@bongos/core 1.19.1052 → 1.19.1054

package/modules/hall-ui/public/thinking.html

@@ -13,7 +13,7 @@
        (tests/hall_tokens.mjs: no hall page hardcodes a web-font stylesheet).
        The template carried its own Google Fonts link for the same two faces. -->
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <link rel="stylesheet" href="/builders/thinking.css?v=2026-09-25-sky4">
+  <link rel="stylesheet" href="/builders/thinking.css?v=2026-09-27-split">
 </head>
 <!-- THE SKY (task 1004231 / sky part 3 of 5, goal 1000095; ADR 0331, ADR 0227
      §11). This page is docs/design/mocks/sky/sky.template.html — the prototype
@@ -41,12 +41,13 @@
      <header>: the shell's top bar is the page's one <header>, and in full
      screen it stays in the document as the way back.
 
-     The same markup, sheet and scripts serve THE PROJECT SKY at /goal-map
-     (part 4, task 1004232): that body says data-sky-lens="all", so the boot
-     opens in "the whole project" and the tour hands back to it. The switcher
-     is two doors — "the whole project" leaves for /goal-map from here, and
-     "simple" / "your thinking" leave for here from there. /goal-map keeps the
-     old standalone form: it is not in the hall chrome (yet). -->
+     ONLY YOUR THINKING (task 1004328, owner decision 2026-09-27). The sheet,
+     the seven scripts and the drawing are shared with THE PROJECT SKY at
+     /goal-map; the lenses and the tools are not. This page's switcher is
+     "simple" and "your thinking" and nothing else. "The whole project", the
+     "my ideas" overlay, explore and its start dialog are the project map's
+     and live only in goal-map.html, and nothing here leaves for that page as
+     a lens. -->
 <body data-page="thinking" data-page-title="Your thinking" data-fullscreen-switch>
 
 <div class="app">
@@ -74,15 +75,12 @@
   <div class="lens" role="group" aria-label="Filter" id="lensGroup">
     <button type="button" id="lensSimple" aria-pressed="false">simple</button>
     <button type="button" id="lensMine" aria-pressed="true">your thinking</button>
-    <button type="button" id="lensAll" aria-pressed="false">the whole project</button>
   </div>
   <div class="tools" id="tools">
     <button type="button" class="pill" id="roomBtn" aria-pressed="false" title="The same sky, as a list (L)">list</button>
     <button type="button" class="pill" id="recentBtn" aria-pressed="false" hidden title="Only the thoughts of the last thirty days.">recent</button>
     <button type="button" class="pill" id="claudeBtn" aria-pressed="false" title="Show the thoughts a session filed under your name. Off by default: only what a person filed.">claude layer</button>
     <button type="button" class="pill" id="influenceBtn" aria-pressed="false" title="Only the goals your thoughts touched — everything else fades.">my influence</button>
-    <button type="button" class="pill" id="exploreBtn" aria-pressed="true" hidden title="Explore: the sky reveals itself as you follow routes from where you begin.">explore</button>
-    <button type="button" class="pill" id="ideasBtn" aria-pressed="false" hidden title="Lay your thoughts over the project map.">my ideas</button>
     <button type="button" class="pill" id="rehearse" aria-pressed="false" title="What if: invents removals, dimming and nods — none has happened in the ledger yet — so you can see how the dead would read. Sizes are never invented.">what if</button>
     <button type="button" class="pill icon" id="clockBtn" title="Show or hide the clock" aria-label="Show or hide the clock">◷</button>
     <button type="button" class="pill icon" id="tourBtn" title="How to read the sky (?)" aria-label="How to read the sky">?</button>
@@ -117,13 +115,6 @@
 
 <aside class="panel" id="panel" hidden aria-live="polite"></aside>
 
-<div class="start glass" id="start" hidden role="dialog" aria-label="Where do you begin?">
-  <span class="lbl">explore</span>
-  <h3>Where do you begin?</h3>
-  <p>The sky reveals itself as you go. Pick a well to start in; every route you chart brings the goal at its far end into view.</p>
-  <div class="opts" id="startOpts"></div>
-</div>
-
 <div class="tour glass" id="tour" hidden role="dialog" aria-label="How to read the sky">
   <div class="step"><span class="lbl" id="tourN"></span><span class="dots" id="tourDots"></span></div>
   <h3 id="tourH"></h3>
@@ -150,13 +141,13 @@
 <script src="/builders/shell.js?v=2026-09-27-fullscreen"></script>
 <script src="/builders/palette.js" defer></script>
 
