@bongos/core 1.19.125 → 1.19.127

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.125",
-  "core_contract": "1.19.125",
-  "source_commit": "669cdd43ff95a6612999a3456ff5b68cdf8ccfd0",
+  "core_version": "1.19.127",
+  "core_contract": "1.19.127",
+  "source_commit": "f4b67a76dc2ad911a7c9257ba4280de4ac7904c7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T23:11:49.244Z",
+  "built_at": "2026-08-15T00:49:23.419Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1569,
-  "tree_sha256": "5310661ece545602d2be2b0c77f859959a02816dded3aeb8c6da211aaef421e9",
+  "tree_sha256": "deedfbf01298656cc039a9d567722f3689778d62d8aacc97a230ac4490a39c7a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2367,7 +2367,7 @@
     {
       "path": "modules/builder-settings/builder-needs.js",
       "mode": "0000644",
-      "sha256": "0b40afc38f91ad053d5ecca380eb35d314a3f104fbe8096d51efeb3de131fc98"
+      "sha256": "3cb7478d9e347147e331f0954a9178a1770918067a678efdb8caef96241dfb5a"
     },
     {
       "path": "modules/builder-settings/db.js",
@@ -4167,12 +4167,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9d8c84867fb0a2470c1597ff6932dd8099f69ecbdaeddf1a8a2761d7e7e14cbd"
+      "sha256": "ecb64df7be6949adcb0d88b5f21ca3014724b598fa1a6d939a3a50d8f9696aa6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d9d1ace99af356b2d7c958b93d94d14bb144eafdf8c75a0b7dd42ca50727a5a1"
+      "sha256": "5be9320e605a4b67ba2d63fa4ab831b99bda91a847c11338fd5e0ed6a65d0779"
     },
     {
       "path": "public-docs/index.html",
@@ -4412,7 +4412,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "368015cca5170dffd39e3fae55c8feca512df12fbb0e8f4daf3758e2aa5cf5f4"
+      "sha256": "a55b4dd516485060edb4f1cd0be5164bd2026d77186d9b19c1f728a64eda9c7b"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4427,7 +4427,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "925e7964f66d59f2df260a611e602bdeafe3f8f3b73d3d16db7bdfa073b4163c"
+      "sha256": "6dcb73054fa58d3b0254f1d82a7f639ed465db2c2fd1e83e26f29b80532047e5"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5527,12 +5527,12 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "fa80ba2c0bb742b83d637280e65965f450bc0387063e65dd06f6bd9171283f23"
+      "sha256": "f31dd847ed641bf49013c345b1f08f9e2794a875dad777de10daeda2a4ae1cf3"
     },
     {
       "path": "src/bongos/db.js",
       "mode": "0000644",
-      "sha256": "64b0efa7c0a251266a8dbc00d43373fb1516fa5c88ba737220c969ec97a2e98b"
+      "sha256": "d3dd606664855a94788751d13ab7fc62ccdc4a8df48f331ec97a5a81a8a6fa96"
     },
     {
       "path": "src/bongos/github-repos.js",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/bongos/routes/me.js",
       "mode": "0000644",
-      "sha256": "e6c9e19a4b644f35da665cc48df21085d9a187e3b694a73af01f3d1b83c620b8"
+      "sha256": "83657d8a2f8e1d81a80324350ddd983baf5346da3f88ce1f41c2211275f34440"
     },
     {
       "path": "src/bongos/routes/modules.js",
@@ -5757,7 +5757,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7319962aeeada78ddc037f8b3eb24c6ecf42e1edd295ee4edb6cd4e0b3247e66"
+      "sha256": "80e087f2181512cfdf51030c27aeb7aaa4235421c4e06c9d7c4a000d418b0d0a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6147,7 +6147,7 @@
     {
       "path": "tests/builder_needs.mjs",
       "mode": "0000644",
-      "sha256": "e3d8c5ac45d59f5d566547e2c406cf44ffa60f1b243afcb222b09eee68f5ee0d"
+      "sha256": "49a8146cbb0ec5def5b48130ed61fdec6e9855f22fe5ad3a09b39ae2cb218ca8"
     },
     {
       "path": "tests/bump_version.mjs",
@@ -6267,7 +6267,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "3a727fd6bf78aa8e61643fea0a9418cd67f97dee8ffc3f620673d715da2fcc38"
+      "sha256": "3689ce2b23d0baedb5a277676e939af712cea8d0cb3c07857e33f36eb12e1233"
     },
     {
       "path": "tests/cost.mjs",

package/modules/builder-settings/builder-needs.js

@@ -90,13 +90,68 @@ function artKeyNeed(ctx) {
 // pure (ctx) => need|null function here — every renderer picks it up for free.
 const NEEDS = [artKeyNeed];
 
