if (depth === 0) { i++; break; } }
+  }
+  return src.slice(start, i);
+}
+
+// Pull out the statement(s) that attach a tile layer to a named Leaflet map
+// in customize-v2.js, so the PRODUCTION call site is what gets executed.
+// Matches from the preceding `var _cv2Tile`-style line (if any) through
+// `.addTo(<mapVar>);`.
+function extractTileAttach(relPath, mapVar) {
+  const src = fs.readFileSync(path.join(__dirname, relPath), 'utf8');
+  const anchor = '.addTo(' + mapVar + ');';
+  // `.addTo(_gfMap);` also appears on markers/polygons, so find the
+  // L.tileLayer( call whose own .addTo() is the one we want.
+  let from = 0, callStart = -1, end = -1;
+  for (;;) {
+    const i = src.indexOf('L.tileLayer(', from);
+    if (i === -1) break;
+    const j = src.indexOf(anchor, i);
+    if (j !== -1 && j - i < 400) { callStart = i; end = j + anchor.length; break; }
+    from = i + 1;
+  }
+  if (callStart === -1) throw new Error('no L.tileLayer(...)' + anchor + ' in ' + relPath);
+  // Include the statements between the enclosing `L.map(` call and the tile
+  // layer — that is where the call site resolves its provider spec.
+  const blockStart = src.lastIndexOf('L.map(', callStart);
+  const lineStart = src.indexOf('\n', src.indexOf(';', blockStart)) + 1;
+  return src.slice(lineStart > 0 && lineStart < callStart ? lineStart : callStart, end);
+}
+
+function makeTileLayerSpy() {
+  const calls = [];
+  const L = {
+    tileLayer(url, opts) {
+      return { addTo(map) { calls.push({ url, opts, map }); return this; } };
+    },
+  };
+  return { L, calls };
+}
+
+const CFG_EMPTY  = { tiles: { providers: {} } };
+function cfgDefaults(dark, light) {
+  return {
+    tiles: {
+      darkDefault: dark,
+      lightDefault: light,
+      providers: {
+        carto: { enabled: true, domain: '' },
+        opentopomap: { enabled: true },
+        usgs: { enabled: true },
+      },
+    },
+  };
+}
+
+// ═══ M1 — fallback defaults are non-CARTO and always resolvable ═════════
+console.log('\n── #332 M1: registry fallback defaults are non-CARTO ──');
+
+test('M1 dark fallback (no darkDefault configured) is not a CARTO style', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: CFG_EMPTY });
+  const id = ctx.window.MC_getDarkTileProvider();
+  const p  = ctx.window.MC_TILE_PROVIDERS[id];
+  assert.ok(p, 'fallback dark id ' + JSON.stringify(id) + ' must exist in REGISTRY');
+  assert.notStrictEqual(p.provider, 'carto', 'fallback dark provider must not be carto, got id=' + id);
+  const url = typeof p.url === 'function' ? p.url() : p.url;
+  assert.ok(url.indexOf(CARTO_HOST) === -1, 'fallback dark URL must not hit CARTO: ' + url);
+});
+
+test('M1 light fallback (no lightDefault configured) is not a CARTO style', () => {
+  const ctx = loadStack({ theme: 'light', mapCfg: CFG_EMPTY });
+  const id = ctx.window.MC_getLightTileProvider();
+  const p  = ctx.window.MC_TILE_PROVIDERS[id];
+  assert.ok(p, 'fallback light id ' + JSON.stringify(id) + ' must exist in REGISTRY');
+  assert.notStrictEqual(p.provider, 'carto', 'fallback light provider must not be carto, got id=' + id);
+  const url = typeof p.url === 'function' ? p.url() : p.url;
+  assert.ok(url.indexOf(CARTO_HOST) === -1, 'fallback light URL must not hit CARTO: ' + url);
+});
+
+test('M1 fallback ids stay in REGISTRY even when every optional provider is disabled', () => {
+  const ctx = loadStack({
+    theme: 'dark',
+    mapCfg: { tiles: { providers: {
+      carto: { enabled: false }, osm: { enabled: false },
+      opentopomap: { enabled: false }, usgs: { enabled: false }, stamen: { enabled: false },
+    } } },
+  });
+  const reg = ctx.window.MC_TILE_PROVIDERS;
+  const d = ctx.window.MC_getDarkTileProvider();
+  const l = ctx.window.MC_getLightTileProvider();
+  assert.ok(reg[d], 'dark fallback ' + d + ' missing from REGISTRY when providers are disabled');
+  assert.ok(reg[l], 'light fallback ' + l + ' missing from REGISTRY when providers are disabled');
+  assert.strictEqual(reg[d].type, 'dark', d + ' must be a dark style');
+  assert.strictEqual(reg[l].type, 'light', l + ' must be a light style');
+});
+
+test('M1 a configured darkDefault/lightDefault still wins over the fallback', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: cfgDefaults('carto-dark', 'carto-light') });
+  assert.strictEqual(ctx.window.MC_getDarkTileProvider(), 'carto-dark');
+  assert.strictEqual(ctx.window.MC_getLightTileProvider(), 'carto-light');
+});
+
+// ═══ M2 — MC_getTileSpec is the single resolver ═════════════════════════
+console.log('\n── #332 M2: MC_getTileSpec(type) ──');
+
+test('M2 MC_getTileSpec is exposed', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: CFG_EMPTY });
+  assert.strictEqual(typeof ctx.window.MC_getTileSpec, 'function', 'window.MC_getTileSpec must exist');
+});
+
+test('M2 MC_getTileSpec("dark") returns the active dark provider url + attribution', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: cfgDefaults('esri-darkgray-labels', 'carto-light') });
+  const spec = ctx.window.MC_getTileSpec('dark');
+  assert.strictEqual(spec.id, 'esri-darkgray-labels');
+  assert.strictEqual(typeof spec.url, 'string', 'url must be a string template, got ' + typeof spec.url);
+  assert.ok(/World_Dark_Gray_Base/.test(spec.url), 'expected the Esri dark canvas URL, got ' + spec.url);
+  assert.strictEqual(spec.attribution, 'Tiles © Esri');
+});
+
+test('M2 MC_getTileSpec("light") returns the active LIGHT provider, not the dark one', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: cfgDefaults('esri-darkgray-labels', 'opentopomap') });
+  const spec = ctx.window.MC_getTileSpec('light');
+  assert.strictEqual(spec.id, 'opentopomap');
+  assert.ok(/tile\.opentopomap\.org/.test(spec.url), 'expected the OpenTopoMap URL, got ' + spec.url);
+  assert.ok(/OpenTopoMap/.test(spec.attribution), 'expected the OpenTopoMap attribution, got ' + spec.attribution);
+});
+
+test('M2 MC_getTileSpec invokes function-valued url (never leaks the function)', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: cfgDefaults('carto-dark', 'carto-light') });
+  const spec = ctx.window.MC_getTileSpec('dark');
+  assert.strictEqual(typeof spec.url, 'string');
+  assert.ok(/\{z\}/.test(spec.url) && /\{x\}/.test(spec.url) && /\{y\}/.test(spec.url),
+    'url must keep the leaflet placeholders, got ' + spec.url);
+});
+
+test('M2 MC_getTileSpec carries invertFilter + maxZoom from the provider', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: cfgDefaults('positron-dark', 'opentopomap') });
+  const dark = ctx.window.MC_getTileSpec('dark');
+  assert.ok(dark.invertFilter && /invert\(1\)/.test(dark.invertFilter), 'positron-dark inverts');
+  const light = ctx.window.MC_getTileSpec('light');
+  assert.strictEqual(light.maxZoom, 17, 'OpenTopoMap caps at zoom 17');
+});
+
+test('M2 MC_getTileSpec never returns a CARTO attribution for a non-CARTO provider', () => {
+  const ctx = loadStack({ theme: 'light', mapCfg: cfgDefaults('esri-darkgray-labels', 'usgs-topo') });
