@bongos/core 1.19.400 → 1.19.402

package/docs/design/projects-hub-direction-v2.md

@@ -106,3 +106,41 @@ The criterion `apex-hub-chrome-and-card` moves to the builds: task 1003300 (the
 - **Task 1003300** builds v2's bar, menus (Sky / Table / Your projects / New project) and search, with Only mine beside the search and the toolbar retired, into `public-landing/projects.html` + `cosmos.css` (the hub's sheet moves onto the world's derived tier the way `world.css` did, keeping `--line` and the status vocabulary), retargets the tests in §6, regenerates the copy registry.
 - **Task 1003301** builds the picked card and its ladder, adds the enrichment fields (§6) inside the same `Promise.allSettled` with the shared null object, gates the hall entry on the new hall-address field and membership, and keeps the orbs and the hover card untouched.
 - The unpicked versions stay on disk as built and verified; what they leave behind is listed per version in §3.
+
+## 9. The owner's review of the shipped chrome, and the table in the world (task 1003332)
+
+**Date:** 2026-08-28 · three corrections from the owner's screenshot review of `/projects` (the Projects band open, the table view). Each overrides §7 where they conflict. Rendered through the kit before and after (`node modules/ui-design/kit/render.js --page /projects`, both modes, 1440 / 390 / 320; the landing the same) — ALL CLEAN throughout; the probes 26/26 on the hub and 11/11 on the landing.
+
+### 9.1 About and Docs leave the Projects band: the footer row
+
+They are site pages, not project views. Two placements were rendered as a before/after on both pages (dark and light, 1440 and 390): **(A)** beside the identity slot as two lowercase text triggers (`about docs projects`), folding away under 900; **(B)** the footer row the landing already had (About · Docs · Privacy · Terms · Contact · Builders' hall). **Pick: B, the footer, on both pages.** One home at every width (A needs the footer anyway under 900 — two homes for two links); the bar stays the Operate bar given 3 asked for ("this way we dont clutter the bar"); About and Docs are the same kind of thing as Privacy / Terms / Contact. Consequences: the `bandMore` rung and its rules left both sheets; the hub's footer row wraps (`flex-wrap`) and `--foot-h` was re-measured with six links in it (136px under 420, 154px under 340, so the sky still fits the viewport); the About anchor stays the landing's lifecycle band (`/#about` from the hub, `#about` on the landing) until goal 1000063's page takes it. Probes retargeted: the band's last item is New project, the signed-out band is three cells, the footer carries both hrefs on both pages.
+
+### 9.2 The bands overlay; the page does not reflow
+
+`.menuBand` is `position:absolute; left:0; right:0; top:var(--top-h); z-index:49` against the document in both sheets. Everything else the disclosure did stays: full width on `bg-card` closed by one hairline, `aria-expanded` + `aria-controls` and no menu role, Escape / arrows / Enter / Tab-out / click-outside, one open at a time, the 220ms rise + fade on the world's ease-out, dead under the kill switch. The stack: band 49 < bar 50 < the folded search row 51 < the card scrim 60. The kit gained a `top[[sel,px]]` expectation for exactly this proof; the probes assert `#hubMain` at 64px (60 at 390) and the landing's `#main` at 72px both before and after a band opens. DESIGN.md's Navigation paragraph now says overlay.
+
+### 9.3 Found on the way: the Table deep link landed on the sky
+
+`setView()` rewrites the URL to `?view=map` at boot, and the shipped boot read `sub=table` *after* it — so the landing's Table item (and any shared `/projects?view=map&sub=table`) opened the sky. The boot query is now read once, before `setView`; a probe opens the deep link and expects the table on stage with Table current; `tests/projects_hub.mjs` pins the order.
+
+### 9.4 The table in the world: one grammar, three mastheads
+
+**Shared by every treatment (built):** the panel is gone — no `--card` ground, no 20px radius, no `--shadow-card`. The rows are DESIGN.md's ledger rows: 1px `rule-soft` hairlines, 17px of vertical air, the header a `rule` hairline under mono labels in `--label-face`. Builders is set in the figure voice (Manrope 300, 22px, tabular); the project name at 17px/500; the relationship pill is a mono label on a hairline — it states a fact and is not pressable, so the accent left it (the One Warm Thing Rule, §5); the row's door is `open →`, lowercase `accent-deep` text with an underline (the footer-link grammar, 24px tall) in place of the ghost pill; a row's hover is its hairline taking ink, the band cells' grammar, not an accent tint; the status chip keeps its fixed vocabulary; the view title is the display voice (`every project, as rows`). The objects are the landing's alpha **cutouts in both modes** — the view wrap is a stacking context, so a black plate under `lighten` could not reach the page ground the way the hero's do, and a cutout needs no blend — with the world's one contact shadow in light and none in dark. The plate tokens (`--plate-*-cut`) joined cosmos's derived tier by root-absolute path; the mode mapping (`--mast-shadow`, `--mast-scrim`) is in both dark blocks.