-<script src="/builders/idea-objects.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-data.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-layout.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-draw.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-interaction.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-panel.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-composer.js?v=2026-09-25-sky4"></script>
-<script src="/builders/sky-tour.js?v=2026-09-25-sky4"></script>
+<script src="/builders/idea-objects.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-data.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-layout.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-draw.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-interaction.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-panel.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-composer.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-tour.js?v=2026-09-27-split"></script>
 </body>
 </html>

package/modules/hall-ui/public/thinking.states.json

@@ -15,7 +15,7 @@
     },
     "sky": {
       "auth": true,
-      "_": "The 'your thinking' lens, bare: composer, lenses, tools, legend and the clock.",
+      "_": "The 'your thinking' lens, bare: composer, the two lenses (simple, your thinking), tools, legend and the clock.",
       "actions": [["wait", 1200], ["clickIfVisible", "#tourSkip"], ["wait", 300]],
       "expect": { "visible": ["#sky", "#composerWrap"] }
     },

package/modules/hall-ui/records/sky.md

@@ -30,3 +30,14 @@ Pinned by `tests/hall_sky.mjs` (31 cases: the reads, the five objects, the two c
 - **The sky is drawn on a STAGE.** Everything the sky owns lives in `main.sky-stage`, fixed under the top bar and beside the 64px rail (the whole window in full screen, no rail under 768). `contain: layout paint` makes the stage the containing block of every fixed layer, so the template's fixed layout is untouched and simply measures from the stage; its four viewport units became `%` of that box (the same number on `/goal-map`). `SKY.viewport()` gives the canvas its size and the pointer its offset (`S.OX` / `S.OY`), and a `ResizeObserver` re-measures when the switch changes the box without the window resizing.
 - **The sky's palette lives on the stage, not the body, on `/thinking`** — so the chrome around it keeps the hall's own light and dark. `style.css` now loads under `thinking.css`, and the handful of hall rules whose names the template also uses (`.skip`, `.filters`, `.foot`, `:focus-visible`, text inputs, `* { box-sizing }`) are reset under `:where(.sky-stage)` at the same specificity, before the sky's own rules. The sky's global rules are `:where()`-scoped for the same reason, which leaves `/goal-map` byte-for-byte in its old cascade.
 - **Both pages render in both modes now.** The chrome follows the hall theme; the sky's stage is the void in both. The `full` and `full-back` states in both states files (and `full-list` in the sky's) press the switch.
+
+## Two skies, one renderer (task 1004328, BV2.TW21)
+
+**Owner decision 2026-09-27: "Your thinking is only your thinking."** Part 4's "one page, two doors" above is SUPERSEDED: the two pages share the renderer and nothing else. The owner confirmed that "the your projects tab" means the whole-project lens, its switch and the project-map features. What this settled:
+- **The lens and the features separate; the drawing does not.** `thinking.css`, the seven `sky-*.js` files and every draw path stay shared. What each page may be in is `S.lenses` (set once in `sky-data.js` from `data-sky-lens`): `['simple', 'mine']` on `/thinking`, `['all']` on `/goal-map`. `setLens` clamps to it, so nothing — a button, the tour, a jump, the panel's "descend" — can take a page into a lens it lacks, and no button leaves for the other page (`location.assign` is gone from `sky-interaction.js`).
+- **Absent, not hidden.** `/thinking` carries no "the whole project" button, no "my ideas", no "explore" and no "where do you begin" dialog; `/goal-map` carries no switcher at all and none of the ideator's pills (recent, claude layer, my influence). The scripts touch a one-page control through `SKY.hide` / `SKY.press` / `SKY.on`, which do nothing when the element is not there. `thinking.css` gained one rule, `.brand + .tools { margin-left: auto; }`, so `/goal-map`'s tools keep the switcher's push to the right and its top strip reads as before.
+- **Two tours from one list.** Every step in `ALL_STEPS` says which sky it belongs to; `/thinking` walks nine of the template's thirteen (the ideator's steps, the wells and rings, the clock, the composer, simple), `/goal-map` walks eight — the wells, rings, life, routes, settled systems, the clock and explore — opened by one new step, "This is the whole project.", because the template's first step is "This is your sky." and belongs to `/thinking`. The project tour turns explore off for its length and gives it back. Each tour has its own seen key (S.tourKey: sky-tour-seen here, sky-map-tour-seen on the map), so one does not silence the other.
+- **"Descend into the well" stays in its sky.** On `/goal-map` it only flies; on `/thinking` it steps "simple" up to "your thinking" (the one lens there that zooms). The legend drops "unexplored" on `/thinking`, which has no explore.
+- **Kept on both:** the list drawer (the room on `/thinking`, the ledger on `/goal-map`), the clock, the composer, "what if", the panel. Filing a thought from the project map still works; the owner's decision names the lens and the overlay, not the composer.
+
+Pinned by `tests/hall_sky.mjs` (absence of every project-map control, every path into a lens, the nine-step tour never entering "all") and `tests/goal_map_page.mjs` (no switcher, setLens clamped, the eight-step tour with explore off and given back).

