@bongos/core 1.19.106 → 1.19.108

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.106",
-  "core_contract": "1.19.106",
-  "source_commit": "9c4d81635ba2c3b6781454fef02a2b4fd03c313a",
+  "core_version": "1.19.108",
+  "core_contract": "1.19.108",
+  "source_commit": "bafad9a6b64800aa591f105f14a5a67cf39a54d9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T01:02:38.447Z",
+  "built_at": "2026-08-14T13:14:28.346Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 301,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1558,
-  "tree_sha256": "8dc050d8d7110c73665132a52cad7e280ab1b8db7053b35778cd87c03a4d9b6e",
+  "tree_sha256": "7130b0e01712f13175140a4ddc52041177b8f660fab0029699212a445ebf59ad",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4147,12 +4147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5ac251e031cc6f47a48545e288edb4c894b5832a1a27f80c4ff39abf23f17517"
+      "sha256": "f205db41eab8846e667c61aad6739b8194db55326d38562f0e6a674ecb0cd8ce"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ecc9e5581a436fcf4bafb8d8d9d64f688884d0344f7c484e5cfeadace6f4a198"
+      "sha256": "afc15cf17f555b46d2e616cea755061e6d6751e06b582ad9253ff9dc257a203d"
     },
     {
       "path": "public-docs/index.html",
@@ -4392,7 +4392,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "3ae9d1edc18eef49ebdf90d0c20c00defda76bfb393936c4a615720314a2886e"
+      "sha256": "e5bfd01db8cca1cb28c2d5c2382a401a2ee882cb1a219ed5553d578f2e3952b6"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4412,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "e9fd91527dd347041b35701f67fe4b245e99ec0cbe015a98bbae24cb9fcfea52"
+      "sha256": "e6e951af6fc202a2d90accef69e32da7d8a3456b80a6fcdbce469274edb49bce"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5727,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "20c85ad2a6dc6be87060b034fb9aaa10712463f9f12164d836588f8a28cf3caf"
+      "sha256": "309c33b07e1c5391726d8bf73d2c0d595cab3b9624244df0f7cd8fcbe068e3a5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7052,7 +7052,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "005e784feb96676ada71399fae94e7b11c579159cd80a7fac0ba0ac79bda1e5d"
+      "sha256": "092c9d9ffeed7faed34cfb49ffec6de64d86e45a8fda129444345924313b8fd7"
     },
     {
       "path": "tests/module_manifest.mjs",
@@ -7252,7 +7252,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "1671466fb3301b1b549835ff7e7466a1374079a470f58773cdeddbe81ba3b478"
+      "sha256": "6ddec55050ca5864670d02caad6ede76e5e0753afb1e5636036b75d4185e9427"
     },
     {
       "path": "tests/provision.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.106",
+  "version": "1.19.108",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.106",
+      "version": "1.19.108",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.106",
+  "version": "1.19.108",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -259,6 +259,8 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .projects{list-style:none;display:flex;flex-direction:column;gap:18px;}
 .proj{border:2px solid var(--line);border-radius:18px;padding:18px 20px;background:var(--bg-card);display:flex;gap:16px;align-items:flex-start;}
 .proj.gone{opacity:0.78;}
+/* click-to-manage landing glow: the sky's owned orb hands focus to this card */
+.proj.anchored{border-color:var(--accent);box-shadow:0 0 0 3px color-mix(in srgb,var(--accent) 30%,transparent);}
 .projBody{flex:1;min-width:0;}
 .projHead{display:flex;align-items:center;gap:12px;flex-wrap:wrap;}
 .projName{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;}
@@ -503,7 +505,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   border:1px solid color-mix(in srgb,var(--accent) 45%,transparent);}
 :root[data-mode="dark"] .worldOrb[data-rel="builder"] .badge{color:var(--sun-lit);}
 @media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .worldOrb[data-rel="builder"] .badge{color:var(--sun-lit);}}
-.worldOrb .chip{transform:scale(.88);}
+.worldOrb .chip{transform:scale(.88);white-space:nowrap;}
 
