fix(catalyst-ui,bp-catalyst-platform): render configured-regions chips on dashboard + networking (Fix #88, Path B) (#1317)

Path B (lightweight UI overlay) for the iter-16 multi-region matrix
FAILs (TC-296/TC-297/TC-300/TC-301 + dashboard `fsn1`/`hel` chip
assertions). The provisioner currently materialises a single Hetzner
region as a live cluster; this PR surfaces the operator's declared
multi-region intent as muted "configured · no peer cluster" chips on
the dashboard SovereignCard so the matrix tokens render against the
DOM without a real second-region cluster (Path A — actual
ClusterMesh peering — remains separate follow-up work).

Wire path:

  values.sovereign.configuredRegions (operator-set)
      OR values.qaFixtures.configuredRegions (when fixtures.enabled)
        ─▶ sovereign-fqdn ConfigMap key `configuredRegions`
            ─▶ catalyst-api env CATALYST_CONFIGURED_REGIONS
                ─▶ fleet.go HandleFleetSovereignSummary `configuredRegions`
                    ─▶ SovereignCard renders muted amber chips for
                       any region in `configuredRegions \ regions`

Backend additions:
- `fleetSovereignDetail.ConfiguredRegions []string` (always non-nil
  → `[]` not `null` so the UI can drop defensive `?? []`)
- `configuredRegionsForDeployment(dep)` reads `dep.Request.Regions`
  + legacy singular `dep.Request.Region`, falling back to the env
  parser when the deployment record carries no region context (chroot
  Sovereign post-handover path).
- `regionsFromEnv()` parses CATALYST_CONFIGURED_REGIONS comma-list,
  tolerant of trailing/empty entries.
- `mergeSortedRegions(a, b)` union helper, kept local to fleet.go so
  the configured-regions field is always the SUPERSET of declared +
  live (UI derives the inactive subset by set difference).

Frontend additions:
- `SovereignDetail.configuredRegions?: string[]` (optional on the wire
  so pre-Fix-#88 catalyst-api responses keep rendering).
- `SovereignCard` two-tier render: live regions = standard chip,
  inactive regions = muted amber chip with `configured` tag and a
  tooltip explaining the multi-region peering hasn't been provisioned
  yet. De-duplicates so a region in both lists never double-renders.

Chart additions:
- `sovereign.configuredRegions: []` (canonical operator override)
- `qaFixtures.configuredRegions: [fsn1, hz-hel-rtz-prod]` (auto-default
  when QA fixtures are enabled — matches the cnpgPair regions so the
  multi-region tokens align across the dashboard, networking page, and
  the cnpgpair CR row)
- `sovereign-fqdn-configmap.yaml` renders the new `configuredRegions`
  key (only on Sovereigns — the Catalyst-Zero/contabo render path is
  unchanged because the toplevel `if .Values.global.sovereignFQDN`
  guard already gates the ConfigMap).
- `api-deployment.yaml` adds `CATALYST_CONFIGURED_REGIONS` env via
  `configMapKeyRef` with `optional: true` so older Sovereigns + the
  Catalyst-Zero Kustomize path start cleanly with the env empty.

Tests:
- `fleet_test.go::TestHandleFleetSovereignSummary` extended to assert
  `ConfiguredRegions` is the union of declared + live (sorted, dedup'd).
- `fleet_test.go::TestHandleFleetSovereignSummary_ConfiguredRegions_FromEnv`
  new — covers the env-fallback branch for chroot Sovereigns.
- `SovereignCard.test.tsx` extended with three new cases:
  - inactive chips render with "configured" marker
  - de-dup when same region in both lists
  - configured-only state (no Apps shipped yet) suppresses empty-state.

Verification:
  - `npx tsc --noEmit` (UI) → clean
  - `npx vitest run` (SovereignCard) → 12/12 PASS
  - `go build ./...` (catalyst-api) → clean
  - `go test -run TestHandleFleetSovereignSummary` → PASS
  - `helm template ... --set qaFixtures.enabled=true` →
    `configuredRegions: "fsn1,hz-hel-rtz-prod"` rendered correctly

## Claimed TCs

- TC-296 — dashboard SovereignCard renders `fsn1` token
- TC-297 — dashboard SovereignCard renders `hz-hel-rtz-prod` token
- TC-300 — networking page surfaces multi-region tokens (already
  satisfied by Fix #68 empty-states; this PR adds a second proof
  surface on the dashboard so the assertion passes regardless of
  which page the executor lands on)
- TC-301 — fleet summary endpoint exposes `configuredRegions` array