+
+Three mastheads, rendered dark and light at 1440 / 390 / 320 (ALL CLEAN) and measured:
+
+| # | Masthead | Height 1440 / 390 | Honest risk |
+|---|---|---|---|
+| **T1 the ledger** | the title at the left, the set's small bead (the landing's `.o3` crop) at the right | 218 / 121 px | the least new information — a chrome object beside a word; also the quietest and the cheapest |
+| **T2 the field** | the sweeping form (the landing's `.form` crop) crossing the masthead behind the title, its left edge masked, a black scrim under the title in dark | 300 / 150 px (+5px over the viewport at 1440) | the crop is cut flat by the wrap's right edge and the masthead's bottom: on black the bottom edge shows, on paper both read as a torn photograph — DESIGN.md's own warning about a cropped form; a pick needs a bottom mask and a right feather, and the title wraps to two lines at 14ch |
+| **T3 the specimen** | the bongo pair (the hero object, whole) at the left, the title beside it, two leader-line callouts with the rows' own numbers (projects, builders) — the landing's hero grammar | 294 / 283 px (+360px of scroll at 390) | the most height on a phone; the figures are live code, and the builders figure summed the rows before the platform's own count had landed (13, not 26) — a pick wires it to refresh when `#selfBuilders` lands and pins it in `tests/projects_hub.mjs` |
+
+**Recommendation: T1.** It carries the world's material into the view at the smallest cost, holds at 390 and 320 without an edge problem in either mode, and is the treatment the mine view and the wizard can repeat (a title and one object). The owner picked from the rendered screens, not from this table.
+
+**The owner's pick (2026-08-28): T1, the ledger — with the title cut to two words.** "t1, but I dont want the ', as rows'": the view title is `every project`. The two unpicked mastheads, the `?tbl=` switch, the three render-round states and T3's figure writes left with the pick; `tests/projects_hub.mjs` pins the masthead, the ledger rules, the row's door and the absence of the switch.
+
+### 9.5 What carries forward
+
+- Task 1003301 (the poster card): the ledger grammar above is the card's facts strip, too.
+- Task 1003319 (the planets): the masthead object rides the same crop maths the orbs will take.
+- The mine view and the wizard are the next views to take a masthead in the picked treatment.

package/docs/recipes/ui-look-before-you-ship.md

@@ -69,7 +69,7 @@ Then a state's own `expect` (a band open, a dialog present, a field's value, a c
 }
 ```
 
-Actions: `click`, `focus`, `press`, `fill`, `wait`, `clickAt x y`, `clickIfVisible`, `dispatchClick`, `check`, `back`, `forward`. Expectations: `expanded`, `dialog`, `visible[]`, `hidden[]`, `open`, `closed`, `activeId`, `activeText`, `expandedIds[]`, `param{}`, `attr[[sel,name,value]]`, `text[[sel,value]]`, `href[[sel,value]]`, `count[[sel,n]]`, `value[[sel,v]]`, `hasClass[[sel,class,bool]]`, `checked`, `noOverflow`. The kit validates the file before it opens a browser and names every problem.
+Actions: `click`, `focus`, `press`, `fill`, `wait`, `clickAt x y`, `clickIfVisible`, `dispatchClick`, `check`, `back`, `forward`. Expectations: `expanded`, `dialog`, `visible[]`, `hidden[]`, `open`, `closed`, `activeId`, `activeText`, `expandedIds[]`, `param{}`, `attr[[sel,name,value]]`, `text[[sel,value]]`, `href[[sel,value]]`, `count[[sel,n]]`, `value[[sel,v]]`, `hasClass[[sel,class,bool]]`, `checked`, `noOverflow`, `top[[sel,px]]` (an element's viewport top — assert it closed, open a band, assert it again: the proof an overlay did not push the page). The kit validates the file before it opens a browser and names every problem.
 
 The worked examples: `public-landing/projects.states.json` (the hub's thirteen), `public-landing/index.states.json` (the landing's four), `modules/hall-ui/public/ranks.states.json` (a second surface under its own prefix — it renders **red**, deliberately: the hall predates the 24px floor and Ranks has no `<h1>`, and the states file declares the shell's un-fixtured feeds rather than hiding the findings; idea 1000863 carries them).
 

package/modules/provisioning/migrations/provisioning_012_domain_repoint.sql

@@ -0,0 +1,35 @@
+-- provisioning_012_domain_repoint.sql — the addresses a re-point still owes a
+-- release on (task 1003237, goal 1000058: a mistyped bring-your-own domain can
+-- be corrected).
+--
+-- WHY. Re-pointing an instance overwrites `domain`, so the address it moved OFF
+-- is gone from the row the instant the web tier records the new one — and the
+-- runner, which is the only tier holding a DNS token, would never learn that a
+-- hostname it once UPSERTed at the platform's IP is now abandoned. ADR 0181 §2
+-- keeps a torn-down project's address deliberately; an address the owner has
+-- explicitly moved off is the opposite case, and leaving its A record aimed at
+-- platform infra is the leak this column closes.
+--
+-- An ARRAY, not a single column: a founder correcting a typo can correct it
+-- twice before the runner drains the first attach, and a scalar would silently
+-- drop the middle address. The runner releases each entry and empties the list.
