@bongos/core 1.19.339 → 1.19.340

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.339",
+  "version": "1.19.340",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.339",
+      "version": "1.19.340",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.339",
+  "version": "1.19.340",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -201,6 +201,10 @@
 
 *{box-sizing:border-box;margin:0;padding:0;}
 [hidden]{display:none !important;}
+/* visually-hidden: said by a screen reader, never painted. The done panel's
+   progress strip needs it (its dots carry each stage's state for the eye only),
+   and the hub's map heading and skip link ride on it. */
+.vh{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%);white-space:nowrap;}
 html{scroll-behavior:smooth;}
 body{font-family:var(--font-body);color:var(--ink);background:var(--page-bg);min-height:100vh;-webkit-font-smoothing:antialiased;overflow-x:hidden;}
 
@@ -283,14 +287,18 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    verification — warm when verified live, amber-dim when stale, ashen when
    it failed its check, ghosted when torn down. Born for the dark sky; on
    light cards the inset ring keeps it grounded. ── */
-.orb{flex:0 0 54px;width:54px;height:54px;border-radius:50%;position:relative;overflow:visible;cursor:pointer;border:none;padding:0;
+.orb{flex:0 0 54px;width:54px;height:54px;border-radius:50%;position:relative;overflow:visible;border:none;padding:0;
   background:radial-gradient(120% 120% at 50% 50%, var(--acc,#fb923c), color-mix(in srgb, var(--acc,#fb923c) 55%, #1b2b52) 100%);
   box-shadow:0 0 0 1.5px rgba(255,255,255,.35) inset, 0 6px 18px rgba(20,16,40,.28), 0 0 26px var(--glow, rgba(251,146,60,.5));}
 .orb::after{content:'';position:absolute;inset:0;border-radius:50%;pointer-events:none;
   background:radial-gradient(38% 34% at 34% 28%, rgba(255,255,255,.9), rgba(255,255,255,0) 60%);}
 .orb.dim{filter:saturate(.55) brightness(.92);--glow:rgba(217,119,6,.35);}
 .orb.ashen{filter:saturate(.3) brightness(.78);--glow:rgba(220,38,38,.22);}
-.orb.ghost{opacity:.4;box-shadow:0 0 0 1.5px rgba(255,255,255,.25) inset;filter:saturate(.2);cursor:default;}
+.orb.ghost{opacity:.4;box-shadow:0 0 0 1.5px rgba(255,255,255,.25) inset;filter:saturate(.2);}
+/* only the LINKED orb is clickable: orbFor() emits a <span class="orb"> for
+   every non-navigable state, and index.html's .conItem .orb takes cursor:inherit
+   from the <a> it sits inside — so .orb.ghost's cursor reset is redundant. */
+a.orb{cursor:pointer;}
 
 /* ── project cards ── */
 .projects{list-style:none;display:flex;flex-direction:column;gap:18px;}
@@ -622,6 +630,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl th{text-align:left;font-family:var(--font-display);font-size:11.5px;font-weight:700;
   letter-spacing:.9px;text-transform:uppercase;color:var(--ink-faint);padding:15px 18px;
   border-bottom:2px solid var(--line);white-space:nowrap;}
+/* the sort control is a real button so the keyboard can reach it; it must look
+   like the header it replaced, so it inherits everything the th declares. */
+.tbl th button{all:unset;cursor:pointer;}
+.tbl th button:focus-visible{outline:2px solid var(--accent);outline-offset:2px;}
 .tbl td{padding:15px 18px;border-bottom:1px solid var(--line);font-size:14px;font-weight:600;
   color:var(--ink-soft);vertical-align:middle;}
 .tbl tr:last-child td{border-bottom:none;}
@@ -631,7 +643,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .pname{display:flex;align-items:center;gap:11px;}
 .tbl .pdot{width:11px;height:11px;border-radius:50%;background:var(--acc);flex:0 0 auto;
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
-.tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);}
+.tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);text-decoration:none;}
+.tbl a.ptitle:hover{text-decoration:underline;}
 .tbl .ptag{font-size:12.5px;color:var(--ink-faint);font-weight:600;}
 .tbl .num{font-family:var(--font-mono);font-weight:500;}
 .tbl .tags{display:flex;gap:6px;flex-wrap:wrap;}
@@ -753,6 +766,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .steps li.now .snum{border-color:var(--accent);color:var(--accent-deep);}
 .steps .slbl{font-size:12.5px;font-weight:700;color:var(--ink-faint);}
 .steps li.now .slbl,.steps li.done .slbl{color:var(--ink-soft);}
+.steps li[role=button]{cursor:pointer;}
+.steps li[role=button]:focus-visible{outline:2px solid var(--accent);outline-offset:3px;border-radius:8px;}
 .createSplit{display:grid;grid-template-columns:1fr 300px;gap:var(--pad-md);align-items:center;}
 @media (max-width:840px){.createSplit{grid-template-columns:1fr;}.createSplit .bongoCell{display:none;}}
 