 /* what the only-mine filter shows when you are connected to nothing. Not a
    hypothetical — GET /my-projects returns { owned: [], building: [] } for the

package/public-landing/projects.html

@@ -453,6 +453,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale */
     if (v === 'mine' && me) refreshList();
+    /* owned chips refresh on re-entry, never on a timer — C8 keeps the map quiet */
+    if (v === 'map' && me) loadOwnedInstances().then(applyMapFilter);
     /* focus the name field only on a deliberate move into the view — never on
        boot, where it would steal focus from whatever the visitor arrived at */
     if (v === 'new' && focus) $('newName').focus();
@@ -528,6 +530,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   var ORB_GLOWS = ORB_ACCENTS.map(function (t) { return 'color-mix(in srgb,' + t + ' 45%,transparent)'; });
   var catalog = [];
   var mineOrigins = {};   /* normalized host → 'owner' | 'builder' */
+  var ownedInstances = []; /* the viewer's OWN provisioning rows (never torn_down) */
+  var ownedByHost = {};    /* lower(domain) → instance row — the dedupe join */
   /* What the platform's own entry is FOR SEARCH. It is deliberately not pushed
      into `catalog`: the catalog is the federated directory of other instances,
      and a synthetic member of it would flow into accent assignment, orb slots
@@ -562,7 +566,24 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       .forEach(function (p, i) { p._acc = ORB_ACCENTS[i % ORB_ACCENTS.length]; });
   }
   function accentOf(p) { return p._acc || ORB_ACCENTS[0]; }
-  function relOf(p) { return mineOrigins[hostOf(p.origin)] || 'none'; }
+  /* the manage cards' accent rule — one project, one colour, in the sky AND
+     the list. Shared with orbFor(), which used to carry this hash inline. */
+  function slugAccent(slug) {
+    var h = 0, s = String(slug || '');
+    for (var i = 0; i < s.length; i++) h = (h * 31 + s.charCodeAt(i)) >>> 0;
+    return h % ORB_ACCENTS.length;
+  }
+  function relOf(p) {
+    /* an instance the viewer provisioned is a server-resolved authority too —
+       own-scoped by owner_builder_id, no client inference (direction §2
+       principle 5). It outranks a membership row: owning the instance is the
+       stronger claim. The _inst annotation covers owned entries with no
+       domain yet; ownedByHost covers any un-annotated caller. */
+    if (p._inst) return 'owner';
+    var h = hostOf(p.origin);
+    if (ownedByHost[h]) return 'owner';
+    return mineOrigins[h] || 'none';
+  }
   /* The platform's own relationship cannot come from mineOrigins, and not
      because the data is merely missing: platform_identity_project_memberships
      is written ONLY by the server-to-server check-in a FEDERATED instance posts
@@ -594,7 +615,11 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   }
   function matchesMapQuery(p, q) {
     if (!q) return true;
-    return (String(p.name || '') + ' ' + String(p.tagline || '')).toLowerCase().indexOf(q) !== -1;
+    /* an owned entry also answers by slug and address — the same fields the
+       manage view's search reads, so the habit learned there works here */
+    var hay = String(p.name || '') + ' ' + String(p.tagline || '') +
+      (p._inst ? ' ' + String(p._inst.slug || '') + ' ' + String(p._inst.domain || '') : '');
+    return hay.toLowerCase().indexOf(q) !== -1;
   }
 
