@bongos/core 1.19.125 → 1.19.126

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.125",
-  "core_contract": "1.19.125",
-  "source_commit": "669cdd43ff95a6612999a3456ff5b68cdf8ccfd0",
+  "core_version": "1.19.126",
+  "core_contract": "1.19.126",
+  "source_commit": "b56cedc2da8ef6691bd7990c6e3219896694e540",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T23:11:49.244Z",
+  "built_at": "2026-08-15T00:16:09.571Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1569,
-  "tree_sha256": "5310661ece545602d2be2b0c77f859959a02816dded3aeb8c6da211aaef421e9",
+  "tree_sha256": "5703791569f4c26556ad21f0bbcf605faf1b42cfd3631a1ce5f25a05269fd4b4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4167,12 +4167,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9d8c84867fb0a2470c1597ff6932dd8099f69ecbdaeddf1a8a2761d7e7e14cbd"
+      "sha256": "64edc372bb49cd5c30eb5a1d46f54361293de787d1717d2e116f52568ff93f2c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d9d1ace99af356b2d7c958b93d94d14bb144eafdf8c75a0b7dd42ca50727a5a1"
+      "sha256": "c652ffaf3901e4ccc8f64ff9340f7f4f6c418ab738fc52f2b71450083d2a4e97"
     },
     {
       "path": "public-docs/index.html",
@@ -4412,7 +4412,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "368015cca5170dffd39e3fae55c8feca512df12fbb0e8f4daf3758e2aa5cf5f4"
+      "sha256": "a55b4dd516485060edb4f1cd0be5164bd2026d77186d9b19c1f728a64eda9c7b"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4427,7 +4427,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "925e7964f66d59f2df260a611e602bdeafe3f8f3b73d3d16db7bdfa073b4163c"
+      "sha256": "6dcb73054fa58d3b0254f1d82a7f639ed465db2c2fd1e83e26f29b80532047e5"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5757,7 +5757,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7319962aeeada78ddc037f8b3eb24c6ecf42e1edd295ee4edb6cd4e0b3247e66"
+      "sha256": "c64972eb393e195b4f24de3459036423077430a5cf643fd2e3a8da525ab3af56"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6267,7 +6267,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "3a727fd6bf78aa8e61643fea0a9418cd67f97dee8ffc3f620673d715da2fcc38"
+      "sha256": "3689ce2b23d0baedb5a277676e939af712cea8d0cb3c07857e33f36eb12e1233"
     },
     {
       "path": "tests/cost.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.125",
+  "version": "1.19.126",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.125",
+      "version": "1.19.126",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.125",
+  "version": "1.19.126",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -98,6 +98,7 @@
   --ink:#fdeedd; --ink-soft:#dcb693; --ink-faint:#b89272;
   --rule:#5e3521; --rule-soft:#3f2317;
   --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
+  --sea-ink:color-mix(in srgb, var(--sea) 65%, #ffffff);
   --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
   --on-ok:#0b2e18;
   --page-bg:#150c06;
@@ -124,6 +125,7 @@
     --ink:#fdeedd; --ink-soft:#dcb693; --ink-faint:#b89272;
     --rule:#5e3521; --rule-soft:#3f2317;
     --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
+    --sea-ink:color-mix(in srgb, var(--sea) 65%, #ffffff);
     --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
     --on-ok:#0b2e18;
     --page-bg:#150c06;
@@ -154,6 +156,10 @@
   --err-soft:color-mix(in srgb, var(--err) 12%, var(--bg-card));
   --accent-soft:color-mix(in srgb, var(--accent) 15%, var(--bg-card));
   --sea-soft:color-mix(in srgb, var(--sea) 16%, var(--bg-card));
+  /* the strip's STATE-carrying marks (done fill, now ring/pulse) — light uses
+     --sea as-is; dark derives brighter (the --accent-deep pattern) so a pack's
+     light-tuned sea clears WCAG 1.4.11's 3:1 on the near-black card too */
+  --sea-ink:var(--sea);
   --neutral-soft:color-mix(in srgb, var(--ink) 8%, var(--bg-card));
