@bongos/core 1.19.349 → 1.19.351

package/public-landing/projects.html

@@ -653,7 +653,7 @@ summary{min-height:24px;padding:3px 0;}
              explanation, not another platform's task tracker. -->
         <details class="finePrint" id="mRepoVisWhy">
           <summary>Why can’t it be private yet?</summary>
-          <p>The platform used to deploy every project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the shared credential, so flipping it private would break its next deploy — the switch stays off until existing projects are re-wired.</p>
+          <p>This project’s deploys read its code from GitHub with an older key that only works on public repositories — so making the repository private would break the next deploy. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the older key, so the switch stays off until existing projects are re-wired.</p>
         </details>
       </div>
 
@@ -1152,8 +1152,15 @@ summary{min-height:24px;padding:3px 0;}
     if (a.dataset.nav === 'home') return;   /* a real navigation — leave it alone */
     a.addEventListener('click', function (ev) { ev.preventDefault(); setView(a.dataset.nav, true); });
   });
-  document.querySelectorAll('[data-nav-to]').forEach(function (a) {
-    a.addEventListener('click', function (ev) { ev.preventDefault(); setView(a.dataset.navTo, true); });
+  /* delegated, not swept: a data-nav-to link injected into a card or the manage
+     page after boot (addressRow, renderDelete) would never be upgraded by a
+     one-shot querySelectorAll — it would cost a whole page load. A modified
+     click keeps its browser meaning, the same contract a[data-manage] has. */
+  document.addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('[data-nav-to]');
+    if (!a || !isPlainClick(ev)) return;
+    ev.preventDefault();
+    setView(a.dataset.navTo, true);
   });
   /* Back / Forward land on the view the URL names — viewFromUrl() reads the
      manage id too, so a manage entry restores its project */
@@ -3125,7 +3132,7 @@ summary{min-height:24px;padding:3px 0;}
         '<p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
         '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
         '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div>' +
-        '<p>The generated credentials are placed on the platform’s control plane by an operator — that part isn’t yours to run (the one-click path above does it all automatically). It’s done when <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> reports <code style="font-family:var(--font-mono)">auth_configured: true</code>.</p></details>';
+        '<p>The platform team places the generated credentials; this step ticks itself once they land.</p></details>';
     }
 
     /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
@@ -3176,10 +3183,10 @@ summary{min-height:24px;padding:3px 0;}
        the box. Web sign-in works either way; the CLI also has a web-token fallback. */
     function renderStepDeviceFlow() {
       if (live.manifest !== 'done') {
-        return '<li class="slocked" data-onboard-step="device-flow"><b>Enable Device Flow — one checkbox</b><p>Unlocks once GitHub sign-in above is wired. It lets builders sign in from a terminal (<code style="font-family:var(--font-mono)">bongos setup</code>); web sign-in works without it.</p></li>';
+        return '<li class="slocked" data-onboard-step="device-flow"><b>Let builders sign in from a command line — one checkbox</b><p>Unlocks once GitHub sign-in above is wired. It lets builders sign in from a terminal — the <code style="font-family:var(--font-mono)">bongos setup</code> command builders run on their own machine; web sign-in works without it.</p></li>';
       }
       var appUrl = live.appSlug ? 'https://github.com/settings/apps/' + esc(live.appSlug) : null;
-      return '<li data-onboard-step="device-flow"><b>Enable Device Flow — one checkbox</b><p>' +
+      return '<li data-onboard-step="device-flow"><b>Let builders sign in from a command line — one checkbox</b><p>' +
         (appUrl
           ? 'Open <a href="' + appUrl + '" target="_blank" rel="noopener">your app’s settings</a>, check <strong>Enable Device Flow</strong>, and save. '
           : 'GitHub → Settings → Developer settings → GitHub Apps → your app → check <strong>Enable Device Flow</strong> → save. ') +
@@ -3957,6 +3964,11 @@ summary{min-height:24px;padding:3px 0;}
        address is tracked separately (task 1002897); until then "reserved" is
        both the honest word and the accurate one, since a revive re-uses exactly
        this hostname. */
+    /* pre-standup: at 'requested' nothing has been built, so the shape arms
+       below would describe a server and a database that never existed. error
+       and provisioning keep the built-world text on purpose — a run that failed
+       partway may already have a database, a port and a DNS record. */
+    if (inst && inst.status === 'requested') return 'Nothing has been stood up yet — this cancels the standup. Anything already on GitHub is untouched, and the name and web address stay reserved for this project.';
     return inst && inst.hosting_shape === 'dedicated'
       ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.'
       : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
@@ -3989,7 +4001,7 @@ summary{min-height:24px;padding:3px 0;}
       return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
     }
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
-    return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one.';
+    return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. <a href="?view=mine" data-nav-to="mine">Give it an address from your projects</a>.';
   }
 