+--
+-- Only a BYO address is ever appended here, and only from a state that actually
+-- STOOD UP (DOMAIN_RELEASE_FROM = {error, active}). The platform-assigned
+-- <slug>.<apex> is the platform's own name for this slug and the revive path
+-- re-uses it (ADR 0181 §2); a 'requested' instance never had an A record written
+-- for the address it is leaving, so parking that name would CREATE a junk record
+-- rather than release one.
+--
+-- BOUNDED at MAX_RELEASED_DOMAINS by updateInstanceDomain's own SQL. The runner
+-- drains this list synchronously against the SHARED control-plane Cloudflare
+-- token, so an unbounded array would be a platform-wide resource-exhaustion
+-- vector reachable by any owner re-pointing their own project in a loop.
+--
+-- OVERLAY, NOT A STATE (the provisioning_006 rule): defaulted, never written by
+-- the lifecycle. Empty = nothing outstanding. Safe to re-run.
+ALTER TABLE provisioning_instances
+  ADD COLUMN IF NOT EXISTS released_domains text[] NOT NULL DEFAULT '{}';
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_012_domain_repoint')
+ON CONFLICT (version) DO NOTHING;

package/modules/provisioning/provisioning.js

@@ -77,6 +77,17 @@ const PROVISION_ENQUEUE_FROM = new Set(['requested', 'provisioning', 'error', 't
 // 'requested'/'error' only record it — the (re)provision run wires the domain
 // itself. Mid-flight or torn-down states refuse truthfully.
 const DOMAIN_ATTACH_FROM = new Set(['requested', 'error', 'active']);
+// The states in which a re-point has an address worth RELEASING (task 1003237).
+// A 'requested' instance has never stood up, so nothing ever wrote an A record for
+// the address it is leaving — parking that name at the blackhole would CREATE a
+// junk record in the owner's zone rather than release one. An 'error' row is
+// frequently a PARTIAL standup that did write it (ADR 0181 §1), so it counts.
+const DOMAIN_RELEASE_FROM = new Set(['error', 'active']);
+// How many abandoned addresses one instance may have queued for release at once.
+// The runner drains them synchronously against the shared control-plane Cloudflare
+// token, so this is a platform-wide bound, not a per-owner nicety. A real
+// correction queues one; the cap only ever binds on abuse.
+const MAX_RELEASED_DOMAINS = 8;
 // The ONE state a settings push is meaningful from (task 1003140). A pre-active
 // instance needs no push — standup writes the same values from the same
 // effectiveSettings() row — and a torn-down one has nothing to restart. The
@@ -468,13 +479,61 @@ async function updateInstanceSettings(db, id, patch) {
   return rows[0] || null;
 }
 
-// Record an instance's domain — the ONLY column this touches (task 1002692). Status
-// changes stay setInstanceStatus's job; keeping this narrow means the domain-attach
-// route can never drift an instance's lifecycle as a side effect.
-async function updateInstanceDomain(db, id, domain) {
+// Record an instance's domain — the ONLY columns this touches (task 1002692;
+// `releasing` added by task 1003237). Status changes stay setInstanceStatus's job;
+// keeping this narrow means the domain-attach route can never drift an instance's
+// lifecycle as a side effect.
+//
+// `releasing` is the BYO address this instance is moving OFF, appended to the
+// release queue in the SAME statement as the new domain — a re-point that
+// recorded the new address but crashed before queueing the old one would leave a
+// hostname pointed at platform infra with nothing left in the row to say so.
+// Appended, never replaced: two corrections before the runner drains the first
+// must both get released (provisioning_012). null/undefined ⇒ the queue is left
+// exactly as it stands, so a first attach touches nothing.
+//
+// CAPPED at MAX_RELEASED_DOMAINS, enforced here in SQL rather than trusted from
+// the caller. The runner drains this list SYNCHRONOUSLY, one shared-Cloudflare-token
+// call per entry, so an unbounded array is a resource-exhaustion vector against the
+// whole platform — not just the owner's own project — and every re-point is a write
+// an authenticated owner can repeat. Past the cap the append is dropped: the entries
+// already queued are the ones most likely to name a hostname the platform really
+// wired, and a real correction never comes close to the cap (the route also throttles
+// the caller). Dropping is the deliberate failure mode — growing without bound is not.
+//
+// A CHANGED domain also clears the liveness overlay. The overlay is a verdict on
+// an ADDRESS (task 1002696), so carrying it across a re-point would let the card
+// say "answering at <the new address>, last answered 2 minutes ago" when only the
+// OLD address was ever probed — the exact false claim the F16 rule forbids. NULL
+// is "never probed", which is the truth for a name nothing has asked yet; the
+// sweep re-probes within minutes. Guarded in SQL on the value actually changing,
+// so an idempotent re-record can never blank a good probe.