   function renderOrbs(list) {
@@ -608,24 +633,39 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       var a = document.createElement('a');
       a.className = 'worldOrb';
       a.setAttribute('data-generated', '');
-      a.setAttribute('data-rel', relOf(p));
+      var rel = relOf(p);
+      a.setAttribute('data-rel', rel);
+      var inst = p._inst;
       var href = safeHttpUrl(p.origin);
-      /* The href STAYS, and stays honest, even though a plain click now opens
-         the card instead of following it: it is what makes the orb a real link
-         — focusable, Enter-activatable, and still ctrl/middle-clickable into a
-         new tab. The card is layered over that, not substituted for it. */
-      a.href = href || '#';
-      if (href) { a.target = '_blank'; a.rel = 'noopener'; }
+      if (inst) {
+        /* an OWNED entry — catalog-annotated or owned-only, one code path.
+           Its job is MANAGE (direction §5): same tab, anchored on that
+           project. The public-site door still exists on the manage card; a
+           middle-click lands a fresh tab on the manage view, which is this
+           orb's honest destination. */
+        a.href = '?view=mine';
+        a.setAttribute('data-manage', String(inst.id));
+      } else {
+        /* The href STAYS, and stays honest, even though a plain click now opens
+           the card instead of following it: it is what makes the orb a real link
+           — focusable, Enter-activatable, and still ctrl/middle-clickable into a
+           new tab. The card is layered over that, not substituted for it. */
+        a.href = href || '#';
+        if (href) { a.target = '_blank'; a.rel = 'noopener'; }
+      }
       a.setAttribute('data-origin', String(p.origin || ''));
       a.title = p.tagline || p.name || '';
       a.style.cssText = '--acc:' + accentOf(p) +
         ';--d:' + slot[2] + 'px;left:' + slot[0] + '%;top:' + slot[1] + '%';
-      var rel = relOf(p);
       a.innerHTML =
         (rel === 'owner' ? '<span class="badge">yours</span>' :
          rel === 'builder' ? '<span class="badge">you build here</span>' : '') +
         '<span class="disc"></span>' +
-        '<span class="nm">' + esc(p.name) + '</span>';
+        '<span class="nm">' + esc(p.name) + '</span>' +
+        /* the ONE chip site, deferring to the manage list's vocabulary — so a
+           project can never look alive in the sky and unreachable in the list
+           (C6: two views of one truth) */
+        (inst ? chipFor(inst) : '');
       field.insertBefore(a, hint);
     });
   }
@@ -641,7 +681,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       var rel = relOf(p);
       var pill = rel === 'owner' ? ' <span class="pill">yours</span>'
         : rel === 'builder' ? ' <span class="pill">you build here</span>' : '';
-      return '<tr data-generated data-origin="' + esc(String(p.origin || '')) + '">' +
+      return '<tr data-generated ' + (p._inst ? 'data-manage="' + esc(String(p._inst.id)) + '" ' : '') +
+        'data-origin="' + esc(String(p.origin || '')) + '">' +
         '<td class="colName"><span class="pname"><span class="pdot" style="--acc:' +
           accentOf(p) + '"></span>' +
           '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
@@ -653,10 +694,13 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
            "we could not ask". */
         '<td class="right num">' + (p.builders == null ? '—' : esc(String(p.builders))) + '</td>' +
         '<td class="colTags">' + tagsHtml(p.tags) + '</td>' +
-        /* liveness on a catalog row is NOT probed by this surface. A chip that
-           said "live" here would claim more than anything verified (C6); the
-           verification overlay on owned orbs is its own task. */
-        '<td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>' +
+        /* liveness on a CATALOG row is NOT probed by this surface — a chip
+           saying "live" there would claim more than anything verified (C6).
+           An OWNED row is different: the own-scoped feed answers for it, so
+           it carries chipFor()'s truth, the same chip its orb and its manage
+           card show (task 1002744). */
+        '<td class="right colStatus">' + (p._inst ? chipFor(p._inst)
+          : '<span class="chip calm"><span class="cdot"></span>—</span>') + '</td>' +
         '<td class="colGo">' + (safeHttpUrl(p.origin)
           ? '<a class="btn small ghost" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">Open →</a>'
           : '') + '</td>' +
@@ -667,7 +711,30 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   function applyMapFilter() {
     var onlyMine = $('onlyMine').checked;
     var q = $('mapQ').value.trim().toLowerCase();
-    var list = catalog.filter(function (p) {
+    /* ONE browse list feeds both sub-views (task 1002744): every catalog row
+       is annotated with the viewer's own instance when the hosts join — so a
+       project both featured and owned renders once, marked owned — and owned
+       instances the catalog does not carry are appended as first-class
+       entries. The sky, the table, the search box and the count read the same
+       list and can never disagree about what exists. */
+    var catalogHosts = {};
+    catalog.forEach(function (p) {
+      var h = hostOf(p.origin);
+      catalogHosts[h] = 1;
+      p._inst = ownedByHost[h] || null;
+    });
+    var browse = catalog.slice();
+    ownedInstances.forEach(function (inst) {
+      var h = inst.domain ? hostOf(inst.domain) : '';
+      if (h && catalogHosts[h]) return;   /* annotated onto its catalog row above */
+      browse.push({
+        name: inst.slug, tagline: inst.domain || '',
+        origin: inst.domain ? 'https://' + inst.domain : '',
+        builders: null, tags: null,
+        _inst: inst, _acc: ORB_ACCENTS[slugAccent(inst.slug)]
+      });
+    });
+    var list = browse.filter(function (p) {
       return matchesMapQuery(p, q) && (!onlyMine || relOf(p) !== 'none');
     });
     list.sort(function (x, y) {
@@ -777,16 +844,44 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (!a || !isPlainClick(ev)) return;
     ev.preventDefault();
     if (a.id === 'selfOrb') return openCard(SELF_PROJECT, selfRel(), a);
+    /* an owned orb's job is MANAGE (direction §5) — before the card path */
+    if (a.hasAttribute('data-manage')) return goToManage(a.getAttribute('data-manage'));
     var p = projByOrigin(a.getAttribute('data-origin') || '');
     if (p) openCard(p, relOf(p), a);
   });
 
