@bongos/core 1.19.401 → 1.19.403

package/scripts/gds/provision-units.js

@@ -240,6 +240,23 @@ function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
 // The settings env vars the runner pushes to a RUNNING instance (task 1003140):
 // the module's settingsEnvVars under the prefix the instance actually resolves —
 // the same pair webEnvBody writes at standup, so standup and push cannot drift.
+// The four origin overrides web.env carries for an addressed instance — the
+// domain-dependent half of webEnvBody, on its own so domain-attach can patch
+// exactly those lines IN PLACE (task 1003237). A single-host instance has no
+// dedicated builders./status. subdomain, so all four point at the one host.
+// Empty for a domainless instance: there is no origin to assert, and writing
+// `=` over a real one would take the hall down. PURE.
+function originEnvVarsFor(inst) {
+  if (!inst || !inst.domain) return {};
+  const prefix = provisionedEnvPrefix(), origin = `https://${inst.domain}`;
+  return {
+    [`${prefix}_PUBLIC_ORIGIN`]: origin,
+    [`${prefix}_BUILDERS_ORIGIN`]: origin,
+    [`${prefix}_STATUS_ORIGIN`]: origin,
+    [`${prefix}_OAUTH_ORIGIN`]: origin,
+  };
+}
+
 function settingsEnvVarsFor(inst) {
   const { settingsEnvVars } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   return settingsEnvVars(inst, provisionedEnvPrefix());
@@ -309,6 +326,7 @@ module.exports = {
   backupTimerPath,
   backupUnitName,
   instanceManifestCmd,
+  originEnvVarsFor,
   provisionedEnvPrefix,
   serviceUnit,
   serviceUnitPath,

package/scripts/gds/provision.js

@@ -51,8 +51,8 @@ const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
 function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = null, sshOpts = '' }) {
   // `shown` (task 1003140): what to LOG in place of the command text — for a command
@@ -464,6 +464,12 @@ async function provisionInstance(inst, deps) {
     }
   }
 
+  // A re-point on a PRE-ACTIVE instance records its release here and never
+  // reaches the attach leg (that one no-ops for anything but 'active'), so this
+  // run owns the drain — and an `error` row is frequently a partial standup that
+  // already UPSERTed the address it is now leaving (ADR 0181 §1, task 1003237).
+  await releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning });
+
   // ── step 6: Caddy per-instance site snippet + reload ──────────────────────
   // Write the instance's OWN <slug>.caddy snippet (idempotent overwrite via the
   // injected writeFile — no read-modify-append to a shared Caddyfile), then reload.
@@ -557,6 +563,57 @@ runcmd:
 `;
 }
 
