@bongos/core 1.19.442 → 1.19.444

package/docs/design/mocks/hub/mine.html

@@ -8,7 +8,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003345 (docs/design/projects-hub-direction-v2.md §14). cosmos.css

package/docs/design/mocks/hub/picker.html

@@ -8,7 +8,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003347 (docs/design/projects-hub-direction-v2.md §16): the

package/docs/design/mocks/hub/planets.html

@@ -11,7 +11,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003319 (docs/design/projects-hub-direction-v2.md §11). cosmos.css

package/docs/design/mocks/hub/v1.html

@@ -11,7 +11,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 /* ═══════════════ v1 "the shelf" — the page tier ═══════════════════════════
    cosmos.css above carries the fifteen contract tokens, the sky, the orbs, the
@@ -757,7 +757,7 @@ not a width), --ok, --warn and --err keep cosmos's meaning and are not redeclare
   <div class="cardScrim" id="cardScrim" hidden>
     <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName" data-art="on" data-faces="on" data-figs="two" data-facts="on" data-hall="on" style="--acc:var(--accent)">
       <button type="button" class="cardX" id="cardClose" aria-label="Close"><svg viewBox="0 0 20 20" aria-hidden="true"><path d="M5.4 5.4l9.2 9.2M14.6 5.4l-9.2 9.2"/></svg></button>
-      <img class="cardArt" id="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" id="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="cardDot" id="cardDot"></span>
       <h2 class="cardName" id="cardName">Cloud Bongos</h2>
       <p class="cardTag" id="cardTag">Building Digitally, as simple as Bongos.</p>
@@ -903,7 +903,7 @@ not a width), --ok, --warn and --err keep cosmos's meaning and are not redeclare
   var AV = 'https://avatars.githubusercontent.com/u/';
   var PLATFORM = {
     acc: 'var(--accent)', name: 'Cloud Bongos', tag: 'Building Digitally, as simple as Bongos.',
-    rel: 'you build here', art: '../../../../public-landing/assets/world/og-card.jpg',
+    rel: 'you build here', art: '../../../../modules/public-landing/public/assets/world/og-card.jpg',
     faces: [[AV + '64553469?v=4', 'jaxri'], [AV + '283020391?v=4', 'lars589'], [AV + '290184380?v=4', 'IAMMASTERQUA'],
             [AV + '295990394?v=4', 'scootermack'], [AV + '35337514?v=4', 'LarsCode']],
     type: null, more: '+4', builders: '9', shipped: '30+', runs: 'cloudbongos.com',

package/docs/design/mocks/hub/v2.html

@@ -12,7 +12,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* v2 "the hairline" — the world's derived tier for this surface, by the recipes in DESIGN.md's
@@ -753,7 +753,7 @@ vocabulary its chips depend on). Two recipes are adapted because a mock may carr
   <div class="cardScrim" id="cardScrim" hidden>
     <div class="projCard has-art" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
       <button type="button" class="cardX" id="cardClose" aria-label="Close"><svg aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" id="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" id="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <p class="cardFigs" id="cardFigs">
         <span class="cardCall a" id="figA"><svg class="lead" viewBox="0 0 68 26" preserveAspectRatio="none" aria-hidden="true"><line x1="0" y1="25" x2="67" y2="1" stroke="currentColor" stroke-width="1" vector-effect="non-scaling-stroke"/></svg><span class="fig" id="figABig">9</span><span class="cap">builders</span></span>
         <span class="cardCall b" id="figB"><svg class="lead" viewBox="0 0 68 26" preserveAspectRatio="none" aria-hidden="true"><line x1="0" y1="25" x2="67" y2="1" stroke="currentColor" stroke-width="1" vector-effect="non-scaling-stroke"/></svg><span class="fig" id="figBBig">30+</span><span class="cap">shipped in 30 days</span></span>