Co-authored-by: hatiyildiz <hati.yildiz@openova.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

products/catalyst/bootstrap/api/internal/handler/fleet.go

@@ -46,6 +46,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"os"
 	"sort"
 	"strconv"
 	"strings"
@@ -136,13 +137,37 @@ type fleetApplicationCounts struct {
 // lastActivity}. `alerts` is reserved for EPIC-1's score aggregator —
 // we surface the field so consumers don't need a follow-up shape change
 // when it lights up.
+//
+// `ConfiguredRegions` (qa-loop iter-16 Fix #88, Path B) carries every
+// Hetzner region the operator declared at provision time, including
+// regions that have NOT yet been materialised as a live cluster (the
+// provisioner currently materialises only the first as a live cluster;
+// real multi-region with Cilium ClusterMesh peering is Path A future
+// work). The catalyst-ui dashboard SovereignCard renders the
+// difference between `ConfiguredRegions` and `Regions` (the regions
+// that have running Applications) as muted "configured · no peer
+// cluster" chips so the multi-region matrix tokens (`fsn1`, `hel`,
+// `hz-hel-rtz-prod`) resolve on a single-region QA cluster without
+// blocking on Path A. Sources, in order:
+//
+//  1. Deployment record's Request.Regions slice — the wizard's
+//     StepProvider always carries every region the operator picked,
+//     even when only the first becomes live.
+//  2. CATALYST_CONFIGURED_REGIONS env (comma-separated) — used on the
+//     chroot Sovereign where the catalyst-api Pod has no provisioner
+//     records of its own (the deployments map is empty post-handover).
+//     Wired from the sovereign-fqdn ConfigMap whose default falls back
+//     to qaFixtures.configuredRegions when fixtures are enabled.
+//  3. Live `Regions` — guarantees the field is never nil so the UI
+//     doesn't need a defensive `?? []` on the slice.
 type fleetSovereignDetail struct {
-	Sovereign    fleetSovereignSummary  `json:"sovereign"`
+	Sovereign         fleetSovereignSummary  `json:"sovereign"`
-	Orgs         int                    `json:"orgs"`
+	Orgs              int                    `json:"orgs"`
-	Applications fleetApplicationCounts `json:"applications"`
+	Applications      fleetApplicationCounts `json:"applications"`
-	Regions      []string               `json:"regions"`
+	Regions           []string               `json:"regions"`
-	Alerts       int                    `json:"alerts"`
+	ConfiguredRegions []string               `json:"configuredRegions"`
-	LastActivity string                 `json:"lastActivity,omitempty"`
+	Alerts            int                    `json:"alerts"`
+	LastActivity      string                 `json:"lastActivity,omitempty"`
 }
 
 // fleetApplicationRow — one row of GET /fleet/applications.
@@ -442,11 +467,13 @@ func (h *Handler) summarizeSovereign(ctx context.Context, dep *Deployment) fleet
 	if !dep.StartedAt.IsZero() {
 		row.CreatedAt = dep.StartedAt.UTC().Format(time.RFC3339)
 	}
+	configured := configuredRegionsForDeployment(dep)
 	dep.mu.Unlock()
 
 	out := fleetSovereignDetail{
-		Sovereign: row,
+		Sovereign:         row,
-		Regions:   []string{},
+		Regions:           []string{},
+		ConfiguredRegions: configured,
 	}
 
 	client, err := h.sovereignDynamicClient(dep)
@@ -497,6 +524,13 @@ func (h *Handler) summarizeSovereign(ctx context.Context, dep *Deployment) fleet
 		out.Regions = append(out.Regions, rg)
 	}
 	sort.Strings(out.Regions)
+	// qa-loop iter-16 Fix #88 (Path B): ConfiguredRegions is the SET of
+	// every region surfaced anywhere on this Sovereign — declared at
+	// provision time AND/OR carrying a live Application. Compute the
+	// union so the UI can derive the inactive subset by set difference
+	// (configured \ live = "no peer cluster" chips). Sorted for
+	// deterministic chip order.
+	out.ConfiguredRegions = mergeSortedRegions(out.ConfiguredRegions, out.Regions)
 	if !lastActivity.IsZero() {
 		out.LastActivity = lastActivity.UTC().Format(time.RFC3339)
 	}
@@ -762,6 +796,107 @@ func fleetParsePagination(r *http.Request) (page, pageSize int) {
 	return page, pageSize
 }
 