+  const spec = ctx.window.MC_getTileSpec('light');
+  assert.ok(!/Carto/i.test(spec.attribution), 'USGS attribution must not name Carto: ' + spec.attribution);
+});
+
+// ═══ M3 — roles.js getTileUrl() per provider + both themes + fallback ══
+console.log('\n── #332 M3: roles.js getTileUrl() ──');
+
+// One case per provider family, dark and light, driven through real config.
+const PROVIDER_CASES = [
+  { theme: 'dark',  dark: 'carto-dark',            light: 'carto-light', match: /basemaps\.cartocdn\.com\/dark_all/ },
+  { theme: 'dark',  dark: 'carto-voyager-dark',    light: 'carto-light', match: /rastertiles\/voyager/ },
+  { theme: 'dark',  dark: 'positron-dark',         light: 'carto-light', match: /light_all/ },
+  { theme: 'dark',  dark: 'esri-darkgray-labels',  light: 'carto-light', match: /World_Dark_Gray_Base/ },
+  { theme: 'light', dark: 'carto-dark',            light: 'carto-light', match: /basemaps\.cartocdn\.com\/light_all/ },
+  { theme: 'light', dark: 'carto-dark',            light: 'carto-voyager', match: /rastertiles\/voyager/ },
+  { theme: 'light', dark: 'carto-dark',            light: 'opentopomap', match: /tile\.opentopomap\.org/ },
+  { theme: 'light', dark: 'carto-dark',            light: 'usgs-topo',   match: /basemap\.nationalmap\.gov.*USGSTopo/ },
+  { theme: 'light', dark: 'carto-dark',            light: 'usgs-imagery', match: /USGSImageryTopo/ },
+];
+
+for (const c of PROVIDER_CASES) {
+  test('M3 ' + c.theme + ' + ' + (c.theme === 'dark' ? c.dark : c.light) + ' → getTileUrl() returns that provider’s URL', () => {
+    const ctx = loadStack({ theme: c.theme, mapCfg: cfgDefaults(c.dark, c.light) });
+    const url = ctx.window.getTileUrl();
+    assert.strictEqual(typeof url, 'string', 'getTileUrl() must return a string, got ' + typeof url);
+    assert.ok(c.match.test(url), 'expected ' + c.match + ', got ' + url);
+  });
+}
+
+test('M3 OSM provider (token-upgraded) reaches getTileUrl() in light mode', () => {
+  const ctx = loadStack({
+    theme: 'light',
+    mapCfg: { tiles: { darkDefault: 'osm-dark', lightDefault: 'osm-standard', providers: {
+      osm: { enabled: true, provider: 'maptiler', token: 'T0K' },
+    } } },
+  });
+  const url = ctx.window.getTileUrl();
+  assert.ok(/api\.maptiler\.com/.test(url), 'expected the MapTiler URL, got ' + url);
+  assert.ok(/key=T0K/.test(url), 'token must be carried through, got ' + url);
+});
+
+test('M3 stamen provider reaches getTileUrl() in light mode', () => {
+  const ctx = loadStack({
+    theme: 'light',
+    mapCfg: { tiles: { lightDefault: 'stamen-toner-lite', providers: {
+      stamen: { enabled: true, token: 'S1' },
+    } } },
+  });
+  const url = ctx.window.getTileUrl();
+  assert.ok(/stadiamaps\.com/.test(url), 'expected the Stadia/Stamen URL, got ' + url);
+});
+
+test('M3 FALLBACK: no registry at all, dark theme → non-CARTO URL', () => {
+  const ctx = makeSandbox({ theme: 'dark' });
+  loadInto(ctx, path.join('public', 'roles.js'));   // roles.js alone — no registry
+  const url = ctx.window.getTileUrl();
+  assert.strictEqual(typeof url, 'string');
+  assert.ok(url.indexOf(CARTO_HOST) === -1, 'dark fallback must not hit CARTO: ' + url);
+  assert.ok(/\{z\}/.test(url), 'fallback must still be a tile template: ' + url);
+});
+
+test('M3 FALLBACK: no registry at all, light theme → non-CARTO URL', () => {
+  const ctx = makeSandbox({ theme: 'light' });
+  loadInto(ctx, path.join('public', 'roles.js'));
+  const url = ctx.window.getTileUrl();
+  assert.ok(url.indexOf(CARTO_HOST) === -1, 'light fallback must not hit CARTO: ' + url);
+  assert.ok(/\{z\}/.test(url), 'fallback must still be a tile template: ' + url);
+});
+
+test('M3 FALLBACK: window.TILE_DARK / TILE_LIGHT are not CARTO templates', () => {
+  const ctx = makeSandbox({ theme: 'dark' });
+  loadInto(ctx, path.join('public', 'roles.js'));
+  assert.ok(ctx.window.TILE_DARK.indexOf(CARTO_HOST) === -1, 'TILE_DARK: ' + ctx.window.TILE_DARK);
+  assert.ok(ctx.window.TILE_LIGHT.indexOf(CARTO_HOST) === -1, 'TILE_LIGHT: ' + ctx.window.TILE_LIGHT);
+});
+
+test('M3 FALLBACK: a registry whose active style has no url still degrades non-CARTO', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: CFG_EMPTY });
+  ctx.window.MC_getTileSpec = function () { return { id: 'broken', url: null, attribution: '' }; };
+  ctx.window.MC_TILE_PROVIDERS = { broken: { provider: 'x', type: 'dark' } };
+  ctx.window.MC_getDarkTileProvider = function () { return 'broken'; };
+  const url = ctx.window.getTileUrl();
+  assert.ok(url.indexOf(CARTO_HOST) === -1, 'degraded path must not hit CARTO: ' + url);
+});
+
+test('M3 legacy registry shape (no MC_getTileSpec) still honours the LIGHT provider', () => {
+  const ctx = makeSandbox({ theme: 'light' });
+  loadInto(ctx, path.join('public', 'roles.js'));
+  ctx.window.MC_TILE_PROVIDERS = {
+    'legacy-light': { provider: 'esri', type: 'light', url: function () { return 'https://legacy.example/{z}/{x}/{y}.png'; } },
+  };
+  ctx.window.MC_getLightTileProvider = function () { return 'legacy-light'; };
+  const url = ctx.window.getTileUrl();
+  assert.strictEqual(url, 'https://legacy.example/{z}/{x}/{y}.png',
+    'light mode must consult MC_getLightTileProvider, got ' + url);
+});
+
+test('M3 getActiveTileProvider() resolves the configured LIGHT provider in light mode', () => {
+  const ctx = loadStack({ theme: 'light', mapCfg: cfgDefaults('carto-dark', 'opentopomap') });
+  const p = ctx.window.getActiveTileProvider();
+  assert.ok(p, 'expected a provider object in light mode, got ' + JSON.stringify(p));
+  assert.strictEqual(p.type, 'light');
+  assert.ok(/OpenTopoMap/.test(p.attribution), 'attribution must come from the provider, got ' + p.attribution);
+});
+
+test('M3 getActiveTileProvider() still resolves the dark provider in dark mode', () => {
+  const ctx = loadStack({ theme: 'dark', mapCfg: cfgDefaults('esri-darkgray-labels', 'carto-light') });
+  const p = ctx.window.getActiveTileProvider();
+  assert.ok(p && p.type === 'dark', 'expected the dark provider, got ' + JSON.stringify(p));
+  assert.strictEqual(p.attribution, 'Tiles © Esri');
+});
+
+// ═══ M4 — customizer preview maps ══════════════════════════════════════
+console.log('\n── #332 M4: customizer geo-filter preview maps ──');
+
+const CV2 = path.join('public', 'customize-v2.js');
+
+function runPreviewHelper(spec) {
+  const ctx = makeSandbox({ theme: 'light' });
+  ctx.window.TILE_LIGHT = 'https://fallback.example/{z}/{x}/{y}.png';
+  if (spec) ctx.window.MC_getTileSpec = function () { return spec; };
+  vm.runInContext(extractFn(CV2, '_cv2PreviewTile') + '\nvar __out = _cv2PreviewTile();', ctx, { filename: CV2 });
+  return ctx.__out;
+}
+
+test('M4 _cv2PreviewTile() takes url + attribution + maxZoom from the light provider', () => {
+  const out = runPreviewHelper({ id: 'opentopomap', url: 'https://a.tile.opentopomap.org/{z}/{x}/{y}.png', attribution: '© OpenTopoMap', maxZoom: 17 });
