@bongos/core 1.19.387 → 1.19.389

package/docs/file-map.md

@@ -9,6 +9,9 @@
 /
 ├── CLAUDE.md                    ← index + framing (descriptive; DB is source of truth for state)
 ├── README.md                    ← public-facing one-paragraph summary
+├── PRODUCT.md                   ← durable product truth for the apex/hall/status surfaces (impeccable init, task 1003296): users, positioning, constraints, brand commitments, principles — no palette, no type
+├── DESIGN.md                    ← the visual rulebook written FROM the built landing (task 1003298, ADR 0196): palette + derived recipes, type, materials (the chrome plates), components, the motion grammar, both modes; what H1 (hall) and S1 (status) build against. Sidecar .impeccable/design.json
+├── .impeccable/                 ← impeccable skill artifacts: config.json (buildPath: code), surfaces/<route>.md (per-route briefs), mocks/world-assets/ (Higgsfield renders + prompt sidecars; the SOURCE of public-landing/assets/world/), mocks/decision/ (A1 comps), design.json (DESIGN.md sidecar), review/ (finish captures)
 ├── .gitignore
 ├── package.json / package-lock.json
 ├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/gds/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
@@ -246,6 +249,17 @@
 │   ├── assets/tray/ + build-resources/ ← generated icons (scripts/gen-icons.js; build-resources name dodges the global build/ gitignore)
 │   └── test/unit.mjs               ← hermetic unit tests (run by the CI workflow, not the root gate)
 │
+├── public-landing/                 ← the APEX front door + hub surfaces served by src/platform-server.js (landingPage(): apex-only strip → brand-token stamp → theme injection → ?v= asset stamp). Ships to EVERY instance; <!--apex-only:start/end--> regions are removed on a child
+│   ├── index.html                  ← the landing (/) — v3 "the template's page" of the chrome world (task 1003298, ADR 0196): server-stamped head, the breath (CSS-only signature), live figures/ledger/orbs from the public feeds baked inside sentinels; page-local <style> only (no :root), links /assets/world.css
+│   ├── projects.html               ← the hub (/projects?view=map|mine|manage|new) on cosmos.css (A4, task 1003299, rebuilds it in the world)
+│   ├── privacy.html / terms.html / contact.html ← the footer doors (task 1003251), on cosmos.css
+│   ├── assets/
+│   │   ├── world.css               ← the WORLD token layer (ADR 0196): contract tier = the pack, derived tier both modes, root-absolute plate token pairs, the reduced-motion kill switch; no page composition
+│   │   ├── world/                  ← the six production plates + <file>.json provenance sidecars (embed-prompt.mjs --scan clean): r2-chrome-blobs-set.jpg, r2-chrome-blob-one.jpg, r2-bongos-chrome-b.jpg (black plates, dark mode, lighten) and their -cut.webp alpha twins (light mode); og-card.jpg (the social card, captured from the page)
+│   │   ├── cosmos.css              ← the HUB component sheet (task 1002696): contract tier synced to the pack, its own derived + dark tiers, the .btn/.chip/.strip/.proj/.tbl vocabulary; measured by tests/cosmos_token_contrast.mjs
+│   │   └── verro-medallion.png     ← the Verro Labs mark (apex-only block)
+│   └── world/assets/               ← the RETIRED gate's clouds/creatures/plates (task 1002407; the gate folded into / in 1003233) — not the chrome plates
+│
 ├── public/                         ← example.com — the game (product)
 │   ├── index.html
 │   ├── assets/
@@ -321,6 +335,7 @@ tests/
 ├── terrain_picker.mjs            ← (ADR 0012): picker dispatch shape + GROUND-ONLY invariant (objects must never affect tile selection).
 ├── walkability.mjs               ← (ADR 0012): isBlocked over the actual INITIAL_MAP for sea / sand / grass / rock-on-grass / all 8 container cells / vendor cell / cell south of vendor / out-of-bounds. Loads server-side src/world/{map,terrain}.js directly so server logic is exercised.
 ├── grader.mjs                    ← (task 197): pure scoring functions + weight blending + end-to-end grade() per kind. Run with `node tests/grader.mjs`.
+├── grader_quality_window_overflow.mjs ← (task 1003318): a Quality worker that dies on a context-window overflow is PROMPT_TOO_LONG (no retry), a null axis, and a server-side lens outage → manual-confirm, never a fabricated 0/10; the card, the forged-flag and blocker-beside-outage shapes.
 ├── session_records.mjs           ← (6D.1, ADR 0027): scrubSecrets (ADR 0022 shapes + JWT/DSN/assignments) + buildSessionDigest + resolveTranscriptPath (worktree-session lookup, #551). Fixtures built at runtime so no literal secret hits the scanner.
 ├── session_search.mjs            ← (6D.2): the session-search ORDER BY whitelist (injection guard) + LIMIT clamp.
 ├── session_eval.mjs              ← (6D.3 + 6D.4): classifyTurn / computeOverhead / detectFootguns / summarizeSystemicFindings, incl. a #506-shaped fixture.

