@bongos/core 1.19.1027 → 1.19.1028

package/docs/module-api-changelog.md

@@ -2533,5 +2533,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1025 with no explicit bump. run 36186644421. (task 1002620)
   1.19.1027 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1026 with no explicit bump. run 36187742785. (task 1002620)
+  1.19.1028 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1027 with no explicit bump. run 36188894725. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/builders.js

@@ -1231,9 +1231,12 @@
       if (e.target.closest('#disc-save')) saveDisciplines();
     });
 
-    // V3.R72 (#291): the dev-curve scope toggle (Archon only). Delegated on the
-    // curve body since renderCurveBody replaces the toggle's innerHTML.
-    $('#curve-body')?.addEventListener('click', (e) => {
+    // V3.R72 (#291): the dev-curve scope toggle. Delegated because
+    // renderCurveBody replaces the toggle's innerHTML — and from the whole
+    // Progress section, NOT #curve-body: the controls render into
+    // #curve-scope-note in the section's lede, a sibling of #curve-body, so a
+    // listener there never heard them (task 1004079).
+    $('#analytics-scroll')?.addEventListener('click', (e) => {
       const btn = e.target.closest('.curve__scope-btn[data-scope]');
       if (!btn) return;
       const scope = btn.dataset.scope === 'eco' ? 'eco' : 'self';
@@ -1247,7 +1250,7 @@
     // listener bound to the element itself would not survive the first render.
     // 'change', not 'input' — a keyboard user arrowing through a native select
     // fires input per option, and each one would be a pair of round trips.
-    $('#curve-body')?.addEventListener('change', (e) => {
+    $('#analytics-scroll')?.addEventListener('change', (e) => {
       const sel = e.target.closest('#curve-kind');
       if (!sel) return;
       const kind = sel.value ? sel.value : null;

package/modules/public-landing/public/assets/cosmos.css

@@ -350,6 +350,12 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .btn:disabled{background:color-mix(in srgb,var(--ink) 12%,var(--bg-deep));color:color-mix(in srgb,var(--ink) 40%,var(--bg-deep));box-shadow:none;cursor:not-allowed;transform:none;}
 .btn.ghost{background:transparent;color:var(--ink-soft);box-shadow:none;border:2px solid var(--line);}
 .btn.ghost:hover{border-color:var(--accent);color:var(--accent-deep);}
+/* a disabled ghost button must LOOK disabled — the same .btn:disabled-vs-.btn.ghost
+   specificity tie .btn.danger:disabled fixed below, applied to "Applied" on the
+   map's card (R10, task 1002286: it kept full-strength ghost styling and only the
+   cursor said it was inert, task 1003774). */
+.btn.ghost:disabled{background:transparent;color:color-mix(in srgb,var(--ink) 40%,var(--bg-deep));border-color:color-mix(in srgb,var(--ink) 18%,transparent);box-shadow:none;cursor:not-allowed;transform:none;}
+.btn.ghost:disabled:hover{border-color:color-mix(in srgb,var(--ink) 18%,transparent);color:color-mix(in srgb,var(--ink) 40%,var(--bg-deep));}
 .btn.small{font-size:13.5px;padding:8px 16px;}
 .btn.danger{background:transparent;color:var(--err);box-shadow:none;border:2px solid color-mix(in srgb,var(--err) 35%,transparent);}
 .btn.danger:hover{background:var(--err-soft);border-color:var(--err);}
@@ -1162,6 +1168,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    underlined accent-deep text link (the footer-link grammar) */
 .projCard .cardActions{order:9;display:flex;align-items:center;justify-content:flex-start;gap:22px;flex-wrap:wrap;
   margin:24px 0 0;padding:0 26px;}
+/* the apply outcome sits UNDER the buttons, never beside them (R10, task 1002286 /
+   1003774): flex-basis:100% forces the wrap this row's own flex-wrap already allows,
+   so the message never lands in the gap next to a short "Applied" label. */
+.projCard .cardActions .projMsg{flex-basis:100%;}
 .projCard .cardOpen{display:inline-flex;align-items:center;justify-content:center;min-height:48px;padding:0 30px;
   border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);font-family:var(--font-display);
   font-size:16px;font-weight:500;text-transform:lowercase;text-decoration:none;
@@ -1309,6 +1319,32 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-mine .mineEmpty{font-weight:400;color:var(--ink-soft);}
 #view-mine .linklike,#view-manage .linklike{font-weight:400;color:var(--ink-soft);}
 
