@bongos/core 1.19.400 → 1.19.402

package/public-landing/index.html

@@ -191,10 +191,11 @@ main:focus{outline:none;box-shadow:none}
 @media (prefers-color-scheme:dark){:root:not([data-mode="light"]) .sun{display:block}
   :root:not([data-mode="light"]) .moon{display:none}}
 
-/* the menu bands (.menuBand — .band is this page's content sections): not floating cards. Full width on the card ground, closed by one hairline, pushing
-   the page down. Cells in a hairline-separated row, a lowercase display title over one clause;
-   the whole cell is the target. One authored move, dead under world.css's kill switch. */
-.menuBand{position:relative;z-index:49;background:var(--bg-card);border-bottom:1px solid var(--rule);
+/* the menu bands (.menuBand — .band is this page's content sections): not floating cards. Full width on the card ground, closed by one hairline, a LAYER
+   over the page under the bar — the page does not reflow (owner, 2026-08-28; task 1003332). Cells in a
+   hairline-separated row, a lowercase display title over one clause; the whole cell is the target.
+   One authored move, dead under world.css's kill switch. */
+.menuBand{position:absolute;left:0;right:0;top:var(--top-h);z-index:49;background:var(--bg-card);border-bottom:1px solid var(--rule);
   animation:bandIn .22s cubic-bezier(.16,1,.3,1) both}
 @keyframes bandIn{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:none}}
 .bandIn{padding:20px 26px 28px}
@@ -207,8 +208,6 @@ main:focus{outline:none;box-shadow:none}
 .bandCell:hover .bandT{color:var(--ink)}
 .bandCell:hover{border-top-color:var(--ink-faint)}
 .bandC{display:block;margin-top:5px;font-size:13.5px;line-height:1.45;color:var(--ink-soft)}
-.bandMore{margin-top:18px}
-.bandMore .bandT{font-size:17px;font-weight:400;min-height:24px;display:inline-flex;align-items:center}
 .bandProfile{display:flex;align-items:flex-end;justify-content:space-between;gap:34px;flex-wrap:wrap}
 .bandWho{display:flex;align-items:center;gap:10px;padding-top:15px;border-top:1px solid var(--rule-soft);
   flex:0 1 auto;font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);
@@ -843,9 +842,10 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 </header>
 
 <!-- the two bands: full-width, on the card ground, closed by one hairline; they unfold under the
-     bar's edge and push the page down. One disclosure component, two instances (the script at the
-     foot of the page): Escape closes and returns focus to the trigger, the arrows walk the items,
-     Tab out closes, a click outside closes, opening one closes the other. -->
+     bar's edge as a layer over the page, which does not reflow (task 1003332). One disclosure
+     component, two instances (the script at the foot of the page): Escape closes and returns focus
+     to the trigger, the arrows walk the items, Tab out closes, a click outside closes, opening one
+     closes the other. -->
 <div class="menuBand" id="menuProjects" data-menu="projects" hidden>
   <div class="bandIn">
     <ul class="bandRow">
@@ -854,12 +854,8 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
       <li class="bandCell" id="mineCell" hidden><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own or build on</span></li>
       <li class="bandCell"><a class="bandT" href="/projects?view=new">New project</a><span class="bandC">five questions and a home</span></li>
     </ul>
-    <!-- under a hairline: what this is, and the docs (§5's About cell; goal 1000063's About page
-         takes the anchor over when it lands) -->
-    <ul class="bandRow bandMore">
-      <li class="bandCell"><a class="bandT" href="#about">About</a></li>
-      <li class="bandCell"><a class="bandT" href="/docs">Docs</a></li>
-    </ul>
+    <!-- About and Docs are site pages, not project views: they live in the footer row with
+         Privacy / Terms / Contact (owner, 2026-08-28; task 1003332). -->
   </div>
 </div>
 <div class="menuBand" id="menuProfile" data-menu="profile" hidden>
@@ -1096,6 +1092,8 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 <footer>
   <div class="footrow">
     <p><!--apex-only:start-->A non-profit, capture-resistant commons. <!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</p>
+    <a href="#about">About</a>
+    <a href="/docs">Docs</a>
     <a href="/privacy">Privacy</a>
     <a href="/terms">Terms</a>
     <a href="/contact">Contact</a>