package/modules/dev-box/app/renderer/index.html

@@ -7,7 +7,7 @@
   <title>Dev Box</title>
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&display=swap" rel="stylesheet">
+  <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap" rel="stylesheet">
   <link rel="stylesheet" href="theme.generated.css">
   <link rel="stylesheet" href="styles.css">
 </head>

package/modules/dev-box/app/renderer/styles.css

@@ -154,7 +154,9 @@ main {
   width: 100%;
   margin-top: 10px;
 }
-.btn:hover:not(:disabled) { background: var(--accent); border-color: var(--accent); }
+/* the hover fill is the raw accent; the chrome world's accent carries a light ink
+   at 2.19:1, so the label flips to --ink on it (8.12:1) — task 1003298 */
+.btn:hover:not(:disabled) { background: var(--accent); border-color: var(--accent); color: var(--ink); }
 .btn:disabled { opacity: 0.55; cursor: default; }
 .btn--ghost {
   background: transparent;

package/modules/dev-box/app/renderer/theme.generated.css

@@ -1,16 +1,16 @@
 /* GENERATED by scripts/gen-brand.js from config/branding.json — do not edit by hand. */
 :root {
-  --bg: #f9d9a8;
-  --bg-card: #fffaf2;
-  --bg-deep: #f6d8ae;
-  --ink: #2b170e;
-  --ink-soft: #6d4a33;
-  --ink-faint: #785a41;
-  --rule: #e8a463;
-  --rule-soft: #f6d8ae;
-  --accent: #ce4806;
-  --accent-deep: #9e3406;
-  --terracotta: #855b3d;
-  --font-display: "Baloo 2", "Quicksand", system-ui, sans-serif;
-  --font-body: "Quicksand", system-ui, -apple-system, "Segoe UI", sans-serif;
+  --bg: #edecee;
+  --bg-card: #fbfafc;
+  --bg-deep: #e2e1e4;
+  --ink: #17181a;
+  --ink-soft: #55565a;
+  --ink-faint: #65656a;
+  --rule: #c6c6c8;
+  --rule-soft: #dcdbdd;
+  --accent: #fb9569;
+  --accent-deep: #a3481a;
+  --terracotta: #c9512c;
+  --font-display: "Manrope", "Segoe UI", system-ui, -apple-system, sans-serif;
+  --font-body: "Manrope", "Segoe UI", system-ui, -apple-system, sans-serif;
 }

package/modules/dev-box/app/scripts/gen-brand.js

@@ -73,7 +73,7 @@ function buildBrand(branding) {
     // Panel header epigraph (branding copy.tagline).
     TAGLINE: (branding.copy && branding.copy.tagline) || '',
     // Pre-CSS window background (main.js) — the theme bg so first paint is on-brand.
-    BG_COLOR: colors.bg || '#fffaf2',
+    BG_COLOR: colors.bg || '#fbfafc',
   };
 }
 
