@bongos/core 1.19.438 → 1.19.440

package/public-landing/projects.probes.json

@@ -1,5 +1,5 @@
 {
-  "_": "The hub's interaction contract for modules/ui-design/kit/probe.js (task 1003320): the disclosure bands, the views, the card, the fold under 480, signed out. A probe with `continue` keeps the previous page — the contract is a sequence. The manage flows (task 1003345): attach, restart, teardown (the row and the ender), revive, retry and join drive the stub's receipts end to end, so the makeover cannot silently break a door. The catalog is featured-hub.json (stub.fixtures): the signed-in stub owns Demo, and an owned orb's plain click opens its manage view, never its card — the card probes open the landing's other rows and Tidewater, the un-owned floor row.",
+  "_": "The hub's interaction contract for modules/ui-design/kit/probe.js (task 1003320): the disclosure bands, the views, the card, the fold under 480, signed out. A probe with `continue` keeps the previous page — the contract is a sequence. The manage flows: since task 1003355 a row carries only its two doors, so attach, restart, revive, retry, teardown (the ender), join and the planet all drive the stub's receipts from the project's OWN page — and one probe holds the row itself to two doors and nothing that acts. The catalog is featured-hub.json (stub.fixtures): the signed-in stub owns Demo, and an owned orb's plain click opens its manage view, never its card — the card probes open the landing's other rows and Tidewater, the un-owned floor row.",
   "page": "/projects",
   "surface": "public-landing",
   "stub": { "fixtures": { "featured": "featured-hub" } },
@@ -108,24 +108,21 @@
     { "name": "390: a solo Shift tap opens the fold and focuses the field, without overflow", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100], ["press", "Shift"], ["wait", 150]],
       "expect": { "hasClass": [["#qWrap", "is-open", true]], "activeId": "mapQ", "noOverflow": true } },
-    { "name": "manage flows (task 1003345): the address fold on a live row records a domain", "auth": true, "width": 1440, "url": "/projects?view=mine",
-      "steps": [["wait",600],["click","li[data-inst=\"101\"] details.attachFold summary"],["fill","#dom-101","demo.example.com"],["click","[data-attach=\"101\"]"],["wait",600]],
-      "expect": {"text":[["#msg-101","Address recorded."]],"hasClass":[["#msg-101","ok",true]]} },
-    { "name": "manage flows: restart on an unreachable row asks; the row re-reads the project and shows the queued rail, the door leaves while the intent is open", "auth": true, "width": 1440, "url": "/projects?view=mine",
-      "steps": [["wait",600],["click","[data-restart=\"105\"]"],["wait",900]],
-      "expect": {"text":[["li[data-inst=\"105\"] .strip .pnote","A restart is queued — this card updates when it starts."],["li[data-inst=\"105\"] .strip .stages li.now .slbl","Restart queued"]],"visible":["li[data-inst=\"105\"] .strip","li[data-inst=\"105\"] .worldOrb.ashen"],"hidden":["[data-restart=\"105\"]"]} },
-    { "name": "manage flows: tear it down asks twice on a row — the truth first, then the door", "auth": true, "width": 1440, "url": "/projects?view=mine",
-      "steps": [["wait",600],["click","[data-teardown=\"101\"]"],["wait",200]],
-      "expect": {"visible":["li[data-inst=\"101\"] .confirmRow","[data-teardown-yes=\"101\"]","[data-teardown-no=\"101\"]"],"hidden":["[data-teardown=\"101\"]"]} },
-    { "name": "manage flows: the second press queues the teardown; the row re-reads the project and shows the wind-down rail, the door leaves", "continue": true,
-      "steps": [["click","[data-teardown-yes=\"101\"]"],["wait",900]],
-      "expect": {"text":[["li[data-inst=\"101\"] .strip .pnote","A teardown is queued — this card updates when it starts."]],"visible":["li[data-inst=\"101\"] .strip.flowDown"],"hidden":["[data-teardown=\"101\"]","[data-teardown-yes=\"101\"]"]} },
-    { "name": "manage flows: bring it back on a torn-down row re-files the project", "auth": true, "width": 1440, "url": "/projects?view=mine",
-      "steps": [["wait",600],["click","[data-revive=\"104\"]"],["wait",600]],
-      "expect": {"text":[["#msg-104","Queued. The platform picks it up from here."]],"hasClass":[["#msg-104","ok",true]],"visible":["li[data-inst=\"104\"] .worldOrb.ghost"]} },
-    { "name": "manage flows: try again on a snagged row re-files it too", "auth": true, "width": 1440, "url": "/projects?view=mine",
-      "steps": [["wait",600],["click","[data-retry=\"103\"]"],["wait",600]],
-      "expect": {"text":[["#msg-103","Queued. The platform picks it up from here."]],"hasClass":[["#msg-103","ok",true]]} },
+    { "name": "the row is two doors and nothing that acts (task 1003355): view where a project is live and addressed, manage on every row, no button anywhere in the list", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",600]],
+      "expect": {"count":[["#projectsList .proj .actions a",7],["#projectsList .proj .actions a[data-manage]",5],["#projectsList .proj .actions button",0],["li[data-inst=\"104\"] .actions a",1]],"text":[["li[data-inst=\"104\"] .actions","Manage"]]} },
+    { "name": "manage flows (task 1003355): the address control on the project's own page records a domain", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
+      "steps": [["wait",900],["fill","#mDomName","demo.example.com"],["click","[data-m-attach]"],["wait",900]],
+      "expect": {"text":[["#mDomMsg","Address recorded."],["#mName","demo"]],"hasClass":[["#mDomMsg","ok",true]],"visible":["#mAddress","#mDomWhat summary"]} },
+    { "name": "manage flows: restart from the unreachable project's own page; the page re-reads it, the rail says queued and the door leaves while the intent is open", "auth": true, "width": 1440, "url": "/projects?view=manage&id=105",
+      "steps": [["wait",900],["click","[data-m-restart]"],["wait",900]],
+      "expect": {"text":[["#mMsg","Restart queued."],["#mStrip .strip .stages li.now .slbl","Restart queued"]],"hasClass":[["#mMsg","ok",true]],"visible":["#mStrip .strip","#mOrb .worldOrb.ashen"],"hidden":["[data-m-restart]"]} },
+    { "name": "manage flows: bring it back from the torn-down project's own page re-files it", "auth": true, "width": 1440, "url": "/projects?view=manage&id=104",
+      "steps": [["wait",900],["click","[data-m-revive]"],["wait",900]],
+      "expect": {"text":[["#mMsg","Queued. The platform picks it up from here."]],"hasClass":[["#mMsg","ok",true]],"visible":["#mOrb .worldOrb.ghost"],"hidden":["#mAddress"]} },
+    { "name": "manage flows: try again from the snagged project's own page re-files it too", "auth": true, "width": 1440, "url": "/projects?view=manage&id=103",
+      "steps": [["wait",900],["click","[data-m-retry]"],["wait",900]],
+      "expect": {"text":[["#mMsg","Queued. The platform picks it up from here."]],"hasClass":[["#mMsg","ok",true]],"hidden":["#mAddress"]} },
     { "name": "manage flows: how people join — pick a cell, save, the receipt lands under the choice", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
       "steps": [["wait",900],["check","input[name=\"mJoinPick\"][value=\"apply\"]"],["click","[data-join-save]"],["wait",600]],
       "expect": {"text":[["#mJoinMsg","Saved. The project restarts to apply it."],["#mName","demo"]],"checked":"input[name=\"mJoinPick\"][value=\"apply\"]","visible":["#mOrb .worldOrb","#mFacts .ledger .k"]} },