package/modules/provisioning/control-plane-guard.js

@@ -40,10 +40,23 @@ const { PublicRefusal } = require('./public-refusal');
 //                  the provisioning module — so its hall is the only one with an
 //                  Upgrade page at all. A preview that cannot run where the button
 //                  lives is not a preview (task 1004125).
+//   settings-apply
+//                — push a SAVED setting into the box's own web.env, then restart
+//                  (task 1004334). It is `restart` plus an in-place edit of the
+//                  settings lines, and nothing else: the runner leg re-reads the
+//                  file, replaces only the vocabulary keys (SETTINGS_VOCAB plus its
+//                  declared companions) and refuses outright if the file cannot be
+//                  read, so it cannot blank a credential, a port or the database
+//                  name. It deletes nothing, provisions nothing and moves no pin.
+//                  Refusing it here protected the box from nothing and left the
+//                  owner's saved settings on the platform's own row unable to reach
+//                  the live site — PATCH …/settings on this row stored 'off' while
+//                  cloudbongos.com kept reading 'strict', and the only remedy was a
+//                  hand edit on a machine the owner cannot reach.
 //
 // Adding to this list is a deliberate edit someone has to argue for. It is pinned
 // by name in tests/core_upgrade_door.mjs so it cannot grow as a side effect.
-const CONTROL_PLANE_ACTIONS = Object.freeze(['core-upgrade', 'core-upgrade-preflight', 'restart']);
+const CONTROL_PLANE_ACTIONS = Object.freeze(['core-upgrade', 'core-upgrade-preflight', 'restart', 'settings-apply']);
 
 /**
  * May this intent action be aimed at an instance of this hosting shape? PURE.

package/modules/provisioning/provisioning.js

@@ -104,8 +104,9 @@ const MAX_RELEASED_DOMAINS = 8;
 // excludes 'active' (task 1002691).
 const SETTINGS_APPLY_FROM = new Set(['active']);
 // The hosting shapes the runner has a write path to. 'byo-host' is absent (the owner runs
-// it, we reach into nothing) and so is 'control-plane' (the platform's own row).
-const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host']);
+// it, we reach into nothing). 'control-plane' is the runner's OWN box, admitted by name in
+// control-plane-guard.js (task 1004334) so a setting saved on the platform's row reaches it.
+const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host', 'control-plane']);
 // The ONE state a restart is meaningful from (task 1003238). Liveness is an
 // OVERLAY, not a seventh state — an instance the heartbeat cannot reach is still
 // 'active', and 'active' is exactly where a restart applies. Every earlier state
@@ -115,8 +116,8 @@ const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host']);
 // SETTINGS_APPLY_FROM: each action declaring its own gate is this module's
 // convention, and the two answer different questions.
 const RESTART_FROM = new Set(['active']);
-// Same reachability rule as the settings push, and the same set for the same reason:
-// the runner can only restart what it runs.
+// Same reachability rule as the settings push (the runner can only restart what it runs),
+// minus 'control-plane': task 1004334 gave the self row a settings push, not a restart door.
 const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host']);
 
 // Per-project settings (task 1003040, goal 1000058): the known keys + their

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1052",
+  "version": "1.19.1054",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1052",
+      "version": "1.19.1054",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1052",
+  "version": "1.19.1054",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7613,5 +7613,17 @@
       "id": "1004327",
       "text": "The studio and Your thinking now sit inside the builders hall like every other page, with the sidebar and the top bar around them. Each has one new button in the top-right corner that goes full screen: the sidebar and top bar"
     }
+  ],
+  "1.19.1053": [
+    {
+      "id": "1004328",
+      "text": "Your thinking and the project map are now two separate pages that share only their drawing. Your thinking keeps just your own views, simple and your thinking, with your own tools: the list, recent, claude layer, my influence,"
+    }
+  ],
+  "1.19.1054": [
+    {
+      "id": "1004334",
+      "text": "The platform can now apply a saved setting to its own site, not just to the projects it hosts. Turning the artist gate off on Cloud Bongos will actually reach cloudbongos.com: the platform updates its own settings file and res"
+    }
   ]
 }