+// ---- founding grace (task 1002739 / direction §5.6, idea 1000701) -----------
+//
+// A freshly-provisioned instance used to greet its founding owner with "your
+// free art coverage has ended" — a demand as the payoff moment of the whole
+// create flow. While the founding owner's first days are running, the roster
+// leads with a welcome and every action_needed item is held at 'covered'
+// (listed, honest, but not demanding). First-run is a time window, not a
+// visit-counter: counting the first hall visit would end the grace on the very
+// request that renders it.
+//
+// ctx.isFoundingOwner   — is this builder the instance's first admitted builder?
+// ctx.founderCreatedAt  — that first builder's created_at (≈ the instance's
+//                         birth on a newborn); the window anchors here.
+// ctx.projectName       — branding identity.productName, for the greeting.
+// ctx.nowMs             — injectable clock for tests; defaults to Date.now().
+const FOUNDING_GRACE_DAYS = 7;
+const FOUNDING_GRACE_MS = FOUNDING_GRACE_DAYS * 24 * 60 * 60 * 1000;
+
+function foundingGraceActive(ctx = {}) {
+  if (!ctx.isFoundingOwner || !ctx.founderCreatedAt) return false;
+  const born = new Date(ctx.founderCreatedAt).getTime();
+  if (!Number.isFinite(born)) return false;
+  const now = typeof ctx.nowMs === 'number' ? ctx.nowMs : Date.now();
+  return now - born < FOUNDING_GRACE_MS;
+}
+
+function foundingWelcomeNeed(ctx) {
+  const name = ctx.projectName || 'your project';
+  return {
+    id: 'founding_welcome',
+    title: `Welcome to ${name}`,
+    what: 'Your project is standing, and this hall is where it gets built.',
+    learn_more_url: null,
+    state: 'covered',
+    severity: 'info',
+    message: `You made it — ${name} is up, and this hall is its workshop. ` +
+      'Look around at your own pace; if the platform ever needs something from you, ' +
+      'it will say so here once your first days are behind you.',
+    action: null,
+  };
+}
+
 // Compute the live list for a builder. `ctx` carries everything the need
 // functions read (see each need's doc). Returns:
 //   { items: Need[], action_needed_count, has_action_needed }
 // items is ordered: action_needed first (loudest), then covered, then satisfied,
-// so any renderer that takes "the first one" gets the most urgent.
+// so any renderer that takes "the first one" gets the most urgent. During the
+// founding grace nothing is action_needed, so the welcome (prepended before the
+// stable sort) is what that renderer shows.
 function computeNeeds(ctx = {}) {
-  const items = NEEDS.map((fn) => fn(ctx)).filter(Boolean);
+  const grace = foundingGraceActive(ctx);
+  let items = NEEDS.map((fn) => fn(ctx)).filter(Boolean);
+  if (grace) {
+    items = items.map((n) => n.state !== 'action_needed' ? n : {
+      ...n,
+      state: 'covered',
+      severity: 'info',
+      message: 'Nothing needed from you today — we’ll bring this up once your first days are behind you.',
+      action: null,
+    });
+    items.unshift(foundingWelcomeNeed(ctx));
+  }
   const order = { action_needed: 0, covered: 1, satisfied: 2 };
   items.sort((a, b) => (order[a.state] ?? 9) - (order[b.state] ?? 9));
   const actionNeeded = items.filter((n) => n.state === 'action_needed');
@@ -111,5 +166,7 @@ module.exports = {
   computeNeeds,
   // exported for tests / direct reuse
   artKeyNeed,
+  foundingGraceActive,
+  FOUNDING_GRACE_DAYS,
   SETTINGS_PATH,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.125",
+  "version": "1.19.127",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.125",
+      "version": "1.19.127",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.125",
+  "version": "1.19.127",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -98,6 +98,7 @@
   --ink:#fdeedd; --ink-soft:#dcb693; --ink-faint:#b89272;
   --rule:#5e3521; --rule-soft:#3f2317;
   --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
+  --sea-ink:color-mix(in srgb, var(--sea) 65%, #ffffff);
   --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
   --on-ok:#0b2e18;
   --page-bg:#150c06;
@@ -124,6 +125,7 @@
     --ink:#fdeedd; --ink-soft:#dcb693; --ink-faint:#b89272;
     --rule:#5e3521; --rule-soft:#3f2317;
     --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
+    --sea-ink:color-mix(in srgb, var(--sea) 65%, #ffffff);
     --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
     --on-ok:#0b2e18;
     --page-bg:#150c06;
@@ -154,6 +156,10 @@
   --err-soft:color-mix(in srgb, var(--err) 12%, var(--bg-card));
   --accent-soft:color-mix(in srgb, var(--accent) 15%, var(--bg-card));
   --sea-soft:color-mix(in srgb, var(--sea) 16%, var(--bg-card));
+  /* the strip's STATE-carrying marks (done fill, now ring/pulse) — light uses
+     --sea as-is; dark derives brighter (the --accent-deep pattern) so a pack's
