@bongos/core 1.19.330 → 1.19.332

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.330",
-  "core_contract": "1.19.330",
-  "source_commit": "acf9d9dd29679f6c527824b2803950999664958e",
+  "core_version": "1.19.332",
+  "core_contract": "1.19.332",
+  "source_commit": "e2808f7a5ce4556d6265f326004a0cc87f463841",
   "source_ref": "HEAD",
-  "built_at": "2026-08-24T23:30:13.047Z",
+  "built_at": "2026-08-25T00:18:07.252Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 324,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1811,
-  "tree_sha256": "40c5457e809c4588d34d3be61fccf5c49606fc002cbf64170aaf50c56ffa7652",
+  "tree_sha256": "e1c90c92977490868bc70a33b665c39305e4a5ec7c2b8af2f042df1ad8151de5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "d1d2622e002edaed8a98deb8b69ff5a77c6eeab7993e3b0e7f1513f32ff027c6"
+      "sha256": "7b204f9621ced68ef54b9f74aa8fbec53ab2fa81b0380133c762950ac4de1479"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -4667,12 +4667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9bb6d40a874f3fa2ac02ff97883933dd86765c7c0d0f12aee6914961584b9702"
+      "sha256": "bc62624584d42e3c04dda858b69f3fdbb1c09db67d54c46b1e7601f004c2eca9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2b5ad8d6ae7d079ecc2d53f39c32f076521b843514fe80b71851f80440463ab6"
+      "sha256": "be5885b562847832c030b3dcbed240eb204a1c648eb6835d0b3bddb107aec2f6"
     },
     {
       "path": "public-docs/index.html",
@@ -4912,7 +4912,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "a7f21729b00719b22cfd13c14b33d87f4fdd8aaa2890a174bfc36d1b53c1e5e4"
+      "sha256": "2a258be2790a6fadd1c2d9e190675c62e2b68dddece65f497b4e983c6d9b9146"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -4932,7 +4932,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "203b726527c02ed0383945c431df062ae6f02ed64cadc7942f9fef3e587a9da6"
+      "sha256": "44474703a87cecfa8f80ecbca6ecfb03d4fc3ccf166fe26bc4c310f404f5f76a"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -6342,7 +6342,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "c5688194f21600a64ced6b27aa5c12b4f580db786ffcf85a151422635269aa40"
+      "sha256": "bb62110c21a07745a8bcfd3e2cf94f29deec1de5baea9d62fa903febcca54f2b"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -6452,7 +6452,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "da4209544a6cd0b389cccc563cd45f6c04fc22816f7b132772024f77fa2900f8"
+      "sha256": "34ffbdddcf9e14262f980f9badc4f19eee6235321572aeb71809810eb09b32b5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8277,7 +8277,7 @@
     {
       "path": "tests/post_login_landing.mjs",
       "mode": "0000644",
-      "sha256": "942b2a9b0d5e2d2dd337b3ff738b7193ce0936d196a936f61bef51b74ed11ad0"
+      "sha256": "08a7496090f4617cef7e270afddcef8ee3a0b58bff6920b56bc2f2bbb49ed4ca"
     },
     {
       "path": "tests/pre_compact.mjs",
@@ -8332,7 +8332,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "a3cea371bb80b2dc05762a11bc43de84667f06db8723e384b34073e48fdfda6a"
+      "sha256": "c30221f0cb0b23b7f18b2edffd26cb895038543b07ee87c7a401508131edfc1a"
     },
     {
       "path": "tests/promote_goal_id.mjs",

package/config/branding.neutral.json

@@ -103,7 +103,7 @@
     }
   },
   "landing": {
-    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/gate/', the orbs). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
+    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/', its landing page; the retired '/gate/' orb sky folds to '/' — task 1003233). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
     "postLogin": "/builders"
   },
   "envPrefix": "CLOUDBONGOS"

