@bongos/core 1.19.399 → 1.19.401

package/public-landing/index.probes.json

@@ -3,9 +3,12 @@
   "page": "/",
   "surface": "public-landing",
   "probes": [
-    { "name": "landing: Enter opens Projects on the first item", "auth": true, "width": 1440,
+    { "name": "landing closed: the main content starts under the bar", "auth": true, "width": 1440,
+      "steps": [],
+      "expect": { "expanded": false, "top": [["#main", 72]] } },
+    { "name": "landing: Enter opens Projects on the first item; the band overlays and the hero does not move (task 1003332)", "continue": true,
       "steps": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 150]],
-      "expect": { "open": "#menuProjects", "activeText": "Sky" } },
+      "expect": { "open": "#menuProjects", "activeText": "Sky", "top": [["#main", 72]] } },
     { "name": "landing: arrows walk the visible items (Your projects shows signed in)", "continue": true,
       "steps": [["press", "ArrowDown"], ["press", "ArrowDown"]],
       "expect": { "activeText": "Your projects" } },
@@ -14,16 +17,16 @@
       "expect": { "closed": "#menuProjects", "activeId": "projTrig" } },
     { "name": "landing: the profile band closes the Projects band", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "#who .trig"], ["wait", 120]],
-      "expect": { "open": "#menuProfile", "closed": "#menuProjects" } },
+      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "top": [["#main", 72]] } },
     { "name": "landing: the profile band names the person; sign out keeps the honest href", "continue": true,
       "steps": [],
       "expect": { "href": [["#menuProfile a.signout", "/api/bongos/auth/logout"]], "text": [["#bandWho", "builder"]], "count": [["#bandWho img", 1]] } },
     { "name": "landing: a click outside closes", "continue": true,
       "steps": [["clickAt", 700, 700], ["wait", 120]],
       "expect": { "closed": "#menuProfile", "expanded": false } },
-    { "name": "landing: the band deep-links the hub views + About + Docs", "continue": true,
+    { "name": "landing: the band deep-links the hub views; About and Docs are footer links (task 1003332)", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120]],
-      "expect": { "count": [["#menuProjects a", 6]], "href": [["#menuProjects .bandCell:nth-child(1) a", "/projects?view=map"], ["#menuProjects .bandCell:nth-child(2) a", "/projects?view=map&sub=table"], ["#menuProjects a[href=\"#about\"]", "#about"], ["#menuProjects a[href=\"/docs\"]", "/docs"]] } },
+      "expect": { "count": [["#menuProjects a", 4], ["#menuProjects a[href=\"/docs\"]", 0]], "href": [["#menuProjects .bandCell:nth-child(1) a", "/projects?view=map"], ["#menuProjects .bandCell:nth-child(2) a", "/projects?view=map&sub=table"], ["footer a[href=\"#about\"]", "#about"], ["footer a[href=\"/docs\"]", "/docs"]] } },
     { "name": "landing: #about exists", "continue": true,
       "steps": [["press", "Escape"]],
       "expect": { "count": [["#about", 1]] } },

package/public-landing/projects.html

@@ -418,9 +418,10 @@ summary{min-height:24px;padding:3px 0;}
 </header>
 
 <!-- ══ THE BANDS ══ The menus are not floating cards. Each is a full-width band
-     that unfolds under the bar's edge and PUSHES the page down, so a
-     destination is a place the page opens into rather than a list that hovers
-     over it. One component, two instances (see the bands block in the script):
+     that unfolds under the bar's edge as a layer OVER the page — the page does
+     not reflow (owner, 2026-08-28; task 1003332) — so a destination is a place
+     that opens under the bar rather than a list that hovers beside it. One
+     component, two instances (see the bands block in the script):
      Escape closes and returns focus to the trigger, the arrows walk the items,
      a click outside closes, opening one closes the other. Plain links in a
      disclosure (aria-expanded + aria-controls, no menu role), so what is
@@ -435,12 +436,8 @@ summary{min-height:24px;padding:3px 0;}
       <li class="bandCell"><a class="bandT" href="?view=mine" data-nav="mine">Your projects</a><span class="bandC">the ones you own or build on</span></li>
       <li class="bandCell"><a class="bandT" href="?view=new" data-nav="new">New project</a><span class="bandC">five questions and a home</span></li>
     </ul>
-    <!-- under a hairline (§5's About cell): what this is, and the docs. About is the landing's
-         own explanation until goal 1000063's About page takes the anchor over. -->
-    <ul class="bandRow bandMore">
-      <li class="bandCell"><a class="bandT" href="/#about">About</a></li>
-      <li class="bandCell"><a class="bandT" href="/docs">Docs</a></li>
-    </ul>
+    <!-- About and Docs are site pages, not project views: they live in the
+         footer row with Privacy / Terms / Contact (owner, 2026-08-28; task 1003332). -->
   </div>
 </div>
 <div class="menuBand" id="menuProfile" data-menu="profile" hidden>
@@ -508,6 +505,15 @@ summary{min-height:24px;padding:3px 0;}
   </div>
 
