@bongos/core 1.19.401 → 1.19.403

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.401",
+  "version": "1.19.403",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.401",
+      "version": "1.19.403",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.401",
+  "version": "1.19.403",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -250,6 +250,7 @@
   --radius:16px; --radius-sm:10px; --radius-pill:999px;
   --top-h:64px;
   --gutter:clamp(16px,4vw,34px);
+  --leader-len:68px;   /* the poster card's callout leader (task 1003301) */
   /* the world's object for the hub's view masthead (task 1003332): the apex
      shares the landing's plates because it is the same world (DESIGN.md
      "Materials"); the hub takes the alpha CUTOUT in both modes — the view
@@ -404,6 +405,8 @@ a.orb{cursor:pointer;}
 .attachFold{margin-top:12px;}
 .attachFold summary{cursor:pointer;width:fit-content;font-size:13px;font-weight:700;color:var(--ink-faint);}
 .attachFold summary:hover,.attachFold[open] summary{color:var(--ink-soft);}
+.attachNote{margin:8px 0 0;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+.attachNote code{font-family:var(--font-mono);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}
@@ -895,32 +898,130 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    dark, which paints a white sheet over the page instead of dimming it. */
 .cardScrim{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;
   padding:24px;background:rgba(0,0,0,.55);backdrop-filter:blur(3px);}
-.projCard{position:relative;width:min(420px,100%);background:var(--bg-card);border:1.5px solid var(--line);
-  border-radius:var(--r-card,20px);box-shadow:var(--shadow-card);padding:30px 28px 26px;text-align:center;}
-.projCard .cardDot{display:block;width:54px;height:54px;border-radius:50%;margin:0 auto 16px;
-  background:var(--acc,var(--accent));box-shadow:0 0 0 8px color-mix(in srgb,var(--acc,var(--accent)) 18%,transparent);}
-.projCard h3{font-family:var(--font-display);font-weight:700;font-size:21px;color:var(--ink);margin-bottom:6px;}
-.projCard .cardTag{font-size:14px;color:var(--ink-faint);font-weight:600;line-height:1.5;margin-bottom:14px;}
-.projCard .cardRel{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
-  border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);margin-bottom:18px;}
-/* the facts strip (task 1002778): a label/value grid, centered as a block but
-   read left-aligned. A hidden pair leaves no gap — the grid row collapses. */
-.projCard .cardMeta{display:grid;grid-template-columns:auto auto;justify-content:center;
-  gap:6px 14px;margin-bottom:18px;text-align:left;}
-.projCard .cardMeta dt{font-family:var(--font-mono);font-size:11px;letter-spacing:.04em;
-  text-transform:uppercase;color:var(--ink-faint);align-self:center;}
-.projCard .cardMeta dd{font-size:13.5px;color:var(--ink-soft);font-weight:600;}
-.projCard .cardMeta .ownerAv{width:16px;height:16px;border-radius:50%;vertical-align:-3px;margin-right:6px;}
-.projCard .cardMeta .tags{display:flex;gap:6px;flex-wrap:wrap;}
-.projCard .cardMeta .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;
-  border-radius:999px;border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
-.projCard .cardActions{display:flex;gap:10px;justify-content:center;flex-wrap:wrap;}
-.projCard .cardX{position:absolute;top:10px;right:12px;width:30px;height:30px;border-radius:50%;
-  border:none;background:none;cursor:pointer;font-size:14px;color:var(--ink-faint);line-height:1;}
-.projCard .cardX:hover{background:var(--accent-soft);color:var(--accent-deep);}
+/* THE POSTER (task 1003301; the v2 pick, direction §7): a specimen sheet in the
+   world, not a panel. min(560px,100%) on bg-card closed by one rule hairline,
+   no shadow (the world has no shadow vocabulary for UI). A flex column ordered
+   by `order`, so every region stays a flat child of the card whatever the
+   layout does with it (the C6 slice rule in tests/projects_hub.mjs).
+   container-type gives the disc and the callouts the card's own width (cqw),
+   so the banner's 5:2 edge is a number the disc can sit on. Six regions, top
+   to bottom: the banner, the two figures (callouts ON the art from 561px,
+   the two-up band otherwise and with no art), the accent disc, name / tagline
+   / relationship, the faces, the facts as a mono hairline ledger, the doors. */