+     light-tuned sea clears WCAG 1.4.11's 3:1 on the near-black card too */
+  --sea-ink:var(--sea);
   --neutral-soft:color-mix(in srgb, var(--ink) 8%, var(--bg-card));
   /* ink-derived so the shadow is a WARM brown on the marigold ground instead of
      the cold navy it used to cast. The dark blocks override it with a plain black
@@ -225,7 +231,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    (.rec) — "live" always says when it was last verified. ── */
 .chip{display:inline-flex;align-items:center;gap:7px;font-size:12px;font-weight:700;letter-spacing:0.3px;border-radius:999px;padding:4px 12px;background:var(--neutral-soft);color:var(--ink-soft);}
 .chip .cdot{width:7px;height:7px;border-radius:50%;background:var(--ink-faint);flex:0 0 auto;}
-.chip .rec{font-weight:600;opacity:0.72;font-size:11.5px;}
+.chip .rec{font-weight:600;font-size:11.5px;}
 .chip.busy{background:var(--accent-soft);color:var(--accent-deep);}
 .chip.busy .cdot{background:var(--accent);animation:chipPulse 1.4s ease-in-out infinite;}
 .chip.live{background:var(--ok-soft);color:var(--ok);}
@@ -297,13 +303,15 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .strip .stages{display:flex;list-style:none;margin-bottom:6px;}
 .strip .stages li{flex:1;display:flex;flex-direction:column;align-items:center;gap:7px;position:relative;}
 .strip .stages li:not(:first-child)::before{content:"";position:absolute;top:11px;right:50%;width:100%;height:3px;border-radius:2px;background:var(--sea-soft);z-index:0;margin-right:12px;}
-.strip .stages li.done:not(:first-child)::before{background:var(--sea);}
+.strip .stages li.done:not(:first-child)::before{background:var(--sea-ink);}
 .strip .sdot{position:relative;z-index:1;width:24px;height:24px;border-radius:50%;border:3px solid var(--sea-soft);background:var(--bg-card);display:flex;align-items:center;justify-content:center;}
-.strip .stages li.done .sdot{border-color:var(--sea);background:var(--sea);}
-.strip .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid #fff;border-bottom:2.5px solid #fff;transform:rotate(-45deg) translate(1px,-1px);}
-.strip .stages li.now .sdot{border-color:var(--sea);}
-.strip .stages li.now .sdot::after{content:"";width:8px;height:8px;border-radius:50%;background:var(--sea);animation:beatPulse 1.2s ease-in-out infinite;}
-@keyframes beatPulse{0%,100%{transform:scale(.7);opacity:.6}50%{transform:scale(1.15);opacity:1}}
+.strip .stages li.done .sdot{border-color:var(--sea-ink);background:var(--sea-ink);}
+/* tick ink is --on-ok, not #fff — dark's bright fills took a white tick to 1.7:1 */
+.strip .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid var(--on-ok);border-bottom:2.5px solid var(--on-ok);transform:rotate(-45deg) translate(1px,-1px);}
+.strip .stages li.now .sdot{border-color:var(--sea-ink);}
+.strip .stages li.now .sdot::after{content:"";width:8px;height:8px;border-radius:50%;background:var(--sea-ink);animation:beatPulse 1.2s ease-in-out infinite;}
+/* scale-only: an opacity trough took the pulse below the 3:1 its token clears */
+@keyframes beatPulse{0%,100%{transform:scale(.7)}50%{transform:scale(1.15)}}
 .strip .slbl{font-size:12px;font-weight:700;color:var(--ink-faint);}
 .strip .stages li.now .slbl,.strip .stages li.done .slbl{color:color-mix(in srgb,var(--sea) 40%,var(--ink));}
 .strip .pnote{text-align:center;font-size:13px;font-weight:600;color:var(--ink-soft);min-height:18px;line-height:1.5;}
@@ -414,8 +422,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* Home LEAVES the hub, so it never takes the current-view pill and a hairline
    sets it apart. Without it the header offered no way back to the landing page
    except the wordmark, which nothing announced as a link. */
-.navrow .navHome{color:var(--glass-ink);opacity:.9;}
-.navrow .navHome:hover{opacity:1;color:var(--chrome-accent);}
+.navrow .navHome{color:var(--glass-ink);}
+.navrow .navHome:hover{color:var(--chrome-accent);}
 .navSep{width:1px;align-self:stretch;margin:4px 3px;background:var(--glass-border);flex:0 0 auto;}
 /* below the mid breakpoint the three groups stack and centre rather than
    fighting for one row — equal flanks only buy a centred nav while it fits */
@@ -440,7 +448,9 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .search svg{width:15px;height:15px;fill:none;stroke:var(--glass-ink);stroke-width:2;flex:0 0 auto;}
 .search input{flex:1;min-width:0;background:none;border:none;outline:none;font-family:var(--font-mono);
   font-size:13px;color:var(--chrome-ink);}
-.search input::placeholder{color:var(--glass-ink);opacity:.75;}
+/* no opacity dim — .75 washed this to 3.87:1, and the .mineBar override
+   inherited the multiply so its own token could never fix it (task 1002751) */
+.search input::placeholder{color:var(--glass-ink);}
 .search .count{font-family:var(--font-mono);font-size:11.5px;color:var(--glass-ink);white-space:nowrap;}
 
