@bongos/core 1.19.1012 → 1.19.1014

package/docs/file-map.md

@@ -134,7 +134,7 @@
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
-│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE ROOM's figure run, size bar and five-object marks (task 1004098 / BV2.R03 — `thinking.{html,js}` at `/thinking`, named for its own h1 because `room.css` is the reading-room archetype and `board-room` is the government surface; `idea-objects.js` beside it is the shared object vocabulary the sky will take too).
+│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).

package/docs/module-api-changelog.md

@@ -2498,5 +2498,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1010 with no explicit bump. run 36066617514. (task 1002620)
   1.19.1012 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1011 with no explicit bump. run 36067980398. (task 1002620)
+  1.19.1013 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1012 with no explicit bump. run 36072935774. (task 1002620)
+  1.19.1014 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1013 with no explicit bump. run 36076310606. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet-costs.js

@@ -0,0 +1,80 @@
+// fleet-costs.js — the fleet cost page's builders (task 1001949, ADR 0327).
+//
+// WHY. GET /provisioning/fleet/cost-ledger answers two questions per project, one
+// column each: what the project costs US, and an ESTIMATE of its owner's own hosting
+// bill. null in either means UNPRICED — the row names no plan anything can price.
+// What this file exists to hold: an unpriced cost never renders as $0 and never moves
+// a total. A $0 there would be a price nobody quoted.
+//
+// Pure, so a test runs the real rendering over the real fixture instead of a copy of
+// it. Exposed as window.OTBFleetCosts; node-require-safe (the roadmap-timeline.js
+// pattern — assignment is the only eval-time side effect). fleet.js is the chrome.
+(() => {
+  'use strict';
+
+  const UNPRICED = 'not priced yet';
+  const SHAPE = {
+    'cloud-host': 'Cloud host (owner’s account)',
+    'byo-host': 'Self-hosted',
+    'control-plane': 'This platform’s server',
+    'co-tenant': 'Shared server (retired)',
+  };
+
+  const ESC = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ESC[c]);
+  const isPriced = (v) => typeof v === 'number' && Number.isFinite(v);
+  const quiet = (text) => `<span class="ledger__est">${text}</span>`;
+
+  function money(v) {
+    if (!isPriced(v)) return null;
+    return `$${Number.isInteger(v) ? v : v.toFixed(2)}`;
+  }
+
+  // A self-hosted project runs on its owner's own machine, so its bill is not ours to
+  // see: a different absence from a plan nobody has recorded yet.
+  function cellHtml(v, shape, column) {
+    if (isPriced(v)) return esc(money(v));
+    return quiet(column === 'owner' && shape === 'byo-host' ? 'not visible to us' : UNPRICED);
+  }
+
+  // The server's total sums only priced rows and counts the rest as one number; the
+  // self-hosted share of that count is split back out so the total says what its cells
+  // say. A column with NOTHING priced gets no figure at all: the sum of no prices is not $0.
+  function totalHtml(total, rows, column) {
+    const unpriced = Number(total && total.unpriced) || 0;
+    const hidden = column === 'owner'
+      ? rows.filter((r) => r.hosting_shape === 'byo-host' && !isPriced(r.owner_monthly_usd)).length
+      : 0;
+    const notPriced = unpriced - hidden;
+    if (rows.length - unpriced <= 0) return quiet(notPriced > 0 ? UNPRICED : 'not visible to us');
+    const notes = [notPriced > 0 && `${notPriced} not priced`, hidden > 0 && `${hidden} not visible`].filter(Boolean);
+    const figure = esc(money(Number(total && total.monthly_usd) || 0));
+    return notes.length ? `${figure} ${quiet(`+ ${notes.join(', ')}`)}` : figure;
+  }
+
+  function rowHtml(r) {
+    return `<tr>
+      <td>${esc(r.slug)}</td>
+      <td>${esc(r.owner)}</td>
+      <td>${esc(SHAPE[r.hosting_shape] || r.hosting_shape)}</td>
+      <td>${r.tier ? esc(r.tier) : quiet('none recorded')}</td>
+      <td class="ledger__num">${cellHtml(r.platform_monthly_usd, r.hosting_shape, 'platform')}</td>
+      <td class="ledger__num">${cellHtml(r.owner_monthly_usd, r.hosting_shape, 'owner')}</td>
+    </tr>`;
+  }
+
+  function ledgerHtml(ledger) {
+    const rows = ledger && Array.isArray(ledger.instances) ? ledger.instances : [];
+    if (!rows.length) return '<p class="ledger__note">No projects are hosted here yet.</p>';
+    const totals = (ledger && ledger.totals) || {};
+    return `<table class="ledger" id="fl-table">
+      <thead><tr><th>Project</th><th>Owner</th><th>Hosting</th><th>Plan</th><th>Costs us / month</th><th>Owner’s bill / month (est.)</th></tr></thead>
+      <tbody>${rows.map(rowHtml).join('')}</tbody>
+      <tfoot><tr><th scope="row" colspan="4">Total</th><td class="ledger__num">${totalHtml(totals.platform, rows, 'platform')}</td><td class="ledger__num">${totalHtml(totals.owner, rows, 'owner')}</td></tr></tfoot>
+    </table>`;
+  }
+
+  const api = { money, ledgerHtml };
+  if (typeof window !== 'undefined') window.OTBFleetCosts = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/fleet.html