   <div class="wrap viewWrap" id="sub-table-body" hidden>
+    <!-- ══ THE TABLE IN THE WORLD (task 1003332) ══ The table is a view of the same
+         world as the sky: a masthead in the world's material — the view title in
+         the display voice and one chrome object — then ledger rows. The owner's
+         pick from three rendered treatments (docs/design/projects-hub-direction-v2.md
+         §9): "the ledger", with the title cut to two words. -->
+    <div class="tblMast">
+      <h2 class="tblTitle">every project</h2>
+      <span class="mastObj" aria-hidden="true"></span>
+    </div>
     <table class="tbl">
       <thead>
         <tr>
@@ -533,7 +539,7 @@ summary{min-height:24px;padding:3px 0;}
           <td class="right num" id="selfBuilders">—</td>
           <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
-          <td class="colGo"><a class="btn small ghost" href="/">Open →</a></td>
+          <td class="colGo"><a class="rowGo" href="/">Open →</a></td>
         </tr>
         <!--apex-only:end-->
       </tbody>
@@ -1070,7 +1076,7 @@ summary{min-height:24px;padding:3px 0;}
 
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
 
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this
@@ -1485,7 +1491,7 @@ summary{min-height:24px;padding:3px 0;}
         '<td class="right colStatus">' + (p._inst ? chipFor(p._inst)
           : '<span class="chip calm"><span class="cdot"></span>—</span>') + '</td>' +
         '<td class="colGo">' + (safeHttpUrl(p.origin)
-          ? '<a class="btn small ghost" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">Open →</a>'
+          ? '<a class="rowGo" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">Open →</a>'
           : '') + '</td>' +
         '</tr>';
     }).join(''));
@@ -4023,6 +4029,17 @@ summary{min-height:24px;padding:3px 0;}
      both re-POST the slug (the server's PROVISION_ENQUEUE_FROM gate) */
   function canRetry(inst) { return inst.status === 'error' && !inst.open_intent; }
   function canRevive(inst) { return inst.status === 'torn_down' && !inst.open_intent; }
+  /* the restart door (task 1003238): client mirror of RESTART_FROM {active} +
+     RESTART_SHAPES (a dedicated droplet has no runner exec path), shown ONLY
+     where it has a reason to exist — a project the heartbeat cannot reach.
+     last_verified_up === false is the verdict; null means never probed and is
+     deliberately NOT the same claim (publicInstance keeps the two apart), so a
+     brand-new project never grows a Restart button it has no use for. A door on
+     every healthy card would only invite needless downtime. */
+  function canRestart(inst) {
+    return inst.status === 'active' && inst.last_verified_up === false &&
+      inst.hosting_shape !== 'dedicated' && !inst.open_intent;
+  }
   /* keep watching while the platform is doing something to this instance */
   function shouldWatch(inst) {
     if (inst.status === 'requested' || inst.status === 'provisioning' || inst.status === 'tearing_down') return true;
@@ -4053,7 +4070,8 @@ summary{min-height:24px;padding:3px 0;}
     revive: { names: ['Revive queued', 'Standing it up', 'Back live'], cls: '' },
     teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' },
     address: { names: ['Address queued', 'Wiring the address', 'Answering there'], cls: '' },
-    settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' }
+    settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' },
+    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' }
   };
   function stripMarkup(flow, stageNow, stagesDone, note, extraCls) {
     var f = FLOWS[flow];
@@ -4090,6 +4108,11 @@ summary{min-height:24px;padding:3px 0;}
       if (a === 'settings-apply') return inst.open_intent.state === 'running'
         ? stripMarkup('settings', 1, 1, 'Applying a settings change — the project restarts to pick it up.')
         : stripMarkup('settings', 0, 0, 'A settings change is queued — this card updates when it starts.');
+      /* task 1003238: the owner asked for a restart — say so, and never claim
+         it came back before a probe has said it did */
+      if (a === 'restart') return inst.open_intent.state === 'running'
+        ? stripMarkup('restart', 1, 1, 'Restarting the project — it goes down and comes back up.')
+        : stripMarkup('restart', 0, 0, 'A restart is queued — this card updates when it starts.');
       if (a === 'provision') return stripMarkup(s === 'torn_down' ? 'revive' : 'standup', 0, 0, (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this card updates when it starts.');
       return stripMarkup('standup', 2, 2, 'A ' + esc(a) + ' run is queued — this card updates when it lands.');
     }