+  /* ── Click-to-manage (task 1002744): an owned orb opens YOUR side of the hub,
+     anchored on that project's card. The anchor is deferred — setView('mine')
+     triggers an async refreshList(), so the target `[data-inst]` node may not
+     exist yet; render() and refreshList() retry tryAnchor() once it does. ── */
+  var ANCHOR_GLOW_MS = 2200;
+  var pendingAnchor = null;
+  function goToManage(instId) {
+    pendingAnchor = String(instId || '');
+    setView('mine');
+    tryAnchor();   /* the list may already be rendered from an earlier visit */
+  }
+  function tryAnchor() {
+    if (!pendingAnchor) return;
+    var li = document.querySelector('li[data-inst="' + pendingAnchor + '"]');
+    if (!li) return;
+    pendingAnchor = null;
+    /* a search or state filter that hides the target would turn the anchor
+       into a silent no-op — clear them the same way the visitor would */
+    if (li.hidden) $('mineClear').click();
+    li.scrollIntoView({ block: 'center' });
+    li.classList.add('anchored');
+    setTimeout(function () { li.classList.remove('anchored'); }, ANCHOR_GLOW_MS);
+  }
+
   $('mapRows').addEventListener('click', function (ev) {
     /* the row's own "Open →" keeps its job — the card is for the rest of the row */
     if (ev.target.closest && ev.target.closest('a')) return;
     var tr = ev.target.closest && ev.target.closest('tr');
     if (!tr || !isPlainClick(ev)) return;
     if (tr.id === 'selfRow') return openCard(SELF_PROJECT, selfRel(), null);
+    /* an owned row goes to MANAGE, exactly like its orb — two views, one job */
+    if (tr.hasAttribute('data-manage')) return goToManage(tr.getAttribute('data-manage'));
     var p = projByOrigin(tr.getAttribute('data-origin') || '');
     if (p) openCard(p, relOf(p), null);
   });
@@ -846,6 +941,29 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       .catch(function () { mineOrigins = {}; });
   }
 
+  /* The owner-scoped half of the sky (task 1002744). The public catalog
+     cannot answer "is this mine" — /projects/featured is rank:public and
+     varies by nobody — so the map merges the viewer's OWN provisioning rows:
+     GET /provisioning/instances is own-scoped by construction and carries the
+     same last_verified_* overlay the manage list renders. Signed out (401) and
+     a child instance with provisioning off (404) both read as "no owned
+     projects here", never as an error. */
+  function loadOwnedInstances() {
+    if (!me) { ownedInstances = []; ownedByHost = {}; return Promise.resolve(); }
+    return fetch(API + '/provisioning/instances', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : { instances: [] }; })
+      .then(function (d) {
+        /* a torn-down project is filed under "gone" in the manage list — the
+           sky does not float what no longer exists */
+        ownedInstances = (d.instances || []).filter(function (inst) { return inst.status !== 'torn_down'; });
+        ownedByHost = {};
+        ownedInstances.forEach(function (inst) {
+          if (inst.domain) ownedByHost[hostOf(inst.domain)] = inst;
+        });
+      })
+      .catch(function () { ownedInstances = []; ownedByHost = {}; });
+  }
+
   $('onlyMine').addEventListener('change', applyMapFilter);
   $('mapQ').addEventListener('input', applyMapFilter);
   document.querySelectorAll('.tbl th[data-sort]').forEach(function (th) {
@@ -1043,9 +1161,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   /* ── the orb: the gate's project sphere, glow keyed to verification ────── */
 
