@bongos/core 1.19.209 → 1.19.210

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.209",
-  "core_contract": "1.19.209",
-  "source_commit": "7163dda884c4ff7ab746790988dd3612e1271681",
+  "core_version": "1.19.210",
+  "core_contract": "1.19.210",
+  "source_commit": "00146d83dff6ca94febcce329b5677b8d7dcb25c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T21:40:11.933Z",
+  "built_at": "2026-08-17T22:55:17.955Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1631,
-  "tree_sha256": "f933ba33ff7212d28d0d1b4447b760177e211576e00658e3050a7a72528c3bc5",
+  "tree_sha256": "101f3cedf1222f6a1a14cc53957baf132e2586e9061e196dcff4550d43033a10",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1367,12 +1367,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "52554cf7c8e5355c59594c872f30975581eb6c1b9a5bcb63efa1a1a19f2d3877"
+      "sha256": "7b61c830bb85b66e1d6d5dad672fd4b90166e01d07be0f5db7677fc38cc24817"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "825af2c499836301a34cff79192e41556cc863fe9a5378d9e5134c862769c2fa"
+      "sha256": "260f4413742edbb61d7695a1912ecae67383c9787a7f6f40211c5421668da480"
     },
     {
       "path": "docs/architecture.md",
@@ -3982,7 +3982,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "78c89017e17dfba57ade2330fce293e6422aab316e9311f8215ff3eb9fdc3fe5"
+      "sha256": "a4419bdd0693d0e1168051bd640721b615bf400b25f26478d786b9aac908ab5e"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9a096a5f5cadd3f8dab6e2c958402e36c857ff560a14364c756161c41d573ed3"
+      "sha256": "4cfce69a22e52a9c0a89cd376458a32616167c2c6ca387f9cfc376212fd630db"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9b699cde73691611630459b846d40b8a887cb51099b8d4193d775fd76f1b9749"
+      "sha256": "6c5ee2445f8c94f3ccbcee5c2387ac2029e34607601ff6146c6a932dc6282d40"
     },
     {
       "path": "public-docs/index.html",
@@ -4527,7 +4527,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "611050e8599be5791e89f9711b76ef6efc5b1e8bd703e2badc6a6418a9ed432b"
+      "sha256": "bb8a74eaadebf0adf8e59dd03cab87f9c3cbd7faf21d1d6a5d47b460c032c28b"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -4547,7 +4547,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "20dd4fcb471c8d5a4dced2788ca6fffecaba241207bc0087d918d15b60bcc1a1"
+      "sha256": "e19cbe7db15331509cb1f09c5e8cbcf0379bb55ddb5bc405d4ebf386186f016c"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "efbf7edd3c80dbce81da9aa7473ae1903674c9018da9803e6ab0e807bcb616f0"
+      "sha256": "8f9beea649114a7133ef56008878f45197bb97c29bdddf6e5c6c5d786ca30981"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7522,7 +7522,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "5a3f724b4e84324d7560254517612b45fd4e4e31e57ebbb0b35a4021d712df6b"
+      "sha256": "3c31493c1b2a804b52f34310dc31f10b3bf67387ed9266c06fd7295aac2f0d5b"
     },
     {
       "path": "tests/provision.mjs",
@@ -7552,7 +7552,7 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "bb800d2e15045efbac4fadbc62996054d33e163eb86e6a5e09087d409cc7fbfa"
+      "sha256": "a525fdcfa2fde8edd2be3198ca7213b9b6bc43a12f748a718a570b7f993972b6"
     },
     {
       "path": "tests/provisioning_slug_available.mjs",
@@ -7572,7 +7572,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "ea3fc3b311115c765e7734e11cc33750a5ffde9f492d4635460b04cfc2108ad3"
+      "sha256": "d3e132bd85382b1a9ff4fa2d582a5fc72dabc91b2dc50828b5f622f6c112b2f1"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/docs/api/openapi.json

@@ -8725,7 +8725,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/instances/:id",
-        "description": "GET /provisioning/instances/:id — read one of the caller's own instances. rank: any authenticated builder (own resource). 404 when the id isn't the caller's (own-scoped; does not leak another owner's instance existence).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "GET /provisioning/instances/:id — read one instance (the manage page's read). rank: any authenticated builder (own resource; archon may read any — task 1003041). 404 otherwise — does not leak another owner's instance existence.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [

package/docs/api-reference.md

@@ -380,7 +380,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |
 | GET | `/api/bongos/provisioning/instances` | `any-builder` | — | GET /provisioning/instances — the caller's own instances + each open intent. |
 | POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `no_address`, `tier`, `onboard_mode`, `type` | POST /provisioning/instances — request a new instance. |
-| GET | `/api/bongos/provisioning/instances/:id` | `any-builder` | — | GET /provisioning/instances/:id — read one of the caller's own instances. |
+| GET | `/api/bongos/provisioning/instances/:id` | `any-builder` | — | GET /provisioning/instances/:id — read one instance (the manage page's read). |
 | POST | `/api/bongos/provisioning/instances/:id/domain` | `any-builder` | `domain` | POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domai… |
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |

package/modules/provisioning/routes/provisioning.js

@@ -569,15 +569,25 @@ module.exports = function provisioningRoutes() {
     }
   });
 