@@ -4176,7 +4199,17 @@ summary{min-height:24px;padding:3px 0;}
         /* the runner had no DNS hook (F16): the CAUSE beats the bare symptom —
            a successful A record flips last_verified_up and retires the note */
         if (inst.dns_note) return 'Its address is ' + link + '. ' + esc(inst.dns_note);
-        if (inst.last_verified_up === false) return 'Not answering at ' + link + ' right now. We keep checking every few minutes and update this on its own if it comes back.';
+        /* task 1003238: there IS an action now, so the sentence names it — the old
+           copy could only counsel patience because nothing else was on offer. It
+           names it through canRestart(), the SAME predicate the button renders on:
+           a dedicated-shape project (no runner exec path) or one with work already
+           queued gets no button, and pointing it at one would be the exact
+           misdirection ADR 0199 §8 forbids — a refusal must name the action that IS
+           available. Where there is no button the sentence stops at the full stop. */
+        if (inst.last_verified_up === false) {
+          return 'Not answering at ' + link + ' right now. We keep checking every few minutes and update this on its own if it comes back' +
+            (canRestart(inst) ? ' — or restart it yourself below.' : '.');
+        }
         if (inst.last_verified_up) return 'Its address is ' + link + ' — last answered ' + esc(relTime(verifiedAt(inst))) + '.';
         return 'Its address is ' + link + ' — confirming it answers.';
       }
@@ -4263,6 +4296,7 @@ summary{min-height:24px;padding:3px 0;}
     if (inst.status === 'active' && inst.domain) acts.unshift('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-retry="' + iid + '">Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-revive="' + iid + '">Bring it back</button>');
+    if (canRestart(inst)) acts.push('<button type="button" class="btn small" data-restart="' + iid + '">Restart it</button>');
     if (canTeardown(inst)) acts.push('<button type="button" class="btn small danger" data-teardown="' + iid + '">Tear it down</button>');
     if (acts.length) body += '<div class="actions" id="act-' + iid + '">' + acts.join('') + '</div>';
     body += attachFold(inst, iid);
@@ -4299,7 +4333,7 @@ summary{min-height:24px;padding:3px 0;}
     if (!el || !el.getAttribute) return null;
     if (el.tagName === 'SUMMARY') return 'details.attachFold summary';
     if (el.hasAttribute('data-teardown-yes') || el.hasAttribute('data-teardown-no')) return '[data-teardown]';
-    var keys = ['data-manage', 'data-attach', 'data-retry', 'data-revive', 'data-teardown'];
+    var keys = ['data-manage', 'data-attach', 'data-retry', 'data-revive', 'data-restart', 'data-teardown'];
     for (var i = 0; i < keys.length; i++) if (el.hasAttribute(keys[i])) return '[' + keys[i] + ']';
     return null;
   }
@@ -4539,6 +4573,7 @@ summary{min-height:24px;padding:3px 0;}
     if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-m-retry>Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-m-revive>Bring it back</button>');
+    if (canRestart(inst)) acts.push('<button type="button" class="btn small" data-m-restart>Restart it</button>');
     $('mActs').innerHTML = acts.join('');
     $('mActs').hidden = !acts.length;
   }
@@ -4575,11 +4610,33 @@ summary{min-height:24px;padding:3px 0;}
       box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
     }).then(function () { loadManage(true, true); });
   }
+  /* Restart from the project's own page — the same POST the list card sends */
+  function mRestart() {
+    var inst = manageInst;
+    if (!inst) return;
+    var box = $('mMsg');
+    box.className = 'projMsg'; box.textContent = 'Asking the platform to restart it…';
+    $('mActs').querySelectorAll('button').forEach(function (b) { b.disabled = true; });
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/restart', {
+      method: 'POST', credentials: 'same-origin'
+    }).then(function (res) {
+      if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) { box.className = 'projMsg ok'; box.textContent = data.message || 'Restart queued.'; return; }
+        box.className = 'projMsg err';
+        box.textContent = restartFailure(data, res.status);
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () { loadManage(true, true); });
+  }
   $('mActs').addEventListener('click', function (ev) {
     var t = ev.target.closest && ev.target.closest('button');
     if (!t) return;
     if (t.hasAttribute('data-m-retry')) return mReProvision('retry');
     if (t.hasAttribute('data-m-revive')) return mReProvision('revive');
+    if (t.hasAttribute('data-m-restart')) return mRestart();
   });
 
