@bongos/core 1.19.438 → 1.19.440

package/docs/design/projects-hub-direction-v2.md

@@ -256,3 +256,23 @@ Three mastheads, rendered dark and light at 1440 / 390 / 320 (ALL CLEAN) and mea
 **The kit.** The stub remembers a saved planet for the run (a `PLANETS` map, the teardown-ask precedent) and answers the route's own receipt shapes, so the page's re-read finds its choice; both featured fixtures carry the keys on every row and Demo's owner has chosen `pair-obsidian-tint` on sea (the feed path — kept the pair's box so the sky's composition, and a signed-out Shift probe's blank-spot click, stand); Harbor's row carries `blob-frost-tint` on sun-lit (the row path — the list draws it with no catalog row). A state, `in-manage-planet`, renders the section on Demo; three probes save a pick and read the receipt, the head and the ledger row back, hand the pick back to the platform, and save through the pills at 390. `render.js --page /projects` ALL CLEAN (67 states), the empty and floor siblings ALL CLEAN, probes 44/44.
 
 **Retargeted.** `tests/projects_hub.mjs`: the mine-row and walk pins name the owner's choice first, the field-path pin reads Demo's choice over the curated template, and five new pins hold the vocabulary lockstep (client ↔ provisioning ↔ platform-identity), the section's markup and fold, the script (the preview, the radiogroups, the tick and late-catalog rules, the PATCH body, no open-intent re-read), the sheet by scope with the 900px pills, the kit's state/probes/fixtures/stub, and the seam. `tests/provisioning_settings.mjs` (the planet: saved, echoed, audited, no push; null clears; no change; no re-kick; a mixed save; off-vocabulary → 400), `modules/provisioning/tests/provisioning.mjs` (the mirror, `planetChoice`, `publicInstance`), `tests/provisioning_settings_env.mjs` (never in the env). The API docs regenerated; the copy registry regenerated.
+
+## 17. Your projects: two doors a row, and every control on the project's own page (task 1003355)
+
+**Date:** 2026-08-30 · the owner, on the shipped Your-projects list (§14.1): "for the buttons on the your projects page, I think we should consolidate to one or two buttons which would be 'view' or 'view' and 'manage' and move the other buttons inside the project page."
+
+**No composition round.** The grammar the round already settled (§14.1: the doors as hairline pills, the accent only on the one that acts) answers a two-door row without a new sheet, and the round's method reserves a sheet for a reading the page cannot already draw. What changed is *which* controls a row holds, not how a door looks — so this is a build against the existing pick, recorded here.
+
+**The row.** `renderCard` renders one `.actions` strip and nothing else: **View**, a plain link to the project's site, only where it is `active` and has an address; **Manage**, a real link to `?view=manage&id=N`, on every row. Neither acts, so neither takes the accent. Gone from the row: try again, bring it back, restart it, the two-press ender, and the bring-your-own-domain fold. What stays is everything that *says* rather than does — the planet, the name and its chip, the facts, the lifecycle rail, the honest snag paragraph, the torn-down note and the live region the watch writes into. The row's own `id="act-…"`, its confirm prompt (`cardAsking`/`askTeardown`/`unAskTeardown`), its four senders (`doTeardown`, `reProvision`, `doRestart`, `doAttach`), `quietActions`, `watchOnce` and `canTeardown` went with them; the delegated list handler is down to the one Manage anchor it upgrades. The focus-restore across the heartbeat re-render stays, shrunk to the two doors.
+
+**The manage page gains "its address".** The fold's field is now a settings section of the project's own page (`#mAddress`, between the ledger and repository visibility), in the `.mSec` grammar the three sections below it wear: the title and its fold on the left, the control on the right, the field as one hairline, the receipt as the section's own status line. The section's heading is the disclosure, so the field needs no `<details>` of its own and `.attachFold` left the sheet with it. Every server truth came across unchanged — `canAttachDomain` mirrors `DOMAIN_ATTACH_FROM`, the section hides itself where there is nothing to point an address at (a snagged or torn-down project), no second control renders while one is wiring, and the re-kick (F19) and correction (task 1003237) doors keep their pre-filled fields. What the fold said by *opening itself*, the section says in a sentence above the field. `renderAddress` is fetch-free like its neighbours, so the minute tick repaints it; the half-typed domain, the caret and the receipt all survive that repaint, the receipt keyed by project so a different one never wears the last one's.
+
+**Copy that pointed at the row, corrected.** Three sentences named a control the row no longer has, and each would now have been a dead end. `addressRow` takes a second argument for the surface reading it: on the manage page the unreachable line still says "or restart it yourself below" and the no-address line says "give it an address below"; on a row they name the project's own page instead, the second as a `data-manage` link the list opens in place. The ender's torn-down state pointed at "your projects" for the revive door that now sits at the top of the same page, and says so — dropping the clause where `canRevive` renders no button. The create flow's done panel named the list five times for controls that now live on the project's page — three "attach an address", one "retry it", one "bring it back" — and all five go through `projectPageLink`, which names the project by id whenever the flow has one. Its two remaining pointers at the list ("watch it there", "follow it there") stay: the list does still show the project.
+
+**Carried, not lost.** `teardownFailure` gives the ender the refusal vocabulary the row's sender held (`intent_conflict`, `not_teardownable` — the tasks 1002691/1002692 rule), which the truthful-refusal pin in `tests/<redacted>.mjs` caught the moment the row's copy went. `canTeardown` did not survive: `renderDelete` already carried each of its three exclusions as its own honest state, so with the row's button gone it mirrored nothing — the gate pin moved onto `renderDelete` itself.
+
+**The kit.** One new state, `in-manage-address`; `in-manage` now expects the section, `in-manage-snag` and `in-manage-gone` expect it hidden; `in-mine` counts the doors (seven anchors over five rows, zero buttons). Six row probes became five page ones: attach, restart, revive and retry drive the stub from `?view=manage&id=N`, the two row-teardown presses fold into the ender probe that already drove the same flow there, and a new probe holds the row itself to its two doors. `render.js --page /projects` ALL CLEAN (68 states), the empty and floor siblings ALL CLEAN, probes 43/43.
+
+**Retargeted.** `tests/projects_hub.mjs` (`renderManage` reads `addressRow(inst, true)`; the delete gate reads off `renderDelete`) and `tests/projects_hub_pre_uat.mjs` (the restart door's one home, the restart sender, the one remaining confirm, the field's move and its section, the F19 and correction doors, the minute tick, the manifest snag's link, the announcements, the no-address door). The copy registry regenerated.
+
+**Flagged to the copy desk, not changed here.** The manage page's own site door still reads "Open site →" while the row now reads "View" — each reads naturally in place (the row pairs two doors, the page sits among verbs), so neither was churned. `stripMarkup`'s queued-flow notes still say "this card updates when it starts" on a page that is not a card. And a prose pointer inside a row's address line inherits the mono face meant for the address itself — true before this build too, and left alone rather than churned.

