@bongos/core 1.19.398 → 1.19.399

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.398",
-  "core_contract": "1.19.398",
-  "source_commit": "d2fe79ca3d995c8416584bc06575b73afeaec45c",
+  "core_version": "1.19.399",
+  "core_contract": "1.19.399",
+  "source_commit": "078d5aba95cdb1b88fa5d41cea74d8f5970f0153",
   "source_ref": "HEAD",
-  "built_at": "2026-08-28T18:29:17.996Z",
+  "built_at": "2026-08-28T18:52:22.972Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 348,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2029,
-  "tree_sha256": "034d29b37b3208023040c5ded6d355c32bba38f3e57ced2a770e893f8d1928ff",
+  "tree_sha256": "db3d8330b945cae451854b1aa6971c725a064644793114830480a32bc0c7ccc3",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -5307,12 +5307,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "13f7c20f7d01157842d006764090fabd60536d20e4dee048243f04851ece16c8"
+      "sha256": "e036f768512bfbfbc2851b076a12e6185b7e9d02b9a919a8b0c5bd32dc94e246"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f45044af3ba97b0e1b923e179ea75e8186280f21bb0168cefd7489a133a137c0"
+      "sha256": "25cb1fa5145932470a12a6cee77b1515feed2ceb24d3c3418028efd08ea2f37e"
     },
     {
       "path": "public-docs/index.html",
@@ -5662,7 +5662,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "1e1867918ec2a8fe489d9d21aa2e50fada9950b220c865c57f23c703a6c29f24"
+      "sha256": "55f3cc6b922e355cdb910b99487dfda61eb78c0d6f682de5ed3c534d0dfb7e65"
     },
     {
       "path": "public-landing/projects.probes.json",
@@ -7327,7 +7327,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ecd70bbc85834d5014b2062dd73436d56124aa399c12f9f4f0fc0f5e5f25a594"
+      "sha256": "939ace4177533bab1902bf03a387547efef875752d69f1050610b46606bc8d2f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9342,7 +9342,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "3104082c86aabc56824a026eccf028c9971bfbffc5a2c7801accbe1c899cba0c"
+      "sha256": "0b3f5b5cd293f0b6805df75e7b3f43e4e453718cc83e66297e3a4a693a27f36c"
     },
     {
       "path": "tests/promote_goal_id.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.398",
+  "version": "1.19.399",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.398",
+      "version": "1.19.399",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.398",
+  "version": "1.19.399",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -1086,6 +1086,10 @@ summary{min-height:24px;padding:3px 0;}
                                   (direction §3 — an active card must be able to
                                   self-correct, so the list re-reads once a minute) */
   var FRESH_MS = 12 * 60 * 1000; /* "checked Xm ago" freshness ≈ 2 heartbeat sweeps */
+  /* how long the card keeps showing the moment a standup LANDED (task 1003243).
+     Shorter than FRESH_MS on purpose: "live" is a standing fact the chip carries
+     forever, while "it just came up" is an event that stops being news. */
+  var LIVE_MOMENT_MS = 5 * 60 * 1000;
 
   var b = (typeof window !== 'undefined' && window.__BRANDING__) || {};
   var productName = (b.identity && b.identity.productName) || 'Cloud Bongos';
@@ -3950,6 +3954,20 @@ summary{min-height:24px;padding:3px 0;}
      so the page can never say "Answering at …" beside a chip that says "live?". */
   function verifiedAt(inst) { return inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0; }
   function freshUp(inst) { var at = verifiedAt(inst); return !!(inst.last_verified_up && at && (Date.now() - at) <= FRESH_MS); }
+  /* the landing moment (task 1003243): a standup or revive that VERIFIABLY came
+     up, still recent enough to be news. Two gates, both already on the card —
+     freshUp() so "live" stays ONE rule (a lit third stage beside a "live?" chip
+     would be the exact contradiction direction §3 forbids), and provisioned_at,
+     which the runner re-stamps every time it flips an instance to active, so a
+     revive earns the moment too. No sticky per-card flag is invented: the whole
+     window is derived from data the card already holds, which is why a reload
+     mid-window still shows it and a long-live project never does. */
+  function provisionedAt(inst) { return inst.provisioned_at ? new Date(inst.provisioned_at).getTime() : 0; }
+  function justLive(inst) {
+    var at = provisionedAt(inst);
+    return inst.status === 'active' && !inst.open_intent && freshUp(inst) &&
+      !!at && (Date.now() - at) <= LIVE_MOMENT_MS;
+  }
 