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.330",
+  "version": "1.19.332",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.330",
+      "version": "1.19.332",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.330",
+  "version": "1.19.332",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -414,6 +414,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* ── page-level bits ── */
 .alert{display:none;background:var(--err-soft);border:2px solid color-mix(in srgb,var(--err) 25%,transparent);color:var(--err);font-weight:600;font-size:14px;border-radius:14px;padding:12px 16px;margin-bottom:18px;}
 .alert.on{display:block;}
+/* the raw server text folds under the alert's plain sentence (task 1003244) */
+.alert details{margin-top:8px;}
+.alert summary{cursor:pointer;font-size:12.5px;font-weight:700;}
+.alert details p{margin-top:6px;font-family:var(--font-mono);font-size:12px;font-weight:500;overflow-wrap:anywhere;}
 .loading{font-size:14.5px;font-weight:600;color:var(--ink-faint);padding:14px 0;}
 .empty{border:2px dashed var(--line);border-radius:18px;padding:22px;text-align:center;}
 .empty p{font-size:14.5px;font-weight:600;color:var(--ink-soft);margin-bottom:14px;line-height:1.55;}

package/public-landing/projects.html

@@ -614,7 +614,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
              stripFor/errMarkup/canRetry/canRevive the list card reads -->
         <div id="mStrip"></div>
         <div class="projMsg err" id="mErr" hidden></div>
-        <div class="projMsg" id="mMsg"></div>
+        <div class="projMsg" id="mMsg" role="status" aria-live="polite"></div>
         <div class="actions" id="mActs" hidden></div>
       </div>
 
@@ -683,7 +683,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   <div class="wrap viewWrap">
     <div class="card">
       <ol class="steps" aria-label="Creation steps">
-        <li class="now" data-step="1"><span class="snum">1</span><span class="slbl">Name</span></li>
+        <li class="now" data-step="1" aria-current="step"><span class="snum">1</span><span class="slbl">Name</span></li>
         <li data-step="2"><span class="snum">2</span><span class="slbl">Type</span></li>
         <li data-step="3"><span class="snum">3</span><span class="slbl">Home</span></li>
         <li data-step="4"><span class="snum">4</span><span class="slbl">Address</span></li>
@@ -2400,16 +2400,27 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
        Six steps since task 1002772: gate 0 · name 1 · type 2 · home 3 ·
        address 4 · review 5 · done 6 (the rail shows 1-5; done marks it all). */
     var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-home', 4: 'panel-address', 5: 'panel-review', 6: 'panel-done' };
+    /* the rail at the done panel (task 1003244): "done" is the Create step
+       still running — the marker stays on 5 until the project actually
+       answers, and only then does the whole rail read finished. aria-current
+       tells a screen reader the same thing. */
+    function paintRail(step) {
+      var landed = step === 6 && !!(live && live.instStatus === 'active');
+      var cur = step === 6 ? 5 : step;
+      root.querySelectorAll('.steps li').forEach(function (li) {
+        var n = Number(li.getAttribute('data-step'));
+        var now = !landed && n === cur;
+        li.classList.toggle('now', now);
+        li.classList.toggle('done', landed || n < cur);
+        if (now) li.setAttribute('aria-current', 'step'); else li.removeAttribute('aria-current');
+      });
+    }
     function show(step, moveFocus) {
       state.step = step;
       Object.keys(panels).forEach(function (k) {
         $(panels[k]).classList.toggle('on', Number(k) === step);
       });
-      root.querySelectorAll('.steps li').forEach(function (li) {
-        var n = Number(li.getAttribute('data-step'));
-        li.classList.toggle('now', n === step);
-        li.classList.toggle('done', n < step || step === 6);
-      });
+      paintRail(step);
       saveDraft();
       /* the done step takes the whole card — the bongo pair steps aside */
       root.querySelector('.createSplit').classList.toggle('wizDone', step === 6);
@@ -2782,14 +2793,24 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     }
 