package/docs/module-api-changelog.md

@@ -1313,5 +1313,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.436 with no explicit bump. run 33289560561. (task 1002620)
   1.19.438 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.437 with no explicit bump. run 33290212472. (task 1002620)
+  1.19.439 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.438 with no explicit bump. run 33290633434. (task 1002620)
+  1.19.440 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.439 with no explicit bump. run 33321131006. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/ship-assurance.js

@@ -67,13 +67,22 @@ function normalizeShipAssurance(a) {
 //
 // `deps` is injected so this is unit-testable with no network and no DB.
 async function deriveShipAssurance({ taskId, body = {}, db, githubPush, onProbeError }) {
+  const report = (e) => { if (onProbeError) onProbeError(e); };
+  // The tip is the durable proof (task 1547); the branch/PR status is only a
+  // WITNESS for the out-of-band fallback (task 1002615). A claim with no branch
+  // makes getPublishStatus throw BAD_BRANCH — that used to abort the whole probe
+  // before landProvenForTask ever saw a recorded tip, so a commit provably on main
+  // was refused as "not proven" (strands 1003285/1003286, task 1003434). Each step
+  // now fails on its own: a status miss degrades to status=null, never to no-proof.
+  let publishedSha = null;
+  try { publishedSha = await db.getClaimPublishedSha(taskId); } catch (e) { report(e); }
+  let status = null;
+  try { status = await githubPush.getPublishStatus({ taskId, publishedSha }); } catch (e) { report(e); }
   try {
-    const publishedSha = await db.getClaimPublishedSha(taskId);
-    const status = await githubPush.getPublishStatus({ taskId, publishedSha });
     const proof = await githubPush.landProvenForTask({ taskId, publishedSha, status });
     if (proof && proof.proven) return { assurance: { kind: 'proof', reason: proof.reason } };
   } catch (e) {
-    if (onProbeError) onProbeError(e);
+    report(e);
   }
 