+/* ── invitations · projects you build on · join by URL (task 1003774) — the
+   #view-manage .mSec heading voice, without that section's two-column grid
+   (this content is a stacked list, not a label/value pair). ── */
+.mineExtra section{margin-top:30px;padding-top:26px;border-top:1px solid var(--rule-soft);}
+.mineExtra h2{font-family:var(--font-display);font-weight:300;font-size:clamp(20px,2.2vw,24px);letter-spacing:-.02em;line-height:1.15;text-transform:lowercase;color:var(--ink);margin:0 0 14px;}
+.mineRows{list-style:none;display:flex;flex-direction:column;gap:0;margin:0;padding:0;}
+.mineRow{display:flex;align-items:center;justify-content:space-between;gap:16px;padding:14px 0;border-top:1px solid var(--rule-soft);}
+.mineRows .mineRow:first-child{border-top:0;}
+.mineRow__main{min-width:0;flex:1 1 auto;}
+.mineRow__name{font-size:15px;font-weight:500;color:var(--ink);}
+.mineRow__host{display:block;margin-top:2px;font-family:var(--font-mono);font-size:12.5px;color:var(--ink-faint);overflow-wrap:anywhere;}
+.mineRow__hint{margin:2px 0 0;font-size:12.5px;color:var(--ink-faint);}
+.mineRow__actions{display:flex;align-items:center;gap:10px;flex:none;}
+/* a two-button action group (Open project + Decline) has no room beside the
+   name at phone width — drop it to its own line rather than squeeze the name
+   and hint past their box (found by render-check.js at 320px, task 1003774) */
+@media (max-width:480px){
+  .mineRow{flex-wrap:wrap;}
+  .mineRow__actions{flex-basis:100%;justify-content:flex-start;margin-top:8px;}
+}
+.mineJoinRow{display:flex;gap:10px;flex-wrap:wrap;}
+.mineJoinRow input{flex:1 1 260px;min-width:0;min-height:44px;padding:0 16px;font:inherit;font-size:15px;color:var(--ink);background:var(--bg-card);border:1px solid var(--ctl-line);border-radius:var(--radius-pill);}
+.mineJoinRow input::placeholder{color:var(--ink-faint);}
+.mineJoinNote{display:block;width:100%;box-sizing:border-box;margin-top:10px;min-height:64px;padding:12px 16px;font:inherit;font-size:14px;line-height:1.5;color:var(--ink);background:var(--bg-card);border:1px solid var(--ctl-line);border-radius:14px;resize:vertical;}
+.mineJoinNote::placeholder{color:var(--ink-faint);}
+
 /* ── the ledger row: planet · name and chip · the facts · the rail · the
    doors. The planet and the doors are fixed widths; the three middle tracks
    share the rest by ratio with NO content minimum, so every row lays its