package/public-landing/projects.states.json

@@ -16,11 +16,12 @@
     "in-map-search": { "auth": true, "actions": [["clickIfVisible", "#qToggle"], ["wait", 200], ["fill", "#mapQ", "emer"], ["wait", 300]], "expect": { "value": [["#mapQ", "emer"]] } },
     "in-map-mine-on": { "auth": true, "actions": [["check", "#onlyMine"], ["wait", 300]], "expect": { "checked": "#onlyMine" } },
     "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body", ".tblMast", ".mastObj", "#selfHall"], "closed": "#menuProjects", "count": [["#mapRows tr[data-generated] .rowHall", 1]] } },
-    "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap", "#empty"], "visible": ["#mineBar", "#projectsList", "#projectsList .proj .worldOrb .disc"], "count": [["#projectsList .proj", 5], ["#projectsList .proj.gone", 1], ["#projectsList .proj .worldOrb[data-shape][data-material][data-style]", 5], ["#projectsList .proj .worldOrb[data-template=\"blob-frost-tint\"]", 1], ["#projectsList .proj .strip", 1], ["#projectsList .proj .worldOrb.ashen", 2], ["#projectsList [data-restart]", 1]] } },
-    "in-manage": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mMain", "#mChip .chip", "#mOrb .worldOrb", "#mFacts .ledger .k", "#mActs"], "hidden": ["#qWrap", "#mGate", "#mMissing", "#mErr"], "text": [["#mName", "demo"], ["#mTitle", "demo"]] } },
+    "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap", "#empty"], "visible": ["#mineBar", "#projectsList", "#projectsList .proj .worldOrb .disc"], "count": [["#projectsList .proj", 5], ["#projectsList .proj.gone", 1], ["#projectsList .proj .worldOrb[data-shape][data-material][data-style]", 5], ["#projectsList .proj .worldOrb[data-template=\"blob-frost-tint\"]", 1], ["#projectsList .proj .strip", 1], ["#projectsList .proj .worldOrb.ashen", 2], ["#projectsList .proj .actions a", 7], ["#projectsList .proj .actions button", 0]] } },
+    "in-manage": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mMain", "#mChip .chip", "#mOrb .worldOrb", "#mFacts .ledger .k", "#mActs", "#mAddress"], "hidden": ["#qWrap", "#mGate", "#mMissing", "#mErr"], "text": [["#mName", "demo"], ["#mTitle", "demo"]] } },
+    "in-manage-address": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mAddress", "#mAddress h2", "#mDom .plain", "#mDomName", "#mDom [data-m-attach]", "#mDomWhat summary"], "count": [["#mDom .attach input[type=text]", 1], ["#mDom .attach button", 1]] } },
     "in-manage-planet": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mPlanetPick", "#mPick .pick .pickPreview .worldOrb .disc", "#mPick [data-pick-save]", "#mPick [data-pick-reset]", "#mPickWhat summary"], "count": [["#mPick .pickCells[role=\"radiogroup\"]", 3], ["#mPick .pickCell", 10], ["#mPick .pickCell.on", 3], ["#mPick .pickSw", 5], ["#mPick .pickSw.on", 1]], "attr": [["#mPick .pickPreview .worldOrb", "data-template", "pair-obsidian-tint"], ["#mOrb .worldOrb", "data-template", "pair-obsidian-tint"]], "checked": "#mPick input[name=\"mPickAccent\"][value=\"sea\"]", "text": [["#mPlanet .v small", "your choice."]] } },
-    "in-manage-snag": { "auth": true, "url": "/projects?view=manage&id=103", "expect": { "visible": ["#mMain", "#mErr", "#mActs"], "text": [["#mName", "tidepool"]] } },
-    "in-manage-gone": { "auth": true, "url": "/projects?view=manage&id=104", "expect": { "visible": ["#mMain", "#mActs"], "hidden": ["#mErr"], "text": [["#mName", "old-lantern"]] } },
+    "in-manage-snag": { "auth": true, "url": "/projects?view=manage&id=103", "expect": { "visible": ["#mMain", "#mErr", "#mActs"], "hidden": ["#mAddress"], "text": [["#mName", "tidepool"]] } },
+    "in-manage-gone": { "auth": true, "url": "/projects?view=manage&id=104", "expect": { "visible": ["#mMain", "#mActs"], "hidden": ["#mErr", "#mAddress"], "text": [["#mName", "old-lantern"]] } },