+.projCard{position:relative;container-type:inline-size;display:flex;flex-direction:column;
+  width:min(560px,100%);max-height:calc(100vh - 48px);overflow:auto;text-align:left;
+  background:var(--bg-card);border:1px solid var(--rule);border-radius:var(--radius);box-shadow:none;padding:0 0 26px;}
+.projCard:not(.has-art){padding-top:26px;}
+.projCard .cardArt{order:0;display:block;width:100%;aspect-ratio:5/2;object-fit:cover;
+  border-radius:var(--radius) var(--radius) 0 0;}
+.projCard .cardX{position:absolute;top:12px;right:12px;z-index:4;display:inline-flex;align-items:center;
+  justify-content:center;width:30px;height:30px;border:0;border-radius:var(--radius-pill);
+  background:var(--glass-strong);color:var(--ink);cursor:pointer;font-size:14px;line-height:1;}
+.projCard .cardX:hover{background:var(--glass-edge);}
+/* on art the close control takes the void pill: the one legal literal is black with alpha */
+.projCard.has-art .cardX{background:var(--void-pill);color:var(--void-ink);}
+/* THE DISC SURVIVES: it is how a project is recognised in the sky (task 1003258).
+   With art it half-overlaps the banner's lower edge, ringed in the card ground
+   so it sits ON the card; without art it renders where it always did. */
+.projCard .cardDot{order:1;align-self:flex-start;display:block;width:54px;height:54px;border-radius:50%;
+  margin:0 0 16px 26px;background:var(--acc,var(--accent));box-shadow:none;}
+.projCard.has-art .cardDot{position:absolute;z-index:3;left:24px;top:calc(100cqw / 2.5 - 27px);margin:0;
+  border:4px solid var(--bg-card);}
+.projCard h3{order:3;margin:0;padding:0 26px;font-family:var(--font-display);font-size:32px;font-weight:300;
+  line-height:1.08;letter-spacing:-.03em;color:var(--ink);}
+.projCard.has-art h3{margin-top:44px;}
+.projCard .cardTag{order:4;margin:9px 0 0;padding:0 26px;font-size:14.5px;font-weight:400;line-height:1.5;
+  color:var(--ink-soft);max-width:46ch;}
+/* the relationship is a mono label, not a pill: a fact about you, not a control */
+.projCard .cardRel{order:5;display:block;margin:14px 0 0;padding:0 26px;background:none;border-radius:0;
+  font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);
+  text-transform:uppercase;color:var(--ink-faint);}
+.projCard .cardFaces{order:6;display:flex;align-items:center;margin:18px 0 0;padding:0 26px;}
+.projCard .cardFaces img{width:28px;height:28px;border-radius:50%;object-fit:cover;
+  border:2px solid var(--bg-card);margin-right:-8px;}
+.projCard .facesMore{margin-left:16px;font-family:var(--font-mono);font-size:11.5px;color:var(--ink-faint);
+  font-variant-numeric:tabular-nums;}
+/* the two figures in the world's callout grammar (DESIGN.md "Leader-line
+   callouts"): a 1px diagonal leader, a 300-weight tabular figure, a caption */
+.projCard .cardFigs{order:7;display:flex;gap:38px;margin:20px 0 0;padding:0 26px;}
+.projCard .cardCall{display:block;}
+.projCard .lead{display:none;width:var(--leader-len);height:26px;margin-bottom:10px;overflow:visible;
+  color:color-mix(in srgb,var(--ink) 78%,transparent);}
+.projCard .fig{display:block;position:relative;width:fit-content;font-family:var(--font-display);
+  font-size:clamp(21px,5cqw,28px);font-weight:300;letter-spacing:-.025em;line-height:1;
+  font-variant-numeric:tabular-nums;color:var(--ink);text-shadow:var(--type-halo);}
+.projCard .cap{display:block;position:relative;width:fit-content;margin-top:7px;font-size:13px;
+  color:var(--ink-soft);text-shadow:var(--type-halo);}
+@media (min-width:561px){
+  .projCard.has-art .cardFigs{position:absolute;z-index:2;left:0;right:0;top:0;height:calc(100cqw / 2.5);
+    margin:0;padding:0;display:block;pointer-events:none;}
+  .projCard.has-art .cardCall{position:absolute;width:max-content;max-width:42%;}
+  /* 44px in, not the 26px gutter: the patch reaches 44px past the glyph box,
+     and a patch that meets the card's edge is clipped flat there */
+  .projCard.has-art .cardCall.a{left:44px;top:14px;}
+  .projCard.has-art .cardCall.b{right:44px;top:calc(100cqw / 2.5 - 112px);text-align:right;}
+  .projCard.has-art .cardCall.b .fig,.projCard.has-art .cardCall.b .cap{margin-left:auto;}
+  .projCard.has-art .cardCall .lead{display:block;}
+  .projCard.has-art .cardCall.b .lead{transform:scaleX(-1);margin-left:auto;}
+  /* each callout carries ONE feathered patch of the CARD ground under its
+     figure and caption together: solid to 10px past every edge of the glyph