package/public-landing/projects.html

@@ -40,6 +40,11 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 
    Same trust boundary as /create — every button only ASKS (enqueues an
    intent); the control-plane runner does the real infra work (ADR 0111 §2). */
+/* the skip link un-hides ITSELF on focus (0,2,0 beats cosmos's .vh at 0,1,0):
+   every property .vh sets is reversed here, so it is a real pill on first Tab */
+.skip:focus{position:fixed;top:8px;left:8px;z-index:100;width:auto;height:auto;margin:0;overflow:visible;clip-path:none;white-space:normal;
+  font-size:14px;font-weight:800;text-decoration:none;color:var(--ink);background:var(--bg-card);
+  border:2px solid var(--ctl-line);border-radius:12px;padding:10px 16px;}
 .viewWrap{padding-bottom:40px;}
 .card{margin-bottom:26px;}
 /* page titles align with the cards below them — cosmos's .hero is 880px-centred
@@ -255,9 +260,13 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 .again{
   display:inline-block;margin-top:14px;font-size:13px;font-weight:700;color:var(--ink-faint);
   background:none;border:none;cursor:pointer;font-family:var(--font-body);text-decoration:underline;
-  text-underline-offset:3px;padding:0;
+  text-underline-offset:3px;padding:6px 2px;min-height:24px;
 }
 .again:hover{color:var(--accent-deep);}
+/* every fold on this page is a real target: these summaries are 12.5–13px text
+   and measured under the 24px minimum (WCAG 2.2 target size, AA). Not
+   display:flex — that would drop the disclosure marker every fold shows today. */
+summary{min-height:24px;padding:3px 0;}
 