   /* an IN-FLIGHT project is watched here at the card's cadence — its own copy
@@ -5315,6 +5372,39 @@ summary{min-height:24px;padding:3px 0;}
     });
   }
 
+  /* ── restart an unreachable project (task 1003238). Its own route, because
+     PROVISION_ENQUEUE_FROM excludes 'active' — re-POSTing the slug the way
+     Try again / Bring it back do would be refused on every press. Every
+     refusal is shown as the server worded it: the server owns the gate, and
+     a card that invents its own reason drifts from it. ── */
+
+  function restartFailure(data, status) {
+    var e = apiError(data, status);
+    if (e.code === 'rate_limited') return e.message || 'Too many requests right now — give it a moment and try again.';
+    return e.message || 'The restart could not be queued — try again in a moment.';
+  }
+
+  function doRestart(id) {
+    var inst = byId[id];
+    if (!inst) return;
+    quietActions(id);
+    msg(id, 'Asking…');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/restart', {
+      method: 'POST', credentials: 'same-origin'
+    }).then(function (res) {
+      if (res.status === 401) { msg(id, signInAgain(), 'err'); return null; }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) { msg(id, esc(data.message || 'Restart queued.'), 'ok'); return; }
+        msg(id, esc(restartFailure(data, res.status)), 'err');
+      });
+    }).catch(function () {
+      msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
+    }).then(function () {
+      if (byId[id]) renderCard(byId[id]);
+      watchOnce(id);
+    });
+  }
+
   /* ── domain attach: same truth-telling for every refusal (task 1002692) ── */
 
   function doAttach(id) {
@@ -5373,6 +5463,7 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-attach')) return doAttach(t.getAttribute('data-attach'));
     if (t.hasAttribute('data-retry')) return reProvision(t.getAttribute('data-retry'), 'retry');
     if (t.hasAttribute('data-revive')) return reProvision(t.getAttribute('data-revive'), 'revive');
+    if (t.hasAttribute('data-restart')) return doRestart(t.getAttribute('data-restart'));
   });
 