package/scripts/gds/provision-units.js

@@ -304,9 +304,44 @@ function originEnvVarsFor(inst) {
   };
 }
 
-function settingsEnvVarsFor(inst) {
+// `envBody` is the web.env being patched; only the control-plane row reads it (see
+// selfEnvPrefix). Every other shape keeps the provisioned-instance prefix, unchanged.
+function settingsEnvVarsFor(inst, envBody) {
   const { settingsEnvVars } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
-  return settingsEnvVars(inst, provisionedEnvPrefix());
+  const prefix = inst && inst.hosting_shape === 'control-plane' ? selfEnvPrefix({ envBody }) : provisionedEnvPrefix();
+  return settingsEnvVars(inst, prefix);
+}
+
+// The env-var prefix the CONTROL PLANE's own web process resolves (task 1004334). The
+// self row is not a provisioned instance: it loads the pack src/branding.js loads, from
+// ITS instance root, so provisionedEnvPrefix() (the neutral pack's floor) is the wrong
+// question — a value written under a prefix the site does not resolve is read by
+// nothing, and the push would report success over a site that never changed.
+//
+// Precedence mirrors loadBranding: the instance pack is a <PREFIX>_BRANDING_FILE line in
+// the web.env being patched (the file the web service actually boots with) when there is
+// one, else <instanceRoot>/config/branding.json; under it sits the core's neutral pack,
+// then the fallback. The first that names an envPrefix wins. A wrong answer is not silent: the
+// leg's read-back (settingsConsumed) compares the live manifest after the restart and
+// records "still reports the OLD values".
+function selfEnvPrefix({ envBody = '', instanceRoot, readFile = (p) => fs.readFileSync(p, 'utf8') } = {}) {
+  const { FALLBACK_ENV_PREFIX, LEGACY_ENV_PREFIXES } = require('../../src/instance-config');
+  const root = instanceRoot || require('./provision-repo.js').selfInstanceRoot(); // eslint-disable-line global-require
+  const names = [FALLBACK_ENV_PREFIX, ...LEGACY_ENV_PREFIXES].map((p) => `${p}_BRANDING_FILE`);
+  const override = String(envBody || '').split(/\r?\n/)
+    .map((l) => /^([A-Z]+_BRANDING_FILE)=(.*)$/.exec(l.trim()))
+    .find((m) => m && names.includes(m[1]) && m[2].trim());
+  const candidates = [
+    override ? path.resolve(root, override[2].trim()) : path.join(root, 'config', 'branding.json'),
+    path.join(REPO_ROOT, ENV_PREFIX_PACK),
+  ];
+  for (const p of candidates) {
+    try {
+      const pack = JSON.parse(readFile(p));
+      if (pack && typeof pack.envPrefix === 'string' && pack.envPrefix) return pack.envPrefix;
+    } catch { /* absent or unreadable — the next candidate answers */ }
+  }
+  return FALLBACK_ENV_PREFIX;
 }
 
 // The instance's own public manifest — the settings read-back ADR 0190 names
@@ -375,6 +410,7 @@ module.exports = {
   instanceManifestCmd,
   originEnvVarsFor,
   provisionedEnvPrefix,
+  selfEnvPrefix,
   serviceUnit,
   serviceUnitPath,
   settingsConsumed,

package/scripts/gds/provision.js

@@ -875,12 +875,12 @@ async function domainAttachInstance(inst, deps) {
 // ---------------------------------------------------------------------------
 async function settingsApplyInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
-  // Same box routing as domainAttachInstance: a standalone runs control-plane-local.
-  const standalone = inst.hosting_shape === 'cloud-host';
-  const boxExec = standalone ? (deps.controlExec || exec) : exec;
-  const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
+  // A standalone runs control-plane-local; the control plane's own row IS this box (task 1004334).
+  const onControlBox = inst.hosting_shape === 'cloud-host' || inst.hosting_shape === 'control-plane';
+  const boxExec = onControlBox ? (deps.controlExec || exec) : exec;
+  const boxWriteFile = onControlBox ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';
-  const vars = settingsEnvVarsFor(inst);
+  const vars = settingsEnvVarsFor(inst); // the self row's prefix is re-read from the live file at the write
   const shown = Object.entries(vars).map(([k, v]) => `${k}=${v}`).join(' ');
   log(`settings-apply ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status}): ${shown}`);
 
@@ -917,7 +917,7 @@ async function settingsApplyInstance(inst, deps) {
   }
   try {
     log('  [config] patch the settings lines of web.env in place (creds + origins untouched)');
-    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, vars), { mode: 0o600, sudo: true });
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, settingsEnvVarsFor(inst, current)), { mode: 0o600, sudo: true });
     log('  [service] restart so the memoized branding pack re-reads them');
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
   } catch (e) {