+// The addresses a re-point left behind and this run still owes a release on
+// (task 1003237). The one guard this tier can make on its own, and the one that
+// matters: the address the instance is CURRENTLY on is never released, so a row
+// that somehow queued its own domain can never blackhole a live project.
+// Keeping a platform-assigned <slug>.<apex> off the queue is the ENQUEUE site's
+// job — the web tier knows the apex, this runner does not (ADR 0181 §2). PURE.
+function releasableDomains(inst) {
+  const here = String((inst && inst.domain) || '').toLowerCase();
+  return (Array.isArray(inst && inst.released_domains) ? inst.released_domains : [])
+    .map((d) => String(d || '').toLowerCase())
+    .filter((d) => d && d !== here);
+}
+
+// Park every address a re-point moved off at the blackhole sentinel, then empty
+// the queue (task 1003237, ADR 0200). Called by BOTH legs that wire a domain —
+// domain-attach for an ACTIVE instance, and the provision run that owns
+// PRE-ACTIVE ones, since an `error` row is frequently a partial standup that
+// already UPSERTed the address it is now leaving (ADR 0181 §1).
+//
+// BEST-EFFORT in the teardown sense: a hook that fails leaves the queue intact
+// so the next run retries, and never fails the wiring that already landed. EVERY
+// queued address is attempted — one host whose zone the token cannot reach must
+// not strand the others behind it — and the queue is emptied only when all of
+// them landed; a re-park of an address already at the sentinel is an idempotent
+// UPSERT, so retrying the whole list costs nothing but the call. The list is
+// capped at the enqueue site (MAX_RELEASED_DOMAINS), which is what bounds this
+// loop. Returns the first host that failed, or null. Runs on the CONTROL PLANE —
+// the hook needs the Cloudflare token, which never leaves it (ADR 0111 §2).
+async function releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning }) {
+  const hosts = releasableDomains(inst);
+  if (!hosts.length) return null;
+  if (!CONFIG.dnsHook) {
+    log(`  [dns] cannot release ${hosts.join(', ')} (BOX_DNS_HOOK unset) — remove their A records manually`);
+    return null;
+  }
+  let firstFailed = null;
+  for (const host of hosts) {
+    const relEnv = dnsReleaseEnv(host);
+    log(`  [dns] release ${host} -> ${relEnv.BOX_IP} (blackhole, zone ${relEnv.CLOUDFLARE_ZONE}) via ${CONFIG.dnsHook}`);
+    if (!apply) continue;
+    try { controlExec(CONFIG.dnsHook, { env: relEnv }); }
+    catch (e) {
+      log(`  ⚠ could not release ${host}: ${(e && e.message) || e} — its A record still points here`);
+      if (!firstFailed) firstFailed = host;
+    }
+  }
+  if (firstFailed) return firstFailed;
+  if (apply && provisioning.clearReleasedDomains) await provisioning.clearReleasedDomains(db, inst.id).catch(() => {});
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Attach a late-arriving domain to an ALREADY-ACTIVE instance (task 1002692):
 // re-assert exactly the domain-dependent runbook legs — web.env origins (+ a
@@ -565,6 +622,18 @@ runcmd:
 // RETURN { ok:false } instead of throwing: the drain loop's catch flips the
 // instance to 'error', which must never happen to a healthy ACTIVE instance
 // over a domain hiccup.
+//
+// This leg ALSO carries a RE-POINT (task 1003237, ADR 0200) — the same intent,
+// because the wiring is the same wiring. Two things follow from that:
+//   • The origin lines are patched IN PLACE (upsertEnvVars), never regenerated
+//     from the row. A template re-write via webEnvBody would blank the OAuth
+//     creds placeManifestCreds placed, the App private key and the federation
+//     block — none of which the row knows (ADR 0190 §2). A first attach was
+//     MASKED by wizard order (address first, GitHub App second); a re-point runs
+//     on a project the founder is already signed in to, so the same move would
+//     break sign-in on the exact project they just corrected (idea 1000842).
+//   • Every address on the row's release queue is parked at the blackhole
+//     sentinel AFTER the new one is wired — best-effort, never fatal.
 // ---------------------------------------------------------------------------
 async function domainAttachInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
@@ -603,8 +672,22 @@ async function domainAttachInstance(inst, deps) {
     ? (CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp))
     : CONFIG.publicIp;
 
-  log('  [config] re-write per-instance web.env (origins now carry the domain)');
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
+  // Patch ONLY the origin lines (the settingsApplyInstance shape, ADR 0190 §2).
+  // Dry-run has no file to read, so it PLANS the patch rather than writing a
+  // synthetic body. An unreadable or empty file is refused, never "patched":
+  // writing four origins over a missing PORT/PGDATABASE would take the instance
+  // down — and this leg runs against instances that are ALREADY serving.
+  const origins = originEnvVarsFor(inst);
+  const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
+  const currentEnv = String((read && read.stdout) || '');
+  if (!apply) {
+    log(`  [config] would patch ${Object.keys(origins).join(', ')} in ${webEnvPath(inst)} in place (creds + federation untouched)`);
+  } else if (!read || read.softFailed || !currentEnv.trim()) {
+    return { ok: false, error: `cannot read ${webEnvPath(inst)} — nothing to patch (was this instance provisioned by the runner?)` };
+  } else {
+    log('  [config] patch the origin lines of web.env in place (creds + federation untouched)');
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(currentEnv, origins), { mode: 0o600, sudo: true });
+  }
   log('  [service] restart to pick up the new origins');
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
@@ -629,10 +712,19 @@ async function domainAttachInstance(inst, deps) {
     log(`  [dns] skipped (BOX_DNS_HOOK unset) — point ${inst.domain}'s A record at ${recordIp || 'this server'} manually`);
   }
 
+  // The snippet is per-SLUG and always carries the CURRENT domain, so a re-point
+  // takes the old vhost away in the same write — Caddy stops serving the old host
+  // (and tls-check stops vouching for it) with no separate un-wire step.
   log('  [caddy] write site snippet + reload');
   boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
   boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
 
+  // Release what the re-point moved off, AFTER the new address is wired: the DNS
+  // record is the only half of an abandoned address the platform still holds, and
+  // it points at platform infra.
+  const releaseFailed = await releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning });
+  if (releaseFailed) return { ok: true, releaseFailed };
+
   log('  [healthz] verify the instance answers');
   boxExec(healthzCmd(inst), { allowFail: true });
 