   /* ── the bring-your-own-domain fold (owner decision 2, 2026-08-24). A live
@@ -4431,11 +4443,18 @@ summary{min-height:24px;padding:3px 0;}
         if (m === 'handled' || m === 'stale') return;
         $('mLoading').hidden = true;
         var a = $('mAlert');
-        a.textContent = 'Couldn’t read this project right now — refresh in a moment.';
+        a.innerHTML = 'Couldn’t read this project right now. <button type="button" class="btn small ghost" id="mAlertRetry">Try again</button>';
         a.classList.add('on');
       });
   }
 
+  /* the alert's own way out (task 1003245): delegated, because the catch above
+     rewrites #mAlert's innerHTML on every failure — a bound button would not
+     survive the next write. A loud re-read: the founder asked. */
+  $('mAlert').addEventListener('click', function (ev) {
+    if (ev.target.closest && ev.target.closest('#mAlertRetry')) loadManage();
+  });
+
   function manageChipTick() {
     if (document.hidden || currentView !== 'manage' || !manageInst) return;
     renderManage(manageInst); /* zero requests — re-dates "checked Xm ago" */
@@ -4475,7 +4494,7 @@ summary{min-height:24px;padding:3px 0;}
     } else {
       repoVisMsg(
         '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
-        '<p class="finePrint">Making it private isn’t possible from here yet: this project’s deploys still read the repository with the shared credential, so flipping now would break the next deploy. The switch lands with the re-wiring fix.</p>');
+        '<p class="finePrint">Making it private isn’t possible from here yet — see below for why.</p>');
     }
   }
 
@@ -4596,7 +4615,8 @@ summary{min-height:24px;padding:3px 0;}
       return;
     }
     /* a project that never finished standing up still reaches here — that is
-       the whole point of the widened gate; the consequence copy is the same */
+       the whole point of the widened gate; teardownTruth() scopes the copy to
+       its status */
     delMsg('<p class="plain">' + teardownTruth(inst) + '</p>' +
       '<div class="actions"><button type="button" class="btn small danger" data-del-ask>Tear it down</button></div>');
   }

package/scripts/gds/ship-flow.js

@@ -15,6 +15,8 @@ const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-m
 const { matchOne } = require('../../src/bongos/path-match');
 const { runShipGate } = require('./sandbox-stage');
 const { captureSurpriseLearning, promptSurprise } = require('./ship-surprise.js');
+// task 1003109: the optional `--visual` leg of a ship (goal 1000072).
+const shipVisual = require('./ship-visual.js');
 const { gitOk } = require('./ship-git.js');
 const { autoLinkifyChangedDocs, mergeMainIntoBranch, preflight } = require('./ship-preflight-steps.js');
 const { applyBaseOverride, computeChangedFiles, computeGraderBaseline, runSmokeAsync } = require('./ship-grade.js');
@@ -35,7 +37,7 @@ async function shipMain() {
   const args = process.argv.slice(2);
   const taskId = Number(args[0]);
   if (!Number.isFinite(taskId)) {
-    console.error('usage: node scripts/gds/ship.js <task-id> (--notes-file <path|-> | --notes "...") (--summary-file <path|-> | --summary "...") [--surprise "text" | --surprise none | --no-surprise] [--no-merge] [--db-only] [--verified] [--allow-empty] [--allow-smoke-fail] [--base <ref>]');
+    console.error('usage: node scripts/gds/ship.js <task-id> (--notes-file <path|-> | --notes "...") (--summary-file <path|-> | --summary "...") [--visual <image>] [--visual-alt "caption"] [--surprise "text" | --surprise none | --no-surprise] [--no-merge] [--db-only] [--verified] [--allow-empty] [--allow-smoke-fail] [--base <ref>]');
     console.error('  prefer the -file forms for prose: a shell command-substitutes backticks in an inline value before node sees it (learning 1000197).');
     process.exit(2);
   }
@@ -94,6 +96,10 @@ async function shipMain() {
     console.log(`--base: grading ${res.sha.slice(0, 9)}...HEAD — the task's real committed diff (work already on main). Graded via the rank-open path; no --allow-empty needed.`);
   }
 