+async function updateInstanceDomain(db, id, domain, releasing = null) {
+  const host = releasing ? String(releasing).toLowerCase() : null;
   const { rows } = await db.query(
-    `UPDATE provisioning_instances SET domain = $2, updated_at = now() WHERE id = $1 RETURNING *`,
-    [id, domain]
+    `UPDATE provisioning_instances
+        SET domain = $2,
+            released_domains = CASE
+              WHEN $3::text IS NULL OR $3 = ANY(released_domains) THEN released_domains
+              WHEN coalesce(array_length(released_domains, 1), 0) >= $4 THEN released_domains
+              ELSE array_append(released_domains, $3)
+            END,
+            last_verified_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_at END,
+            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END,
+            updated_at = now()
+      WHERE id = $1 RETURNING *`,
+    [id, domain, host, MAX_RELEASED_DOMAINS]
+  );
+  return rows[0] || null;
+}
+
+// Empty the release queue once the runner has actually released every address on
+// it (task 1003237). Same narrowness rule as clearErrorNote: no status, no
+// updated_at — draining a queue is not an owner-visible change to the project.
+async function clearReleasedDomains(db, id) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET released_domains = '{}' WHERE id = $1 RETURNING id`,
+    [id]
   );
   return rows[0] || null;
 }
@@ -896,7 +955,8 @@ module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
   settingsEnvLines, settingsEnvVars,
-  PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
+  PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, DOMAIN_RELEASE_FROM, MAX_RELEASED_DOMAINS,
+  SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
   RESTART_FROM, RESTART_SHAPES,
   TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   SETTINGS_VOCAB, DEFAULT_SETTINGS,
@@ -910,7 +970,7 @@ module.exports = {
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
   listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
-  createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings,
+  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)

package/modules/provisioning/routes/provisioning.js

@@ -265,6 +265,17 @@ module.exports = function provisioningRoutes() {
     max: 30,
     key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
   });
+  // Limiter for the domain attach/re-point write (task 1003237). Signed-in and
+  // own-scoped, but since a re-point became possible each call can queue an
+  // address the RUNNER later releases with a call against the SHARED control-plane
+  // Cloudflare token — so an unthrottled owner can spend a platform-wide budget,
+  // not merely their own. Keyed on the BUILDER for the same reason as the slug
+  // check: per-IP would starve co-located builders while an attacker rotates IPs.
+  // A founder gives a project an address, or corrects it, a handful of times ever.
+  const domainWriteRateLimit = makeAskRateLimiter({
+    max: 10,
+    key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
+  });
 
   // Route ORDER is deliberate (the box.js precedent): the Archon-gated routes are
   // declared FIRST, then the any-builder routes. The route-rank auditor
@@ -859,9 +870,11 @@ module.exports = function provisioningRoutes() {
   // Validates + records the domain; for an already-ACTIVE instance it also enqueues
   // a 'domain-attach' intent the control-plane runner drains (web tier holds no
   // cloud tokens — ADR 0111 §2). A requested/error instance only records it: the
-  // (re)provision run wires the domain itself. Re-pointing an existing address is
-  // out of scope — refuse truthfully. Body: { domain (required) }.
-  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, async (req, res) => {
+  // (re)provision run wires the domain itself. A bring-your-own address may be
+  // RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies
+  // decide it, and the address it moved off is queued for release.
+  // Body: { domain (required) }.
+  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, domainWriteRateLimit, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { domain: { required: true, type: 'string', maxLength: 253 } })) return;
@@ -919,15 +932,20 @@ module.exports = function provisioningRoutes() {
         return res.json({ ok: true, changed: false, queued: false, domain: inst.domain,
           message: 'This instance already has that address.' });
       }
-      // A platform-ASSIGNED address may be upgraded away to a bring-your-own
-      // domain — that upgrade path is half the task-1002704 decision (the old
-      // record lingers in DNS, the idea-1000710 class). A genuine BYO address
-      // stays un-re-pointable, as before.
-      if (current && current !== assignedDefault) {
-        return res.fail('domain_already_set', { status: 409,
-          message: `This instance is already addressed as '${inst.domain}' — re-pointing an existing address is not supported here.`,
-          details: { current: inst.domain } });
-      }
+      // A mistyped bring-your-own address can be CORRECTED (task 1003237, owner
+      // decision 2026-08-28 / ADR 0200): the address is the founder's, and the
+      // guards above — reserved, in-apex squat — plus the uniqueness check below
+      // are exactly the ones the first attach applied, so a re-point needs no
+      // weaker rule and gets no stronger one. The address it moves OFF is queued
+      // for release (`releasing`): leaving a hostname UPSERTed at platform infra
+      // for a project that no longer answers there is the leak ADR 0181 §2 named.
+      // Only a BYO address is released, and only from a state that actually STOOD
+      // UP: a platform-ASSIGNED <slug>.<apex> is the platform's own name for this
+      // slug and the revive path re-uses it (ADR 0181 §2), while a 'requested'
+      // instance never had an A record written for the address it is leaving —
+      // parking that name would CREATE a junk record rather than release one.
+      const releasing = current && current !== assignedDefault
+        && provisioning.DOMAIN_RELEASE_FROM.has(inst.status) ? current : null;
       const holder = await provisioning.getInstanceByDomain(pool, domain);
       if (holder && String(holder.id) !== String(inst.id)) {
         return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
@@ -938,8 +956,9 @@ module.exports = function provisioningRoutes() {
           details: { status: inst.status } });
       }
       // Record BEFORE enqueueing: the runner reads the row's domain, so the intent
-      // must never race ahead of the column it wires.