 /* the collapsed address step — a confirmation, not a form (task 1002704) */
 .addrConfirm{border:2px solid color-mix(in srgb,var(--ok) 30%,var(--bg-card));border-radius:18px;padding:18px 20px;background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);margin-bottom:16px;}
@@ -285,7 +294,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 .ghrow{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:none;border:0;border-bottom:1px solid color-mix(in srgb,var(--ink) 8%,transparent);padding:9px 12px;font:inherit;font-size:13.5px;color:var(--ink);cursor:pointer;}
 .ghrow:last-child{border-bottom:0;}
 .ghrow:hover{background:color-mix(in srgb,var(--accent) 6%,var(--bg-deep));}
-.ghrow[aria-selected=true]{background:color-mix(in srgb,var(--accent) 12%,var(--bg-deep));box-shadow:inset 3px 0 0 var(--accent);font-weight:600;}
+.ghrow[aria-current=true]{background:color-mix(in srgb,var(--accent) 12%,var(--bg-deep));box-shadow:inset 3px 0 0 var(--accent);font-weight:600;}
 /* --ink-soft, not --ink-faint: the badge tint is the darkest ground on the page,
    and faint ink only reaches 3.96:1 on it (task 1002749). */
 .ghrow .priv{margin-left:auto;font-size:11px;font-weight:600;color:var(--ink-soft);background:color-mix(in srgb,var(--ink) 8%,transparent);border-radius:5px;padding:1px 6px;}
@@ -309,6 +318,12 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 /* 840px matches cosmos's createSplit collapse, the breakpoint the old /create
    used (860) — the two-up grids and the bongo cell fold together */
 @media (max-width:840px){.row2,.choices{grid-template-columns:1fr;}}
+
+/* cosmos's global reduced-motion kill switch zeroes every animation, which
+   leaves the mark's blinking caret parked at FULL opacity — a solid bar beside
+   the wordmark forever. Page-local on purpose: a second reduce block in
+   cosmos.css would shadow the first one tests/landing_page.mjs extracts. */
+@media (prefers-reduced-motion:reduce){.shell .caret{display:none;}}
 </style>
 </head>
 <body>
@@ -340,6 +355,10 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
      page. They sit in one control because they are all "where can I go from
      here", but the divider keeps the distinction honest — Home navigates and
      never takes the current-view pill. ── -->
+<!-- keyboard skip: the chrome above every view is a wordmark, a four-item nav
+     and a right-hand cluster. Hidden until focused (.vh), it becomes a real
+     pill on first Tab and jumps to the #hubMain landmark. -->
+<a class="skip vh" href="#hubMain">Skip to content</a>
 <header class="shell">
   <!-- The mark types the PREFIX and holds `bongos` still, because `bongos` is
        the word you type and the assistant is what varies — which is also what
@@ -383,7 +402,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
      What you land on, signed in or out (owner, 2026-08-13). The orbs are
      placed statically on purpose: where things sit is this pass; how the sky
      moves is not. -->
+<main id="hubMain">
 <section id="view-map">
+  <h1 class="vh">The project map</h1>
   <div class="toolbar">
     <div class="seg" role="group" aria-label="Map display">
       <button type="button" id="sub-sky" aria-pressed="true">Sky</button>
@@ -441,9 +462,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     <table class="tbl">
       <thead>
         <tr>
-          <th class="colName" data-sort="name" aria-sort="ascending">Project</th>
+          <th class="colName" data-sort="name" aria-sort="ascending"><button type="button" class="thSort">Project</button></th>
           <th class="colType">Type</th>
-          <th class="right" data-sort="builders">Builders</th>
+          <th class="right" data-sort="builders"><button type="button" class="thSort">Builders</button></th>
           <th class="colTags">Runs</th>
           <th class="right colStatus">Status</th>
           <th class="colGo"></th>
@@ -468,7 +489,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         <!--apex-only:end-->
       </tbody>
     </table>
-    <p class="finePrint" style="text-align:center">Click a column to sort.</p>
+    <p class="finePrint" style="text-align:center">Sort by Project or Builders.</p>
   </div>
 
   <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
@@ -519,7 +540,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         Each card says what the platform <b>last verified</b>, and when.</p>
     </div>
 
-    <main class="card">
+    <div class="card">
       <!-- signed-out gate: identity-only sign-in (ADR 0143 least-privilege — unlike
            /create, listing your own instances needs no repo scope) -->
       <section id="gate" hidden>
@@ -546,11 +567,11 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
             <span class="count" id="mineCount"></span>
           </div>
           <div class="filters" role="group" aria-label="Filter by state">
-            <button type="button" data-f="all"       aria-pressed="true">All <span class="n">0</span></button>
-            <button type="button" data-f="live"      aria-pressed="false">Live <span class="n">0</span></button>
-            <button type="button" data-f="attention" aria-pressed="false">Needs you <span class="n">0</span></button>
-            <button type="button" data-f="working"   aria-pressed="false">Working <span class="n">0</span></button>
-            <button type="button" data-f="gone"      aria-pressed="false">Torn down <span class="n">0</span></button>
+            <button type="button" data-f="all"       aria-controls="projectsList" aria-pressed="true">All <span class="n">0</span></button>
+            <button type="button" data-f="live"      aria-controls="projectsList" aria-pressed="false">Live <span class="n">0</span></button>
+            <button type="button" data-f="attention" aria-controls="projectsList" aria-pressed="false">Needs you <span class="n">0</span></button>
+            <button type="button" data-f="working"   aria-controls="projectsList" aria-pressed="false">Working <span class="n">0</span></button>
+            <button type="button" data-f="gone"      aria-controls="projectsList" aria-pressed="false">Torn down <span class="n">0</span></button>
           </div>
         </div>
         <p class="mineEmpty" id="mineEmpty" hidden>Nothing matches that. <button type="button" class="linklike" id="mineClear">Clear the filters</button></p>
@@ -562,7 +583,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         <ul class="projects" id="projectsList"></ul>
         <p class="finePrint">Buttons here ask the platform to act; each card reports only what was verified, and when. A standup keeps going even with this tab closed.</p>
       </section>
-    </main>
+    </div>
   </div>
 </section>
 