@@ -1337,7 +1429,7 @@ module.exports = {
   caddyBlock, caddySnippetPath, healthzCmd, dedicatedUserData, nextFreePort,
   // executors + orchestration (injectable deps for tests)
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
-  domainAttachInstance, cmdRunIntents, cmdReconcile, cmdStatus,
+  domainAttachInstance, releasableDomains, cmdRunIntents, cmdReconcile, cmdStatus,
   // live settings push (task 1003140) + the in-place env patch + read-back it rides on
   settingsApplyInstance, upsertEnvVars, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch

package/src/module-api.js

@@ -1242,8 +1242,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.399 with no explicit bump. run 33201979306. (task 1002620)
 //   1.19.401 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.400 with no explicit bump. run 33205015717. (task 1002620)
+//   1.19.402 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.401 with no explicit bump. run 33206226800. (task 1002620)
+//   1.19.403 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.402 with no explicit bump. run 33208825538. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.401'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.403'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -176,6 +176,8 @@ const PAIRS = [
   // shipped a fired-down ember where #ffffff measured 4.61:1 — that is history now,
   // and any prose below still naming those values is history too.)
   ['.btn label on its fill',            'var(--accent-on)',     'var(--accent)',        4.5],
+  // the poster card's door lifts to --accent-lift on hover (task 1003301)
+  ['.cardOpen:hover label on its lift', 'var(--accent-on)',     'var(--accent-lift)',   4.5],
   ['.btn.ghost:hover label',            'var(--accent-deep)',   CARD,                   4.5],
   ['.btn.danger label',                 'var(--err)',           CARD,                   4.5],
   // Code chips, pills, the now-step number, the hover inks: --accent-deep is
@@ -205,8 +207,9 @@ const PAIRS = [
   ['.chip.live label',                  'var(--ok)',            'var(--ok-soft)',       4.5],
   ['.chip.maybe label',                 'var(--warn)',          'var(--warn-soft)',     4.5],
   ['.chip.down/.bad label',             'var(--err)',           'var(--err-soft)',      4.5],
-  // .chip.busy + the .tbl .pill / .cardRel / builder-badge family: accent-deep
-  // ink on the accent-soft tint, both modes
+  // .chip.busy + the builder-badge family: accent-deep ink on the accent-soft
+  // tint, both modes (.tbl .pill and .cardRel are mono labels in ink-faint since
+  // tasks 1003332 / 1003301 — a fact is not pressable, so the accent left them)
   ['.chip.busy label',                  'var(--accent-deep)',   'var(--accent-soft)',   4.5],
   // lifecycle strip STATE INDICATORS (task 1002751): non-text at the WCAG
   // 1.4.11 bar of 3.0. --sea-ink derives brighter in dark exactly the way

package/tests/project_stats.mjs

@@ -27,7 +27,8 @@ beforeEach(() => { stats._reset(); });
 function json(body) {
   return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(body) });
 }
-// route a fake instance: { leaderboard: [...], enabled: {...} }
+// route a fake instance: { leaderboard: [...], enabled: {...}, tasks: [...],
+// days: 30|undefined (whether the remote honoured ?days=), index: {...} }
 function stub(map) {
   globalThis.fetch = (url) => {
     const u = new URL(url);
@@ -39,9 +40,17 @@ function stub(map) {
     if (u.pathname.endsWith('/modules')) {
       return site.enabled ? json({ enabled: site.enabled }) : Promise.reject(new Error('down'));
     }
+    if (u.pathname.endsWith('/recent-shipped')) {
+      return site.tasks ? json({ tasks: site.tasks, days: site.days }) : Promise.reject(new Error('down'));
+    }
+    if (u.pathname === '/api/bongos') {
+      return site.index ? json(site.index) : Promise.reject(new Error('404'));
+    }
     return Promise.reject(new Error('404'));
   };
 }
+const DAY = 24 * 60 * 60 * 1000;
+function shipped(daysAgo) { return { shipped_at: new Date(Date.now() - daysAgo * DAY).toISOString() }; }
 
 test('system accounts are excluded — they are machines, not builders', async () => {
   // measured live: raw leaderboards read 13/3/3 against real 11/1/1
@@ -208,7 +217,7 @@ test('concurrent requests for the same origin collapse into one fetch', async ()
     stats.getProjectStats(['https://8.8.8.8']),
     stats.getProjectStats(['https://8.8.8.8']),
   ]);
-  assert.equal(calls, 2, 'two endpoints for one origin, not six for three callers');
+  assert.equal(calls, 4, 'four feeds for one origin, not twelve for three callers');
 });
 