package/modules/public-landing/public/projects.html

@@ -655,6 +655,36 @@ summary{min-height:24px;padding:3px 0;}
         </section>
         <ul class="projects" id="projectsList"></ul>
         <p class="finePrint">Buttons here ask the platform to act; each row reports only what was verified, and when. A standup keeps going even with this tab closed.</p>
+
+        <!-- ══ INVITATIONS · PROJECTS YOU BUILD ON · JOIN BY URL (task 1003774) ══
+             Restores what the hall's deleted my-projects.js rendered (task 1003308,
+             ADR 0141 §3). No Accept button — ADR 0335 retired that hub-only flip as
+             a dead end; an invite is a link into the project instead. ══ -->
+        <div class="mineExtra">
+          <section id="mineInvites" hidden aria-labelledby="mineInvitesH">
+            <h2 id="mineInvitesH">Invitations</h2>
+            <ul class="mineRows" id="invitesList"></ul>
+          </section>
+
+          <section aria-labelledby="mineBuildingH">
+            <h2 id="mineBuildingH">Projects you build on</h2>
+            <p class="mineEmpty" id="buildingEmpty" hidden>You’re not building on any other projects yet.</p>
+            <ul class="mineRows" id="buildingList"></ul>
+          </section>
+
+          <section aria-labelledby="mineJoinH">
+            <h2 id="mineJoinH">Join a project</h2>
+            <p class="lede">Paste the project’s address — its owner sees your request in their own queue.</p>
+            <div class="mineJoinRow">
+              <label class="vh" for="joinOrigin">Project address</label>
+              <input id="joinOrigin" type="url" placeholder="https://project.example.com" autocomplete="off">
+              <button id="joinBtn" type="button" class="btn small">Request to join</button>
+            </div>
+            <label class="vh" for="joinNote">Add a note (optional)</label>
+            <textarea id="joinNote" class="mineJoinNote" rows="2" maxlength="400" placeholder="A note for the owner (optional) — what you’d like to work on, who you are."></textarea>
+            <p class="projMsg" id="joinStatus" role="status" aria-live="polite"></p>
+          </section>
+        </div>
       </section>
     </div>
   </div>
@@ -1519,8 +1549,10 @@ summary{min-height:24px;padding:3px 0;}
     $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
       idPart.replace('&', '%26').replace('=', '%3D') + (v === 'new' ? '&repos=1' : '');
     /* the mine view is the only one that polls; it re-reads on entry so a
-       card that changed while you were on the map is not stale */
-    if (v === 'mine' && me) refreshList();
+       card that changed while you were on the map is not stale — including
+       the membership + invitations lists (task 1003774), the same re-read
+       refreshList() already does for owned instances */
+    if (v === 'mine' && me) { refreshList(); loadMemberships(); loadInvites(); }
     /* manage re-reads its project on entry — no timer lives here (C8) */
     if (v === 'manage') loadManage();
     /* owned chips refresh on re-entry, never on a timer — C8 keeps the map quiet */
@@ -2193,30 +2225,24 @@ summary{min-height:24px;padding:3px 0;}
     btn.disabled = true;
     btn.textContent = 'Applying…';
     var msg = $('cardApplyMsg');
-    fetch(API + '/my-projects/join', {
-      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ origin: p.origin }),
-    }).then(function (res) {
-      if (res.status === 401) {
+    postJoinRequest(p.origin, null).then(function (res) {
+      if (res.unauthenticated) {
         btn.textContent = 'Apply to join'; btn.disabled = false;