   if (body.no_artifact === true) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.438",
+  "version": "1.19.440",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.438",
+      "version": "1.19.440",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.438",
+  "version": "1.19.440",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -407,12 +407,9 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .attach input[type=text]{flex:1;min-width:220px;font-family:var(--font-body);font-size:15px;font-weight:600;color:var(--ink);background:var(--bg-card);border:2px solid var(--ctl-line);border-radius:12px;padding:9px 14px;outline:none;transition:border-color .15s ease, box-shadow .15s ease;}
 .attach input[type=text]::placeholder{color:var(--ink-faint);font-weight:500;}
 .attach input[type=text]:focus{border-color:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 13%,transparent);}
-/* the bring-your-own-domain fold (owner decision 2, 2026-08-24): the wizard's
-   address-step disclosure, closed by default and after the card's doors — a
-   domain the founder can't buy here must not be the card's loudest control */
-.attachFold{margin-top:12px;}
-.attachFold summary{cursor:pointer;width:fit-content;font-size:13px;font-weight:700;color:var(--ink-faint);}
-.attachFold summary:hover,.attachFold[open] summary{color:var(--ink-soft);}
+/* the bring-your-own-domain field. It sat behind a fold on the list card until
+   task 1003355 moved it to the project's own page, where the section's heading
+   is the disclosure and the row it left carries only its two doors. */
 .attachNote{margin:8px 0 0;font-size:13px;line-height:1.45;color:var(--ink-faint);}
 .attachNote code{font-family:var(--font-mono);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
@@ -1222,14 +1219,12 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-mine .addr{grid-area:addr;align-self:start;}
 #view-mine .strip{grid-area:rail;}
 #view-mine .actions{grid-area:doors;}
-/* everything else on a card (a snag, a status line, the torn-down note, the
-   address fold) is a full row under the ledger line */
-#view-mine .projBody>.projMsg,#view-mine .projBody>.attachFold{grid-column:1/-1;}
+/* everything else on a row (a snag, a status line, the torn-down note) is a
+   full row under the ledger line */
+#view-mine .projBody>.projMsg{grid-column:1/-1;}
 #view-mine .projMsg{min-height:0;margin:0;font-weight:400;}
 #view-mine .projMsg:not(:empty){margin-top:10px;}
 #view-mine .projMsg.err{margin-top:12px;}
-#view-mine .attachFold{margin-top:10px;}
-#view-mine .actions:has(.confirmRow){grid-area:auto;grid-column:1/-1;justify-content:flex-start;margin-top:12px;}
 /* the name in the body face; the chip beneath it, allowed to wrap */
 #view-mine .projName{font-family:var(--font-body);font-weight:500;font-size:17px;letter-spacing:-.015em;color:var(--ink);}
 #view-mine .proj.gone .projName{color:var(--ink-soft);}
@@ -1245,14 +1240,12 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    box; the address clause's mono link may run long and must wrap inside the
    prose, so it stays inline and takes the floor as vertical padding (an inline's
    rect is its content box plus padding, never the line box) */
-#view-mine .projMsg a,#view-mine .attachNote a,#view-manage .ledger a,#view-manage .backRow a,#view-manage .mSec a{display:inline-block;padding:3px 0;min-height:24px;line-height:18px;font-weight:400;text-decoration:none;}
+#view-mine .projMsg a,#view-manage .ledger a,#view-manage .backRow a,#view-manage .mSec a{display:inline-block;padding:3px 0;min-height:24px;line-height:18px;font-weight:400;text-decoration:none;}
 #view-mine .addr{line-height:1.6;}
 #view-mine .addr a{display:inline;padding:4px 0;font-weight:400;text-decoration:none;}
 #view-mine .addr a,#view-manage .ledger a{font-family:var(--font-mono);font-size:12.5px;color:var(--ink-soft);}
 #view-mine .addr a:hover,#view-manage .ledger a:hover{color:var(--ink);text-decoration:underline;}
 #view-mine .projMsg a,#view-manage .mSec a{color:var(--ink);text-decoration:underline;}
-#view-mine .attachFold summary{display:inline-flex;align-items:center;min-height:24px;font-weight:400;font-size:13.5px;color:var(--ink-soft);}
-#view-mine .attachFold summary:hover,#view-mine .attachFold[open] summary{color:var(--ink);}
 
