@bongos/core 1.19.441 → 1.19.443

package/modules/public-landing/public/assets/world/r4-card-deepfield.jpg.json

@@ -0,0 +1,14 @@
+{
+  "kind": "card-band",
+  "model": "soul_location (Higgsfield) — nano_banana_pro was asked first; its queue had not started a job after 25 minutes, so the round moved to the model that answered",
+  "job_id": "debaaba3-6094-4670-9b08-c578fc6e8bb9",
+  "aspect_ratio": "5:2",
+  "source_aspect_ratio": "21:9",
+  "generated": "2026-08-30T17:09Z",
+  "round": 4,
+  "task": 1003352,
+  "prompt": "Ultra-wide deep-field astronomical photograph on a pure black ground: many very small, very distant galaxies and faint stars scattered sparsely across an almost entirely black frame, a few with the faintest cool blue or warm amber tint, no bright object anywhere, extremely quiet and even. No planets, no moons, no large nebula, no ground plane, no horizon, no lens flare, no text, no watermark, no logo, no border. Pure black dominates the frame.",
+  "source": ".impeccable/mocks/world-assets/r4-card-deepfield-src.jpg",
+  "encoded": "ffmpeg crop=2560:1024:0:24 (21:9 → 5:2, centred), JPEG -q:v 4",
+  "use": "the poster card's backdrop on /projects, chosen by an owner as card_backdrop=\"deepfield\": a deep field of very distant galaxies on near-black; the quietest of the four. Dark only (ADR 0204); composed so the left third and the lower corners stay near-black, where the card puts its disc, its name and its two figure callouts."
+}

package/modules/public-landing/public/assets/world/r4-card-dust.jpg.json

@@ -0,0 +1,14 @@
+{
+  "kind": "card-band",
+  "model": "soul_location (Higgsfield) — nano_banana_pro was asked first; its queue had not started a job after 25 minutes, so the round moved to the model that answered",
+  "job_id": "7ec35328-3943-4765-8dd7-8392fb8c48c3",
+  "aspect_ratio": "5:2",
+  "source_aspect_ratio": "21:9",
+  "generated": "2026-08-30T17:09Z",
+  "round": 4,
+  "task": 1003352,
+  "prompt": "Ultra-wide cinematic deep-space photograph on a pure black ground: soft interstellar dust lanes in warm bronze and dark amber sweeping diagonally across the centre-right, very low contrast, a haze rather than a shape, a scatter of tiny faint stars. The left third and both lower corners stay almost pure black and empty. No planets, no moons, no nebula pillars, no ground plane, no horizon, no lens flare, no text, no watermark, no logo, no border. Pure black dominates the frame.",
+  "source": ".impeccable/mocks/world-assets/r4-card-dust-src.jpg",
+  "encoded": "ffmpeg crop=2560:1024:0:24 (21:9 → 5:2, centred), eq=gamma=1.20, JPEG -q:v 4",
+  "use": "the poster card's backdrop on /projects, chosen by an owner as card_backdrop=\"dust\": warm bronze dust lanes, very low contrast; a haze rather than a shape. Dark only (ADR 0204); composed so the left third and the lower corners stay near-black, where the card puts its disc, its name and its two figure callouts."
+}

package/modules/public-landing/public/assets/world/r4-card-nebula.jpg.json

@@ -0,0 +1,14 @@
+{
+  "kind": "card-band",
+  "model": "soul_location (Higgsfield) — nano_banana_pro was asked first; its queue had not started a job after 25 minutes, so the round moved to the model that answered",
+  "job_id": "35ad2c18-aaa3-413c-9fd8-958e5017d77c",
+  "aspect_ratio": "5:2",
+  "source_aspect_ratio": "21:9",
+  "generated": "2026-08-30T17:09Z",
+  "round": 4,
+  "task": 1003352,
+  "prompt": "Ultra-wide cinematic deep-space photograph on a pure black ground: a faint nebula wash in muted violet and deep blue with a soft bronze warmth drifting through the centre-right of the frame, very sparse pin-sharp stars of varied brightness, gentle depth. The left third and both lower corners stay almost pure black and empty. No planets, no moons, no ground plane, no horizon, no lens flare, no text, no watermark, no logo, no border. Pure black dominates the frame.",
+  "source": ".impeccable/mocks/world-assets/r4-card-nebula-src.jpg",
+  "encoded": "ffmpeg crop=2560:1024:0:24 (21:9 → 5:2, centred), eq=gamma=1.75:saturation=1.30, JPEG -q:v 4 — the render was too dark to read at the card's 560px; a gamma lift raises the wash without crushing the black the disc and the name sit on (contrast would have)",
+  "use": "the poster card's backdrop on /projects, chosen by an owner as card_backdrop=\"nebula\": a violet-and-bronze nebula wash, sparse stars — the field's own language in the card's shape. Dark only (ADR 0204); composed so the left third and the lower corners stay near-black, where the card puts its disc, its name and its two figure callouts."
+}