+  // task 1003109: screen --visual BEFORE any heavy work, so bad input aborts with
+  // the claim STILL ACTIVE (the --base posture above). null when none was asked for.
+  const visual = shipVisual.fromArgs(args);
+
   const me = noteServerReward(await (await cliClient()).me.getMe());
   if (!me.ok) {
     console.error('failed to load profile:', me.data);
@@ -456,6 +462,10 @@ async function shipMain() {
 
   const taskStatus = r.data.taskStatus || 'shipped (legacy response)';
   console.log(`Task #${r.data.taskId} is now: ${taskStatus}`);
+  // task 1003109: attach the optional visual now the claim has resolved (the upload
+  // gate is "the task's last claim holder" — still us). Best-effort: it prints its
+  // own warning, and a failed picture never fails a successful ship.
+  await shipVisual.upload({ taskId, visual, client: await cliClient(), errorLine: apiErrorLine });
   // Claim CONSUMED, task at 'completed' — a crash from here needs fatalRecoveryLines.
   markShipProgress('resolved', taskId);
 

package/scripts/gds/ship-visual.js

@@ -0,0 +1,68 @@
+'use strict';
+
+// scripts/gds/ship-visual.js — the `--visual` leg of a ship (task 1003109, goal
+// 1000072 "Human legibility").
+//
+// A shipped task can carry an optional IMAGE alongside its value summary: a
+// screenshot of the surface that changed, a before/after, a diagram — so a reader
+// who does not read code can SEE what shipped instead of reading about it (owner
+// idea 1000400). ship.js owns the ship; this file owns the picture.
+//
+// Its own file, not another 60 lines inside the 4,600-line ship.js, because the
+// size ratchet (fitness-ratchets.js, task 1003129) is shrink-only — and because
+// the two things really are separable: the ship must not care whether a visual
+// came along.
+//
+// THE ONE RULE HERE: a visual never costs a builder their ship. Bad input is
+// caught BEFORE the claim resolves (a usage error, claim intact); a failed upload
+// happens AFTER it and is a warning, never a failure.
+
+const path = require('node:path');
+const { arg } = require('./cli-lib');
+// Reading + screening is the SERVER's own lib, so a terminal refuses exactly what
+// the upload route would refuse.
+const taskVisuals = require('../../modules/lifecycle/task-visuals');
+
+// Parse + screen `--visual <file> [--visual-alt "caption"]` from an argv slice.
+// Returns null when no visual was asked for, or { buf, contentType, alt, name }.
+// EXITS (code 2) on bad input: this runs before any heavy work, so a wrong path
+// costs the builder a retyped command, not a claim. Pure enough to reason about;
+// the exit is the deliberate CLI edge.
+function fromArgs(args) {
+  const file = arg('--visual', args) || '';
+  if (!file) return null;
+  const read = taskVisuals.readImageFile(file);
+  if (!read.ok) {
+    console.error(`Ship aborted: --visual ${file} — ${read.message}`);
+    console.error('Fix the path (or drop --visual: a visual is always optional). No claim resolved, no credits awarded.');
+    process.exit(2);
+  }
+  const visual = { ...read, alt: arg('--visual-alt', args) || '', name: path.basename(file) };
+  console.log(`--visual: ${visual.name} (${visual.contentType}, ${Math.round(visual.buf.length / 1024)} KB) — uploaded after the claim resolves.`);
+  return visual;
+}
+
+// Upload the screened visual to the task. BEST-EFFORT BY DESIGN: called AFTER the
+// claim has resolved, so a failure here must never fail the ship — the work
+// landed, only the picture did not. Returns true when it stuck; prints a
+// one-line, actionable warning and returns false when it did not.
+async function upload({ taskId, visual, client, errorLine }) {
+  if (!visual) return false;
+  const r = await client.tasks.postTasksIdVisual({
+    id: taskId,
+    body: {
+      image_b64: visual.buf.toString('base64'),
+      content_type: visual.contentType,
+      ...(visual.alt ? { alt: visual.alt } : {}),
+    },
+  });
+  if (r.ok) {
+    console.log("Visual attached — it renders wherever this task's value summary does.");
+    return true;
+  }
+  console.warn(`Note: the visual did not upload (${errorLine(r.data, r.status)}). The ship is unaffected — re-attach any time with:`);
+  console.warn(`  node scripts/gds/task.js visual ${taskId} <image> [--alt "caption"]`);
+  return false;
+}
+
+module.exports = { fromArgs, upload };

