@bongos/core 1.19.1013 → 1.19.1014

package/modules/hall-ui/public/goal-map.html

@@ -56,7 +56,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/goals.html

@@ -235,7 +235,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1" defer></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -55,7 +55,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -334,6 +334,10 @@
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
       { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon' },
+      // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
+      // of `provisioning.fleet.manage`, the atom its page and its one read check (the
+      // Deploy precedent above); dropped where the provisioning module is not enabled.
+      { id: 'fleet', label: 'Fleet costs', icon: 'admin', href: '/fleet', gate: 'government', module: 'provisioning' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'government' gate comment anticipated — cosmetic
       // only. The wall is the `government.manage` atom checked on each of the

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/shell.js?v=2026-09-24-fleetcosts1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/provisioning/routes/provisioning.js

@@ -49,7 +49,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const auth = api, { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
-const { costLedger } = require('../cost-ledger');
+const { costLedger, ownerMonthlyUsd } = require('../cost-ledger');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
@@ -144,10 +144,10 @@ function publishVerdict(row) {
 }
 
 // The owner-facing projection every instance read returns: the allow-listed row
-// plus the derived publish verdict. One helper so a new read cannot ship the row
-// without the verdict and leave an owner unable to see why they are dark matter.
+// plus the derived publish verdict and the estimate of the owner's own hosting bill
+// (task 1001949; null = unpriced, never 0). Owner- or archon-scoped reads only.
 function ownerInstance(row) {
-  return { ...provisioning.publicInstance(row), publish: publishVerdict(row) };
+  return { ...provisioning.publicInstance(row), publish: publishVerdict(row), owner_monthly_usd: ownerMonthlyUsd({ hostingShape: row.hosting_shape, tier: row.tier }) };
 }
 
 // Project an instance row for the fleet view — the owner identity + the same

package/modules/public-landing/public/projects.html

@@ -5573,6 +5573,12 @@ summary{min-height:24px;padding:3px 0;}
 
   /* one label · value pair of the manage ledger */
   function ledgerRow(r) { return '<span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span>'; }
+  /* the owner's own hosting bill (task 1001949, ADR 0327): an estimate, since the
+     provider bills them directly. null is unpriced — a $0 would be a price nobody quoted */
+  function hostingBill(usd) {
+    if (typeof usd !== 'number' || !isFinite(usd)) return 'not priced yet';
+    return '$' + (usd % 1 ? usd.toFixed(2) : String(usd)) + '/month, estimated. Render bills you directly.';
+  }
   /* the head's planet and the ledger's planet row (task 1003345) — one resolution
      (planetOf) for both, so the head, the row and the sky can never disagree; the
      planet row is the slot the picker (task 1003347) fills */
@@ -5601,6 +5607,7 @@ summary{min-height:24px;padding:3px 0;}
     var server = inst.hosting_shape ? esc(SHAPE_LABEL[inst.hosting_shape] || inst.hosting_shape) : '';
     if (inst.onboard_mode === 'adopt') server += (server ? ', ' : '') + 'adopted repo';
     if (server) rows.push(['server', server]);
+    if (inst.hosting_shape === 'cloud-host' && inst.status !== 'torn_down') rows.push(['hosting bill', hostingBill(inst.owner_monthly_usd)]);
     $('mMeta').innerHTML = rows.map(ledgerRow).join('');
     $('mMeta').hidden = !rows.length;
     var addr = addressRow(inst, true);

package/modules/ui-design/kit/fixtures/provisioning-instances.json

@@ -26,6 +26,7 @@
       "domain": null,
       "target_ref": "builder/harbor",
       "hosting_shape": "cloud-host",
+      "owner_monthly_usd": null,
       "onboard_mode": "scaffold",
       "created_at": "$now-6m",
       "provisioned_at": null,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1013",
+  "version": "1.19.1014",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1013",
+      "version": "1.19.1014",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1013",
+  "version": "1.19.1014",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth.js