 test('a non-http origin is refused rather than fetched', async () => {
@@ -274,3 +283,120 @@ test('an origin named __proto__ cannot retarget the result prototype', async ()
   assert.equal(Object.getPrototypeOf(out), null, 'the result map is null-prototype');
   assert.equal(({}).builders, undefined, 'Object.prototype is untouched');
 });
+
+/* ── The poster card's fields (task 1003301) ────────────────────────────────
+   Faces, shipped-in-30-days and the hall address ride the SAME allSettled as
+   builders and tags, degrade to null exactly like them, and share the one
+   frozen null shape — a key that went missing would ship as undefined, which
+   JSON.stringify drops, which silently changes the wire. ── */
+
+const KEYS = ['builders', 'tags', 'owner', 'owner_avatar', 'faces', 'shipped_30d', 'shipped_30d_capped', 'hall_origin'];
+
+test('one frozen null shape carries every key, and both fallbacks are that shape', async () => {
+  assert.ok(Object.isFrozen(stats.NULL_STATS));
+  assert.deepEqual(Object.keys(stats.NULL_STATS).sort(), KEYS.slice().sort());
+  const failed = await stats.getProjectStats(['file:///etc/passwd']);   // the cached-failure literal
+  assert.equal(failed['file:///etc/passwd'], stats.NULL_STATS);
+  stub({});
+  const unreached = await stats.getProjectStats(['https://9.9.9.9']);   // the read fallback
+  for (const k of KEYS) assert.equal(unreached['https://9.9.9.9'][k], null, `${k} is null, never undefined`);
+});
+
+test('faces are the first five people with an http avatar, in the feed\'s order; machines and bad URLs are skipped', async () => {
+  const av = (n) => `https://avatars.example.com/${n}.png`;
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [
+        { github_login: 'a', avatar_url: av('a') }, { github_login: 'bfg-system', avatar_url: av('bot') },
+        { github_login: 'b', avatar_url: 'javascript:alert(1)' }, { github_login: 'c', avatar_url: av('c') },
+        { github_login: 'd', avatar_url: av('d') }, { github_login: 'e', avatar_url: av('e') },
+        { github_login: 'f', avatar_url: av('f') }, { github_login: 'g', avatar_url: av('g') },
+      ],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].faces, ['a', 'c', 'd', 'e', 'f'].map(av));
+  assert.equal(out['https://8.8.8.8'].builders, 7, 'the +N the card shows is counted against builders');
+});
+
+test('a leaderboard with no avatars yields an empty faces list — asked, none — not null', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [{ github_login: 'a' }], enabled: {} } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].faces, []);
+});
+
+test('shipped_30d counts only rows inside the window, from shipped_at, whatever the remote returned', async () => {
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [], enabled: {},
+      tasks: [shipped(1), shipped(29), shipped(31), shipped(400), { shipped_at: null }, {}],
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].shipped_30d, 2);
+  assert.equal(out['https://8.8.8.8'].shipped_30d_capped, false);
+});
+
+test('shipped_30d is capped ("N+") when the feed\'s row cap is full and every row is inside the window', async () => {
+  const full = (n) => Array.from({ length: n }, (_, i) => shipped(i % 20));
+  stub({
+    'https://1.1.1.1': { leaderboard: [], enabled: {}, tasks: full(200), days: 30 },   // ?days honoured: cap 200
+    'https://8.8.8.8': { leaderboard: [], enabled: {}, tasks: full(30) },              // older core, no days: cap 30
+    'https://9.9.9.9': { leaderboard: [], enabled: {}, tasks: full(199), days: 30 },   // under the cap
+  });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://8.8.8.8', 'https://9.9.9.9']);
+  assert.deepEqual([out['https://1.1.1.1'].shipped_30d, out['https://1.1.1.1'].shipped_30d_capped], [200, true]);
+  assert.deepEqual([out['https://8.8.8.8'].shipped_30d, out['https://8.8.8.8'].shipped_30d_capped], [30, true]);
+  assert.deepEqual([out['https://9.9.9.9'].shipped_30d, out['https://9.9.9.9'].shipped_30d_capped], [199, false]);
+});
+
+test('the shipped feed is asked for the window explicitly', async () => {
+  const urls = [];
+  globalThis.fetch = (url) => { urls.push(String(url)); return Promise.reject(new Error('down')); };
+  await stats.getProjectStats(['https://8.8.8.8']);
+  assert.ok(urls.includes(`https://8.8.8.8/api/bongos/public/recent-shipped?days=${stats.SHIPPED_WINDOW_DAYS}`));
+  assert.ok(urls.includes('https://8.8.8.8/api/bongos'), 'the discovery index answers the hall address');
+});
+
+test('hall_origin is the discovery index\'s hall only where it is a different host from the site', async () => {
+  stub({
+    'https://1.1.1.1': { leaderboard: [], enabled: {}, index: { hall: 'https://builders.example.com' } },
+    'https://8.8.8.8': { leaderboard: [], enabled: {}, index: { hall: 'https://8.8.8.8' } },      // single host
+    'https://9.9.9.9': { leaderboard: [], enabled: {}, index: { hall: 'javascript:alert(1)' } },
+    'https://4.4.4.4': { leaderboard: [], enabled: {} },                                           // no index (older core)
+  });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://8.8.8.8', 'https://9.9.9.9', 'https://4.4.4.4']);
+  assert.equal(out['https://1.1.1.1'].hall_origin, 'https://builders.example.com');
+  assert.equal(out['https://8.8.8.8'].hall_origin, null, 'a hall at <site>/builders is the site\'s own door');
+  assert.equal(out['https://9.9.9.9'].hall_origin, null);
+  assert.equal(out['https://4.4.4.4'].hall_origin, null);
+});
+
+test('a dead shipped feed leaves the other quarters standing', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [{ github_login: 'a' }], enabled: { game: true }, index: { hall: 'https://h.example.com' } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].shipped_30d, null, 'the dead quarter is unknown');
+  assert.equal(out['https://8.8.8.8'].shipped_30d_capped, null);
+  assert.equal(out['https://8.8.8.8'].builders, 1);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['game']);
+  assert.equal(out['https://8.8.8.8'].hall_origin, 'https://h.example.com');
+});
+
+test('the origin\'s host is resolved once per sweep, not once per feed', async () => {
+  const src = await import('node:fs').then((fs) =>
+    fs.readFileSync(new URL('../modules/platform-identity/project-stats.js', import.meta.url), 'utf8'));
+  assert.match(src, /await assertPublicHost\(siteUrl\(origin\)\.hostname\);/, 'the guard runs in fetchStats, before the allSettled');
+  const getJson = (src.match(/async function getJson\(url\)\s*\{([\s\S]*?)\n\}/) || [, ''])[1];
+  assert.ok(getJson, 'getJson() must exist');
+  assert.doesNotMatch(getJson, /assertPublicHost/, 'no per-feed lookup');
+});
+
+test('httpUrl accepts only http(s) strings and caps them', () => {
+  assert.equal(stats.httpUrl('https://a.example/x.png'), 'https://a.example/x.png');
+  assert.equal(stats.httpUrl('http://a.example/x.png'), 'http://a.example/x.png');
+  assert.equal(stats.httpUrl('javascript:alert(1)'), null);
+  assert.equal(stats.httpUrl('//a.example/x.png'), null);
+  assert.equal(stats.httpUrl(42), null);
+  assert.equal(stats.httpUrl('https://a.example/' + 'x'.repeat(400)).length, 300);
+});