@@ -0,0 +1,64 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Fleet costs — {{worldName}}</title>
+  <meta name="description" content="What each hosted project costs this platform, and an estimate of what its owner pays for their own hosting.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="/builders/style.css?v=2026-09-23-changelist1">
+  <link rel="stylesheet" href="/builders/oversight.css">
+  <link rel="stylesheet" href="/builders/project-settings.css">
+</head>
+<body data-page="fleet" data-page-title="Fleet costs">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Fleet costs</h1>
+        <p class="page-head__sub" id="fl-sub">Loading…</p>
+      </div>
+
+      <main id="hall-main">
+        <section class="scroll" id="fl-sealed" aria-labelledby="fl-sealed-h" hidden>
+          <h2 class="scroll__h" id="fl-sealed-h">Restricted</h2>
+          <p class="scroll__lede">This page opens at a higher rank.</p>
+        </section>
+
+        <section class="scroll" id="fl-body" aria-labelledby="fl-body-h" hidden>
+          <h2 class="scroll__h" id="fl-body-h">What each project costs</h2>
+          <!-- Two different bills, one column each (ADR 0327): a cloud host runs on its
+               OWNER's account, so it costs this platform nothing and its owner pays their
+               hosting provider directly. Nothing on this page is charged to anyone. -->
+          <p class="scroll__lede">
+            Two different bills, one column each. The first is what a project costs this
+            platform. The second is an estimate of what its owner pays their own hosting
+            provider, which bills them directly. A project with no recorded plan reads
+            "not priced yet", never $0, and is left out of the total. A self-hosted
+            project runs on its owner's own machine, so its bill is not visible to us.
+          </p>
+          <div id="fl-panel"><span class="kit-skel"></span></div>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
+<script src="/builders/palette.js" defer></script>
+<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
+<script src="/builders/hall-kit.js"></script>
+<script src="/builders/fleet-costs.js"></script>
+<script src="/builders/fleet.js"></script>
+</body>
+</html>

package/modules/hall-ui/public/fleet.js

@@ -0,0 +1,45 @@
+// fleet.js — the fleet cost page (task 1001949, ADR 0327): the chrome around
+// fleet-costs.js, which does all the drawing.
+//
+// One read, GET /provisioning/fleet/cost-ledger, gated on `provisioning.fleet.manage`
+// exactly as this page is. A 403 shows the sealed state rather than an empty table,
+// so a refusal is never mistaken for a fleet with nothing in it.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml } = window.OTB;
+  const $ = (id) => document.getElementById(id);
+
+  function fail(message) {
+    $('fl-body').hidden = false;
+    $('fl-sub').textContent = 'Unavailable';
+    $('fl-panel').innerHTML = `<p class="ps-invalid">${escapeHtml(message)}</p>`;
+  }
+
+  async function load() {
+    let res;
+    try {
+      res = await api.request('GET', `${API}/provisioning/fleet/cost-ledger`);
+    } catch (e) {
+      return fail('Could not reach the server.');
+    }
+    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+    if (res.status === 403) {
+      $('fl-sealed').hidden = false;
+      $('fl-sub').textContent = 'Restricted';
+      return;
+    }
+    if (!res.ok) {
+      const err = (res.data && res.data.error) || {};
+      return fail(err.message && err.message !== err.code ? err.message : 'Could not read the fleet costs.');
+    }
+    const n = ((res.data && res.data.instances) || []).length;
+    $('fl-sub').textContent = `${n} project${n === 1 ? '' : 's'}`;
+    $('fl-body').hidden = false;
+    $('fl-panel').innerHTML = window.OTBFleetCosts.ledgerHtml(res.data);
+  }
+
+  document.addEventListener('DOMContentLoaded', load);
+})();

package/modules/hall-ui/public/fleet.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "FLEET COSTS (task 1001949, ADR 0327) through modules/ui-design/kit/render.js. The page reads ONE authenticated route, GET /provisioning/fleet/cost-ledger, gated on provisioning.fleet.manage, so against the kit's own stub it renders its failed-read state — a state the floors must hold in. To look at the populated ledger run it against the hall-preview harness, whose provisioning__fleet__cost-ledger.json fixture carries two cloud hosts with no recorded plan (every owner cost unpriced, the state live is in today):\n\n  node scripts/hall-preview/server.js --port 4620 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/fleet.states.json --base-in http://localhost:4620 --base-out http://localhost:4620",
+  "page": "/builders/fleet",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/" },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b403\\b", "\\b404\\b", "Unauthorized", "Forbidden", "Not Found", "load failed"],
+  "states": {
+    "ledger": { "auth": true, "actions": [["wait", 800]], "expect": { "visible": ["#fl-body"] } },
+    "out": { "auth": false, "actions": [["wait", 600]] }
+  },
+  "reducedMotion": { "auth": true, "actions": [["wait", 800]] }
+}

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goal-map.html

@@ -56,7 +56,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/goals.html

@@ -235,7 +235,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea-objects.js

@@ -42,7 +42,10 @@
     protostar: {
       label: 'waiting',
       noun: 'protostar',
-      blurb: 'filed, not yet ignited',
+      // The sky's fuller sentence (docs/design/mocks/sky/sky.template.html, the
+      // design of record — task 1004231): the second axis, position, spelled
+      // into the object's own blurb, since the sky is where it can be seen.
+      blurb: 'filed, not yet ignited. in a well it awaits a nod; in open space nothing has claimed it',
     },
     satellite: {
       label: 'folded in',

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1" defer></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -55,7 +55,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -334,6 +334,10 @@
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
       { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon' },
+      // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
+      // of `provisioning.fleet.manage`, the atom its page and its one read check (the
+      // Deploy precedent above); dropped where the provisioning module is not enabled.
+      { id: 'fleet', label: 'Fleet costs', icon: 'admin', href: '/fleet', gate: 'government', module: 'provisioning' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'government' gate comment anticipated — cosmetic
       // only. The wall is the `government.manage` atom checked on each of the