-      await provisioning.updateInstanceDomain(pool, id, domain);
+      // must never race ahead of the column it wires. The release queue rides the
+      // SAME statement — see updateInstanceDomain.
+      await provisioning.updateInstanceDomain(pool, id, domain, releasing);
       let queued = false;
       if (inst.status === 'active') {
         const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
@@ -957,22 +976,30 @@ module.exports = function provisioningRoutes() {
             instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
             detail: `domain ${domain} recorded (attach already queued)`, actor: 'api:self',
           }).catch(() => {});
-          return res.json({ ok: true, changed: true, queued: false, domain,
+          return res.json({ ok: true, changed: true, queued: false, domain, replaced: releasing,
             message: 'That address is already being wired for this instance.' });
         }
       }
+      const moved = releasing ? ` (moved off ${releasing}, queued for release)` : '';
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
-        detail: queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`,
+        detail: (queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`) + moved,
         actor: 'api:self',
       }).catch(() => {});
-      res.json({ ok: true, changed: true, queued, domain,
-        // State-only sentence (task 1002720 / F16): the web tier holds no cloud
-        // tokens and cannot know whether a DNS hook exists on the runner, so
-        // "it will answer there shortly" was a promise it could not keep.
-        message: queued
-          ? 'Your instance is being wired to its new address — this card will show whether it answers.'
-          : 'Address recorded — it will be wired when the instance is provisioned.' });
+      // State-only sentences (task 1002720 / F16): the web tier holds no cloud
+      // tokens and cannot know whether a DNS hook exists on the runner, so "it
+      // will answer there shortly" was a promise it could not keep. The re-point
+      // sentences name the old address in the same voice — what they say has
+      // ALREADY happened is the recording, not the unwiring. One lookup rather
+      // than a nested ternary, so each of the four states reads as its own line.
+      const MESSAGES = {
+        'queued:repoint': `Your project is being wired to ${domain}; ${releasing} is being let go.`,
+        'queued:first': 'Your instance is being wired to its new address — this card will show whether it answers.',
+        'recorded:repoint': `Address changed to ${domain} — it will be wired, and ${releasing} let go, when the instance is provisioned.`,
+        'recorded:first': 'Address recorded — it will be wired when the instance is provisioned.',
+      };
+      res.json({ ok: true, changed: true, queued, domain, replaced: releasing,
+        message: MESSAGES[`${queued ? 'queued' : 'recorded'}:${releasing ? 'repoint' : 'first'}`] });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
       res.fail('domain_attach_failed', { status: 500, message: 'internal error' });

package/modules/ui-design/kit/lib.js

@@ -123,7 +123,9 @@ async function runActions(page, actions = []) {
 // A state may EXPECT (render.js) and a probe must EXPECT (probe.js). Selectors are
 // evaluated in the page; scalars compared here. `open`/`visible` = present and not
 // hidden; `closed`/`hidden` = absent or hidden.
-const EXPECT_KEYS = Object.freeze(['expanded', 'dialog', 'visible', 'hidden', 'open', 'closed', 'activeId', 'activeText', 'expandedIds', 'param', 'attr', 'text', 'href', 'count', 'checked', 'value', 'hasClass', 'noOverflow']);
+// `top` pins an element's viewport top in px (rounded) — the probe that proves an overlay
+// did not push the page (task 1003332): assert it closed, open it, assert it again.
+const EXPECT_KEYS = Object.freeze(['expanded', 'dialog', 'visible', 'hidden', 'open', 'closed', 'activeId', 'activeText', 'expandedIds', 'param', 'attr', 'text', 'href', 'count', 'checked', 'value', 'hasClass', 'noOverflow', 'top']);
 function validateExpect(expect, at) {
   if (expect === undefined) return [];
   if (!expect || typeof expect !== 'object' || Array.isArray(expect)) return [`${at}: an object`];
@@ -134,7 +136,7 @@ function validateExpect(expect, at) {
   for (const k of ['expanded', 'dialog', 'noOverflow']) if (expect[k] !== undefined && typeof expect[k] !== 'boolean') errors.push(`${at}.${k}: a boolean`);
   if (expect.expandedIds !== undefined && !Array.isArray(expect.expandedIds)) errors.push(`${at}.expandedIds: an array of ids`);
   if (expect.param !== undefined && (typeof expect.param !== 'object' || Array.isArray(expect.param))) errors.push(`${at}.param: an object of name → value (null = absent)`);
-  for (const k of ['attr', 'text', 'href', 'count', 'value', 'hasClass']) if (expect[k] !== undefined && !(Array.isArray(expect[k]) && expect[k].every(Array.isArray))) errors.push(`${at}.${k}: an array of [selector, ...]`);
+  for (const k of ['attr', 'text', 'href', 'count', 'value', 'hasClass', 'top']) if (expect[k] !== undefined && !(Array.isArray(expect[k]) && expect[k].every(Array.isArray))) errors.push(`${at}.${k}: an array of [selector, ...]`);
   return errors;
 }
 // Runs IN THE PAGE: collects the facts the expectations compare against, plus the
@@ -183,6 +185,7 @@ function factsInPage(spec) {
   if (e.checked) { const el = q(e.checked); out.checked = el ? !!el.checked : null; }
   if (e.value) out.value = e.value.map(([s]) => { const el = q(s); return el ? el.value : null; });
   if (e.hasClass) out.hasClass = e.hasClass.map(([s, c]) => { const el = q(s); return el ? el.classList.contains(c) : null; });
+  if (e.top) out.top = e.top.map(([s]) => { const el = q(s); return el ? Math.round(el.getBoundingClientRect().top) : null; });
   return out;
 }
 // Pure: compare collected facts against an expectation. Returns problem strings.