package/scripts/gds/task.js

@@ -11,11 +11,16 @@
 //                   [--priority 3] [--version <id>] [--goal <id>] [--criteria C1,C2]
 //                   [--touches a/,b/] [--est-minutes N] [--credits N] [--ready] [--json]
 //   bongos task show <id> [--json]
+//   bongos task visual <id> <image> [--alt "caption"]   attach/replace the ship-time visual
+//   bongos task visual <id> --remove                    take it back off
 //
 // Task CREATION is Archon-gated SERVER-SIDE (creating work shapes scope, ADR 0016). This
 // CLI adds no authority — a lower rank gets a clear 403 message pointing at idea capture.
 
 const { cliClient, requireSession, arg, hasFlag } = require('./cli-lib');
+// task 1003109: the ship-time VISUAL. The CLI screens the file with the SERVER's
+// own constants, so what it accepts is exactly what the upload route accepts.
+const taskVisuals = require('../../modules/lifecycle/task-visuals');
 
 // Valid enums (mirrors the server's task-classifier vocab; a friendly client-side check
 // so an obvious typo fails before the round-trip — the server stays authoritative).
@@ -77,6 +82,8 @@ function usage() {
   console.error('                  [--priority 3] [--version <id>] [--goal <id>] [--criteria C1,C2]');
   console.error('                  [--touches a/,b/] [--est-minutes N] [--credits N] [--ready] [--json]');
   console.error('  bongos task show <id> [--json]');
+  console.error('  bongos task visual <id> <image> [--alt "caption"]   attach or replace the ship-time visual');
+  console.error('  bongos task visual <id> --remove                    remove it again');
   console.error(`\n  kinds: ${VALID_KINDS.join(' | ')}`);
   console.error(`  disciplines: ${VALID_DISCIPLINES.join(' | ')}`);
 }
@@ -149,6 +156,60 @@ async function cmdShow(args) {
   if (task.description) console.log(`\n${task.description}`);
 }
 