 /* the only-mine filter — a real two-state control, not a link: it filters the

package/public-landing/projects.html

@@ -163,7 +163,12 @@ h1[tabindex="-1"]:focus{outline:none;}
    step that can't be performed yet (its prerequisite — usually the domain — is missing) */
 .humanSteps>li.sdone{border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);}
 .humanSteps>li.sdone::before{content:"✓";background:var(--ok);color:var(--on-ok);}
-.humanSteps>li.slocked{opacity:.6;}
+/* locked = muted TOKENS, not subtree opacity — opacity multiplies after the
+   token resolves and took this copy below AA (task 1002751) */
+.humanSteps>li.slocked{border-color:color-mix(in srgb,var(--line) 55%,var(--bg-card));}
+.humanSteps>li.slocked b{color:var(--ink-soft);}
+.humanSteps>li.slocked p{color:var(--ink-faint);}
+.humanSteps>li.slocked::before{color:var(--ink-faint);}
 .humanSteps details{margin-top:10px;}
 .humanSteps summary{cursor:pointer;font-weight:700;font-size:12.5px;color:var(--ink-faint);}
 .humanSteps details p{margin-top:8px;}
@@ -194,16 +199,19 @@ h1[tabindex="-1"]:focus{outline:none;}
   content:"";position:absolute;top:11px;right:50%;width:100%;height:3px;border-radius:2px;
   background:var(--sea-soft);z-index:0;margin-right:12px;
 }
-.prog .stages li.done:not(:first-child)::before{background:var(--sea);}
+/* state marks paint --sea-ink / --on-ok, mirroring cosmos's .strip (task
+   1002751) — raw --sea sat at 3.03:1 in dark and the #fff tick at 1.74:1 on
+   dark's bright --ok */
+.prog .stages li.done:not(:first-child)::before{background:var(--sea-ink);}
 .prog .sdot{
   position:relative;z-index:1;width:24px;height:24px;border-radius:50%;
   border:3px solid var(--sea-soft);background:var(--bg-card);display:flex;align-items:center;justify-content:center;
 }
-.prog .stages li.done .sdot{border-color:var(--sea);background:var(--sea);}
-.prog .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid #fff;border-bottom:2.5px solid #fff;transform:rotate(-45deg) translate(1px,-1px);}
-.prog .stages li.now .sdot{border-color:var(--sea);}
+.prog .stages li.done .sdot{border-color:var(--sea-ink);background:var(--sea-ink);}
+.prog .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid var(--on-ok);border-bottom:2.5px solid var(--on-ok);transform:rotate(-45deg) translate(1px,-1px);}
+.prog .stages li.now .sdot{border-color:var(--sea-ink);}
 .prog .stages li.now .sdot::after{
-  content:"";width:8px;height:8px;border-radius:50%;background:var(--sea);
+  content:"";width:8px;height:8px;border-radius:50%;background:var(--sea-ink);
   animation:beatPulse 1.2s ease-in-out infinite;
 }
 /* idle labels match cosmos's .strip .slbl — the 55% sea mix washed to 4.15:1 in dark */
@@ -229,7 +237,9 @@ h1[tabindex="-1"]:focus{outline:none;}
 