+  assert.strictEqual(out.url, 'https://a.tile.opentopomap.org/{z}/{x}/{y}.png');
+  assert.strictEqual(out.attribution, '© OpenTopoMap');
+  assert.strictEqual(out.maxZoom, 17);
+});
+
+test('M4 _cv2PreviewTile() falls back to the non-CARTO TILE_LIGHT when no registry is present', () => {
+  const out = runPreviewHelper(null);
+  assert.strictEqual(out.url, 'https://fallback.example/{z}/{x}/{y}.png');
+  assert.ok(!/Carto/i.test(out.attribution), 'fallback attribution must not name Carto: ' + out.attribution);
+});
+
+// Execute the PRODUCTION call sites so re-hardcoding a URL there fails here.
+for (const [label, mapVar] of [['geo-filter tab', '_gfMap'], ['geo-filter modal', '_gfModalMap']]) {
+  test('M4 ' + label + ' preview map attaches the configured light provider', () => {
+    const ctx = makeSandbox({ theme: 'light' });
+    const spy = makeTileLayerSpy();
+    ctx.L = spy.L;
+    ctx.window.TILE_LIGHT = 'https://fallback.example/{z}/{x}/{y}.png';
+    ctx.window.MC_getTileSpec = function (t) {
+      assert.strictEqual(t, 'light', 'preview maps must ask for the LIGHT provider, got ' + t);
+      return { id: 'opentopomap', url: 'https://a.tile.opentopomap.org/{z}/{x}/{y}.png', attribution: '© OpenTopoMap', maxZoom: 17 };
+    };
+    ctx[mapVar] = { __name: mapVar };
+    const code = extractFn(CV2, '_cv2PreviewTile') + '\n' + extractTileAttach(CV2, mapVar);
+    vm.runInContext(code, ctx, { filename: CV2 });
+    assert.strictEqual(spy.calls.length, 1, 'expected exactly one tile layer, got ' + spy.calls.length);
+    const call = spy.calls[0];
+    assert.ok(call.url.indexOf(CARTO_HOST) === -1, label + ' must not request CARTO tiles: ' + call.url);
+    assert.strictEqual(call.url, 'https://a.tile.opentopomap.org/{z}/{x}/{y}.png');
+    assert.strictEqual(call.opts.attribution, '© OpenTopoMap');
+    assert.strictEqual(call.opts.maxZoom, 17);
+  });
+}
+
+// ═══ M5 — live.js / map.js resolvers ═══════════════════════════════════
+console.log('\n── #332 M5: live.js / map.js tile resolvers ──');
+
+const RESOLVERS = [
+  { file: path.join('public', 'live.js'), fn: '_liveResolveTile' },
+  { file: path.join('public', 'map.js'),  fn: '_resolveTileUrl'  },
+];
+
+function runResolver(rel, fnName, setup) {
+  const ctx = makeSandbox({ theme: 'dark' });
+  ctx.window.TILE_DARK  = 'https://fallback.example/dark/{z}/{x}/{y}.png';
+  ctx.window.TILE_LIGHT = 'https://fallback.example/light/{z}/{x}/{y}.png';
+  if (setup) setup(ctx);
+  for (const k of Object.keys(ctx.window)) if (!(k in ctx)) ctx[k] = ctx.window[k];
+  vm.runInContext(extractFn(rel, fnName) + '\nvar __fn = ' + fnName + ';', ctx, { filename: rel });
+  return ctx.__fn;
+}
+
+for (const r of RESOLVERS) {
+  test('M5 ' + r.file + ' ' + r.fn + '(): no registry, light → attribution does not name CartoDB', () => {
+    const out = runResolver(r.file, r.fn)(false);
+    assert.ok(!/Carto/i.test(out.attribution), 'got ' + out.attribution);
+    assert.ok(out.url.indexOf(CARTO_HOST) === -1, 'got ' + out.url);
+  });
+
+  test('M5 ' + r.file + ' ' + r.fn + '(): no registry, dark → attribution does not name CartoDB', () => {
+    const out = runResolver(r.file, r.fn)(true);
+    assert.ok(!/Carto/i.test(out.attribution), 'got ' + out.attribution);
+    assert.ok(out.url.indexOf(CARTO_HOST) === -1, 'got ' + out.url);
+  });
+
+  test('M5 ' + r.file + ' ' + r.fn + '(): prefers MC_getTileSpec for both themes', () => {
+    const seen = [];
+    const fn = runResolver(r.file, r.fn, (ctx) => {
+      ctx.window.MC_getTileSpec = function (t) {
+        seen.push(t);
+        return { id: 'x-' + t, url: 'https://spec.example/' + t + '/{z}/{x}/{y}.png', attribution: 'ATTR-' + t, refUrl: null, maxZoom: 19 };
+      };
+    });
+    const d = fn(true), l = fn(false);
+    assert.deepStrictEqual(seen, ['dark', 'light'], 'resolver must pass the theme through, saw ' + JSON.stringify(seen));
+    assert.strictEqual(d.url, 'https://spec.example/dark/{z}/{x}/{y}.png');
+    assert.strictEqual(d.attribution, 'ATTR-dark');
+    assert.strictEqual(l.url, 'https://spec.example/light/{z}/{x}/{y}.png');
+    assert.strictEqual(l.attribution, 'ATTR-light');
+  });
+
+  test('M5 ' + r.file + ' ' + r.fn + '(): legacy registry — picks the accessor matching the theme', () => {
+    const fn = runResolver(r.file, r.fn, (ctx) => {
+      // No MC_getTileSpec: a partial/older registry exposing only accessors.
+      ctx.window.MC_TILE_PROVIDERS = {
+        'd1': { type: 'dark',  url: 'https://dark.example/{z}/{x}/{y}.png',  attribution: 'ATTR-D' },
+        'l1': { type: 'light', url: 'https://light.example/{z}/{x}/{y}.png', attribution: 'ATTR-L' },
+      };
+      ctx.window.MC_getDarkTileProvider  = function () { return 'd1'; };
+      ctx.window.MC_getLightTileProvider = function () { return 'l1'; };
+    });
+    const d = fn(true), l = fn(false);
+    assert.strictEqual(d.url, 'https://dark.example/{z}/{x}/{y}.png', 'dark must use MC_getDarkTileProvider');
+    assert.strictEqual(d.attribution, 'ATTR-D');
+    assert.strictEqual(l.url, 'https://light.example/{z}/{x}/{y}.png', 'light must use MC_getLightTileProvider');
+    assert.strictEqual(l.attribution, 'ATTR-L');
+  });
+
+  test('M5 ' + r.file + ' ' + r.fn + '(): carries the provider refUrl through', () => {
+    const fn = runResolver(r.file, r.fn, (ctx) => {
+      ctx.window.MC_getTileSpec = function () {
+        return { id: 'esri', url: 'https://e/{z}/{x}/{y}', attribution: 'Tiles © Esri', refUrl: 'https://e/ref/{z}/{x}/{y}', maxZoom: 19 };
+      };
+    });
+    assert.strictEqual(fn(true).refUrl, 'https://e/ref/{z}/{x}/{y}');
+  });
+}
+
+// ═══ M6 — no stray CARTO literal under public/ ═════════════════════════
+console.log('\n── #332 M6: no hard-coded CARTO host outside _getCartoBase() ──');
+
+test('M6 the only basemaps.cartocdn.com literal under public/ is in _getCartoBase()', () => {
+  const dir = path.join(__dirname, 'public');
+  const offenders = [];
+  (function walk(d) {
+    for (const name of fs.readdirSync(d)) {
+      const p = path.join(d, name);
+      const st = fs.statSync(p);
+      if (st.isDirectory()) { walk(p); continue; }
+      if (!/\.(js|html)$/.test(name)) continue;
+      const rel = path.relative(__dirname, p);
+      const src = fs.readFileSync(p, 'utf8');
+      src.split('\n').forEach((line, i) => {
+        if (line.indexOf('basemaps.cartocdn.com') === -1) return;
+        if (rel === path.join('public', 'map-tile-providers.js') && /_getCartoBase/.test(line)) return;
+        offenders.push(rel + ':' + (i + 1) + ': ' + line.trim().slice(0, 100));
+      });
+    }
+  })(dir);
+  assert.deepStrictEqual(offenders, [],
+    'hard-coded CARTO host(s) found:\n    ' + offenders.join('\n    '));
+});
+
+// ─── Summary ────────────────────────────────────────────────────────────
+console.log('\n' + (failed === 0 ? '✅' : '❌') + ' #332: ' + passed + ' passed, ' + failed + ' failed');
+process.exit(failed === 0 ? 0 : 1);