-  // GET /provisioning/instances/:id — read one of the caller's own instances.
-  // rank: any authenticated builder (own resource). 404 when the id isn't the
-  // caller's (own-scoped; does not leak another owner's instance existence).
+  // Own-scoped with an Archon override: an owner manages their own project; an
+  // Archon may act on any (fleet support). 404 for everyone else — no existence
+  // leak. Guards the per-id read (the manage page, task 1003041) and both
+  // settings routes (task 1003040).
+  function instanceAccessDenied(inst, builder) {
+    if (!inst) return true;
+    if (builder.rank === 'archon') return false;
+    return String(inst.owner_builder_id) !== String(builder.id);
+  }
+
+  // GET /provisioning/instances/:id — read one instance (the manage page's read).
+  // rank: any authenticated builder (own resource; archon may read any — task
+  // 1003041). 404 otherwise — does not leak another owner's instance existence.
   router.get('/provisioning/instances/:id', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
       const inst = await provisioning.getInstanceById(pool, id);
-      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
+      if (instanceAccessDenied(inst, req.builder)) {
         return res.fail('instance_not_found', 404);
       }
       const open = await provisioning.getOpenIntent(pool, id);
@@ -594,14 +604,8 @@ module.exports = function provisioningRoutes() {
   // ── Per-project settings (task 1003040, goal 1000058) ─────────────────────
   // The foundation the manage-page wave hangs off: effective settings are the
   // DEFAULTS (today's behavior — public surfaces, apply-to-join) overlaid with
-  // the instance's stored keys. Own-scoped with an Archon override: the owner
-  // manages their own project; an Archon may act on any (fleet support). 404
-  // for everyone else — no existence leak (the GET-by-id precedent).
-  function settingsAccessDenied(inst, builder) {
-    if (!inst) return true;
-    if (builder.rank === 'archon') return false;
-    return String(inst.owner_builder_id) !== String(builder.id);
-  }
+  // the instance's stored keys. Access: instanceAccessDenied above (own-scoped,
+  // Archon override, 404 otherwise — no existence leak).
 
   // GET /provisioning/instances/:id/settings — read a project's effective
   // settings + the allowed values (so a form can render its choices).
@@ -611,7 +615,7 @@ module.exports = function provisioningRoutes() {
     if (!id) return;
     try {
       const inst = await provisioning.getInstanceById(pool, id);
-      if (settingsAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
       res.json({ ok: true, settings: provisioning.effectiveSettings(inst), options: provisioning.SETTINGS_VOCAB });
     } catch (err) {
       console.error('[provisioning] GET /provisioning/instances/:id/settings', err);
@@ -640,7 +644,7 @@ module.exports = function provisioningRoutes() {
     }
     try {
       const inst = await provisioning.getInstanceById(pool, id);
-      if (settingsAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
       const updated = await provisioning.updateInstanceSettings(pool, id, patch);
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'settings',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.209",
+  "version": "1.19.210",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.209",
+      "version": "1.19.210",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.209",
+  "version": "1.19.210",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -299,8 +299,6 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    card is there for — and the ghosted .orb stays the graphic cue. */
 .proj.gone{border-color:color-mix(in srgb,var(--line) 55%,var(--bg-card));}
 .proj.gone .projName{color:var(--ink-soft);}
-/* click-to-manage landing glow: the sky's owned orb hands focus to this card */
-.proj.anchored{border-color:var(--accent);box-shadow:0 0 0 3px color-mix(in srgb,var(--accent) 30%,transparent);}
 .projBody{flex:1;min-width:0;}
 .projHead{display:flex;align-items:center;gap:12px;flex-wrap:wrap;}
 .projName{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;}
@@ -319,6 +317,11 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}
 .projMsg a{color:var(--link-ink);font-weight:700;text-decoration:none;}
+/* the manage view (task 1003041): its back link, meta repo link and the
+   honest empty-state links speak the same link ink as every other surface */
+.projMeta a{color:var(--link-ink);font-weight:700;text-decoration:none;}
+.backRow a{color:var(--link-ink);font-weight:700;text-decoration:none;}
+.empty p a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .projMsg a:hover{text-decoration:underline;}
 .projMsg details{margin-top:8px;}
 .projMsg summary{cursor:pointer;font-size:12.5px;font-weight:700;color:var(--ink-faint);}

package/public-landing/projects.html

@@ -43,6 +43,12 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 .viewWrap{padding-bottom:40px;}
 .card{margin-bottom:26px;}
 