 /* the collapsed address step — a confirmation, not a form (task 1002704) */
 .addrConfirm{border:2px solid color-mix(in srgb,var(--ok) 30%,var(--bg-card));border-radius:18px;padding:18px 20px;background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);margin-bottom:16px;}
-.addrConfirm.optedOut{border-color:var(--line);background:var(--bg);opacity:.75;}
+.addrConfirm.optedOut{border-color:var(--line);background:var(--bg);}
+.addrConfirm.optedOut .addrBig{color:var(--ink-soft);}
+.addrConfirm.optedOut>p{color:var(--ink-faint);}
 .addrBig{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;line-height:1.4;}
 .addrBig code{font-family:var(--font-mono);font-size:15px;background:var(--bg-deep);border-radius:8px;padding:2px 9px;color:var(--accent-deep);word-break:break-all;}
 .addrConfirm>p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.5;margin-top:6px;}

package/src/bongos/db-kernel.js

@@ -62,6 +62,20 @@ async function getBuilderById(id) {
   return rows[0] ?? null;
 }
 
+// getFoundingBuilder — the instance's first admitted HUMAN builder (task
+// 1002739): the founding owner a newborn instance greets, and the anchor of
+// the builder-needs founding-grace window. system_role IS NULL is load-bearing:
+// core migrations 065/067 seed the BFG + Discord-bot system principals into
+// builders on EVERY instance before anyone can sign in, so the lowest ids on a
+// newborn DB are not the founder. First human row by id, regardless of status —
+// the founder stays the founder even if later deactivated.
+async function getFoundingBuilder() {
+  const { rows } = await pool.query(
+    `SELECT id, created_at FROM builders WHERE system_role IS NULL ORDER BY id ASC LIMIT 1`
+  );
+  return rows[0] ?? null;
+}
+
 // listActiveBuilders — the minimal, any-builder-readable roster (task 1877): an
 // invite-picker needs a real name of every builder to invite, not just the
 // leaderboard's top-100-by-credits window. Deliberately narrow columns — no
@@ -337,6 +351,7 @@ module.exports = {
   withTx,
   sessionPermsSelect,
   getBuilderById,
+  getFoundingBuilder,
   listActiveBuilders,
   insertAuditLog,
   LIVE_RANK_LADDER,

package/src/bongos/db.js

@@ -38,7 +38,7 @@ const seams = require('../module-seams');
 // published doorway resolves through. Re-exported below so every caller is
 // byte-identical; db-kernel depends only on ./pool, never ./db (one-way).
 const {
-  withTx, getBuilderById, listActiveBuilders, insertAuditLog, LIVE_RANK_LADDER,
+  withTx, getBuilderById, getFoundingBuilder, listActiveBuilders, insertAuditLog, LIVE_RANK_LADDER,
   // Auth/identity/admission + the rank vocabulary carved to db-kernel (ADR 0102,
   // finishing ADR 0091 §1). Re-exported below so db.js's other importers + its own
   // internal uses (setBuilderRank's RANKS.indexOf, etc.) stay byte-identical.
@@ -978,6 +978,7 @@ module.exports = {
   upsertBuilder,
   seatFirstAdminIfUnclaimed,
   getBuilderById,
+  getFoundingBuilder,
   listActiveBuilders,
   linkAnthropicAccount,
   getBuilderByGithubId,

package/src/bongos/routes/me.js

@@ -83,7 +83,7 @@ module.exports = function buildMeRouter() {
     const [
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, boxConnected, cliAuthed,
-      behaviorPrefs, geminiKeyRow, needsRebaseTasks,
+      behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -144,6 +144,10 @@ module.exports = function buildMeRouter() {
       // without a follow-up call. Through the `lifecycle` port; [] on a
       // lifecycle-less instance (guarded — the port is resolveOptional).
       lc() ? lc().needsRebaseTasksForBuilder(req.builder.id) : [],
+      // task 1002739: the instance's first admitted builder — anchors the
+      // builder-needs founding-grace window (a newborn instance's founder gets a
+      // welcome, not a nag). Best-effort: null just means no grace.
+      db.getFoundingBuilder().catch(() => null),
     ]);
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
@@ -274,6 +278,12 @@ module.exports = function buildMeRouter() {
         rank: builder?.rank,
         ownKeySet: !!(geminiKeyRow && geminiKeyRow.enc),
         sharedKeyConfigured: artSharedKeyConfigured(),
+        // founding grace (task 1002739 / direction §5.6): a newborn instance's
+        // founder gets a welcome roster, not a coverage nag. The module owns the
+        // policy (window length, copy); we pass the raw facts.
+        isFoundingOwner: !!(foundingBuilder && String(foundingBuilder.id) === String(req.builder.id)),
+        founderCreatedAt: foundingBuilder ? foundingBuilder.created_at : null,
+        projectName: (() => { try { return branding().identity?.productName || null; } catch { return null; } })(),
       }) : [],
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module

package/src/module-api.js

@@ -677,8 +677,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.123 with no explicit bump. run 31844281033. (task 1002620)
 //   1.19.125 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.124 with no explicit bump. run 31849445746. (task 1002620)
+//   1.19.126 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.125 with no explicit bump. run 31853055269. (task 1002620)
+//   1.19.127 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.126 with no explicit bump. run 31854730552. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.125'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.127'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/builder_needs.mjs