@@ -85,19 +85,19 @@ function buildThemeCss(branding) {
   const v = (x, fb) => x || fb;
   return `/* GENERATED by scripts/gen-brand.js from config/branding.json — do not edit by hand. */
 :root {
-  --bg: ${v(c.bg, '#f9d9a8')};
-  --bg-card: ${v(c.bgCard, '#fffaf2')};
-  --bg-deep: ${v(c.bgDeep, '#f6d8ae')};
-  --ink: ${v(c.ink, '#2b170e')};
-  --ink-soft: ${v(c.inkSoft, '#6d4a33')};
+  --bg: ${v(c.bg, '#edecee')};
+  --bg-card: ${v(c.bgCard, '#fbfafc')};
+  --bg-deep: ${v(c.bgDeep, '#e2e1e4')};
+  --ink: ${v(c.ink, '#17181a')};
+  --ink-soft: ${v(c.inkSoft, '#55565a')};
   --ink-faint: ${v(c.inkFaint, '#785a41')};
-  --rule: ${v(c.rule, '#e8a463')};
-  --rule-soft: ${v(c.ruleSoft, '#f6d8ae')};
-  --accent: ${v(c.accent, '#ce4806')};
-  --accent-deep: ${v(c.accentDeep, '#9e3406')};
-  --terracotta: ${v(c.terracotta, '#855b3d')};
-  --font-display: ${v(fonts.display, '"Baloo 2", "Quicksand", system-ui, sans-serif')};
-  --font-body: ${v(fonts.body, '"Quicksand", system-ui, -apple-system, "Segoe UI", sans-serif')};
+  --rule: ${v(c.rule, '#c6c6c8')};
+  --rule-soft: ${v(c.ruleSoft, '#dcdbdd')};
+  --accent: ${v(c.accent, '#fb9569')};
+  --accent-deep: ${v(c.accentDeep, '#a3481a')};
+  --terracotta: ${v(c.terracotta, '#c9512c')};
+  --font-display: ${v(fonts.display, '"Manrope", "Segoe UI", system-ui, sans-serif')};
+  --font-body: ${v(fonts.body, '"Manrope", "Segoe UI", system-ui, -apple-system, sans-serif')};
 }
 `;
 }

package/modules/dev-box/app/scripts/gen-dmg-backdrop.py

@@ -68,9 +68,9 @@ ICON = 100                 # dmg.iconSize
 # it, so its "fallback" would paint a Cloud Bongos colour into a fully-specified
 # host build. That is exactly what `sea` did to the Applications-well rim.
 COLOR_ROLES = {
-    "bg": "#f9d9a8", "bgDeep": "#f6d8ae", "bgCard": "#fffaf2",
-    "ink": "#2b170e", "inkSoft": "#6d4a33", "ruleSoft": "#f6d8ae",
-    "accent": "#ce4806", "accentDeep": "#9e3406", "terracotta": "#855b3d",
+    "bg": "#edecee", "bgDeep": "#e2e1e4", "bgCard": "#fbfafc",
+    "ink": "#17181a", "inkSoft": "#55565a", "ruleSoft": "#dcdbdd",
+    "accent": "#fb9569", "accentDeep": "#a3481a", "terracotta": "#c9512c",
 }
 
 FONT_DIRS = (

package/modules/dev-box/app/scripts/gen-icons.js

@@ -62,9 +62,9 @@ const OUT_BUILD = path.join(APP_DIR, 'build-resources');
 // it has nothing prompting a host to define it, so its "fallback" would paint a
 // Cloud Bongos colour into a fully-specified host build.
 const COLOR_ROLES = {
-  bgCard: '#fffaf2', bgDeep: '#f6d8ae', ink: '#2b170e',
-  rule: '#e8a463', ruleSoft: '#f6d8ae',
-  accent: '#ce4806', accentDeep: '#9e3406', terracotta: '#855b3d',
+  bgCard: '#fbfafc', bgDeep: '#e2e1e4', ink: '#17181a',
+  rule: '#c6c6c8', ruleSoft: '#dcdbdd',
+  accent: '#fb9569', accentDeep: '#a3481a', terracotta: '#c9512c',
 };
 
 // The pack, resolved exactly as gen-brand.js resolves it (env → instance → neutral).