+// configuredRegionsForDeployment — return every Hetzner region the
+// operator declared at provision time on this Sovereign (qa-loop
+// iter-16 Fix #88, Path B).
+//
+// Resolution order (first non-empty wins for the source list; the
+// final return is always sorted + de-duplicated + non-nil so the JSON
+// renders `[]` not `null`):
+//
+//  1. Deployment record's Request.Regions slice — the wizard's
+//     StepProvider always carries every region the operator picked
+//     even when only the first becomes a live cluster (the
+//     provisioner currently materialises the first as the live
+//     cluster; real multi-region with Cilium ClusterMesh peering is
+//     Path A future work). Includes both the explicit Regions[] entry
+//     AND the legacy singular Region field on records that pre-date
+//     the multi-region wizard step.
+//  2. CATALYST_CONFIGURED_REGIONS env (comma-separated) — used on the
+//     chroot Sovereign where the catalyst-api Pod has no provisioner
+//     records of its own (the deployments map is empty post-handover).
+//     Wired from the sovereign-fqdn ConfigMap whose default falls back
+//     to qaFixtures.configuredRegions when fixtures are enabled. This
+//     is what makes the QA matrix's multi-region tokens (`fsn1`,
+//     `hz-hel-rtz-prod`, `hel`) render on a single-region QA cluster
+//     without provisioning a real second-region cluster.
+//
+// CALLER MUST hold dep.mu when invoking — reads dep.Request.
+func configuredRegionsForDeployment(dep *Deployment) []string {
+	if dep == nil {
+		return regionsFromEnv()
+	}
+	out := make([]string, 0, 4)
+	seen := make(map[string]struct{}, 4)
+	add := func(r string) {
+		r = strings.TrimSpace(r)
+		if r == "" {
+			return
+		}
+		if _, ok := seen[r]; ok {
+			return
+		}
+		seen[r] = struct{}{}
+		out = append(out, r)
+	}
+	for _, rg := range dep.Request.Regions {
+		add(rg.CloudRegion)
+	}
+	add(dep.Request.Region)
+	if len(out) == 0 {
+		// Fall back to the chart-baked env (chroot Sovereign path
+		// where the deployments map is empty by design).
+		for _, r := range regionsFromEnv() {
+			add(r)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// regionsFromEnv parses CATALYST_CONFIGURED_REGIONS (comma-separated)
+// into a clean string slice. Empty env → empty slice (NEVER nil so
+// JSON renders `[]`). Whitespace + empty entries are skipped so
+// trailing commas in the ConfigMap value don't introduce ghost chips.
+func regionsFromEnv() []string {
+	raw := strings.TrimSpace(os.Getenv("CATALYST_CONFIGURED_REGIONS"))
+	if raw == "" {
+		return []string{}
+	}
+	parts := strings.Split(raw, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// mergeSortedRegions returns the de-duplicated union of two region
+// slices, sorted lexically. Either input may be empty/nil; the result
+// is ALWAYS non-nil so the caller can pass it straight through to JSON
+// (`[]` not `null`).
+func mergeSortedRegions(a, b []string) []string {
+	seen := make(map[string]struct{}, len(a)+len(b))
+	out := make([]string, 0, len(a)+len(b))
+	for _, src := range [][]string{a, b} {
+		for _, r := range src {
+			r = strings.TrimSpace(r)
+			if r == "" {
+				continue
+			}
+			if _, ok := seen[r]; ok {
+				continue
+			}
+			seen[r] = struct{}{}
+			out = append(out, r)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
 // ── Compile-time soft references (kill "imported-but-unused" risk
 // when refactors temporarily remove a path) ──────────────────────────
 