     /* ── create ── */
+    /* the mapped codes are headline-only; anything else gets a fixed owner
+       sentence with the raw text folded under Technical details (direction
+       §5.1, task 1003244) — operator text is never the headline */
     function friendlyCreateError(err) {
       var code = err && err.data && err.data.error && (err.data.error.code || '');
       if (code === 'slug_taken') return 'That handle is already taken by another project. Pick a different one.';
       if (code === 'bad_slug') return 'The handle didn’t pass the server’s checks — 2–40 lowercase letters, numbers, or dashes.';
-      if (code === 'domain_reserved') return 'That address is reserved for the platform itself. Pick a different handle, or bring a domain you own.';
+      /* both server branches: a reserved hostname, and any name under the platform's own apex */
+      if (code === 'domain_reserved') return 'That address belongs to the platform’s own domain — your project already gets its own address there from its handle. Use a domain you own instead.';
       if (code === 'domain_taken') return 'That address is already held by another project. Pick a different handle or domain.';
       if (code === 'bad_domain') return 'The domain didn’t parse as a real hostname — use something like myproject.example.com.';
-      return 'Couldn’t file the request: ' + (err && err.message ? err.message : 'something went sideways. Try again.');
+      if (code === 'repo_scope_required') return 'GitHub hasn’t granted repository access for this session. Sign in again — it asks for repository access — and try once more.';
+      if (code === 'request_failed') return 'The platform couldn’t file the request. Nothing was created — try again in a moment.';
+      return '';
+    }
+    function createFailureMarkup(err) {
+      return 'We couldn’t file the request just now. Nothing was created — you can try again.' +
+        '<details><summary>Technical details</summary><p>' + esc(err && err.message ? err.message : 'no detail came back') + '</p></details>';
     }
 
     /* Fresh + repo access: auto-create the empty GitHub repo NOW (the commit moment),
@@ -2901,7 +2922,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
           $('h-home').className = 'hint err';
           return;
         }
-        alertBox.textContent = friendlyCreateError(err);
+        var friendly = friendlyCreateError(err);
+        if (friendly) alertBox.textContent = friendly;
+        else alertBox.innerHTML = createFailureMarkup(err);
         alertBox.classList.add('on');
       });
     });
@@ -2918,7 +2941,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
 