 /* ── the lifecycle rail (DESIGN.md): stripMarkup's markup, drawn as three
    hairlines with a 7px dot and one lit step — no plate, no connector, no
@@ -1294,13 +1287,15 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-mine .btn.small.danger,#view-manage .btn.small.danger{border-color:color-mix(in srgb,var(--err) 45%,transparent);color:var(--err);}
 #view-mine .btn.small.danger:hover,#view-manage .btn.small.danger:hover{background:none;border-color:var(--err);color:var(--err);}
 #view-mine .btn.small:disabled,#view-manage .btn.small:disabled{background:none;border-color:var(--rule-soft);color:var(--ink-faint);}
-/* the fold's field and the ender's typed-back name: a hairline field */
-#view-mine .attach,#view-manage .attach{gap:10px 14px;margin-top:12px;align-items:center;}
-#view-mine .attach input[type=text],#view-manage .attach input[type=text]{min-width:220px;min-height:40px;font-family:var(--font-body);font-size:15.5px;font-weight:400;color:var(--ink);background:none;border:0;border-bottom:1px solid var(--rule);border-radius:0;padding:8px 0;}
-#view-mine .attach input[type=text]::placeholder,#view-manage .attach input[type=text]::placeholder{font-weight:400;}
-#view-mine .attach input[type=text]:focus,#view-manage .attach input[type=text]:focus{border-bottom-color:var(--ink);box-shadow:none;}
-#view-mine .confirmRow,#view-manage .confirmRow{font-weight:400;}
-#view-mine .confirmRow .plain,#view-manage .confirmRow .plain{font-weight:400;font-size:14.5px;line-height:1.5;}
+/* the address field and the ender's typed-back name: a hairline field. Both
+   live on the project's own page now (task 1003355), so the scope is one. */
+#view-manage .attach{gap:10px 14px;margin-top:12px;align-items:center;}
+#view-manage .attach input[type=text]{min-width:220px;min-height:40px;font-family:var(--font-body);font-size:15.5px;font-weight:400;color:var(--ink);background:none;border:0;border-bottom:1px solid var(--rule);border-radius:0;padding:8px 0;}
+#view-manage .attach input[type=text]::placeholder{font-weight:400;}
+#view-manage .attach input[type=text]:focus{border-bottom-color:var(--ink);box-shadow:none;}
+#view-manage .attachNote{margin:0;font-size:13.5px;line-height:1.5;}
+#view-manage .confirmRow{font-weight:400;}
+#view-manage .confirmRow .plain{font-weight:400;font-size:14.5px;line-height:1.5;}
 
 /* ── the empty state: a band of the Projects band's grammar, one door ── */
 #view-mine .empty{display:grid;gap:14px;justify-items:start;text-align:left;background:var(--bg-card);border:0;border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);border-radius:0;padding:58px var(--gutter) 62px;}
@@ -1392,7 +1387,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   #view-mine .proj .worldOrb{--orb-scale:.875;grid-column:1;grid-row:1;}
   #view-mine .projBody{display:contents;}
   #view-mine .projHead{grid-area:auto;grid-column:2;grid-row:1;}
-  #view-mine .projMeta,#view-mine .addr,#view-mine .strip,#view-mine .actions,#view-mine .projBody>.projMsg,#view-mine .projBody>.attachFold{grid-area:auto;grid-column:1/-1;}
+  #view-mine .projMeta,#view-mine .addr,#view-mine .strip,#view-mine .actions,#view-mine .projBody>.projMsg{grid-area:auto;grid-column:1/-1;}
   #view-mine .projMeta{margin-top:14px;}
   #view-mine .strip{margin-top:16px;}
   #view-mine .actions{margin-top:16px;justify-content:flex-start;flex-direction:row;align-items:center;}