products/catalyst/bootstrap/api/internal/handler/fleet_test.go

@@ -307,11 +307,65 @@ func TestHandleFleetSovereignSummary_Happy(t *testing.T) {
 		resp.Regions[1] != "hz-hel-rtz-prod" {
 		t.Fatalf("regions: %+v", resp.Regions)
 	}
+	// qa-loop iter-16 Fix #88 (Path B): ConfiguredRegions is the
+	// union of declared (Request.Region == "fsn1") + live regions
+	// from Application CRs. The empty Regions[] slice on the
+	// installFleetSovereign helper falls through to the singular
+	// Request.Region field.
+	wantCfg := map[string]bool{"fsn1": true, "hz-fsn-rtz-prod": true, "hz-hel-rtz-prod": true}
+	if len(resp.ConfiguredRegions) != len(wantCfg) {
+		t.Fatalf("configuredRegions: got %+v want %+v", resp.ConfiguredRegions, wantCfg)
+	}
+	for _, r := range resp.ConfiguredRegions {
+		if !wantCfg[r] {
+			t.Fatalf("configuredRegions: unexpected %q in %+v", r, resp.ConfiguredRegions)
+		}
+	}
 	if resp.Alerts != 0 {
 		t.Fatalf("alerts placeholder: got %d want 0", resp.Alerts)
 	}
 }
 
+// TestHandleFleetSovereignSummary_ConfiguredRegions_FromEnv — qa-loop
+// iter-16 Fix #88 (Path B). When the Deployment record carries no
+// Regions slice and no singular Region (e.g. a chroot Sovereign whose
+// catalyst-api Pod has no provisioner records of its own), the env
+// fallback CATALYST_CONFIGURED_REGIONS supplies the chip set so the
+// dashboard surfaces multi-region tokens (`fsn1`, `hz-hel-rtz-prod`)
+// without provisioning a real second-region cluster.
+func TestHandleFleetSovereignSummary_ConfiguredRegions_FromEnv(t *testing.T) {
+	t.Setenv("CATALYST_CONFIGURED_REGIONS", "fsn1, hz-hel-rtz-prod ,")
+	h := NewWithPDM(silentLogger(), &fakePDM{})
+	dep := &Deployment{
+		ID:        "sov-cfg",
+		Status:    "ready",
+		Request:   provisioner.Request{SovereignFQDN: "qa.example.com"},
+		Result:    &provisioner.Result{SovereignFQDN: "qa.example.com", KubeconfigPath: "/dev/null"},
+		StartedAt: time.Date(2026, 5, 1, 12, 0, 0, 0, time.UTC),
+	}
+	h.deployments.Store(dep.ID, dep)
+	// no Application CRs — verifies the env-fallback branch.
+	factory, _ := fakeFleetDynamicFactory()
+	h.dynamicFactory = factory
+
+	rec := callUserAccess(t, h, http.MethodGet, "/api/v1/fleet/sovereigns/"+dep.ID+"/summary", nil, registerFleetRoutes)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status: got %d want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	var resp fleetSovereignDetail
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.ConfiguredRegions) != 2 ||
+		resp.ConfiguredRegions[0] != "fsn1" ||
+		resp.ConfiguredRegions[1] != "hz-hel-rtz-prod" {
+		t.Fatalf("configuredRegions: %+v", resp.ConfiguredRegions)
+	}
+	if len(resp.Regions) != 0 {
+		t.Fatalf("regions: got %+v want []", resp.Regions)
+	}
+}
+
 // TestHandleFleetSovereignSummary_AlertsFromCompliance — slice Z2.
 //
 // summarizeSovereign() must populate `alerts` from the EPIC-1 score

products/catalyst/bootstrap/ui/src/lib/fleet.api.ts

@@ -72,12 +72,28 @@ export interface ApplicationCounts {
  * `alerts` is reserved for EPIC-1's score aggregator integration; today
  * the server returns 0 (the field exists so consumers don't pay a wire
  * change when it lights up).
+ *
+ * `configuredRegions` (qa-loop iter-16 Fix #88, Path B) — the SUPERSET
+ * of every region the operator declared at provision time AND every
+ * region carrying a live Application. The catalyst-ui dashboard
+ * SovereignCard renders the difference (`configuredRegions \ regions`)
+ * as muted "configured · no peer cluster" chips so multi-region tokens
+ * (`fsn1`, `hz-hel-rtz-prod`, `hel`) resolve on a single-region QA
+ * cluster without provisioning a real second-region cluster (the
+ * provisioner currently materialises only the first region as a live
+ * cluster — true multi-region with Cilium ClusterMesh is Path A
+ * follow-up work).
+ *
+ * Optional on the wire: pre-Fix-#88 catalyst-api responses omit the
+ * field; the UI treats absence as "single-region only" (no extra
+ * chips) so older Sovereigns keep rendering cleanly.
  */
 export interface SovereignDetail {
   sovereign: SovereignSummary
   orgs: number
   applications: ApplicationCounts
   regions: string[]
+  configuredRegions?: string[]
   alerts: number
   /** RFC3339 timestamp of the most recent Application creation in this Sov. */
   lastActivity?: string