   /* ink-derived so the shadow is a WARM brown on the marigold ground instead of
      the cold navy it used to cast. The dark blocks override it with a plain black
@@ -225,7 +231,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    (.rec) — "live" always says when it was last verified. ── */
 .chip{display:inline-flex;align-items:center;gap:7px;font-size:12px;font-weight:700;letter-spacing:0.3px;border-radius:999px;padding:4px 12px;background:var(--neutral-soft);color:var(--ink-soft);}
 .chip .cdot{width:7px;height:7px;border-radius:50%;background:var(--ink-faint);flex:0 0 auto;}
-.chip .rec{font-weight:600;opacity:0.72;font-size:11.5px;}
+.chip .rec{font-weight:600;font-size:11.5px;}
 .chip.busy{background:var(--accent-soft);color:var(--accent-deep);}
 .chip.busy .cdot{background:var(--accent);animation:chipPulse 1.4s ease-in-out infinite;}
 .chip.live{background:var(--ok-soft);color:var(--ok);}
@@ -297,13 +303,15 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .strip .stages{display:flex;list-style:none;margin-bottom:6px;}
 .strip .stages li{flex:1;display:flex;flex-direction:column;align-items:center;gap:7px;position:relative;}
 .strip .stages li:not(:first-child)::before{content:"";position:absolute;top:11px;right:50%;width:100%;height:3px;border-radius:2px;background:var(--sea-soft);z-index:0;margin-right:12px;}
-.strip .stages li.done:not(:first-child)::before{background:var(--sea);}
+.strip .stages li.done:not(:first-child)::before{background:var(--sea-ink);}
 .strip .sdot{position:relative;z-index:1;width:24px;height:24px;border-radius:50%;border:3px solid var(--sea-soft);background:var(--bg-card);display:flex;align-items:center;justify-content:center;}
-.strip .stages li.done .sdot{border-color:var(--sea);background:var(--sea);}
-.strip .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid #fff;border-bottom:2.5px solid #fff;transform:rotate(-45deg) translate(1px,-1px);}
-.strip .stages li.now .sdot{border-color:var(--sea);}
-.strip .stages li.now .sdot::after{content:"";width:8px;height:8px;border-radius:50%;background:var(--sea);animation:beatPulse 1.2s ease-in-out infinite;}
-@keyframes beatPulse{0%,100%{transform:scale(.7);opacity:.6}50%{transform:scale(1.15);opacity:1}}
+.strip .stages li.done .sdot{border-color:var(--sea-ink);background:var(--sea-ink);}
+/* tick ink is --on-ok, not #fff — dark's bright fills took a white tick to 1.7:1 */
+.strip .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid var(--on-ok);border-bottom:2.5px solid var(--on-ok);transform:rotate(-45deg) translate(1px,-1px);}
+.strip .stages li.now .sdot{border-color:var(--sea-ink);}
+.strip .stages li.now .sdot::after{content:"";width:8px;height:8px;border-radius:50%;background:var(--sea-ink);animation:beatPulse 1.2s ease-in-out infinite;}
+/* scale-only: an opacity trough took the pulse below the 3:1 its token clears */
+@keyframes beatPulse{0%,100%{transform:scale(.7)}50%{transform:scale(1.15)}}
 .strip .slbl{font-size:12px;font-weight:700;color:var(--ink-faint);}
 .strip .stages li.now .slbl,.strip .stages li.done .slbl{color:color-mix(in srgb,var(--sea) 40%,var(--ink));}
 .strip .pnote{text-align:center;font-size:13px;font-weight:600;color:var(--ink-soft);min-height:18px;line-height:1.5;}
@@ -414,8 +422,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* Home LEAVES the hub, so it never takes the current-view pill and a hairline
    sets it apart. Without it the header offered no way back to the landing page
    except the wordmark, which nothing announced as a link. */
-.navrow .navHome{color:var(--glass-ink);opacity:.9;}
-.navrow .navHome:hover{opacity:1;color:var(--chrome-accent);}
+.navrow .navHome{color:var(--glass-ink);}
+.navrow .navHome:hover{color:var(--chrome-accent);}
 .navSep{width:1px;align-self:stretch;margin:4px 3px;background:var(--glass-border);flex:0 0 auto;}