package/modules/dev-box/app/src/brand.generated.json

@@ -9,5 +9,5 @@
   "COPYRIGHT": "© Cloud Bongos",
   "CONFIG_DIR": "cloudbongos",
   "TAGLINE": "Building Digitally, as simple as Bongos.",
-  "BG_COLOR": "#f9d9a8"
+  "BG_COLOR": "#edecee"
 }

package/modules/grading/grader-config.js

@@ -33,9 +33,11 @@ const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-fable-5';
 const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-5';
 const FALLTHROUGH_CONFIDENCE = V4.fallthrough_confidence ?? 0.3;
 // task 1002660: per-worker model tier overrides (rubric-configured). The
-// Quality worker was 41% of panel spend with 75% nit findings — its cq/economy
-// judgment doesn't need the full cross-model tier. Keys are worker kinds;
-// values are model ids. workerModelFor guards the cross-model invariant.
+// Quality worker was 41% of panel spend with 75% nit findings, so it ran on
+// the haiku tier — until its 200k window overflowed on any big diff and the
+// lens went dark (task 1003318: now claude-sonnet-5, a floor that coincides
+// with default_model for top-tier builders). Keys are worker kinds; values are
+// model ids. workerModelFor guards the cross-model invariant.
 const WORKER_MODEL_TIERS = V4.worker_model_tiers || {};
 const workers = require('./grader-workers');
 const generatedProvenance = require('./generated-provenance'); // task 1002795

package/modules/grading/grader-rubric.json

@@ -12,8 +12,8 @@
     "assumed_builder_model": "claude-fable-5",
     "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
-    "worker_model_tiers": { "quality": "claude-haiku-4-5-20251001" },
-    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens runs on the haiku tier. workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
+    "worker_model_tiers": { "quality": "claude-sonnet-5" },
+    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens ran on the haiku tier. task 1003318: moved to claude-sonnet-5 — haiku 4.5's 200k window overflows on any diff over ~150 KB (`Prompt is too long`, deterministic; tasks 1003297 and 1003298 each lost three ~$5 panel runs to it) and a Quality worker that never starts is missing signal on a GATING lens. For fable/opus builders the panel model is already claude-sonnet-5, so the tier coincides with default_model and acts as a floor — a future default_model bump must not pin Quality back onto a smaller window; it stays a live cost lever only for haiku builders (whose panel runs on opus-5). workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",

package/modules/grading/grader-score.js

@@ -19,18 +19,23 @@ function isNum(n) {
   return Number.isFinite(n);
 }
 
-// #1002653 corroboration helpers for validateAndScore's null-ff lens branch.
-// A worker entry is untrusted input — w.issues may be any shape. Absent issues
-// on an errored worker is the normal outage shape (treated as none); a truthy
-// NON-ARRAY issues is malformed and must DISQUALIFY corroboration (fail-closed
-// schema_error downstream), never TypeError into a 500 on grade submission.
-const isNarcErroredClean = (w) => {
-  if (!w || w.kind !== 'narc' || !w.error) return false;
+// #1002653 / task 1003318 corroboration helpers for validateAndScore's null-axis
+// lens branches (Narc → ff, Quality → cq). A worker entry is untrusted input —
+// w.issues may be any shape. Absent issues on an errored worker is the normal
+// outage shape (treated as none); a truthy NON-ARRAY issues is malformed and
+// must DISQUALIFY corroboration (fail-closed schema_error downstream), never
+// TypeError into a 500 on grade submission.
+const isWorkerErroredClean = (kind) => (w) => {
+  if (!w || w.kind !== kind || !w.error) return false;
   const issues = w.issues == null ? [] : w.issues;
   if (!Array.isArray(issues)) return false;
   return !issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
 };
-const isNarcHealthy = (w) => !!w && w.kind === 'narc' && !w.error;
+const isWorkerHealthy = (kind) => (w) => !!w && w.kind === kind && !w.error;
+const isNarcErroredClean = isWorkerErroredClean('narc');
+const isNarcHealthy = isWorkerHealthy('narc');
+const isQualityErroredClean = isWorkerErroredClean('quality');
+const isQualityHealthy = isWorkerHealthy('quality');
 