package/docs/design/mocks/hub/v3.html

@@ -11,7 +11,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 /* ══ v3 THE GLASS STRIP. Page tier only. cosmos.css owns the fifteen contract
       tokens, the sky, the orbs, the hover card, the toolbar, the table, the
@@ -875,7 +875,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card"><span class="boardLbl">card</span>
     <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName" style="--acc:var(--accent)">
       <button type="button" class="cardX" id="cardClose" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot" id="cardDot"></span>
       <h3 class="cardName" id="cardName">Cloud Bongos</h3>
@@ -967,7 +967,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card-nofaces" hidden><span class="boardLbl">card-nofaces</span>
     <div class="projCard" style="--acc:var(--accent)">
       <button type="button" class="cardX" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot"></span>
       <h3 class="cardName" id="cardName-nofaces">Cloud Bongos</h3>
@@ -990,7 +990,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card-onefig" hidden><span class="boardLbl">card-onefig</span>
     <div class="projCard" style="--acc:var(--accent)">
       <button type="button" class="cardX" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot"></span>
       <h3 class="cardName" id="cardName-onefig">Cloud Bongos</h3>
@@ -1020,7 +1020,7 @@ the hub's fixed verification vocabulary.
     <div class="ladderCell" data-card="card-nofig" hidden><span class="boardLbl">card-nofig</span>
     <div class="projCard" style="--acc:var(--accent)">
       <button type="button" class="cardX" aria-label="Close"><svg class="ic" aria-hidden="true"><use href="#i-close"></use></svg></button>
-      <img class="cardArt" src="../../../../public-landing/assets/world/og-card.jpg" alt="">
+      <img class="cardArt" src="../../../../modules/public-landing/public/assets/world/og-card.jpg" alt="">
       <span class="artScrim" aria-hidden="true"></span>
       <span class="cardDot"></span>
       <h3 class="cardName" id="cardName-nofig">Cloud Bongos</h3>

package/docs/design/mocks/hub/wizard.html

@@ -8,7 +8,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
-<link rel="stylesheet" href="../../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../../modules/public-landing/public/assets/cosmos.css">
 <style>
 body{
 /* The composition round for task 1003346 (docs/design/projects-hub-direction-v2.md §15). cosmos.css

package/docs/design/mocks/landing/v1.html

@@ -803,7 +803,7 @@ in the h1 is the server-stamped {{tagline}}. Apex-only regions are stripped on a
 <!--apex-only:start-->
   <section class="band">
     <div class="wrap verro">
-      <img src="../../../../public-landing/assets/verro-medallion.png" width="384" height="384"
+      <img src="../../../../modules/public-landing/public/assets/verro-medallion.png" width="384" height="384"
            alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
       <div>
         <h2>VERRO LABS</h2>

package/docs/design/mocks/landing/v2.html

@@ -614,7 +614,7 @@ data-link-hall); the h1 string is the server-stamped {{tagline}}.
 <!--apex-only:start-->
   <section class="page">
     <div class="wrap verro">
-      <img src="../../../../public-landing/assets/verro-medallion.png" width="292" height="292"
+      <img src="../../../../modules/public-landing/public/assets/verro-medallion.png" width="292" height="292"
            alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
       <div>
         <span class="wordmark">VERRO LABS</span>

package/docs/design/mocks/landing/v3.html

@@ -825,7 +825,7 @@ composition A, pinned by the owner 2026-08-27. No roll.
 <!--apex-only:start-->
   <section class="band">
     <div class="wrap verro">
-      <img src="../../../../public-landing/assets/verro-medallion.png"
+      <img src="../../../../modules/public-landing/public/assets/verro-medallion.png"
            alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
       <div>
         <p class="wordmark">VERRO LABS</p>

package/docs/design/mocks/landing-page-mock.html

@@ -32,7 +32,7 @@
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap">
 <!-- Same convention as projects-page-mock.html: this links the REAL token layer
      the live pages use, so what you review is what ships. Toggle ☾/☀ in the header. -->
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <!-- Candidate palettes. MOCK-ONLY: on a real instance exactly one of these
      exists and arrives via config/branding.json → themeMarkup(). See the file
      header for the contrast audit. -->
@@ -339,7 +339,7 @@ body:not([data-mascot="bongos"]) .mascot-bongos{display:none;}
       </div>
     </div>
     <div class="mascot">
-      <img class="mascot-buddha" id="buddha" src="../../../public-landing/buddha.png"
+      <img class="mascot-buddha" id="buddha" src="../../../modules/public-landing/public/buddha.png"
            alt="A laughing Cloud Bongos buddha playing the bongos on a cloud">
 