package/public-landing/index.probes.json

@@ -3,9 +3,12 @@
   "page": "/",
   "surface": "public-landing",
   "probes": [
-    { "name": "landing: Enter opens Projects on the first item", "auth": true, "width": 1440,
+    { "name": "landing closed: the main content starts under the bar", "auth": true, "width": 1440,
+      "steps": [],
+      "expect": { "expanded": false, "top": [["#main", 72]] } },
+    { "name": "landing: Enter opens Projects on the first item; the band overlays and the hero does not move (task 1003332)", "continue": true,
       "steps": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 150]],
-      "expect": { "open": "#menuProjects", "activeText": "Sky" } },
+      "expect": { "open": "#menuProjects", "activeText": "Sky", "top": [["#main", 72]] } },
     { "name": "landing: arrows walk the visible items (Your projects shows signed in)", "continue": true,
       "steps": [["press", "ArrowDown"], ["press", "ArrowDown"]],
       "expect": { "activeText": "Your projects" } },
@@ -14,16 +17,16 @@
       "expect": { "closed": "#menuProjects", "activeId": "projTrig" } },
     { "name": "landing: the profile band closes the Projects band", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "#who .trig"], ["wait", 120]],
-      "expect": { "open": "#menuProfile", "closed": "#menuProjects" } },
+      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "top": [["#main", 72]] } },
     { "name": "landing: the profile band names the person; sign out keeps the honest href", "continue": true,
       "steps": [],
       "expect": { "href": [["#menuProfile a.signout", "/api/bongos/auth/logout"]], "text": [["#bandWho", "builder"]], "count": [["#bandWho img", 1]] } },
     { "name": "landing: a click outside closes", "continue": true,
       "steps": [["clickAt", 700, 700], ["wait", 120]],
       "expect": { "closed": "#menuProfile", "expanded": false } },
-    { "name": "landing: the band deep-links the hub views + About + Docs", "continue": true,
+    { "name": "landing: the band deep-links the hub views; About and Docs are footer links (task 1003332)", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120]],
-      "expect": { "count": [["#menuProjects a", 6]], "href": [["#menuProjects .bandCell:nth-child(1) a", "/projects?view=map"], ["#menuProjects .bandCell:nth-child(2) a", "/projects?view=map&sub=table"], ["#menuProjects a[href=\"#about\"]", "#about"], ["#menuProjects a[href=\"/docs\"]", "/docs"]] } },
+      "expect": { "count": [["#menuProjects a", 4], ["#menuProjects a[href=\"/docs\"]", 0]], "href": [["#menuProjects .bandCell:nth-child(1) a", "/projects?view=map"], ["#menuProjects .bandCell:nth-child(2) a", "/projects?view=map&sub=table"], ["footer a[href=\"#about\"]", "#about"], ["footer a[href=\"/docs\"]", "/docs"]] } },
     { "name": "landing: #about exists", "continue": true,
       "steps": [["press", "Escape"]],
       "expect": { "count": [["#about", 1]] } },

package/public-landing/projects.html

@@ -418,9 +418,10 @@ summary{min-height:24px;padding:3px 0;}
 </header>
 
 <!-- ══ THE BANDS ══ The menus are not floating cards. Each is a full-width band
-     that unfolds under the bar's edge and PUSHES the page down, so a
-     destination is a place the page opens into rather than a list that hovers
-     over it. One component, two instances (see the bands block in the script):
+     that unfolds under the bar's edge as a layer OVER the page — the page does
+     not reflow (owner, 2026-08-28; task 1003332) — so a destination is a place
+     that opens under the bar rather than a list that hovers beside it. One
+     component, two instances (see the bands block in the script):
      Escape closes and returns focus to the trigger, the arrows walk the items,
      a click outside closes, opening one closes the other. Plain links in a
      disclosure (aria-expanded + aria-controls, no menu role), so what is
@@ -435,12 +436,8 @@ summary{min-height:24px;padding:3px 0;}
       <li class="bandCell"><a class="bandT" href="?view=mine" data-nav="mine">Your projects</a><span class="bandC">the ones you own or build on</span></li>
       <li class="bandCell"><a class="bandT" href="?view=new" data-nav="new">New project</a><span class="bandC">five questions and a home</span></li>
     </ul>
-    <!-- under a hairline (§5's About cell): what this is, and the docs. About is the landing's
-         own explanation until goal 1000063's About page takes the anchor over. -->
-    <ul class="bandRow bandMore">
-      <li class="bandCell"><a class="bandT" href="/#about">About</a></li>
-      <li class="bandCell"><a class="bandT" href="/docs">Docs</a></li>
-    </ul>
+    <!-- About and Docs are site pages, not project views: they live in the
+         footer row with Privacy / Terms / Contact (owner, 2026-08-28; task 1003332). -->
   </div>
 </div>
 <div class="menuBand" id="menuProfile" data-menu="profile" hidden>
@@ -508,6 +505,15 @@ summary{min-height:24px;padding:3px 0;}
   </div>
 