+
+// ---- bongos task visual (task 1003109, goal 1000072) ------------------------
+//
+// A shipped task can carry a VISUAL alongside its value summary — a screenshot of
+// the surface that changed, a before/after, a diagram — so a reader who does not
+// read code can SEE what changed. `ship.js --visual` is the usual path; this is
+// the after-the-fact one: attach the picture you forgot, replace the wrong one,
+// or take it back off. Same server gate either way — the task's claim holder (or
+// an Archon). Always optional: no task needs one.
+async function cmdVisual(args) {
+  const id = Number(args[0]);
+  if (!Number.isInteger(id) || id <= 0) {
+    console.error('usage: bongos task visual <id> <image> [--alt "caption"]');
+    console.error('       bongos task visual <id> --remove');
+    process.exit(2);
+  }
+  const api = await cliClient();
+
+  if (hasFlag('--remove', args)) {
+    const r = await api.tasks.deleteTasksIdVisual({ id });
+    if (r.status === 404) { console.error(`task #${id} not found.`); process.exit(1); }
+    if (!r.ok) { console.error(`visual remove failed (${r.status}):`, r.data); process.exit(1); }
+    console.log(`✓ Task #${id} no longer carries a visual.`);
+    return;
+  }
+
+  // The image is POSITIONAL — `visual <id> <image>`. Deliberately not "the first
+  // arg that isn't a flag": with `--alt "a caption" shot.png` that heuristic
+  // picks up the caption as the filename.
+  const file = args[1] && !args[1].startsWith('--') ? args[1] : null;
+  if (!file) {
+    console.error('usage: bongos task visual <id> <image> [--alt "caption"]');
+    process.exit(2);
+  }
+  // Reading + screening is the SERVER's own lib (shared with ship.js --visual),
+  // so a terminal refuses exactly what the upload route would refuse.
+  const visual = taskVisuals.readImageFile(file);
+  if (!visual.ok) {
+    console.error(`${file} — ${visual.message}`);
+    process.exit(2);
+  }
+
+  const alt = arg('--alt', args) || '';
+  const r = await api.tasks.postTasksIdVisual({
+    id,
+    body: { image_b64: visual.buf.toString('base64'), content_type: visual.contentType, ...(alt ? { alt } : {}) },
+  });
+  if (r.status === 404) { console.error(`task #${id} not found.`); process.exit(1); }
+  if (r.status === 403) { console.error(`Only task #${id}'s claim holder (or an Archon) may attach its visual.`); process.exit(1); }
+  if (!r.ok) { console.error(`visual upload failed (${r.status}):`, r.data); process.exit(1); }
+  console.log(`✓ Task #${id} now carries a visual (${Math.round(visual.buf.length / 1024)} KB).`);
+  console.log('  It renders wherever this task\'s value summary does.');
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const sub = args[0];
@@ -156,6 +217,7 @@ async function main() {
   await requireSession();
   if (sub === 'new') return cmdNew(args.slice(1));
   if (sub === 'show') return cmdShow(args.slice(1));
+  if (sub === 'visual') return cmdVisual(args.slice(1));
   console.error(`task: unknown subcommand "${sub}"\n`); usage(); process.exit(2);
 }
 

package/src/bongos/routes/public.js

@@ -43,6 +43,14 @@ function projectPublicTask(task) {
     payload.title = task.title;
     payload.value_summary = task.value_summary ?? null;
     payload.shipped_at = task.shipped_at ?? null;
+    // task 1003109: the ship-time VISUAL travels with the summary it restates —
+    // one claim, one audience, in both media. The extra `security_sensitive`
+    // narrowing is the serve route's own gate (task-visuals.isPubliclyViewable);
+    // publishing a URL this projection would then refuse to serve would be a
+    // broken image, so the two agree here.
+    const visualIsPublic = task.security_sensitive !== true;
+    payload.visual_url = visualIsPublic ? (task.visual_url ?? null) : null;
+    payload.visual_alt = visualIsPublic ? (task.visual_alt ?? null) : null;
   }
   return payload;
 }

package/src/bongos/routes.js

@@ -86,7 +86,11 @@ function buildGdsRouter() {
       req.path === '/memory/sync' ||
       req.path === '/sessions' ||
       req.path === '/llm-cache/store' ||
-      /^\/tasks\/\d+\/publish-branch$/.test(req.path)
+      /^\/tasks\/\d+\/publish-branch$/.test(req.path) ||
+      // task 1003109: the ship-time task visual — a base64 image up to ~5.3 MB
+      // encoded (4 MB decoded). Same dynamic-:id pattern as publish-branch above;
+      // modules/lifecycle/routes/task-visuals.js mounts its own 8 MB parser.
+      /^\/tasks\/\d+\/visual$/.test(req.path)
     ) return next();
     return globalJson(req, res, next);
   });