       <svg class="mascot-bongos bongos" viewBox="0 0 440 320" role="img"
@@ -611,7 +611,7 @@ body:not([data-mascot="bongos"]) .mascot-bongos{display:none;}
      only ever been visible behind a 401. buddha.png stays the poster so the
      hero is never blank while frames load. */
   if(!reduce){
-    var img=document.getElementById('buddha'), FR=44, base='../../../public-landing/assets/anim/idle/frame_';
+    var img=document.getElementById('buddha'), FR=44, base='../../../modules/public-landing/public/assets/anim/idle/frame_';
     var srcs=[], loaded=0;
     for(var i=0;i<FR;i++){
       var p=new Image();

package/docs/design/mocks/projects-hub-mock.html

@@ -8,7 +8,7 @@
 <!-- The mock links the SHIPPING stylesheet by relative path so what you see is
      what the build inherits. Serve over HTTP (python -m http.server 8899) — a
      file:// open still resolves this, but the fonts do not. -->
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap" rel="stylesheet">

package/docs/design/mocks/projects-hub-variants.html

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>The hub's ground — three candidates (task 1002758)</title>
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap" rel="stylesheet">
 <style>
 /* Contact sheet — the same pattern landing-palettes.html used for the palette

package/docs/design/mocks/projects-page-mock.html

@@ -9,7 +9,7 @@
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap">
 <!-- This mock links the REAL token/component layer the live pages use, so what
      you review here is what ships. Toggle ☾/☀ in the header to see both modes. -->
-<link rel="stylesheet" href="../../../public-landing/assets/cosmos.css">
+<link rel="stylesheet" href="../../../modules/public-landing/public/assets/cosmos.css">
 <script>
 try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')document.documentElement.setAttribute('data-mode',_m);}catch(e){}
 </script>

package/docs/file-map.md

@@ -11,7 +11,7 @@
 ├── README.md                    ← public-facing one-paragraph summary
 ├── PRODUCT.md                   ← durable product truth for the apex/hall/status surfaces (impeccable init, task 1003296): users, positioning, constraints, brand commitments, principles — no palette, no type
 ├── DESIGN.md                    ← the visual rulebook written FROM the built landing (task 1003298, ADR 0196): palette + derived recipes, type, materials (the chrome plates), components, the motion grammar, both modes; what H1 (hall) and S1 (status) build against. Sidecar .impeccable/design.json
-├── .impeccable/                 ← impeccable skill artifacts: config.json (buildPath: code), surfaces/<route>.md (per-route briefs), mocks/world-assets/ (Higgsfield renders + prompt sidecars; the SOURCE of public-landing/assets/world/), mocks/decision/ (A1 comps), design.json (DESIGN.md sidecar), review/ (finish captures)
+├── .impeccable/                 ← impeccable skill artifacts: config.json (buildPath: code), surfaces/<route>.md (per-route briefs), mocks/world-assets/ (Higgsfield renders + prompt sidecars; the SOURCE of modules/public-landing/public/assets/world/), mocks/decision/ (A1 comps), design.json (DESIGN.md sidecar), review/ (finish captures)
 ├── .gitignore
 ├── package.json / package-lock.json
 ├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/gds/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
@@ -130,7 +130,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav.
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (public-landing/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. Reserved home styles/ (1003323) with a README. config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. Reserved home styles/ (1003323) with a README. config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.
@@ -254,7 +254,7 @@
 │   ├── assets/tray/ + build-resources/ ← generated icons (scripts/gen-icons.js; build-resources name dodges the global build/ gitignore)
 │   └── test/unit.mjs               ← hermetic unit tests (run by the CI workflow, not the root gate)
 │
-├── public-landing/                 ← the APEX front door + hub surfaces served by src/platform-server.js (landingPage(): apex-only strip → brand-token stamp → theme injection → ?v= asset stamp). Ships to EVERY instance; <!--apex-only:start/end--> regions are removed on a child
+├── modules/public-landing/public/   ← the APEX front door + hub surfaces. Its OWN MODULE since task 1003322 / ADR 0218 (manifest declares { apexRoot: true, dir: "public" } — the apex is not a Host prefix), still served by src/platform-server.js (landingPage(): apex-only strip → brand-token stamp → theme injection → ?v= asset stamp). Ships to EVERY instance; <!--apex-only:start/end--> regions are removed on a child
 │   ├── index.html                  ← the landing (/) — v3 "the template's page" of the chrome world (task 1003298, ADR 0196): server-stamped head, the breath (CSS-only signature), live figures/ledger/orbs from the public feeds baked inside sentinels; page-local <style> only (no :root), links /assets/world.css
 │   ├── projects.html               ← the hub (/projects?view=map|mine|manage|new) on cosmos.css (A4, task 1003299, rebuilds it in the world)
 │   ├── privacy.html / terms.html / contact.html ← the footer doors (task 1003251), on cosmos.css