 /* below the mid breakpoint the three groups stack and centre rather than
    fighting for one row — equal flanks only buy a centred nav while it fits */
@@ -440,7 +448,9 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .search svg{width:15px;height:15px;fill:none;stroke:var(--glass-ink);stroke-width:2;flex:0 0 auto;}
 .search input{flex:1;min-width:0;background:none;border:none;outline:none;font-family:var(--font-mono);
   font-size:13px;color:var(--chrome-ink);}
-.search input::placeholder{color:var(--glass-ink);opacity:.75;}
+/* no opacity dim — .75 washed this to 3.87:1, and the .mineBar override
+   inherited the multiply so its own token could never fix it (task 1002751) */
+.search input::placeholder{color:var(--glass-ink);}
 .search .count{font-family:var(--font-mono);font-size:11.5px;color:var(--glass-ink);white-space:nowrap;}
 
 /* the only-mine filter — a real two-state control, not a link: it filters the

package/public-landing/projects.html

@@ -163,7 +163,12 @@ h1[tabindex="-1"]:focus{outline:none;}
    step that can't be performed yet (its prerequisite — usually the domain — is missing) */
 .humanSteps>li.sdone{border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);}
 .humanSteps>li.sdone::before{content:"✓";background:var(--ok);color:var(--on-ok);}
-.humanSteps>li.slocked{opacity:.6;}
+/* locked = muted TOKENS, not subtree opacity — opacity multiplies after the
+   token resolves and took this copy below AA (task 1002751) */
+.humanSteps>li.slocked{border-color:color-mix(in srgb,var(--line) 55%,var(--bg-card));}
+.humanSteps>li.slocked b{color:var(--ink-soft);}
+.humanSteps>li.slocked p{color:var(--ink-faint);}
+.humanSteps>li.slocked::before{color:var(--ink-faint);}
 .humanSteps details{margin-top:10px;}
 .humanSteps summary{cursor:pointer;font-weight:700;font-size:12.5px;color:var(--ink-faint);}
 .humanSteps details p{margin-top:8px;}
@@ -194,16 +199,19 @@ h1[tabindex="-1"]:focus{outline:none;}
   content:"";position:absolute;top:11px;right:50%;width:100%;height:3px;border-radius:2px;
   background:var(--sea-soft);z-index:0;margin-right:12px;
 }
-.prog .stages li.done:not(:first-child)::before{background:var(--sea);}
+/* state marks paint --sea-ink / --on-ok, mirroring cosmos's .strip (task
+   1002751) — raw --sea sat at 3.03:1 in dark and the #fff tick at 1.74:1 on
+   dark's bright --ok */
+.prog .stages li.done:not(:first-child)::before{background:var(--sea-ink);}
 .prog .sdot{
   position:relative;z-index:1;width:24px;height:24px;border-radius:50%;
   border:3px solid var(--sea-soft);background:var(--bg-card);display:flex;align-items:center;justify-content:center;
 }
-.prog .stages li.done .sdot{border-color:var(--sea);background:var(--sea);}
-.prog .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid #fff;border-bottom:2.5px solid #fff;transform:rotate(-45deg) translate(1px,-1px);}
-.prog .stages li.now .sdot{border-color:var(--sea);}
+.prog .stages li.done .sdot{border-color:var(--sea-ink);background:var(--sea-ink);}
+.prog .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid var(--on-ok);border-bottom:2.5px solid var(--on-ok);transform:rotate(-45deg) translate(1px,-1px);}
+.prog .stages li.now .sdot{border-color:var(--sea-ink);}
 .prog .stages li.now .sdot::after{
-  content:"";width:8px;height:8px;border-radius:50%;background:var(--sea);
+  content:"";width:8px;height:8px;border-radius:50%;background:var(--sea-ink);
   animation:beatPulse 1.2s ease-in-out infinite;
 }
 /* idle labels match cosmos's .strip .slbl — the 55% sea mix washed to 4.15:1 in dark */
@@ -229,7 +237,9 @@ h1[tabindex="-1"]:focus{outline:none;}
 
 /* the collapsed address step — a confirmation, not a form (task 1002704) */
 .addrConfirm{border:2px solid color-mix(in srgb,var(--ok) 30%,var(--bg-card));border-radius:18px;padding:18px 20px;background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);margin-bottom:16px;}