+/* ── the manage view (task 1003041): container rhythm only — every component
+   it draws (card, chip, addr, empty) is cosmos vocabulary ── */
+.backRow{margin:14px 0;font-weight:700;}
+#view-manage .empty{text-align:left;}
+#view-manage .empty p{margin-bottom:0;}
+
 /* The bongo pair on the New-project view. Component-scoped custom properties,
    never :root (C1). The drum head is SKIN — using --bg-card would turn it black
    in dark mode — and --drum-shadow is ink in light but PLAIN BLACK in dark,
@@ -557,6 +563,74 @@ h1[tabindex="-1"]:focus{outline:none;}
   </div>
 </section>
 
+<!-- ══════════════════ VIEW · MANAGE ═══════════════════════════════════════
+     One owned project's management home (task 1003041, goal-1000058 wave).
+     Deep link: ?view=manage&id=N — goToManage() routes the map's owned
+     orbs/rows and the mine cards here. The API is the wall: the per-id read
+     is own-scoped (owner, or an archon for fleet support) and answers 404
+     for anyone else, so a stranger's deep link renders the same clean
+     "no project here" as a wrong id — never a permission hint. The settings
+     sections are the homes the sibling manage-wave tasks fill in; until each
+     ships, its section says so honestly instead of faking a control. -->
+<section id="view-manage" hidden>
+  <div class="wrap viewWrap">
+    <p class="backRow"><a href="?view=mine" data-nav-to="mine">← Your projects</a></p>
+
+    <!-- signed out: the same identity-only door the mine view uses (ADR 0143) -->
+    <section id="mGate" class="card" hidden>
+      <p class="lede">This is a project’s management page — it answers only to the person who owns it. Sign in with GitHub to open yours.</p>
+      <a class="btn" id="mSignin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine">
+        <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
+        Sign in with GitHub
+      </a>
+    </section>
+
+    <!-- 404: one clean state for "not yours" and "doesn't exist" — the API
+         answers both identically on purpose, and so does this copy -->
+    <section id="mMissing" class="card" hidden>
+      <p class="lede">No project here. It may have been removed, or the link may be wrong.</p>
+      <a class="btn small ghost" href="?view=mine" data-nav-to="mine">Back to your projects</a>
+    </section>
+
+    <div class="alert" id="mAlert" role="alert"></div>
+    <div class="loading" id="mLoading">Reading the project…</div>
+
+    <section id="mMain" hidden>
+      <div class="hero" style="padding-left:0;padding-right:0">
+        <h1>Manage</h1>
+        <p class="lede">One project, up close — its address, its repository, and what the platform last <b>verified</b> about it, with a timestamp. The controls land here piece by piece; each section says what it can do today.</p>
+      </div>
+
+      <div class="card">
+        <div class="projHead"><span class="projName" id="mName">…</span><span id="mChip"></span></div>
+        <div class="projMeta" id="mMeta" hidden></div>
+        <div class="addr" id="mAddr" hidden></div>
+        <p class="finePrint" id="mCreated" hidden></p>
+      </div>
+
+      <div class="card" id="mVisibility">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Who can see it</h2>
+        <div class="empty"><p>Choosing who can open this project’s pages — everyone, or only people signed in to it — isn’t wired up here yet. It lands in one of the next updates; until then every project keeps the behavior it already has.</p></div>
+      </div>
+
+      <div class="card" id="mJoinability">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
+        <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. It lands in one of the next updates.</p></div>
+      </div>
+
+      <div class="card" id="mRepoVisibility">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Repository visibility</h2>
+        <div class="empty"><p>Making the project’s code repository public or private from here isn’t wired up yet. Until it lands, GitHub’s own settings page is the place to change that.</p></div>
+      </div>
+
+      <div class="card" id="mDelete">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Delete the project</h2>
+        <div class="empty"><p>Deleting a project from this page isn’t wired up yet. A running project can still be torn down from its card under <a href="?view=mine" data-nav-to="mine">Your projects</a> — that stops the server and keeps your repository.</p></div>
+      </div>
+    </section>
+  </div>
+</section>
+
 <!-- ══════════════════ VIEW · NEW PROJECT ══════════════════════════════════
      The whole create wizard, absorbed from /create (task 1002763; direction
      §4 — that route now 302s here). Seven panels behind the five-beat rail; the
@@ -912,12 +986,23 @@ h1[tabindex="-1"]:focus{outline:none;}
      pointed at /projects?view=new) actually arrive somewhere.
      ══════════════════════════════════════════════════════════════════════════ */
 