@@ -802,7 +823,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
               <div id="ghAdopt" class="wizField" hidden>
                 <span>Pick one of your repositories</span>
                 <input type="text" id="ghSearch" placeholder="Search your repos…" autocomplete="off" aria-label="Search your repositories">
-                <div id="ghList" class="ghlist" role="listbox" aria-label="Your repositories"></div>
+                <div id="ghList" class="ghlist" role="group" aria-label="Your repositories"></div>
                 <div class="hint" id="ghAdoptHint">&nbsp;</div>
                 <!-- visibility stated on EVERY repo path (task 1002721) — the picker
                      marks private repos, and this says what adoption does about it -->
@@ -896,7 +917,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
               <h1 id="done-h">The drums are rolling</h1>
             </div>
             <p class="lede" id="doneLede"></p>
-            <div id="liveProgress"></div>
+            <!-- the STABLE live region: the strip inside is rebuilt every 5s tick,
+                 and a live region that is itself replaced never announces -->
+            <div id="liveProgress" role="status" aria-live="polite"></div>
             <h2 style="font-family:var(--font-display);font-size:19px;margin-top:22px;">Your steps — the parts only you can play</h2>
             <ol class="humanSteps" id="humanSteps"></ol>
             <p class="samePath">These are the same steps however a project is created — nothing here is special to this page.</p>
@@ -977,7 +1000,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   </div>
 </section>
 
-<div class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</div>
+</main>
+
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</footer>
 
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this
@@ -1008,7 +1033,15 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     if (m === 'light' || m === 'dark') return m;
     return (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) ? 'dark' : 'light';
   }
-  function paintModeToggle() { $('modeToggle').textContent = resolvedMode() === 'dark' ? '☀' : '☾'; }
+  /* the glyph shows the mode you would GET, so the label must say the same:
+     a bare ☀/☾ announces as "sun"/"moon" and nothing about what the press does.
+     No aria-pressed — this swaps a mode, it is not a two-state toggle button. */
+  function paintModeToggle() {
+    var dark = resolvedMode() === 'dark';
+    var el = $('modeToggle');
+    el.textContent = dark ? '☀' : '☾';
+    el.setAttribute('aria-label', dark ? 'Switch to light mode' : 'Switch to dark mode');
+  }
   $('modeToggle').addEventListener('click', function () {
     var next = resolvedMode() === 'dark' ? 'light' : 'dark';
     document.documentElement.setAttribute('data-mode', next);
@@ -1022,7 +1055,20 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     });
   }
 
-  var REDUCED = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;
+  /* HELD, not sampled once: a visitor who flips "reduce motion" mid-session must
+     stop the sky then and there (and get it back if they flip it off), instead
+     of being stuck with whatever the preference was at load. addListener is the
+     Safari <14 fallback — MediaQueryList only grew addEventListener later. */
+  var REDUCED_MQ = window.matchMedia ? window.matchMedia('(prefers-reduced-motion: reduce)') : null;
+  var REDUCED = !!(REDUCED_MQ && REDUCED_MQ.matches);
+  if (REDUCED_MQ) {
+    var onReducedChange = function (ev) {
+      REDUCED = !!(ev && typeof ev.matches === 'boolean' ? ev.matches : REDUCED_MQ.matches);
+      if (REDUCED) stopSky(); else startSky();
+    };
+    if (REDUCED_MQ.addEventListener) REDUCED_MQ.addEventListener('change', onReducedChange);
+    else if (REDUCED_MQ.addListener) REDUCED_MQ.addListener(onReducedChange);
+  }
 
   /* ══════════════════════════════════════════════════════════════════════════
      THE HUB SHELL — one surface, three views, one real URL.
@@ -1111,7 +1157,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   });
   /* Back / Forward land on the view the URL names — viewFromUrl() reads the
      manage id too, so a manage entry restores its project */
-  window.addEventListener('popstate', function () { setView(viewFromUrl()); });
+  window.addEventListener('popstate', function () { closeCard(); setView(viewFromUrl()); });
 