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1052'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1054'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -102,18 +102,32 @@ await t('the allow-list is exactly the acts that cannot destroy the box', () =>
   // dry run returns at pre-flight having moved no pin, run no npm and restarted
   // nothing, and the control plane is the only instance whose hall HAS an Upgrade
   // page — so refusing the preview there protected nothing and removed everything.
+  // Widened a second time, by 'settings-apply' (task 1004334), for the reason argued in
+  // the guard's own comment: it is restart plus an in-place edit of the settings lines,
+  // and without it a setting saved on the platform's row could never reach the live site.
   assert.deepEqual([...G.CONTROL_PLANE_ACTIONS].sort(),
-    ['core-upgrade', 'core-upgrade-preflight', 'restart']);
+    ['core-upgrade', 'core-upgrade-preflight', 'restart', 'settings-apply']);
 });
 
 await t('the preview is permitted on the control plane — the one row that can use it', () => {
   assert.equal(G.intentAllowedForShape('core-upgrade-preflight', 'control-plane'), true);
 });
 
+await t('the settings push is permitted on the control plane, and the guard says WHY by name (task 1004334)', () => {
+  assert.equal(G.intentAllowedForShape('settings-apply', 'control-plane'), true);
+  // The argument is part of the edit: an entry added without its reason is exactly the
+  // "grew as a side effect" this pin exists to stop.
+  const src = read('modules', 'provisioning', 'control-plane-guard.js');
+  const reason = src.slice(src.indexOf('//   settings-apply'), src.indexOf('const CONTROL_PLANE_ACTIONS'));
+  assert.ok(reason.length > 0 && src.includes('//   settings-apply'), 'the guard comment carries a settings-apply entry');
+  assert.match(reason, /task 1004334/, 'the reason names the task that argued it');
+  assert.match(reason, /deletes nothing/, 'the reason states the property that makes it safe');
+});
+
 await t('and widening it did NOT let the destructive acts through', () => {
   // The whole risk of arguing one action onto an allow-list is arguing four.
   for (const a of P.INTENT_ACTIONS) {
-    if (['core-upgrade', 'core-upgrade-preflight', 'restart'].includes(a)) continue;
+    if (['core-upgrade', 'core-upgrade-preflight', 'restart', 'settings-apply'].includes(a)) continue;
     assert.equal(G.intentAllowedForShape(a, 'control-plane'), false,
       `'${a}' must still be refused against the box the platform runs on`);
   }

package/tests/goal_map_page.mjs

@@ -20,7 +20,13 @@
 // The REAL goal-map.html markup and the REAL seven sky-*.js files boot in a vm
 // through bootSkyPage (tests/helpers.mjs) — the same helper tests/hall_sky.mjs
 // uses for /thinking, pointed at this page's own file, so a button lost from
-// either door fails its own suite.
+// either page fails its own suite.
+//
+// TWO SKIES, ONE RENDERER (task 1004328, owner decision 2026-09-27). The
+// project sky is the ONLY home of the whole-project lens and its features —
+// explore, "my ideas", the ledger of goals — and it offers no other lens: no
+// switcher, no "simple", no "your thinking", and the ideator's pills
+// (recent, claude layer, my influence) are /thinking's alone.
 //
 // Run:  node tests/goal_map_page.mjs
 import assert from 'node:assert/strict';
@@ -85,45 +91,45 @@ const goal = (p, id) => p.S().goalById.get(String(id));
 
 // ═══ the lens is home ════════════════════════════════════════════════════════
 
-await test('it opens in "the whole project": the brand line, the switcher, the tools and the figures are the project sky\'s', async () => {
+await test('it opens in "the whole project": the brand line, the tools and the figures are the project sky\'s', async () => {
   const p = await boot({ sky: FOUR(), versions: versions(), mine: mine([star()]) });
   assert.ok(p.ready(), 'the page booted');
   const S = p.S();
   assert.equal(S.home, 'all', 'the body says which lens is home');
   assert.equal(S.lens, 'all');
-  assert.equal(p.el('lensAll').getAttribute('aria-pressed'), 'true');
-  assert.equal(p.el('lensMine').getAttribute('aria-pressed'), 'false');
   assert.equal(p.el('lensWord').textContent, '— the whole project');
   assert.equal(p.el('lensWord').parentNode.textContent, 'the sky — the whole project', 'the h1 is the project sky\'s');
   assert.equal(p.el('roomTitle').textContent, 'the ledger');
   assert.equal(p.el('exploreBtn').hidden, false, 'explore is a tool here');
   assert.equal(p.el('ideasBtn').hidden, false, 'so is "my ideas"');
-  assert.equal(p.el('claudeBtn').hidden, true, 'the ideator\'s pills are not');
-  assert.equal(p.el('influenceBtn').hidden, true);
+  for (const id of ['claudeBtn', 'influenceBtn', 'recentBtn']) assert.equal(p.el(id), null, `the ideator's #${id} is not on this page at all`);
   assert.match(p.stats(), /<b>4<\/b> goals · <b>1<\/b> alive · <b>2<\/b> wells · <b>1<\/b> settled · <b>1<\/b> collapsed · <b>1<\/b> routes · <b>13<\/b> tasks/, 'the figures line is the goals\' line');
   const urls = p.requests.map((r) => r.url);
   for (const want of ['/api/bongos/sky', '/api/bongos/sky/mine', '/api/bongos/me', '/api/bongos/inbox/template']) assert.ok(urls.includes(want), `reads ${want}`);
   assert.ok(!urls.some((u) => /goals\/graph/.test(u)), 'the goal map\'s aggregate read is gone — the sky\'s own reads carry the routes');
 });
 