-.addrConfirm.optedOut{border-color:var(--line);background:var(--bg);opacity:.75;}
+.addrConfirm.optedOut{border-color:var(--line);background:var(--bg);}
+.addrConfirm.optedOut .addrBig{color:var(--ink-soft);}
+.addrConfirm.optedOut>p{color:var(--ink-faint);}
 .addrBig{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;line-height:1.4;}
 .addrBig code{font-family:var(--font-mono);font-size:15px;background:var(--bg-deep);border-radius:8px;padding:2px 9px;color:var(--accent-deep);word-break:break-all;}
 .addrConfirm>p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.5;margin-top:6px;}

package/src/module-api.js

@@ -677,8 +677,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.123 with no explicit bump. run 31844281033. (task 1002620)
 //   1.19.125 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.124 with no explicit bump. run 31849445746. (task 1002620)
+//   1.19.126 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.125 with no explicit bump. run 31853055269. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.125'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.126'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -165,6 +165,21 @@ const PAIRS = [
   // .chip.busy + the .tbl .pill / .cardRel / builder-badge family: accent-deep
   // ink on the accent-soft tint, both modes
   ['.chip.busy label',                  'var(--accent-deep)',   'var(--accent-soft)',   4.5],
+  // lifecycle strip STATE INDICATORS (task 1002751): non-text at the WCAG
+  // 1.4.11 bar of 3.0. --sea-ink derives brighter in dark exactly the way
+  // --accent-deep does, so a pack's light-tuned sea can't vanish on the dark
+  // card; the done tick takes --on-ok (the ink-on-a-filled-state-dot token).
+  ['strip done/now indicator on card',  'var(--sea-ink)',       CARD,                   3.0],
+  ['strip done fill vs its idle rail',  'var(--sea-ink)',       'var(--sea-soft)',      3.0],
+  ['strip indicator on the strip tint', 'var(--sea-ink)',       'color-mix(in srgb,var(--sea) 8%,var(--bg-card))', 3.0],
+  ['strip done tick on its fill',       'var(--on-ok)',         'var(--sea-ink)',       3.0],
+  ['flowDown done tick on its fill',    'var(--on-ok)',         'var(--ink-faint)',     3.0],
+  ['.steps done/now ring on card',      'var(--accent)',        CARD,                   3.0],
+  ['.steps done vs idle connector',     'var(--accent)',        'var(--line)',          3.0],
+  // the opted-out address card swaps to the page ground (--bg); its muted copy
+  // must still measure (19px/700 headline = large text, 3.0)
+  ['optedOut .addrBig (large) on --bg', 'var(--ink-soft)',      'var(--bg)',            3.0],
+  ['addrOpt warning on --bg',           'var(--warn)',          'var(--bg)',            4.5],
   // lifecycle strip: 12px/700
   ['.strip .slbl idle',                 'var(--ink-faint)',     CARD,                   4.5],
   ['.strip .slbl now/done',             'color-mix(in srgb,var(--sea) 40%,var(--ink))',       CARD, 4.5],
@@ -254,6 +269,81 @@ test('dark blocks never re-point a token at the locked space palette', () => {
   }
 });
 
+// opacity multiplies AFTER the token resolves, so a dimmed subtree's contrast
+// is invisible to every token assertion above (task 1002751: .slocked at .6
+// took 13.5px copy to 3.02:1; .chip .rec at .72 took recency to 3.48:1;
+// .addrConfirm.optedOut at .75 took its note to 3.43:1; a placeholder rule's
+// .75 survived into an override that set only the color, so no token value
+// could ever fix it). Dim with a muted TOKEN so the result stays measured.
+// Known limits, accepted: @keyframes bodies, animation-fill-mode resting
+// values, and JS-set inline opacity are out of static reach — never make an
+// animation or script the resting presenter of text or a state mark.
