@bongos/core 1.19.329 → 1.19.331

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.329",
-  "core_contract": "1.19.329",
-  "source_commit": "ed313bf56c84b4802561c1a22a7b1f13552d3297",
+  "core_version": "1.19.331",
+  "core_contract": "1.19.331",
+  "source_commit": "cc85e05304300cfad9f701b9f9432f1f74b5cf53",
   "source_ref": "HEAD",
-  "built_at": "2026-08-24T23:19:59.592Z",
+  "built_at": "2026-08-25T00:01:28.994Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 324,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1811,
-  "tree_sha256": "2e52a9d82898b6470557b59fc6ca710346a09b410a7f47f88fc037ad493df397",
+  "tree_sha256": "68c81c790b852a7c79d261a2d55f43ec6c2dbc17f1e89a80757b41023f929748",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "d1d2622e002edaed8a98deb8b69ff5a77c6eeab7993e3b0e7f1513f32ff027c6"
+      "sha256": "7b204f9621ced68ef54b9f74aa8fbec53ab2fa81b0380133c762950ac4de1479"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -1452,12 +1452,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "c8ac603ee95d84be92bda48042d937a62bfedb22bdc7a5c4362955db71a6ca8c"
+      "sha256": "04addfdc7fb7e9b59968d9d8daacd44d24280405868a705a65a3e4fd6166ec90"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b764712ca31d56511fed2e7d439b7230ab3539519aa337bc1c57360412cf3b13"
+      "sha256": "a7516b85bec7090bf2ea753246e03c0d3cd3505c54ea5de68987cf4b2543001c"
     },
     {
       "path": "docs/design-contract.md",
@@ -4667,12 +4667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "454fbe2af15bdbe1cdd60d5eb558c601062ee8efb13b21805f0644e07a125984"
+      "sha256": "0d95e9a5ad8a6d63dba589cbe1bc8f4497bebf1470776bdbfcf21f470a7bb81e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "40a3c39811c23c665f9710599982e4964d6f58d405c6e2fcf24b96e4aab36820"
+      "sha256": "ab2dde9733b1e67f8099474fc5d998b4e4c2060b2ac239ddd16db36bd1570fa5"
     },
     {
       "path": "public-docs/index.html",
@@ -4912,7 +4912,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "d39de81b2de333eb82eb5486bf975b56a99d24cf56bc84815fdf4bb96ae9fa0e"
+      "sha256": "a7f21729b00719b22cfd13c14b33d87f4fdd8aaa2890a174bfc36d1b53c1e5e4"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -4927,12 +4927,12 @@
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
-      "sha256": "ab299596b6c514ac044b2471330026e1516f6878e02b9045afae0ddc1f5fbfd9"
+      "sha256": "db0d924005e8806d9e64c5c12b31c91957f1f625da972cafd5745c2cbdbf6dd9"
     },
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "98e234b47865c9f84650d2b1a9408610965ef780492fcc9b70d74adee57ad039"
+      "sha256": "203b726527c02ed0383945c431df062ae6f02ed64cadc7942f9fef3e587a9da6"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -6342,7 +6342,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "c5688194f21600a64ced6b27aa5c12b4f580db786ffcf85a151422635269aa40"
+      "sha256": "bb62110c21a07745a8bcfd3e2cf94f29deec1de5baea9d62fa903febcca54f2b"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -6452,7 +6452,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a06153efe33e5d5729c4c6a86e1889441808217fa7fe6c9b07bd6b5ebe86114c"
+      "sha256": "11aa1bff9445edc29d7fe5034536edc7a6758e2f3d4c91d4b16a45c8ca1091ba"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8277,7 +8277,7 @@
     {
       "path": "tests/post_login_landing.mjs",
       "mode": "0000644",
-      "sha256": "942b2a9b0d5e2d2dd337b3ff738b7193ce0936d196a936f61bef51b74ed11ad0"
+      "sha256": "08a7496090f4617cef7e270afddcef8ee3a0b58bff6920b56bc2f2bbb49ed4ca"
     },
     {
       "path": "tests/pre_compact.mjs",
@@ -8332,7 +8332,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "566428702a778df50caf55d7050adbe18d3005eecf8f63aa6a758437ab2934a7"
+      "sha256": "a3cea371bb80b2dc05762a11bc43de84667f06db8723e384b34073e48fdfda6a"
     },
     {
       "path": "tests/promote_goal_id.mjs",