         if (msg) { msg.className = 'projMsg err'; msg.innerHTML = signInAgain(); }
         return;
       }
-      return jsonOrEmpty(res).then(function (data) {
-        if (res.ok && data && data.status === 'requested') {
-          appliedOrigins[hostOf(p.origin)] = true;
-          btn.textContent = 'Applied';
-          if (msg) { msg.className = 'projMsg ok'; msg.textContent = data.message || 'Requested.'; }
-          return;
-        }
-        btn.textContent = 'Apply to join';
-        btn.disabled = false;
-        var e = apiError(data, res.status);
-        if (msg) {
-          msg.className = 'projMsg' + (res.ok ? '' : ' err');
-          msg.textContent = (res.ok && data && data.message) || e.message || 'Could not reach that project — try again in a moment.';
-        }
-      });
+      if (res.ok && res.data && res.data.status === 'requested') {
+        btn.textContent = 'Applied';
+        if (msg) { msg.className = 'projMsg ok'; msg.textContent = res.data.message || 'Requested.'; }
+        return;
+      }
+      btn.textContent = 'Apply to join';
+      btn.disabled = false;
+      var e = apiError(res.data, res.status);
+      if (msg) {
+        msg.className = 'projMsg' + (res.ok ? '' : ' err');
+        msg.textContent = (res.ok && res.data && res.data.message) || e.message || 'Could not reach that project — try again in a moment.';
+      }
     }).catch(function () {
       btn.textContent = 'Apply to join';
       btn.disabled = false;
@@ -2260,7 +2286,7 @@ summary{min-height:24px;padding:3px 0;}
         (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
       : '') + (hall
       ? '<a class="cardHall" id="cardHall" href="' + esc(hall) + '" target="_blank" rel="noopener">' + HALL_GLYPH + 'Builders\' hall</a>'
-      : '') + applyBtn + (applyBtn ? '<p class="projMsg" id="cardApplyMsg"></p>' : '');
+      : '') + applyBtn + (applyBtn ? '<p class="projMsg" id="cardApplyMsg" role="status" aria-live="polite"></p>' : '');
     var applyEl = $('cardApply');
     if (applyEl && !applyEl.disabled) applyEl.addEventListener('click', function () { submitApply(applyEl, p); });
     closeMenus();
@@ -2512,13 +2538,23 @@ summary{min-height:24px;padding:3px 0;}
      401 (signed out) is not an error here. */
   function loadMemberships() {
     return fetch(API + '/my-projects', { credentials: 'same-origin' })
-      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [], applied: [] }; })
-      .then(function (d) {
+      .then(function (res) {
+        return res.ok
+          ? res.json().then(function (d) { return { ok: true, d: d }; })
+          : { ok: false, d: { owned: [], building: [], applied: [] } };
+      })
+      .then(function (r) {
+        var d = r.d;
         mineOrigins = {};
         appliedOrigins = {};
         (d.owned || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'owner'; });
         (d.building || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'builder'; });
         (d.applied || []).forEach(function (m) { if (m.origin) appliedOrigins[hostOf(m.origin)] = true; });
+        /* only a genuinely successful read may repaint "Projects you build on" —
+           a transient failure resets the map's origin maps (as before) but must
+           not overwrite the list with a false "not building on anything" empty
+           state on every re-entry to this view (task 1003774) */
+        if (r.ok) renderBuildingList(d.building || []);
       })
       .catch(function () { mineOrigins = {}; appliedOrigins = {}; });
   }
@@ -2546,6 +2582,173 @@ summary{min-height:24px;padding:3px 0;}
       .catch(function () { ownedInstances = []; ownedByHost = {}; });
   }
 