 // task 1002658 (ADR 0164): a SUBSTANTIVE issue is one a real panel emits — a
 // known severity + a non-empty summary. The old plausibility guard counted raw
@@ -95,8 +100,8 @@ function validateAndScore(rawSubagent, meta = {}) {
   // needs POSITIVE corroboration: workers[] carries an errored
   // no-substantive-finding Narc (#473 missing-signal semantics) and no healthy
   // Narc. Empty/narc-less/absent workers, ABSENT ff, and every other shape
-  // fall through to the fail-closed schema_error below. Quality has no such
-  // branch — gating lens, absence stays fail-closed.
+  // fall through to the fail-closed schema_error below. Quality's twin branch
+  // (task 1003318, below) is gating, so it never passes.
   // Trust note: workers[] is client-supplied like every SR-9 grade input — a
   // forger gains nothing here they cannot get by sending ff:9 directly; the
   // server-derivable-signals redesign is tracked separately (SR-9 residual).
@@ -105,8 +110,23 @@ function validateAndScore(rawSubagent, meta = {}) {
     metaWorkers.some(isNarcErroredClean) && !metaWorkers.some(isNarcHealthy);
   const ffExplicitNull = parsed.functional_fidelity === null;
   const ffLensUnavailable = ffExplicitNull && narcMissingSignal;
+  // task 1003318: the same shape for the GATING Quality lens. The haiku-tier
+  // Quality worker died on a context-window overflow (`Prompt is too long`)
+  // before it started; aggregatePanel forwarded code_quality: null and
+  // Number(null) === 0 fabricated "FAIL — code_quality below 6" at (9+0)/2.
+  // Unlike the advisory ff branch this NEVER passes: a gating lens that did not
+  // run is recorded as unavailable (json-null axis, score on the axis that ran,
+  // signals.cq_lens_unavailable) and the task parks at completed for
+  // manual-confirm — fail-closed, and a forger gains nothing they could not get
+  // by sending cq:9 outright. Same corroboration: an errored no-finding Quality
+  // in workers[] and no healthy one; every other null shape is schema_error.
+  const qualityMissingSignal = !!metaWorkers &&
+    metaWorkers.some(isQualityErroredClean) && !metaWorkers.some(isQualityHealthy);
+  const cqExplicitNull = parsed.code_quality === null;
+  const cqLensUnavailable = cqExplicitNull && qualityMissingSignal;
+  const qualityErrorTag = cqLensUnavailable ? String(metaWorkers.find(isQualityErroredClean).error) : null;
   const ff = ffExplicitNull ? null : Number(parsed.functional_fidelity);
-  const cq = Number(parsed.code_quality);
+  const cq = cqExplicitNull ? null : Number(parsed.code_quality);
   const economyRaw = Number(parsed.economy);
   const economy =
     isNum(economyRaw) && economyRaw >= 0 && economyRaw <= 10 ? economyRaw : null;
@@ -138,9 +158,13 @@ function validateAndScore(rawSubagent, meta = {}) {
 
   signals.confidence = confidence;
   signals.issue_count = issues.length;
-  if (ffLensUnavailable) signals.ff_lens_unavailable = true;
+  // Set AND cleared: `signals` spreads the client's own blob, so a forged
+  // `*_lens_unavailable: true` on a judged grade must not survive into the row
+  // (the ship card keys its outage reading on these).
+  if (ffLensUnavailable) signals.ff_lens_unavailable = true; else delete signals.ff_lens_unavailable;
+  if (cqLensUnavailable) signals.cq_lens_unavailable = true; else delete signals.cq_lens_unavailable;
 
-  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || !isNum(cq) || cq < 0 || cq > 10) {
+  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || (!cqLensUnavailable && (!isNum(cq) || cq < 0 || cq > 10))) {
     return {
       score: 0,
       passed: false,
@@ -152,22 +176,34 @@ function validateAndScore(rawSubagent, meta = {}) {
       notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`
         + (ffExplicitNull && !narcMissingSignal
           ? ' Explicit null functional_fidelity without a corroborated Narc outage in signals.workers is fail-closed.'
+          : '')
+        + (cqExplicitNull && !qualityMissingSignal
+          ? ' Explicit null code_quality without a corroborated Quality outage in signals.workers is fail-closed.'
           : ''),
       issues,
     };
   }
 