package/src/module-api.js

@@ -1128,8 +1128,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.347 with no explicit bump. run 32802746363. (task 1002620)
 //   1.19.349 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.348 with no explicit bump. run 32803276871. (task 1002620)
+//   1.19.350 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.349 with no explicit bump. run 32810944115. (task 1002620)
+//   1.19.351 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.350 with no explicit bump. run 32850120472. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.349'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.351'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -997,8 +997,10 @@ test('flip-to-private cannot travel from this page — only the public direction
     'no code path may send the private direction');
   // the refusal is SAID, with its reason, not silently missing — post-ADR-0176 the
   // reason is THIS project's shared-credential wiring, not a platform-wide inability
-  assert.match(SCRIPT, /would break the next deploy/,
-    'the flip-to-private limitation is stated in plain words');
+  assert.match(SCRIPT, /Making it private isn’t possible from here yet — see below for why\./,
+    'the refusal is SAID inline, and points at the fold that carries the reason');
+  assert.match(HUB, /would break the next deploy/,
+    'the flip-to-private limitation is stated in plain words, in the fold');
 });
 
 test('the visibility shown is GitHub\'s answer, never an assumption', () => {
@@ -1033,7 +1035,7 @@ test('the refusal carries a LINK to the limitation, never prose alone (task 1003
   assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
   assert.ok(fold, 'the fold must be extractable');
-  assert.match(fold, /shared read-only credential/, 'the WHY is stated in plain words');
+  assert.match(fold, /an older key that only works on public repositories/, 'the WHY is stated in plain words');
   assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
     'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
   // apex-only: a child instance keeps the explanation, not another platform's tracker

package/tests/projects_hub_pre_uat.mjs

@@ -363,6 +363,47 @@ test('card action results announce, nothing under the pointer is deleted, and fo
   assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a, \.actions button'\) \|\|\n\s*li\.querySelector\('details\.attachFold summary'\)/, 'nearest control as the fallback');
 });
 
+/* ── copy follow-ups (task 1003245) ── */
+test('teardown copy is state-aware: a queued project is told nothing was built', () => {
+  const truth = fn('teardownTruth');
+  assert.match(truth, /if \(inst && inst\.status === 'requested'\) return 'Nothing has been stood up yet — this cancels the standup\. Anything already on GitHub is untouched, and the name and web address stay reserved for this project\.';/);
+  const arm = truth.indexOf("inst.status === 'requested'");
+  const shape = truth.indexOf("hosting_shape === 'dedicated'");
+  assert.ok(arm > 0 && arm < shape, 'the pre-standup arm comes before the shape arms');
+  assert.doesNotMatch(truth, /status === 'error'|status === 'provisioning'/, 'error and provisioning keep today’s text — a failed run may already have built things');
+});
+
+test('founder voice on the Device Flow step and the manual OAuth fallback', () => {
+  const df = fn('renderStepDeviceFlow');
+  assert.equal((df.match(/<b>Let builders sign in from a command line — one checkbox<\/b>/g) || []).length, 2, 'both branches carry the outcome-first title');
+  assert.doesNotMatch(df, /<b>Enable Device Flow — one checkbox<\/b>/);
+  assert.match(df, /the <code style="font-family:var\(--font-mono\)">bongos setup<\/code> command builders run on their own machine/, 'the command is glossed, not bare-coded');
+  assert.doesNotMatch(df, /Optional/, 'not optional — a manifest-born App has Device Flow off');
+  assert.equal((df.match(/<strong>Enable Device Flow<\/strong>/g) || []).length, 2, 'GitHub’s own checkbox label stays verbatim in the instructions');
+  const manual = fn('manualOauthDetails');
+  assert.match(manual, /The platform team places the generated credentials; this step ticks itself once they land\.<\/p><\/details>/);
+  assert.doesNotMatch(manual, /auth_configured|healthz/, 'no JSON health check for a founder to perform');
+});
+
+test('repo visibility: the refusal is one line, the mechanism lives in the fold', () => {
+  const rv = fn('renderRepoVis');
+  assert.match(rv, /This repository is <b>public<\/b> — anyone can read its code\./, 'line one stays');
+  assert.match(rv, /Making it private isn’t possible from here yet — see below for why\./);
+  assert.doesNotMatch(rv, /shared credential/);
+  const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
+  assert.match(fold, /an older key that only works on public repositories/);
+  assert.doesNotMatch(fold, /shared read-only credential/);
+  assert.match(fold, /<!--apex-only:start--> — shipped as <a href="\{\{buildersOrigin\}\}#\/task\/1002735"/, 'the hall task link stays inside its apex-only sentinel');
+});
+
+test('a failed manage read offers a retry; the no-address sentence offers a door', () => {
+  assert.match(SCRIPT, /a\.innerHTML = 'Couldn’t read this project right now\. <button type="button" class="btn small ghost" id="mAlertRetry">Try again<\/button>';/);
+  assert.match(SCRIPT, /\$\('mAlert'\)\.addEventListener\('click', function \(ev\) \{\n\s*if \(ev\.target\.closest && ev\.target\.closest\('#mAlertRetry'\)\) loadManage\(\);/, 'delegated — the catch rewrites the alert on every failure');
+  assert.match(fn('addressRow'), /No address yet<\/span> — sign-in on this project can’t be set up until it has one\. <a href="\?view=mine" data-nav-to="mine">Give it an address from your projects<\/a>\./);
+  assert.match(SCRIPT, /var a = ev\.target\.closest && ev\.target\.closest\('\[data-nav-to\]'\);\n\s*if \(!a \|\| !isPlainClick\(ev\)\) return;/, 'data-nav-to is delegated, so a link injected after boot switches views in place');
+  assert.doesNotMatch(SCRIPT, /querySelectorAll\('\[data-nav-to\]'\)/, 'the boot-time sweep is gone');
+});
+
 /* ── accessibility follow-ups (task 1003246) ── */
 test('the done panel’s progress region is stable, change-only, and says each stage’s state', () => {
   assert.match(HUB, /<div id="liveProgress" role="status" aria-live="polite"><\/div>/, 'the live region is the static wrapper');