+     boxes (no column of the text ever sits on the fade), then a 34px feather
+     to nothing, so the patch reads as haze in the art and never as a slab of
+     paint on it. The feather is a mask, not a shadow. It starts under the
+     figure, never behind the leader. */
+  .projCard.has-art .cardCall::before{content:"";position:absolute;left:-44px;right:-44px;top:18px;bottom:-24px;
+    z-index:-1;pointer-events:none;background:var(--bg-card);border-radius:44px/30px;filter:blur(3px);
+    -webkit-mask-image:linear-gradient(90deg,transparent,var(--ink) 34px,var(--ink) calc(100% - 34px),transparent),
+      linear-gradient(180deg,transparent,var(--ink) 10px,var(--ink) calc(100% - 12px),transparent);
+    -webkit-mask-composite:source-in;
+    mask-image:linear-gradient(90deg,transparent,var(--ink) 34px,var(--ink) calc(100% - 34px),transparent),
+      linear-gradient(180deg,transparent,var(--ink) 10px,var(--ink) calc(100% - 12px),transparent);
+    mask-composite:intersect;}
+}
+/* the facts as the ledger (task 1003332's grammar): mono label left, value
+   right and tabular, ONE rule-soft hairline per row on both cells so the rule
+   never steps at the column boundary. A hidden pair leaves no gap. */
+.projCard .cardMeta{order:8;display:grid;grid-template-columns:auto 1fr;justify-content:normal;gap:0;
+  margin:22px 0 0;padding:0 26px;text-align:left;}
+.projCard .cardMeta dt{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);
+  text-transform:uppercase;color:var(--ink-faint);padding:11px 20px 11px 0;border-top:1px solid var(--rule-soft);
+  line-height:19px;}
+.projCard .cardMeta dd{margin:0;padding:11px 0;text-align:right;font-size:14px;font-weight:400;color:var(--ink);
+  border-top:1px solid var(--rule-soft);font-variant-numeric:tabular-nums;}
+.projCard .cardMeta .ownerAv{display:inline-block;width:16px;height:16px;border-radius:50%;object-fit:cover;
+  vertical-align:-3px;margin-right:6px;}
+/* ONE accent door (the One Warm Thing Rule), the hall entry beside it as an
+   underlined accent-deep text link (the footer-link grammar) */
+.projCard .cardActions{order:9;display:flex;align-items:center;justify-content:flex-start;gap:22px;flex-wrap:wrap;
+  margin:24px 0 0;padding:0 26px;}
+.projCard .cardOpen{display:inline-flex;align-items:center;justify-content:center;min-height:48px;padding:0 30px;
+  border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);font-family:var(--font-display);
+  font-size:16px;font-weight:500;text-transform:lowercase;text-decoration:none;
+  transition:background .2s cubic-bezier(.2,.7,.3,1);}
+.projCard .cardOpen:hover{background:var(--accent-lift);color:var(--accent-on);}
+.projCard .cardHall{display:inline-flex;align-items:center;gap:8px;min-height:24px;color:var(--accent-deep);
+  font-size:15px;text-transform:lowercase;text-decoration:underline;text-underline-offset:4px;
+  text-decoration-color:color-mix(in srgb,var(--accent) 55%,transparent);
+  transition:text-decoration-color .2s cubic-bezier(.2,.7,.3,1);}
+.projCard .cardHall:hover{text-decoration-color:var(--accent-deep);}
+.cardHall svg,.rowHall svg{width:17px;height:17px;fill:none;stroke:currentColor;stroke-width:1.5;
+  stroke-linecap:round;stroke-linejoin:round;}
+/* the table row's hall glyph: beside Open, a member's door, only where the hall is elsewhere */
+.rowHall{display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;margin-left:10px;
+  vertical-align:middle;color:var(--accent-deep);border-radius:var(--radius-pill);}
+.rowHall:hover{background:var(--glass);}
+.tbl .colGo{white-space:nowrap;}
+@media (max-width:640px){
+  .projCard h3{font-size:26px;padding:0 20px;}
+  .projCard .cardTag,.projCard .cardRel,.projCard .cardFaces,.projCard .cardFigs,.projCard .cardMeta,
+  .projCard .cardActions{padding-left:20px;padding-right:20px;}
+  .projCard .cardDot{margin-left:20px;}
+  .projCard.has-art .cardDot{left:18px;}
+  .projCard .cardActions{gap:16px;}
+}
 @media (prefers-reduced-motion:no-preference){
-  .cardScrim:not([hidden]) .projCard{animation:cardIn .16s ease-out;}
-  @keyframes cardIn{from{opacity:0;transform:translateY(6px) scale(.98);}to{opacity:1;transform:none;}}
+  .cardScrim:not([hidden]) .projCard{animation:cardIn 260ms cubic-bezier(.16,1,.3,1) both;}
+  @keyframes cardIn{from{opacity:0;transform:translateY(6px);}to{opacity:1;transform:none;}}
 }
 