From 26beef7e45fc7614db34487324aae14823f48a3d Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 17:00:00 +0200
Subject: [PATCH 2/2] reviewfix(map): route the subpath minimap through the
 shared tile helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round-2 review findings on #344 (#332).

F1 (blocking) — dark-mode regression. The Analytics -> Subpaths detail
minimap did `L.tileLayer(getTileUrl())` and never applied the provider's
invertFilter. #332 makes `osm-dark` the dark default, and that style is
the LIGHT OSM template plus an invert filter, so on a default install in
dark mode this map rendered an un-inverted light basemap inside a dark
page. It now goes through the one shared helper every other inset map
uses (nodes.js `_applyTilesToNodeMap`), which resolves the configured
provider for the current theme and applies its invertFilter to that
map's own tile pane. It was the only `L.tileLayer(getTileUrl())` call
left in the frontend.

F2 (blocking) — E2E coverage gaps. Added steps for the Analytics ->
Subpaths minimap and the packet-path modal, and replaced the vacuous
"Areas tab" step: that tab mounts no Leaflet map at all (its
position-gap rows are not clickable there), so the step passed on zero
tiles. The Areas map that exists is AreaNodesMap, from the Position-Fix
Coverage Gaps tool. Every map step now also asserts that the resolved
provider's invertFilter reaches the tile pane -- read from the page, so
it holds for any configured provider.

F3 — attribution on the new default. `osm-standard` / `osm-dark`
credited "Maps (c) Mapbox/Thunderforest/MapTiler" unconditionally, but a
keyless install uses none of those three. The credit is now resolved the
same way `_getOsmUrl()` picks the URL: plain OSM by default, the one
configured vendor when a token is set.

F4 — the comment and config.example.json said "tiles to zoom 19"; both
OSM styles declare maxZoom 18.

F5 — the tile picker's last-resort ids were 'carto-dark' / 'carto-light'.
They now come from the registry's own exported defaults.

Relates to #332
---
 config.example.json                      |   2 +-
 public/analytics.js                      |  15 +-
 public/customize-v2.js                   |   8 +-
 public/map-tile-providers.js             |  27 ++-
 test-issue-332-no-carto-tiles-e2e.js     | 131 +++++++++++-
 test-issue-332-tile-provider-fallback.js | 246 +++++++++++++++++++++++
 6 files changed, 414 insertions(+), 15 deletions(-)

diff --git a/config.example.json b/config.example.json
index 52896d086..4e6c7dc25 100644
--- a/config.example.json
+++ b/config.example.json
@@ -94,7 +94,7 @@
   },
   "map": {
     "tiles": {
-      "_comment_defaults": "#332 — the built-in defaults are 'osm-dark' / 'osm-standard' (keyless OpenStreetMap, tiles to zoom 19). Set darkDefault/lightDefault to any enabled style id to override; they take priority over the built-in fallback. Carto is NOT the default any more: since August 2026 keyless Carto raster tiles come back HTTP 200 with 'API KEY REQUIRED' stamped into the PNG, and CoreScope has no Carto basemap-key plumbing.",
+      "_comment_defaults": "#332 — the built-in defaults are 'osm-dark' / 'osm-standard' (keyless OpenStreetMap, tiles to zoom 18). Set darkDefault/lightDefault to any enabled style id to override; they take priority over the built-in fallback. Carto is NOT the default any more: since August 2026 keyless Carto raster tiles come back HTTP 200 with 'API KEY REQUIRED' stamped into the PNG, and CoreScope has no Carto basemap-key plumbing.",
       "darkDefault": "osm-dark",
       "lightDefault": "osm-standard",
       "providers": {
diff --git a/public/analytics.js b/public/analytics.js
index 06eed67a1..39d90f2bf 100644
--- a/public/analytics.js
+++ b/public/analytics.js
@@ -2534,7 +2534,20 @@
     // Render minimap
     if (hasMap && typeof L !== 'undefined') {
       const map = L.map('subpathMap', { zoomControl: false, attributionControl: false });
-      L.tileLayer(getTileUrl(), { maxZoom: 18 }).addTo(map);
+      // #332 — go through the one shared helper (nodes.js, also used by the
+      // node-detail inset, node-reach, packet-path, area-nodes and
+      // rx-coverage maps). It resolves the configured provider for the
+      // current theme AND applies that provider's invertFilter to THIS
+      // map's own tile pane. A bare L.tileLayer(getTileUrl()) skipped the
+      // filter, so the keyless-OSM dark default (the light OSM template
+      // plus an invert filter) rendered a light basemap in a dark page.
+      if (typeof window._applyTilesToNodeMap === 'function') {
+        window._applyTilesToNodeMap(map);
+      } else {
+        // Loud, not silent: the shared tile helper is missing.
+        console.warn('subpath minimap: _applyTilesToNodeMap unavailable — using OSM fallback');
+        L.tileLayer('https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', { maxZoom: 18 }).addTo(map);
+      }
 