package/{public-landing → modules/public-landing/public}/projects-floor.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
+  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Off the Boats a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
   "page": "/projects",
   "surface": "public-landing",
   "modes": [
@@ -58,6 +58,33 @@
           "#cardListed"
         ]
       }
+    },
+    "card-backdrop": {
+      "auth": true,
+      "actions": [
+        [
+          "dispatchClick",
+          "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"
+        ],
+        [
+          "wait",
+          600
+        ]
+      ],
+      "expect": {
+        "dialog": true,
+        "visible": [
+          "#cardArt",
+          "#cardOpen"
+        ],
+        "attr": [
+          [
+            "#cardArt",
+            "src",
+            "/assets/world/r4-card-nebula.jpg"
+          ]
+        ]
+      }
     }
   }
 }

package/{public-landing → modules/public-landing/public}/projects.html

@@ -769,6 +769,18 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- its card (task 1003352): the poster card's backdrop, a plate the
+           platform drew. Beside the planet, on the same settings channel, and
+           like it: nothing is pushed to the project and nothing restarts. -->
+      <div class="card mSec" id="mCard">
+        <h2>Its card</h2>
+        <div id="mCardPick"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mCardWhat">
+          <summary>What the choice changes</summary>
+          <p>The backdrop behind this project’s name on its card — the panel that opens when someone picks it out of the map. Four plates the platform drew, or the project’s own picture if you have given it one. Saving here changes nothing on the project itself: no restart, nothing to apply.</p>
+        </details>
+      </div>
+
       <!-- live since task 1003042: the teardown control, for a project in ANY
            state that still holds something. The server used to refuse a
            'requested' or an 'error' project outright — and force-teardown reused
@@ -1820,7 +1832,7 @@ summary{min-height:24px;padding:3px 0;}
     var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
        again here before it becomes a src */
-    cardArt(p.isSelf ? '' : safeHttpUrl(p.art_url));
+    cardArt(p.isSelf ? '' : (backdropPlate(p.card_backdrop) || safeHttpUrl(p.art_url)));
     $('cardDot').style.setProperty('--acc', p.isSelf ? 'var(--accent)' : accentOf(p));
     $('cardName').textContent = p.name || '';
     $('cardTag').textContent = p.tagline || '';
@@ -4851,6 +4863,7 @@ summary{min-height:24px;padding:3px 0;}
     /* its planet (task 1003347) reads off the row — fetch-free too; a pick in
        progress survives the tick because only a different project re-renders it */
     renderPick(inst);
+    renderCardPick(inst);
     /* the page names its project — the heading holds #mName; and in the tab */
     document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
     /* the card's own story, on the project's own page (task 1003232): the
@@ -5432,6 +5445,20 @@ summary{min-height:24px;padding:3px 0;}
   var PICK_STYLES = [['tint', 'tinted'], ['wash', 'washed'], ['plain', 'plain']];
   var PICK_ACCENTS = [['sea', 'sea'], ['terracotta', 'terracotta'], ['gold-soft', 'soft gold'], ['sun-lit', 'sunlit'], ['accent', 'the accent']];
   var PICK_FIELDS = { mPickShape: 'shape', mPickMaterial: 'material', mPickStyle: 'style', mPickAccent: 'accent' };
+  /* ── the card's backdrop (task 1003352): the same KIND of key as the planet —
+     a closed list of platform-drawn plates, saved on the same settings channel,
+     pushed to no instance and restarting nothing. '' is "its own picture": the
+     card falls back to the project's art_url, which is all it read before. The
+     plates are the world's own material (DESIGN.md, round 4), dark only. ── */
+  var CARD_BACKDROPS = [['', 'its own picture'], ['nebula', 'nebula'], ['dust', 'dust'], ['deepfield', 'deep field'], ['chrome', 'chrome']];
+  var CARD_PLATES = { nebula: 'r4-card-nebula.jpg', dust: 'r4-card-dust.jpg', deepfield: 'r4-card-deepfield.jpg', chrome: 'r4-card-chrome.jpg' };
+  var CARD_WORDS = { nebula: 'a violet and bronze nebula wash', dust: 'warm bronze dust lanes',
+    deepfield: 'a deep field of distant galaxies', chrome: 'a sweep of liquid chrome' };
+  /* a key → the plate's path, or '' for anything this platform does not draw
+     (an unknown key from an older row must never become a broken src) */
+  function backdropPlate(key) {
+    return CARD_PLATES[key] ? '/assets/world/' + CARD_PLATES[key] : '';
+  }
   var mPick = null;         /* the pending choice: { shape, material, style, accent } */
   var mPickFor = null;      /* which project it belongs to — a different one starts afresh */
   var mPickTouched = false; /* the owner changed something since the seed — a late catalog must not undo it */
@@ -5540,6 +5567,79 @@ summary{min-height:24px;padding:3px 0;}
     });
   }
 