 /* ── your projects: search + a state filter whose pills carry live counts, so

package/public-landing/projects.html

@@ -539,7 +539,7 @@ summary{min-height:24px;padding:3px 0;}
           <td class="right num" id="selfBuilders">—</td>
           <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
-          <td class="colGo"><a class="rowGo" href="/">Open →</a></td>
+          <td class="colGo"><a class="rowGo" href="/">Open →</a><a class="rowHall" id="selfHall" href="{{buildersOrigin}}" aria-label="Builders' hall" title="Builders' hall" hidden><svg viewBox="0 0 20 20" aria-hidden="true"><path d="M2.8 7.4 10 3.5l7.2 3.9"/><path d="M5.2 8.8v5.6M10 8.8v5.6M14.8 8.8v5.6"/><path d="M3.4 16.3h13.2"/></svg></a></td>
         </tr>
         <!--apex-only:end-->
       </tbody>
@@ -563,20 +563,30 @@ summary{min-height:24px;padding:3px 0;}
   <div class="cardScrim" id="cardScrim" hidden>
     <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
       <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
+      <!-- The poster (task 1003301, the v2 pick): every region a DIRECT child of
+           the card, on purpose. The C6 card test slices the card non-greedily up
+           to the first adjacent pair of closing wrapper tags, and a nested
+           wrapper would silently shorten what that test guards. So the banner is
+           a bare img, the figures and the faces are paragraphs, the facts a
+           definition list. Each region degrades by hiding: no art, no banner;
+           no faces, no row; one figure null, the other stands alone; both null,
+           no band; a fact with no answer hides label and value together,
+           because "Owner: dash" on the most authoritative-looking element of
+           the page reads as broken, not honest (task 1002778). Everything null
+           is the card that shipped before this one: disc, name, tagline,
+           relationship, the address, one door. -->
+      <img class="cardArt" id="cardArt" alt="" hidden>
+      <p class="cardFigs" id="cardFigs" hidden>
+        <span class="cardCall a" id="cardBuildersFig" hidden><svg class="lead" viewBox="0 0 68 26" preserveAspectRatio="none" aria-hidden="true"><line x1="0" y1="25" x2="67" y2="1" stroke="currentColor" stroke-width="1" vector-effect="non-scaling-stroke"/></svg><span class="fig" id="cardBuilders"></span><span class="cap">builders</span></span>
+        <span class="cardCall b" id="cardShippedFig" hidden><svg class="lead" viewBox="0 0 68 26" preserveAspectRatio="none" aria-hidden="true"><line x1="0" y1="25" x2="67" y2="1" stroke="currentColor" stroke-width="1" vector-effect="non-scaling-stroke"/></svg><span class="fig" id="cardShipped"></span><span class="cap">shipped in 30 days</span></span>
+      </p>
       <span class="cardDot" id="cardDot"></span>
       <h3 id="cardName"></h3>
       <p class="cardTag" id="cardTag"></p>
       <p class="cardRel" id="cardRel" hidden></p>
-      <!-- The facts strip. A definition list, never nested block wrappers, on
-           purpose: the C6 card test slices the card non-greedily up to the
-           first adjacent pair of closing wrapper tags, and a nested wrapper
-           would silently shorten what that test guards. A fact with no answer
-           hides, label and value together, because "Owner: dash" on the most
-           authoritative-looking element of the page reads as broken, not
-           honest (task 1002778). -->
+      <p class="cardFaces" id="cardFaces" hidden></p>
       <dl class="cardMeta" id="cardMeta" hidden>
         <dt id="cardTypeL" hidden>Type</dt><dd id="cardType" hidden></dd>
-        <dt id="cardBuildersL" hidden>Builders</dt><dd id="cardBuilders" hidden></dd>
         <dt id="cardRunsL" hidden>Runs</dt><dd id="cardRuns" hidden></dd>
         <dt id="cardOwnerL" hidden>Owner</dt><dd id="cardOwner" hidden></dd>
         <dt id="cardListedL" hidden>Listed</dt><dd id="cardListed" hidden></dd>
@@ -1492,7 +1502,7 @@ summary{min-height:24px;padding:3px 0;}
           : '<span class="chip calm"><span class="cdot"></span>—</span>') + '</td>' +
         '<td class="colGo">' + (safeHttpUrl(p.origin)
           ? '<a class="rowGo" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">Open →</a>'
-          : '') + '</td>' +
+          : '') + hallGlyphHtml(p, rel) + '</td>' +
         '</tr>';
     }).join(''));
   }
@@ -1577,6 +1587,9 @@ summary{min-height:24px;padding:3px 0;}
     if (row) {
       row.hidden = !selfShown;
       $('selfPill').innerHTML = badge ? ' <span class="pill">' + badge + '</span>' : '';
+      /* the hall glyph: member-gated (the badge says so) and address-gated */
+      var sh = $('selfHall');
+      if (sh) sh.hidden = !badge || !hallUrlOf(SELF_PROJECT);
     }
 
     var shown = list.length + (selfShown ? 1 : 0);
@@ -1639,32 +1652,111 @@ summary{min-height:24px;padding:3px 0;}
     return !!value;
   }
 