     "in-manage-missing": { "auth": true, "url": "/projects?view=manage&id=999", "expect": { "visible": ["#mMissing"], "hidden": ["#mMain", "#mGate"] } },
     "out-manage": { "auth": false, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mGate"], "hidden": ["#mMain", "#mMissing"] } },
     "in-new": { "auth": true, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.438'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.440'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -1161,7 +1161,8 @@ test('the manage chip defers to chipFor — one site, no second story (C6)', ()
   assert.ok(fn, 'renderManage() must be extractable');
   assert.equal((fn.match(/chipFor\(inst\)/g) || []).length, 1,
     'renderManage must have exactly one chip call site');
-  assert.match(fn, /addressRow\(inst\)/, 'the address sentence is the shared, verified one');
+  assert.match(fn, /addressRow\(inst, true\)/,
+    'the address sentence is the shared, verified one — read on THIS surface, so its pointers name the controls this page has (task 1003355)');
   assert.match(fn, /SHAPE_LABEL/, 'the hosting shape speaks the card\'s vocabulary');
 });
 
@@ -1304,12 +1305,11 @@ test('tearing a project down asks for its NAME — the page\'s heaviest control'
 });
 
 test('the delete section mirrors the server gate — every state but torn_down', () => {
-  const fn = (SCRIPT.match(/function canTeardown\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
-  assert.ok(fn, 'canTeardown() must be extractable');
-  // the old whitelist is what made a snagged project a dead end (N5)
-  assert.doesNotMatch(fn, /inst\.status === 'provisioning' \|\| inst\.status === 'active'/,
-    'the two-state whitelist is gone');
-  assert.match(fn, /torn_down/, 'torn_down is the only lifecycle exclusion');
+  // the ender is the ONLY teardown door since task 1003355 took the row's away,
+  // so renderDelete IS the gate: it carries each exclusion as its own honest
+  // state rather than deferring to a predicate nothing else reads
+  assert.doesNotMatch(SCRIPT, /function canTeardown\(/,
+    'the client mirror went with the row button that was its only caller');
   const render = (SCRIPT.match(/function renderDelete\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.ok(render, 'renderDelete() must be extractable');
   // keyed by PROJECT, not a bare flag: a boolean would also suppress the repaint
@@ -1320,6 +1320,16 @@ test('the delete section mirrors the server gate — every state but torn_down',
   for (const s of ['torn_down', 'tearing_down']) {
     assert.match(render, new RegExp(s), `${s} gets its own honest state, not the action`);
   }
+  assert.match(render, /open_intent\.action === 'teardown'/, 'and a queued teardown is the third');
+  // the old whitelist is what made a snagged project a dead end (N5): every
+  // other state — 'requested' and 'error' included — still reaches the ask
+  assert.match(render, /teardownTruth\(inst\)[\s\S]*?data-del-ask/,
+    'a project that never finished standing up still reaches the ask');
+  // the pointer out of a torn-down project must name a door THIS page has
+  assert.doesNotMatch(render, /view=mine/,
+    'the revive door moved here in task 1003355 — a pointer at the list would be a dead end');
+  assert.match(render, /canRevive\(inst\) \? ' Bring it back with the button at the top of this page\.' : ''/,
+    'and the sentence is dropped where no such button rendered');
 });
 
 test('a teardown does not silence the address — the copy says what the runner does', () => {

package/tests/projects_hub_pre_uat.mjs

@@ -79,16 +79,17 @@ test('the restart door appears ONLY where it has a reason to exist, and mirrors
   assert.match(body, /!inst\.open_intent/, 'the strip tells the story while work is in flight');
 });
 