+  /* ── its card (task 1003352; the owner's ask on the planet round: "this could
+     also house project card backdrop customization"). Its own section BESIDE the
+     planet rather than inside it, so each heading stays true — one is how the
+     project is drawn everywhere, the other is one surface's backdrop. Same
+     mechanics as the planet, key for key: reads off the row, saves on the
+     settings PATCH, and the reply is a receipt the card repaints from. ── */
+  var mCard = null;         /* the pending choice: the backdrop key, or '' */
+  var mCardFor = null;      /* which project it belongs to */
+  function renderCardPick(inst) {
+    if (mCard === null || mCardFor !== inst.id) { mCard = inst.card_backdrop || ''; mCardFor = inst.id; }
+    var plate = backdropPlate(mCard);
+    $('mCardPick').innerHTML =
+      '<div class="pick">' +
+        '<div class="pickPreview"><span class="cardBand"' +
+          (plate ? ' style="background-image:url(' + esc(plate) + ')"' : ' data-own') + ' aria-hidden="true"></span>' +
+          /* the line speaks for the ROW, so a pick that is ahead of the row says
+             so — the preview above it is already showing the plate */
+          '<p class="pickWords">' + esc(CARD_WORDS[mCard] || 'the project’s own picture, when it has one') +
+          '<small>' + (mCard !== (inst.card_backdrop || '') ? 'not saved yet'
+            : inst.card_backdrop ? 'your choice' : 'nothing chosen') + '</small></p></div>' +
+        '<div class="pickBands">' + pickBand('Backdrop', 'mCardBackdrop', CARD_BACKDROPS, mCard) + '</div>' +
+      '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-card-save>Save its card</button></div>' +
+      '<div class="projMsg" id="mCardMsg" role="status" aria-live="polite"></div>';
+  }
+  $('mCardPick').addEventListener('change', function (ev) {
+    var t = ev.target;
+    if (!t || t.type !== 'radio' || t.name !== 'mCardBackdrop' || !manageInst) return;
+    mCard = t.value;
+    renderCardPick(manageInst);   /* the preview follows the pick, keeping the cell's focus */
+    var again = document.querySelector('#mCardPick input[value="' + t.value + '"]');
+    if (again) again.focus({ preventScroll: true });
+  });
+  $('mCardPick').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-card-save')) doCardSave();
+  });
+  function doCardSave() {
+    if (!manageInst || mCard === null) return;
+    var box = $('mCardMsg');
+    document.querySelectorAll('#mCardPick .actions button').forEach(function (b) { b.disabled = true; });
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ card_backdrop: mCard || null })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice; the card reads it from there */
+          manageInst.card_backdrop = (data.planet || {}).card_backdrop || null;
+          var row = byId[manageInst.id];
+          if (row) row.card_backdrop = manageInst.card_backdrop;
+          mCard = null;
+          renderCardPick(manageInst);
+          var done = $('mCardMsg');
+          done.className = 'projMsg ok';
+          done.textContent = (data.push && data.push.message) || 'Saved.';
+          loadCatalog();
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        box.className = 'projMsg err';
+        box.textContent = e.message || 'The choice could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      document.querySelectorAll('#mCardPick .actions button').forEach(function (b) { b.disabled = false; });
+    });
+  }
+
   /* ── how people join (task 1003044): the joinability toggle — the visibility
      section's shape, key for key: the CHOICE from the platform's settings row,
      what the project RUNS from its own manifest (brand.project.joinability),