+  /* Runs, on the poster, is the project's ADDRESS: where it answers. The table
+     keeps the module list in its Runs column (the v2 pick, direction §7). */
+  function runsOf(p) {
+    return p.isSelf ? hostOf(location.host) : hostOf(p.origin);
+  }
+  /* shipped in the last 30 days, "N+" when the count sat at the feed's row cap;
+     null is "we could not ask" and hides, 0 is a real answer and renders */
+  function shippedFigure(p) {
+    if (p.shipped_30d == null) return '';
+    return String(p.shipped_30d) + (p.shipped_30d_capped ? '+' : '');
+  }
+  /* A figure either has an answer or takes no space: the callout hides whole,
+     leader and caption with it, so the other figure stands alone. */
+  function cardFig(id, value) {
+    $(id).textContent = value || '';
+    $(id + 'Fig').hidden = !value;
+    return !!value;
+  }
+  /* The faces: up to five avatars from the project's own leaderboard, then +N
+     for the builders beyond them. Third-party URLs, scheme-checked before they
+     become a src. No faces, no row. */
+  var FACES_MAX = 5;
+  function cardFaces(p) {
+    var faces = Array.isArray(p.faces) ? p.faces.map(safeHttpUrl).filter(Boolean).slice(0, FACES_MAX) : [];
+    var more = p.builders != null && p.builders > faces.length ? p.builders - faces.length : 0;
+    $('cardFaces').innerHTML = faces.map(function (u) {
+      return '<img src="' + esc(u) + '" alt="" loading="lazy">';
+    }).join('') + (more ? '<span class="facesMore">+' + more + '</span>' : '');
+    $('cardFaces').hidden = !faces.length;
+  }
+  /* The banner. has-art switches the whole layout (the disc over the banner's
+     edge, the figures as callouts on it); without art the card is the card
+     that shipped before this one. A broken image demotes to no-art, so the
+     most authoritative element of the page never shows a broken glyph. */
+  function cardArt(url) {
+    var img = $('cardArt');
+    if (url) img.src = url; else img.removeAttribute('src');
+    img.hidden = !url;
+    $('projCard').classList.toggle('has-art', !!url);
+  }
+  $('cardArt').addEventListener('error', function () { cardArt(''); });
+  /* EXACTLY ONE hall-URL derivation (task 1003257, owner decision a). The hub's
+     own hall comes from the DOM: the server-stamped anchor in its own table row
+     (dropped whole by the stamp when a pack names no hall; never assembled in
+     script). A project's comes from the hall_origin its feed row carries. Both
+     go through safeHttpUrl, and both count only where the hall is a different
+     host from the site: a door that opens onto the room you are in is a dead door. */
+  function hallUrlOf(p) {
+    var hall, site;
+    if (p.isSelf) {
+      var a = $('selfHall');
+      hall = a ? safeHttpUrl(a.getAttribute('href')) : '';
+      site = location.host;
+    } else {
+      hall = safeHttpUrl(p.hall_origin);
+      site = p.origin;
+    }
+    return hall && hostOf(hall) !== hostOf(site) ? hall : '';
+  }
+  var HALL_GLYPH = '<svg viewBox="0 0 20 20" aria-hidden="true"><path d="M2.8 7.4 10 3.5l7.2 3.9"/><path d="M5.2 8.8v5.6M10 8.8v5.6M14.8 8.8v5.6"/><path d="M3.4 16.3h13.2"/></svg>';
+  function isMember(rel) { return rel === 'owner' || rel === 'builder'; }
+  /* the row's hall glyph: a member's door, only where the hall is elsewhere */
+  function hallGlyphHtml(p, rel) {
+    var hall = isMember(rel) ? hallUrlOf(p) : '';
+    return hall
+      ? '<a class="rowHall" href="' + esc(hall) + '" target="_blank" rel="noopener" aria-label="Builders\' hall" title="Builders\' hall">' + HALL_GLYPH + '</a>'
+      : '';
+  }
+
   function openCard(p, rel, returnTo) {
     var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
+    /* the art: catalog text an Archon typed, scheme-checked server-side and
+       again here before it becomes a src */
+    cardArt(p.isSelf ? '' : safeHttpUrl(p.art_url));
     $('cardDot').style.setProperty('--acc', p.isSelf ? 'var(--accent)' : accentOf(p));
     $('cardName').textContent = p.name || '';
     $('cardTag').textContent = p.tagline || '';
     var label = rel === 'owner' ? 'yours' : rel === 'builder' ? 'you build here' : '';
     $('cardRel').textContent = label;
     $('cardRel').hidden = !label;
-    /* builders: 0 is a real answer ("nobody has joined yet"), null is "we could
-       not ask" and hides. runs: [] is a real answer too — the project declares
-       nothing beyond the core set, which the owner voiced as "core". */
+    cardFaces(p);
+    /* the two figures: builders (0 is a real answer, "nobody has joined yet";
+       null is "we could not ask" and hides) and shipped in the last 30 days */
+    var figs = cardFig('cardBuilders', p.builders == null ? '' : String(p.builders));
+    figs = cardFig('cardShipped', shippedFigure(p)) || figs;
+    $('cardFigs').hidden = !figs;
     var any = cardFact('cardType', typeLabel(p.type));
-    any = cardFact('cardBuilders', p.builders == null ? '' : String(p.builders)) || any;
-    any = cardFact('cardRuns', Array.isArray(p.tags) ? tagsHtml(p.tags) : '', true) || any;
+    any = cardFact('cardRuns', runsOf(p)) || any;
     /* when the rel chip already says "yours", naming the viewer as Owner is
        noise — the fact answers strangers, not the person it describes */
     any = cardFact('cardOwner', rel === 'owner' ? '' : ownerHtml(p), true) || any;
     any = cardFact('cardListed', p.created_at ? listedDate(p.created_at) : '') || any;
     $('cardMeta').hidden = !any;
     /* the platform's door is same-tab: / is this site, and a new tab for the
-       page you are already on is a bug, not a courtesy */
-    $('cardActions').innerHTML = href
-      ? '<a class="btn small" href="' + esc(href) + '"' +
+       page you are already on is a bug, not a courtesy. The hall door beside it
+       is member-gated AND address-gated: a member's entry, only where the hall
+       is somewhere other than the site the first door already opens. */
+    var hall = isMember(rel) ? hallUrlOf(p) : '';
+    $('cardActions').innerHTML = (href
+      ? '<a class="cardOpen" id="cardOpen" href="' + esc(href) + '"' +
         (p.isSelf ? '' : ' target="_blank" rel="noopener"') + '>' +
         (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
-      : '';
+      : '') + (hall
+      ? '<a class="cardHall" id="cardHall" href="' + esc(hall) + '" target="_blank" rel="noopener">' + HALL_GLYPH + 'Builders\' hall</a>'
+      : '');
     closeMenus();
     cardReturn = returnTo || null;
     $('cardScrim').hidden = false;
@@ -1864,6 +1956,7 @@ summary{min-height:24px;padding:3px 0;}
            builder count and its owner — the archon row — by the same rule the
            server-side enrichment applies to every other project */
         SELF_PROJECT.builders = real.length;
+        SELF_PROJECT.faces = real.map(function (b) { return safeHttpUrl(b.avatar_url); }).filter(Boolean).slice(0, FACES_MAX);
         var arch = real.filter(function (b) { return b.rank === 'archon'; })[0];
         if (arch && arch.github_login) {
           SELF_PROJECT.owner = String(arch.github_login);
@@ -1872,6 +1965,21 @@ summary{min-height:24px;padding:3px 0;}
       })
       .catch(function () { /* unreachable → the dash already in the markup stands */ });
   }
+  /* the platform's shipped-in-30-days figure, by the rule the server applies
+     to every other project (project-stats.js): rows inside the window from
+     shipped_at, "N+" when the feed's row cap (200 with ?days honoured) was full */
+  function loadSelfShipped() {
+    return fetch(API + '/public/recent-shipped?days=30', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) {
+        if (!d || !Array.isArray(d.tasks)) return;
+        var since = Date.now() - 30 * 24 * 60 * 60 * 1000;
+        var n = d.tasks.filter(function (t) { return Date.parse(t && t.shipped_at) >= since; }).length;
+        SELF_PROJECT.shipped_30d = n;
+        SELF_PROJECT.shipped_30d_capped = d.tasks.length >= 200 && n === d.tasks.length;
+      })
+      .catch(function () { /* unknown stays unknown: the figure hides */ });
+  }
 