package/tests/projects_hub.mjs

@@ -483,13 +483,109 @@ test('the card claims only what the catalog and the project itself answer (C6)',
   for (const invented of [/\blive\b/i, /uptime/i, /\bCreated\b/]) {
     assert.doesNotMatch(card, invented, `the card must not invent ${invented}`);
   }
-  for (const id of ['cardBuilders', 'cardRuns', 'cardOwner', 'cardListed']) {
-    assert.match(card, new RegExp(`id="${id}"`), `the ${id} fact must be real markup (C7)`);
+  for (const id of ['cardBuilders', 'cardShipped', 'cardRuns', 'cardOwner', 'cardListed', 'cardArt', 'cardFaces', 'cardFigs']) {
+    assert.match(card, new RegExp(`id="${id}"`), `the ${id} region must be real markup (C7)`);
   }
   assert.match(card, />Listed</, 'the catalogue date wears its honest label');
   assert.doesNotMatch(card, /—/, 'an unanswerable card fact hides; it never dashes');
 });
 
+/* ── The poster (task 1003301; the v2 pick, direction §7) ───────────────────
+   Art, faces, two figures on the art, the facts as a ledger, one accent door
+   and a member-only hall entry. The load-bearing rule is the DEGRADATION
+   LADDER: every region hides on null, down to the card that shipped before. ── */
+
+test('every card region is a direct child of the card — the banner a bare img, the faces and figures paragraphs', () => {
+  const card = (HUB.match(/<div class="projCard"[\s\S]*?<div class="cardActions" id="cardActions"><\/div>/) || [''])[0];
+  assert.ok(card, 'the card must be findable');
+  assert.equal((card.match(/<div\b/g) || []).length, 2, 'the card and its actions strip are the only divs — a nested wrapper shortens the C6 slice');
+  assert.match(card, /<img class="cardArt" id="cardArt" alt="" hidden>/, 'the banner is a bare img, hidden until art arrives');
+  assert.match(card, /<p class="cardFigs" id="cardFigs" hidden>/, 'the figures ride a paragraph');
+  assert.match(card, /<p class="cardFaces" id="cardFaces" hidden>/, 'the faces ride a paragraph');
+  assert.match(card, /<span class="cardCall a" id="cardBuildersFig" hidden>[\s\S]*?<span class="fig" id="cardBuilders"><\/span><span class="cap">builders<\/span>/);
+  assert.match(card, /<span class="cardCall b" id="cardShippedFig" hidden>[\s\S]*?<span class="fig" id="cardShipped"><\/span><span class="cap">shipped in 30 days<\/span>/);
+  assert.equal((card.match(/<svg class="lead"/g) || []).length, 2, 'each callout carries its own leader');
+  assert.doesNotMatch(card, /id="cardBuildersL"/, 'Builders left the facts list for the figure band');
+});
+
+test('the ladder: each region hides on null and the other figure stands alone', () => {
+  const fig = (SCRIPT.match(/function cardFig\(id, value\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fig, 'cardFig() must exist');
+  assert.match(fig, /\$\(id \+ 'Fig'\)\.hidden = !value/, 'a null figure hides its whole callout, leader and caption with it');
+  assert.match(SCRIPT, /\$\('cardFigs'\)\.hidden = !figs;/, 'both null hides the band');
+  const sf = (SCRIPT.match(/function shippedFigure\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(sf, /p\.shipped_30d == null\) return ''/, 'null shipped hides; 0 renders');
+  assert.match(sf, /p\.shipped_30d_capped \? '\+' : ''/, 'at the feed cap the figure reads N+');
+  const faces = (SCRIPT.match(/function cardFaces\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(faces, 'cardFaces() must exist');
+  assert.match(faces, /\$\('cardFaces'\)\.hidden = !faces\.length/, 'no faces, no row — absent, not empty-looking');
+  assert.match(faces, /p\.faces\.map\(safeHttpUrl\)\.filter\(Boolean\)\.slice\(0, FACES_MAX\)/, 'five scheme-checked faces at most');
+  assert.match(faces, /p\.builders - faces\.length/, 'the +N counts the builders beyond the faces shown');
+  assert.match(SCRIPT, /var FACES_MAX = 5;/);
+  const art = (SCRIPT.match(/function cardArt\(url\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(art, 'cardArt() must exist');