   <div class="wrap viewWrap" id="sub-table-body" hidden>
+    <!-- ══ THE TABLE IN THE WORLD (task 1003332) ══ The table is a view of the same
+         world as the sky: a masthead in the world's material — the view title in
+         the display voice and one chrome object — then ledger rows. The owner's
+         pick from three rendered treatments (docs/design/projects-hub-direction-v2.md
+         §9): "the ledger", with the title cut to two words. -->
+    <div class="tblMast">
+      <h2 class="tblTitle">every project</h2>
+      <span class="mastObj" aria-hidden="true"></span>
+    </div>
     <table class="tbl">
       <thead>
         <tr>
@@ -533,7 +539,7 @@ summary{min-height:24px;padding:3px 0;}
           <td class="right num" id="selfBuilders">—</td>
           <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
-          <td class="colGo"><a class="btn small ghost" href="/">Open →</a></td>
+          <td class="colGo"><a class="rowGo" href="/">Open →</a></td>
         </tr>
         <!--apex-only:end-->
       </tbody>
@@ -1070,7 +1076,7 @@ summary{min-height:24px;padding:3px 0;}
 
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
 
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this
@@ -1485,7 +1491,7 @@ summary{min-height:24px;padding:3px 0;}
         '<td class="right colStatus">' + (p._inst ? chipFor(p._inst)
           : '<span class="chip calm"><span class="cdot"></span>—</span>') + '</td>' +
         '<td class="colGo">' + (safeHttpUrl(p.origin)
-          ? '<a class="btn small ghost" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">Open →</a>'
+          ? '<a class="rowGo" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">Open →</a>'
           : '') + '</td>' +
         '</tr>';
     }).join(''));
@@ -4016,8 +4022,12 @@ summary{min-height:24px;padding:3px 0;}
        (error_note, no intent in flight) can re-send its own domain — the route
        re-enqueues the attach for exactly this shape */
     if (inst.status === 'active' && inst.domain && inst.error_note && !inst.open_intent) return true;
-    return (!inst.domain || inst.domain === assignedDefaultFor(inst)) &&
-      (inst.status === 'requested' || inst.status === 'error' || inst.status === 'active');
+    /* every address here is now correctable (task 1003237): none (give it one),
+       the platform-assigned <slug>.<apex> (upgrade away from it), and — since the
+       owner decision of 2026-08-28 — a bring-your-own address that was mistyped.
+       The server's guards (reserved, in-apex squat, already held by another
+       project) are unchanged and stay the authority; this is only the door. */
+    return inst.status === 'requested' || inst.status === 'error' || inst.status === 'active';
   }
   /* re-enqueue doors: Try again on snagged, Bring it back on torn down —
      both re-POST the slug (the server's PROVISION_ENQUEUE_FROM gate) */
@@ -4231,13 +4241,30 @@ summary{min-height:24px;padding:3px 0;}
        be refused (intent_conflict), so the fold waits for the run to land */
     if (inst.open_intent && inst.open_intent.action === 'domain-attach') return '';
     var rekick = inst.status === 'active' && inst.domain && inst.error_note;
+    /* the CORRECTION door (task 1003237): the project already answers on an
+       address the founder brought, and it can be changed. The field carries the
+       current one so a typo is fixed by editing it, not retyped from scratch —
+       the re-kick door's shape, for the same reason. The platform-assigned
+       <slug>.<apex> is NOT a correction: moving off it is the upgrade the fold
+       already offered, and the field stays empty for the domain being brought. */
+    var byo = inst.domain && inst.domain !== assignedDefaultFor(inst);
+    var repoint = !rekick && byo;
+    var prefill = rekick || repoint;
+    var label = rekick ? 'Try the address again'
+      : repoint ? 'Use a different domain'
+      : inst.domain ? 'Use a domain I own' : 'Give it an address';
     return '<details class="attachFold"' + (rekick ? ' open' : '') + '>' +
-      '<summary>' + (rekick ? 'Try the address again' : inst.domain ? 'Use a domain I own' : 'Give it an address') + '</summary>' +
+      '<summary>' + label + '</summary>' +
       '<div class="attach">' +
       '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
-      (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
+      (prefill ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
       '<button type="button" class="btn small" data-attach="' + iid + '">' +
-      (rekick ? 'Try the address again' : 'Use this domain') + '</button></div></details>';
+      (rekick ? 'Try the address again' : repoint ? 'Change the address' : 'Use this domain') + '</button></div>' +
+      /* true in every state the fold renders in: a REQUESTED project never
+         answered anywhere yet, so "stops answering" would be a claim about a
+         thing that never happened (the F16 rule) */
+      (repoint ? '<p class="attachNote">Changing it lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
+      '</details>';
   }
 