   /* ── the self-typing mark. `bongos` is the CONSTANT — it is the word you
      type — and the prefix is what varies, which is exactly what the vanity
@@ -1124,6 +1170,11 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var prefix = parts.join(' ');
     $('markWord').textContent = word;
     $('markPrefix').textContent = prefix;
+    /* the link's name is its two spans, so mid-type it announces "gem bongos".
+       Label the LINK instead — before the early return, so a re-branded or
+       reduced-motion visitor gets it too. #markLeft stays visible to AT:
+       tests/projects_hub.mjs pins that markup literal. */
+    $('markLeft').parentNode.setAttribute('aria-label', productName + ' — home');
     if (REDUCED || prefix !== 'cloud' || word !== 'bongos') return;
     var PREFIXES = ['cloud', 'claude', 'chatgpt', 'gemini'];
 
@@ -1367,7 +1418,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         'data-origin="' + esc(String(p.origin || '')) + '">' +
         '<td class="colName"><span class="pname"><span class="pdot" style="--acc:' +
           accentOf(p) + '"></span>' +
-          '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
+          '<span>' + (p._inst
+            ? '<a class="ptitle" data-manage="' + esc(String(p._inst.id)) + '" href="?view=manage&id=' + esc(String(p._inst.id)) + '">' + esc(p.name) + '</a>'
+            : '<span class="ptitle">' + esc(p.name) + '</span>') + pill + '<br>' +
           '<span class="ptag">' + esc(p.tagline || '') + '</span></span></span></td>' +
         /* Builders and Runs come from the project's OWN public API, enriched
            server-side (task 1002771). null is unknown — the project was
@@ -1561,12 +1614,24 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
       : '';
     cardReturn = returnTo || null;
     $('cardScrim').hidden = false;
+    pageInert(true);
     $('cardClose').focus();
   }
 
+  /* While the dialog is open the page behind it is inert (task 1003246): no tab
+     stop, no screen-reader route out into the map. aria-modal alone only tells
+     AT; it does not stop Tab. The card is the MAP's own child, so the map is
+     inerted a child at a time — inert on an ancestor can never be lifted on a
+     descendant, and inerting #view-map would inert the card with it. */
+  function pageInert(on) {
+    document.querySelectorAll('a.skip, header.shell, footer.foot, #view-mine, #view-new, #view-manage, #view-map > :not(#cardScrim)')
+      .forEach(function (el) { if (on) el.setAttribute('inert', ''); else el.removeAttribute('inert'); });
+  }
+
   function closeCard() {
     if ($('cardScrim').hidden) return;
     $('cardScrim').hidden = true;
+    pageInert(false);                    /* before the handback — an inert element cannot take focus */
     if (cardReturn && cardReturn.focus) cardReturn.focus();
     cardReturn = null;
   }
@@ -1611,6 +1676,14 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   }
 
   $('mapRows').addEventListener('click', function (ev) {
+    /* an owned row's title is a real manage anchor — a modified click keeps its
+       browser meaning, a plain one stays in-page (the orb-click contract) */
+    var m = ev.target.closest && ev.target.closest('a[data-manage]');
+    if (m) {
+      if (!isPlainClick(ev)) return;
+      ev.preventDefault();
+      return goToManage(m.getAttribute('data-manage'));
+    }
     /* the row's own "Open →" keeps its job — the card is for the rest of the row */
     if (ev.target.closest && ev.target.closest('a')) return;
     var tr = ev.target.closest && ev.target.closest('tr');
@@ -1711,9 +1784,13 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 
   $('onlyMine').addEventListener('change', applyMapFilter);
   $('mapQ').addEventListener('input', applyMapFilter);
+  /* the sort control is the BUTTON, not the th: a th takes no focus and no
+     Enter/Space, so the column sort was mouse-only. aria-sort stays on the th,
+     which is where a screen reader reads it from. */
   document.querySelectorAll('.tbl th[data-sort]').forEach(function (th) {
-    th.style.cursor = 'pointer';
-    th.addEventListener('click', function () {
+    var btn = th.querySelector('button');
+    if (!btn) return;
+    btn.addEventListener('click', function () {
       var k = th.getAttribute('data-sort');
       mapSort.dir = (mapSort.key === k) ? -mapSort.dir : 1;
       mapSort.key = k;
@@ -2413,6 +2490,19 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         li.classList.toggle('now', now);
         li.classList.toggle('done', landed || n < cur);
         if (now) li.setAttribute('aria-current', 'step'); else li.removeAttribute('aria-current');
+        /* a step already answered is a way BACK (task 1003246): only those take
+           the button role, the tab stop and the data-goto the delegated handler
+           below reads. The done panel offers none — the project is filed, and
+           there is nothing behind it to change. */
+        if (step < 6 && n < cur) {
+          li.setAttribute('role', 'button');
+          li.setAttribute('tabindex', '0');
+          li.setAttribute('data-goto', String(n));
+        } else {
+          li.removeAttribute('role');
+          li.removeAttribute('tabindex');
+          li.removeAttribute('data-goto');
+        }
       });
     }
     function show(step, moveFocus) {
@@ -2444,6 +2534,24 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
       if (step === 5) renderReview();
     }
 