   function orbFor(inst) {
-    var h = 0, slug = String(inst.slug || '');
-    for (var i = 0; i < slug.length; i++) h = (h * 31 + slug.charCodeAt(i)) >>> 0;
-    var k = h % ORB_ACCENTS.length;
+    var k = slugAccent(inst.slug);
     var cls = 'orb';
     if (inst.status === 'torn_down' || inst.status === 'tearing_down') cls += ' ghost';
     else if (inst.status === 'error' || (inst.status === 'active' && inst.last_verified_up === false)) cls += ' ashen';
@@ -1215,6 +1331,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     });
     recountMine();
     applyMine();
+    tryAnchor();   /* a click-to-manage jump may be waiting on this render */
   }
 
   function msg(id, text, cls) {
@@ -1304,6 +1421,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
         var sameSet = instances.length === known && instances.every(function (i) { return byId[i.id]; });
         if (!sameSet) { render(instances); return; }
         instances.forEach(function (inst) { takeUpdate(inst.id, inst); });
+        tryAnchor();   /* same-set refresh renders no shells — retry here too */
       })
       .catch(function () { /* transient — next tick will try again */ });
   }
@@ -1312,7 +1430,36 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
      while you browsed the sky would be spending requests on nothing */
   function shouldPoll() { return !document.hidden && me && currentView === 'mine'; }
   setInterval(function () { if (shouldPoll()) refreshList(); }, REFRESH_MS);
-  document.addEventListener('visibilitychange', function () { if (shouldPoll()) refreshList(); });
+  document.addEventListener('visibilitychange', function () {
+    if (shouldPoll()) refreshList();
+    /* returning to a MAP tab re-reads the owned overlay once — event-driven,
+       like the mine view's entry refresh, not a timer */
+    if (!document.hidden && me && currentView === 'map') loadOwnedInstances().then(applyMapFilter);
+  });
+
+  /* C6 freshness without C8's cost: once a minute the visible MAP refreshes
+     its owned chips from data already in hand — ZERO requests — so "live ·
+     checked 2m ago" keeps telling the truth and downgrades to live? once the
+     probe ages past FRESH_MS. Chips only: rebuilding every orb and row to
+     re-date a label would be pointless DOM churn. The re-FETCH happens only
+     on view entry and tab return, never on this timer. */
+  function refreshOwnedChips() {
+    var byManageId = {};
+    ownedInstances.forEach(function (inst) { byManageId[String(inst.id)] = inst; });
+    document.querySelectorAll('#view-map [data-manage]').forEach(function (el) {
+      var inst = byManageId[el.getAttribute('data-manage')];
+      var chip = inst && el.querySelector('.chip');
+      if (!chip) return;
+      var wrap = document.createElement('span');
+      wrap.innerHTML = chipFor(inst);
+      chip.replaceWith(wrap.firstChild);
+    });
+  }
+  function mapChipTick() {
+    if (document.hidden || currentView !== 'map' || !ownedInstances.length) return;
+    refreshOwnedChips();
+  }
+  setInterval(mapChipTick, REFRESH_MS);
 
   /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
      SAY exactly what the server said ── */
@@ -1509,7 +1656,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       $('gate').hidden = true;
       $('mine').hidden = false;
       load();
-      return loadMemberships();
+      return Promise.all([loadMemberships(), loadOwnedInstances()]);
     })
     .catch(function (err) {
       me = null;

package/src/module-api.js

@@ -639,8 +639,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.104 with no explicit bump. run 31758526405. (task 1002620)
 //   1.19.106 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.105 with no explicit bump. run 31759315328. (task 1002620)
+//   1.19.107 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.106 with no explicit bump. run 31762781737. (task 1002620)
+//   1.19.108 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.107 with no explicit bump. run 31803763842. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.106'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.108'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module_loader.mjs