@@ -95,5 +95,119 @@ t('missing rank fails safe — not action_needed without an explicit rank', () =
   assert.ok(['covered', 'action_needed', 'satisfied'].includes(n.state));
 });
 
+console.log('founding grace (task 1002739, direction §5.6):');
+
+const DAY = 24 * 60 * 60 * 1000;
+const bornNow = new Date().toISOString();
+
+t('newborn founder: welcome item first, greeting by project name', () => {
+  const r = needs.computeNeeds({
+    rank: 'archon', ownKeySet: false,
+    isFoundingOwner: true, founderCreatedAt: bornNow, projectName: 'Mercury',
+  });
+  assert.equal(r.items[0].id, 'founding_welcome');
+  assert.match(r.items[0].title, /Mercury/);
+  assert.equal(r.items[0].state, 'covered');
+  assert.equal(r.items[0].action, null);
+});
+
+t('newborn founder: zero action_needed — every nag is suppressed', () => {
+  const r = needs.computeNeeds({
+    rank: 'archon', ownKeySet: false, isFoundingOwner: true, founderCreatedAt: bornNow,
+  });
+  assert.equal(r.has_action_needed, false);
+  assert.equal(r.action_needed_count, 0);
+  for (const n of r.items) assert.notEqual(n.state, 'action_needed');
+});
+
+t('a suppressed nag keeps its identity but loses the demand', () => {
+  const r = needs.computeNeeds({
+    rank: 'archon', ownKeySet: false, isFoundingOwner: true, founderCreatedAt: bornNow,
+  });
+  const artItem = r.items.find((n) => n.id === 'art_key');
+  assert.ok(artItem, 'the art_key item must still be listed, not hidden');
+  assert.equal(artItem.state, 'covered');
+  assert.equal(artItem.action, null);
+  assert.doesNotMatch(artItem.message, /coverage has ended/i);
+});
+
+t('the grace window is seven days — the policy number is pinned, not self-referential', () => {
+  // A fixed injected clock, and 7 written as a literal on both sides: mutating
+  // FOUNDING_GRACE_DAYS (a "tune", a bad merge) must fail here, not slide.
+  assert.equal(needs.FOUNDING_GRACE_DAYS, 7);
+  const born = Date.parse('2026-01-01T00:00:00Z');
+  const ctx = { rank: 'archon', ownKeySet: false, isFoundingOwner: true, founderCreatedAt: '2026-01-01T00:00:00Z' };
+  const inWindow = needs.computeNeeds({ ...ctx, nowMs: born + 7 * DAY - 60_000 });
+  assert.equal(inWindow.has_action_needed, false);
+  assert.equal(inWindow.items[0].id, 'founding_welcome');
+  const expired = needs.computeNeeds({ ...ctx, nowMs: born + 7 * DAY + 60_000 });
+  assert.equal(expired.has_action_needed, true);
+  assert.ok(!expired.items.find((n) => n.id === 'founding_welcome'));
+});
+
+t('grace expires: past FOUNDING_GRACE_DAYS the founder is nagged like anyone (real clock)', () => {
+  const old = new Date(Date.now() - (needs.FOUNDING_GRACE_DAYS * DAY + 60_000)).toISOString();
+  const r = needs.computeNeeds({
+    rank: 'archon', ownKeySet: false, isFoundingOwner: true, founderCreatedAt: old,
+  });
+  assert.equal(r.has_action_needed, true);
+  assert.ok(!r.items.find((n) => n.id === 'founding_welcome'));
+});
+
+t('a non-founder on a newborn instance is not suppressed', () => {
+  const r = needs.computeNeeds({
+    rank: 'thetes', ownKeySet: false, isFoundingOwner: false, founderCreatedAt: bornNow,
+  });
+  assert.equal(r.has_action_needed, true);
+  assert.ok(!r.items.find((n) => n.id === 'founding_welcome'));
+});
+
+t('satisfied stays satisfied during grace — no fake downgrades', () => {
+  const r = needs.computeNeeds({
+    rank: 'archon', ownKeySet: true, isFoundingOwner: true, founderCreatedAt: bornNow,
+  });
+  assert.equal(r.items.find((n) => n.id === 'art_key').state, 'satisfied');
+});
+
+t('no founder facts at all → no grace, no welcome (vanilla ctx unchanged)', () => {
+  const r = needs.computeNeeds({ rank: 'thetes', ownKeySet: false });
+  assert.equal(r.has_action_needed, true);
+  assert.ok(!r.items.find((n) => n.id === 'founding_welcome'));
+});
+
+console.log('the producing side (DB-free source pins — the policy is only as real as its facts):');
+
+// The seven policy cases above hand computeNeeds its ctx. These pin the two
+// places that PRODUCE that ctx, because both were wrong-or-unverified once:
+// the founder query returned the migration-seeded BFG system principal (ids 1-2
+// on every newborn DB — review panel, 2026-08-15), and a key rename in me.js
+// would silently disable the grace while every policy case stayed green. A
+// DB-backed newborn-instance test can't run in the unit gate, so the source is
+// the checkable artifact.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+t('getFoundingBuilder skips the seeded system principals (system_role IS NULL)', () => {
+  const src = readFileSync(path.join(ROOT, 'src/bongos/db-kernel.js'), 'utf8');
+  const fn = src.slice(src.indexOf('function getFoundingBuilder'));
+  const sql = fn.slice(0, fn.indexOf('return'));
+  assert.match(sql, /FROM builders/);
+  assert.match(sql, /system_role IS NULL/,
+    'the founder query must exclude system principals — migrations 065/067 seed them at the lowest ids on every instance');
+  assert.match(sql, /ORDER BY id ASC/);
+});
+
+t('the /me aggregator feeds computeNeeds the founder facts under their contract names', () => {
+  const src = readFileSync(path.join(ROOT, 'src/bongos/routes/me.js'), 'utf8');
+  const call = src.slice(src.indexOf('computeNeeds({'), src.indexOf('}) : []'));
+  for (const key of ['isFoundingOwner', 'founderCreatedAt', 'projectName']) {
+    assert.match(call, new RegExp(`${key}\\s*:`),
+      `me.js must pass ${key} into computeNeeds — a rename silently disables the founding grace`);
+  }
+  assert.match(src, /getFoundingBuilder\(\)/, 'me.js must resolve the founder row');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/cosmos_token_contrast.mjs