-await test('the same seven files open /thinking in "your thinking" — one page, two doors', async () => {
+await test('the same seven files open /thinking in "your thinking" — one renderer, two skies', async () => {
   const p = bootSkyPage({ page: 'thinking', sky: FOUR(), versions: versions() }); await drain();
   assert.equal(p.S().home, 'mine');
   assert.equal(p.S().lens, 'mine');
   assert.equal(p.el('lensWord').parentNode.textContent, 'your sky — your thinking');
 });
 
-await test('the switcher is two doors: "simple" and "your thinking" leave for /thinking, and "the whole project" stays', async () => {
-  const a = await boot({ sky: FOUR() });
-  a.click('lensSimple');
-  assert.equal(a.navigated, '/thinking');
-  const b = await boot({ sky: FOUR() });
-  b.click('lensMine');
-  assert.equal(b.navigated, '/thinking');
-  const c = await boot({ sky: FOUR() });
-  c.click('lensAll');
-  assert.equal(c.navigated, null, 'already here');
-  assert.equal(c.S().lens, 'all');
+await test('THE WHOLE PROJECT ONLY: no switcher, no "simple", no "your thinking" — and no lens this page lacks is ever entered', async () => {
+  const p = await boot({ sky: FOUR(), versions: versions(), mine: mine([star()]) });
+  const S = p.S(); const SKY = p.SKY();
+  assert.deepEqual(JSON.parse(JSON.stringify(S.lenses)), ['all']);
+  for (const id of ['lensGroup', 'lensSimple', 'lensMine', 'lensAll']) assert.equal(p.el(id), null, `#${id} is not on this page`);
+  const html = read('goal-map.html').replace(/<!--[\s\S]*?-->/g, '');
+  assert.equal(/your thinking|>simple</.test(html), false, 'the page offers neither lens in its markup');
+  assert.equal(/href="[^"]*\/thinking"/.test(html), false, 'and never links to /thinking (the shared sheet is thinking.css, which is not a link to the page)');
+  for (const l of ['mine', 'simple']) { SKY.setLens(l, true); assert.equal(S.lens, 'all', `setLens('${l}') stays in the whole project`); }
+  assert.equal(p.el('lensWord').parentNode.textContent, 'the sky — the whole project');
+  SKY.pick({ kind: 'goal', ref: goal(p, '7') }, false); p.click('descendBtn');
+  assert.equal(S.lens, 'all', 'descending stays on the project map');
+  assert.equal(p.navigated, null, 'nothing leaves for /thinking');
+  assert.ok(/\.brand \+ \.tools \{ margin-left: auto; \}/.test(read('thinking.css')), 'the tools take the switcher\'s push to the right, so the top strip reads as before');
 });
 
 // ═══ the wells ═══════════════════════════════════════════════════════════════
@@ -339,19 +345,37 @@ await test('a band is a version, and clicking one fills the screen with it', asy
 