@@ -170,16 +170,34 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // then status-ui (R84) + hall-ui (R85) the two web-surface carves; and
   // provisioning (ADR 0111 / task 1942) — a net-new feature module (instance hosting);
   // platform-identity (ADR 0141) the hub IdP; and governance (ADR 0151 / BV1.R94) the
-  // configurable roles/permissions module. All are discovered; none has validation
+  // configurable roles/permissions module; and agents (ADR 0083 / goal 1000038) the
+  // declarative agent registry — the first module to ship default:false, which is
+  // why it is DISCOVERED here (discovery is enablement-independent) while staying
+  // off in enabledModules(). All are discovered; none has validation
   // errors or coreVersion mismatches. Order is the readdir sort.
   //
   // NB this is the CORE package tree: game / art-pipeline / character-anim / demo are
   // instance/content-excluded from the published core (ADR 0098) so they are not
-  // present here — the discovered set is the 17 always-shipped core-domain + feature
+  // present here — the discovered set is the 18 always-shipped core-domain + feature
   // modules below.
+  //
+  // ⚠ ADDING A MODULE? This roster is HARDCODED and you must extend it — otherwise
+  // this test reds and your PR cannot land (task 1002787: the agents manifest hit
+  // exactly this). It stays hardcoded on purpose: unlike the fitness roster check,
+  // which compares two INDEPENDENT disk reads (tests/helpers.mjs onDiskModuleKeys vs
+  // fitness.js discoveredModuleKeys), this assertion pins what the PUBLISHED CORE
+  // ships (ADR 0098 content-exclusion). Deriving it from the same disk the loader
+  // just read would make it tautological — it could no longer catch the loader
+  // silently dropping or duplicating a module, which is the thing it exists to catch.
+  //
+  // ⚠ AND CHECK WHICH TESTS FAIL, NOT HOW MANY FILES. On Windows, origin/main already
+  // fails ~21 test FILES, this one among them (see the dedupeRoots test below — a path
+  // -resolution env issue). A before/after run compared at FILE granularity therefore
+  // reads 21 = 21 and looks clean while a NEW failure hides inside an already-red file.
+  // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'governance', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'governance', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/projects_hub.mjs

@@ -269,6 +269,8 @@ test('the self entry is not pushed into the catalog array', () => {
 test('the count includes the platform when it is shown', () => {
   assert.doesNotMatch(SCRIPT, /mapCount'\)\.textContent = list\.length/,
     'the count must not ignore the self entry it is rendering beside');
+  // owned entries live INSIDE `list` (the merged browse list) — a separate
+  // owned term here meant the table under-rendered what the count claimed
   assert.match(SCRIPT, /var shown = list\.length \+ \(selfShown \? 1 : 0\)/);
 });
 