   function loadCatalog() {
     fetch(API + '/projects/featured', { credentials: 'same-origin' })
@@ -4022,8 +4130,12 @@ summary{min-height:24px;padding:3px 0;}
        (error_note, no intent in flight) can re-send its own domain — the route
        re-enqueues the attach for exactly this shape */
     if (inst.status === 'active' && inst.domain && inst.error_note && !inst.open_intent) return true;
-    return (!inst.domain || inst.domain === assignedDefaultFor(inst)) &&
-      (inst.status === 'requested' || inst.status === 'error' || inst.status === 'active');
+    /* every address here is now correctable (task 1003237): none (give it one),
+       the platform-assigned <slug>.<apex> (upgrade away from it), and — since the
+       owner decision of 2026-08-28 — a bring-your-own address that was mistyped.
+       The server's guards (reserved, in-apex squat, already held by another
+       project) are unchanged and stay the authority; this is only the door. */
+    return inst.status === 'requested' || inst.status === 'error' || inst.status === 'active';
   }
   /* re-enqueue doors: Try again on snagged, Bring it back on torn down —
      both re-POST the slug (the server's PROVISION_ENQUEUE_FROM gate) */
@@ -4237,13 +4349,30 @@ summary{min-height:24px;padding:3px 0;}
        be refused (intent_conflict), so the fold waits for the run to land */
     if (inst.open_intent && inst.open_intent.action === 'domain-attach') return '';
     var rekick = inst.status === 'active' && inst.domain && inst.error_note;
+    /* the CORRECTION door (task 1003237): the project already answers on an
+       address the founder brought, and it can be changed. The field carries the
+       current one so a typo is fixed by editing it, not retyped from scratch —
+       the re-kick door's shape, for the same reason. The platform-assigned
+       <slug>.<apex> is NOT a correction: moving off it is the upgrade the fold
+       already offered, and the field stays empty for the domain being brought. */
+    var byo = inst.domain && inst.domain !== assignedDefaultFor(inst);
+    var repoint = !rekick && byo;
+    var prefill = rekick || repoint;
+    var label = rekick ? 'Try the address again'
+      : repoint ? 'Use a different domain'
+      : inst.domain ? 'Use a domain I own' : 'Give it an address';
     return '<details class="attachFold"' + (rekick ? ' open' : '') + '>' +
-      '<summary>' + (rekick ? 'Try the address again' : inst.domain ? 'Use a domain I own' : 'Give it an address') + '</summary>' +
+      '<summary>' + label + '</summary>' +
       '<div class="attach">' +
       '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
-      (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
+      (prefill ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
       '<button type="button" class="btn small" data-attach="' + iid + '">' +
-      (rekick ? 'Try the address again' : 'Use this domain') + '</button></div></details>';
+      (rekick ? 'Try the address again' : repoint ? 'Change the address' : 'Use this domain') + '</button></div>' +
+      /* true in every state the fold renders in: a REQUESTED project never
+         answered anywhere yet, so "stops answering" would be a claim about a
+         thing that never happened (the F16 rule) */
+      (repoint ? '<p class="attachNote">Changing it lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
+      '</details>';
   }
 