   function renderCard(inst) {
@@ -5421,8 +5448,6 @@ summary{min-height:24px;padding:3px 0;}
           msg(id, 'That doesn’t look like a usable address — ' + esc(e.details.reason || 'use a real hostname like myproject.example.com') + '.', 'err');
         } else if (e.code === 'domain_taken') {
           msg(id, esc(e.message || 'That address is already in use by another project.'), 'err');
-        } else if (e.code === 'domain_already_set') {
-          msg(id, esc(e.message || 'This project already has an address — re-pointing isn’t supported here.'), 'err');
         } else if (e.code === 'domain_not_attachable') {
           msg(id, esc(e.message || 'An address can be attached once the instance settles.'), 'err');
         } else if (e.code === 'intent_conflict') {
@@ -5543,10 +5568,14 @@ summary{min-height:24px;padding:3px 0;}
   /* Boot. The view is set FIRST, from the URL, so the page is navigable before
      any request resolves — /projects?view=new must land on the create view even
      if the identity call is slow or fails. */
+  /* the boot query is read ONCE, before the view is set: setView rewrites the
+     URL to ?view=<v> and would drop everything else (the Table deep link from
+     the landing landed on the sky until task 1003332) */
+  var bootQ = new URLSearchParams(location.search);
   setView(viewFromUrl());
   /* the Table item's deep link (and the landing's) names the sub-view; a view change
      never writes it back, so a reload from the band returns to the sky as before */
-  if (new URLSearchParams(location.search).get('sub') === 'table') setSub('table');
+  if (bootQ.get('sub') === 'table') setSub('table');
 
   fetch(API + '/me', { credentials: 'same-origin' })
     .then(function (res) { if (!res.ok) throw new Error(String(res.status)); return res.json(); })