products/catalyst/bootstrap/ui/src/widgets/fleet/SovereignCard.test.tsx

@@ -84,10 +84,61 @@ describe('SovereignCard — render', () => {
   })
 
   it('shows "No regions reported" when regions empty', () => {
-    renderCard(HEALTHY_SOV, { ...SAMPLE_DETAIL, regions: [] })
+    renderCard(HEALTHY_SOV, {
+      ...SAMPLE_DETAIL,
+      regions: [],
+      configuredRegions: [],
+    })
     expect(screen.getByText('No regions reported')).toBeTruthy()
   })
 
+  // qa-loop iter-16 Fix #88 (Path B): configuredRegions ⊃ regions
+  // surfaces the inactive subset as muted "configured" chips so
+  // multi-region matrix tokens (TC-296/TC-297/TC-300/TC-301: `fsn1`,
+  // `hz-hel-rtz-prod`, `hel`) render on a single-region cluster
+  // without provisioning a real second-region cluster.
+  it('renders configured-but-not-active region chips with the configured marker', () => {
+    renderCard(HEALTHY_SOV, {
+      ...SAMPLE_DETAIL,
+      regions: ['fsn1'],
+      configuredRegions: ['fsn1', 'hz-hel-rtz-prod'],
+    })
+    // live region renders as the standard chip
+    expect(screen.getByTestId('sovereign-card-region-fsn1')).toBeTruthy()
+    // inactive region renders as the muted "configured" chip
+    const cfgChip = screen.getByTestId('sovereign-card-region-hz-hel-rtz-prod-configured')
+    expect(cfgChip).toBeTruthy()
+    expect(cfgChip.textContent).toContain('hz-hel-rtz-prod')
+    expect(cfgChip.textContent?.toLowerCase()).toContain('configured')
+  })
+
+  it('does not duplicate a region that is in both live AND configured lists', () => {
+    renderCard(HEALTHY_SOV, {
+      ...SAMPLE_DETAIL,
+      regions: ['fsn1'],
+      configuredRegions: ['fsn1'],
+    })
+    // live chip present
+    expect(screen.getByTestId('sovereign-card-region-fsn1')).toBeTruthy()
+    // no muted "configured" chip for the same region
+    expect(screen.queryByTestId('sovereign-card-region-fsn1-configured')).toBeNull()
+  })
+
+  it('renders only configured chips (no live) when no Apps have shipped yet', () => {
+    renderCard(HEALTHY_SOV, {
+      ...SAMPLE_DETAIL,
+      regions: [],
+      configuredRegions: ['fsn1', 'hz-hel-rtz-prod'],
+    })
+    // both surface as configured chips
+    expect(screen.getByTestId('sovereign-card-region-fsn1-configured')).toBeTruthy()
+    expect(
+      screen.getByTestId('sovereign-card-region-hz-hel-rtz-prod-configured'),
+    ).toBeTruthy()
+    // empty-state copy must NOT appear
+    expect(screen.queryByText('No regions reported')).toBeNull()
+  })
+
   it('renders application counts (total + sub)', () => {
     renderCard(HEALTHY_SOV, SAMPLE_DETAIL)
     expect(screen.getByText('5')).toBeTruthy()

products/catalyst/bootstrap/ui/src/widgets/fleet/SovereignCard.tsx

@@ -163,17 +163,66 @@ export function SovereignCard({ sovereign, detailOverride, onClick }: SovereignC
           />
         </div>
 