+    /* One delegated pair on the rail, so paintRail can add and drop data-goto
+       freely (task 1003246). Enter and Space are the contract role="button"
+       makes; Space must not scroll the card while it keeps it. */
+    var railEl = root.querySelector('.steps');
+    if (railEl) {
+      railEl.addEventListener('click', function (ev) {
+        var li = ev.target.closest && ev.target.closest('li[data-goto]');
+        if (li) show(Number(li.getAttribute('data-goto')), true);
+      });
+      railEl.addEventListener('keydown', function (ev) {
+        if (ev.key !== 'Enter' && ev.key !== ' ' && ev.key !== 'Spacebar') return;
+        var li = ev.target.closest && ev.target.closest('li[data-goto]');
+        if (!li) return;
+        ev.preventDefault();
+        show(Number(li.getAttribute('data-goto')), true);
+      });
+    }
+
     /* ── field wiring ── */
     $('newName').value = state.name;
     $('f-owner').value = state.owner;
@@ -2601,7 +2709,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
       var rows = repoList.filter(function (r) { return !effectiveQ || String(r.full_name).toLowerCase().indexOf(effectiveQ) >= 0; }).slice(0, 100);
       $('ghList').innerHTML = rows.length
         ? rows.map(function (r) {
-            return '<button type="button" class="ghrow" role="option" data-full="' + esc(r.full_name) + '" aria-selected="' + (r.full_name === sel) + '">' +
+            return '<button type="button" class="ghrow" data-full="' + esc(r.full_name) + '" aria-current="' + (r.full_name === sel) + '">' +
               '<span>' + esc(r.full_name) + '</span>' + (r.private ? '<span class="priv">Private</span>' : '') + '</button>';
           }).join('')
         : '<div class="hint" style="padding:10px 12px">No repositories match “' + esc(effectiveQ) + '”.</div>';
@@ -2628,6 +2736,20 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     }
     $('ghSearch').addEventListener('focus', function () { this.select(); openRepoList(); });
     $('ghSearch').addEventListener('input', openRepoList);
+    /* A dropdown must be dismissable and must not outlive the field it belongs
+       to (task 1003246). Escape hands focus back to the box FIRST, because the
+       box's own focus handler reopens the list — the collapse has to be the
+       last word. A null relatedTarget is left alone: some browsers report it
+       for a click on a row, and closing there would eat the pick. */
+    $('ghAdopt').addEventListener('keydown', function (ev) {
+      if (ev.key !== 'Escape' || $('ghList').hidden) return;
+      ev.stopPropagation();
+      $('ghSearch').focus();
+      closeRepoList();
+    });
+    $('ghAdopt').addEventListener('focusout', function (ev) {
+      if (ev.relatedTarget && !$('ghAdopt').contains(ev.relatedTarget)) closeRepoList();
+    });
     $('ghList').addEventListener('click', function (ev) {
       var row = ev.target.closest('.ghrow'); if (!row) return;
       var full = row.getAttribute('data-full'); var slash = full.indexOf('/');
@@ -2944,6 +3066,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
+    var lastProgHtml = '';            /* same change-only contract, for the progress strip */
     var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'device-flow', 'app-install', 'first-sign-in', 'enter-hall'];
 