package/{public-landing → modules/public-landing/public}/projects.probes.json

@@ -131,6 +131,12 @@
     { "name": "manage flows: try again from the snagged project's own page re-files it too", "auth": true, "width": 1440, "url": "/projects?view=manage&id=103",
       "steps": [["wait",900],["click","[data-m-retry]"],["wait",900]],
       "expect": {"text":[["#mMsg","Queued. The platform picks it up from here."]],"hasClass":[["#mMsg","ok",true]],"hidden":["#mAddress"]} },
+    { "name": "manage flows: its card (task 1003352) — pick the nebula plate; save; the receipt lands and the preview takes the plate", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
+      "steps": [["wait",900],["check","#mCardPick input[name=\"mCardBackdrop\"][value=\"nebula\"]"],["wait",150],["click","[data-card-save]"],["wait",700]],
+      "expect": {"text":[["#mCardMsg","Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it."]],"hasClass":[["#mCardMsg","ok",true]],"count":[["#mCardPick .cardBand[data-own]",0]]} },
+    { "name": "manage flows: its card — handing it back to the platform restores the project's own picture", "continue": true,
+      "steps": [["check","#mCardPick input[name=\"mCardBackdrop\"][value=\"\"]"],["wait",150],["click","[data-card-save]"],["wait",700]],
+      "expect": {"hasClass":[["#mCardMsg","ok",true]],"count":[["#mCardPick .cardBand[data-own]",1]]} },
     { "name": "manage flows: how people join — pick a cell, save, the receipt lands under the choice", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
       "steps": [["wait",900],["check","input[name=\"mJoinPick\"][value=\"apply\"]"],["click","[data-join-save]"],["wait",600]],
       "expect": {"text":[["#mJoinMsg","Saved. The project restarts to apply it."],["#mName","demo"]],"checked":"input[name=\"mJoinPick\"][value=\"apply\"]","visible":["#mOrb .worldOrb","#mFacts .ledger .k"]} },

package/{public-landing → modules/public-landing/public}/projects.states.json

@@ -21,6 +21,7 @@
     "in-manage": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mMain", "#mChip .chip", "#mOrb .worldOrb", "#mFacts .ledger .k", "#mActs", "#mAddress"], "hidden": ["#qWrap", "#mGate", "#mMissing", "#mErr"], "text": [["#mName", "demo"], ["#mTitle", "demo"]] } },
     "in-manage-address": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mAddress", "#mAddress h2", "#mDom .plain", "#mDomName", "#mDom [data-m-attach]", "#mDomWhat summary"], "count": [["#mDom .attach input[type=text]", 1], ["#mDom .attach button", 1]] } },
     "in-manage-planet": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mPlanetPick", "#mPick .pick .pickPreview .worldOrb .disc", "#mPick [data-pick-save]", "#mPick [data-pick-reset]", "#mPickWhat summary"], "count": [["#mPick .pickCells[role=\"radiogroup\"]", 3], ["#mPick .pickCell", 10], ["#mPick .pickCell.on", 3], ["#mPick .pickSw", 5], ["#mPick .pickSw.on", 1]], "attr": [["#mPick .pickPreview .worldOrb", "data-template", "pair-obsidian-tint"], ["#mOrb .worldOrb", "data-template", "pair-obsidian-tint"]], "checked": "#mPick input[name=\"mPickAccent\"][value=\"sea\"]", "text": [["#mPlanet .v small", "your choice."]] } },
+    "in-manage-card": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mCard", "#mCardPick .pick .pickPreview .cardBand", "#mCardPick [data-card-save]", "#mCardWhat summary"], "count": [["#mCardPick .pickCells[role=\"radiogroup\"]", 1], ["#mCardPick .pickCell", 5], ["#mCardPick .pickCell.on", 1]], "checked": "#mCardPick input[name=\"mCardBackdrop\"][value=\"\"]", "attr": [["#mCardPick .cardBand", "data-own", ""]] } },
     "in-manage-snag": { "auth": true, "url": "/projects?view=manage&id=103", "expect": { "visible": ["#mMain", "#mErr", "#mActs"], "hidden": ["#mAddress"], "text": [["#mName", "tidepool"]] } },
     "in-manage-gone": { "auth": true, "url": "/projects?view=manage&id=104", "expect": { "visible": ["#mMain", "#mActs"], "hidden": ["#mErr", "#mAddress"], "text": [["#mName", "old-lantern"]] } },
     "in-manage-missing": { "auth": true, "url": "/projects?view=manage&id=999", "expect": { "visible": ["#mMissing"], "hidden": ["#mMain", "#mGate"] } },