package/config/branding.neutral.json

@@ -103,7 +103,7 @@
     }
   },
   "landing": {
-    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/gate/', the orbs). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
+    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/', its landing page; the retired '/gate/' orb sky folds to '/' — task 1003233). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
     "postLogin": "/builders"
   },
   "envPrefix": "CLOUDBONGOS"

package/docs/copy-inventory.md

@@ -4,7 +4,7 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1381 strings** across 3 surfaces · 1225 distinct pieces of copy · 1381 certain, 0 heuristic · 126 shown in more than one place.
+**1383 strings** across 3 surfaces · 1226 distinct pieces of copy · 1383 certain, 0 heuristic · 127 shown in more than one place.
 
 ## Surfaces
 
@@ -12,7 +12,7 @@
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 65 | 1096 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
-| `landing` | `public-landing` | 2 | 187 |
+| `landing` | `public-landing` | 2 | 189 |
 
 ## Confidence, and why it is on every row
 
@@ -76,7 +76,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3837f6d586a3` | 2x | Copy the task prompt to your clipboard | modules/hall-ui/public/goals-page.js:552, modules/hall-ui/public/work.js:356 |
 | `e3fd1febf63d` | 2x | Could not copy to the clipboard. Try again. | modules/hall-ui/public/goals-page.js:515, modules/hall-ui/public/work.js:461 |
 | `7775fec0fa85` | 2x | Could not load sessions. | modules/hall-ui/public/sessions.js:168, modules/hall-ui/public/sessions.js:207 |
-| … | | _86 more in the JSON registry_ | |
+| … | | _87 more in the JSON registry_ | |
 
 ## `builders-hall` — 1096 strings
 
@@ -1282,7 +1282,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 187 strings
+## `landing` — 189 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1328,7 +1328,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c01533093b42` | certain | Create your first project | `public-landing/projects.html:560` |
 | `b07e75a05f48` | certain | Creating the repo yourself on GitHub? Public or private is your choice there — both work here, and we never ch | `public-landing/projects.html:829` |
 | `3aeefb044b9f` | certain | Creation steps | `public-landing/projects.html:685` |
-| `b228633307df` | certain | Delete the project | `public-landing/projects.html:660` |
 | `47d1558b17a3` | certain | Domain you own | `public-landing/projects.html:862` |
 | `d919980d2ca5` | certain | Download our core code and protocols, and build instantly with your team. | `public-landing/index.html:499` |
 | `af5ca714d375` | certain | Equity issuance, business filing, and builder compensation. | `public-landing/index.html:509` |
@@ -1362,11 +1361,13 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `837fdaa0936a` | certain | Nothing matches that. | `public-landing/projects.html:556` |
 | `8329bb1a3693` | certain | One tap files the request and the platform starts standing your project up — server, database, address. Here's | `public-landing/projects.html:882` |
 | `86cde1930d84` | certain | Only mine | `public-landing/projects.html:394` |
+| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `public-landing/index.html:546` |
+| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `public-landing/projects.html:980` |
 | `275ca0d5ce65` | certain | Open source. | `public-landing/index.html:499` |
 | `94c67d09c97c` | certain | Open the map → | `public-landing/index.html:476` |
 | `b4a3643706ac` | certain | Open → | `public-landing/projects.html:466` |
 | `d4e9bf625ab3` | certain | Pick one of your repositories | `public-landing/projects.html:803` |
-| `8addc4b11b13` | certain | Pick the shape that fits best — it labels the project on the map. Not sure is a fine answer. | `public-landing/projects.html:749` |
+| `65635b58dfab` | certain | Pick the shape that fits best — it’s how the project is listed on the map, and it stays as you pick it for now | `public-landing/projects.html:749` |
 | `92c7055aa799` | certain | Project handle | `public-landing/projects.html:852` |
 | `8b4663ad561c` | certain | Project hub | `public-landing/projects.html:357` |
 | `edab0ed81a40` | certain | Project name | `public-landing/projects.html:728` |
@@ -1400,6 +1401,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0b1330bed905` | certain | Starting point | `public-landing/projects.html:775` |
 | `decfc9512772` | certain | Switch light / dark | `public-landing/projects.html:371` |
 | `25bdf1bf7113` | certain | Switch light or dark mode | `public-landing/projects.html:371` |
+| `d75633cc707d` | certain | Take it offline | `public-landing/projects.html:660` |
 | `d3ce1efd0e67` | certain | Tearing down stops the project’s server and its nightly backups. It does | `public-landing/projects.html:668` |
 | `f6584b0a728b` | certain | The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry | `public-landing/index.html:426` |
 | `72e85e8b6f47` | certain | The drums are rolling | `public-landing/projects.html:896` |