+  /* ── invitations / building-on rows + join-by-URL (task 1003774) ──
+     Same row shape for both lists: a name, its host in the mono face, and one
+     action on the right. textContent-only, matching the deleted hall page
+     this restores. */
+  function mineEl(tag, cls) { var e = document.createElement(tag); if (cls) e.className = cls; return e; }
+  function mineRow(p) {
+    var row = mineEl('li', 'mineRow');
+    var main = mineEl('div', 'mineRow__main');
+    var name = mineEl('div', 'mineRow__name');
+    name.textContent = p.name || p.client_id;
+    main.appendChild(name);
+    var host = hostOf(p.origin);
+    if (host) { var h = mineEl('span', 'mineRow__host'); h.textContent = host; main.appendChild(h); }
+    row.appendChild(main);
+    return row;
+  }
+
+  /* the leave/decline shape: disable, POST, drop the row on success, restore
+     the button on failure. `onRemoved` carries whatever else the caller needs
+     after the row is gone (the empty-state flip, the mineOrigins cleanup). */
+  function postThenRemoveRow(url, row, btn, idleLabel, onRemoved) {
+    btn.disabled = true;
+    if (idleLabel) btn.textContent = idleLabel.busy;
+    fetch(url, { method: 'POST', credentials: 'same-origin' })
+      .then(function (r) { return r.ok ? r.json() : Promise.reject(); })
+      .then(function () { row.remove(); if (onRemoved) onRemoved(); })
+      .catch(function () { btn.disabled = false; if (idleLabel) btn.textContent = idleLabel.idle; });
+  }
+
+  function renderBuildingList(rows) {
+    var ul = $('buildingList');
+    ul.textContent = '';
+    (rows || []).forEach(function (m) {
+      var row = mineRow(m);
+      var actions = mineEl('div', 'mineRow__actions');
+      var btn = document.createElement('button');
+      btn.type = 'button';
+      btn.className = 'btn small ghost';
+      btn.textContent = 'Leave';
+      btn.addEventListener('click', function () {
+        postThenRemoveRow(
+          API + '/my-projects/' + encodeURIComponent(m.client_id) + '/leave', row, btn,
+          { busy: 'Leaving…', idle: 'Leave' },
+          /* the map reads mineOrigins for its "you build here" pill and Apply
+             button — clear this project's entry so a leave takes effect there
+             on the next repaint too, not just in this list (task 1003774) */
+          function () {
+            delete mineOrigins[hostOf(m.origin)];
+            if (!ul.children.length) $('buildingEmpty').hidden = false;
+          }
+        );
+      });
+      actions.appendChild(btn);
+      row.appendChild(actions);
+      ul.appendChild(row);
+    });
+    $('buildingEmpty').hidden = !!(rows && rows.length);
+  }
+
+  /* Each invitation renders as a way IN, never an Accept button: the hub's own
+     accept flip never admits anyone to the project's own instance (ADR 0335)
+     — signing in there is what actually accepts it (task 1002969). Decline
+     still works; it only clears the hub's own pending row. */
+  function renderInvitesList(invites) {
+    var section = $('mineInvites');
+    var ul = $('invitesList');
+    ul.textContent = '';
+    if (!invites || !invites.length) { section.hidden = true; return; }
+    invites.forEach(function (inv) {
+      var row = mineRow(inv);
+      var hint = mineEl('p', 'mineRow__hint');
+      hint.textContent = 'Sign in there to accept.';
+      row.querySelector('.mineRow__main').appendChild(hint);
+      var actions = mineEl('div', 'mineRow__actions');
+      var href = safeHttpUrl(inv.origin);
+      if (href) {
+        var open = document.createElement('a');
+        open.className = 'btn small';
+        open.href = href;
+        open.target = '_blank';
+        open.rel = 'noopener';
+        open.textContent = 'Open project →';
+        actions.appendChild(open);
+      }
+      var decline = document.createElement('button');
+      decline.type = 'button';
+      decline.className = 'btn small ghost';
+      decline.textContent = 'Decline';
+      decline.addEventListener('click', function () {
+        postThenRemoveRow(
