@bongos/core 1.19.139 → 1.19.140

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.139",
-  "core_contract": "1.19.139",
-  "source_commit": "f5c30a288b3d2e438db66a6c80a845c6d389c3b7",
+  "core_version": "1.19.140",
+  "core_contract": "1.19.140",
+  "source_commit": "10935aeebedec72d8090e9be8f6d261d3b44d787",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T15:00:38.021Z",
+  "built_at": "2026-08-15T15:07:34.061Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "a3c1891b3b817e057662118da1da9b7952ea9c428344f02c4fbc87cf15fb468f",
+  "tree_sha256": "bff52e93502be3347f11913b68eb9807f14d6181c7e9f85788de9f4d21fa9c64",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "82837d1851e437e93bd6027ad59f49e9b1cff5fe4cbc0ba6d1bb8685b243308d"
+      "sha256": "9a8f370c9664f4d95d9030a91829796d447c7bd2e0e5f19d7be9f34ee4f9e305"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eddbbbd8e503347796b3df0c99c4891a15815c91d86223cc19384bde1e1abec1"
+      "sha256": "3dab4531988ec5a8632934a63ca42c7872e899c878ffd75a85ba4ef9e0bbf806"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "1cc492c8b781bd67f284d3fbcb3d2d46a7159dc6de8af3fb92e2b5589e4f7b10"
+      "sha256": "1c7cb3f54e177325c60a713a3f9219ce4349be229a3638f67319484f11cfef07"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "599d420de3284de8a307b0ab87a3506faa8f3e3c9f0014d5bdd36bdeaa1a7317"
+      "sha256": "ce6bcfa96110ae47a5098b08b574d9f8d015acfca354db31cd438c68362b3027"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7352,7 +7352,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "d0907a08d6b932d25df7b143e82c94d64a15eab66a7bd1df86ba85b1729661b7"
+      "sha256": "5760a59ccce395dbc3ac7bb49df58db3acac2954ab83b345b557233bb3381e12"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.139",
+  "version": "1.19.140",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.139",
+      "version": "1.19.140",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.139",
+  "version": "1.19.140",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -2932,11 +2932,36 @@ h1[tabindex="-1"]:focus{outline:none;}
                  : 'Raising the server, database, and address — nothing needed from you.',
           '', revive ? 'revive' : 'standup');
       } else if (s === 'active') {
+        /* Live lights on a VERIFIED answer, not on script completion (direction
+           §7): the strip keys on the same last_verified_* overlay the manage
+           list's chips read. null is deliberately distinct from false — a fresh
+           standup stays unprobed for up to a sweep interval and must not read
+           as a failure. */
         var addr = inst.domain ? 'https://' + inst.domain : null;
-        el.innerHTML = progressMarkup(-1, 3,
-          'Your project is up' + (addr ? ' — <a href="' + esc(addr) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>' : '') +
-          '. Finish the steps below and the hall is yours.', 'isLive');
-        return true;
+        var link = addr ? '<a href="' + esc(addr) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>' : null;
+        var flow = revive ? 'revive' : 'standup';
+        if (!addr) {
+          /* domainless instances are never probed — there is no address to
+             answer at, so a verified answer can never arrive; say what IS true
+             instead of promising the hall (sign-in stays locked without one) */
+          el.innerHTML = progressMarkup(-1, 3,
+            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', 'isLive', flow);
+          return true;
+        }
+        if (inst.last_verified_up === false) {
+          el.innerHTML = progressMarkup(2, 2,
+            'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow);
+          return false;
+        }
+        if (inst.last_verified_up) {
+          el.innerHTML = progressMarkup(-1, 3,
+            'Your project is answering at ' + link + '. Finish the steps below and the hall is yours.', 'isLive', flow);
+          return true;
+        }
+        /* null: standing, not checked yet — keep watching until the first probe */
+        el.innerHTML = progressMarkup(2, 2,
+          'The build finished — checking that ' + link + ' answers…', '', flow);
+        return false;
       } else if (s === 'error') {
         /* the honest snag (direction §5 / F19): no raw stderr as the headline, no
            false "keeps retrying" — retries stop, and the retry door is the mine view */

package/src/module-api.js

@@ -705,8 +705,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.137 with no explicit bump. run 31891128524. (task 1002620)
 //   1.19.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.138 with no explicit bump. run 31891461224. (task 1002620)
+//   1.19.140 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.139 with no explicit bump. run 31891805999. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.139'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.140'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/public_landing_projects.mjs

@@ -160,6 +160,22 @@ test('the done panel reads the open intent — a queued revive is never told to
   assert.match(body, /\.prog\.flowDown/, 'the .prog strip has the teardown palette (transcribed from .strip.flowDown)');
 });
 
+test('the done panel lights Live on a verified answer, never on status alone (task 1002895)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderProgress\(inst\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderProgress() must be extractable');
+  assert.match(fn, /last_verified_up/, 'the strip reads the verification overlay, not status alone');
+  // the three honest rungs: verified, failed probe, and never-probed —
+  // null is deliberately distinct from false and must not read as a failure
+  assert.match(fn, /answering at/i, 'verified speaks the list view\'s language');
+  assert.match(fn, /isn’t answering right now/, 'a failed probe is spoken, never painted green');
+  assert.match(fn, /checking that/, 'the never-probed instance gets its own calm rung');
+  // gap row 8: domainless is never probed at all — it states its truth instead
+  // of promising the hall (sign-in stays locked without an address)
+  assert.match(fn, /no address yet/, 'the domainless path cannot fall into an unverified hole');
+  assert.doesNotMatch(fn, /Your project is up/, 'the status-alone headline is dead');
+});
+
 test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');