@@ -165,6 +165,21 @@ const PAIRS = [
   // .chip.busy + the .tbl .pill / .cardRel / builder-badge family: accent-deep
   // ink on the accent-soft tint, both modes
   ['.chip.busy label',                  'var(--accent-deep)',   'var(--accent-soft)',   4.5],
+  // lifecycle strip STATE INDICATORS (task 1002751): non-text at the WCAG
+  // 1.4.11 bar of 3.0. --sea-ink derives brighter in dark exactly the way
+  // --accent-deep does, so a pack's light-tuned sea can't vanish on the dark
+  // card; the done tick takes --on-ok (the ink-on-a-filled-state-dot token).
+  ['strip done/now indicator on card',  'var(--sea-ink)',       CARD,                   3.0],
+  ['strip done fill vs its idle rail',  'var(--sea-ink)',       'var(--sea-soft)',      3.0],
+  ['strip indicator on the strip tint', 'var(--sea-ink)',       'color-mix(in srgb,var(--sea) 8%,var(--bg-card))', 3.0],
+  ['strip done tick on its fill',       'var(--on-ok)',         'var(--sea-ink)',       3.0],
+  ['flowDown done tick on its fill',    'var(--on-ok)',         'var(--ink-faint)',     3.0],
+  ['.steps done/now ring on card',      'var(--accent)',        CARD,                   3.0],
+  ['.steps done vs idle connector',     'var(--accent)',        'var(--line)',          3.0],
+  // the opted-out address card swaps to the page ground (--bg); its muted copy
+  // must still measure (19px/700 headline = large text, 3.0)
+  ['optedOut .addrBig (large) on --bg', 'var(--ink-soft)',      'var(--bg)',            3.0],
+  ['addrOpt warning on --bg',           'var(--warn)',          'var(--bg)',            4.5],
   // lifecycle strip: 12px/700
   ['.strip .slbl idle',                 'var(--ink-faint)',     CARD,                   4.5],
   ['.strip .slbl now/done',             'color-mix(in srgb,var(--sea) 40%,var(--ink))',       CARD, 4.5],
@@ -254,6 +269,81 @@ test('dark blocks never re-point a token at the locked space palette', () => {
   }
 });
 