+          API + '/my-projects/invites/' + encodeURIComponent(inv.client_id) + '/decline', row, decline, null,
+          function () { if (!ul.children.length) section.hidden = true; }
+        );
+      });
+      actions.appendChild(decline);
+      row.appendChild(actions);
+      ul.appendChild(row);
+    });
+    section.hidden = false;
+  }
+
+  function loadInvites() {
+    return fetch(API + '/my-projects/invites', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : { invites: [] }; })
+      .then(function (d) { renderInvitesList(d.invites || []); })
+      .catch(function () { $('mineInvites').hidden = true; });
+  }
+
+  /* the one relay both the map's per-card Apply (submitApply) and the
+     address-typed join field drive — POST /my-projects/join, the 401 case and
+     the 'requested' echo update kept in ONE place (task 1003774). Keys the
+     echo off the server's OWN resolved origin where the response carries one:
+     it need not match what the visitor typed byte-for-byte (a trailing
+     slash, a different case) to be the same project the map's catalog names. */
+  function postJoinRequest(origin, note) {
+    return fetch(API + '/my-projects/join', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(note ? { origin: origin, note: note } : { origin: origin }),
+    }).then(function (res) {
+      if (res.status === 401) return { unauthenticated: true };
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok && data && data.status === 'requested') {
+          appliedOrigins[hostOf((data.project && data.project.origin) || origin)] = true;
+        }
+        return { ok: res.ok, status: res.status, data: data };
+      });
+    });
+  }
+
+  /* Join by URL, with the applicant's own optional note (task 1002330). */
+  $('joinBtn').addEventListener('click', function () {
+    var origin = ($('joinOrigin').value || '').trim();
+    var status = $('joinStatus');
+    if (!origin) { status.className = 'projMsg err'; status.textContent = 'Enter a project’s address.'; return; }
+    /* a bare host ("grove.cloudbongos.com") never resolves — the server's own
+       origin lookup is an exact match against the registered https:// form —
+       and would otherwise surface as the generic "could not reach" message
+       for what is really a typo. Assume https:// rather than making the
+       visitor retype it. */
+    if (!/^https?:\/\//i.test(origin)) origin = 'https://' + origin;
+    var note = ($('joinNote').value || '').trim();
+    var btn = $('joinBtn');
+    btn.disabled = true;
+    status.className = 'projMsg';
+    status.textContent = 'Requesting…';
+    postJoinRequest(origin, note).then(function (res) {
+      btn.disabled = false;
+      if (res.unauthenticated) { status.className = 'projMsg err'; status.innerHTML = signInAgain(); return; }
+      if (res.ok && res.data && res.data.message) {
+        status.className = 'projMsg' + (res.data.status === 'requested' ? ' ok' : '');
+        status.textContent = res.data.message;
+        if (res.data.status === 'requested') {
+          $('joinOrigin').value = '';
+          $('joinNote').value = '';
+        }
+      } else {
+        var e = apiError(res.data, res.status);
+        status.className = 'projMsg err';
+        status.textContent = e.message || 'Could not reach that project — try again in a moment.';
+      }
+    }).catch(function () {
+      btn.disabled = false;
+      status.className = 'projMsg err';
+      status.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    });
+  });
+
   $('onlyMine').addEventListener('change', applyMapFilter);
   $('mapQ').addEventListener('input', applyMapFilter);
   /* ── the sort, off the column head (task 1003356) ──
@@ -7953,7 +8156,7 @@ summary{min-height:24px;padding:3px 0;}
       $('gate').hidden = true;
       $('mine').hidden = false;
       load();
-      return Promise.all([loadMemberships(), loadOwnedInstances()]);
+      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]);
     })
     .catch(function (err) {
       me = null;