   function renderCard(inst) {
@@ -5427,8 +5556,6 @@ summary{min-height:24px;padding:3px 0;}
           msg(id, 'That doesn’t look like a usable address — ' + esc(e.details.reason || 'use a real hostname like myproject.example.com') + '.', 'err');
         } else if (e.code === 'domain_taken') {
           msg(id, esc(e.message || 'That address is already in use by another project.'), 'err');
-        } else if (e.code === 'domain_already_set') {
-          msg(id, esc(e.message || 'This project already has an address — re-pointing isn’t supported here.'), 'err');
         } else if (e.code === 'domain_not_attachable') {
           msg(id, esc(e.message || 'An address can be attached once the instance settles.'), 'err');
         } else if (e.code === 'intent_conflict') {
@@ -5591,7 +5718,8 @@ summary{min-height:24px;padding:3px 0;}
        signed-out stranger lands on and it must not depend on identity */
     .then(loadCatalog, loadCatalog)
     /* the platform's own count is public too, so it loads either way */
-    .then(loadSelfStats, loadSelfStats);
+    .then(loadSelfStats, loadSelfStats)
+    .then(loadSelfShipped, loadSelfShipped);
 })();
 </script>
 </body>

package/public-landing/projects.probes.json

@@ -51,6 +51,34 @@
     { "name": "Escape closes the card when no band is open", "continue": true,
       "steps": [["press", "Escape"], ["wait", 150]],
       "expect": { "dialog": false } },
+    { "name": "the poster (task 1003301): art, five faces and +N, two figures on the art, the address, a member's hall door", "continue": true,
+      "steps": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"], ["wait", 900]],
+      "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]],
+                  "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"],
+                  "count": [["#cardFaces img", 5], ["#projCard > div", 1]],
+                  "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"], ["#cardHall", "Builders' hall"]],
+                  "href": [["#cardHall", "https://builders.amazonprimea.com/"], ["#cardOpen", "https://amazonprimea.com/"]] } },
+    { "name": "the ladder: a project that answered nothing is the card that shipped before (disc, name, tagline, address, listed, one door)", "continue": true,
+      "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]"], ["wait", 500]],
+      "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]],
+                  "hidden": ["#cardArt", "#cardFaces", "#cardFigs", "#cardBuildersFig", "#cardShippedFig", "#cardHall", "#cardRel", "#cardTypeL", "#cardOwnerL"],
+                  "visible": ["#cardDot", "#cardName", "#cardTag", "#cardRuns", "#cardListed", "#cardOpen"],
+                  "text": [["#cardRuns", "demo.cloudbongos.com"]] } },
+    { "name": "the hall door is address-gated: a member of a project whose hall is its own site gets no door; the capped figure reads N+", "continue": true,
+      "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 500]],
+      "expect": { "dialog": true, "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardFigs", "#cardBuildersFig", "#cardShippedFig", "#cardOpen"],
+                  "text": [["#cardRel", "you build here"], ["#cardShipped", "30+"], ["#cardBuilders", "1"]] } },
+    { "name": "the platform's own card: figures and faces by the same rule, its hall door from the stamped DOM link", "continue": true,
+      "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#selfOrb"], ["wait", 500]],
+      "expect": { "dialog": true, "hidden": ["#cardArt"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardFaces", "#cardOpen", "#cardHall"],
+                  "text": [["#cardRel", "yours"]], "href": [["#cardOpen", "/"]] } },
+    { "name": "the table: the hall glyph rides the door cell on the one member row whose hall is elsewhere, and on the platform's row", "continue": true,
+      "steps": [["press", "Escape"], ["wait", 150], ["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"table\"]"], ["wait", 300]],
+      "expect": { "dialog": false, "visible": ["#selfHall"], "count": [["#mapRows tr[data-generated] .rowHall", 1], ["#mapRows tr[data-generated] td", 18]],
+                  "href": [["#mapRows tr[data-generated] .rowHall", "https://builders.amazonprimea.com/"]] } },
+    { "name": "back to the sky for the rest of the sequence", "continue": true,
+      "steps": [["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"sky\"]"], ["wait", 300]],
+      "expect": { "hidden": ["#sub-table-body"] } },
     { "name": "a solo Shift tap focuses the search on the map", "continue": true,
       "steps": [["clickAt", 700, 600], ["press", "Shift"], ["wait", 100]],
       "expect": { "activeId": "mapQ" } },