-  var VIEWS = { map: 1, mine: 1, new: 1 };
+  var VIEWS = { map: 1, mine: 1, new: 1, manage: 1 };
   var currentView = 'map';
+  /* the manage view's target project (task 1003041) — set by goToManage() and
+     the ?view=manage&id=N deep link, read by loadManage() */
+  var manageId = null;
+  var manageInst = null;
 
   function viewFromUrl() {
     var v;
     try { v = new URLSearchParams(location.search).get('view'); } catch (e) { v = null; }
+    if (v === 'manage') {
+      /* per-project: no id names no project — the list is the honest landing */
+      var id = null;
+      try { id = new URLSearchParams(location.search).get('id'); } catch (e) {}
+      if (id) { manageId = String(id); return 'manage'; }
+      return 'mine';
+    }
     return VIEWS[v] ? v : 'map';
   }
 
@@ -930,14 +1015,20 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (a.dataset.nav !== 'home' && a.dataset.nav === v) a.setAttribute('aria-current', 'page');
       else a.removeAttribute('aria-current');
     });
-    try { history.replaceState(null, '', '?view=' + v); } catch (e) {}
+    /* the manage view's URL names its project — the deep-link contract grew
+       an id in task 1003041, so a manage tab is shareable and reload-safe */
+    var idPart = (v === 'manage' && manageId) ? '&id=' + encodeURIComponent(manageId) : '';
+    try { history.replaceState(null, '', '?view=' + v + idPart); } catch (e) {}
     /* the shell's sign-in door returns the visitor to the view they left, and
        carries the repo scope when that view is the wizard (ADR 0143: the
        create path asks once up front instead of a second consent at Home) */
-    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v + (v === 'new' ? '&repos=1' : '');
+    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
+      idPart.replace('&', '%26').replace('=', '%3D') + (v === 'new' ? '&repos=1' : '');
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale */
     if (v === 'mine' && me) refreshList();
+    /* manage re-reads its project on entry — no timer lives here (C8) */
+    if (v === 'manage') loadManage();
     /* owned chips refresh on re-entry, never on a timer — C8 keeps the map quiet */
     if (v === 'map' && me) loadOwnedInstances().then(applyMapFilter);
     /* the living sky runs only on stage (C8) — start and stop with the view;
@@ -1169,11 +1260,11 @@ h1[tabindex="-1"]:focus{outline:none;}
       var href = safeHttpUrl(p.origin);
       if (inst) {
         /* an OWNED entry — catalog-annotated or owned-only, one code path.
-           Its job is MANAGE (direction §5): same tab, anchored on that
-           project. The public-site door still exists on the manage card; a
-           middle-click lands a fresh tab on the manage view, which is this
-           orb's honest destination. */
-        a.href = '?view=mine';
+           Its job is MANAGE (direction §5): a plain click opens that
+           project's manage view (task 1003041), and the href IS that view's
+           deep link, so a middle/ctrl-click lands a fresh tab on the same
+           honest destination. The public-site door stays on the manage page. */
+        a.href = '?view=manage&id=' + encodeURIComponent(String(inst.id));
         a.setAttribute('data-manage', String(inst.id));
       } else {
         /* The href STAYS, and stays honest, even though a plain click now opens
@@ -1441,16 +1532,14 @@ h1[tabindex="-1"]:focus{outline:none;}
     if (p) openCard(p, relOf(p), a);
   });
 