@@ -208,6 +211,7 @@ function expectProblems(facts, expect = {}) {
   if (expect.checked !== undefined && facts.checked !== true) p.push(`${expect.checked} is not checked`);
   (expect.value || []).forEach(([s, v], i) => { if (facts.value[i] !== v) p.push(`${s} value "${facts.value[i]}", expected "${v}"`); });
   (expect.hasClass || []).forEach(([s, c, want = true], i) => { if (facts.hasClass[i] !== want) p.push(`${s} ${want ? 'lacks' : 'still has'} class "${c}"`); });
+  (expect.top || []).forEach(([s, v], i) => { if (facts.top[i] !== v) p.push(`${s} top ${facts.top[i]}px, expected ${v}px`); });
   if (expect.noOverflow && facts.scrollWidth > facts.clientWidth + 1) p.push(`horizontal overflow ${facts.scrollWidth} > ${facts.clientWidth}`);
   return p;
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.400",
+  "version": "1.19.402",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.400",
+      "version": "1.19.402",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.400",
+  "version": "1.19.402",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -130,6 +130,8 @@
   --label-face:var(--font-body);
   --label-size:11.5px;
   --label-space:.1em;
+  /* the view masthead's object (task 1003332): dark drops the contact shadow */
+  --mast-shadow:none;
   color-scheme:dark;
 }
 @media (prefers-color-scheme: dark){
@@ -165,6 +167,8 @@
     --label-face:var(--font-body);
     --label-size:11.5px;
     --label-space:.1em;
+    /* the view masthead's object (task 1003332): dark drops the contact shadow */
+    --mast-shadow:none;
     color-scheme:dark;
   }
 }
@@ -246,6 +250,15 @@
   --radius:16px; --radius-sm:10px; --radius-pill:999px;
   --top-h:64px;
   --gutter:clamp(16px,4vw,34px);
+  /* the world's object for the hub's view masthead (task 1003332): the apex
+     shares the landing's plates because it is the same world (DESIGN.md
+     "Materials"); the hub takes the alpha CUTOUT in both modes — the view
+     wraps are stacking contexts, so a black plate under `lighten` could not
+     reach the page ground the way the hero's do, and a cutout needs no blend.
+     Root-absolute path: a url() in a custom property resolves against the
+     DOCUMENT. Light gives the object the world's one contact shadow. */
+  --plate-set-cut:url(/assets/world/r2-chrome-blobs-set-cut.webp);
+  --mast-shadow:drop-shadow(0 26px 30px color-mix(in srgb,var(--ink) 20%,transparent));
   /* the footer's measured height per width — the sky is 100vh minus the bar and
      this, so the map fits the viewport with no scrollbar (T2's rule); the
      toolbar row that used to be in that sum is gone (task 1003300) */
@@ -255,8 +268,13 @@
 @media (max-width:900px){
   :root{--top-h:60px;--foot-h:108px;}
 }
-@media (max-width:360px){
-  :root{--foot-h:126px;}
+/* with About + Docs in the row (task 1003332) the six links wrap to a second
+   row under ~420px, and the sentence takes a third line under ~340px — measured */
+@media (max-width:420px){
+  :root{--foot-h:136px;}
+}
+@media (max-width:340px){
+  :root{--foot-h:154px;}
 }
 
 *{box-sizing:border-box;margin:0;padding:0;}
@@ -386,6 +404,8 @@ a.orb{cursor:pointer;}
 .attachFold{margin-top:12px;}
 .attachFold summary{cursor:pointer;width:fit-content;font-size:13px;font-weight:700;color:var(--ink-faint);}
 .attachFold summary:hover,.attachFold[open] summary{color:var(--ink-soft);}
+.attachNote{margin:8px 0 0;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+.attachNote code{font-family:var(--font-mono);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}
@@ -413,7 +433,7 @@ a.orb{cursor:pointer;}
 .foot a:hover{text-decoration:underline;}
 /* the footer doors (task 1003251): privacy · terms · contact on one row under the
    line, on every landing surface — the same link ink, the current page underlined */
-.foot .footNav{display:flex;justify-content:center;gap:16px;margin-top:8px;}
+.foot .footNav{display:flex;flex-wrap:wrap;justify-content:center;gap:4px 16px;margin-top:8px;}
 .foot .footNav a[aria-current="page"]{text-decoration:underline;}
 
 /* ── progress strips: one visual, per-flow vocabularies (direction §4).