   function chipMarkup(cls, label, rec) {
     return '<span class="chip ' + cls + '"><span class="cdot"></span>' + esc(label) +
@@ -4037,9 +4055,9 @@ summary{min-height:24px;padding:3px 0;}
     address: { names: ['Address queued', 'Wiring the address', 'Answering there'], cls: '' },
     settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' }
   };
-  function stripMarkup(flow, stageNow, stagesDone, note) {
+  function stripMarkup(flow, stageNow, stagesDone, note, extraCls) {
     var f = FLOWS[flow];
-    return '<div class="strip ' + f.cls + '" role="status" aria-live="polite">' +
+    return '<div class="strip ' + f.cls + (extraCls ? ' ' + extraCls : '') + '" role="status" aria-live="polite">' +
       '<ul class="stages">' + f.names.map(function (n, i) {
         var c = stagesDone > i ? 'done' : (stageNow === i ? 'now' : '');
         return '<li class="' + c + '"><span class="sdot"></span><span class="slbl">' + n + '</span></li>';
@@ -4075,6 +4093,17 @@ summary{min-height:24px;padding:3px 0;}
       if (a === 'provision') return stripMarkup(s === 'torn_down' ? 'revive' : 'standup', 0, 0, (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this card updates when it starts.');
       return stripMarkup('standup', 2, 2, 'A ' + esc(a) + ' run is queued — this card updates when it lands.');
     }
+    /* the moment it landed (task 1003243). Until now this fell straight through to
+       '' — stages 1 and 2 lit while the work ran, then the strip vanished, so the
+       founder watching their own card never saw the third stage the wizard's done
+       panel shows them. stagesDone=3 lights all three; stageNow=-1 because nothing
+       is in progress any more. The address row carries the address, so this line
+       says the EVENT and does not repeat it. */
+    if (justLive(inst)) {
+      return stripMarkup(revive ? 'revive' : 'standup', -1, 3,
+        revive ? 'It’s back — your project is answering again.' : 'Standing up finished — your project is answering.',
+        'isLive');
+    }
     return '';
   }
 
@@ -4340,7 +4369,11 @@ summary{min-height:24px;padding:3px 0;}
     var at = inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0;
     return JSON.stringify([inst.status, inst.domain, inst.error_note,
       inst.open_intent && inst.open_intent.action, inst.open_intent && inst.open_intent.state,
-      inst.last_verified_up, at ? Math.floor((Date.now() - at) / 60000) : -1]);
+      inst.last_verified_up, at ? Math.floor((Date.now() - at) / 60000) : -1,
+      /* the landing moment is time-boxed (task 1003243), so its own age is part of
+         what the card renders from — otherwise a stalled heartbeat freezes
+         last_verified_at's bucket and the moment never clears itself */
+      justLive(inst)]);
   }
   function takeUpdate(id, inst) {
     var prev = byId[id];

package/src/module-api.js

@@ -1236,8 +1236,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.396 with no explicit bump. run 33193365480. (task 1002620)
 //   1.19.398 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.397 with no explicit bump. run 33199474439. (task 1002620)
+//   1.19.399 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.398 with no explicit bump. run 33201243958. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.398'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.399'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -54,6 +54,43 @@ test('addressRow branches by state before it trusts the domain — torn down and
   assert.match(body, /We keep checking every few minutes/, 'an unreachable project says what the platform is doing');
 });
 
+/* ── the moment a standup lands (task 1003243) ── */
+test('the landed moment is earned by a VERIFIED probe inside a window, not invented state', () => {
+  const body = fn('justLive');
+  assert.match(body, /freshUp\(inst\)/, '"live" stays ONE rule — a lit third stage beside a "live?" chip is the contradiction §3 forbids');
+  assert.match(body, /LIVE_MOMENT_MS/, 'and it is time-boxed');
+  assert.match(body, /inst\.status === 'active'/);
+  assert.match(body, /!inst\.open_intent/, 'work in flight tells its own story');
+  assert.match(SCRIPT, /var LIVE_MOMENT_MS = [\s\S]{0,40}?;/, 'the window is a named constant');
+  // derived from data the card already holds — a sticky per-card flag would not
+  // survive a reload, and would keep claiming the moment after the project died
+  assert.match(fn('provisionedAt'), /inst\.provisioned_at/, 'the runner re-stamps this on every standup, so a revive earns it too');
+  assert.doesNotMatch(body, /localStorage|sessionStorage|sawLive|_seen/, 'no invented client-side state');
+});
+
+test('the landed moment lights all three stages green — and only stripFor may do it', () => {
+  const body = fn('stripFor');
+  assert.match(body, /justLive\(inst\)/, 'the active fallthrough is no longer a bare return');
+  assert.match(body, /stripMarkup\(revive \? 'revive' : 'standup', -1, 3,[\s\S]*?'isLive'\)/,
+    'all three done (stagesDone=3), nothing in progress (stageNow=-1), painted in the landed palette');
+  // the strip must still vanish once the moment passes — a permanent progress
+  // strip on a long-live project is exactly what the pre-UAT review flagged
+  assert.match(body, /\n    return '';\n  \}/, "the fallthrough still ends at ''");
+  assert.match(SCRIPT, /function stripMarkup\(flow, stageNow, stagesDone, note, extraCls\)/, 'one markup fn, not a second copy');
+});
+
+test('the landed note says the EVENT — the address row already carries the address', () => {
+  const body = fn('stripFor');
+  assert.match(body, /Standing up finished — your project is answering\./, 'a first standup');
+  assert.match(body, /It’s back — your project is answering again\./, 'and a revive says the right thing');
+  assert.doesNotMatch(body, /justLive[\s\S]{0,400}?esc\(inst\.domain\)/, 'the note does not repeat the domain');
+});
+
+test('the moment clears itself even if the heartbeat stalls — sig() renders from its own age', () => {
+  assert.match(fn('sig'), /justLive\(inst\)/,
+    "last_verified_at's per-minute bucket stops moving when the sweep stalls; without this the strip would freeze on screen");
+});
+
 test('"live" is ONE rule — chip, orb and address row all read freshUp()', () => {
   assert.match(SCRIPT, /function freshUp\(inst\)/);
   assert.match(fn('chipFor'), /freshUp\(inst\)/, 'the chip');