     function fetchPlan() {
@@ -3279,22 +3402,39 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
       revive: { names: ['Revive queued', 'Standing it up', 'Back live'], cls: '' },
       teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' }
     };
+    /* No live-region attributes here: this strip is destroyed and rebuilt on
+       every 5s tick, and a live region that is itself replaced never announces.
+       #liveProgress is the stable region; this is only its contents. (The
+       mine-card twin stripMarkup() still carries its own — left for a later pass.) */
     function progressMarkup(stageNow, stagesDone, note, cls, flow) {
       var f = PROG_FLOWS[flow || 'standup'];
-      return '<div class="prog ' + (f.cls ? f.cls + ' ' : '') + (cls || '') + '" role="status" aria-live="polite">' +
+      return '<div class="prog ' + (f.cls ? f.cls + ' ' : '') + (cls || '') + '">' +
         '<ul class="stages">' + f.names.map(function (n, i) {
           var c = stagesDone > i ? 'done' : (stageNow === i ? 'now' : '');
-          return '<li class="' + c + '"><span class="sdot"></span><span class="slbl">' + n + '</span></li>';
+          /* the dot carries the state for the eye only — a screen reader needs
+             the word, and the live stage marked, or it hears three bare names */
+          var word = c === 'done' ? 'done' : (c === 'now' ? 'current' : 'upcoming');
+          return '<li class="' + c + '"' + (c === 'now' ? ' aria-current="step"' : '') + '>' +
+            '<span class="sdot"></span><span class="slbl">' + n + '</span>' +
+            '<span class="vh">, ' + word + '</span></li>';
         }).join('') + '</ul>' +
         '<p class="pnote">' + note + '</p></div>';
     }
+    /* Change-only write into the stable live region: an identical tick performs
+       no DOM write at all, so the region announces real movement only — the same
+       contract renderSteps() uses with lastStepsHtml. */
+    function setProgress(html) {
+      var el = $('liveProgress');
+      if (!el || html === lastProgHtml) return;
+      lastProgHtml = html;
+      el.innerHTML = html;
+    }
     /* Renders the current instance state; returns true when the state is terminal
        (no further polling wanted). The strip is chosen by the OPEN INTENT first,
        then status (F22): a torn-down instance with a queued revive must never be
        told to "start another project". */
     function renderProgress(inst) {
-      var el = $('liveProgress');
-      if (!el) return true;
+      if (!$('liveProgress')) return true;
       var s = inst && inst.status;
       var revive = !!(inst && inst.torn_down_at);
       var oi = inst && inst.open_intent;
@@ -3303,23 +3443,23 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
          would make the status branch dead and diverge from the mine card) */
       if (oi && s !== 'provisioning' && s !== 'tearing_down' && s !== 'requested') {
         if (oi.action === 'provision') {
-          el.innerHTML = progressMarkup(0, 0,
+          setProgress(progressMarkup(0, 0,
             (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this panel updates when it starts.',
-            '', s === 'torn_down' ? 'revive' : 'standup');
+            '', s === 'torn_down' ? 'revive' : 'standup'));
           return false;
         }
         if (oi.action === 'teardown') {
-          el.innerHTML = progressMarkup(0, 0, 'A teardown is queued — this panel updates when it starts.', '', 'teardown');
+          setProgress(progressMarkup(0, 0, 'A teardown is queued — this panel updates when it starts.', '', 'teardown'));
           return false;
         }
       }
       if (s === 'requested') {
-        el.innerHTML = progressMarkup(0, 0, 'Filed — waiting for the platform to pick it up. This updates the moment it starts.', '', revive ? 'revive' : 'standup');
+        setProgress(progressMarkup(0, 0, 'Filed — waiting for the platform to pick it up. This updates the moment it starts.', '', revive ? 'revive' : 'standup'));
       } else if (s === 'provisioning') {
-        el.innerHTML = progressMarkup(1, 1,
+        setProgress(progressMarkup(1, 1,
           revive ? 'Bringing it back on the newest platform version — nothing needed from you.'
                  : 'Raising the server, database, and address — nothing needed from you.',
-          '', revive ? 'revive' : 'standup');
+          '', revive ? 'revive' : 'standup'));
       } else if (s === 'active') {
         /* Live lights on a VERIFIED answer, not on script completion (direction
            §7): the strip keys on the same last_verified_* overlay the manage
@@ -3333,39 +3473,39 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
           /* domainless instances are never probed — there is no address to
              answer at, so a verified answer can never arrive; say what IS true
              instead of promising the hall (sign-in stays locked without one) */
-          el.innerHTML = progressMarkup(-1, 2,
-            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', '', flow);
+          setProgress(progressMarkup(-1, 2,
+            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', '', flow));
           return true;
         }
         if (inst.last_verified_up === false) {
-          el.innerHTML = progressMarkup(2, 2,
-            'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow);