-  /* ── Click-to-manage (task 1002744): an owned orb opens YOUR side of the hub,
-     anchored on that project's card. The anchor is deferred — setView('mine')
-     triggers an async refreshList(), so the target `[data-inst]` node may not
-     exist yet; render() and refreshList() retry tryAnchor() once it does. ── */
-  var ANCHOR_GLOW_MS = 2200;
-  var pendingAnchor = null;
+  /* ── Click-to-manage (task 1002744 → 1003041): an owned orb, row or card
+     opens that project's own manage view — the per-project page the
+     manage-wave tasks fill in. It replaced the scroll-anchor-into-the-list
+     this function used to do. ── */
   function goToManage(instId) {
-    pendingAnchor = String(instId || '');
-    setView('mine');
-    tryAnchor();   /* the list may already be rendered from an earlier visit */
+    manageId = String(instId || '');
+    manageInst = null;
+    setView('manage');
   }
   /* Card-shell lookup by instance id. CSS.escape, not esc(): the data-inst
      attribute holds the DECODED value, so an HTML-escaped id would never match
@@ -1459,18 +1548,6 @@ h1[tabindex="-1"]:focus{outline:none;}
   function liFor(id) {
     return document.querySelector('li[data-inst="' + CSS.escape(String(id == null ? '' : id)) + '"]');
   }
-  function tryAnchor() {
-    if (!pendingAnchor) return;
-    var li = liFor(pendingAnchor);
-    if (!li) return;
-    pendingAnchor = null;
-    /* a search or state filter that hides the target would turn the anchor
-       into a silent no-op — clear them the same way the visitor would */
-    if (li.hidden) $('mineClear').click();
-    li.scrollIntoView({ block: 'center' });
-    li.classList.add('anchored');
-    setTimeout(function () { li.classList.remove('anchored'); }, ANCHOR_GLOW_MS);
-  }
 
   $('mapRows').addEventListener('click', function (ev) {
     /* the row's own "Open →" keeps its job — the card is for the rest of the row */
@@ -3630,7 +3707,9 @@ h1[tabindex="-1"]:focus{outline:none;}
     }
     var lm = lastMsg[inst.id];
     body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '">' + (lm ? lm.text : '') + '</div>';
-    var acts = [];
+    /* every owned card opens its manage view (task 1003041) — a real link, so
+       middle/ctrl-click works; the delegated handler upgrades a plain click */
+    var acts = ['<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>'];
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-retry="' + iid + '">Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-revive="' + iid + '">Bring it back</button>');
     if (canTeardown(inst)) acts.push('<button type="button" class="btn small danger" data-teardown="' + iid + '">Tear it down</button>');
@@ -3663,7 +3742,6 @@ h1[tabindex="-1"]:focus{outline:none;}
     });
     recountMine();
     applyMine();
-    tryAnchor();   /* a click-to-manage jump may be waiting on this render */
   }
 
   function msg(id, text, cls) {
@@ -3753,7 +3831,6 @@ h1[tabindex="-1"]:focus{outline:none;}
         var sameSet = instances.length === known && instances.every(function (i) { return byId[i.id]; });
         if (!sameSet) { render(instances); return; }
         instances.forEach(function (inst) { takeUpdate(inst.id, inst); });
-        tryAnchor();   /* same-set refresh renders no shells — retry here too */
       })
       .catch(function () { /* transient — next tick will try again */ });
   }
@@ -3767,6 +3844,8 @@ h1[tabindex="-1"]:focus{outline:none;}
     /* returning to a MAP tab re-reads the owned overlay once — event-driven,
        like the mine view's entry refresh, not a timer */
     if (!document.hidden && me && currentView === 'map') loadOwnedInstances().then(applyMapFilter);
+    /* returning to a MANAGE tab re-reads its one project the same way */
+    if (!document.hidden && currentView === 'manage' && manageId) loadManage(true);
   });
 
   /* C6 freshness without C8's cost: once a minute the visible MAP refreshes
@@ -3793,6 +3872,93 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
   setInterval(mapChipTick, REFRESH_MS);
 