-test('the restart door is offered on BOTH surfaces, and the address row points at it', () => {
-  assert.match(fn('renderCard'), /canRestart\(inst\)[\s\S]*?data-restart=/, 'the list card');
-  assert.match(fn('renderManage'), /canRestart\(inst\)[\s\S]*?data-m-restart/, 'the project’s own page — the two never disagree');
+test('the restart door lives on the project’s own page, and the address row points at it from wherever it is read', () => {
+  // task 1003355: a list row carries only view and manage, so the door has ONE
+  // home — a second copy on the row would be the thing the owner asked to remove
+  assert.doesNotMatch(fn('renderCard'), /data-restart/, 'the row acts on nothing');
+  assert.match(fn('renderManage'), /canRestart\(inst\)[\s\S]*?data-m-restart/, 'the project’s own page');
   // the door and the sentence that sends the owner to it must ship together —
   // and the sentence must be gated by the SAME predicate, or a project with no
-  // button (dedicated shape, or work already queued) is told to scroll to one
+  // button (dedicated shape, or work already queued) is told to go looking for one
   const addr = fn('addressRow');
-  assert.match(addr, /or restart it yourself below/, 'the unreachable line names the action now that one exists');
-  assert.match(addr, /canRestart\(inst\) \? ' — or restart it yourself below\.' : '\.'/,
-    'the pointer is conditioned on canRestart(), not on last_verified_up alone (ADR 0199 §8)');
+  assert.match(addr, /canRestart\(inst\) \? \(onManage \? ' — or restart it yourself below\.' : ' — or restart it from its own page\.'\) : '\.'/,
+    'the pointer is conditioned on canRestart() and names a door the READING surface has (ADR 0199 §8)');
 });
 
 test('a queued restart has its own strip — never the generic "a <action> run is queued" fallthrough', () => {
@@ -102,11 +103,12 @@ test('a queued restart has its own strip — never the generic "a <action> run i
 });
 
 test('the restart sender posts to the restart ROUTE — re-POSTing the slug would be refused on every press', () => {
-  const body = fn('doRestart');
+  const body = fn('mRestart');
   assert.match(body, /\/restart'/, 'its own endpoint');
   assert.doesNotMatch(body, /provisioning\/instances',/, 'NOT the create/re-provision POST — PROVISION_ENQUEUE_FROM excludes active');
-  assert.match(body, /quietActions\(id\)/, 'the row goes quiet while it is in flight');
-  assert.match(fn('mRestart'), /\/restart'/, 'and the manage page sends the same request');
+  assert.match(body, /\$\('mActs'\)\.querySelectorAll\('button'\)\.forEach\(function \(b\) \{ b\.disabled = true; \}\);/,
+    'the doors go quiet while it is in flight');
+  assert.doesNotMatch(SCRIPT, /function doRestart\(/, 'and there is no second sender since the row lost its door (task 1003355)');
 });
 /* ── the moment a standup lands (task 1003243) ── */
 test('the landed moment is earned by a VERIFIED probe inside a window, not invented state', () => {
@@ -319,11 +321,14 @@ test('card metadata is span-wrapped so a separator can never strand; the manage
   assert.match(fn('repaintPlanets'), /if \(manageInst\) paintManagePlanet\(manageInst\);/, 'a catalog that lands after the manage page rendered repaints its head too');
 });
 
-test('an open teardown confirm survives the minute re-render', () => {
-  assert.match(SCRIPT, /var cardAsking = null;/);
-  assert.match(fn('renderCard'), /if \(cardAsking !== null && cardAsking === String\(inst\.id\)\) return;/);
-  assert.match(fn('askTeardown'), /cardAsking = String\(id\);/);
-  assert.match(SCRIPT, /function unAskTeardown\(id\) \{ cardAsking = null;/);
+test('the one open teardown confirm — the ender’s — survives the minute re-render', () => {
+  // task 1003355: the row's two-press confirm is gone with the row's door, so
+  // there is exactly one confirmation on the hub and it is the typed-back name
+  assert.doesNotMatch(SCRIPT, /cardAsking/, 'the row holds no confirmation to protect');
+  assert.match(SCRIPT, /var mDelAsking = null;/);
+  assert.match(fn('renderDelete'), /if \(mDelAsking && mDelAsking === inst\.slug\) return;/,
+    'and it is keyed by PROJECT, so a different project always repaints');
+  assert.match(fn('askDelete'), /mDelAsking = inst\.slug;/);
 });
 
 test('the inputs a stranger types into are labelled', () => {
@@ -332,48 +337,54 @@ test('the inputs a stranger types into are labelled', () => {
   assert.match(SCRIPT, /aria-label="A domain you own, for ' \+ esc\(inst\.slug\) \+ '"/);
 });
 