       const latlngs = [];
       nodesWithLoc.forEach((n, i) => {
diff --git a/public/customize-v2.js b/public/customize-v2.js
index b18a9379e..54eedfc9c 100644
--- a/public/customize-v2.js
+++ b/public/customize-v2.js
@@ -1637,8 +1637,12 @@
   function _renderTileProviderSelector() {
     var reg = (typeof window !== 'undefined') && window.MC_TILE_PROVIDERS;
     if (!reg) return '';
-    var activeDark = (typeof window.MC_getDarkTileProvider === 'function') ? window.MC_getDarkTileProvider() : 'carto-dark';
-    var activeLight = (typeof window.MC_getLightTileProvider === 'function') ? window.MC_getLightTileProvider() : 'carto-light';
+    // #332 — the last-resort id comes from the registry's own exported
+    // defaults, never from a hard-coded 'carto-*'. CARTO is no longer the
+    // built-in default, so naming it here would have preselected a style
+    // the instance may not even have enabled.
+    var activeDark = (typeof window.MC_getDarkTileProvider === 'function') ? window.MC_getDarkTileProvider() : window.MC_DARK_TILE_DEFAULT;
+    var activeLight = (typeof window.MC_getLightTileProvider === 'function') ? window.MC_getLightTileProvider() : window.MC_LIGHT_TILE_DEFAULT;
     
     var darkIds = Object.keys(reg).filter(function(id) { return reg[id].type === 'dark'; });
     var lightIds = Object.keys(reg).filter(function(id) { return reg[id].type === 'light'; });
diff --git a/public/map-tile-providers.js b/public/map-tile-providers.js
index 8b64383e6..507b182bf 100644
--- a/public/map-tile-providers.js
+++ b/public/map-tile-providers.js
@@ -21,7 +21,7 @@
   // stamps "API KEY REQUIRED" into every keyless raster tile, and this fork
   // has no basemap-key plumbing, so an unconfigured instance that defaulted
   // to 'carto-dark' / 'carto-light' rendered watermarked maps. OSM Standard
-  // is the keyless baseline: no token, tiles to zoom 19, and it is already
+  // is the keyless baseline: no token, tiles to zoom 18, and it is already
   // the unconditional provider for the home mini-map, node-reach, packet-path
   // and area maps — so this default introduces no new third party. Operators
   // who want CARTO (or anything else) still set map.tiles.darkDefault /
@@ -49,6 +49,23 @@
     }
     return 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png';
   };
+  /* #332 — credit the vendor that actually serves the tiles. osm-standard /
+   * osm-dark used to credit "Maps © Mapbox/Thunderforest/MapTiler"
+   * unconditionally; #332 makes them the default every unconfigured
+   * instance shows, and such an instance uses none of those three — its
+   * tiles come straight from the OSMF servers. Resolved the same way
+   * _getOsmUrl() picks the URL, and re-resolved on every registry init so
+   * config landing after parse time still applies. */
+  var _getOsmAttribution = function() {
+    var OSM = '© OpenStreetMap contributors';
+    if (_cfg && _cfg.providers && _cfg.providers.osm && _cfg.providers.osm.provider && _cfg.providers.osm.token) {
+      var prov = _cfg.providers.osm.provider.toLowerCase();
+      if (prov === 'thunderforest') return OSM + ', Tiles © Thunderforest';
+      if (prov === 'maptiler')      return OSM + ', Tiles © MapTiler';
+      if (prov === 'mapbox')        return OSM + ', Tiles © Mapbox';
+    }
+    return OSM;
+  };
 
   var BASE_STYLES = {
     'carto-dark': { provider: 'carto', label: 'Carto Dark', url: function() { return _getCartoBase() + '/dark_all/{z}/{x}/{y}{r}.png'; }, invertFilter: null, type: 'dark', attribution: '© OpenStreetMap © CartoDB', maxZoom: 19 },
@@ -82,6 +99,13 @@
     var HAS_STAMEN = _cfg && _cfg.providers && _cfg.providers.stamen && _cfg.providers.stamen.enabled && !!_cfg.providers.stamen.token;
     var HAS_ESRI = true; // Kept for backwards compatibility
 
+    // #332 — resolve the OSM credit against the configured vendor before
+    // the registry is handed out. Keeping `attribution` a plain string here
+    // means every reader (getTileSpec, the layer control, the inset-map
+    // helper, map.js/live.js legacy branches) stays unchanged.
+    BASE_STYLES['osm-standard'].attribution = _getOsmAttribution();
+    BASE_STYLES['osm-dark'].attribution     = _getOsmAttribution();
+
     REGISTRY = {};
     for (var key in BASE_STYLES) {
       var style = BASE_STYLES[key];
@@ -229,6 +253,7 @@
   // ── Public surface ──────────────────────────────────────────────────────
   
   window.MC_DARK_TILE_DEFAULT           = DEFAULT_ID;
+  window.MC_LIGHT_TILE_DEFAULT          = DEFAULT_ID_LIGHT;
   window.MC_TILE_PROVIDERS              = REGISTRY; // initial ref; MC_initTileRegistry keeps this in sync
   window.MC_setDarkTileProvider         = function(id) { return setActive(id, 'dark'); };
   window.MC_setLightTileProvider        = function(id) { return setActive(id, 'light'); };
diff --git a/test-issue-332-no-carto-tiles-e2e.js b/test-issue-332-no-carto-tiles-e2e.js
index 05030f100..e0e2ed042 100644
--- a/test-issue-332-no-carto-tiles-e2e.js
+++ b/test-issue-332-no-carto-tiles-e2e.js
@@ -8,12 +8,18 @@
  * instance configured for Esri/OpenTopoMap/OSM.
  *
  * This test drives a real browser over every surface named in the issue —
- * node detail, the main map, Live, Areas and both customizer geo-filter
- * previews — in BOTH themes, and asserts:
+ * the main map, Live, node detail, the Analytics -> Subpaths minimap, the
+ * packet-path modal, the Areas (position-gap) node map and both customizer
+ * geo-filter previews — in BOTH themes, and asserts:
  *
- *   1. zero network requests to basemaps.cartocdn.com, and
+ *   1. zero network requests to basemaps.cartocdn.com,
  *   2. at least one tile request that DOES go to the expected provider
- *      host (so "no CARTO" can't pass by the map simply never loading).
+ *      host (so "no CARTO" can't pass by the map simply never loading), and
+ *   3. that the map's tile pane carries the resolved provider's
+ *      invertFilter — present when the provider declares one, absent when
+ *      it does not. The #332 dark default (osm-dark) is the LIGHT OSM
+ *      template plus an invert filter, so a map that attaches tiles but
+ *      skips the filter renders a light basemap inside a dark page.
  *
  * Third-party tile IMAGE requests are stubbed with a 1x1 PNG at the route
  * level: the point is which URL the page asks for, not what comes back,
@@ -119,6 +125,30 @@ function assert(c, m) { if (!c) throw new Error(m || 'assertion failed'); }
     }
   }
 
+  // The provider's own invertFilter must reach the map's tile pane — not a
+  // hard-coded expectation, so this holds for any configured provider:
+  // osm-dark declares one, esri-darkgray-labels and every light style do
+  // not. Read from the page, so a differently-configured server still
+  // asserts the right thing.
+  async function checkFilter(page, paneSelector, theme, label) {
+    const want = await page.evaluate((t) => {
+      try {
+        const s = window.MC_getTileSpec && window.MC_getTileSpec(t);
+        return (s && s.invertFilter) || '';
+      } catch (_) { return ''; }
+    }, theme);
+    const got = await page.$eval(paneSelector, (el) => getComputedStyle(el).filter);
+    const has = !!got && got !== 'none';
+    if (want) {
+      assert(has, `${label}: the resolved ${theme} provider declares invertFilter ` +
+        `"${want}" but ${paneSelector} computes filter "${got}" — an un-inverted ` +
+        `light basemap would render inside a ${theme} page`);
+    } else {
+      assert(!has, `${label}: the resolved ${theme} provider declares no invertFilter ` +
+        `but ${paneSelector} computes filter "${got}"`);
+    }
+  }
+
   for (const theme of ['dark', 'light']) {
     console.log(`── theme: ${theme} ──`);
 