package/public-landing/projects.probes.json

@@ -3,26 +3,29 @@
   "page": "/projects",
   "surface": "public-landing",
   "probes": [
-    { "name": "Enter opens Projects and lands on the first item", "auth": true, "width": 1440,
+    { "name": "closed: the main content starts under the bar", "auth": true, "width": 1440,
+      "steps": [],
+      "expect": { "expanded": false, "top": [["#hubMain", 64]] } },
+    { "name": "Enter opens Projects and lands on the first item; the band overlays and the content does not move (task 1003332)", "continue": true,
       "steps": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 150]],
-      "expect": { "open": "#menuProjects", "activeText": "Sky" } },
+      "expect": { "open": "#menuProjects", "activeText": "Sky", "top": [["#hubMain", 64]] } },
     { "name": "ArrowDown walks to Table", "continue": true,
       "steps": [["press", "ArrowDown"]],
       "expect": { "activeText": "Table" } },
-    { "name": "ArrowUp wraps to the last item (Docs, the About/Docs row)", "continue": true,
+    { "name": "ArrowUp wraps to the last item (New project; About and Docs are footer links, task 1003332)", "continue": true,
       "steps": [["press", "ArrowUp"], ["press", "ArrowUp"]],
-      "expect": { "activeText": "Docs" } },
+      "expect": { "activeText": "New project" } },
     { "name": "Escape closes and returns focus to the trigger", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100]],
       "expect": { "closed": "#menuProjects", "activeId": "projTrig", "expanded": false } },
     { "name": "opening the profile band closes the Projects band", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "#who"], ["wait", 120]],
-      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "expandedIds": ["who"] } },
+      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "expandedIds": ["who"], "top": [["#hubMain", 64]] } },
     { "name": "a click outside closes", "continue": true,
       "steps": [["clickAt", 700, 600], ["wait", 120]],
       "expect": { "closed": "#menuProfile", "expanded": false } },
     { "name": "Tab out of the band closes it", "continue": true,
-      "steps": [["click", "#projTrig"], ["wait", 120], ["focus", "#menuProjects a[href=\"/docs\"]"], ["press", "Tab"], ["wait", 120]],
+      "steps": [["click", "#projTrig"], ["wait", 120], ["focus", "#menuProjects a[data-nav=\"new\"]"], ["press", "Tab"], ["wait", 120]],
       "expect": { "closed": "#menuProjects" } },
     { "name": "Table from the band: the table on stage, Table current, band closed", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"table\"]"], ["wait", 300]],
@@ -54,12 +57,16 @@
     { "name": "the mode toggle: the label says what the press does, and the press does it", "continue": true,
       "steps": [["clickAt", 700, 600], ["click", "#modeToggle"], ["wait", 100]],
       "expect": { "attr": [["#modeToggle", "aria-label", "Switch to light mode"], ["html", "data-mode", "dark"]] } },
+    { "name": "the Table deep link (the landing's band item) lands on the table, Table current (task 1003332)", "auth": true, "width": 1440, "url": "/projects?view=map&sub=table",
+      "steps": [["wait", 300]],
+      "expect": { "visible": ["#sub-table-body", ".tblMast"], "hidden": ["#sub-sky-body"], "text": [["[aria-current=\"page\"]", "Table"], [".tblTitle", "every project"]] } },
     { "name": "signed out: no chip, the door shows, no switch, the search stays", "auth": false, "width": 1440,
       "steps": [],
       "expect": { "hidden": ["#who", ".switch"], "visible": ["#signinTop", "#qWrap"] } },
-    { "name": "signed out the Projects band is Sky / Table / New project + About / Docs (no Your projects)", "continue": true,
+    { "name": "signed out the Projects band is Sky / Table / New project (no Your projects); About and Docs are in the footer row", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120]],
-      "expect": { "count": [["#menuProjects .bandCell:not([hidden])", 5]], "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
+      "expect": { "count": [["#menuProjects .bandCell:not([hidden])", 3], ["#menuProjects a[href=\"/docs\"]", 0]], "hidden": ["#menuProjects [data-nav=\"mine\"]"],
+                  "href": [[".footNav a[href=\"/#about\"]", "/#about"], [".footNav a[href=\"/docs\"]", "/docs"]] } },
     { "name": "signed out: the card still closes on Escape (nothing throws with no session)", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100], ["dispatchClick", "#orbField a.worldOrb:not(#selfOrb)"], ["wait", 400], ["press", "Escape"], ["wait", 150]],
       "expect": { "dialog": false, "closed": "#menuProjects" } },
@@ -69,9 +76,9 @@
     { "name": "390: Escape folds the row and returns focus to the magnifier", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100]],
       "expect": { "activeId": "qToggle", "hasClass": [["#qWrap", "is-open", false]] } },
-    { "name": "390: an opening band folds the search", "continue": true,
+    { "name": "390: an opening band folds the search and overlays the sky (the content does not move)", "continue": true,
       "steps": [["click", "#qToggle"], ["wait", 100], ["click", "#projTrig"], ["wait", 150]],
-      "expect": { "hasClass": [["#qWrap", "is-open", false]], "open": "#menuProjects" } },
+      "expect": { "hasClass": [["#qWrap", "is-open", false]], "open": "#menuProjects", "top": [["#hubMain", 60]] } },
     { "name": "390: a solo Shift tap opens the fold and focuses the field, without overflow", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100], ["press", "Shift"], ["wait", 150]],
       "expect": { "hasClass": [["#qWrap", "is-open", true]], "activeId": "mapQ", "noOverflow": true } }

package/public-landing/projects.states.json

@@ -14,7 +14,7 @@
     "in-map-kbd": { "auth": true, "actions": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 350], ["press", "ArrowDown"], ["wait", 120]], "expect": { "expanded": true, "activeText": "Table" } },
     "in-map-search": { "auth": true, "actions": [["clickIfVisible", "#qToggle"], ["wait", 200], ["fill", "#mapQ", "emer"], ["wait", 300]], "expect": { "value": [["#mapQ", "emer"]] } },
     "in-map-mine-on": { "auth": true, "actions": [["check", "#onlyMine"], ["wait", 300]], "expect": { "checked": "#onlyMine" } },
-    "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body"], "closed": "#menuProjects" } },
+    "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body", ".tblMast", ".mastObj"], "closed": "#menuProjects" } },
     "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap"] } },
     "in-new": { "auth": true, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },

package/scripts/gds/provision-net.js

@@ -118,6 +118,37 @@ function dnsUpsertEnv(inst, { publicIp, zone, proxied = false } = {}) {
   };
 }
 