@@ -462,6 +462,10 @@ const PAGE_GATES = Object.freeze({
   // — a vulnerability window, and exactly the kind of topology ADR 0043 keeps off
   // unauthenticated surfaces.
   requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders' }),
+  // The /fleet cost page (task 1001949) — on `provisioning.fleet.manage`, the SAME atom
+  // its one read (GET /provisioning/fleet/cost-ledger) checks: every owner's projects
+  // and what they cost, so the page reaches exactly as far as the data does.
+  requireFleetPage: Object.freeze({ permission: 'provisioning.fleet.manage', deniedTo: '/builders' }),
 });
 
 // The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
@@ -637,6 +641,9 @@ async function requireBoardVotePage(req, res, next) {
 async function requireCorePinPage(req, res, next) {
   return runPageGate('requireCorePinPage', req, res, next);
 }
+async function requireFleetPage(req, res, next) {
+  return runPageGate('requireFleetPage', req, res, next);
+}
 
 // ---------------------------------------------------------------------------
 // Route-gate inventory (V3.R06 #231) — the canonical "who can call what" list.
@@ -929,6 +936,7 @@ module.exports = {
   requireProjectCuratePage,
   requireBoardVotePage,
   requireCorePinPage,
+  requireFleetPage,
   requireRank,
   rankMeetsThreshold,
   requirePermission,

package/src/bongos/serve-internal.js

@@ -954,6 +954,8 @@ function mountInternalSurfaces(app) {
   // statically, and a comment in that gap makes the page test as UNGATED while
   // looking gated here. Prose goes above the const, as here.
   const DEPLOY_PAGE_RE = /^\/builders\/deploy(?:\.html)?\/?$/;
+  // The fleet cost page (task 1001949), on the atom its one read checks.
+  const FLEET_PAGE_RE = /^\/builders\/fleet(?:\.html)?\/?$/;
   // /scouting WAS the legacy twin of /people — the same /api/gds/scouting
   // directory, left behind when task 1002577 graduated it into the hall. Task
   // 1003470 had already made the two one page (scouting.html rendered people's
@@ -1004,6 +1006,9 @@ function mountInternalSurfaces(app) {
     if (DEPLOY_PAGE_RE.test(norm)) {
       return gdsAuth.requireCorePinPage(req, res, next);
     }
+    if (FLEET_PAGE_RE.test(norm)) {
+      return gdsAuth.requireFleetPage(req, res, next);
+    }
     next();
   });
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1013'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1014'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_resolve_failure.mjs

@@ -98,16 +98,17 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   //   requireBoardVotePage      /   ADR 0266 /board-room vote gate)
   //   requireCorePinPage        /   ADR 0293's /deploy door — the narrowest of them,
   //                                 on the archon-floor `core.pin.move` atom.
+  //   requireFleetPage            — task 1001949's /fleet cost page, same delegation.
   // Task 1003450 removed two more — requireNonXenosPage and the R113
   // requireGovernmentManagePage — which had both ended up dispatched from no
   // route at all; tests/hall_page_gate_map.mjs now fails if that recurs.
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireCorePinPage', 'requireGovernmentPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireCorePinPage', 'requireFleetPage', 'requireGovernmentPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage', 'requireBoardVotePage', 'requireCorePinPage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage', 'requireBoardVotePage', 'requireCorePinPage', 'requireFleetPage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/fleet_cost_view.mjs