     var instanceId = null;             /* set when a create lands / a resumed watch starts */
-    var live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
+    var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'device-flow', 'app-install', 'first-sign-in', 'enter-hall'];
@@ -3000,8 +3023,15 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code> is live.</p></li>';
       }
       if (live.manifest === 'error' || live.manifest === 'expired') {
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' +
-          (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
+        /* a plain sentence first; the raw route text folds under Technical
+           details (task 1003244). The one refusal a founder can act on — no
+           address yet — says where to go instead of what the server said. */
+        var snag, raw = '';
+        if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
+        else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from <a href="?view=mine">your projects page</a>, then come back to this step.';
+        else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
+          (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
           '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
       }
       if (live.manifest === 'code_received') {
@@ -3186,6 +3216,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         return res.json().catch(function () { return {}; }).then(function (d) {
           if (!res.ok) {
             var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
+            e.code = (d.error && d.error.code) || '';
             throw e;
           }
           return d;
@@ -3206,6 +3237,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         if (String(err && err.message) === 'signing in') return;
         if (tab) { try { tab.close(); } catch (e) {} }
         live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+        live.manifestCode = String((err && err.code) || '');
         renderSteps();
       });
     }
@@ -3380,7 +3412,10 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
-            if (inst && inst.status !== live.instStatus) { live.instStatus = inst.status; renderSteps(); }
+            if (inst && inst.status !== live.instStatus) {
+              live.instStatus = inst.status; renderSteps();
+              if (state.step === 6) paintRail(6);   /* the rail finishes only when the project answers */
+            }
             var terminal = renderProgress(inst);
             if (!terminal) pollTimer = setTimeout(tick, 5000);
             else stopPolling();
@@ -3412,7 +3447,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         instanceId = null;
         watchPending = false; manifestPending = false; manifestState = null;
         manifestStartedAt = 0; manifestStale = false;
-        live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
+        live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
         lastStepsHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
         state = { step: 1, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
@@ -3882,7 +3917,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
           : '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>');
     }
     var lm = lastMsg[inst.id];
-    body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '">' + (lm ? lm.text : '') + '</div>';
+    /* a live region: an action's result is announced where the pointer is,
+       not only painted (task 1003244) */
+    body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '" role="status" aria-live="polite">' + (lm ? lm.text : '') + '</div>';
     /* every owned card opens its manage view (task 1003041) — a real link, so
        middle/ctrl-click works; the delegated handler upgrades a plain click */
     var acts = ['<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>'];
@@ -3903,12 +3940,51 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var keepOpen = !!(oldFold && oldFold.open);
     var typed = oldInput && oldInput.value !== oldInput.defaultValue ? oldInput.value : '';
     var hadFocus = !!oldInput && document.activeElement === oldInput;
+    /* focus anywhere else on the card (a door, a confirm, the fold's summary)
+       comes back to the same control — or the nearest one — after the swap;
+       quietActions() leaves a note when a disabled button already let go */
+    var wasInside = li.contains(document.activeElement) && document.activeElement !== li;
+    var prefer = wasInside ? focusKeyOf(document.activeElement) : null;
+    var focusBack = wasInside || li.hasAttribute('data-focus-back');
+    li.removeAttribute('data-focus-back');
     li.innerHTML = orbFor(inst) + '<div class="projBody">' + body + '</div>';
     var fold = li.querySelector('details.attachFold');
     var input = fold ? fold.querySelector('input') : null;
     if (fold && keepOpen) fold.open = true;
     if (input && typed) input.value = typed;
     if (input && hadFocus) input.focus();
+    else if (focusBack) focusCardControl(inst.id, prefer);
+  }
+
+  /* ── keeping focus on the card through a re-render (task 1003244) ── */
+
+  /* which control had focus, as a selector the rebuilt card can answer;
+     a confirm's Yes/Keep lands back on the door that opened it */
+  function focusKeyOf(el) {
+    if (!el || !el.getAttribute) return null;
+    if (el.tagName === 'SUMMARY') return 'details.attachFold summary';
+    if (el.hasAttribute('data-teardown-yes') || el.hasAttribute('data-teardown-no')) return '[data-teardown]';
+    var keys = ['data-manage', 'data-attach', 'data-retry', 'data-revive', 'data-teardown'];
+    for (var i = 0; i < keys.length; i++) if (el.hasAttribute(keys[i])) return '[' + keys[i] + ']';
+    return null;
+  }
+  function focusCardControl(id, prefer) {
+    var li = liFor(id);
+    if (!li) return;
+    var t = (prefer && li.querySelector(prefer)) ||
+      li.querySelector('.actions a, .actions button') ||
+      li.querySelector('details.attachFold summary');
+    if (t) t.focus();
+  }
+  /* an action in flight: the row stays put and its buttons go quiet, so
+     nothing under the pointer is deleted mid-click; a button that held
+     focus lets go when disabled, so the card remembers to take it back */
+  function quietActions(id) {
+    var act = $('act-' + id);
+    if (!act) return;
+    var li = liFor(id);
+    if (li && act.contains(document.activeElement)) li.setAttribute('data-focus-back', '');
+    act.querySelectorAll('button').forEach(function (b) { b.disabled = true; });
   }
 