+  assert.match(art, /classList\.toggle\('has-art', !!url\)/, 'art switches the whole layout');
+  assert.match(SCRIPT, /\$\('cardArt'\)\.addEventListener\('error', function \(\) \{ cardArt\(''\); \}\);/,
+    'a broken image demotes to the no-art layout, never a broken glyph');
+  assert.match(SCRIPT, /cardArt\(p\.isSelf \? '' : safeHttpUrl\(p\.art_url\)\)/, 'the art URL is scheme-checked client-side too');
+});
+
+test('exactly one hall-URL derivation: the DOM for the hub, the feed for a project, safeHttpUrl for both, and only where the hall is elsewhere', () => {
+  assert.equal((SCRIPT.match(/function hallUrlOf\(/g) || []).length, 1);
+  const fn = (SCRIPT.match(/function hallUrlOf\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'hallUrlOf() must exist');
+  assert.match(fn, /var a = \$\('selfHall'\);/, 'the hub\'s own hall is read from the stamped DOM anchor, never assembled in script');
+  assert.match(fn, /safeHttpUrl\(a\.getAttribute\('href'\)\)/);
+  assert.match(fn, /safeHttpUrl\(p\.hall_origin\)/, 'a project\'s hall is the feed field, scheme-checked');
+  assert.match(fn, /hostOf\(hall\) !== hostOf\(site\)/, 'address-gated: no door onto the room you are in');
+  assert.doesNotMatch(SCRIPT, /'[^'\n]*\{\{buildersOrigin\}\}/, 'no brand token is ever emitted into a script string');
+  assert.equal((SCRIPT.match(/isMember\(rel\) \? hallUrlOf\(p\) : ''/g) || []).length, 2, 'member-gated on the card AND on the row, one rule');
+  assert.match(SCRIPT, /'<a class="cardHall" id="cardHall" href="' \+ esc\(hall\)/, 'the card\'s hall door is escaped');
+  assert.match(SCRIPT, /'<a class="rowHall" href="' \+ esc\(hall\) \+ '" target="_blank" rel="noopener"/, 'the row\'s hall glyph is escaped and opens a new tab');
+  assert.match(SCRIPT, /: ''\) \+ hallGlyphHtml\(p, rel\) \+ '<\/td>'/, 'the glyph rides the existing door cell — no seventh column');
+});
+
+test('the platform row carries a stamped, hidden hall glyph the session unhides — same tab, no target', () => {
+  const selfRow = (HUB.match(/<tr id="selfRow">([\s\S]*?)<\/tr>/) || [, ''])[1];
+  assert.match(selfRow, /<a class="rowHall" id="selfHall" href="\{\{buildersOrigin\}\}"[^>]*hidden>/, 'server-stamped and hidden until the session says member');
+  assert.match(SCRIPT, /if \(sh\) sh\.hidden = !badge \|\| !hallUrlOf\(SELF_PROJECT\);/, 'member-gated and address-gated, and null-safe: the stamp drops the anchor whole when a pack names no hall');
+  assert.match(SCRIPT, /if \(p\.isSelf\) \{\r?\n\s*var a = \$\('selfHall'\);/);
+});
+
+test('the card\'s doors: one accent door, the hall entry beside it as text, the platform\'s door same-tab', () => {
+  assert.match(SCRIPT, /'<a class="cardOpen" id="cardOpen" href="' \+ esc\(href\) \+ '"' \+\r?\n\s*\(p\.isSelf \? '' : ' target="_blank" rel="noopener"'\)/);
+  assert.match(SCRIPT, /\(p\.isSelf \? 'Home →' : 'Open site →'\)/);
+  assert.match(SCRIPT, /HALL_GLYPH \+ 'Builders\\' hall<\/a>'/, 'the hall entry carries the glyph and its name');
+  assert.match(COSMOS, /\.projCard \.cardOpen\{[^}]*background:var\(--accent\);color:var\(--accent-on\)/, 'the one accent door');
+  assert.match(COSMOS, /\.projCard \.cardHall\{[^}]*color:var\(--accent-deep\)[^}]*text-decoration:underline/, 'the hall entry is the footer-link grammar');
+});
+
+test('the platform answers its own figures by the same rule: faces from its leaderboard, shipped from its own feed', () => {
+  assert.match(SCRIPT, /SELF_PROJECT\.faces = real\.map\(function \(b\) \{ return safeHttpUrl\(b\.avatar_url\); \}\)\.filter\(Boolean\)\.slice\(0, FACES_MAX\);/);
+  const fn = (SCRIPT.match(/function loadSelfShipped\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'loadSelfShipped() must exist');
+  assert.match(fn, /\/public\/recent-shipped\?days=30/, 'the window is asked for explicitly');
+  assert.match(fn, /Date\.parse\(t && t\.shipped_at\) >= since/, 'counted from shipped_at, inside the window');