   const ffR = ffLensUnavailable ? null : r1(clamp(ff, 0, 10));
-  const cqR = r1(clamp(cq, 0, 10));
+  const cqR = cqLensUnavailable ? null : r1(clamp(cq, 0, 10));
   const economyR = economy != null ? r1(clamp(economy, 0, 10)) : null;
   const securityR = securityScore != null ? r1(clamp(securityScore, 0, 10)) : null;
   const efficiencyR = efficiencyScore != null ? r1(clamp(efficiencyScore, 0, 10)) : null;
   const economyPenalty =
     economyR != null ? Math.max(0, (THRESHOLD - economyR) / 2) : 0;
-  const cqEffective = economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
-  // With the ff lens out, the score reflects only the axis that ran — never a
-  // blend with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold.
-  const blended = ffLensUnavailable ? cqR : r1((ffR + cqR) / 2);
+  const cqEffective = cqLensUnavailable
+    ? null
+    : economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
+  // With a lens out, the score reflects only the axis that ran — never a blend
+  // with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold. Both
+  // out → 0: nothing was judged.
+  const blended = ffLensUnavailable && cqLensUnavailable
+    ? 0
+    : ffLensUnavailable
+      ? cqR
+      : cqLensUnavailable
+        ? ffR
+        : r1((ffR + cqR) / 2);
 
   // confidence must be present (not null) for a PASS. A subagent that omits
   // confidence entirely silently bypassed the low-confidence gate under the
@@ -182,26 +218,40 @@ function validateAndScore(rawSubagent, meta = {}) {
   // (null < THRESHOLD is true via JS coercion), and must not appear in the
   // verdict's below-threshold branches.
   const ffBelow = !ffLensUnavailable && ffR < THRESHOLD;
-  const bothPass = !ffBelow && cqR >= THRESHOLD;
-  const passed = bothPass && !lowConfidence && !confidenceAbsent;
-
+  const cqBelow = !cqLensUnavailable && cqR < THRESHOLD;
+  const bothPass = !ffBelow && !cqBelow;
+  // A GATING lens that did not run is never a PASS (ff is advisory since #481;
+  // cq is not) — manual-confirm is the only way past it (task 1003318).
+  const passed = bothPass && !lowConfidence && !confidenceAbsent && !cqLensUnavailable;
+
+  // The UNAVAILABLE reading is only honest when the lenses that DID run found
+  // nothing substantive: a Hacker blocker beside a dead Quality is a rejection
+  // with a missing axis, not an outage, and must keep the ordinary FAIL chain
+  // (the #574 posture — a dark lens hardens the outcome, never softens it).
+  const hasSubstantiveFinding = issues.some((i) => i.severity === 'blocker' || i.severity === 'major');
   const verdict = passed
     ? 'PASS'
-    : confidenceAbsent
-      ? 'FAIL — confidence absent'
-      : lowConfidence
-        ? 'FAIL — low confidence'
-        : bothPass
-          ? 'FAIL'
-          : ffBelow && cqR < THRESHOLD
-            ? `FAIL — both axes below ${THRESHOLD}`
-            : ffBelow
-              ? `FAIL — functional_fidelity below ${THRESHOLD}`
-              : `FAIL — code_quality below ${THRESHOLD}`;
+    : cqLensUnavailable && !hasSubstantiveFinding
+      ? `UNAVAILABLE — the code_quality lens did not run (Quality worker errored: ${qualityErrorTag}); not a quality rejection — manual-confirm available`
+        + (ffBelow ? ` (functional_fidelity below ${THRESHOLD})` : '')
+        // the confidence reasons the chain below would have named — kept as a
+        // tail so the #489 gate-walk signal is never hidden by the outage line
+        + (confidenceAbsent ? '; confidence absent' : lowConfidence ? `; low confidence ${confidence}` : '')
+      : confidenceAbsent
+        ? 'FAIL — confidence absent'
+        : lowConfidence
+          ? 'FAIL — low confidence'
+          : bothPass
+            ? 'FAIL'
+            : ffBelow && cqBelow
+              ? `FAIL — both axes below ${THRESHOLD}`
+              : ffBelow
+                ? `FAIL — functional_fidelity below ${THRESHOLD}`
+                : `FAIL — code_quality below ${THRESHOLD}`;
 
   const notesLines = [];
   notesLines.push(`Shot ${signals.shot_index != null ? signals.shot_index : '?'} (${signals.model}) — ${verdict}`);
-  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
+  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqLensUnavailable ? 'n/a (lens unavailable)' : `${cqR}/10`}${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
   if (notesFromSubagent) {
     notesLines.push('');
     notesLines.push(notesFromSubagent.trim());
@@ -559,6 +609,9 @@ function aggregateShots(shotResults, meta = {}) {
   const cq = median(verdicts.map((v) => v.cq));
   const economy = median(verdicts.map((v) => v.economy));
   const cqEffective = median(verdicts.map((v) => v.cq_effective));
+  // NB (task 1003318): this v3 multi-shot path still collapses a null axis to
+  // 0 — it serves the trivial-diff single shot, which cannot overflow a window;
+  // the panel path's lens-outage handling lives in validateAndScore.
   const blended = ff != null && cq != null ? r1((ff + cq) / 2) : 0;
   // Top-level aggregated confidence = median of per-shot confidences. Without
   // this, ship.js forwards a null top-level confidence to /tasks/:id/grade,