-/* ── the custom-domain field sits behind a fold (owner decision 2, 2026-08-24) ── */
-test('the domain field is a closed disclosure after the card’s doors — never the card’s loudest control', () => {
-  const fold = fn('attachFold');
-  assert.match(fold, /<details class="attachFold"/, 'the wizard’s address-step disclosure shape');
-  assert.match(fold, /Use a domain I own/, 'labelled the way the wizard labels it');
-  assert.match(fold, /inst\.status !== 'active' && inst\.status !== 'requested'\) return ''/, 'live + queued only — snagged and torn-down cards carry no fold');
-  assert.match(fold, /if \(!canAttachDomain\(inst\)\) return ''/, 'the server-mirror gate still comes first');
-  assert.match(fold, /inst\.open_intent\.action === 'domain-attach'\) return ''/, 'no second attach control while one is wiring');
-  assert.doesNotMatch(fold, /Use your own domain/, 'the old filled-button label is gone');
+/* ── the custom-domain field is a section of the project's own page (owner,
+   2026-08-29 — task 1003355; it sat behind a fold on the list card until then) ── */
+test('the row carries two doors and nothing that acts; the address field is a section of the project’s own page', () => {
   const card = fn('renderCard');
-  assert.doesNotMatch(card, /<div class="attach">/, 'renderCard no longer inlines the bare field');
-  const actions = card.indexOf('<div class="actions" id="act-');
-  const foldCall = card.indexOf('body += attachFold(inst, iid);');
-  assert.ok(actions >= 0 && foldCall > actions, 'Open site → Manage → (fold): the fold renders after the actions row');
-  assert.match(COSMOS, /\.attachFold summary\{cursor:pointer;/, 'the summary reads as a control');
-  // the 390px capture: the fold stacks field over button because the row wraps
-  // and the field's minimum (220px) is narrower than a phone card's body; the
-  // fold itself sets no width, so it can never be the thing that overflows
+  assert.doesNotMatch(card, /<button/, 'no sender survives on a row');
+  assert.doesNotMatch(card, /attachFold|<div class="attach">/, 'and no field either');
+  assert.match(card, /'<div class="actions">' \+ acts\.join\(''\)/, 'one doors strip, always rendered');
+  assert.match(card, /inst\.status === 'active' && inst\.domain\) acts\.push\([\s\S]{0,180}>View<\/a>'\)/,
+    'View only where the project is live and has an address to open');
+  assert.match(card, /acts\.push\('<a class="btn small ghost" data-manage="' \+ iid \+ '" href="\?view=manage&id=' \+ iid \+ '">Manage<\/a>'\);/,
+    'Manage on every row, as a real link');
+  // the section on the manage page: the heading is the disclosure, so the field
+  // needs no fold of its own, and the ender's hairline shapes are reused
+  assert.match(HUB, /<div class="card mSec" id="mAddress" hidden>/, 'a settings section like the three above it');
+  assert.match(HUB, /<h2>Its address<\/h2>/);
+  for (const id of ['mDom', 'mDomWhat']) assert.match(HUB, new RegExp('id="' + id + '"'), '#' + id + ' is real markup');
+  const sec = fn('renderAddress');
+  assert.match(sec, /canAttachDomain\(inst\) && \(inst\.status === 'active' \|\| inst\.status === 'requested'\)/,
+    'the server-mirror gate first, then live + queued only — a snagged or torn-down project has nothing to point an address at');
+  assert.match(sec, /\$\('mAddress'\)\.hidden = !offer;/, 'and the whole section goes, not just the button');
+  assert.match(sec, /inst\.open_intent\.action === 'domain-attach'/, 'no second attach control while one is wiring');
+  assert.match(sec, /<div class="attach">/, 'the ender’s hairline field');
+  assert.match(sec, /data-m-attach/, 'and the manage page’s own marker');
+  assert.doesNotMatch(SCRIPT, /function doAttach\(/, 'the row’s sender is gone with the row’s field');
+  // the 390px capture: the row wraps and the field's minimum (220px) is
+  // narrower than a phone's body, so it can never be the thing that overflows
   assert.match(COSMOS, /\.attach\{display:flex;gap:10px;margin-top:10px;flex-wrap:wrap;\}/, 'the row wraps at phone width');
-  assert.match(COSMOS, /\.attach input\[type=text\]\{flex:1;min-width:220px;/, 'the field fits a 390px card and grows on a laptop');
-  assert.doesNotMatch(COSMOS, /\.attachFold[^{]*\{[^}]*(width|min-width):(?!fit-content)/, 'the fold sets no width of its own');
-  // and in both themes: the summary reads from tokens, never a literal colour
-  assert.doesNotMatch((COSMOS.match(/\.attachFold[^\n]*/g) || []).join('\n'), /#[0-9a-f]{3,8}\b/i, 'the fold paints from --ink-faint / --ink-soft, so dark mode needs no twin');
-});
-
-test('the F19 re-kick door survives the fold: open, pre-filled, one button', () => {
-  const fold = fn('attachFold');
-  assert.match(fold, /var rekick = inst\.status === 'active' && inst\.domain && inst\.error_note;/);
-  assert.match(fold, /\(rekick \? ' open' : ''\)/, 'the fold opens on its own for a stalled address');
-  assert.match(fold, /\(prefill \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address in play');
-  assert.match(fold, /var prefill = rekick \|\| repoint;/, 'a stalled address and a correctable one both arrive in the field');
-  assert.match(fold, /rekick \? 'Try the address again' : repoint \? 'Change the address' : 'Use this domain'/, 'and the button says what it does');
+  assert.match(COSMOS, /\.attach input\[type=text\]\{flex:1;min-width:220px;/, 'the field fits a 390px page and grows on a laptop');
+  assert.doesNotMatch(COSMOS, /attachFold/, 'the fold’s rules went with the fold');
+});
+
+test('the F19 re-kick door survives the move: pre-filled, one button, its own sentence', () => {
+  const sec = fn('renderAddress');
+  assert.match(sec, /var rekick = inst\.status === 'active' && inst\.domain && inst\.error_note;/);
+  assert.match(sec, /\(prefill \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address in play');
+  assert.match(sec, /var prefill = rekick \|\| repoint;/, 'a stalled address and a correctable one both arrive in the field');
+  assert.match(sec, /rekick \? 'Try the address again' : repoint \? 'Change the address' : 'Use this domain'/, 'and the button says what it does');
+  assert.match(sec, /rekick \? 'The wiring for this address stopped\./, 'the section says WHY the field is pre-filled — the fold said it by opening itself');
   assert.match(fn('canAttachDomain'), /inst\.status === 'active' && inst\.domain && inst\.error_note && !inst\.open_intent\) return true;/, 'the route-side re-kick gate is untouched');
 });
 