@@ -128,6 +158,7 @@ function assert(c, m) { if (!c) throw new Error(m || 'assertion failed'); }
         await page.waitForSelector('#leaflet-map .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
         await page.waitForTimeout(1500);
         check('map', tiles, { expectHost: EXPECT[theme] });
+        await checkFilter(page, '#leaflet-map .leaflet-tile-pane', theme, 'map');
       });
     });
 
@@ -137,6 +168,7 @@ function assert(c, m) { if (!c) throw new Error(m || 'assertion failed'); }
         await page.waitForSelector('.leaflet-tile-pane', { state: 'attached', timeout: 15000 });
         await page.waitForTimeout(1500);
         check('live', tiles, { expectHost: EXPECT[theme] });
+        await checkFilter(page, '.leaflet-tile-pane', theme, 'live');
       });
     });
 
@@ -146,19 +178,98 @@ function assert(c, m) { if (!c) throw new Error(m || 'assertion failed'); }
         await page.waitForSelector('.leaflet-tile-pane', { state: 'attached', timeout: 15000 });
         await page.waitForTimeout(1500);
         check('node detail', tiles, { expectHost: EXPECT[theme] });
+        await checkFilter(page, '.leaflet-tile-pane', theme, 'node detail');
       });
     });
 
-    await step(`[${theme}] Areas tab requests no CARTO tiles`, async () => {
+    // Analytics -> Subpaths: click route rows until one has >=2 located
+    // nodes, which is what makes renderSubpathDetail() mount #subpathMap.
+    // This minimap used L.tileLayer(getTileUrl()) with no invertFilter, so
+    // the #332 dark default rendered an un-inverted light basemap here.
+    await step(`[${theme}] Analytics → Subpaths minimap requests no CARTO tiles`, async () => {
       await withPage(theme, async (page, tiles) => {
         await page.goto(BASE + '/#/analytics', { waitUntil: 'domcontentloaded' });
-        const tab = page.locator('.tab-btn[data-tab="areas"]');
+        const tab = page.locator('.tab-btn[data-tab="subpaths"]');
         await tab.waitFor({ timeout: 15000 });
         await tab.click();
-        await page.waitForTimeout(2500);
-        // The Areas tab only mounts a map when the fixture has areas, so a
-        // tile hit is not guaranteed here — the CARTO assertion is.
-        check('areas', tiles, { requireHit: false });
+        await page.waitForSelector('tr[data-hops]', { timeout: 15000 });
+        const rows = page.locator('tr[data-hops]');
+        const total = Math.min(await rows.count(), 15);
+        assert(total > 0, 'the fixture served no subpath rows to open');
+        tiles.length = 0;
+        let mounted = false;
+        for (let i = 0; i < total && !mounted; i++) {
+          await rows.nth(i).click();
+          try {
+            await page.waitForSelector('#subpathMap .leaflet-tile-pane', { state: 'attached', timeout: 3000 });
+            mounted = true;
+          } catch (_) { /* this route has <2 located nodes — try the next */ }
+        }
+        assert(mounted, `no subpath route out of ${total} mounted #subpathMap — ` +
+          'the minimap never rendered, so this step would prove nothing');
+        await page.waitForTimeout(1500);
+        check('analytics subpath minimap', tiles, { expectHost: EXPECT[theme] });
+        await checkFilter(page, '#subpathMap .leaflet-tile-pane', theme, 'analytics subpath minimap');
+      });
+    });
+
+    // The packet-path modal, reached the way a shared link reaches it:
+    // #/packets/<hash>?viewPath=1. The hash is discovered at runtime so the
+    // step does not depend on a particular fixture row surviving a freshen.
+    await step(`[${theme}] packet-path map requests no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/packets', { waitUntil: 'domcontentloaded' });
+        await page.waitForSelector('#packetsTable, .data-table', { timeout: 15000 });
+        const hash = await page.evaluate(async () => {
+          const r = await fetch('/api/packets?limit=40&timeWindow=0');
+          const d = await r.json();
+          for (const p of (d.packets || [])) {
+            if (!p.hash) continue;
+            try {
+              const pr = await fetch('/api/packets/' + encodeURIComponent(p.hash) + '/path');
+              if (!pr.ok) continue;
+              const pd = await pr.json();
+              for (const b of (pd.branches || [])) {
+                const pts = (b.points || []).filter((q) => q.lat != null && q.lon != null);
+                if (pts.length || (b.observer && b.observer.lat != null)) return p.hash;
+              }
+            } catch (_) {}
+          }
+          return null;
+        });
+        assert(hash, 'no fixture packet has a plottable relay path — cannot open the packet-path map');
+        tiles.length = 0;
+        await page.goto(BASE + '/#/packets/' + hash + '?viewPath=1', { waitUntil: 'domcontentloaded' });
+        await page.waitForSelector('#packetPathMapContainer .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        check('packet-path map', tiles, { expectHost: EXPECT[theme] });
+        await checkFilter(page, '#packetPathMapContainer .leaflet-tile-pane', theme, 'packet-path map');
+      });
+    });
+
+    // Areas. The Analytics -> Areas TAB mounts no Leaflet map at all (its
+    // position-gap rows are not clickable there), so the old step asserted
+    // nothing. The Areas map that exists is AreaNodesMap, opened from a
+    // position-gap row in the Position-Fix Coverage Gaps tool. The committed
+    // fixture has no estimated positions, so there is no row to click: drive
+    // the modal's own public entry point with synthetic points instead. The
+    // production tile-attach path is identical either way — only the markers
+    // come from the test.
+    await step(`[${theme}] Areas (position-gap) node map requests no CARTO tiles`, async () => {
+      await withPage(theme, async (page, tiles) => {
+        await page.goto(BASE + '/#/tools/position-gaps', { waitUntil: 'domcontentloaded' });
+        await page.waitForFunction(() => !!(window.AreaNodesMap && window.L), null, { timeout: 15000 });
+        tiles.length = 0;
+        await page.evaluate(() => {
+          window.AreaNodesMap.open('#332 E2E area', [
+            { name: 'A', lat: 37.5, lon: -122.3, approximated: true },
+            { name: 'B', lat: 37.9, lon: -122.1, approximated: true },
+          ]);
+        });
+        await page.waitForSelector('#areaNodesMapContainer .leaflet-tile-pane', { state: 'attached', timeout: 15000 });
+        await page.waitForTimeout(1500);
+        check('area-nodes map', tiles, { expectHost: EXPECT[theme] });
+        await checkFilter(page, '#areaNodesMapContainer .leaflet-tile-pane', theme, 'area-nodes map');
       });
     });
 
diff --git a/test-issue-332-tile-provider-fallback.js b/test-issue-332-tile-provider-fallback.js
index 161768ffd..1ef042742 100644
--- a/test-issue-332-tile-provider-fallback.js
+++ b/test-issue-332-tile-provider-fallback.js
@@ -540,6 +540,252 @@ test('M6 the only basemaps.cartocdn.com literal under public/ is in _getCartoBas
     'hard-coded CARTO host(s) found:\n    ' + offenders.join('\n    '));
 });
 