 // ═══ the tour ════════════════════════════════════════════════════════════════
 
-await test('the tour walks all three lenses here too, and hands the sky back to the whole project', async () => {
-  const p = await boot({ sky: FOUR(), versions: versions() });
+await test('the tour is the project map\'s own eight steps, all in the whole project, with explore off while it runs and given back after', async () => {
+  const p = await boot({ sky: FOUR(), versions: versions(), storage: {} });
+  const S = p.S();
+  assert.deepEqual(S.explore.on, true, 'explore is on before the tour');
+  assert.deepEqual(JSON.parse(JSON.stringify(p.SKY().STEPS.map((s) => s.h))), [
+    'This is the whole project.', 'A goal is a gravity well.', 'A ring is a criterion.', 'An alive well glows.',
+    'Routes run between goals that wait on each other.', 'A settled system is a goal that finished.', 'The sky has a clock.', 'By default, you explore.',
+  ]);
   p.key('?');
   assert.equal(p.el('tour').hidden, false);
-  assert.equal(p.S().lens, 'mine', 'step one is "This is your sky"');
-  for (let n = 0; n < 6; n++) p.click('tourNext');
-  assert.equal(p.S().lens, 'all', 'step seven is the alive well, on the project map');
+  assert.equal(p.el('tourN').textContent, 'how to read the sky · 1 of 8');
+  assert.equal(S.lens, 'all', 'step one is the whole project');
+  assert.equal(S.explore.on, false, 'and the tour sees every well');
+  assert.equal(p.el('start').hidden, true, 'so "where do you begin" waits');
+  const lenses = new Set([S.lens]);
+  for (let n = 0; n < 7; n++) { p.click('tourNext'); lenses.add(S.lens); }
+  assert.deepEqual([...lenses], ['all'], 'no step of this tour leaves the whole project');
+  assert.equal(p.el('tourN').textContent, 'how to read the sky · 8 of 8');
   p.key('Escape');
   assert.equal(p.el('tour').hidden, true);
-  assert.equal(p.S().lens, 'all', 'back to the whole project, not to your thinking');
-  assert.equal(p.el('lensAll').getAttribute('aria-pressed'), 'true');
+  assert.equal(S.lens, 'all', 'back to the whole project');
+  assert.equal(S.explore.on, true, 'explore is given back');
+  assert.equal(p.el('exploreBtn').getAttribute('aria-pressed'), 'true');
   const first = await boot({ sky: FOUR(), tourSeen: false });
   assert.equal(first.timers.pending(), 1, 'a first visit schedules the tour here as well');
+  // The two tours differ, so each keeps its own seen key (task 1004328).
+  const afterThinking = await boot({ sky: FOUR(), tourSeen: false, storage: { 'sky-explore': 'off', 'sky-tour-seen': '4' } });
+  assert.equal(afterThinking.timers.pending(), 1, 'having seen /thinking\'s tour does not mark this one seen');
+  assert.equal(afterThinking.S().tourKey, 'sky-map-tour-seen');
+  const seenHere = await boot({ sky: FOUR(), tourSeen: false, storage: { 'sky-explore': 'off', 'sky-map-tour-seen': '4' } });
+  assert.equal(seenHere.timers.pending(), 0, 'and this one, once seen, stays seen');
 });
 
 // ═══ born of a thought (part 5) ══════════════════════════════════════════════

package/tests/hall_sky.mjs

@@ -20,6 +20,7 @@
 // tests/hall_thinking_room.mjs.
 
 import assert from 'node:assert/strict';
+import * as FS from 'node:fs';
 import { makeRunner, settle, bootSkyPage } from './helpers.mjs';
 
 const { test, summary } = makeRunner();
@@ -367,11 +368,38 @@ await test('the bands come from the versions read: building at the centre, shipp
   for (const f of src) assert.doesNotMatch(fs.readFileSync(path.join('modules/hall-ui/public', f), 'utf8'), /BONGOS-V\d|GDS-V\d|PMS-V\d|CB-V\d/, `${f} names no instance version`);
 });
 
-await test('"the whole project" leaves for the project sky at /goal-map', async () => {
-  const p = await boot({ mine: mine(FIVE()) });
-  p.click('lensAll');
-  assert.equal(p.navigated, '/goal-map');
-  assert.equal(p.S().lens, 'mine', 'this page does not switch — part 4 owns that view');
+// ═══ only your thinking (task 1004328, owner decision 2026-09-27) ═══════════
+// The whole-project lens and the project map's features live only on
+// /goal-map (tests/goal_map_page.mjs). Here they are ABSENT from the markup,
+// not merely hidden, and nothing — a button, the tour, a jump, the panel —
+// takes this sky into "the whole project" or leaves for that page.
+
+await test('ONLY YOUR THINKING: no "the whole project" lens, no "my ideas", no explore — absent from the page, not hidden', async () => {
+  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]), versions: versions() });
+  same(p.S().lenses, ['simple', 'mine']);
+  for (const id of ['lensAll', 'ideasBtn', 'exploreBtn', 'start', 'startOpts']) assert.equal(p.el(id), null, `#${id} is the project map's, not this page's`);
+  for (const id of ['lensSimple', 'lensMine', 'recentBtn', 'claudeBtn', 'influenceBtn', 'rehearse']) assert.ok(p.el(id), `#${id} is your thinking's own tool`);
+  // The markup a person meets — the header comments may explain the split, and do.
+  const html = FS.readFileSync('modules/hall-ui/public/thinking.html', 'utf8').replace(/<!--[\s\S]*?-->/g, '');
+  assert.doesNotMatch(html, /the whole project/, 'the words are gone from the markup too');
+  assert.doesNotMatch(html, /goal-map/, 'and this page never names the project map');
+  assert.doesNotMatch(p.el('legend').innerHTML, /unexplored/, 'the legend does not teach explore, which this sky does not have');
+});
+
+await test('nothing takes /thinking into the whole project: setLens, the panel and the switcher all stay in your sky', async () => {
+  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]), versions: versions() });
+  p.SKY().setLens('all', true);
+  assert.equal(p.S().lens, 'mine', 'a lens this page does not have is never entered');
+  p.click('lensSimple'); assert.equal(p.S().lens, 'simple');
+  p.click('lensMine'); assert.equal(p.S().lens, 'mine');
+  assert.equal(p.navigated, null, 'no lens leaves for another page');
+  p.SKY().pick({ kind: 'goal', ref: p.S().goals[0] }, false);
+  p.click('descendBtn');
+  assert.equal(p.S().lens, 'mine', 'descending into a well stays in your thinking');
+  p.click('lensSimple'); p.SKY().pick({ kind: 'goal', ref: p.S().goals[0] }, false); p.click('descendBtn');
+  assert.equal(p.S().lens, 'mine', 'from "simple", descending steps up to your thinking — the one lens here that zooms');
+  const src = FS.readFileSync('modules/hall-ui/public/sky-interaction.js', 'utf8');
+  assert.doesNotMatch(src, /location\.assign|'\/goal-map'|'\/thinking'/, 'the switcher has no door to the other page');
 });
 