@@ -0,0 +1,189 @@
+// tests/fleet_cost_view.mjs — Cost view v1 (task 1001949, ADR 0327): the fleet cost page
+// for the platform owner, and the one estimate line on a cloud-host owner's project page.
+//
+// The rule every case below leans on: an UNPRICED cost (null) renders as unpriced and never
+// as $0, and never moves a total. A $0 there would be a price nobody quoted.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import http from 'node:http';
+import vm from 'node:vm';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (p) => readFileSync(p, 'utf8').replace(/\r\n/g, '\n');
+const costs = require(path.join(HALL, 'fleet-costs.js'));
+const FIXTURE = JSON.parse(read(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'provisioning__fleet__cost-ledger.json')));
+
+// ── the fleet page's builders ────────────────────────────────────────────────
+const row = (over) => ({ id: '1', slug: 'p', owner: 'o', hosting_shape: 'cloud-host', tier: null, status: 'active', platform_monthly_usd: 0, owner_monthly_usd: null, ...over });
+const cells = (html) => [...html.matchAll(/<td[^>]*>([\s\S]*?)<\/td>/g)].map((m) => m[1].replace(/<[^>]+>/g, '').trim());
+const foot = (html) => html.slice(html.indexOf('<tfoot>'));
+
+test('money: whole dollars stay whole, cents show two places, and an unpriced value has no price', () => {
+  assert.equal(costs.money(13), '$13');
+  assert.equal(costs.money(12.5), '$12.50');
+  assert.equal(costs.money(0), '$0');
+  assert.equal(costs.money(null), null);
+  assert.equal(costs.money(undefined), null);
+});
+
+test('an unpriced row reads "not priced yet", never $0 — and a real $0 still reads $0', () => {
+  const html = costs.ledgerHtml({
+    instances: [row({ slug: 'a', platform_monthly_usd: 0, owner_monthly_usd: null })],
+    totals: { platform: { monthly_usd: 0, unpriced: 0 }, owner: { monthly_usd: 0, unpriced: 1 } },
+  });
+  const [, , , , us, owner] = cells(html.slice(0, html.indexOf('<tfoot>')));
+  assert.equal(us, '$0', 'a cloud-host costs us a real, measured $0');
+  assert.equal(owner, 'not priced yet');
+});
+
+test('a total sums only priced rows and names how many it left out', () => {
+  const html = costs.ledgerHtml({
+    instances: [
+      row({ slug: 'cp', hosting_shape: 'control-plane', tier: 's-1vcpu-2gb', platform_monthly_usd: 12, owner_monthly_usd: 0 }),
+      row({ slug: 'priced', tier: 'starter+basic-256mb', owner_monthly_usd: 13 }),
+      row({ slug: 'bare', owner_monthly_usd: null }),
+    ],
+    totals: { platform: { monthly_usd: 12, unpriced: 0 }, owner: { monthly_usd: 13, unpriced: 1 } },
+  });
+  const [us, owner] = cells(foot(html));
+  assert.equal(us, '$12');
+  assert.equal(owner, '$13 + 1 not priced', 'the null row is counted, not summed');
+});
+
+test('a column with NOTHING priced has no total — the sum of no prices is not $0', () => {
+  const html = costs.ledgerHtml({
+    instances: [row({ slug: 'a' }), row({ slug: 'b' })],
+    totals: { platform: { monthly_usd: 0, unpriced: 0 }, owner: { monthly_usd: 0, unpriced: 2 } },
+  });
+  const [us, owner] = cells(foot(html));
+  assert.equal(us, '$0', 'every row prices at a real $0 for us');
+  assert.equal(owner, 'not priced yet', 'the owner total is not printed as $0');
+});
+
+test('the harness fixture reads as live does today: our box priced, every owner bill but ours unpriced', () => {
+  const [us, owner] = cells(foot(costs.ledgerHtml(FIXTURE)));
+  assert.equal(us, '$12');
+  assert.equal(owner, '$0 + 2 not priced, 1 not visible');
+});
+
+test('the total says what its cells say: a self-hosted bill is "not visible", not "not priced"', () => {
+  const byo = (slug) => row({ slug, hosting_shape: 'byo-host' });
+  const mixed = costs.ledgerHtml({
+    instances: [row({ slug: 'p', tier: 'starter+basic-256mb', owner_monthly_usd: 13 }), byo('a'), byo('b')],
+    totals: { platform: { monthly_usd: 0, unpriced: 0 }, owner: { monthly_usd: 13, unpriced: 2 } },
+  });
+  assert.equal(cells(foot(mixed))[1], '$13 + 2 not visible');
+  const allByo = costs.ledgerHtml({ instances: [byo('a'), byo('b')], totals: { platform: { monthly_usd: 0, unpriced: 0 }, owner: { monthly_usd: 0, unpriced: 2 } } });
+  assert.equal(cells(foot(allByo))[1], 'not visible to us');
+});
+
+test('a self-hosted owner\'s bill is not ours to see — a different absence from an unrecorded plan', () => {
+  const html = costs.ledgerHtml({ instances: [row({ hosting_shape: 'byo-host' })], totals: { platform: { monthly_usd: 0, unpriced: 0 }, owner: { monthly_usd: 0, unpriced: 1 } } });
+  assert.equal(cells(html)[5], 'not visible to us');
+  assert.equal(cells(html)[2], 'Self-hosted');
+});
+
+test('every row of the fixture is listed, a missing plan says so, and row text is escaped', () => {
+  const html = costs.ledgerHtml(FIXTURE);
+  for (const r of FIXTURE.instances) assert.ok(html.includes(`>${r.slug}<`), `${r.slug} is a row`);
+  assert.match(html, /none recorded/);
+  const hostile = costs.ledgerHtml({ instances: [row({ slug: '<img src=x onerror=1>', owner: '"q"' })], totals: {} });
+  assert.doesNotMatch(hostile, /<img/);
+  assert.match(hostile, /&lt;img src=x onerror=1&gt;/);
+});
+