+// The RFC 5737 TEST-NET-1 sentinel a released hostname is parked at (task
+// 1003237) — the shape scripts/gds/box-infra.js proved for a torn-down box
+// (idea 309 / task 1234). 192.0.2.1 is reserved for documentation and is
+// GUARANTEED never routable, so a name parked here can never dial platform
+// infra or a recycled address.
+const DNS_BLACKHOLE_IP = '192.0.2.1';
+
+// The env a RELEASE invocation of the DNS hook needs: the abandoned hostname,
+// parked at the blackhole sentinel. A re-point (task 1003237) leaves the old
+// address UPSERTed at the platform's IP for a project that no longer answers
+// there — the ADR 0181 §2 leak — and this is how the runner lets it go.
+//
+// REPOINT, not delete, for the reason box-infra.js records: deleting a name
+// opens an NXDOMAIN window that resolvers negative-cache for the zone's SOA
+// neg-TTL (~30 min, not editable), so a client that queried mid-gap stays
+// broken long after. A name that always resolves — to a guaranteed-dead host —
+// has nothing to negative-cache. It also needs only the UPSERT contract every
+// BOX_DNS_HOOK implements, so no hook grows a new mode for this.
+//
+// proxied=0: a parked record must never ride the Cloudflare edge, which would
+// answer for it. Takes a bare `hostname` rather than an instance — the whole
+// point is that the row has already moved on. PURE.
+function dnsReleaseEnv(hostname, { zone } = {}) {
+  return {
+    BOX_HOSTNAME: hostname,
+    BOX_IP: DNS_BLACKHOLE_IP,
+    CLOUDFLARE_ZONE: zone || zoneForDomain(hostname),
+    BOX_PROXIED: '0',
+  };
+}
+
 // ── DNS token-scope PREFLIGHT (task 1980) ────────────────────────────────────
 // Onboarding a NEW project on a domain the control-plane's Cloudflare token does NOT
 // cover fails LATE: the DNS UPSERT (step 5) errors mid-provision (the Emersonian
@@ -208,10 +239,12 @@ function healthzCmd(inst) {
 
 module.exports = {
   CF_API_BASE,
+  DNS_BLACKHOLE_IP,
   caddyBlock,
   caddySnippetPath,
   checkDnsTokenScope,
   classifyZoneScope,
+  dnsReleaseEnv,
   dnsUpsertEnv,
   federateInstance,
   federationHubOrigin,

package/scripts/gds/provision-units.js

@@ -240,6 +240,23 @@ function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
 // The settings env vars the runner pushes to a RUNNING instance (task 1003140):
 // the module's settingsEnvVars under the prefix the instance actually resolves —
 // the same pair webEnvBody writes at standup, so standup and push cannot drift.
+// The four origin overrides web.env carries for an addressed instance — the
+// domain-dependent half of webEnvBody, on its own so domain-attach can patch
+// exactly those lines IN PLACE (task 1003237). A single-host instance has no
+// dedicated builders./status. subdomain, so all four point at the one host.
+// Empty for a domainless instance: there is no origin to assert, and writing
+// `=` over a real one would take the hall down. PURE.
+function originEnvVarsFor(inst) {
+  if (!inst || !inst.domain) return {};
+  const prefix = provisionedEnvPrefix(), origin = `https://${inst.domain}`;
+  return {
+    [`${prefix}_PUBLIC_ORIGIN`]: origin,
+    [`${prefix}_BUILDERS_ORIGIN`]: origin,
+    [`${prefix}_STATUS_ORIGIN`]: origin,
+    [`${prefix}_OAUTH_ORIGIN`]: origin,
+  };
+}
+
 function settingsEnvVarsFor(inst) {
   const { settingsEnvVars } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   return settingsEnvVars(inst, provisionedEnvPrefix());
@@ -309,6 +326,7 @@ module.exports = {
   backupTimerPath,
   backupUnitName,
   instanceManifestCmd,
+  originEnvVarsFor,
   provisionedEnvPrefix,
   serviceUnit,
   serviceUnitPath,

package/scripts/gds/provision.js

@@ -51,8 +51,8 @@ const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
 function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = null, sshOpts = '' }) {
   // `shown` (task 1003140): what to LOG in place of the command text — for a command
@@ -464,6 +464,12 @@ async function provisionInstance(inst, deps) {
     }
   }
 