 // ═══ the words are never markup ══════════════════════════════════════════════
@@ -392,25 +420,34 @@ await test('a title never becomes markup — in the drawer, the panel and the ho
 
 // ═══ the tour, the lenses and the keys ═══════════════════════════════════════
 
-await test('the tour is the template\'s thirteen steps — ? opens it, Escape closes it', async () => {
+await test('the tour is your thinking\'s nine of the template\'s thirteen steps, in order and never in the whole project — ? opens it, Escape closes it', async () => {
   const p = await boot({ mine: mine(FIVE()), sky: sky([well()]), versions: versions() });
-  const STEPS = p.SKY().STEPS;
-  assert.equal(STEPS.length, 13);
-  same(STEPS.map((s) => s.h), [
+  // The template's thirteen are all still in the list; the four the project map owns are /goal-map's (task 1004328).
+  const template = [
     'This is your sky.', 'A goal is a gravity well.', 'A ring is a criterion.', 'A burning thought is a star.', 'Some thoughts became the structure.',
     'Unclaimed thoughts drift.', 'An alive well glows.', 'Routes run between goals that wait on each other.', 'A settled system is a goal that finished.',
     'The sky has a clock.', 'By default, you explore.', 'Release a thought here.', 'When it is too much, go simple.',
+  ];
+  same(p.SKY().ALL_STEPS.map((s) => s.h).filter((h) => template.includes(h)), template, 'every template step survives, in its order');
+  const STEPS = p.SKY().STEPS;
+  assert.equal(STEPS.length, 9);
+  same(STEPS.map((s) => s.h), [
+    'This is your sky.', 'A goal is a gravity well.', 'A ring is a criterion.', 'A burning thought is a star.', 'Some thoughts became the structure.',
+    'Unclaimed thoughts drift.', 'The sky has a clock.', 'Release a thought here.', 'When it is too much, go simple.',
   ]);
   assert.equal(p.el('tour').hidden, true);
   p.key('?');
   assert.equal(p.el('tour').hidden, false);
-  assert.equal(p.el('tourN').textContent, 'how to read the sky · 1 of 13');
-  for (let n = 0; n < 12; n++) p.click('tourNext');
-  assert.equal(p.el('tourN').textContent, 'how to read the sky · 13 of 13');
+  assert.equal(p.el('tourN').textContent, 'how to read the sky · 1 of 9');
+  const lenses = new Set([p.S().lens]);
+  for (let n = 0; n < 8; n++) { p.click('tourNext'); lenses.add(p.S().lens); }
+  assert.equal(lenses.has('all'), false, 'no step of this tour enters the whole project');
+  assert.equal(p.el('tourN').textContent, 'how to read the sky · 9 of 9');
   assert.equal(p.el('tourNext').textContent, 'start reading');
   p.key('Escape');
   assert.equal(p.el('tour').hidden, true);
   assert.equal(p.S().lens, 'mine', 'the tour hands the sky back to your thinking');
+  assert.equal(p.navigated, null);
 });
 
 await test('the tour opens by itself on a first visit, and only then', async () => {

package/tests/helpers.mjs

@@ -904,7 +904,8 @@ export function bootSkyPage({
   };
 
   // ── the window ───────────────────────────────────────────────────────────
-  const store = { ...(tourSeen ? { 'sky-tour-seen': '4' } : {}), ...storage };
+  // Each page keeps its own tour-seen key (task 1004328); tourSeen marks both.
+  const store = { ...(tourSeen ? { 'sky-tour-seen': '4', 'sky-map-tour-seen': '4' } : {}), ...storage };
   let raf = null;
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: {} },