-test('the correction door: a bring-your-own address can be changed, and the fold says what that costs (task 1003237)', () => {
-  const fold = fn('attachFold');
+test('the correction door: a bring-your-own address can be changed, and the section says what that costs (task 1003237)', () => {
+  const fold = fn('renderAddress');
   // the three doors are told apart by what the project is actually addressed as
   assert.match(fold, /var byo = inst\.domain && inst\.domain !== assignedDefaultFor\(inst\);/,
-    'the platform-assigned <slug>.<apex> is NOT a correction — moving off it is the upgrade the fold already offered');
+    'the platform-assigned <slug>.<apex> is NOT a correction — moving off it is the upgrade this control already offered');
   assert.match(fold, /var repoint = !rekick && byo;/, 'a stalled address keeps the F19 door, which is louder');
-  assert.match(fold, /'Use a different domain'/, 'the summary names the correction');
+  assert.match(fold, /repoint \? 'It answers on an address you brought\./, 'the lead names the correction');
   assert.match(fold, /attachNote/, 'and the consequence is stated where the button is');
   assert.match(fold, /won’t use that address any more/, 'letting the old address go is SAID, not discovered');
   // the door itself: an addressed, live project is no longer excluded
@@ -392,13 +403,23 @@ test('the retired refusal is gone from the card: domain_already_set can no longe
     'the server stopped sending it (task 1003237) — a branch for it would be unreachable copy');
 });
 
-test('a heartbeat re-render keeps an open fold open and a half-typed domain typed', () => {
+test('the minute tick keeps a half-typed domain typed, and its receipt on the page', () => {
+  // the rule moved with the field (task 1003355): renderManage repaints every
+  // section once a minute, so the address section must survive its own repaint
+  const sec = fn('renderAddress');
+  assert.match(sec, /old\.value !== old\.defaultValue \? old\.value : ''/, 'typing is told apart from the pre-fill');
+  assert.match(sec, /document\.activeElement === old/, 'the caret comes back too');
+  // lastIndexOf: the in-flight branch above writes the same slot, and returns
+  const set = sec.lastIndexOf("$('mDom').innerHTML =");
+  assert.ok(sec.indexOf('var typed =') < set && sec.indexOf('if (field && typed) field.value = typed;') > set,
+    'read before the swap, restore after it');
+  assert.match(sec, /if \(mDomFor !== inst\.id\) \{ mDomFor = inst\.id; mDomNote = null; \}/,
+    'and the receipt is keyed by PROJECT, so a different project never wears the last one’s');
+  assert.match(sec, /\(mDomNote \? mDomNote\.html : ''\)/, 'a repaint re-renders the receipt rather than swallowing it');
+  // the row keeps nothing to restore but the door that had focus
   const card = fn('renderCard');
-  assert.match(card, /var keepOpen = !!\(oldFold && oldFold\.open\);/);
-  assert.match(card, /oldInput\.value !== oldInput\.defaultValue \? oldInput\.value : ''/, 'typing is told apart from the re-kick pre-fill');
-  assert.match(card, /document\.activeElement === oldInput/, 'the caret comes back too');
-  const set = card.indexOf('li.innerHTML = orbFor(inst)');
-  assert.ok(card.indexOf('var keepOpen') < set && card.indexOf('if (fold && keepOpen) fold.open = true;') > set, 'read before the swap, restore after it');
+  assert.doesNotMatch(card, /oldFold|oldInput|keepOpen/, 'the row holds no field or fold to carry across the swap');
+  assert.match(card, /if \(wasInside\) focusCardControl\(inst\.id, prefer\);/);
 });
 