+test('no projects renders a sentence, not an empty table', () => {
+  assert.match(costs.ledgerHtml({ instances: [], totals: {} }), /No projects are hosted here yet/);
+  assert.match(costs.ledgerHtml(null), /No projects are hosted here yet/);
+});
+
+// ── the page: its wiring and its gate ────────────────────────────────────────
+test('the page loads the builders before its chrome and reads the ledger route', () => {
+  const html = read(path.join(HALL, 'fleet.html'));
+  assert.ok(html.indexOf('fleet-costs.js') !== -1 && html.indexOf('fleet-costs.js') < html.indexOf('/fleet.js'), 'fleet-costs.js loads first');
+  const js = read(path.join(HALL, 'fleet.js'));
+  assert.match(js, /\/provisioning\/fleet\/cost-ledger/);
+  assert.match(js, /status === 403[\s\S]{0,200}fl-sealed/, 'a refusal shows the sealed state');
+});
+
+test('the page gate is the atom the ledger route checks, and the nav mirrors its floor', () => {
+  const route = read(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'));
+  assert.match(route, /router\.get\('\/provisioning\/fleet\/cost-ledger', auth\.requireBuilder, auth\.requirePermission\('provisioning\.fleet\.manage'\)/);
+  assert.match(read(path.join(ROOT, 'src', 'bongos', 'auth.js')), /requireFleetPage: Object\.freeze\(\{ permission: 'provisioning\.fleet\.manage'/);
+  // The nav is cosmetic (the page gate is the wall); 'government' is the metic floor.
+  const { byKey } = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+  assert.equal(byKey('provisioning.fleet.manage').floor, 'metic');
+  assert.match(read(path.join(HALL, 'shell.js')), /href: '\/fleet', gate: 'government', module: 'provisioning'/);
+});
+
+// ── the owner's line on their own project page ───────────────────────────────
+const HUB = read(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'));
+function hubFn(name) {
+  const start = HUB.indexOf(`function ${name}(`);
+  assert.ok(start !== -1, `${name} is defined in projects.html`);
+  const end = HUB.indexOf('\n  function ', start + 1);
+  const box = {};
+  vm.runInNewContext(`${HUB.slice(start, end)}\nbox.fn = ${name};`, { box });
+  return box.fn;
+}
+
+test('the owner\'s hosting-bill line: a price when the plan is known, "not priced yet" when not', () => {
+  const hostingBill = hubFn('hostingBill');
+  assert.equal(hostingBill(null), 'not priced yet');
+  assert.equal(hostingBill(undefined), 'not priced yet');
+  assert.equal(hostingBill(13), '$13/month, estimated. Render bills you directly.');
+  assert.equal(hostingBill(12.5), '$12.50/month, estimated. Render bills you directly.');
+});
+
+test('the line is shown only on a live cloud-host — a self-hosted owner\'s bill is theirs', () => {
+  const body = HUB.slice(HUB.indexOf('function renderManage('), HUB.indexOf("$('mMeta').innerHTML", HUB.indexOf('function renderManage(')));
+  assert.match(body, /if \(inst\.hosting_shape === 'cloud-host' && inst\.status !== 'torn_down'\) rows\.push\(\['hosting bill', hostingBill\(inst\.owner_monthly_usd\)\]\);/);
+});
+
+// ── the payload the owner's page reads ───────────────────────────────────────
+const provisioning = require(path.join(ROOT, 'modules', 'provisioning', 'provisioning.js'));
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+let detailRow = null;
+provisioning.getInstanceById = async () => detailRow;
+provisioning.getOpenIntent = async () => null;
+provisioning.getLatestOAuthManifestForInstance = async () => null;
+require(path.join(ROOT, 'modules', 'provisioning', 'catalog-bridge.js')).healInstanceCatalog = async () => {};
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+const express = require('express');
+const app = express();
+app.use((_req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code } });
+  next();
+});
+app.use('/api/bongos', require(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'))());
+const getJson = (url) => new Promise((resolve, reject) => {
+  http.get(url, (res) => { let d = ''; res.on('data', (c) => { d += c; }); res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d || 'null') })); }).on('error', reject);
+});
+
+test('GET /provisioning/instances/:id carries the owner\'s estimate — null until a plan is recorded', async () => {
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  const url = `http://127.0.0.1:${server.address().port}/api/bongos/provisioning/instances/41`;
+  const base = { id: 41, owner_builder_id: 7, slug: 'p', status: 'active', hosting_shape: 'cloud-host', description: 'd' };
+  try {
+    detailRow = { ...base, tier: null };
+    let r = await getJson(url);
+    assert.equal(r.status, 200);
+    assert.ok('owner_monthly_usd' in r.body.instance, 'the field is present');
+    assert.equal(r.body.instance.owner_monthly_usd, null, 'no plan: unpriced, not 0');
+    detailRow = { ...base, tier: 'starter+basic-256mb' };
+    r = await getJson(url);
+    assert.equal(r.body.instance.owner_monthly_usd, 13, 'the ledger\'s own price for the named plan');
+    detailRow = { ...base, owner_builder_id: 8, tier: 'starter+basic-256mb' };
+    r = await getJson(url);
+    assert.equal(r.status, 404, 'another builder\'s project answers nothing');
+  } finally {
+    server.close();
+  }
+});