package/modules/ui-design/kit/fixtures/featured-hub.json

@@ -1 +1 @@
-{"_":"The hub's catalog (task 1003345): the landing's featured.json plus Tidewater, an all-null row nobody owns — the card-floor state opens ITS card, because Demo is owned by the signed-in stub (provisioning-instances.json) and an owned orb's plain click opens the manage view, never the card. Served under the name \"featured\" by projects.states.json's stub.fixtures alias; the landing keeps featured.json.","projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","planet_template":null,"planet_accent":null,"created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","planet_template":"pair-obsidian-tint","planet_accent":"sea","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null},{"origin":"https://tidewater.cloudbongos.com","name":"Tidewater","tagline":"A project that has declared nothing yet.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-20T08:00:00.000Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null}]}
+{"_":"The hub's catalog (task 1003345): the landing's featured.json plus Tidewater, an all-null row nobody owns — the card-floor state opens ITS card, because Demo is owned by the signed-in stub (provisioning-instances.json) and an owned orb's plain click opens the manage view, never the card. Served under the name \"featured\" by projects.states.json's stub.fixtures alias; the landing keeps featured.json.","projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","planet_template":null,"planet_accent":null,"card_backdrop":"nebula","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","planet_template":"pair-obsidian-tint","planet_accent":"sea","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null},{"origin":"https://tidewater.cloudbongos.com","name":"Tidewater","tagline":"A project that has declared nothing yet.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-20T08:00:00.000Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null}]}

package/modules/ui-design/kit/lib.js

@@ -53,7 +53,7 @@ function normalizePageArg(page) {
   if (typeof page === 'string' && /^[A-Za-z]:[\\/]/.test(page) && /[\\/]$/.test(page)) return '/';
   return page;
 }
-// A surface is a directory of the checkout: 'public-landing', 'modules/<key>/public',
+// A surface is a directory of the checkout ('modules/<key>/public') or a module KEY
 // or a module KEY whose manifest declares a webSurfaces dir. Nothing is hardcoded.
 function resolveSurfaceDir(surface, root = REPO_ROOT) {
   if (!surface) return null;
@@ -234,7 +234,7 @@ function reducedMotionProblems({ running = [], frames = 0 } = {}) {
 }
 
 // ── the states file ───────────────────────────────────────────────────────────
-// { "page": "/projects", "surface"?: "public-landing", "stub"?: { prefix?, child? },
+// { "page": "/projects", "surface"?: "public-landing" (a module key), "stub"?: { prefix?, child? },
 //   "modes"?: ["dark" | "light", …] (the modes the page renders; default both — a page that pins
 //   one mode declares it here), "modeQuery"?: "mode" | false, "ignoreRequests"?: [regex strings], "ignoreConsole"?: [...],
 //   stub.fixtures?: { "<fixture name>": "<other fixture file>" } (serve another file under a name — an empty list, a

package/modules/ui-design/kit/render.js

@@ -8,7 +8,7 @@
 // through two stubs this file starts itself (signed out, signed in), then a
 // reduced-motion pass per mode. Writes the shots + a JSON report; exits non-zero on any problem.
 //
-//   node modules/ui-design/kit/render.js --page /projects              (public-landing/projects.states.json)
+//   node modules/ui-design/kit/render.js --page /projects              (surface defaults to the public-landing module key)
 //   node modules/ui-design/kit/render.js --page /builders/ranks --surface hall-ui
 //   node modules/ui-design/kit/render.js --states <file>               (explicit file)
 //     --modes dark,light  --sizes 1440,390,320  --only a,b  --out <dir>