+  // A re-point on a PRE-ACTIVE instance records its release here and never
+  // reaches the attach leg (that one no-ops for anything but 'active'), so this
+  // run owns the drain — and an `error` row is frequently a partial standup that
+  // already UPSERTed the address it is now leaving (ADR 0181 §1, task 1003237).
+  await releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning });
+
   // ── step 6: Caddy per-instance site snippet + reload ──────────────────────
   // Write the instance's OWN <slug>.caddy snippet (idempotent overwrite via the
   // injected writeFile — no read-modify-append to a shared Caddyfile), then reload.
@@ -557,6 +563,57 @@ runcmd:
 `;
 }
 
+// The addresses a re-point left behind and this run still owes a release on
+// (task 1003237). The one guard this tier can make on its own, and the one that
+// matters: the address the instance is CURRENTLY on is never released, so a row
+// that somehow queued its own domain can never blackhole a live project.
+// Keeping a platform-assigned <slug>.<apex> off the queue is the ENQUEUE site's
+// job — the web tier knows the apex, this runner does not (ADR 0181 §2). PURE.
+function releasableDomains(inst) {
+  const here = String((inst && inst.domain) || '').toLowerCase();
+  return (Array.isArray(inst && inst.released_domains) ? inst.released_domains : [])
+    .map((d) => String(d || '').toLowerCase())
+    .filter((d) => d && d !== here);
+}
+
+// Park every address a re-point moved off at the blackhole sentinel, then empty
+// the queue (task 1003237, ADR 0200). Called by BOTH legs that wire a domain —
+// domain-attach for an ACTIVE instance, and the provision run that owns
+// PRE-ACTIVE ones, since an `error` row is frequently a partial standup that
+// already UPSERTed the address it is now leaving (ADR 0181 §1).
+//
+// BEST-EFFORT in the teardown sense: a hook that fails leaves the queue intact
+// so the next run retries, and never fails the wiring that already landed. EVERY
+// queued address is attempted — one host whose zone the token cannot reach must
+// not strand the others behind it — and the queue is emptied only when all of
+// them landed; a re-park of an address already at the sentinel is an idempotent
+// UPSERT, so retrying the whole list costs nothing but the call. The list is
+// capped at the enqueue site (MAX_RELEASED_DOMAINS), which is what bounds this
+// loop. Returns the first host that failed, or null. Runs on the CONTROL PLANE —
+// the hook needs the Cloudflare token, which never leaves it (ADR 0111 §2).
+async function releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning }) {
+  const hosts = releasableDomains(inst);
+  if (!hosts.length) return null;
+  if (!CONFIG.dnsHook) {
+    log(`  [dns] cannot release ${hosts.join(', ')} (BOX_DNS_HOOK unset) — remove their A records manually`);
+    return null;
+  }
+  let firstFailed = null;
+  for (const host of hosts) {
+    const relEnv = dnsReleaseEnv(host);
+    log(`  [dns] release ${host} -> ${relEnv.BOX_IP} (blackhole, zone ${relEnv.CLOUDFLARE_ZONE}) via ${CONFIG.dnsHook}`);
+    if (!apply) continue;
+    try { controlExec(CONFIG.dnsHook, { env: relEnv }); }
+    catch (e) {
+      log(`  ⚠ could not release ${host}: ${(e && e.message) || e} — its A record still points here`);
+      if (!firstFailed) firstFailed = host;
+    }
+  }
+  if (firstFailed) return firstFailed;
+  if (apply && provisioning.clearReleasedDomains) await provisioning.clearReleasedDomains(db, inst.id).catch(() => {});
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Attach a late-arriving domain to an ALREADY-ACTIVE instance (task 1002692):
 // re-assert exactly the domain-dependent runbook legs — web.env origins (+ a
@@ -565,6 +622,18 @@ runcmd:
 // RETURN { ok:false } instead of throwing: the drain loop's catch flips the
 // instance to 'error', which must never happen to a healthy ACTIVE instance
 // over a domain hiccup.
+//
+// This leg ALSO carries a RE-POINT (task 1003237, ADR 0200) — the same intent,
+// because the wiring is the same wiring. Two things follow from that:
+//   • The origin lines are patched IN PLACE (upsertEnvVars), never regenerated
+//     from the row. A template re-write via webEnvBody would blank the OAuth
+//     creds placeManifestCreds placed, the App private key and the federation
+//     block — none of which the row knows (ADR 0190 §2). A first attach was
+//     MASKED by wizard order (address first, GitHub App second); a re-point runs
+//     on a project the founder is already signed in to, so the same move would
+//     break sign-in on the exact project they just corrected (idea 1000842).
+//   • Every address on the row's release queue is parked at the blackhole
+//     sentinel AFTER the new one is wired — best-effort, never fatal.
 // ---------------------------------------------------------------------------
 async function domainAttachInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
@@ -603,8 +672,22 @@ async function domainAttachInstance(inst, deps) {
     ? (CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp))
     : CONFIG.publicIp;
 