package/tests/hall_nav.mjs

@@ -287,7 +287,9 @@ test('sidebar groups read by audience, in order', () => {
   // 'deploy' (task 1003159, ADR 0293) is the SECOND archon item, beside 'government':
   // its gate is the `core.pin.move` atom, archon-floor and system:true. It sits with
   // the steering surfaces because that is what it is — the owner's third release gate.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'gate', 'sessions', 'project-settings', 'deploy', 'government']);
+  // 'fleet' (task 1001949) follows it at the metic floor of `provisioning.fleet.manage`:
+  // what each hosted project costs is an operator surface, like the rest of this group.
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'gate', 'sessions', 'project-settings', 'deploy', 'fleet', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {

package/tests/hall_page_gate_map.mjs

@@ -103,6 +103,8 @@ const ORACLE = {
   // its write on purpose: the preview discloses the exact core version the box serves
   // and how far behind it is, which is a vulnerability window.
   '/builders/deploy': 'requireCorePinPage',
+  // The fleet cost page (task 1001949), on the atom its one read checks.
+  '/builders/fleet': 'requireFleetPage',
 
   // Metic+ via the `project.curate` atom — the exact permission GET /scouting
   // checks, so the page can never drift wider than the API it fronts. Its

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '02de48ca2ae07995';
+const SHELL_SHA = 'db45ff41bd9c5fce';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);