 /* ── the owner's five calls of 2026-08-24 (task 1003250) ── */
@@ -464,7 +485,18 @@ test('an unmapped create failure gets a plain sentence with the raw text folded
 test('a manifest error says a plain sentence, folds the route text, and sends a domainless project to its address', () => {
   const steps = fn('renderStepOauthApp');
   assert.doesNotMatch(steps, /'GitHub setup hit a snag' \+ \(live\.manifestMsg \? ': ' \+ esc\(live\.manifestMsg\)/, 'the raw route text is no longer the headline');
-  assert.match(steps, /else if \(live\.manifestCode === 'domain_required'\) snag = 'This project needs an address first — attach one from <a href="\?view=mine">your projects page<\/a>/);
+  assert.match(steps, /else if \(live\.manifestCode === 'domain_required'\) snag = 'This project needs an address first — attach one from ' \+ projectPageLink\('its own page'\)/,
+    'the address lives on the project’s own page since task 1003355 — the list would be a dead end');
+  assert.match(fn('projectPageLink'), /instanceId \? '\?view=manage&id=' \+ encodeURIComponent\(instanceId\) : '\?view=mine'/,
+    'and it is named by id whenever the flow has one');
+  // every done-panel pointer that names a CONTROL goes the same way; the ones
+  // that only say "watch it there" still name the list, which does show it
+  assert.equal((SCRIPT.match(/projectPageLink\(/g) || []).length, 6,
+    'the helper and its five callers: the locked step, the domain_required snag, the domainless standup, the snagged retry, the torn-down revive');
+  for (const dead of ['Retry it \\(and see the technical details\\) from <a href="\\?view=mine">',
+                      'Bring it back any time from <a href="\\?view=mine">']) {
+    assert.doesNotMatch(SCRIPT, new RegExp(dead), 'a control the list no longer has must not be pointed at there');
+  }
   assert.match(steps, /\(raw \? '<details><summary>Technical details<\/summary><p>' \+ esc\(raw\) \+ '<\/p><\/details>' : ''\)/);
   assert.match(SCRIPT, /e\.code = \(d\.error && d\.error\.code\) \|\| '';/, 'the route code travels with the error');
   assert.match(SCRIPT, /live\.manifestCode = String\(\(err && err\.code\) \|\| ''\);/);
@@ -486,21 +518,24 @@ test('the rail at the done panel keeps its marker on Create until the project an
   assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
 });
 
-test('card action results announce, nothing under the pointer is deleted, and focus stays on the card', () => {
-  assert.match(fn('renderCard'), /id="msg-' \+ iid \+ '" role="status" aria-live="polite">/, 'the card slot is a live region');
+test('every action result announces, nothing under the pointer is deleted, and focus stays where it was', () => {
+  // task 1003355 moved every sender to the project's own page, so the live
+  // regions that matter are that page's; the row keeps its own for the watch's
+  // "can't see this project any more"
+  assert.match(fn('renderCard'), /id="msg-' \+ iid \+ '" role="status" aria-live="polite">/, 'the row slot is a live region');
   assert.match(HUB, /<div class="projMsg" id="mMsg" role="status" aria-live="polite"><\/div>/, 'so is the manage page’s');
-  assert.doesNotMatch(SCRIPT, /act\.innerHTML = '<span class="projMsg">Asking…<\/span>'/, 'no action replaces the row it was pressed in');
-  assert.match(fn('doTeardown'), /quietActions\(id\);\n\s*msg\(id, 'Asking…'\);/);
-  assert.match(fn('reProvision'), /quietActions\(id\);\n\s*msg\(id, 'Asking…'\);/);
-  assert.match(fn('quietActions'), /act\.querySelectorAll\('button'\)\.forEach\(function \(b\) \{ b\.disabled = true; \}\);/);
-  assert.match(fn('quietActions'), /li\.setAttribute\('data-focus-back', ''\)/, 'a disabled button that held focus leaves a note');
-  assert.match(fn('askTeardown'), /<div class="confirmRow" tabindex="-1">/);
-  assert.match(fn('askTeardown'), /if \(row && row\.focus\) row\.focus\(\);/, 'the question takes focus when the button goes');
+  assert.match(fn('renderAddress'), /id="mDomMsg" role="status" aria-live="polite"/, 'and the address section’s own');
+  for (const sender of ['mReProvision', 'mRestart']) {
+    assert.match(fn(sender), /\$\('mActs'\)\.querySelectorAll\('button'\)\.forEach\(function \(b\) \{ b\.disabled = true; \}\);/,
+      sender + ' quiets the doors while it is in flight');
+  }
+  assert.match(fn('mAttach'), /if \(btn\) btn\.disabled = true;/, 'and so does the address control');
+  assert.match(fn('askDelete'), /if \(field\) field\.focus\(\);/, 'the typed-back name takes focus when the ask opens');
   const card = fn('renderCard');
   assert.match(card, /var wasInside = li\.contains\(document\.activeElement\) && document\.activeElement !== li;/);
-  assert.match(card, /else if \(focusBack\) focusCardControl\(inst\.id, prefer\);/);
-  assert.match(fn('focusKeyOf'), /data-teardown-yes'\) \|\| el\.hasAttribute\('data-teardown-no'\)\) return '\[data-teardown\]'/, 'Yes / Keep land back on the door that opened them');
-  assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a, \.actions button'\) \|\|\n\s*li\.querySelector\('details\.attachFold summary'\)/, 'nearest control as the fallback');
+  assert.match(card, /if \(wasInside\) focusCardControl\(inst\.id, prefer\);/);
+  assert.match(fn('focusKeyOf'), /el\.hasAttribute\('data-manage'\) \? '\[data-manage\]' : null/, 'Manage lands back on Manage');
+  assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a'\)/, 'nearest door as the fallback');
 });
 