   function render(instances) {
@@ -4465,16 +4541,20 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var act = $('act-' + id);
     if (!act) return;
     cardAsking = String(id);
-    act.innerHTML = '<div class="confirmRow">' +
+    act.innerHTML = '<div class="confirmRow" tabindex="-1">' +
       '<span class="plain">Tear it down? ' + teardownTruth(byId[id]) + '</span>' +
       '<button type="button" class="btn small danger" data-teardown-yes="' + esc(id) + '">Yes, tear it down</button>' +
       '<button type="button" class="linklike" data-teardown-no="' + esc(id) + '">Keep it running</button></div>';
+    /* the pressed button is gone — focus lands on the question itself, so
+       the truth is read before Tab reaches Yes (task 1003244) */
+    var row = act.firstChild;
+    if (row && row.focus) row.focus();
   }
   function unAskTeardown(id) { cardAsking = null; var inst = byId[id]; if (inst) renderCard(inst); }
   function doTeardown(id) {
     cardAsking = null;
-    var act = $('act-' + id);
-    if (act) act.innerHTML = '<span class="projMsg">Asking…</span>';
+    quietActions(id);
+    msg(id, 'Asking…');
     fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/teardown', {
       method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: '{}'
     }).then(function (res) {
@@ -4501,8 +4581,8 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     }).catch(function () {
       msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
     }).then(function () {
-      /* restore the actions row ("Asking…" replaced it) even when the state
-         didn't change, then pick up whatever DID change */
+      /* wake the quieted row even when the state didn't change (renderCard
+         also hands focus back), then pick up whatever DID change */
       if (byId[id]) renderCard(byId[id]);
       watchOnce(id);
     });
@@ -4515,8 +4595,8 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   function reProvision(id, verb) {
     var inst = byId[id];
     if (!inst) return;
-    var act = $('act-' + id);
-    if (act) act.innerHTML = '<span class="projMsg">Asking…</span>';
+    quietActions(id);
+    msg(id, 'Asking…');
     var body = { slug: inst.slug, hosting_shape: inst.hosting_shape || 'standalone' };
     if (inst.onboard_mode) body.onboard_mode = inst.onboard_mode;
     if (inst.target_ref) body.target_ref = inst.target_ref;

package/src/bongos/routes/auth.js

@@ -273,18 +273,27 @@ function configuredOAuthOrigin() {
 // was stashed for this sign-in. Configurable per instance via
 // branding.landing.postLogin (env override <PREFIX>_POST_LOGIN_LANDING) so a
 // platform-home instance can land visitors on its OWN front door —
-// cloudbongos.com sets it to /gate/ (the orbs) so a visitor who signs in from
-// the orbs returns to the orbs, never auto-redirected into the builders' hall
-// (task 1002240). Every other instance keeps the portable default '/builders':
-// the hall always exists, a /gate/ orbs site does not. The configured value is
-// run through the SAME open-redirect allowlist as ?return= (safeReturnTo), so a
-// misconfigured landing can never become an open redirect; anything unsafe or
-// absent falls back to '/builders'. Takes an optional resolved pack so the pure
-// path is unit-testable without disk I/O (mirrors clientBranding()).
+// cloudbongos.com points it at '/' (its landing page) so a visitor who signs in
+// from the front door returns to it, never auto-redirected into the builders'
+// hall (task 1002240). Every other instance keeps the portable default
+// '/builders': the hall always exists, a front door of its own may not. The
+// configured value is run through the SAME open-redirect allowlist as ?return=
+// (safeReturnTo), so a misconfigured landing can never become an open redirect;
+// anything unsafe or absent falls back to '/builders'. Takes an optional
+// resolved pack so the pure path is unit-testable without disk I/O (mirrors
+// clientBranding()).
+//
+// /gate/ — the orb sky this knob was first written for — was retired with the
+// landing-page front door (task 1002743) and the apex answers a bare 404 there,
+// so a pack still pointing at it would land every cookie-less sign-in on a
+// 404. It folds to '/' instead (task 1003233).
+const RETIRED_LANDINGS = new Set(['/gate']);
 function postLoginLanding(brand) {
   try {
     const b = brand || branding();
-    return safeReturnTo(b.landing?.postLogin) || '/builders';
+    const configured = safeReturnTo(b.landing?.postLogin) || '/builders';
+    const bare = configured.replace(/\/+$/, '').split('?')[0] || '/';
+    return RETIRED_LANDINGS.has(bare) ? '/' : configured;
   } catch {
     return '/builders';
   }
@@ -568,7 +577,7 @@ module.exports = function buildAuthRouter() {
       // Land back where sign-in began if a validated return target was stashed
       // (e.g. the builders subdomain bounced through here); else the instance's
       // configured post-login landing (default '/builders'; cloudbongos.com →
-      // /gate/, the orbs — task 1002240).
+      // '/', its landing page — task 1002240).
       const returnTo = safeReturnTo(parseCookie(req, RETURN_COOKIE));
       res.clearCookie(RETURN_COOKIE, domainOpts);
       res.redirect(returnTo || postLoginLanding());