package/modules/ui-design/kit/serve.js

@@ -10,9 +10,9 @@
 // fixtures/ so a page boots with real-shaped data and no database. Serves docs/
 // raw so a mock under docs/design/mocks/ renders with its relative links.
 //
-//   node modules/ui-design/kit/serve.js                  -> http://127.0.0.1:3412/  (public-landing)
-//   SURFACE=<dir or module key>   a checkout dir ("public-landing", "modules/hall-ui/public") or a
-//                                 module key whose manifest declares a webSurfaces dir
+//   node modules/ui-design/kit/serve.js                  -> http://127.0.0.1:3412/  (the public-landing module)
+//   SURFACE=<dir or module key>   a checkout dir ("modules/hall-ui/public") or a module
+//                                 key ("public-landing") whose manifest declares a webSurfaces dir
 //   PREFIX=/builders/             the URL prefix the surface's pages + assets are served under
 //   STUB_REPO=<checkout>          the checkout to serve (default: the one this file sits in)
 //   STUB_PORT=<n>                 default 3412 (0 = any free port; the port is printed)
@@ -137,15 +137,40 @@ const ASKED = new Map();
 // the run — the page repaints from the row it re-reads, so the row must carry the choice; a
 // PATCH with only planet keys gets the route's no-restart receipt, a policy key the push
 const PLANETS = new Map();
-const PLANET_KEYS = ['planet_template', 'planet_accent'];
-const NO_PLANET = { planet_template: null, planet_accent: null };
+const PLANET_KEYS = ['planet_template', 'planet_accent', 'card_backdrop'];
+const NO_PLANET = { planet_template: null, planet_accent: null, card_backdrop: null };
 function readBody(req, cb) {
   let d = '';
   req.on('data', (c) => { d += c; });
   req.on('end', () => { let b = {}; try { b = JSON.parse(d || '{}'); } catch { b = {}; } cb(b); });
 }
+// The real route validates STRICTLY against its vocabularies (an undeclared key
+// or an off-vocabulary value is a 400). The stub mirrored none of that, so the
+// probes stayed green on a body the server would have refused — which is how a
+// missing card_backdrop entry in the route's schema shipped past a full probe
+// run (task 1003352, grade round 2). The lists are copied on purpose: a kit
+// module may not import core. They are small, closed, and pinned by a test.
+const STUB_VOCAB = {
+  platform_visibility: ['public', 'gated'],
+  joinability: ['open', 'apply', 'invite_only'],
+  planet_template: null,   // the template set is long; shape is checked, not membership
+  planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
+  card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],
+};
+function settingsRejection(body) {
+  for (const [key, value] of Object.entries(body)) {
+    if (!(key in STUB_VOCAB)) return `unknown field: ${key}`;
+    if (value === null) continue;                    // null hands a pick back
+    if (typeof value !== 'string') return `${key} must be a string`;
+    const allowed = STUB_VOCAB[key];
+    if (allowed && !allowed.includes(value)) return `${key} is not one of: ${allowed.join(', ')}`;
+  }
+  return null;
+}
 function settingsPatch(res, id, body) {
-  if (PLANET_KEYS.some((k) => k in body)) PLANETS.set(String(id), { planet_template: body.planet_template || null, planet_accent: body.planet_accent || null });
+  const bad = settingsRejection(body);
+  if (bad) return json(res, 400, { error: { code: 'validation_failed', message: bad } });
+  if (PLANET_KEYS.some((k) => k in body)) PLANETS.set(String(id), Object.fromEntries(PLANET_KEYS.map((k) => [k, body[k] || null])));
   const policy = ['platform_visibility', 'joinability'].some((k) => k in body);
   const push = policy ? FLOW_RECEIPTS.settings.push
     : { queued: false, restart: false, message: 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.' };
@@ -154,7 +179,7 @@ function settingsPatch(res, id, body) {
 // the row carries its planet: a saved pick for the run, else the fixture's own (or null)
 function withPlanet(inst) {
   const saved = PLANETS.get(String(inst.id));
-  return { ...inst, planet_template: inst.planet_template || null, planet_accent: inst.planet_accent || null, ...(saved || {}) };
+  return { ...inst, ...Object.fromEntries(PLANET_KEYS.map((k) => [k, inst[k] || null])), ...(saved || {}) };
 }
 function flowReceipt(rest, method) {
   if (method === 'POST' && rest === '/provisioning/instances') return FLOW_RECEIPTS.provision;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.441",
+  "version": "1.19.443",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.441",
+      "version": "1.19.443",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.441",
+  "version": "1.19.443",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -54,12 +54,12 @@ const REPORT_REL = 'docs/copy-inventory.md';
 const SURFACES = [
   { id: 'builders-hall', kind: 'dir', at: 'modules/hall-ui/public', exts: ['.html', '.js'] },
   { id: 'status-dashboard', kind: 'dir', at: 'modules/status-ui/public', exts: ['.html', '.js'] },
-  // THE LANDING SURFACE IS public-landing/, NOT src/platform-server.js. The first
+  // THE LANDING SURFACE IS modules/public-landing/public/, NOT src/platform-server.js. The first
   // cut pointed here at the server file, which only fs.readFileSync's these
   // templates — so its JS patterns matched a handful of incidental literals and the
   // page's ACTUAL copy (hero, meta/og text, every section) was silently absent
   // while the registry reported a number. Caught by the grader on task 1003112.
-  { id: 'landing', kind: 'dir', at: 'public-landing', exts: ['.html'] },
+  { id: 'landing', kind: 'dir', at: 'modules/public-landing/public', exts: ['.html'] },
 ];
 