+// opacity multiplies AFTER the token resolves, so a dimmed subtree's contrast
+// is invisible to every token assertion above (task 1002751: .slocked at .6
+// took 13.5px copy to 3.02:1; .chip .rec at .72 took recency to 3.48:1;
+// .addrConfirm.optedOut at .75 took its note to 3.43:1; a placeholder rule's
+// .75 survived into an override that set only the color, so no token value
+// could ever fix it). Dim with a muted TOKEN so the result stays measured.
+// Known limits, accepted: @keyframes bodies, animation-fill-mode resting
+// values, and JS-set inline opacity are out of static reach — never make an
+// animation or script the resting presenter of text or a state mark.
+const pageSrc = fs
+  .readFileSync(path.join(path.dirname(CSS), '..', 'projects.html'), 'utf8')
+  .replace(/<!--[\s\S]*?-->/g, '')
+  .replace(/\/\*[\s\S]*?\*\//g, '');
+const cssSrc = src.replace(/\/\*[\s\S]*?\*\//g, '');
+const dimsBelowFull = (body) => {
+  const m = body.match(/opacity\s*:\s*([\d.]+%?)/);
+  if (!m) return false;
+  const v = m[1].endsWith('%') ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+  return v < 1;
+};
+
+test('text is never dimmed by subtree opacity', () => {
+  // Two nets. (1) Anywhere in either sheet: a rule that declares BOTH a color
+  // and a sub-1 opacity is dimmed text by construction. (2) The create flow's
+  // known text containers may not carry opacity at all — this also catches
+  // ancestor dims (.createSplit) that net 1 can't see.
+  const offenders = [];
+  for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
+    for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
+      if (/(?:^|[;{\s])color\s*:/.test(m[2]) && dimsBelowFull(m[2])) {
+        offenders.push(`${where}: ${m[1].trim().slice(0, 60)} declares color + opacity<1`);
+      }
+    }
+  }
+  for (const sel of ['\\.humanSteps', '\\.addrConfirm', '\\.prog\\b', '\\.choice', '\\.review', '\\.createSplit', '\\.chip \\.rec']) {
+    for (const text of [cssSrc, pageSrc]) {
+      for (const m of text.matchAll(new RegExp(`${sel}[^{}]*\\{([^}]*)\\}`, 'g'))) {
+        if (dimsBelowFull(m[1])) offenders.push(`text container dimmed: ${m[0].slice(0, 90)}`);
+      }
+    }
+  }
+  assert.deepEqual(offenders, [], `\n  ${offenders.join('\n  ')}\n`);
+});
+
+test('the .prog strip mirrors .strip: state marks are --sea-ink, ticks are --on-ok', () => {
+  // /create's done panel renders the page-local .prog, NOT cosmos's .strip —
+  // a re-point of one and not the other is exactly how the 1.74:1 dark tick
+  // shipped the first time. State-mark rules (done fill/connector, now
+  // ring/pulse, the tick) must use the derived tokens; raw --sea is only legal
+  // as a tint ingredient (color-mix) or the idle -soft rail.
+  const progRules = [...pageSrc.matchAll(/\.prog[^{}]*\{([^}]*)\}/g)];
+  assert.ok(progRules.length >= 5, 'the .prog rules moved out of projects.html — update this test');
+  const bad = [];
+  for (const m of progRules) {
+    const body = m[1];
+    if (/(?:border(?:-\w+)?|background)\s*:\s*var\(\s*--sea\s*\)/.test(body)) {
+      bad.push(`raw --sea state mark: ${m[0].slice(0, 80)}`);
+    }
+    if (/border-(?:left|bottom)\s*:[^;]*#fff\b/i.test(body)) {
+      bad.push(`hardcoded #fff tick: ${m[0].slice(0, 80)}`);
+    }
+  }
+  assert.deepEqual(bad, [], `\n  ${bad.join('\n  ')}\n`);
+});
+
+test('the pulse animation never dims its mark', () => {
+  // beatPulse drives the now-dot in BOTH .strip and .prog. An opacity trough
+  // (the old 0.6) put the pulsing mark below the 3:1 its token clears at rest
+  // — the PAIRS row above would assert a color the pixel never sustains.
+  const kf = cssSrc.match(/@keyframes beatPulse\{([\s\S]*?)\}\s*\}/) ||
+             cssSrc.match(/@keyframes beatPulse\{([^@]*)\}/);
+  assert.ok(kf, '@keyframes beatPulse not found in cosmos.css — update this test');
+  assert.ok(!/opacity\s*:/.test(kf[1]), 'beatPulse dims the now-mark by opacity again');
+});
+
 test('the two dark blocks stay in lockstep', () => {
   // cosmos.css carries dark twice — an explicit data-mode hook and a
   // prefers-color-scheme twin. A change to one and not the other is the