package/src/module-api.js

@@ -1087,8 +1087,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.328 with no explicit bump. run 32788827293. (task 1002620)
 //   1.19.330 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.329 with no explicit bump. run 32789596635. (task 1002620)
+//   1.19.331 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.330 with no explicit bump. run 32791877167. (task 1002620)
+//   1.19.332 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.331 with no explicit bump. run 32793033453. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.330'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.332'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/post_login_landing.mjs

@@ -1,42 +1,42 @@
-// tests/post_login_landing.mjs — the configurable post-sign-in landing (task 1002240).
+// tests/post_login_landing.mjs — where a cookie-less sign-in lands (task 1003233,
+// the pre-walk ops check for goal 1000058).
 //
-// postLoginLanding(brand) resolves the redirect target used after a successful
-// web sign-in when NO explicit ?return= / same-apex Referer was carried. It is
-// the ONE seam that lets a platform-home instance (cloudbongos.com) land a
-// visitor back on its orbs (/gate/) instead of the builders' hall, while every
-// other instance keeps the portable '/builders' default (the hall always
-// exists; a /gate/ orbs site does not). Pure over an injected brand pack, and
-// hardened through the SAME open-redirect allowlist as ?return= (safeReturnTo),
-// so a misconfigured landing can never become an open redirect.
-//
-// Pure function, no DB — requiring the route module does not open a pool.
+// The walk found that config/branding.neutral.json still documented the
+// platform-home landing as '/gate/' — the orb sky retired with the landing-page
+// front door (task 1002743), a bare 404 on the apex since. The live instance
+// pack already points at '/', so nothing was broken on the box; this pins the
+// fold that keeps an old pack from ever landing a founder on that 404, and the
+// note that no longer sends an operator there.
 
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
 import { createRequire } from 'node:module';
-const require = createRequire(import.meta.url);
-const { postLoginLanding } = require('../src/bongos/routes/auth.js');
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-let pass = 0, fail = 0;
-function ok(cond, msg) {
-  if (cond) { pass++; console.log(`  ok  ${msg}`); }
-  else { fail++; console.log(`  FAIL ${msg}`); }
-}
-
-console.log('\npostLoginLanding — portable default is the hall:');
-ok(postLoginLanding({}) === '/builders', 'no landing config → /builders');
-ok(postLoginLanding({ landing: {} }) === '/builders', 'empty landing block → /builders');
-// No-arg path reads the real committed neutral pack, which ships postLogin:'/builders'.
-ok(postLoginLanding() === '/builders', 'committed neutral pack → /builders');
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { postLoginLanding } = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
 
-console.log('\npostLoginLanding — an instance lands visitors on its own front door:');
-ok(postLoginLanding({ landing: { postLogin: '/gate/' } }) === '/gate/', 'cloudbongos orbs → /gate/');
-ok(postLoginLanding({ landing: { postLogin: '/gate/?entered=1' } }) === '/gate/?entered=1', 'relative path with query preserved');
+test('a pack that still names the retired /gate/ lands on the front door, not a 404', () => {
+  assert.equal(postLoginLanding({ landing: { postLogin: '/gate/' } }), '/');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/gate' } }), '/');
+});
 