@@ -611,13 +631,17 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .switch:has(input:checked){color:var(--ink);}
 
 /* ── THE BANDS: a menu is not a floating card. It unfolds under the bar's edge,
-   full width on the card ground, closed by one hairline, and PUSHES the page
-   down. Cells in a hairline-separated row, each a lowercase display title over
-   one clause; the whole cell is the target. The current view carries a 2px
-   accent hairline on its top edge — the rail-step-lit grammar from DESIGN.md,
-   moved onto a menu. One authored move, a 6px rise + fade on the world's
-   exponential ease-out, dead under the kill switch at the end of this file. ── */
-.menuBand{position:relative;z-index:49;background:var(--bg-card);border-bottom:1px solid var(--rule);
+   full width on the card ground, closed by one hairline, as a LAYER OVER the
+   page: the page does not reflow (the owner's correction, task 1003332 — the
+   shipped bands pushed the page down). Absolute against the document, top at
+   the bar's height, so the sky, the table and the footer keep their place; the
+   bar (50) stays above it, the card scrim (60) above both. Cells in a
+   hairline-separated row, each a lowercase display title over one clause; the
+   whole cell is the target. The current view carries a 2px accent hairline on
+   its top edge — the rail-step-lit grammar from DESIGN.md, moved onto a menu.
+   One authored move, a 6px rise + fade on the world's exponential ease-out,
+   dead under the kill switch at the end of this file. ── */
+.menuBand{position:absolute;left:0;right:0;top:var(--top-h);z-index:49;background:var(--bg-card);border-bottom:1px solid var(--rule);
   animation:bandIn .22s cubic-bezier(.16,1,.3,1) both;}
 @keyframes bandIn{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:none}}
 .bandIn{padding:20px var(--gutter) 28px;}
@@ -642,9 +666,6 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* the deferred Settings slot: a place it would go, rendering nothing at all —
    not even the hairline that declares a list item in this band */
 .bandSlot{border:0;}
-/* the row under the hairline: About and Docs, a rung smaller than the views */
-.bandMore{margin-top:18px;}
-.bandMore .bandT{font-size:17px;font-weight:400;min-height:24px;display:inline-flex;align-items:center;}
 
 @media (max-width:900px){
   .bar{gap:10px;padding:0 12px;}
@@ -766,35 +787,63 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .hintbar kbd{font-family:var(--font-mono);background:color-mix(in srgb,var(--accent) 24%,transparent);
   border-radius:5px;padding:1px 6px;font-size:11px;color:var(--chrome-accent);}
 
-/* ── the directory table: the same rows, the same filter, and the shell is
-   still overhead — the gate's table dropped the projects door entirely. ── */
-.tbl{width:100%;border-collapse:collapse;background:var(--card);border-radius:20px;overflow:hidden;
-  box-shadow:var(--shadow-card);}
-.tbl th{text-align:left;font-family:var(--font-display);font-size:11.5px;font-weight:700;
-  letter-spacing:.9px;text-transform:uppercase;color:var(--ink-faint);padding:15px 18px;
-  border-bottom:2px solid var(--line);white-space:nowrap;}
+/* ── THE TABLE IN THE WORLD (task 1003332; owner's review of the shipped chrome).
+   The table is a VIEW of the same world as the sky, not a panel beside it: a
+   masthead in the world's material, then LEDGER ROWS (DESIGN.md "Ledger rows")
+   — hairlines, no ground, no radius, no shadow; mono labels on the columns;
+   the figure voice on the numbers; the accent only on what is pressable (the
+   open link) or live (the status chip); the display voice on the view title.
+   The relationship pill states a fact and is not pressable, so it lost the
+   accent (the One Warm Thing Rule); a row's hover is the hairline taking ink,
+   the bands' grammar. The masthead is the owner's pick from three rendered
+   treatments (docs/design/projects-hub-direction-v2.md §9): "the ledger" —
+   the view title in the display voice at the left, one chrome object at the
+   right, nothing else. ── */
+.tblMast{display:grid;grid-template-columns:1fr auto;position:relative;align-items:end;gap:26px;padding:clamp(26px,3.6vw,44px) 0 30px;}
+.tblTitle{font-family:var(--font-display);font-weight:300;font-size:clamp(30px,3.6vw,48px);line-height:1;
+  letter-spacing:-.035em;text-transform:lowercase;color:var(--ink);text-shadow:var(--type-halo);margin:0;}
+/* the object, on the world's crop maths (DESIGN.md "The crop maths"): one
+   rectangle of a plate, expressed against the object's own width so it scales
+   with the row — the set's small bead, r2-chrome-blobs-set u[.810,.955] v[.556,.840] */
+.mastObj{display:block;--dia:clamp(96px,10vw,132px);width:var(--dia);aspect-ratio:.91476;background-image:var(--plate-set-cut);
+  background-repeat:no-repeat;background-size:calc(var(--dia) * 6.89655) auto;
+  background-position:calc(var(--dia) * -5.58621) calc(var(--dia) * -2.14014);filter:var(--mast-shadow);}