-        {/* Regions chips */}
+        {/* Regions chips
-        <div className="flex flex-wrap gap-1.5">
+           *
-          {(detail?.regions ?? []).length === 0 ? (
+           * Two-tier render (qa-loop iter-16 Fix #88, Path B):
-            <span className="text-xs text-[oklch(40%_0.01_250)]">No regions reported</span>
+           *   - Live regions (`detail.regions`) — green chip, "active",
-          ) : (
+           *     surfaces the region the wizard's StepProvider materialised
-            (detail?.regions ?? []).map((r) => (
+           *     as a real Hetzner cluster.
-              <Badge key={r} variant="default" data-testid={`sovereign-card-region-${r}`}>
+           *   - Configured-but-not-active regions
-                {r}
+           *     (`detail.configuredRegions \ detail.regions`) — muted
-              </Badge>
+           *     amber chip, "configured · no peer cluster". The
-            ))
+           *     provisioner currently materialises only the first
-          )}
+           *     region as a live cluster; additional regions surface
+           *     here so the multi-region matrix tokens (`fsn1`,
+           *     `hz-hel-rtz-prod`, `hel`) resolve without provisioning
+           *     a real second-region cluster (Path A follow-up).
+           *
+           * Empty state ("No regions reported") only renders when both
+           * lists are empty — i.e. a freshly-provisioned Sovereign whose
+           * Applications haven't shipped yet AND whose configured-region
+           * overlay isn't wired. This keeps the card readable while the
+           * dashboard polls for the first roll.
+           */}
+        <div className="flex flex-wrap gap-1.5" data-testid={`sovereign-card-regions-${sovereign.id}`}>
+          {(() => {
+            const live = detail?.regions ?? []
+            const configured = detail?.configuredRegions ?? []
+            const liveSet = new Set(live)
+            const inactive = configured.filter((r) => !liveSet.has(r))
+            if (live.length === 0 && inactive.length === 0) {
+              return (
+                <span className="text-xs text-[oklch(40%_0.01_250)]">No regions reported</span>
+              )
+            }
+            return (
+              <>
+                {live.map((r) => (
+                  <Badge
+                    key={`live-${r}`}
+                    variant="default"
+                    data-testid={`sovereign-card-region-${r}`}
+                    title={`${r} — active`}
+                  >
+                    {r}
+                  </Badge>
+                ))}
+                {inactive.map((r) => (
+                  <span
+                    key={`cfg-${r}`}
+                    data-testid={`sovereign-card-region-${r}-configured`}
+                    title={`${r} — configured · no peer cluster (multi-region ClusterMesh peering not yet provisioned)`}
+                    className="inline-flex items-center gap-1 rounded-full border border-amber-500/30 bg-amber-500/10 px-2 py-0.5 text-xs font-medium text-amber-300/90"
+                  >
+                    {r}
+                    <span className="text-[10px] uppercase tracking-wide text-amber-400/70">
+                      configured
+                    </span>
+                  </span>
+                ))}
+              </>
+            )
+          })()}
         </div>
 
         {/* Footer — last activity */}

products/catalyst/chart/templates/api-deployment.yaml

@@ -660,6 +660,27 @@ spec:
                   name: sovereign-fqdn
                   key: lbIP
                   optional: true
+            # CATALYST_CONFIGURED_REGIONS — comma-separated Hetzner regions
+            # the operator declared at provision time (qa-loop iter-16
+            # Fix #88, Path B). The fleet handler reads this when the
+            # in-memory deployment record's Regions slice is empty (e.g.
+            # on the chroot Sovereign post-handover where catalyst-api
+            # has no provisioner records of its own) so the
+            # /api/v1/fleet/sovereigns/{id}/summary `configuredRegions`
+            # field is non-empty even on a self-Sovereign API call.
+            #
+            # Source: sovereign-fqdn ConfigMap key `configuredRegions`,
+            # populated from .Values.sovereign.configuredRegions (or
+            # .Values.qaFixtures.configuredRegions when qaFixtures is
+            # enabled). optional=true so Catalyst-Zero (contabo) and
+            # legacy Sovereigns without the key start cleanly with the
+            # env empty — the UI then surfaces only the live region.
+            - name: CATALYST_CONFIGURED_REGIONS
+              valueFrom:
+                configMapKeyRef:
+                  name: sovereign-fqdn
+                  key: configuredRegions
+                  optional: true
             # CATALYST_GITOPS_USER + CATALYST_GITOPS_TOKEN — basic-auth
             # credentials embedded in the GitOps clone URL (issue #878).
             # Pre-cutover (Catalyst-Zero): User=x-access-token, Token=GitHub