+  assert.match(fn, /d\.tasks\.length >= 200 && n === d\.tasks\.length/, 'N+ at the feed\'s row cap');
+  assert.match(SCRIPT, /\.then\(loadSelfStats, loadSelfStats\)\r?\n\s*\.then\(loadSelfShipped, loadSelfShipped\);/, 'runs once at boot beside the leaderboard read');
+});
+
+test('the poster is in the world: 560 wide, one hairline, no shadow, the disc surviving over the art, the facts a ledger', () => {
+  const block = (COSMOS.match(/\.projCard\{[^}]*\}/) || [''])[0];
+  assert.match(block, /width:min\(560px,100%\)/);
+  assert.match(block, /border:1px solid var\(--rule\)/);
+  assert.match(block, /box-shadow:none/);
+  assert.match(block, /container-type:inline-size/, 'the disc and the callouts measure the card, not the viewport');
+  assert.match(COSMOS, /\.projCard \.cardArt\{[^}]*aspect-ratio:5\/2;object-fit:cover/, 'a fixed 5:2 crop');
+  assert.match(COSMOS, /\.projCard\.has-art \.cardDot\{[^}]*top:calc\(100cqw \/ 2\.5 - 27px\)[^}]*border:4px solid var\(--bg-card\)/, 'half over the banner\'s edge, ringed in the card ground');
+  assert.match(COSMOS, /\.projCard\.has-art \.cardCall::before\{[^}]*mask-image/, 'each callout carries a feathered patch of the card ground — a mask, not a shadow');
+  assert.match(COSMOS, /\.projCard \.cardMeta dt\{[^}]*font-family:var\(--label-face\)[^}]*border-top:1px solid var\(--rule-soft\)/, 'mono label on a hairline');
+  assert.match(COSMOS, /\.projCard \.cardMeta dd\{[^}]*text-align:right[^}]*border-top:1px solid var\(--rule-soft\)/, 'the value right and on the same hairline');
+  assert.match(COSMOS, /\.projCard \.cardRel\{[^}]*font-family:var\(--label-face\)/, 'the relationship is a mono label, not an accent pill');
+  assert.doesNotMatch(COSMOS, /\.projCard \.cardMeta \.tags/, 'the card no longer renders the module list');
+  assert.match(COSMOS, /\.rowHall\{[^}]*width:28px;height:28px/, 'the row glyph clears the 24px floor');
+});
+
 test('the row keeps its own Open link working underneath the card', () => {
   assert.match(SCRIPT, /if \(ev\.target\.closest && ev\.target\.closest\('a'\)\) return;/,
     'a click on the row\'s own anchor must not be swallowed by the card handler');
@@ -592,10 +688,15 @@ test('each card fact is wired to its data, not just present in the markup', () =
   assert.match(SCRIPT, /function cardFact/, 'the card fact writer must exist');
   assert.match(SCRIPT, /dd\.hidden = \$\(id \+ 'L'\)\.hidden = !value/,
     'a fact with no answer hides label and value together — never a dash');
-  assert.match(SCRIPT, /cardFact\('cardBuilders', p\.builders == null \? '' : String\(p\.builders\)\)/,
+  // since task 1003301 Builders is a FIGURE (a callout on the art), not a fact,
+  // and Runs on the poster is the project's ADDRESS — the table keeps the module list
+  assert.match(SCRIPT, /cardFig\('cardBuilders', p\.builders == null \? '' : String\(p\.builders\)\)/,
     'builders: 0 is a real answer, null hides');
-  assert.match(SCRIPT, /cardFact\('cardRuns', Array\.isArray\(p\.tags\) \? tagsHtml\(p\.tags\) : ''/,
-    'runs go through the one shared formatter');
+  assert.match(SCRIPT, /cardFig\('cardShipped', shippedFigure\(p\)\)/, 'the second figure is the 30-day count');
+  assert.match(SCRIPT, /cardFact\('cardRuns', runsOf\(p\)\)/, 'runs is the address on the poster');
+  const runs = (SCRIPT.match(/function runsOf\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(runs, /hostOf\(p\.origin\)/, 'the address is the catalog origin\'s host');
+  assert.match(SCRIPT, /'<td class="colTags">' \+ tagsHtml\(p\.tags\)/, 'the table row keeps the module list');
   assert.match(SCRIPT, /cardFact\('cardOwner', rel === 'owner' \? '' : ownerHtml\(p\), true\)/,
     'owner comes from the enrichment and yields to the rel chip saying "yours"');
   const oh = (SCRIPT.match(/function ownerHtml\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];