-  log('  [config] re-write per-instance web.env (origins now carry the domain)');
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
+  // Patch ONLY the origin lines (the settingsApplyInstance shape, ADR 0190 §2).
+  // Dry-run has no file to read, so it PLANS the patch rather than writing a
+  // synthetic body. An unreadable or empty file is refused, never "patched":
+  // writing four origins over a missing PORT/PGDATABASE would take the instance
+  // down — and this leg runs against instances that are ALREADY serving.
+  const origins = originEnvVarsFor(inst);
+  const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
+  const currentEnv = String((read && read.stdout) || '');
+  if (!apply) {
+    log(`  [config] would patch ${Object.keys(origins).join(', ')} in ${webEnvPath(inst)} in place (creds + federation untouched)`);
+  } else if (!read || read.softFailed || !currentEnv.trim()) {
+    return { ok: false, error: `cannot read ${webEnvPath(inst)} — nothing to patch (was this instance provisioned by the runner?)` };
+  } else {
+    log('  [config] patch the origin lines of web.env in place (creds + federation untouched)');
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(currentEnv, origins), { mode: 0o600, sudo: true });
+  }
   log('  [service] restart to pick up the new origins');
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
@@ -629,10 +712,19 @@ async function domainAttachInstance(inst, deps) {
     log(`  [dns] skipped (BOX_DNS_HOOK unset) — point ${inst.domain}'s A record at ${recordIp || 'this server'} manually`);
   }
 
+  // The snippet is per-SLUG and always carries the CURRENT domain, so a re-point
+  // takes the old vhost away in the same write — Caddy stops serving the old host
+  // (and tls-check stops vouching for it) with no separate un-wire step.
   log('  [caddy] write site snippet + reload');
   boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
   boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
 
+  // Release what the re-point moved off, AFTER the new address is wired: the DNS
+  // record is the only half of an abandoned address the platform still holds, and
+  // it points at platform infra.
+  const releaseFailed = await releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning });
+  if (releaseFailed) return { ok: true, releaseFailed };
+
   log('  [healthz] verify the instance answers');
   boxExec(healthzCmd(inst), { allowFail: true });
 
@@ -1337,7 +1429,7 @@ module.exports = {
   caddyBlock, caddySnippetPath, healthzCmd, dedicatedUserData, nextFreePort,
   // executors + orchestration (injectable deps for tests)
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
-  domainAttachInstance, cmdRunIntents, cmdReconcile, cmdStatus,
+  domainAttachInstance, releasableDomains, cmdRunIntents, cmdReconcile, cmdStatus,
   // live settings push (task 1003140) + the in-place env patch + read-back it rides on
   settingsApplyInstance, upsertEnvVars, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch

package/src/module-api.js

@@ -1240,8 +1240,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.398 with no explicit bump. run 33201243958. (task 1002620)
 //   1.19.400 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.399 with no explicit bump. run 33201979306. (task 1002620)
+//   1.19.401 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.400 with no explicit bump. run 33205015717. (task 1002620)
+//   1.19.402 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.401 with no explicit bump. run 33206226800. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.400'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.402'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');