package/modules/ui-design/kit/fixtures/my-projects__invites.json

@@ -0,0 +1 @@
+{"invites":[{"client_id":"cb-grove","name":"The Grove","origin":"https://grove.cloudbongos.com","invited_at":"2026-08-01T12:00:00.000Z"}]}

package/modules/ui-design/kit/serve.js

@@ -105,7 +105,7 @@ const FEEDS = {
   '/public/leaderboard': 'leaderboard',
   '/projects/featured': 'featured',
 };
-const AUTHED = { '/my-projects': 'my-projects' };
+const AUTHED = { '/my-projects': 'my-projects', '/my-projects/invites': 'my-projects__invites' };
 const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' } };
 
 // GET /provisioning/starter-bundles as the create wizard's module picker reads it
@@ -295,6 +295,17 @@ const server = http.createServer((req, res) => {
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
     const one = rest.match(/^\/provisioning\/instances\/(\d+)(\/settings)?$/);
     if (one && req.method === 'GET') return AUTH ? instances(res, one[1], !!one[2]) : json(res, 401, UNAUTH);
+    // the hub's own cross-project surface (task 1003774): the requested/leave/
+    // decline receipts a real render or probe of the my-projects block drives,
+    // so those buttons are not stuck picturing only their failure branch.
+    if (rest === '/my-projects/join' && req.method === 'POST') {
+      return AUTH ? readBody(req, (body) => json(res, 200, {
+        ok: true, status: 'requested', project: { name: body.origin || 'a project', origin: body.origin || null },
+        message: 'Requested access. The project’s owner admits new builders; once approved, sign in to enter.',
+      })) : json(res, 401, UNAUTH);
+    }
+    if (/^\/my-projects\/[^/]+\/leave$/.test(rest) && req.method === 'POST') return AUTH ? json(res, 200, { ok: true, left: true }) : json(res, 401, UNAUTH);
+    if (/^\/my-projects\/invites\/[^/]+\/decline$/.test(rest) && req.method === 'POST') return AUTH ? json(res, 200, { ok: true, accepted: false }) : json(res, 401, UNAUTH);
     // the manage flows (task 1003345): every door on a row and on the manage page only ASKS
     // (ADR 0111) — the stub answers each ask with the route's receipt so the probes can drive
     // attach / restart / teardown / revive / join end to end; nothing changes in the fixture

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1027",
+  "version": "1.19.1028",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1027",
+      "version": "1.19.1028",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1027",
+  "version": "1.19.1028",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1027'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1028'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/card_apply_ui.mjs

@@ -52,6 +52,11 @@ const REGION = SCRIPT.slice(START, END);
 for (const fn of ['function cardApplyHtml(', 'function submitApply(']) {
   assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
 }
+// submitApply drives the one join relay the address-typed join field shares
+const RELAY_START = SCRIPT.indexOf('function postJoinRequest(');
+const RELAY_END = SCRIPT.indexOf('\n  }', RELAY_START) + 4;
+assert.ok(RELAY_START > 0 && RELAY_END > RELAY_START, 'postJoinRequest must be findable');
+const RELAY = SCRIPT.slice(RELAY_START, RELAY_END);
 
 function boot({ me = { rank: 'thetes' }, appliedOrigins = {}, answers = [] } = {}) {
   const requests = [];
@@ -93,6 +98,7 @@ function boot({ me = { rank: 'thetes' }, appliedOrigins = {}, answers = [] } = {
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(RELAY, sandbox, { filename: 'projects.html#join-relay' });
   vm.runInContext(REGION, sandbox, { filename: 'projects.html#card-apply' });
 
   const settle = async () => { for (let i = 0; i < 10; i++) await Promise.resolve(); };
@@ -240,6 +246,7 @@ test('loadMemberships reads GET /my-projects\' applied echo into appliedOrigins,
     API: '/api/bongos',
     mineOrigins: {},
     appliedOrigins: {},
+    renderBuildingList: () => {},
     hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase(),
     fetch: () => Promise.resolve({
       ok: true,
@@ -289,7 +296,7 @@ test('a fetch failure clears appliedOrigins too, not just mineOrigins', () => {
 
 test('openCard builds the Apply button from cardApplyHtml and wires its click to submitApply', () => {
   assert.match(SCRIPT, /var applyBtn = cardApplyHtml\(p, rel\);/);
-  assert.match(SCRIPT, /\) \+ applyBtn \+ \(applyBtn \? '<p class="projMsg" id="cardApplyMsg"><\/p>' : ''\);/,
+  assert.match(SCRIPT, /\) \+ applyBtn \+ \(applyBtn \? '<p class="projMsg" id="cardApplyMsg" role="status" aria-live="polite"><\/p>' : ''\);/,
     'the message line only ships when there is a button that could produce one');
   assert.match(SCRIPT, /var applyEl = \$\('cardApply'\);/);
   assert.match(SCRIPT, /if \(applyEl && !applyEl\.disabled\) applyEl\.addEventListener\('click', function \(\) \{ submitApply\(applyEl, p\); \}\);/,