   /* ── boot: who am I → my instances ────────────────────────────────────── */
@@ -5458,10 +5549,14 @@ summary{min-height:24px;padding:3px 0;}
   /* Boot. The view is set FIRST, from the URL, so the page is navigable before
      any request resolves — /projects?view=new must land on the create view even
      if the identity call is slow or fails. */
+  /* the boot query is read ONCE, before the view is set: setView rewrites the
+     URL to ?view=<v> and would drop everything else (the Table deep link from
+     the landing landed on the sky until task 1003332) */
+  var bootQ = new URLSearchParams(location.search);
   setView(viewFromUrl());
   /* the Table item's deep link (and the landing's) names the sub-view; a view change
      never writes it back, so a reload from the band returns to the sky as before */
-  if (new URLSearchParams(location.search).get('sub') === 'table') setSub('table');
+  if (bootQ.get('sub') === 'table') setSub('table');
 
   fetch(API + '/me', { credentials: 'same-origin' })
     .then(function (res) { if (!res.ok) throw new Error(String(res.status)); return res.json(); })

package/public-landing/projects.probes.json

@@ -3,26 +3,29 @@
   "page": "/projects",
   "surface": "public-landing",
   "probes": [
-    { "name": "Enter opens Projects and lands on the first item", "auth": true, "width": 1440,
+    { "name": "closed: the main content starts under the bar", "auth": true, "width": 1440,
+      "steps": [],
+      "expect": { "expanded": false, "top": [["#hubMain", 64]] } },
+    { "name": "Enter opens Projects and lands on the first item; the band overlays and the content does not move (task 1003332)", "continue": true,
       "steps": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 150]],
-      "expect": { "open": "#menuProjects", "activeText": "Sky" } },
+      "expect": { "open": "#menuProjects", "activeText": "Sky", "top": [["#hubMain", 64]] } },
     { "name": "ArrowDown walks to Table", "continue": true,
       "steps": [["press", "ArrowDown"]],
       "expect": { "activeText": "Table" } },
-    { "name": "ArrowUp wraps to the last item (Docs, the About/Docs row)", "continue": true,
+    { "name": "ArrowUp wraps to the last item (New project; About and Docs are footer links, task 1003332)", "continue": true,
       "steps": [["press", "ArrowUp"], ["press", "ArrowUp"]],
-      "expect": { "activeText": "Docs" } },
+      "expect": { "activeText": "New project" } },
     { "name": "Escape closes and returns focus to the trigger", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100]],
       "expect": { "closed": "#menuProjects", "activeId": "projTrig", "expanded": false } },
     { "name": "opening the profile band closes the Projects band", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "#who"], ["wait", 120]],
-      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "expandedIds": ["who"] } },
+      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "expandedIds": ["who"], "top": [["#hubMain", 64]] } },
     { "name": "a click outside closes", "continue": true,
       "steps": [["clickAt", 700, 600], ["wait", 120]],
       "expect": { "closed": "#menuProfile", "expanded": false } },
     { "name": "Tab out of the band closes it", "continue": true,
-      "steps": [["click", "#projTrig"], ["wait", 120], ["focus", "#menuProjects a[href=\"/docs\"]"], ["press", "Tab"], ["wait", 120]],
+      "steps": [["click", "#projTrig"], ["wait", 120], ["focus", "#menuProjects a[data-nav=\"new\"]"], ["press", "Tab"], ["wait", 120]],
       "expect": { "closed": "#menuProjects" } },
     { "name": "Table from the band: the table on stage, Table current, band closed", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"table\"]"], ["wait", 300]],
@@ -54,12 +57,16 @@
     { "name": "the mode toggle: the label says what the press does, and the press does it", "continue": true,
       "steps": [["clickAt", 700, 600], ["click", "#modeToggle"], ["wait", 100]],
       "expect": { "attr": [["#modeToggle", "aria-label", "Switch to light mode"], ["html", "data-mode", "dark"]] } },
+    { "name": "the Table deep link (the landing's band item) lands on the table, Table current (task 1003332)", "auth": true, "width": 1440, "url": "/projects?view=map&sub=table",
+      "steps": [["wait", 300]],
+      "expect": { "visible": ["#sub-table-body", ".tblMast"], "hidden": ["#sub-sky-body"], "text": [["[aria-current=\"page\"]", "Table"], [".tblTitle", "every project"]] } },
     { "name": "signed out: no chip, the door shows, no switch, the search stays", "auth": false, "width": 1440,
       "steps": [],
       "expect": { "hidden": ["#who", ".switch"], "visible": ["#signinTop", "#qWrap"] } },
-    { "name": "signed out the Projects band is Sky / Table / New project + About / Docs (no Your projects)", "continue": true,
+    { "name": "signed out the Projects band is Sky / Table / New project (no Your projects); About and Docs are in the footer row", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120]],
-      "expect": { "count": [["#menuProjects .bandCell:not([hidden])", 5]], "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
+      "expect": { "count": [["#menuProjects .bandCell:not([hidden])", 3], ["#menuProjects a[href=\"/docs\"]", 0]], "hidden": ["#menuProjects [data-nav=\"mine\"]"],
+                  "href": [[".footNav a[href=\"/#about\"]", "/#about"], [".footNav a[href=\"/docs\"]", "/docs"]] } },
     { "name": "signed out: the card still closes on Escape (nothing throws with no session)", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100], ["dispatchClick", "#orbField a.worldOrb:not(#selfOrb)"], ["wait", 400], ["press", "Escape"], ["wait", 150]],
       "expect": { "dialog": false, "closed": "#menuProjects" } },
@@ -69,9 +76,9 @@
     { "name": "390: Escape folds the row and returns focus to the magnifier", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100]],
       "expect": { "activeId": "qToggle", "hasClass": [["#qWrap", "is-open", false]] } },
-    { "name": "390: an opening band folds the search", "continue": true,
+    { "name": "390: an opening band folds the search and overlays the sky (the content does not move)", "continue": true,
       "steps": [["click", "#qToggle"], ["wait", 100], ["click", "#projTrig"], ["wait", 150]],
-      "expect": { "hasClass": [["#qWrap", "is-open", false]], "open": "#menuProjects" } },
+      "expect": { "hasClass": [["#qWrap", "is-open", false]], "open": "#menuProjects", "top": [["#hubMain", 60]] } },
     { "name": "390: a solo Shift tap opens the fold and focuses the field, without overflow", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100], ["press", "Shift"], ["wait", 150]],
       "expect": { "hasClass": [["#qWrap", "is-open", true]], "activeId": "mapQ", "noOverflow": true } }