package/docs/copy-registry.json

@@ -3,11 +3,11 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1381,
-    "unique_ids": 1225,
-    "certain": 1381,
+    "strings": 1383,
+    "unique_ids": 1226,
+    "certain": 1383,
     "heuristic": 0,
-    "duplicate_ids": 126
+    "duplicate_ids": 127
   },
   "surfaces": {
     "builders-hall": {
@@ -23,7 +23,7 @@
     "landing": {
       "at": "public-landing",
       "files": 2,
-      "strings": 187
+      "strings": 189
     }
   },
   "blind_spots": [
@@ -818,6 +818,16 @@
         "modules/hall-ui/public/work.js:341"
       ]
     },
+    {
+      "id": "cbfdd6ac4ec8",
+      "surface": "landing",
+      "text": "Open source (AGPL-3.0)",
+      "occurrences": 2,
+      "at": [
+        "public-landing/index.html:546",
+        "public-landing/projects.html:980"
+      ]
+    },
     {
       "id": "855277dff074",
       "surface": "builders-hall",
@@ -11572,15 +11582,6 @@
       "origin": "html-attr:aria-label",
       "confidence": "certain"
     },
-    {
-      "id": "b228633307df",
-      "surface": "landing",
-      "text": "Delete the project",
-      "file": "public-landing/projects.html",
-      "line": 660,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "47d1558b17a3",
       "surface": "landing",
@@ -11878,6 +11879,24 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "cbfdd6ac4ec8",
+      "surface": "landing",
+      "text": "Open source (AGPL-3.0)",
+      "file": "public-landing/index.html",
+      "line": 546,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
+    {
+      "id": "cbfdd6ac4ec8",
+      "surface": "landing",
+      "text": "Open source (AGPL-3.0)",
+      "file": "public-landing/projects.html",
+      "line": 980,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "275ca0d5ce65",
       "surface": "landing",
@@ -11915,9 +11934,9 @@
       "confidence": "certain"
     },
     {
-      "id": "8addc4b11b13",
+      "id": "65635b58dfab",
       "surface": "landing",
-      "text": "Pick the shape that fits best — it labels the project on the map. Not sure is a fine answer.",
+      "text": "Pick the shape that fits best — it’s how the project is listed on the map, and it stays as you pick it for now. Not sure is a fine answer.",
       "file": "public-landing/projects.html",
       "line": 749,
       "origin": "html-text",
@@ -12220,6 +12239,15 @@
       "origin": "html-attr:aria-label",
       "confidence": "certain"
     },
+    {
+      "id": "d75633cc707d",
+      "surface": "landing",
+      "text": "Take it offline",
+      "file": "public-landing/projects.html",
+      "line": 660,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "d3ce1efd0e67",
       "surface": "landing",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.329",
+  "version": "1.19.331",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.329",
+      "version": "1.19.331",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.329",
+  "version": "1.19.331",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -348,6 +348,10 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    the browser's default blue, the one colour in the page that is not ours */
 .finePrint a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .finePrint a:hover{text-decoration:underline;}
+/* the footer's licence link (owner decision 10, 2026-08-24) — the same link
+   ink as fine print, so it never falls back to the browser's blue */
+.foot a{color:var(--link-ink);font-weight:700;text-decoration:none;}
+.foot a:hover{text-decoration:underline;}
 