-console.log('\npostLoginLanding — a misconfigured landing can never become an open redirect:');
-ok(postLoginLanding({ landing: { postLogin: 'https://evil.com/' } }) === '/builders', 'foreign https origin → fallback');
-ok(postLoginLanding({ landing: { postLogin: '//evil.com' } }) === '/builders', 'protocol-relative → fallback');
-ok(postLoginLanding({ landing: { postLogin: 'javascript:alert(1)' } }) === '/builders', 'javascript: scheme → fallback');
-ok(postLoginLanding({ landing: { postLogin: '/a\\b' } }) === '/builders', 'backslash path → fallback');
-ok(postLoginLanding({ landing: { postLogin: 42 } }) === '/builders', 'non-string value → fallback');
+test('every live landing passes through untouched; absent or unsafe falls back to the hall', () => {
+  assert.equal(postLoginLanding({ landing: { postLogin: '/' } }), '/', 'cloudbongos.com today');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/projects' } }), '/projects');
+  assert.equal(postLoginLanding({ landing: { postLogin: '/builders' } }), '/builders');
+  assert.equal(postLoginLanding({ landing: {} }), '/builders');
+  assert.equal(postLoginLanding({}), '/builders');
+  assert.equal(postLoginLanding({ landing: { postLogin: 'https://evil.example/x' } }), '/builders', 'the open-redirect allowlist still governs');
+  assert.equal(postLoginLanding({ landing: { postLogin: '//evil.example' } }), '/builders');
+});
 