package/public-landing/projects.states.json

@@ -14,7 +14,7 @@
     "in-map-kbd": { "auth": true, "actions": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 350], ["press", "ArrowDown"], ["wait", 120]], "expect": { "expanded": true, "activeText": "Table" } },
     "in-map-search": { "auth": true, "actions": [["clickIfVisible", "#qToggle"], ["wait", 200], ["fill", "#mapQ", "emer"], ["wait", 300]], "expect": { "value": [["#mapQ", "emer"]] } },
     "in-map-mine-on": { "auth": true, "actions": [["check", "#onlyMine"], ["wait", 300]], "expect": { "checked": "#onlyMine" } },
-    "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body"], "closed": "#menuProjects" } },
+    "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body", ".tblMast", ".mastObj"], "closed": "#menuProjects" } },
     "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap"] } },
     "in-new": { "auth": true, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },

package/scripts/gds/provision.js

@@ -768,6 +768,107 @@ async function settingsApplyInstance(inst, deps) {
   return { ok: true, healthy, consumed };
 }
 
+// ---------------------------------------------------------------------------
+// Restart an ALREADY-ACTIVE instance the heartbeat cannot reach (task 1003238 —
+// the honest owner action behind the card's "unreachable" line). This is
+// settingsApplyInstance minus the env patch: nothing about the instance's
+// configuration changes, so there is no file to read and no file to write — just
+// the restart and the same PATIENT healthz verify, whose result is recorded on
+// the liveness overlay so the card that sent the owner here updates itself.
+//
+// Why its own leg rather than a re-provision: PROVISION_ENQUEUE_FROM deliberately
+// excludes 'active' (task 1002691), and provisionInstance is a no-op on an active
+// instance by design — a full standup is the wrong tool for "turn it off and on
+// again". Why not settings-apply: that leg only runs behind a value that actually
+// CHANGED, which is exactly the case a stuck project does not have.
+//
+// Like the settings push, EVERY expected failure RETURNS { ok:false } instead of
+// throwing: the drain loop's catch flips the instance to 'error', and an instance
+// that is merely unreachable must not be relabelled broken by the very action
+// meant to recover it — that would drop it off the liveness sweep and leave a
+// re-provision as its only exit (ADR 0190 §2).
+// ---------------------------------------------------------------------------
+async function restartInstance(inst, deps) {
+  const { db, provisioning, exec, log, apply, privileged } = deps;
+  // Same box routing as settingsApplyInstance: a standalone runs control-plane-local.
+  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const sudoP = privileged ? 'sudo ' : '';
+  log(`restart ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
+
+  // A clean no-op (not an error) so a teardown that raced the restart never burns
+  // the intent's retry budget: every non-active state either has nothing running
+  // yet or is being reclaimed.
+  if (inst.status !== 'active') {
+    log(`  instance is '${inst.status}' — nothing running to restart`);
+    return { ok: true, noop: true };
+  }
+  // A dedicated droplet has no runner exec path (the placeManifestCreds refusal).
+  // The route refuses to enqueue for this shape too; this is the second gate.
+  if (inst.hosting_shape === 'dedicated') {
+    return { ok: false, error: `restart is not automated for a dedicated droplet — run 'systemctl restart ${inst.slug}' on that machine` };
+  }
+  if (!apply) {
+    boxExec(`${sudoP}systemctl restart ${inst.slug}`);
+    boxExec(healthzCmd(inst), { allowFail: true });
+    log(`  ✓ would restart ${inst.slug} and wait for it to answer (dry-run — nothing ran)`);
+    return { ok: true, healthy: null };
+  }
+  try {
+    log('  [service] restart');
+    boxExec(`${sudoP}systemctl restart ${inst.slug}`);
+  } catch (e) {
+    // ok:false, never a throw — the retry simply restarts again (idempotent).
+    return { ok: false, error: `could not restart ${inst.slug}: ${(e && e.message) || e}` };
+  }
+
+  // Verify it came back, with the manifest probe's patience (the F23 lesson). A
+  // false "down" is never cosmetic here: this instance is ALREADY flagged
+  // unreachable, and a hasty verdict would tell the owner their restart failed.
+  log('  [healthz] verify the instance answers after the restart');
+  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let healthy = false;
+  for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
+    const res = boxExec(healthzCmd(inst), { allowFail: true });
+    if (res && !res.softFailed) { healthy = true; break; }
+    if (i < MANIFEST_VERIFY_TRIES - 1) await sleep(MANIFEST_VERIFY_INTERVAL_MS);
+  }
+  // Same narrowness as the settings push: a loopback PASS proves the process, not
+  // the address, so only the domain-scoped sweep may claim "up" for an instance
+  // that HAS a domain. Silence after the whole budget is a verdict on any shape.
+  const probeIsVerdict = healthy === false || (healthy === true && !inst.domain);
+  if (probeIsVerdict && provisioning.recordLivenessProbe) await provisioning.recordLivenessProbe(db, inst.id, healthy).catch(() => {});
+  // A restart that worked retires any "we stopped trying" note left by earlier
+  // work (the F19 latch) — the note outliving its own recovery is the bug.
+  // DELIBERATELY gated on `healthy`, NOT on probeIsVerdict: the two answer
+  // different questions. probeIsVerdict asks "may this run claim the instance is
+  // UP?" — a loopback pass may not, for an instance whose address the sweep owns.
+  // The note asks "did work stop partway?", and a process that restarted and
+  // answered is that work finishing, whatever the public address does next.
+  // Holding the note until the sweep agrees would leave a stale "nothing more
+  // will happen" on the card of a project that just visibly recovered.
+  if (healthy && provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  // Name WHAT was observed, not a verdict this probe cannot reach. healthzCmd is
+  // loopback (127.0.0.1:<port>) while the liveness sweep probes the PUBLIC
+  // https://<domain>/healthz — so an instance can answer here while DNS, Caddy or
+  // TLS is the thing actually broken. "Answering again" on a domained instance
+  // would contradict the card still reading "unreachable"; the same asymmetry is
+  // why probeIsVerdict above declines to write an up-verdict for that case.
+  const outcome = !healthy ? 'restarted, but it is not answering on the box — something there needs a look'
+    : inst.domain ? 'restarted and answering on the box; whether its public address answers is for the next liveness sweep to say'
+    : 'restarted and answering again';
+  await provisioning.recordEvent(db, {
+    instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'restarted',
+    detail: `restart requested — ${outcome}`,
+    actor: 'runner',
+  }).catch(() => {});
+  log(healthy ? `  ✓ ${inst.slug} ${outcome}` : `  ⚠ ${inst.slug} ${outcome}`);
+  // ok:true either way: the restart RAN. A project that stays down is a truthful
+  // observation for the card, not a failed intent to retry MAX_INTENT_ATTEMPTS
+  // times — restarting a broken instance four more times fixes nothing and would
+  // end by stamping an error_note over the owner's own deliberate action.
+  return { ok: true, healthy };
+}
+
 // ---------------------------------------------------------------------------
 // Teardown one instance (reverse the runbook; idempotent).
 // ---------------------------------------------------------------------------
@@ -1049,6 +1150,7 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'teardown') result = await teardownInstance(inst, deps);
       else if (intent.action === 'domain-attach') result = await domainAttachInstance(inst, deps);
       else if (intent.action === 'settings-apply') result = await settingsApplyInstance(inst, deps);
+      else if (intent.action === 'restart') result = await restartInstance(inst, deps);
       else result = { ok: false, error: `unknown intent action '${intent.action}' — refusing to guess` };
       if (result && result.ok === false) {
         if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
@@ -1238,6 +1340,8 @@ module.exports = {
   domainAttachInstance, cmdRunIntents, cmdReconcile, cmdStatus,
   // live settings push (task 1003140) + the in-place env patch + read-back it rides on
   settingsApplyInstance, upsertEnvVars, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
+  // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch
+  restartInstance,
   // GitHub App Manifest flow (task 2080, ADR 0133)
   convertManifestCode, placeManifestCreds, drainOAuthManifests, MANIFEST_UA,
   // cross-site identity federation (ADR 0141 §4, task #1002109)

package/src/module-api.js

@@ -1238,8 +1238,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.397 with no explicit bump. run 33199474439. (task 1002620)
 //   1.19.399 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.398 with no explicit bump. run 33201243958. (task 1002620)
+//   1.19.400 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.399 with no explicit bump. run 33201979306. (task 1002620)
+//   1.19.401 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.400 with no explicit bump. run 33205015717. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.399'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.401'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/landing_page.mjs