 /* ── progress strips: one visual, per-flow vocabularies (direction §4).
    Default = the sea-blue "working" look; .isLive = verified-landed green;

package/public-landing/index.html

@@ -543,7 +543,7 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 <!-- The footer line SPLITS. Its first half is a claim about the platform itself
      and is untrue of a project built on it, so only the attribution half travels.
      (Today's page ships the whole line to every instance — this is that fix.) -->
-<div class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos.</div>
+<div class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</div>
 
 <script>
 (function () {

package/public-landing/projects.html

@@ -78,7 +78,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 @keyframes fadeStep{from{opacity:0;transform:translateX(10px)}to{opacity:1;transform:none}}
 /* show() moves focus to each panel's h1 for keyboard/SR context — keep the
    focus, lose the ring (a black rectangle around a heading; owner walk) */
-h1[tabindex="-1"]:focus{outline:none;}
+h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 /* the done step needs the full card width — the split collapses and the
    bongo pair steps aside for the checklist */
 .createSplit.wizDone{display:block;}
@@ -657,7 +657,7 @@ h1[tabindex="-1"]:focus{outline:none;}
            name typed back: it is the only control on this page that ends
            something, and the card's one-click confirm is too light for it. -->
       <div class="card" id="mDelete">
-        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Delete the project</h2>
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Take it offline</h2>
         <div id="mDel"><p class="finePrint">Reading the project…</p></div>
         <!-- the teardown-vs-delete distinction, stated once as a SIBLING of the
              volatile slot (the #mRepoVisWhy shape) so no re-render can drop it.
@@ -746,7 +746,7 @@ h1[tabindex="-1"]:focus{outline:none;}
                forced into a wrong answer, and it can change later. -->
           <section class="panel" id="panel-type" aria-labelledby="type-h">
             <h1 id="type-h">What kind of project is it?</h1>
-            <p class="lede">Pick the shape that fits best — it labels the project on the map. Not sure is a fine answer.</p>
+            <p class="lede">Pick the shape that fits best — it’s how the project is listed on the map, and it stays as you pick it for now. Not sure is a fine answer.</p>
             <form data-next="3">
               <div class="typeCards" id="typeCards" role="group" aria-label="Project type">
                 <button type="button" class="tpill" data-type="game" aria-pressed="false">Game</button>
@@ -977,7 +977,7 @@ h1[tabindex="-1"]:focus{outline:none;}
   </div>
 </section>
 
-<div class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>.</div>
+<div class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</div>
 
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this
@@ -3505,6 +3505,10 @@ h1[tabindex="-1"]:focus{outline:none;}
   };
   function groupFor(inst) {
     if (inst.status === 'active' && inst.last_verified_up === false) return 'attention';
+    /* the card shows its red error paragraph under exactly this condition
+       (renderCard) — a project the owner is being told about cannot sit under
+       Live. The intent-vs-status contract is deliberately left alone. */
+    if (inst.error_note && !inst.open_intent) return 'attention';
     return STATE_GROUP[inst.status] || 'all';
   }
   function findText(inst) {
@@ -3779,8 +3783,8 @@ h1[tabindex="-1"]:focus{outline:none;}
        both the honest word and the accurate one, since a revive re-uses exactly
        this hostname. */
     return inst && inst.hosting_shape === 'dedicated'
-      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back.'
-      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back.';
+      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.'
+      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
   }
 