package/modules/grading/grader-workers/index.js

@@ -45,6 +45,17 @@ const TRANSIENT_WORKER_ERRORS = new Set([
   'SUBAGENT_NONZERO_EXIT',
 ]);
 
+// task 1003318: a context-window overflow is NOT transient. The CLI refuses the
+// request before the worker starts (`Prompt is too long: the request is ~251248
+// tokens (limit 200000)`) and refuses the retry identically, so the #465 retry
+// only burns another round. Its own tag names the cause on the grade row and
+// in the server's verdict line (grader-score.js keys the lens outage on ANY
+// errored no-finding Quality — the tag is the diagnosis, not the trigger).
+// The pattern is the API's exact sentence, so a diff that merely mentions the
+// phrase cannot trip it.
+const PROMPT_TOO_LONG_RE = /prompt is too long: the request is ~?\d+ tokens/i;
+const PROMPT_TOO_LONG = 'PROMPT_TOO_LONG';
+
 // #467: per-worker subagent timeout. The global 240s applied to EVERY worker,
 // which timed out the Read-heavy ones (Narc walks ACs + reads files — hence
 // Phase 2.0.5's 5-read workaround; Quality is next-heaviest). Per-worker budgets
@@ -176,6 +187,14 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
       // (`claude` prints its "not logged in" line there) — fall back so the tail
       // is never empty when the subprocess did explain itself.
       stderrTail = redactStderrTail(err.stderr) ?? redactStderrTail(err.stdout);
+      // Matched on the RAW stream (the redacted tail keeps only the last 400
+      // chars), stderr first and stdout only when stderr is silent — stdout
+      // carries the model's own text. A SUBAGENT_TIMEOUT keeps its tag: it is
+      // the #467 budget signal, never a refusal.
+      if (err.code !== 'SUBAGENT_TIMEOUT') {
+        const said = String(err.stderr || '').trim() || String(err.stdout || '');
+        if (PROMPT_TOO_LONG_RE.test(said)) subprocessError = PROMPT_TOO_LONG;
+      }
     }
     const parsed = subprocessError
       ? null

package/modules/hall-ui/public/builders.js

@@ -550,17 +550,22 @@
       // A grader OUTAGE row (panel_outcome 'unavailable') carries a placeholder
       // score of 0 — label it, never render it as a 0.0 fail (task 1002652).
       const isOutage = g.panel_outcome === 'unavailable';
-      const score = isOutage ? '—' : Number(g.score).toFixed(1);
+      // A json-null gating axis (task 1003318 — the Quality worker never ran)
+      // is likewise not a judgment: the score is the surviving axis, not a fail.
+      const isLensOut = !isOutage && !!g.rubric_scores && g.rubric_scores.code_quality === null;
+      const score = isOutage || isLensOut ? '—' : Number(g.score).toFixed(1);
       const verdict = isOutage
         ? `<span style="color:var(--ink-soft,#8a8577)">not graded (grader outage)</span>`
-        : g.passed
+        : isLensOut
+          ? `<span style="color:var(--ink-soft,#8a8577)">not graded (quality lens unavailable)</span>`
+          : g.passed
           ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
           : `<span style="color:#a04040;font-weight:600">fell short</span>`;
       return `
         <tr>
           <td class="ledger__num">#${g.task_id}</td>
           <td>${escapeHtml(g.title || '')}</td>
-          <td class="ledger__drachmae">${isOutage ? '—' : `${score} / 10`}</td>
+          <td class="ledger__drachmae">${isOutage || isLensOut ? '—' : `${score} / 10`}</td>
           <td>${verdict}</td>
           <td class="ledger__date">${fmtDate(g.graded_at)}</td>
         </tr>

package/modules/provisioning/routes/provisioning.js

@@ -99,8 +99,8 @@ function esc(s) {
 const ACCENT = (() => {
   try {
     const c = api.branding().theme?.ui?.colors || {};
-    return { sun: c.accent || '#ce4806', sun600: c.accentDeep || '#9e3406' };
-  } catch { return { sun: '#ce4806', sun600: '#9e3406' }; }
+    return { sun: c.accent || '#fb9569', sun600: c.accentDeep || '#a3481a' };
+  } catch { return { sun: '#fb9569', sun600: '#a3481a' }; }
 })();
 
 // Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
@@ -108,7 +108,7 @@ const ACCENT = (() => {
 // under the instance's own config/branding.json). Light + dark aware; no external
 // dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
 const PAGE_STYLE = `
-:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
+:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--sunInk:#2a1305;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
 @media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
 *{box-sizing:border-box}html,body{height:100%}
 body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
@@ -135,7 +135,7 @@ code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rg
 @media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
 .status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
 .cta{margin-top:1.4rem}
-.btn{display:inline-block;background:var(--sun);color:#fff;text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
+.btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
 .btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
 .muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
 .hidden{display:none!important}

package/modules/status-ui/public/explore.html

@@ -8,14 +8,19 @@
     /* Self-contained so the showcase renders correctly whether or not the host
        injects theme tokens. Warm Cloud Bongos defaults; overridable by the pack. */
     :root {
-      --bg: #f9d9a8; --card: #fffaf2; --ink: #2b170e; --ink-soft: #6d4a33;
-      --rule: #e8a463; --accent: #ce4806;
+      /* a hand-written mirror of config/branding.neutral.json theme.ui.colors —
+         this page is served without the branding injection, so a drifted value
+         renders a palette the product no longer paints (tests/design_tokens_sync.mjs).
+         Chrome world, task 1003298. --accent-deep is the TEXT-safe accent: the
+         salmon --accent is a fill and measures 2.1:1 as type on the card. */
+      --bg: #edecee; --card: #fbfafc; --ink: #17181a; --ink-soft: #55565a;
+      --rule: #c6c6c8; --accent: #fb9569; --accent-deep: #a3481a;
     }
     * { box-sizing: border-box; }
     body {
       margin: 0; padding: 2.5rem 1.25rem 4rem;
       background: var(--bg); color: var(--ink);
-      font-family: "Quicksand", system-ui, -apple-system, "Segoe UI", sans-serif;
+      font-family: "Manrope", system-ui, -apple-system, "Segoe UI", sans-serif;
       line-height: 1.5;
     }
     .wrap { max-width: 960px; margin: 0 auto; }
@@ -28,14 +33,15 @@
       padding: 1.1rem 1.2rem; text-decoration: none; color: inherit;
       display: flex; flex-direction: column; gap: .4rem; transition: transform .12s ease, box-shadow .12s ease;
     }
-    .card:hover { transform: translateY(-2px); box-shadow: 0 6px 20px rgba(234,88,12,.12); }
+    .card:hover { transform: translateY(-2px); box-shadow: 0 6px 20px rgba(0,0,0,.12); }
     .card h2 { font-size: 1.15rem; margin: 0; }
     .card p { margin: 0; color: var(--ink-soft); font-size: .95rem; }
-    .card .origin { color: var(--accent); font-size: .82rem; word-break: break-all; margin-top: auto; }
+    .card .origin { color: var(--accent-deep); font-size: .82rem; word-break: break-all; margin-top: auto; }
     .card .art { width: 100%; height: 120px; object-fit: cover; border-radius: 10px; margin-bottom: .3rem; }
     .empty, .err { text-align: center; color: var(--ink-soft); padding: 3rem 1rem; }
     @media (prefers-color-scheme: dark) {
-      :root { --bg: #1a1410; --card: #241c16; --ink: #f5ece3; --ink-soft: #b9a998; --rule: #4a3728; }
+      :root { --bg: #000000; --card: #101012; --ink: #ffffff; --ink-soft: #c0c0c0; --rule: rgba(255,255,255,.16);
+              --accent-deep: color-mix(in srgb, var(--accent) 45%, #ffffff); }
     }
   </style>
 </head>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.387",
+  "version": "1.19.389",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.387",
+      "version": "1.19.389",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.387",
+  "version": "1.19.389",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",