+          setProgress(progressMarkup(2, 2,
+            'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow));
           return false;
         }
         if (inst.last_verified_up) {
-          el.innerHTML = progressMarkup(-1, 3,
-            'Your project is answering at ' + link + '. Finish the steps below and the hall is yours.', 'isLive', flow);
+          setProgress(progressMarkup(-1, 3,
+            'Your project is answering at ' + link + '. Finish the steps below and the hall is yours.', 'isLive', flow));
           return true;
         }
         /* null: standing, not checked yet — keep watching until the first probe */
-        el.innerHTML = progressMarkup(2, 2,
-          'The build finished — checking that ' + link + ' answers…', '', flow);
+        setProgress(progressMarkup(2, 2,
+          'The build finished — checking that ' + link + ' answers…', '', flow));
         return false;
       } else if (s === 'error') {
         /* the honest snag (direction §5 / F19): no raw stderr as the headline, no
            false "keeps retrying" — retries stop, and the retry door is the mine view */
-        el.innerHTML = progressMarkup(1, 1,
-          'The standup stopped partway — it won’t continue on its own. Retry it (and see the technical details) from <a href="?view=mine">your projects page</a>.', 'isErr');
+        setProgress(progressMarkup(1, 1,
+          'The standup stopped partway — it won’t continue on its own. Retry it (and see the technical details) from <a href="?view=mine">your projects page</a>.', 'isErr'));
       } else if (s === 'tearing_down') {
         /* a deliberate end is calm, never styled as a failure (direction §5) —
            and it speaks the teardown vocabulary, not the standup's (F22) */
-        el.innerHTML = progressMarkup(1, 1, 'Taking the server offline. The repository stays yours; ' +
-          (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'), '', 'teardown');
+        setProgress(progressMarkup(1, 1, 'Taking the server offline. The repository stays yours; ' +
+          (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'), '', 'teardown'));
       } else if (s === 'torn_down') {
-        el.innerHTML = progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.', '', 'teardown');
+        setProgress(progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.', '', 'teardown'));
         return true;
       } else {
-        el.innerHTML = progressMarkup(0, 0, 'Filed. Watching for the standup to start…');
+        setProgress(progressMarkup(0, 0, 'Filed. Watching for the standup to start…'));
       }
       return false;
     }
@@ -3377,8 +3517,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
       var myGen = watchGen;
       var ticks = 0;
       var watchFlow = 'standup'; /* the vocabulary the strip is speaking (F22) */
-      var el = $('liveProgress');
-      el.innerHTML = progressMarkup(0, 0, 'Filed. Watching for the standup to start…');
+      setProgress(progressMarkup(0, 0, 'Filed. Watching for the standup to start…'));
       function tick() {
         if (myGen !== watchGen) return;
         if (!wizPollActive()) { watchPending = true; stopPolling(); return; }
@@ -3391,8 +3530,8 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
           /* a SNAGGED standup keeps its honest error — "still building" would be
              a lie exactly when the founder most needs the truth */
           if (live.instStatus !== 'error') {
-            $('liveProgress').innerHTML = progressMarkup(1, 1,
-              'Still working — this tab will stop watching now. Follow it any time on <a href="?view=mine">your projects page</a>.', '', watchFlow);
+            setProgress(progressMarkup(1, 1,
+              'Still working — this tab will stop watching now. Follow it any time on <a href="?view=mine">your projects page</a>.', '', watchFlow));
           }
           stopPolling();
           return;
@@ -3424,7 +3563,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
             if (myGen !== watchGen) return;
             var m = String(err && err.message || '');
             if (m.indexOf('gone:') === 0) {
-              $('liveProgress').innerHTML = progressMarkup(1, 1, m.slice(5), 'isErr', watchFlow);
+              setProgress(progressMarkup(1, 1, m.slice(5), 'isErr', watchFlow));
               stopPolling();
               return;
             }
@@ -3449,6 +3588,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         manifestStartedAt = 0; manifestStale = false;
         live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
         lastStepsHtml = '';
+        lastProgHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
         state = { step: 1, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
         $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';

package/src/module-api.js

@@ -1108,8 +1108,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.337 with no explicit bump. run 32796733697. (task 1002620)
 //   1.19.339 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.338 with no explicit bump. run 32797325535. (task 1002620)
+//   1.19.340 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.339 with no explicit bump. run 32798342738. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.339'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.340'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');