+const pageSrc = fs
+  .readFileSync(path.join(path.dirname(CSS), '..', 'projects.html'), 'utf8')
+  .replace(/<!--[\s\S]*?-->/g, '')
+  .replace(/\/\*[\s\S]*?\*\//g, '');
+const cssSrc = src.replace(/\/\*[\s\S]*?\*\//g, '');
+const dimsBelowFull = (body) => {
+  const m = body.match(/opacity\s*:\s*([\d.]+%?)/);
+  if (!m) return false;
+  const v = m[1].endsWith('%') ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+  return v < 1;
+};
+
+test('text is never dimmed by subtree opacity', () => {
+  // Two nets. (1) Anywhere in either sheet: a rule that declares BOTH a color
+  // and a sub-1 opacity is dimmed text by construction. (2) The create flow's
+  // known text containers may not carry opacity at all — this also catches
+  // ancestor dims (.createSplit) that net 1 can't see.
+  const offenders = [];
+  for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
+    for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
+      if (/(?:^|[;{\s])color\s*:/.test(m[2]) && dimsBelowFull(m[2])) {
+        offenders.push(`${where}: ${m[1].trim().slice(0, 60)} declares color + opacity<1`);
+      }
+    }
+  }
+  for (const sel of ['\\.humanSteps', '\\.addrConfirm', '\\.prog\\b', '\\.choice', '\\.review', '\\.createSplit', '\\.chip \\.rec']) {
+    for (const text of [cssSrc, pageSrc]) {
+      for (const m of text.matchAll(new RegExp(`${sel}[^{}]*\\{([^}]*)\\}`, 'g'))) {
+        if (dimsBelowFull(m[1])) offenders.push(`text container dimmed: ${m[0].slice(0, 90)}`);
+      }
+    }
+  }
+  assert.deepEqual(offenders, [], `\n  ${offenders.join('\n  ')}\n`);
+});
+
+test('the .prog strip mirrors .strip: state marks are --sea-ink, ticks are --on-ok', () => {
+  // /create's done panel renders the page-local .prog, NOT cosmos's .strip —
+  // a re-point of one and not the other is exactly how the 1.74:1 dark tick
+  // shipped the first time. State-mark rules (done fill/connector, now
+  // ring/pulse, the tick) must use the derived tokens; raw --sea is only legal
+  // as a tint ingredient (color-mix) or the idle -soft rail.
+  const progRules = [...pageSrc.matchAll(/\.prog[^{}]*\{([^}]*)\}/g)];
+  assert.ok(progRules.length >= 5, 'the .prog rules moved out of projects.html — update this test');
+  const bad = [];
+  for (const m of progRules) {
+    const body = m[1];
+    if (/(?:border(?:-\w+)?|background)\s*:\s*var\(\s*--sea\s*\)/.test(body)) {
+      bad.push(`raw --sea state mark: ${m[0].slice(0, 80)}`);
+    }
+    if (/border-(?:left|bottom)\s*:[^;]*#fff\b/i.test(body)) {
+      bad.push(`hardcoded #fff tick: ${m[0].slice(0, 80)}`);
+    }
+  }
+  assert.deepEqual(bad, [], `\n  ${bad.join('\n  ')}\n`);
+});
+
+test('the pulse animation never dims its mark', () => {
+  // beatPulse drives the now-dot in BOTH .strip and .prog. An opacity trough
+  // (the old 0.6) put the pulsing mark below the 3:1 its token clears at rest
+  // — the PAIRS row above would assert a color the pixel never sustains.
+  const kf = cssSrc.match(/@keyframes beatPulse\{([\s\S]*?)\}\s*\}/) ||
+             cssSrc.match(/@keyframes beatPulse\{([^@]*)\}/);
+  assert.ok(kf, '@keyframes beatPulse not found in cosmos.css — update this test');
+  assert.ok(!/opacity\s*:/.test(kf[1]), 'beatPulse dims the now-mark by opacity again');
+});
+
 test('the two dark blocks stay in lockstep', () => {
   // cosmos.css carries dark twice — an explicit data-mode hook and a
   // prefers-color-scheme twin. A change to one and not the other is the