package/tests/public_landing_projects.mjs

@@ -157,7 +157,7 @@ test('the repo-visibility section is served live, with the private direction ref
   // never shows another platform's tracker). The link itself is pinned inside
   // its sentinels by tests/projects_hub.mjs.
   assert.match(body, /id="mRepoVisWhy"/, 'the why-fold is served');
-  assert.match(body, /shared read-only credential/, 'the explanation survives the strip');
+  assert.match(body, /an older key that only works on public repositories/, 'the explanation survives the strip');
   assert.doesNotMatch(body, /#\/task\/1002735/,
     'the apex-only task link is stripped from a standalone serve');
 });

package/tests/task_visual_route_gate.mjs

@@ -0,0 +1,151 @@
+// tests/task_visual_route_gate.mjs
+//
+// Route-level proof of the ONE rule behind ship-time task visuals (task 1003109,
+// ADR 0184): a visual has no audience of its own — it inherits the audience of the
+// value_summary it restates. Already-public work (shipped|confirmed, not
+// security_sensitive) serves unauthenticated; EVERYTHING else falls through to
+// auth.requireBuilder and never past it.
+//
+// The unit tests in tests/task_visuals.mjs pin the predicate. This pins the WIRING
+// — that the handler actually consults it, in the right order, and fails closed on
+// every miss. It runs the real Express router with the data layer and the auth gate
+// stubbed at the module boundary; no DB, no network, no session.
+//
+// Run:  node tests/task_visual_route_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+const require = createRequire(import.meta.url);
+
+const TMP = path.join(os.tmpdir(), `otb-visualroute-${process.pid}`);
+process.env.TASK_VISUALS_DIR = TMP;
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const visualDb = require('../modules/lifecycle/task-visual-db.js');
+const visuals = require('../modules/lifecycle/task-visuals.js');
+
+// ---- stubs at the module boundary -----------------------------------------
+// The route reads `db.getTaskVisualAccess` and `auth.requireBuilder` off these
+// module objects at CALL time, so replacing the properties is enough — no loader
+// tricks, and the router under test is the real one.
+let taskRow = null;      // what the "DB" says about the task
+let lookupThrows = false;
+visualDb.getTaskVisualAccess = async () => {
+  if (lookupThrows) throw new Error('simulated DB outage');
+  return taskRow;
+};
+let authCalls = 0;
+api.requireBuilder = (req, res) => {
+  authCalls++;
+  // Stand in for the real gate's deny path: it owns its own response, so reaching
+  // here means the request was NOT served publicly.
+  res.status(401).json({ error: 'unauthenticated' });
+};
+
+const buildRouter = require('../modules/lifecycle/routes/visuals.js');
+
+// res.fail is composed at the kernel level in production; supply the same shape.
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, status) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code });
+  next();
+});
+app.use(buildRouter());
+
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+// A real stored file, so a successful gate actually streams bytes.
+const PNG = Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex');
+const stored = await visuals.persistImageBuffer(PNG, { taskId: 4242, contentType: 'image/png', dir: TMP });
+const NAME = stored.file;
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  return Promise.resolve().then(fn)