+// ═══ M7 — analytics subpath minimap (round-2 F1) ════════════════════════
+// The Analytics -> Subpaths detail minimap used `L.tileLayer(getTileUrl())`
+// and never applied the provider's invertFilter. With the #332 dark default
+// (osm-dark = the LIGHT OSM template + an invert filter) that rendered an
+// un-inverted light basemap inside a dark page. It must go through the same
+// shared helper every other inset map uses, not a second resolver of its own.
+console.log('\n── #332 M7: analytics subpath minimap uses the shared tile helper ──');
+
+const ANALYTICS = path.join('public', 'analytics.js');
+const NODES     = path.join('public', 'nodes.js');
+const INVERT_RE = /invert\(/;
+
+// A Leaflet mock whose maps each own their own tilePane, so an assertion on
+// "this map's pane" cannot be satisfied by some other map's pane.
+function makeMapMock() {
+  const calls = [];
+  const panes = [];
+  function fakeMap() {
+    const tilePane = { style: { filter: '' } };
+    panes.push(tilePane);
+    return {
+      getPane: (n) => (n === 'tilePane' ? tilePane : null),
+      fitBounds() { return this; },
+      setView() { return this; },
+      on() { return this; },
+    };
+  }
+  const L = {
+    map() { return fakeMap(); },
+    tileLayer(url, opts) {
+      return { addTo(map) { calls.push({ url, opts, map }); return this; } };
+    },
+    circleMarker() { return { bindTooltip() { return this; }, addTo() { return this; } }; },
+    polyline()     { return { addTo() { return this; } }; },
+    marker()       { return { addTo() { return { bindPopup() {} }; } }; },
+    latLngBounds() { return { pad() { return this; } }; },
+  };
+  return { L, calls, panes };
+}
+
+const SUBPATH_DATA = {
+  nodes: [
+    { name: 'A', lat: 37.5, lon: -122.3 },
+    { name: 'B', lat: 37.9, lon: -122.1 },
+  ],
+  hops: ['33', '67'],
+  totalMatches: 26,
+  hourDistribution: new Array(24).fill(1),
+  signal: { avgSnr: 5, avgRssi: -95, samples: 3 },
+  observers: [],
+  parentPaths: [],
+  firstSeen: '2026-10-01T00:00:00Z',
+  lastSeen: '2026-10-02T00:00:00Z',
+};
+
+// Executes the PRODUCTION renderSubpathDetail() with the PRODUCTION shared
+// helper (extracted from nodes.js) on top of the real registry + roles.js.
+function runSubpathDetail(opts) {
+  const ctx = loadStack(opts);
+  const mock = makeMapMock();
+  ctx.L = mock.L;
+  // The real shared helper, exported the way nodes.js exports it.
+  vm.runInContext(
+    extractFn(NODES, '_applyTilesToNodeMap') +
+    '\nwindow._applyTilesToNodeMap = _applyTilesToNodeMap;',
+    ctx, { filename: NODES });
+  for (const k of Object.keys(ctx.window)) if (!(k in ctx)) ctx[k] = ctx.window[k];
+  // Stubs for the view helpers renderSubpathDetail() reaches for.
+  ctx.esc = (s) => String(s == null ? '' : s);
+  ctx.formatDistance = (km) => km.toFixed(1) + ' km';
+  ctx.statusGreen = () => '#0f0';
+  ctx.statusRed = () => '#f00';
+  ctx.statusYellow = () => '#ff0';
+  ctx.__panel = { innerHTML: '', classList: { remove: () => {}, add: () => {} } };
+  ctx.__data = JSON.parse(JSON.stringify(SUBPATH_DATA));
+  vm.runInContext(
+    extractFn(ANALYTICS, 'renderSubpathDetail') +
+    '\nrenderSubpathDetail(__panel, __data);',
+    ctx, { filename: ANALYTICS });
+  assert.strictEqual(mock.calls.length >= 1, true,
+    'the minimap attached no tile layer at all (' + mock.calls.length + ' calls)');
+  // The minimap is the last map created, so its pane is the last recorded one.
+  return { call: mock.calls[mock.calls.length - 1], pane: mock.panes[mock.panes.length - 1], calls: mock.calls };
+}
+
+test('M7 subpath minimap: dark + built-in default → OSM url AND the invert filter on its own pane', () => {
+  const r = runSubpathDetail({ theme: 'dark', mapCfg: CFG_EMPTY });
+  assert.ok(r.call.url.indexOf(CARTO_HOST) === -1, 'must not request CARTO tiles: ' + r.call.url);
+  assert.ok(/tile\.openstreetmap\.org/.test(r.call.url), 'expected the keyless OSM template, got ' + r.call.url);
+  assert.ok(INVERT_RE.test(r.pane.style.filter),
+    'osm-dark is the LIGHT OSM template plus an invert filter — without the filter the ' +
+    'minimap renders a light basemap in a dark page. Pane filter was ' + JSON.stringify(r.pane.style.filter));
+});
+
+test('M7 subpath minimap: light mode → the light provider and NO invert filter', () => {
+  const r = runSubpathDetail({ theme: 'light', mapCfg: CFG_EMPTY });
+  assert.ok(r.call.url.indexOf(CARTO_HOST) === -1, 'must not request CARTO tiles: ' + r.call.url);
+  assert.ok(/tile\.openstreetmap\.org/.test(r.call.url), 'got ' + r.call.url);
+  assert.strictEqual(r.pane.style.filter, '', 'a light style must not be inverted');
+});
+
+test('M7 subpath minimap: follows a configured dark provider (Esri, natively dark → no filter)', () => {
+  const r = runSubpathDetail({ theme: 'dark', mapCfg: cfgDefaults('esri-darkgray-labels', 'opentopomap') });
+  assert.ok(/server\.arcgisonline\.com/.test(r.call.url), 'expected the configured Esri url, got ' + r.call.url);
+  assert.strictEqual(r.pane.style.filter, '', 'esri-darkgray-labels is natively dark — no invert filter');
+  assert.strictEqual(r.call.opts.attribution, 'Tiles © Esri');
+});
+
+test('M7 subpath minimap: follows a configured light provider', () => {
+  const r = runSubpathDetail({ theme: 'light', mapCfg: cfgDefaults('esri-darkgray-labels', 'opentopomap') });
+  assert.ok(/tile\.opentopomap\.org/.test(r.call.url), 'expected the configured OpenTopoMap url, got ' + r.call.url);
+  assert.ok(/OpenTopoMap/.test(r.call.opts.attribution), 'got ' + r.call.opts.attribution);
+});
+
+test('M7 analytics.js has no tile resolver of its own left', () => {
+  const src = fs.readFileSync(path.join(__dirname, ANALYTICS), 'utf8');
+  const offenders = [];
+  src.split('\n').forEach((line, i) => {
+    if (/^\s*(\/\/|\*|\/\*)/.test(line)) return; // comments explain the old shape
+    if (/L\.tileLayer\s*\(\s*(window\.)?getTileUrl\s*\(/.test(line) ||
+        /L\.tileLayer\s*\(\s*(window\.)?MC_TILE_PROVIDERS\b/.test(line)) {
+      offenders.push((i + 1) + ': ' + line.trim());
+    }
+  });
+  assert.deepStrictEqual(offenders, [],
+    'analytics.js must resolve tiles through the shared helper, not inline:\n    ' + offenders.join('\n    '));
+});
+
+// ═══ M8 — OSM attribution on the new default (round-2 F3) ══════════════