 // Attributes whose value is COPY a person reads (not wiring). The matchers are
@@ -70,7 +70,7 @@ const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${att
 // What this tool knowingly does not see. Printed in the report — an inventory that
 // implies completeness it does not have is worse than a short one.
 const BLIND_SPOTS = [
-  'Landing-page transforms: `public-landing/*.html` is scanned as authored, but the server rewrites it before a visitor sees it — `{{token}}` placeholders are filled from the branding pack, and `<!--apex-only:start--> … <!--apex-only:end-->` sections are STRIPPED on a child instance (src/platform-server.js `landingPage()`). So a row here may be copy that this instance never renders, and a rendered sentence may differ from its authored form.',
+  'Landing-page transforms: `modules/public-landing/public/*.html` is scanned as authored, but the server rewrites it before a visitor sees it — `{{token}}` placeholders are filled from the branding pack, and `<!--apex-only:start--> … <!--apex-only:end-->` sections are STRIPPED on a child instance (src/platform-server.js `landingPage()`). So a row here may be copy that this instance never renders, and a rendered sentence may differ from its authored form.',
   'Server-side messages: route failures (`res.fail` reasons), validation text and API error copy live in server JS and are not walked here. A person reads them, so widening to them is a deliberate later step, not an oversight to quietly fix.',
   'Skill and playbook prose: `.claude/skills/**/SKILL.md` is read by agents and by builders and is arguably the largest body of project voice. Out of scope on purpose — it is not UI, and mixing it in would drown the UI signal.',
   'Discord copy: outbound broadcast text is composed in `modules/discord/*.js` at send time. User-facing, but not part of any UI surface.',

package/scripts/gds/fitness-checks-identity.js

@@ -141,11 +141,27 @@ const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'i
 // silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
 const { stripCommentsForIdentity } = require('./identity-strip');
 
+// An APEX-ONLY region is content the server DELETES on every instance that is not
+// the hub (`stripApexOnly`, src/platform-server.js — ADR 0152; the front door became
+// a module in ADR 0218, which is what first brought these pages under this gate).
+// This check exists so "a non-OTB instance renders ITS OWN brand"; text inside these
+// sentinels never reaches a non-hub instance at all, so it cannot produce that
+// failure. The hub's own landing legitimately NAMES the projects hosted on it, and
+// that catalog is exactly what the sentinels wrap.
+//
+// BLANKED, not removed, so a violation's reported line number still points at the
+// real line. Applied BEFORE the comment strip, which would otherwise eat the
+// sentinels (they are HTML comments) and take the region's boundaries with them.
+const APEX_ONLY_REGION = /<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g;
+function blankApexOnly(text) {
+  return String(text).replace(APEX_ONLY_REGION, (m) => m.replace(/[^\n]/g, ' '));
+}
+
 // Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
 // Returns violation strings. Exported for the "actually catches a re-hardcode" test.
 function scanPromptIdentity(relFile, text, ext = path.extname(relFile)) {
   const violations = [];
-  stripCommentsForIdentity(text, ext).split('\n').forEach((raw, i) => {
+  stripCommentsForIdentity(blankApexOnly(text), ext).split('\n').forEach((raw, i) => {
     if (!raw.trim()) return;
     for (const re of PROMPT_IDENTITY_LITERALS) {
       const m = raw.match(re);
@@ -318,4 +334,5 @@ module.exports = {
   collectIdentityFiles,
   scanPromptIdentity,
   stripCommentsForIdentity,
+  blankApexOnly,           // ADR 0218 — apex-only regions never reach a child instance (tested)
 };

package/scripts/gds/publish-manifest.js

@@ -66,6 +66,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/ui-design/',      // the design contract + its adapters/CLIs + the /design playbook (task 1003324, ADR 0197). default:true, so it MUST be here: a released core without it would materialize skills (design, design-sync, figma-design-sync) whose CLIs and adapters do not exist.
   'modules/hall-ui/',
   'modules/status-ui/',
+  'modules/public-landing/', // the front door (task 1003322, ADR 0218) — the repo-root public-landing/ entry this replaces was always here, and for the same reason: default:true, and it is the only thing an instance serves at its apex root. Omit it and a released core answers the game-less 404 tail on its own home page.
   'modules/dev-box/',
   'modules/discord/',
   'modules/provisioning/',   // instance-hosting control plane — CORE like its sibling dev-box (same do-api/cf-tunnel toolchain, all core). Reclassified IN so the core CLI scripts/gds/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
@@ -137,7 +138,6 @@ const PUBLISH_ALLOWLIST = [
   '.gitattributes',
   'package.json',
   'package-lock.json',
-  'public-landing/',
   // --- served-at-runtime app assets a standalone MUST carry (task 2078) ---
   // The generated typed API client is served at /lib/bongos-client.js as
   // window.BongosClient; shell.js + builders.js call it at the TOP of every hall