@@ -475,14 +475,17 @@ test('the bar is markup: the mark, the Projects trigger, the mode glyph, the sig
   assert.match(PAGE_CSS, /\.topbar\{position:relative;z-index:50;height:var\(--top-h\);display:flex;align-items:center;gap:22px;\s*padding:0 26px;background:var\(--bg\);border-bottom:1px solid var\(--rule\)\}/, 'the page ground closed by one hairline, z-index unified with the hub');
 });
 
-test('the Projects band deep-links the hub\'s views; About and Docs sit under a hairline; no item is current here', () => {
+test('the Projects band deep-links the hub\'s views; About and Docs are footer links, not band items; no item is current here', () => {
   const body = HTML.split('<body>')[1].split('<script>')[0];
   assert.match(body, /<div class="menuBand" id="menuProjects" data-menu="projects" hidden>/);
   assert.match(body, /<a class="bandT" href="\/projects\?view=map">Sky<\/a>/);
   assert.match(body, /<a class="bandT" href="\/projects\?view=map&amp;sub=table">Table<\/a>/, 'the Table item lands on the table (the hub reads sub=table on boot)');
   assert.match(body, /<li class="bandCell" id="mineCell" hidden><a class="bandT" href="\/projects\?view=mine">Your projects<\/a>/, 'member-gated: hidden until the session resolves');
   assert.match(body, /<a class="bandT" href="\/projects\?view=new">New project<\/a>/);
-  assert.match(body, /<ul class="bandRow bandMore">\s*<li class="bandCell"><a class="bandT" href="#about">About<\/a><\/li>\s*<li class="bandCell"><a class="bandT" href="\/docs">Docs<\/a><\/li>/, 'About and Docs under the hairline (§5)');
+  // About and Docs are site pages, not project views (owner, 2026-08-28; task 1003332):
+  // they left the band for the footer row, beside Privacy / Terms / Contact
+  assert.doesNotMatch(body, /bandMore|<a class="bandT" href="#about">|<a class="bandT" href="\/docs">/, 'About and Docs are not in the Projects band');
+  assert.match(body, /<a href="#about">About<\/a>\s*<a href="\/docs">Docs<\/a>\s*<a href="\/privacy">Privacy<\/a>/, 'About and Docs open the footer row');
   assert.match(body, /<section class="band" id="about">/, 'About has a real anchor: the lifecycle band');
   assert.doesNotMatch(body.split('<main')[0], /aria-current/, 'the landing is none of those views');
   // the profile band: the person, My projects, the deferred slot, Sign out as the honest anchor
@@ -496,9 +499,10 @@ test('the Projects band deep-links the hub\'s views; About and Docs sit under a
     assert.ok(body.includes('>' + copy + '<'), `"${copy}" is only reachable with scripting on`);
   }
   // the menu container is .menuBand: .band is this page's own content sections
-  assert.match(PAGE_CSS, /\.menuBand\{position:relative;z-index:49;background:var\(--bg-card\);border-bottom:1px solid var\(--rule\);/);
+  // the bands OVERLAY the page (task 1003332): absolute at the bar's height, so the hero never reflows
+  assert.match(PAGE_CSS, /\.menuBand\{position:absolute;left:0;right:0;top:var\(--top-h\);z-index:49;background:var\(--bg-card\);border-bottom:1px solid var\(--rule\);/);
   assert.doesNotMatch(PAGE_CSS, /\.band\{[^}]*animation:bandIn/, 'the menu rule never lands on the content bands');
-  assert.match(PAGE_CSS, /\.bandMore \.bandT\{font-size:17px;font-weight:400;min-height:24px;display:inline-flex;align-items:center\}/, 'the About/Docs links clear the 24px floor');
+  assert.doesNotMatch(PAGE_CSS, /\.bandMore/, 'the About/Docs rung left the sheet with the markup');
 });
 
 test('the bands are one disclosure: Escape returns focus, arrows cycle, Tab out closes, one closes the other', () => {