 /* ── copy follow-ups (task 1003245) ── */
@@ -539,7 +574,14 @@ test('repo visibility: the refusal is one line, the mechanism lives in the fold'
 test('a failed manage read offers a retry; the no-address sentence offers a door', () => {
   assert.match(SCRIPT, /a\.innerHTML = 'Couldn’t read this project right now\. <button type="button" class="btn small ghost" id="mAlertRetry">Try again<\/button>';/);
   assert.match(SCRIPT, /\$\('mAlert'\)\.addEventListener\('click', function \(ev\) \{\n\s*if \(ev\.target\.closest && ev\.target\.closest\('#mAlertRetry'\)\) loadManage\(\);/, 'delegated — the catch rewrites the alert on every failure');
-  assert.match(fn('addressRow'), /No address yet<\/span> — sign-in on this project can’t be set up until it has one\. <a href="\?view=mine" data-nav-to="mine">Give it an address from your projects<\/a>\./);
+  // the door the sentence offers must be one the READING surface has: on the
+  // project's own page it is the section below, on a row it is that project's
+  // page — never the list, which since task 1003355 carries no field at all
+  const addr = fn('addressRow');
+  assert.match(addr, /No address yet<\/span> — sign-in on this project can’t be set up until it has one\. '/);
+  assert.match(addr, /onManage \? 'Give it an address below\.'/);
+  assert.match(addr, /'<a href="\?view=manage&id=' \+ esc\(String\(inst\.id\)\) \+ '" data-manage="' \+ esc\(String\(inst\.id\)\) \+ '">Give it an address on its own page<\/a>\.'/,
+    'and it carries data-manage, so the list’s delegated handler opens it in place');
   assert.match(SCRIPT, /var a = ev\.target\.closest && ev\.target\.closest\('\[data-nav-to\]'\);\n\s*if \(!a \|\| !isPlainClick\(ev\)\) return;/, 'data-nav-to is delegated, so a link injected after boot switches views in place');
   assert.doesNotMatch(SCRIPT, /querySelectorAll\('\[data-nav-to\]'\)/, 'the boot-time sweep is gone');
 });

package/tests/ship_assurance.mjs

@@ -186,5 +186,57 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
     'and the deliberate-empty land sites must mark themselves as such');
 });
 
+// task 1003434 — a recorded tip proves the land even when the claim has no branch.
+// Strands 1003285/1003286: commits on main, no branch on the claim. Once the tip was
+// recorded, POST /ship still refused, because getPublishStatus threw BAD_BRANCH before
+// landProvenForTask ever saw the tip. The status probe is a witness, not a
+// prerequisite: its failure must degrade to status=null, never discard the proof.
+const { deriveShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
+const TIP = 'a'.repeat(40);
+console.log('\nthe tip proof does not depend on the branch/PR probe');
+await t('tip in main + getPublishStatus throwing (no branch on the claim) → proof', async () => {
+  const seen = [];
+  const r = await deriveShipAssurance({
+    taskId: 1003285,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      getPublishStatus: async () => { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; },
+      landProvenForTask: async ({ publishedSha, status }) => {
+        seen.push({ publishedSha, status });
+        return publishedSha === TIP ? { proven: true, reason: 'published tip in main' } : { proven: false };
+      },
+    },
+    onProbeError: (e) => seen.push({ probeError: e.code }),
+  });
+  assert.equal(seen.some((s) => s.publishedSha === TIP && s.status === null), true, 'the proof ran with status=null');
+  assert.equal(seen.some((s) => s.probeError === 'BAD_BRANCH'), true, 'the probe failure was still reported');
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+});
+await t('no tip + getPublishStatus throwing → still the 409 refusal (nothing to prove)', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1003253,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      getPublishStatus: async () => { throw new Error('BAD_BRANCH'); },
+      landProvenForTask: async () => ({ proven: false, reason: 'no tip, no PR' }),
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+await t('a proof failure (compare API down) still falls through to the refusal, not a throw', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      getPublishStatus: async () => null,
+      landProvenForTask: async () => { throw new Error('STATUS_FETCH_FAILED'); },
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);