+    .then(() => { passed++; console.log(`  PASS  ${name}`); })
+    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); });
+}
+async function get(name) {
+  authCalls = 0;
+  const res = await fetch(`${base}/task-visuals/${name}`);
+  return { status: res.status, authCalls, buf: Buffer.from(await res.arrayBuffer()), headers: res.headers };
+}
+
+console.log('Task-visual serve gate (task 1003109 / ADR 0184):');
+
+await t('a SHIPPED task serves its visual to an unauthenticated caller', async () => {
+  taskRow = { id: 4242, status: 'shipped', security_sensitive: false };
+  const r = await get(NAME);
+  assert.equal(r.status, 200);
+  assert.equal(r.authCalls, 0, 'public work must not be sent through the auth gate');
+  assert.deepEqual(r.buf, PNG);
+  assert.equal(r.headers.get('content-type'), 'image/png');
+  assert.equal(r.headers.get('x-content-type-options'), 'nosniff');
+  assert.equal(r.headers.get('content-disposition'), 'inline');
+  assert.match(r.headers.get('cache-control'), /^public,/);
+});
+
+await t('a CONFIRMED task is public too — the same set as a public value_summary', async () => {
+  taskRow = { id: 4242, status: 'confirmed', security_sensitive: false };
+  assert.equal((await get(NAME)).status, 200);
+});
+
+await t('IN-FLIGHT work never serves publicly — it falls through to requireBuilder', async () => {
+  for (const status of ['backlog', 'ready', 'active', 'completed', 'abandoned']) {
+    taskRow = { id: 4242, status, security_sensitive: false };
+    const r = await get(NAME);
+    assert.equal(r.status, 401, status);
+    assert.equal(r.authCalls, 1, `${status} must reach the auth gate`);
+    assert.equal(r.buf.length && r.buf.includes(PNG), false, `${status} must not leak bytes`);
+  }
+});
+
+await t('a SHIPPED but security-sensitive task stays builders-only (the one narrowing)', async () => {
+  taskRow = { id: 4242, status: 'shipped', security_sensitive: true };
+  const r = await get(NAME);
+  assert.equal(r.status, 401);
+  assert.equal(r.authCalls, 1);
+});
+
+await t('an ABSENT task fails closed — no public serve, no crash', async () => {
+  taskRow = null;
+  const r = await get(NAME);
+  assert.equal(r.status, 401);
+  assert.equal(r.authCalls, 1);
+});
+
+await t('a DB outage fails closed rather than opening the door', async () => {
+  taskRow = { id: 4242, status: 'shipped', security_sensitive: false };
+  lookupThrows = true;
+  const r = await get(NAME);
+  lookupThrows = false;
+  assert.equal(r.status, 401, 'a lookup failure must not be read as "public"');
+  assert.equal(r.authCalls, 1);
+});
+
+await t('a malformed name is refused BEFORE any lookup (the traversal wall)', async () => {
+  taskRow = { id: 4242, status: 'shipped', security_sensitive: false };
+  for (const bad of ['..%2F..%2Fetc%2Fpasswd', 'screenshot.png', 'task-4242-0011.png', 'task-4242-0011223344556677.svg']) {
+    const r = await get(bad);
+    assert.equal(r.status, 400, bad);
+    assert.equal(r.authCalls, 0, `${bad} must not even reach the task lookup`);
+  }
+});
+
+await t('a well-formed name with no file on disk is a 404, not a 200', async () => {
+  taskRow = { id: 4242, status: 'shipped', security_sensitive: false };
+  const r = await get('task-4242-ffffffffffffffff.png');
+  assert.equal(r.status, 404);
+});
+
+server.close();
+await fs.rm(TMP, { recursive: true, force: true });
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);