package/tests/projects_hub_pre_uat.mjs

@@ -335,11 +335,37 @@ test('the F19 re-kick door survives the fold: open, pre-filled, one button', ()
   const fold = fn('attachFold');
   assert.match(fold, /var rekick = inst\.status === 'active' && inst\.domain && inst\.error_note;/);
   assert.match(fold, /\(rekick \? ' open' : ''\)/, 'the fold opens on its own for a stalled address');
-  assert.match(fold, /\(rekick \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address that stalled');
-  assert.match(fold, /rekick \? 'Try the address again' : 'Use this domain'/, 'and the button says what it does');
+  assert.match(fold, /\(prefill \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address in play');
+  assert.match(fold, /var prefill = rekick \|\| repoint;/, 'a stalled address and a correctable one both arrive in the field');
+  assert.match(fold, /rekick \? 'Try the address again' : repoint \? 'Change the address' : 'Use this domain'/, 'and the button says what it does');
   assert.match(fn('canAttachDomain'), /inst\.status === 'active' && inst\.domain && inst\.error_note && !inst\.open_intent\) return true;/, 'the route-side re-kick gate is untouched');
 });
 
+test('the correction door: a bring-your-own address can be changed, and the fold says what that costs (task 1003237)', () => {
+  const fold = fn('attachFold');
+  // the three doors are told apart by what the project is actually addressed as
+  assert.match(fold, /var byo = inst\.domain && inst\.domain !== assignedDefaultFor\(inst\);/,
+    'the platform-assigned <slug>.<apex> is NOT a correction — moving off it is the upgrade the fold already offered');
+  assert.match(fold, /var repoint = !rekick && byo;/, 'a stalled address keeps the F19 door, which is louder');
+  assert.match(fold, /'Use a different domain'/, 'the summary names the correction');
+  assert.match(fold, /attachNote/, 'and the consequence is stated where the button is');
+  assert.match(fold, /won’t use that address any more/, 'letting the old address go is SAID, not discovered');
+  // the door itself: an addressed, live project is no longer excluded
+  const gate = fn('canAttachDomain');
+  assert.doesNotMatch(gate, /!inst\.domain \|\| inst\.domain === assignedDefaultFor\(inst\)/,
+    'the "only a domainless or platform-addressed project may attach" clause is what the re-point removes');
+  assert.match(gate, /inst\.status === 'requested' \|\| inst\.status === 'error' \|\| inst\.status === 'active'/,
+    'state is still the gate — a mid-flight or torn-down project has nothing to point a domain at');
+  assert.match(COSMOS, /\.attachNote\{/, 'the note is styled');
+  assert.doesNotMatch((COSMOS.match(/\.attachNote[^\n]*/g) || []).join('\n'), /#[0-9a-f]{3,8}\b/i,
+    'and paints from tokens, so dark mode needs no twin');
+});
+
+test('the retired refusal is gone from the card: domain_already_set can no longer be returned', () => {
+  assert.doesNotMatch(HUB, /domain_already_set/,
+    'the server stopped sending it (task 1003237) — a branch for it would be unreachable copy');
+});
+
 test('a heartbeat re-render keeps an open fold open and a half-typed domain typed', () => {
   const card = fn('renderCard');
   assert.match(card, /var keepOpen = !!\(oldFold && oldFold\.open\);/);