+  /* ── the manage view (task 1003041): one owned project's management home.
+     The API is the wall — the per-id read is own-scoped with an archon
+     override and 404s for anyone else — so this code only renders what it
+     answers. The data re-reads on entry and tab return, never on a fetch
+     timer (C8); the once-a-minute tick below re-renders from data already
+     in hand so "checked Xm ago" keeps telling the truth (C6). ── */
+
+  function manageSignin() {
+    return API + '/auth/web/start?return=' +
+      encodeURIComponent('/projects?view=manage&id=' + manageId);
+  }
+
+  function renderManage(inst) {
+    manageInst = inst;
+    $('mLoading').hidden = true;
+    $('mGate').hidden = true;
+    $('mMissing').hidden = true;
+    $('mMain').hidden = false;
+    $('mName').textContent = inst.slug || '';
+    /* the ONE chip site of this view — chipFor() or nothing, so the manage
+       page can never tell a different liveness story than the card (C6) */
+    $('mChip').innerHTML = chipFor(inst);
+    var meta = [];
+    if (inst.target_ref) {
+      meta.push('repo <a href="https://github.com/' + esc(inst.target_ref) +
+        '" target="_blank" rel="noopener"><code>' + esc(inst.target_ref) + '</code></a>');
+    }
+    if (inst.hosting_shape) meta.push(esc(SHAPE_LABEL[inst.hosting_shape] || inst.hosting_shape));
+    if (inst.onboard_mode === 'adopt') meta.push('adopted repo');
+    $('mMeta').innerHTML = meta.join('<span aria-hidden="true">·</span>');
+    $('mMeta').hidden = !meta.length;
+    var addr = addressRow(inst);
+    $('mAddr').innerHTML = addr;
+    $('mAddr').hidden = !addr;
+    /* a fact with no answer hides — never a dash (the card rule) */
+    $('mCreated').textContent = inst.created_at ? 'Created ' + listedDate(inst.created_at) : '';
+    $('mCreated').hidden = !inst.created_at;
+  }
+
+  function loadManage(quiet) {
+    if (!manageId) return;
+    $('mAlert').classList.remove('on');
+    $('mSignin').href = manageSignin();
+    if (!quiet) {
+      $('mMain').hidden = true;
+      $('mGate').hidden = true;
+      $('mMissing').hidden = true;
+      $('mLoading').hidden = false;
+    }
+    var asked = manageId; /* a stale answer must never paint a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId), { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        if (res.status === 401) {
+          $('mLoading').hidden = true; $('mMain').hidden = true; $('mGate').hidden = false;
+          throw new Error('handled');
+        }
+        /* 404 is ONE clean answer for "not yours" and "doesn't exist" — the
+           API refuses both identically, so this page cannot leak existence */
+        if (res.status === 404) {
+          $('mLoading').hidden = true; $('mMain').hidden = true; $('mMissing').hidden = false;
+          throw new Error('handled');
+        }
+        if (!res.ok) throw new Error('soft');
+        return res.json();
+      })
+      .then(function (data) {
+        var inst = data.instance || {};
+        inst.open_intent = data.open_intent || null;
+        renderManage(inst);
+      })
+      .catch(function (err) {
+        var m = String(err && err.message);
+        if (m === 'handled' || m === 'stale') return;
+        $('mLoading').hidden = true;
+        var a = $('mAlert');
+        a.textContent = 'Couldn’t read this project right now — refresh in a moment.';
+        a.classList.add('on');
+      });
+  }
+
+  function manageChipTick() {
+    if (document.hidden || currentView !== 'manage' || !manageInst) return;
+    renderManage(manageInst); /* zero requests — re-dates "checked Xm ago" */
+  }
+  setInterval(manageChipTick, REFRESH_MS);
+
   /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
      SAY exactly what the server said ── */
 
@@ -3923,6 +4089,14 @@ h1[tabindex="-1"]:focus{outline:none;}
 
   /* one delegated listener for all card actions */
   $('projectsList').addEventListener('click', function (ev) {
+    /* the Manage link is a real anchor — a modified click keeps its browser
+       meaning, a plain one stays in-page (the orb-click contract) */
+    var m = ev.target.closest && ev.target.closest('a[data-manage]');
+    if (m) {
+      if (!isPlainClick(ev)) return;
+      ev.preventDefault();
+      return goToManage(m.getAttribute('data-manage'));
+    }
     var t = ev.target.closest('button');
     if (!t) return;
     if (t.hasAttribute('data-teardown')) return askTeardown(t.getAttribute('data-teardown'));

package/src/module-api.js

@@ -845,8 +845,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.207 with no explicit bump. run 32068332007. (task 1002620)
 //   1.19.209 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.208 with no explicit bump. run 32072227661. (task 1002620)
+//   1.19.210 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.209 with no explicit bump. run 32078135414. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.209'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.210'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -51,7 +51,11 @@ test('the nav carries Home plus the three views, and Home is not a view', () =>
 
 test('?view= is the deep-link contract, read on boot and written with replaceState', () => {
   assert.match(SCRIPT, /new URLSearchParams\(location\.search\)\.get\('view'\)/);
-  assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v\)/);
+  assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v \+ idPart\)/);
+  // the manage view is per-project, so its deep link carries the id too
+  // (task 1003041) — and the id is encoded, never raw-interpolated
+  assert.match(SCRIPT, /'&id=' \+ encodeURIComponent\(manageId\)/,
+    'the URL writer must carry the manage id, encoded');
   // the landing page's CTAs have always pointed here — this is the bug they hit
   const landing = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
   assert.match(landing, /href="\/projects\?view=new"/,
@@ -753,7 +757,8 @@ test('owned truth reaches the TABLE too — same list, same chip, same manage jo
 });
 
 test('an owned orb\'s job is manage, not the public site', () => {
-  assert.match(SCRIPT, /'\?view=mine'/, 'the owned href is the manage deep-link, real and middle-clickable');
+  assert.match(SCRIPT, /'\?view=manage&id=' \+ encodeURIComponent\(String\(inst\.id\)\)/,
+    'the owned href is the manage deep-link, real and middle-clickable');
   assert.match(SCRIPT, /hasAttribute\('data-manage'\)\) return goToManage/,
     'a plain click on an owned orb routes to manage before the card path');
   const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
@@ -794,13 +799,15 @@ test('the orb chip is the manage list\'s truth, never a second story (C6)', () =
     'no instance chip may be literal-classed live — chipMarkup() decides from the overlay');
 });
 