-console.log(`\nPost-login-landing tests: ${pass} passed, ${fail} failed`);
-if (fail) process.exit(1);
+test('the neutral pack no longer documents the retired landing as live', () => {
+  const pack = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/branding.neutral.json'), 'utf8'));
+  assert.equal(pack.landing.postLogin, '/builders', 'the portable default is unchanged');
+  assert.doesNotMatch(pack.landing._note, /'\/gate\/', the orbs/, 'the note stops calling /gate/ a front door');
+  assert.match(pack.landing._note, /retired '\/gate\/'/, 'and says what became of it');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -309,3 +309,56 @@ test('decision 10 — both footers carry the open-source (AGPL-3.0) link, in lin
   assert.ok(indexFoot.indexOf('<!--apex-only:end-->') < indexFoot.search(AGPL), 'index.html: after the apex-only block');
   assert.match(COSMOS, /\.foot a\{color:var\(--link-ink\);font-weight:700;text-decoration:none;\}/, 'never the browser’s blue');
 });
+
+/* ── the should-fix remainder (task 1003244) ── */
+test('an unmapped create failure gets a plain sentence with the raw text folded under Technical details', () => {
+  const friendly = fn('friendlyCreateError');
+  assert.match(friendly, /return '';\n\s*\}/, 'unmapped codes return nothing — the caller folds them');
+  assert.doesNotMatch(friendly, /Couldn’t file the request: ' \+/, 'the raw message is no longer the headline');
+  for (const code of ['slug_taken', 'bad_slug', 'domain_reserved', 'domain_taken', 'bad_domain', 'repo_scope_required', 'request_failed']) {
+    assert.match(friendly, new RegExp(`code === '${code}'`), `${code} stays headline-only`);
+  }
+  assert.match(friendly, /belongs to the platform’s own domain/, 'domain_reserved covers both server branches');
+  assert.match(fn('createFailureMarkup'), /Nothing was created — you can try again\.' \+\n\s*'<details><summary>Technical details<\/summary><p>' \+ esc\(err && err\.message/);
+  assert.match(SCRIPT, /if \(friendly\) alertBox\.textContent = friendly;\n\s*else alertBox\.innerHTML = createFailureMarkup\(err\);/);
+  assert.match(COSMOS, /\.alert details p\{[^}]*font-family:var\(--font-mono\)/, 'the raw text reads as code, inside the alert');
+});
+
+test('a manifest error says a plain sentence, folds the route text, and sends a domainless project to its address', () => {
+  const steps = fn('renderStepOauthApp');
+  assert.doesNotMatch(steps, /'GitHub setup hit a snag' \+ \(live\.manifestMsg \? ': ' \+ esc\(live\.manifestMsg\)/, 'the raw route text is no longer the headline');
+  assert.match(steps, /else if \(live\.manifestCode === 'domain_required'\) snag = 'This project needs an address first — attach one from <a href="\?view=mine">your projects page<\/a>/);
+  assert.match(steps, /\(raw \? '<details><summary>Technical details<\/summary><p>' \+ esc\(raw\) \+ '<\/p><\/details>' : ''\)/);
+  assert.match(SCRIPT, /e\.code = \(d\.error && d\.error\.code\) \|\| '';/, 'the route code travels with the error');
+  assert.match(SCRIPT, /live\.manifestCode = String\(\(err && err\.code\) \|\| ''\);/);
+  assert.equal((SCRIPT.match(/manifestMsg: '', manifestCode: '', appSlug: null/g) || []).length, 2, 'both resets carry the code');
+});
+
+test('the rail at the done panel keeps its marker on Create until the project answers', () => {
+  const rail = fn('paintRail');
+  assert.match(rail, /var landed = step === 6 && !!\(live && live\.instStatus === 'active'\);/);
+  assert.match(rail, /var cur = step === 6 \? 5 : step;/);
+  assert.match(rail, /li\.classList\.toggle\('done', landed \|\| n < cur\);/);
+  assert.match(rail, /if \(now\) li\.setAttribute\('aria-current', 'step'\); else li\.removeAttribute\('aria-current'\);/);
+  assert.match(fn('show'), /paintRail\(step\);/, 'show() paints through it');
+  assert.doesNotMatch(fn('show'), /classList\.toggle\('done'/, 'and no longer marks the rail on its own');
+  assert.match(SCRIPT, /live\.instStatus = inst\.status; renderSteps\(\);\n\s*if \(state\.step === 6\) paintRail\(6\);/, 'the done-panel poll repaints when the status moves');
+  assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
+});
+
+test('card action results announce, nothing under the pointer is deleted, and focus stays on the card', () => {
+  assert.match(fn('renderCard'), /id="msg-' \+ iid \+ '" role="status" aria-live="polite">/, 'the card slot is a live region');
+  assert.match(HUB, /<div class="projMsg" id="mMsg" role="status" aria-live="polite"><\/div>/, 'so is the manage page’s');
+  assert.doesNotMatch(SCRIPT, /act\.innerHTML = '<span class="projMsg">Asking…<\/span>'/, 'no action replaces the row it was pressed in');
+  assert.match(fn('doTeardown'), /quietActions\(id\);\n\s*msg\(id, 'Asking…'\);/);
+  assert.match(fn('reProvision'), /quietActions\(id\);\n\s*msg\(id, 'Asking…'\);/);
+  assert.match(fn('quietActions'), /act\.querySelectorAll\('button'\)\.forEach\(function \(b\) \{ b\.disabled = true; \}\);/);
+  assert.match(fn('quietActions'), /li\.setAttribute\('data-focus-back', ''\)/, 'a disabled button that held focus leaves a note');
+  assert.match(fn('askTeardown'), /<div class="confirmRow" tabindex="-1">/);
+  assert.match(fn('askTeardown'), /if \(row && row\.focus\) row\.focus\(\);/, 'the question takes focus when the button goes');
+  const card = fn('renderCard');
+  assert.match(card, /var wasInside = li\.contains\(document\.activeElement\) && document\.activeElement !== li;/);
+  assert.match(card, /else if \(focusBack\) focusCardControl\(inst\.id, prefer\);/);
+  assert.match(fn('focusKeyOf'), /data-teardown-yes'\) \|\| el\.hasAttribute\('data-teardown-no'\)\) return '\[data-teardown\]'/, 'Yes / Keep land back on the door that opened them');
+  assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a, \.actions button'\) \|\|\n\s*li\.querySelector\('details\.attachFold summary'\)/, 'nearest control as the fallback');
+});