package/tests/curve_controls_delegation.mjs

@@ -0,0 +1,87 @@
+// tests/curve_controls_delegation.mjs — the Standing → Progress controls are
+// actually heard (task 1004079).
+//
+// The bug: the "You / All builders" scope toggle and the "Kind of work" picker
+// are drawn into #curve-scope-note, which sits in the section's lede <p> — a
+// SIBLING of #curve-body, not a child of it. builders.js delegated both
+// listeners from #curve-body, so a click or change on either control bubbled
+// straight past the listener and the Progress tab only ever showed its first
+// view. Every chart still rendered, so nothing looked broken until you pressed
+// a button.
+//
+// What is pinned: whatever element builders.js delegates each curve control
+// from must, in the widget markup hall-widgets.js mounts, be an ANCESTOR of
+// #curve-scope-note (or be the section itself, which contains everything).
+// There is no jsdom in this repo, so containment is checked by a balanced-tag
+// scan over the markup string.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const widgetsSrc = fs.readFileSync(path.join(PUB, 'hall-widgets.js'), 'utf8');
+const buildersSrc = fs.readFileSync(path.join(PUB, 'builders.js'), 'utf8');
+
+const SECTION_ID = 'analytics-scroll';
+
+// The Progress widget's markup: the concatenated string literals of its w() call.
+function progressMarkup() {
+  const start = widgetsSrc.indexOf(`w('${SECTION_ID}'`);
+  assert.ok(start >= 0, `hall-widgets.js no longer registers '${SECTION_ID}'`);
+  const end = widgetsSrc.indexOf("{ view: 'standing'", start);
+  const call = widgetsSrc.slice(start, end);
+  return [...call.matchAll(/'((?:[^'\\]|\\.)*)'/g)].map((m) => m[1]).slice(2).join('');
+}
+
+// True if the element with id=`outer` encloses the element with id=`inner`.
+function encloses(html, outer, inner) {
+  const open = new RegExp(`<([a-z0-9]+)[^>]*\\bid="${outer}"`).exec(html);
+  if (!open) return false;
+  const tag = open[1];
+  const innerAt = html.indexOf(`id="${inner}"`);
+  if (innerAt < open.index) return false;
+  const re = new RegExp(`<(/?)${tag}\\b[^>]*>`, 'g');
+  re.lastIndex = open.index;
+  let depth = 0;
+  for (let m; (m = re.exec(html));) {
+    depth += m[1] ? -1 : 1;
+    if (depth === 0) return innerAt < m.index;
+  }
+  return false;
+}
+
+// The selector each curve-control listener is attached to in builders.js.
+function delegationTarget(marker) {
+  const at = buildersSrc.indexOf(marker);
+  assert.ok(at >= 0, `builders.js no longer handles ${marker}`);
+  const before = buildersSrc.slice(0, at);
+  const all = [...before.matchAll(/\$\('#([\w-]+)'\)\?\.addEventListener\('(click|change)'/g)];
+  assert.ok(all.length, `no delegated listener found before ${marker}`);
+  return all[all.length - 1][1];
+}
+
+test('the controls render into #curve-scope-note, outside #curve-body', () => {
+  // The premise of the bug. If this ever changes the test below still holds,
+  // but the comment above would be describing a layout that no longer exists.
+  const html = progressMarkup();
+  assert.ok(html.includes('id="curve-scope-note"'));
+  assert.equal(encloses(html, 'curve-body', 'curve-scope-note'), false);
+});
+
+for (const [name, marker] of [
+  ['scope toggle (You / All builders)', ".curve__scope-btn[data-scope]"],
+  ['kind-of-work picker', "closest('#curve-kind')"],
+]) {
+  test(`the ${name} listener is delegated from an ancestor of the control`, () => {
+    const html = progressMarkup();
+    const target = delegationTarget(marker);
+    assert.ok(
+      target === SECTION_ID || encloses(html, target, 'curve-scope-note'),
+      `builders.js listens on #${target}, which does not contain #curve-scope-note — the ${name} is never heard`,
+    );
+  });
+}