-test('click-to-manage anchors the project and defers until the card exists', () => {
-  assert.match(SCRIPT, /function goToManage/);
-  assert.match(SCRIPT, /pendingAnchor/);
-  assert.match(SCRIPT, /scrollIntoView/);
-  const fn = (SCRIPT.match(/function tryAnchor\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
-  assert.ok(fn, 'tryAnchor() must be extractable');
-  assert.match(fn, /mineClear/, 'a filter that hides the anchored card is cleared, not silently no-op\'d');
+test('click-to-manage opens the per-project manage view (task 1003041)', () => {
+  const fn = (SCRIPT.match(/function goToManage\(instId\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'goToManage() must be extractable');
+  assert.match(fn, /manageId = String\(instId/, 'the target project rides the module state');
+  assert.match(fn, /setView\('manage'\)/, 'the destination is the manage view, not a scroll anchor');
+  // the scroll-anchor era ended with its caller — a half-removed pendingAnchor
+  // would silently no-op every manage click
+  assert.doesNotMatch(SCRIPT, /pendingAnchor/, 'the anchor machinery must be fully gone');
+  assert.doesNotMatch(COSMOS, /\.proj\.anchored/, 'and so must its landing-glow rule');
 });
 
 test('the map does not poll for owned truth — it re-reads on entry (C8)', () => {
@@ -887,3 +894,86 @@ test('zoom heads for the cursor and survives line-mode wheels', () => {
   assert.ok(COSMOS.includes('transform-origin:0 0'),
     'the camera algebra assumes the layer scales about its origin');
 });
+
+/* ── The manage view (task 1003041, goal-1000058 wave) ──────────────────────
+   One owned project's management home: ?view=manage&id=N. The identity block
+   renders the own-scoped per-id read (with the verification overlay); the
+   settings sections are the homes the sibling manage-wave tasks fill in, each
+   an honest not-wired-yet until its task ships. The API is the wall: 404 for
+   strangers (owner or archon only), so the page renders one clean not-found
+   and never a permission hint. ── */
+
+test('the manage view ships as real markup with the four settings homes (C7)', () => {
+  assert.match(HUB, /id="view-manage"/);
+  for (const id of ['mGate', 'mSignin', 'mMissing', 'mAlert', 'mLoading', 'mMain',
+    'mName', 'mChip', 'mMeta', 'mAddr', 'mCreated',
+    'mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    assert.match(HUB, new RegExp(`id="${id}"`), `${id} must be real markup`);
+  }
+  // and the not-yet copy a crawler reads is in the document, not a template string
+  assert.match(HUB, /isn’t wired up/, 'the honest empty states live in the markup');
+});
+
+test('the manage view balances its own tree, like the wizard', () => {
+  const start = HUB.indexOf('<section id="view-manage"');
+  const end = HUB.indexOf('<section id="view-new"');
+  assert.ok(start !== -1 && end > start, 'need the view-manage span');
+  const manage = HUB.slice(start, end);
+  assert.equal((manage.match(/<div\b/g) || []).length, (manage.match(/<\/div>/g) || []).length,
+    'every div opened in #view-manage closes in #view-manage');
+  assert.equal((manage.match(/<section\b/g) || []).length, (manage.match(/<\/section>/g) || []).length,
+    'every section opened in #view-manage closes in #view-manage');
+});
+
+test('?view=manage&id=N is the deep link — read on boot, and no id means the list', () => {
+  assert.match(SCRIPT, /if \(v === 'manage'\)/, 'viewFromUrl must know the manage view');
+  assert.match(SCRIPT, /\.get\('id'\)/, 'and read the project id off the URL');
+  assert.match(SCRIPT, /manageId = String\(id\); return 'manage';/,
+    'an id lands on the manage view');
+  assert.match(SCRIPT, /return 'mine';/,
+    'a bare ?view=manage names no project — the list is the honest landing');
+});
+
+test('a stranger\'s deep link renders one clean not-found — never a permission hint', () => {
+  const missing = (HUB.match(/<section id="mMissing"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(missing, 'the not-found state must be extractable');
+  assert.doesNotMatch(missing, /permission|allowed|access|owner/i,
+    'the 404 copy must not hint that the project exists behind a wall');
+  assert.match(SCRIPT, /res\.status === 404[\s\S]{0,220}mMissing/,
+    'a 404 lands on the clean not-found state');
+  assert.match(SCRIPT, /res\.status === 401[\s\S]{0,220}mGate/,
+    'a 401 stays a sign-in gate, distinct from not-found');
+});
+
+test('the manage chip defers to chipFor — one site, no second story (C6)', () => {
+  const fn = (SCRIPT.match(/function renderManage\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'renderManage() must be extractable');
+  assert.equal((fn.match(/chipFor\(inst\)/g) || []).length, 1,
+    'renderManage must have exactly one chip call site');
+  assert.match(fn, /addressRow\(inst\)/, 'the address sentence is the shared, verified one');
+  assert.match(fn, /SHAPE_LABEL/, 'the hosting shape speaks the card\'s vocabulary');
+});
+
+test('the manage view spends no timer requests — refresh is entry and tab return (C8)', () => {
+  const tick = (SCRIPT.match(/function manageChipTick\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(tick, 'manageChipTick() must exist');
+  assert.match(tick, /currentView !== 'manage'/, 'the tick is view-guarded');
+  assert.match(tick, /document\.hidden/, 'and does nothing in a hidden tab');
+  assert.doesNotMatch(tick, /fetch\(/, 'zero requests — recency re-renders from data in hand');
+  assert.match(SCRIPT, /if \(v === 'manage'\) loadManage\(\);/, 'entry re-reads once');
+  assert.match(SCRIPT, /currentView === 'manage' && manageId\) loadManage\(true\)/,
+    'tab return re-reads once, quietly');
+});
+
+test('the repo link is built on github.com and escaped — never a raw href', () => {
+  assert.match(SCRIPT, /https:\/\/github\.com\/' \+ esc\(inst\.target_ref\)/,
+    'the identity block links the repo through the page escaper on a fixed origin');
+});
+
+test('every owned card carries its Manage door, and a modified click keeps its meaning', () => {
+  assert.match(SCRIPT, /data-manage="' \+ iid \+ '" href="\?view=manage&id=' \+ iid/,
+    'the card affordance is a real deep-link anchor');
+  assert.match(SCRIPT, /closest\('a\[data-manage\]'\)/, 'the delegated handler upgrades it');
+  assert.match(SCRIPT, /if \(!isPlainClick\(ev\)\) return;/,
+    'ctrl/middle-click falls through to the browser');
+});