package/public-landing/projects.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The hub's states for modules/ui-design/kit/render.js (task 1003320): name → url + actions + expectations. `auth` picks the signed-in stub. Rendered dark + light at 1440/390/320 and audited against the platform floors.",
+  "_": "The hub's states for modules/ui-design/kit/render.js (task 1003320): name → url + actions + expectations. `auth` picks the signed-in stub. Rendered dark + light at 1440/390/320 and audited against the platform floors. The card states (task 1003301) walk the poster's ladder: the full poster, the artless two-up band, the all-null floor, the platform's own card.",
   "page": "/projects",
   "surface": "public-landing",
   "modeQuery": "mode",
@@ -14,12 +14,15 @@
     "in-map-kbd": { "auth": true, "actions": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 350], ["press", "ArrowDown"], ["wait", 120]], "expect": { "expanded": true, "activeText": "Table" } },
     "in-map-search": { "auth": true, "actions": [["clickIfVisible", "#qToggle"], ["wait", 200], ["fill", "#mapQ", "emer"], ["wait", 300]], "expect": { "value": [["#mapQ", "emer"]] } },
     "in-map-mine-on": { "auth": true, "actions": [["check", "#onlyMine"], ["wait", 300]], "expect": { "checked": "#onlyMine" } },
-    "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body", ".tblMast", ".mastObj"], "closed": "#menuProjects" } },
+    "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body", ".tblMast", ".mastObj", "#selfHall"], "closed": "#menuProjects", "count": [["#mapRows tr[data-generated] .rowHall", 1]] } },
     "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap"] } },
     "in-new": { "auth": true, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "out-map-projects": { "auth": false, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
-    "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb:not(#selfOrb)"], ["wait", 600]], "expect": { "dialog": true } }
+    "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"], ["wait", 900]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]], "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"], "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"]], "count": [["#cardFaces img", 5]], "href": [["#cardHall", "https://builders.amazonprimea.com/"]] } },
+    "card-noart": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]], "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardOpen"], "text": [["#cardShipped", "30+"], ["#cardRel", "you build here"]] } },
+    "card-floor": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hidden": ["#cardArt", "#cardFaces", "#cardFigs", "#cardHall", "#cardRel", "#cardTypeL", "#cardOwnerL"], "visible": ["#cardOpen", "#cardRuns", "#cardListed"] } },
+    "card-self": { "auth": true, "actions": [["dispatchClick", "#selfOrb"], ["wait", 600]], "expect": { "dialog": true, "hidden": ["#cardArt"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardFaces", "#cardOpen", "#cardHall"], "text": [["#cardRel", "yours"]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 100]] }
 }

package/scripts/gds/provision-net.js

@@ -118,6 +118,37 @@ function dnsUpsertEnv(inst, { publicIp, zone, proxied = false } = {}) {
   };
 }
 
+// The RFC 5737 TEST-NET-1 sentinel a released hostname is parked at (task
+// 1003237) — the shape scripts/gds/box-infra.js proved for a torn-down box
+// (idea 309 / task 1234). 192.0.2.1 is reserved for documentation and is
+// GUARANTEED never routable, so a name parked here can never dial platform
+// infra or a recycled address.
+const DNS_BLACKHOLE_IP = '192.0.2.1';
+
+// The env a RELEASE invocation of the DNS hook needs: the abandoned hostname,
+// parked at the blackhole sentinel. A re-point (task 1003237) leaves the old
+// address UPSERTed at the platform's IP for a project that no longer answers
+// there — the ADR 0181 §2 leak — and this is how the runner lets it go.
+//
+// REPOINT, not delete, for the reason box-infra.js records: deleting a name
+// opens an NXDOMAIN window that resolvers negative-cache for the zone's SOA
+// neg-TTL (~30 min, not editable), so a client that queried mid-gap stays
+// broken long after. A name that always resolves — to a guaranteed-dead host —
+// has nothing to negative-cache. It also needs only the UPSERT contract every
+// BOX_DNS_HOOK implements, so no hook grows a new mode for this.
+//
+// proxied=0: a parked record must never ride the Cloudflare edge, which would
+// answer for it. Takes a bare `hostname` rather than an instance — the whole
+// point is that the row has already moved on. PURE.
+function dnsReleaseEnv(hostname, { zone } = {}) {
+  return {
+    BOX_HOSTNAME: hostname,
+    BOX_IP: DNS_BLACKHOLE_IP,
+    CLOUDFLARE_ZONE: zone || zoneForDomain(hostname),
+    BOX_PROXIED: '0',
+  };
+}
+
 // ── DNS token-scope PREFLIGHT (task 1980) ────────────────────────────────────
 // Onboarding a NEW project on a domain the control-plane's Cloudflare token does NOT
 // cover fails LATE: the DNS UPSERT (step 5) errors mid-provision (the Emersonian
@@ -208,10 +239,12 @@ function healthzCmd(inst) {
 
 module.exports = {
   CF_API_BASE,
+  DNS_BLACKHOLE_IP,
   caddyBlock,
   caddySnippetPath,
   checkDnsTokenScope,
   classifyZoneScope,
+  dnsReleaseEnv,
   dnsUpsertEnv,
   federateInstance,
   federationHubOrigin,