   function addressRow(inst) {

package/src/bongos/routes/auth.js

@@ -273,18 +273,27 @@ function configuredOAuthOrigin() {
 // was stashed for this sign-in. Configurable per instance via
 // branding.landing.postLogin (env override <PREFIX>_POST_LOGIN_LANDING) so a
 // platform-home instance can land visitors on its OWN front door —
-// cloudbongos.com sets it to /gate/ (the orbs) so a visitor who signs in from
-// the orbs returns to the orbs, never auto-redirected into the builders' hall
-// (task 1002240). Every other instance keeps the portable default '/builders':
-// the hall always exists, a /gate/ orbs site does not. The configured value is
-// run through the SAME open-redirect allowlist as ?return= (safeReturnTo), so a
-// misconfigured landing can never become an open redirect; anything unsafe or
-// absent falls back to '/builders'. Takes an optional resolved pack so the pure
-// path is unit-testable without disk I/O (mirrors clientBranding()).
+// cloudbongos.com points it at '/' (its landing page) so a visitor who signs in
+// from the front door returns to it, never auto-redirected into the builders'
+// hall (task 1002240). Every other instance keeps the portable default
+// '/builders': the hall always exists, a front door of its own may not. The
+// configured value is run through the SAME open-redirect allowlist as ?return=
+// (safeReturnTo), so a misconfigured landing can never become an open redirect;
+// anything unsafe or absent falls back to '/builders'. Takes an optional
+// resolved pack so the pure path is unit-testable without disk I/O (mirrors
+// clientBranding()).
+//
+// /gate/ — the orb sky this knob was first written for — was retired with the
+// landing-page front door (task 1002743) and the apex answers a bare 404 there,
+// so a pack still pointing at it would land every cookie-less sign-in on a
+// 404. It folds to '/' instead (task 1003233).
+const RETIRED_LANDINGS = new Set(['/gate']);
 function postLoginLanding(brand) {
   try {
     const b = brand || branding();
-    return safeReturnTo(b.landing?.postLogin) || '/builders';
+    const configured = safeReturnTo(b.landing?.postLogin) || '/builders';
+    const bare = configured.replace(/\/+$/, '').split('?')[0] || '/';
+    return RETIRED_LANDINGS.has(bare) ? '/' : configured;
   } catch {
     return '/builders';
   }
@@ -568,7 +577,7 @@ module.exports = function buildAuthRouter() {
       // Land back where sign-in began if a validated return target was stashed
       // (e.g. the builders subdomain bounced through here); else the instance's
       // configured post-login landing (default '/builders'; cloudbongos.com →
-      // /gate/, the orbs — task 1002240).
+      // '/', its landing page — task 1002240).
       const returnTo = safeReturnTo(parseCookie(req, RETURN_COOKIE));
       res.clearCookie(RETURN_COOKIE, domainOpts);
       res.redirect(returnTo || postLoginLanding());

package/src/module-api.js

@@ -1085,8 +1085,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.327 with no explicit bump. run 32786284063. (task 1002620)
 //   1.19.329 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.328 with no explicit bump. run 32788827293. (task 1002620)
+//   1.19.330 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.329 with no explicit bump. run 32789596635. (task 1002620)
+//   1.19.331 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.330 with no explicit bump. run 32791877167. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.329'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.331'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/post_login_landing.mjs

@@ -1,42 +1,42 @@
-// tests/post_login_landing.mjs — the configurable post-sign-in landing (task 1002240).
+// tests/post_login_landing.mjs — where a cookie-less sign-in lands (task 1003233,
+// the pre-walk ops check for goal 1000058).
 //
-// postLoginLanding(brand) resolves the redirect target used after a successful
-// web sign-in when NO explicit ?return= / same-apex Referer was carried. It is
-// the ONE seam that lets a platform-home instance (cloudbongos.com) land a
-// visitor back on its orbs (/gate/) instead of the builders' hall, while every
-// other instance keeps the portable '/builders' default (the hall always
-// exists; a /gate/ orbs site does not). Pure over an injected brand pack, and
-// hardened through the SAME open-redirect allowlist as ?return= (safeReturnTo),
-// so a misconfigured landing can never become an open redirect.
-//
-// Pure function, no DB — requiring the route module does not open a pool.
+// The walk found that config/branding.neutral.json still documented the
+// platform-home landing as '/gate/' — the orb sky retired with the landing-page
+// front door (task 1002743), a bare 404 on the apex since. The live instance
+// pack already points at '/', so nothing was broken on the box; this pins the
+// fold that keeps an old pack from ever landing a founder on that 404, and the
+// note that no longer sends an operator there.
 