package/tests/provisioning_settings.mjs

@@ -97,7 +97,36 @@ function reset({ inst, as } = {}) {
   events = [];
 }
 
-console.log('GET /provisioning/instances/:id/settings:');
+console.log('GET /provisioning/instances/:id (the manage page\'s read — task 1003041):');
+
+await ta('owner reads their own instance', async () => {
+  reset();
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.instance.slug, 'spike');
+});
+
+await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
+  reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+});
+
+await ta('an Archon may read ANY instance — the manage-page override (task 1003041)', async () => {
+  reset({ as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.instance.slug, 'spike');
+});
+
+await ta('unknown instance id → 404 for everyone, archon included', async () => {
+  reset({ inst: null, as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await get('/provisioning/instances/999');
+  assert.equal(r.status, 404, r.raw);
+});
+
+console.log('\nGET /provisioning/instances/:id/settings:');
 
 await ta('owner reads DEFAULTS (public / apply) on a row with empty settings — today\'s behavior', async () => {
   reset();

package/tests/public_landing_projects.mjs

@@ -107,6 +107,20 @@ test('a domainless instance gets an honest no-address state', async () => {
   assert.match(body, /[Nn]o address yet/);
 });
 
+test('the manage view is served: identity block + honest not-yet sections (task 1003041)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="view-manage"/);
+  // the four settings homes the sibling manage-wave tasks fill in
+  for (const id of ['mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    assert.match(body, new RegExp(`id="${id}"`), `${id} must be served`);
+  }
+  assert.match(body, /isn’t wired up/, 'each unshipped section says so honestly');
+  // the not-found state is one clean answer — never a permission hint
+  const missing = (body.match(/<section id="mMissing"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(missing, 'the not-found state must be served');
+  assert.doesNotMatch(missing, /permission|allowed|access|owner/i);
+});
+
 test('the empty state points a new owner at the wizard view — never at a hall', async () => {
   const { body } = await request('/projects', 'game.test.local');
   // /create was absorbed into ?view=new (task 1002763); the CTA moves in-page