@@ -541,3 +543,95 @@ test('no anchor in the table ships a placeholder href', () => {
   const generated = (SCRIPT.match(/return '<tr data-generated([\s\S]*?)'<\/tr>';/) || [, ''])[1];
   assert.doesNotMatch(generated, /href="#"/, 'generated rows must not ship placeholders either');
 });
+
+/* ── The owner-scoped sky (task 1002744) ────────────────────────────────────
+   /projects/featured is rank:public, takes _req, and structurally cannot say
+   "this one is yours". The sky's owner half comes from the viewer's OWN
+   provisioning rows instead: GET /provisioning/instances is own-scoped by
+   construction (owner_builder_id = the session's builder) and carries the same
+   last_verified_* overlay the manage list renders — one truth, two views (C6).
+   These pin the shape: merge client-side, dedupe against the catalog, mark
+   owned, chip with the SAME vocabulary, and a plain click goes to MANAGE. ── */
+
+test('the sky learns ownership from the viewer\'s own instances, signed-in only', () => {
+  const fn = (SCRIPT.match(/function loadOwnedInstances\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'loadOwnedInstances() must exist');
+  assert.match(fn, /if \(!me\)/, 'a signed-out visitor sees the catalog exactly as today');
+  assert.match(fn, /provisioning\/instances/, 'the own-scoped feed is the source');
+  assert.match(fn, /torn_down/, 'the sky must not float what no longer exists');
+});
+
+test('a project both featured and owned renders once, marked owned', () => {
+  const fn = (SCRIPT.match(/function relOf\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'relOf() must exist');
+  assert.match(fn, /ownedByHost/,
+    'the ownership join lives in the one predicate both browse views already read');
+  // the "once" itself: the browse merge ANNOTATES the catalog row and skips
+  // appending a duplicate — deleting either half double-renders the project
+  const filter = (SCRIPT.match(/function applyMapFilter\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(filter, 'applyMapFilter() must be extractable');
+  assert.match(filter, /p\._inst = ownedByHost/, 'catalog rows are annotated with the owned instance');
+  assert.match(filter, /if \(h && catalogHosts\[h\]\) return;/, 'an annotated project is never appended twice');
+});
+
+test('owned truth reaches the TABLE too — same list, same chip, same manage job', () => {
+  // the count, the sky and the table read ONE merged browse list; an owned row
+  // carries chipFor()'s truth in Status and routes its click to manage
+  const generated = (SCRIPT.match(/return '<tr data-generated([\s\S]*?)'<\/tr>';/) || [, ''])[1];
+  assert.ok(generated, 'the generated-row template must keep its extractable shape');
+  assert.match(generated, /data-manage/, 'an owned row carries the manage route key');
+  assert.match(generated, /p\._inst \? chipFor\(p\._inst\)/, 'an owned row\'s Status is the overlay truth');
+  assert.match(generated, /chip calm/, 'an unprobed catalog row keeps the honest calm dash');
+  assert.match(SCRIPT, /tr\.hasAttribute\('data-manage'\)\) return goToManage/,
+    'an owned row click goes to manage, exactly like its orb');
+});
+
+test('an owned orb\'s job is manage, not the public site', () => {
+  assert.match(SCRIPT, /'\?view=mine'/, 'the owned href is the manage deep-link, real and middle-clickable');
+  assert.match(SCRIPT, /hasAttribute\('data-manage'\)\) return goToManage/,
+    'a plain click on an owned orb routes to manage before the card path');
+  const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(orbs, 'renderOrbs must be extractable');
+  assert.match(orbs, /data-manage/, 'owned orbs carry the manage route key');
+  // data-inst is the MINE view's card-shell identity; an orb wearing it would
+  // shadow every unqualified [data-inst] lookup renderCard/applyMine make
+  assert.doesNotMatch(orbs, /data-inst/,
+    'the orb route key must not collide with the manage list\'s card identity');
+});
+
+test('the orb chip is the manage list\'s truth, never a second story (C6)', () => {
+  const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
+  // exactly ONE chip site, and it defers to chipFor() — a second site could
+  // hardcode a claim while this assertion still found its token
+  assert.equal((orbs.match(/chipFor\(inst\)/g) || []).length, 1,
+    'renderOrbs must have exactly one chip call site');
+  assert.match(orbs, /\(inst \? chipFor\(inst\) : ''\)/,
+    'the chip is chipFor() or nothing — never a literal class');
+  assert.doesNotMatch(SCRIPT, /chip live[^']*'\s*\+\s*esc\(inst\./,
+    'no instance chip may be literal-classed live — chipMarkup() decides from the overlay');
+});
+
+test('click-to-manage anchors the project and defers until the card exists', () => {
+  assert.match(SCRIPT, /function goToManage/);
+  assert.match(SCRIPT, /pendingAnchor/);
+  assert.match(SCRIPT, /scrollIntoView/);
+  const fn = (SCRIPT.match(/function tryAnchor\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'tryAnchor() must be extractable');
+  assert.match(fn, /mineClear/, 'a filter that hides the anchored card is cleared, not silently no-op\'d');
+});
+
+test('the map does not poll for owned truth — it re-reads on entry (C8)', () => {
+  assert.match(SCRIPT, /function shouldPoll\(\)[\s\S]*?currentView === 'mine'/);
+  assert.match(SCRIPT, /v === 'map' && me\) loadOwnedInstances/,
+    'entering the map refreshes the owned overlay once, never on a timer');
+});
+
+test('the chip-freshness tick spends no requests — it re-renders what it has (C6+C8)', () => {
+  // without this tick "live · checked 2m ago" freezes and outlives FRESH_MS;
+  // with a FETCH in it the map would be polling, which C8 forbids
+  const fn = (SCRIPT.match(/function mapChipTick\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'mapChipTick() must exist');
+  assert.match(fn, /currentView !== 'map'/, 'the tick is map-view-guarded');
+  assert.match(fn, /document\.hidden/, 'and does nothing in a hidden tab');
+  assert.doesNotMatch(fn, /fetch\(/, 'zero requests — the re-fetch belongs to entry and tab return only');
+});