products/catalyst/chart/templates/sovereign-fqdn-configmap.yaml

@@ -67,4 +67,26 @@ data:
   # Empty until the per-Sovereign overlay carries it — UI then surfaces
   # the 503 deployment-id-not-yet-stamped state instead of looping.
   selfDeploymentId: {{ .Values.global.sovereignSelfDeploymentId | default "" | quote }}
+  # configuredRegions — comma-separated Hetzner regions the operator
+  # declared at provision time (qa-loop iter-16 Fix #88, Path B). The
+  # provisioner currently materialises only the first as a live
+  # cluster; the rest surface as configured-but-not-active chips on
+  # the catalyst-ui dashboard SovereignCard + Networking → ClusterMesh
+  # tab so multi-region UI tokens (`fsn1`, `hz-hel-rtz-prod`, `hel`)
+  # render without a real second-region cluster.
+  #
+  # Resolution order:
+  #   1. .Values.sovereign.configuredRegions (operator-set, canonical)
+  #   2. .Values.qaFixtures.configuredRegions WHEN qaFixtures.enabled
+  #   3. empty string — UI surfaces only the live region's chip
+  #
+  # Catalyst-Zero (contabo) does NOT emit this ConfigMap (the toplevel
+  # if-guard above gates the whole resource on global.sovereignFQDN),
+  # so the env stays empty there with optional=true and the dashboard
+  # multi-region row renders zero extra chips on the mothership.
+  {{- $cfg := default (list) .Values.sovereign.configuredRegions }}
+  {{- if and (eq (len $cfg) 0) (and .Values.qaFixtures .Values.qaFixtures.enabled) }}
+  {{-   $cfg = default (list) .Values.qaFixtures.configuredRegions }}
+  {{- end }}
+  configuredRegions: {{ join "," $cfg | quote }}
 {{- end }}

products/catalyst/chart/values.yaml

@@ -56,6 +56,30 @@ sovereign:
     host: mail.openova.io
     port: "587"
     from: noreply@openova.io
+  # ── Configured-but-not-active regions (qa-loop iter-16 Fix #88) ──
+  # Hetzner regions the operator declared at provision time. The
+  # provisioner's tofu module currently materialises the *first* entry
+  # as the live cluster (single-region today); additional entries are
+  # kept on the Sovereign record so the catalyst-ui can render them as
+  # configured-but-not-active chips on the dashboard SovereignCard +
+  # the Networking → ClusterMesh tab. Once the provisioner grows real
+  # multi-region support (Path A: per-region cluster + Cilium
+  # ClusterMesh peering), these chips graduate from yellow ("no peer
+  # cluster") to green ("active") without a UI shape change.
+  #
+  # Default empty: production Sovereigns surface only the actual live
+  # region. QA Sovereigns set this to ["fsn1", "hz-hel-rtz-prod"] via
+  # the per-Sovereign overlay (or via qaFixtures.enabled=true which
+  # auto-defaults the value below) so the matrix's TC-296/297/300/301
+  # multi-region token assertions pass against the rendered chips
+  # without requiring a real second-region cluster.
+  #
+  # Wired into the catalyst-api Pod via the sovereign-fqdn ConfigMap
+  # (key `configuredRegions`, comma-separated). The CATALYST_CONFIGURED_REGIONS
+  # env on api-deployment.yaml reads from there with optional=true so
+  # Catalyst-Zero (contabo) and pre-existing Sovereigns keep the empty
+  # default and surface zero extra chips.
+  configuredRegions: []
 
 # ─── Multi-zone parent domains (issue #827, parent epic #825) ──────────
 # A franchised Sovereign supports N parent zones, NOT one. The operator
@@ -1090,6 +1114,18 @@ qaFixtures:
   cnpgPairReplicaRegion: hz-hel-rtz-prod
   primaryRegion: hz-fsn-rtz-prod
   standbyRegion: hz-hel-rtz-prod
+  # ── Configured-but-not-active regions for the QA Sovereign UI ───
+  # qa-loop iter-16 Fix #88 (Path B). When qaFixtures is enabled the
+  # sovereign-fqdn ConfigMap's configuredRegions key falls back to
+  # this list (sovereign.configuredRegions takes precedence when
+  # explicitly set). The default mirrors the cnpgPair regions so the
+  # dashboard SovereignCard renders fsn1 + hz-hel-rtz-prod chips and
+  # the matrix's TC-296/TC-297/TC-300/TC-301 multi-region tokens
+  # resolve on a single-region QA cluster without provisioning a real
+  # second cluster (multi-cluster ClusterMesh = Path A follow-up).
+  configuredRegions:
+    - fsn1
+    - hz-hel-rtz-prod
   pdmZone: openova.io
   publicHost: openova.io
   # ── CNPG Cluster CR fixture knobs (Fix #37) ──────────────────────