package/tests/projects_hub.mjs

@@ -49,7 +49,14 @@ test('the Projects band carries the views; Home is gone and the mark is the way
   assert.match(HUB, /href="\?view=map" data-nav="map" data-sub="sky" aria-current="page">Sky<\/a>/);
   assert.match(HUB, /href="\?view=map&amp;sub=table" data-nav="map" data-sub="table">Table<\/a>/);
   assert.match(SCRIPT, /get\('sub'\) === 'table'\) setSub\('table'\);/, 'the Table deep link lands on the table');
-  assert.match(HUB, /<a class="bandT" href="\/#about">About<\/a>/, 'About sits under the hairline (§5)');
+  // setView rewrites the URL to ?view=<v>; the boot query must be captured BEFORE it
+  // runs or sub=table is gone by the time it is read (task 1003332)
+  assert.match(SCRIPT, /var bootQ = new URLSearchParams\(location\.search\);\s*setView\(viewFromUrl\(\)\);[\s\S]{0,400}?if \(bootQ\.get\('sub'\) === 'table'\) setSub\('table'\);/, 'the boot query is read once, before setView');
+  // About and Docs are site pages, not project views (owner, 2026-08-28; task 1003332):
+  // they left the band for the footer row, beside Privacy / Terms / Contact
+  assert.doesNotMatch(HUB, /bandMore|<a class="bandT" href="\/#about">|<a class="bandT" href="\/docs">/, 'About and Docs are not in the Projects band');
+  assert.match(HUB, /<nav class="footNav" aria-label="Site"><a href="\/#about">About<\/a><a href="\/docs">Docs<\/a><a href="\/privacy">Privacy<\/a>/, 'About and Docs open the footer row');
+  assert.doesNotMatch(COSMOS, /\.bandMore/, 'the About/Docs rung left cosmos with the markup');
   assert.doesNotMatch(HUB, /id="sub-sky"|id="sub-table"|class="toolbar"|class="seg"/, 'the toolbar and its seg are retired');
   assert.doesNotMatch(SCRIPT, /dataset\.nav === 'home'/, 'no dead Home branch in the router');
   assert.match(SCRIPT, /if \(a\.dataset\.sub\) setSub\(a\.dataset\.sub\);/, 'a band item may pick the map sub-view');
@@ -138,6 +145,10 @@ test('the bands: one disclosure, two instances — Escape returns focus, the car
   assert.match(HUB, /<div class="menuBand" id="menuProjects" data-menu="projects" hidden>/);
   assert.match(HUB, /<div class="menuBand" id="menuProfile" data-menu="profile" hidden>/);
   assert.doesNotMatch(HUB, /role="menu"|aria-haspopup/, 'plain links in a disclosure — announced as what ships');
+  // the bands OVERLAY the page (owner, 2026-08-28; task 1003332): absolute against the
+  // document at the bar's height, so opening one never reflows the sky, the table or the footer
+  assert.match(COSMOS, /\.menuBand\{position:absolute;left:0;right:0;top:var\(--top-h\);z-index:49;background:var\(--bg-card\);border-bottom:1px solid var\(--rule\);/, 'a band is a layer under the bar, never a push');
+  assert.doesNotMatch(COSMOS, /PUSHES the page/, 'the sheet no longer describes the push-down');
   assert.match(SCRIPT, /function closeMenus\(\) \{[\s\S]*?if \(inside && trig\) trig\.focus\(\);/, 'focus restoration is a property of the close, not of one caller');
   assert.match(SCRIPT, /if \(ev\.key === 'Escape' && !openBand\(\)\) closeCard\(\);/, 'the card yields Escape to an open band');
   assert.match(SCRIPT, /function setView\(v, focus\) \{[\s\S]*?\$\('qWrap'\)\.hidden = \$\('qToggle'\)\.hidden = \(v !== 'map'\);/, 'the search hides off the map in the router');
@@ -525,6 +536,22 @@ test('no sort control is offered for a column that cannot sort', () => {
   }
 });
 
+test('the table is in the world: a masthead, then ledger rows — no panel, no shadow, the accent only on the row\'s door (task 1003332)', () => {
+  // the owner's pick from three rendered treatments: the view title in the display
+  // voice and one chrome object; the title is two words ("every project", the owner cut ", as rows")
+  assert.match(HUB, /<div class="tblMast">\s*<h2 class="tblTitle">every project<\/h2>\s*<span class="mastObj" aria-hidden="true"><\/span>\s*<\/div>\s*<table class="tbl">/, 'one masthead ahead of the table');
+  assert.doesNotMatch(HUB, /tblMast--t[123]|data-tbl|mastCallouts|mastField/, 'the render round\'s switch and the unpicked mastheads left with the pick');
+  assert.match(COSMOS, /\.tbl\{width:100%;border-collapse:collapse;background:none;\}/, 'the rows sit on the page ground — no card');
+  assert.doesNotMatch((COSMOS.match(/\.tbl\{[^}]*\}/) || [''])[0], /border-radius|box-shadow/, 'no radius, no shadow on the table');
+  assert.match(COSMOS, /\.tbl td\{padding:17px 14px;border-bottom:1px solid var\(--rule-soft\);/, 'ledger rows: hairlines');
+  assert.match(COSMOS, /\.tbl tbody tr:hover td\{border-bottom-color:var\(--ink-faint\);\}/, 'hover is the hairline taking ink, not an accent tint');
+  assert.match(COSMOS, /\.rowGo\{[^}]*color:var\(--accent-deep\);text-decoration:underline;/, 'the row\'s door is accent text');
+  assert.match(HUB, /<a class="rowGo" href="\/">Open →<\/a>/, 'the self row\'s door');
+  assert.match(SCRIPT, /'<a class="rowGo" href="' \+ esc\(safeHttpUrl\(p\.origin\)\)/, 'the generated rows\' door');
+  assert.match(COSMOS, /\.mastObj\{display:block;--dia:clamp\(96px,10vw,132px\);[^}]*background-image:var\(--plate-set-cut\);/, 'the object is the set\'s small bead by token, in both modes');
+  assert.doesNotMatch(COSMOS, /mix-blend-mode:var\(--mast/, 'the cutout needs no blend — the view wrap is a stacking context');
+});
+
 test('every live column keeps its styling — .colType included since task 1002772', () => {
   for (const live of ['.tbl .num', '.tbl .tags', '.colTags', '.colType', '.typeTag']) {
     assert.ok(COSMOS.includes(live), `${live} styles a column that renders real data`);