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
 import { createRequire } from 'node:module';
-const require = createRequire(import.meta.url);
-const { postLoginLanding } = require('../src/bongos/routes/auth.js');
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-let pass = 0, fail = 0;
-function ok(cond, msg) {
-  if (cond) { pass++; console.log(`  ok  ${msg}`); }
-  else { fail++; console.log(`  FAIL ${msg}`); }
-}
-
-console.log('\npostLoginLanding — portable default is the hall:');
-ok(postLoginLanding({}) === '/builders', 'no landing config → /builders');
-ok(postLoginLanding({ landing: {} }) === '/builders', 'empty landing block → /builders');
-// No-arg path reads the real committed neutral pack, which ships postLogin:'/builders'.
-ok(postLoginLanding() === '/builders', 'committed neutral pack → /builders');
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { postLoginLanding } = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
 
-console.log('\npostLoginLanding — an instance lands visitors on its own front door:');
-ok(postLoginLanding({ landing: { postLogin: '/gate/' } }) === '/gate/', 'cloudbongos orbs → /gate/');
-ok(postLoginLanding({ landing: { postLogin: '/gate/?entered=1' } }) === '/gate/?entered=1', 'relative path with query preserved');
+test('a pack that still names the retired /gate/ lands on the front door, not a 404', () => {
+  assert.equal(postLoginLanding({ landing: { postLogin: '/gate/' } }), '/');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/gate' } }), '/');
+});
 
-console.log('\npostLoginLanding — a misconfigured landing can never become an open redirect:');
-ok(postLoginLanding({ landing: { postLogin: 'https://evil.com/' } }) === '/builders', 'foreign https origin → fallback');
-ok(postLoginLanding({ landing: { postLogin: '//evil.com' } }) === '/builders', 'protocol-relative → fallback');
-ok(postLoginLanding({ landing: { postLogin: 'javascript:alert(1)' } }) === '/builders', 'javascript: scheme → fallback');
-ok(postLoginLanding({ landing: { postLogin: '/a\\b' } }) === '/builders', 'backslash path → fallback');
-ok(postLoginLanding({ landing: { postLogin: 42 } }) === '/builders', 'non-string value → fallback');
+test('every live landing passes through untouched; absent or unsafe falls back to the hall', () => {
+  assert.equal(postLoginLanding({ landing: { postLogin: '/' } }), '/', 'cloudbongos.com today');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/projects' } }), '/projects');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/builders' } }), '/builders');
+  assert.equal(postLoginLanding({ landing: {} }), '/builders');
+  assert.equal(postLoginLanding({}), '/builders');
+  assert.equal(postLoginLanding({ landing: { postLogin: 'https://evil.example/x' } }), '/builders', 'the open-redirect allowlist still governs');
+  assert.equal(postLoginLanding({ landing: { postLogin: '//evil.example' } }), '/builders');
+});
 
-console.log(`\nPost-login-landing tests: ${pass} passed, ${fail} failed`);
-if (fail) process.exit(1);
+test('the neutral pack no longer documents the retired landing as live', () => {
+  const pack = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/branding.neutral.json'), 'utf8'));
+  assert.equal(pack.landing.postLogin, '/builders', 'the portable default is unchanged');
+  assert.doesNotMatch(pack.landing._note, /'\/gate\/', the orbs/, 'the note stops calling /gate/ a front door');
+  assert.match(pack.landing._note, /retired '\/gate\/'/, 'and says what became of it');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -15,6 +15,7 @@ const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 // anchored regexes below reason about line ends
 const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
 const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
+const INDEX = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
 