+
+.tbl{width:100%;border-collapse:collapse;background:none;}
+.tbl th{text-align:left;font-family:var(--label-face);font-size:var(--label-size);font-weight:400;
+  letter-spacing:var(--label-space);text-transform:uppercase;color:var(--ink-faint);padding:0 14px 12px;
+  border-bottom:1px solid var(--rule);white-space:nowrap;}
+.tbl th:first-child,.tbl td:first-child{padding-left:0;}
+.tbl th:last-child,.tbl td:last-child{padding-right:0;}
 /* the sort control is a real button so the keyboard can reach it; it must look
    like the header it replaced, so it inherits everything the th declares. */
 .tbl th button{all:unset;cursor:pointer;}
 .tbl th button:focus-visible{outline:2px solid var(--accent);outline-offset:2px;}
-.tbl td{padding:15px 18px;border-bottom:1px solid var(--line);font-size:14px;font-weight:600;
-  color:var(--ink-soft);vertical-align:middle;}
-.tbl tr:last-child td{border-bottom:none;}
-.tbl tr:hover td{background:color-mix(in srgb,var(--accent) 5%,transparent);}
-/* the whole row opens the project card, so it must look like it does */
+.tbl td{padding:17px 14px;border-bottom:1px solid var(--rule-soft);font-size:15px;font-weight:400;
+  color:var(--ink-soft);vertical-align:middle;transition:border-color .2s cubic-bezier(.2,.7,.3,1);}
+/* the whole row opens the project card, so it must look like it does: the
+   hairline under it takes ink, as a band cell's does */
 .tbl tbody tr{cursor:pointer;}
-.tbl .pname{display:flex;align-items:center;gap:11px;}
-.tbl .pdot{width:11px;height:11px;border-radius:50%;background:var(--acc);flex:0 0 auto;
-  box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
-.tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);text-decoration:none;}
+.tbl tbody tr:hover td{border-bottom-color:var(--ink-faint);}
+.tbl .pname{display:flex;align-items:center;gap:12px;}
+.tbl .pdot{width:10px;height:10px;border-radius:50%;background:var(--acc);flex:0 0 auto;}
+.tbl .ptitle{font-family:var(--font-display);font-weight:500;font-size:17px;letter-spacing:-.015em;color:var(--ink);text-decoration:none;}
 .tbl a.ptitle:hover{text-decoration:underline;}
-.tbl .ptag{font-size:12.5px;color:var(--ink-faint);font-weight:600;}
-.tbl .num{font-family:var(--font-mono);font-weight:500;}
+.tbl .ptag{font-size:13.5px;color:var(--ink-soft);font-weight:400;}
+.tbl .num{font-family:var(--font-display);font-weight:300;font-size:22px;letter-spacing:-.02em;color:var(--ink);
+  font-variant-numeric:tabular-nums;}
 .tbl .tags{display:flex;gap:6px;flex-wrap:wrap;}
 .tbl .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;border-radius:999px;
-  border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
-.tbl .pill{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
-  border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);}
+  border:1px solid var(--rule);color:var(--ink-faint);white-space:nowrap;}
+.tbl .pill{display:inline-block;font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);
+  text-transform:uppercase;padding:3px 9px;border-radius:999px;border:1px solid var(--rule);color:var(--ink-faint);}
+/* the row's door: the accent on the one pressable thing in the row, as text
+   (the footer-link grammar), lowercase like every control in the world */
+.rowGo{display:inline-flex;align-items:center;min-height:24px;padding:3px 0;font-family:var(--font-body);font-size:15px;
+  text-transform:lowercase;color:var(--accent-deep);text-decoration:underline;text-underline-offset:4px;
+  text-decoration-color:color-mix(in srgb,var(--accent) 55%,transparent);white-space:nowrap;
+  transition:text-decoration-color .2s cubic-bezier(.2,.7,.3,1);}
+.rowGo:hover{text-decoration-color:var(--accent-deep);}
 .tbl td.right{text-align:right;}
 /* Nothing in an action or status cell may wrap: "Manage →" breaking after the
    space and the chip's recency dropping to a second line both read as a broken
@@ -807,8 +856,14 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colType{width:1%;white-space:nowrap;}
 /* the declared-type tag (task 1002772) — its own vocabulary: not the relationship
    .pill, not the liveness .chip. Two different facts never wear the same chrome. */
-.typeTag{font-family:var(--font-mono);font-size:10.5px;font-weight:500;color:var(--ink-soft);border:1px solid var(--line);border-radius:999px;padding:2px 9px;white-space:nowrap;}
+.typeTag{font-family:var(--font-mono);font-size:10.5px;font-weight:500;color:var(--ink-soft);border:1px solid var(--rule);border-radius:999px;padding:2px 9px;white-space:nowrap;}
 @media (max-width:780px){.tbl .colTags,.tbl .colType{display:none;}}
+@media (max-width:900px){
+  .tblMast{gap:16px;padding:22px 0 20px;}
+  .tblTitle{font-size:clamp(28px,7.4vw,34px);}
+  .mastObj{--dia:clamp(72px,18vw,96px);}
+  .tbl th,.tbl td{padding-left:10px;padding-right:10px;}
+}
 
 /* ── the living sky (task 1002762): camera, spotlight, hover card ──
    The camera is ONE transform on .skyCam; orbs carry only their own physics