+// osm-standard / osm-dark credited "Maps © Mapbox/Thunderforest/MapTiler"
+// unconditionally. #332 promotes them to the default every unconfigured
+// instance shows, and such an instance uses none of those three vendors.
+console.log('\n── #332 M8: OSM attribution matches the vendor actually in use ──');
+
+function osmCfg(provider, token) {
+  const osm = { enabled: true };
+  if (provider) osm.provider = provider;
+  if (token) osm.token = token;
+  return { tiles: { providers: { carto: { enabled: true, domain: '' }, osm: osm } } };
+}
+
+const VENDORS = ['Mapbox', 'Thunderforest', 'MapTiler'];
+
+for (const [label, type, theme] of [['osm-standard', 'light', 'light'], ['osm-dark', 'dark', 'dark']]) {
+  test('M8 ' + label + ': keyless install credits plain OpenStreetMap only', () => {
+    const ctx = loadStack({ theme, mapCfg: CFG_EMPTY });
+    const spec = ctx.window.MC_getTileSpec(type);
+    assert.strictEqual(spec.id, label, 'expected the built-in default, got ' + spec.id);
+    assert.ok(/OpenStreetMap/.test(spec.attribution), 'got ' + spec.attribution);
+    for (const v of VENDORS) {
+      assert.ok(spec.attribution.indexOf(v) === -1,
+        'a keyless install uses no ' + v + ' service, so it must not credit one: ' + spec.attribution);
+    }
+  });
+}
+
+for (const [provider, credited] of [['maptiler', 'MapTiler'], ['thunderforest', 'Thunderforest'], ['mapbox', 'Mapbox']]) {
+  test('M8 osm with a ' + provider + ' token credits ' + credited + ' and nobody else', () => {
+    const ctx = loadStack({ theme: 'light', mapCfg: osmCfg(provider, 'tok') });
+    const spec = ctx.window.MC_getTileSpec('light');
+    assert.strictEqual(spec.id, 'osm-standard');
+    assert.ok(spec.attribution.indexOf(credited) !== -1,
+      'the configured vendor must be credited: ' + spec.attribution);
+    for (const v of VENDORS) {
+      if (v === credited) continue;
+      assert.ok(spec.attribution.indexOf(v) === -1,
+        v + ' is not in use, so it must not be credited: ' + spec.attribution);
+    }
+    assert.ok(/OpenStreetMap/.test(spec.attribution), 'OSM data credit is still required: ' + spec.attribution);
+  });
+}
+
+test('M8 osm with a provider but NO token credits plain OpenStreetMap (no tiles come from the vendor)', () => {
+  const ctx = loadStack({ theme: 'light', mapCfg: osmCfg('maptiler', '') });
+  const spec = ctx.window.MC_getTileSpec('light');
+  assert.ok(/openstreetmap\.org/.test(spec.url), 'tokenless config still uses the OSMF tiles: ' + spec.url);
+  for (const v of VENDORS) {
+    assert.ok(spec.attribution.indexOf(v) === -1, 'got ' + spec.attribution);
+  }
+});
+
+// ═══ M9 — documented zoom matches the declared maxZoom (round-2 F4) ════
+console.log('\n── #332 M9: the documented default zoom is the real one ──');
+
+test('M9 map-tile-providers.js and config.example.json document the OSM default\'s real maxZoom', () => {
+  const ctx = loadStack({ theme: 'light', mapCfg: CFG_EMPTY });
+  const real = ctx.window.MC_TILE_PROVIDERS['osm-standard'].maxZoom;
+  assert.strictEqual(ctx.window.MC_getTileSpec('light').maxZoom, real);
+
+  const js = fs.readFileSync(path.join(__dirname, 'public', 'map-tile-providers.js'), 'utf8');
+  const head = js.slice(0, js.indexOf('var DEFAULT_ID'));
+  const mJs = head.match(/tiles to zoom (\d+)/);
+  assert.ok(mJs, 'the #332 comment must still state the default\'s zoom ceiling');
+  assert.strictEqual(Number(mJs[1]), real,
+    'the comment says zoom ' + mJs[1] + ' but osm-standard declares maxZoom ' + real);
+
+  const cfg = JSON.parse(fs.readFileSync(path.join(__dirname, 'config.example.json'), 'utf8'));
+  const note = cfg.map.tiles._comment_defaults;
+  const mCfg = note.match(/tiles to zoom (\d+)/);
+  assert.ok(mCfg, 'config.example.json must still document the default\'s zoom ceiling');
+  assert.strictEqual(Number(mCfg[1]), real,
+    'config.example.json says zoom ' + mCfg[1] + ' but osm-standard declares maxZoom ' + real);
+});
+
+// ═══ M10 — no CARTO id left as a frontend default (round-2 F5) ═════════
+console.log('\n── #332 M10: the tile picker has no CARTO id fallback ──');
+
+test('M10 _renderTileProviderSelector() marks no CARTO style selected when the accessors are missing', () => {
+  const ctx = makeSandbox({ theme: 'dark' });
+  ctx.esc = (s) => String(s == null ? '' : s);
+  ctx.escAttr = (s) => String(s == null ? '' : s);
+  // A registry is present (so the function does not bail), but the
+  // MC_get*TileProvider accessors are not — the branch that used to fall
+  // back to the ids 'carto-dark' / 'carto-light'.
+  ctx.window.MC_TILE_PROVIDERS = {
+    'carto-dark':   { type: 'dark',  label: 'Carto Dark' },
+    'osm-dark':     { type: 'dark',  label: 'OSM Standard' },
+    'carto-light':  { type: 'light', label: 'Carto Positron' },
+    'osm-standard': { type: 'light', label: 'OSM Standard' },
+  };
+  ctx.window.MC_DARK_TILE_DEFAULT = 'osm-dark';
+  ctx.window.MC_LIGHT_TILE_DEFAULT = 'osm-standard';
+  for (const k of Object.keys(ctx.window)) if (!(k in ctx)) ctx[k] = ctx.window[k];
+  vm.runInContext(
+    extractFn(CV2, '_renderTileProviderSelector') + '\nvar __html = _renderTileProviderSelector();',
+    ctx, { filename: CV2 });
+  const html = String(ctx.__html);
+  const selected = (html.match(/<option value="([^"]+)" selected>/g) || [])
+    .map((s) => s.match(/value="([^"]+)"/)[1]);
+  assert.ok(selected.length > 0, 'expected the picker to preselect something, got: ' + html.slice(0, 200));
+  for (const id of selected) {
+    assert.ok(!/^carto/.test(id),
+      'a CARTO style must not be the picker\'s fallback default any more, got ' + id);
+  }
+});
+
+test('M10 customize-v2.js has no hard-coded carto-* id left', () => {
+  const src = fs.readFileSync(path.join(__dirname, CV2), 'utf8');
+  const offenders = [];
+  src.split('\n').forEach((line, i) => {
+    if (/['"]carto-(dark|light)['"]/.test(line)) offenders.push((i + 1) + ': ' + line.trim());
+  });
+  assert.deepStrictEqual(offenders, [],
+    'hard-coded CARTO provider id(s) in the frontend:\n    ' + offenders.join('\n    '));
+});
+
 // ─── Summary ────────────────────────────────────────────────────────────
 console.log('\n' + (failed === 0 ? '✅' : '❌') + ' #332: ' + passed + ' passed, ' + failed + ' failed');
 process.exit(failed === 0 ? 0 : 1);