package/src/bongos/module-scope-map.js

@@ -206,13 +206,15 @@ const MODULE_GLOBS = {
   // (moduleWebSurfaces → serve-internal). Its public read endpoints stay SHARED
   // core in routes/public.js (the hall + the off-box mirror consume them too).
   'status-ui': ['modules/status-ui/'],
-  // The instance's public landing surface (index/projects/create), served by
-  // platform-server.js from the repo-root public-landing/ dir — not yet a carved
-  // module, so the glob lists where the code lives TODAY (the auto-tighten
-  // contract above). Its own key, not provisioning's: the front door is broader
-  // than instance hosting, and the web-surface precedent (hall-ui/status-ui) is
-  // one key per surface (task 1002690, goal 1000059).
-  'public-landing': ['public-landing/'],
+  // Task 1003322 (ADR 0218): the front door graduated to modules/public-landing/ —
+  // public-landing/ moved to modules/public-landing/public/ and is now a loader-
+  // discovered web-surface module. Where hall-ui and status-ui name a Host PREFIX it
+  // declares apexRoot:true, since the apex is whatever host is left once the
+  // subdomains are taken; like the hall it keeps its DEDICATED serving block (in
+  // platform-server.js, re-pointed at the module dir). The KEY is unchanged from
+  // task 1002690 — its own key, not provisioning's, because the front door is broader
+  // than instance hosting and the web-surface precedent is one key per surface.
+  'public-landing': ['modules/public-landing/'],
   // --- the design capability (task 1003324, ADR 0197): the design contract, its
   //     adapters + sync CLIs + validator, the /design playbook, and the reserved homes
   //     for the kit / the vendored UI skills / the style library. default-on,

package/src/bongos/serve-internal.js

@@ -211,7 +211,8 @@ function dropEmptyHrefLinks(html, values) {
 // '<' would otherwise break out of its attribute or close <title> early, and
 // the values now reach four times as many places as when this was written.
 // No token is ever emitted into a <script> or a CSS context (checked across
-// public-landing/, hall-ui/, status-ui/) — that would need different escaping.
+// public-landing/, hall-ui/, status-ui/ — all under modules/ since task 1003322)
+// — that would need different escaping.
 // Ampersand first, or the other replacements get double-escaped.
 function esc(s) {
   return String(s == null ? '' : s)
@@ -701,9 +702,20 @@ function mountInternalSurfaces(app) {
   // non-builders host. (The webSurfaces manifest declaration still makes the hall a
   // loader-DISCOVERED module — it feeds the scope map, the fitness keys, docs, and
   // window.__MODULES__; it is the dedicated serving below that reads the bytes.)
+  //
+  // The APEX-ROOT surface (modules/public-landing/, ADR 0218) is partitioned out the
+  // same way, on its own declaration rather than on a host: it carries no host prefix
+  // at all, because the apex is whatever is LEFT once the subdomains are taken. It is
+  // served by platform-server.js's dedicated landing block (the apex-only strip, the
+  // brand-token stamp, the ?v= content stamp, the five routes). Keeping it out of
+  // isModuleSurfaceHost is load-bearing, not tidiness — that predicate is what the
+  // /builders guards below use to step aside, and a surface matching every host would
+  // make all of them self-skip.
   const buildersHostReq = (host) => ({ headers: { host } });
   const allWebSurfaces = moduleWebSurfaces({ isEnabled: isModuleEnabled });
   const webSurfaces = allWebSurfaces
+    .filter((s) => typeof s.host === 'string')                 // APEX-ROOT surfaces carry no host (ADR 0218): they are not
+                                                               // routed by prefix here, and must stay OUT of isModuleSurfaceHost
     .filter((s) => !isBuildersHost(buildersHostReq(s.host)))   // hall served by the dedicated block, not here
     .map((s) => ({
       key: s.key,

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.441'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.443'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');