 // a function's text runs from its declaration to the next declaration in the
@@ -264,3 +265,47 @@ test('a heartbeat re-render keeps an open fold open and a half-typed domain type
   const set = card.indexOf('li.innerHTML = orbFor(inst)');
   assert.ok(card.indexOf('var keepOpen') < set && card.indexOf('if (fold && keepOpen) fold.open = true;') > set, 'read before the swap, restore after it');
 });
+
+/* ── the owner's five calls of 2026-08-24 (task 1003250) ── */
+test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying nothing erases', () => {
+  const del = (HUB.match(/<div class="card" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
+  assert.ok(del, '#mDelete exists');
+  assert.match(del, /<h2[^>]*>Take it offline<\/h2>/, 'the heading says what the control does');
+  assert.doesNotMatch(HUB, /Delete the project/, 'the word "Delete" no longer promises an erase anywhere on the page');
+  const truth = fn('teardownTruth');
+  assert.equal((truth.match(/until you bring it back\. Nothing here erases a project\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
+});
+
+test('decision 5 — the Type step says the type is fixed for now', () => {
+  const type = (HUB.match(/<section class="panel" id="panel-type"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(type, '#panel-type exists');
+  assert.match(type, /<p class="lede">Pick the shape that fits best — it’s how the project is listed on the map, and it stays as you pick it for now\. Not sure is a fine answer\.<\/p>/);
+});
+
+test('decision 8 — a card carrying a red error paragraph never tallies under Live', () => {
+  const g = fn('groupFor');
+  const down = g.indexOf("if (inst.status === 'active' && inst.last_verified_up === false) return 'attention';");
+  const err = g.indexOf("if (inst.error_note && !inst.open_intent) return 'attention';");
+  const table = g.indexOf('return STATE_GROUP[inst.status]');
+  assert.ok(down >= 0 && err > down && err < table, 'the rule sits after the down-probe override and before the status table');
+  // the same predicate renderCard uses to show the paragraph — the two cannot drift apart
+  assert.match(fn('renderCard'), /if \(\(inst\.status === 'error' \|\| inst\.error_note\) && !inst\.open_intent\) \{/);
+  assert.doesNotMatch(g, /open_intent\.action/, 'the intent-vs-status contract is left alone');
+});
+
+test('decision 9 — only mouse-driven focus on a wizard heading goes ringless', () => {
+  assert.match(HUB, /h1\[tabindex="-1"\]:focus:not\(:focus-visible\)\{outline:none;\}/);
+  assert.doesNotMatch(HUB, /h1\[tabindex="-1"\]:focus\{outline:none;\}/, 'the blanket suppression is gone');
+});
+
+test('decision 10 — both footers carry the open-source (AGPL-3.0) link, in link ink', () => {
+  const AGPL = /<a href="https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0\.html" target="_blank" rel="noopener">Open source \(AGPL-3\.0\)<\/a>\./;
+  const hubFoot = (HUB.match(/<div class="foot">[\s\S]*?<\/div>/) || [''])[0];
+  const indexFoot = (INDEX.match(/<div class="foot">[\s\S]*?<\/div>/) || [''])[0];
+  assert.match(hubFoot, AGPL, 'projects.html');
+  assert.match(indexFoot, AGPL, 'index.html');
+  // the link sits OUTSIDE the apex-only span, so a child instance keeps it too
+  assert.ok(hubFoot.indexOf('<!--apex-only:end-->') < hubFoot.search(AGPL), 'projects.html: after the apex-only block');
+  assert.ok(indexFoot.indexOf('<!--apex-only:end-->') < indexFoot.search(AGPL), 'index.html: after the apex-only block');
+  assert.match(COSMOS, /\.foot a\{color:var\(--link-ink\);font-weight:700;text-decoration:none;\}/, 'never the browser’s blue');
+});