package/docs/module-api-changelog.md

@@ -1321,5 +1321,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.440 with no explicit bump. run 33323478836. (task 1002620)
   1.19.442 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.441 with no explicit bump. run 33326781131. (task 1002620)
+  1.19.443 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.442 with no explicit bump. run 33330337830. (task 1002620)
+  1.19.444 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.443 with no explicit bump. run 33334908383. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -99,7 +99,9 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
     "disciplines": ["artist"],        //   builder disciplines this module adds
     "skills":      ["otb-tile-generate"], // slash-command skills it ships
     "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__
-    "webSurfaces": [{ "host": "status.", "dir": "public" }], // host-routed static web surfaces (BV1.R84)
+    "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces: a Host PREFIX (BV1.R84)…
+                                                            // …or { "apexRoot": true, "dir": "public" } for the
+                                                            // apex root (ADR 0218). One or the other, never both.
     "migrations":  true               //   true → modules/<key>/migrations/*.sql applied if enabled
   },
   "provides": ["box.hasEverConnected"], // OPTIONAL. Seam PORTS this module registers a provider for.
@@ -152,7 +154,11 @@ At boot the loader (called from `src/modules.js` and the route mounter) runs:
 4. **Enablement filter** — check `isModuleEnabled(key)` (env override → `config/modules.json` → `config/modules.neutral.json` → `manifest.default`); disabled modules are skipped.
 5. **Mount routes** — for each `contributes.routes` key, `require(`modules/<key>/routes/<routeKey>.js`)` and call the factory. Audit is already composed at the kernel level (routes.js runs `auditMiddleware` before the loader mounts anything); each route self-gates at the appropriate rank via `api.requireBuilder` / `api.requireRank`. The fitness check (`BV1.R44`) ensures every write route is rank-gated.
 6. **Start pollers** — call each `contributes.pollers` file's `start()` on successful mount.
-7. **Serve web surfaces** — for each `contributes.webSurfaces` entry `{ host, dir }`, `serve-internal.js` (via `loader.moduleWebSurfaces`) serves `modules/<key>/<dir>/` on the matching Host prefix (the content-hash-stamped index + branding injection the status page always used). This is how the status dashboard (`status-ui`) reaches `status.<apex>` with no core edit (BV1.R84). A disabled module's surface is never built, so its host routes nowhere.
+7. **Serve web surfaces** — a `contributes.webSurfaces` entry says WHERE the surface answers in exactly one of two ways, never both and never neither ([ADR 0218](adr/<redacted>.md)):
+   - `{ host: "status.", dir: "public" }` — a **Host-header prefix**. `serve-internal.js` (via `loader.moduleWebSurfaces`) serves `modules/<key>/<dir>/` on the matching host, with the content-hash-stamped index + branding injection the status page always used. This is how the status dashboard (`status-ui`) reaches `status.<apex>` with no core edit (BV1.R84).
+   - `{ apexRoot: true, dir: "public" }` — the **apex root**: whatever host is left once the subdomains are taken (`isApexHost` = `!isStatusHost && !isBuildersHost`). Declared by `public-landing`, the front door, and served by `platform-server.js`'s dedicated block. **`host: ""` is rejected, not read as "the root"** — the routers match with `host.startsWith(s.host)` and every string starts with `""`, so an empty prefix would answer on `builders.`/`status.` too and make `isModuleSurfaceHost()` true for every request, silently un-serving the hall.
+
+   A disabled module's surface is never built, so its host routes nowhere — and for the apex root that means the front door is gone and the 404 tail answers.
 8. **Apply migrations** — enabled-gated; `migrate.sh` discovers `modules/<key>/migrations/*.sql` only when the module is enabled.
 
 The loader is safe-by-construction: with no `modules/` dir it returns empty and all functions are no-ops — the instance behaves identically to before the module move.
@@ -246,6 +252,7 @@ Rules (enforced by the `BV1.R45` fitness check):
 | **`autonomy`** *(core-domain, default-on; R83)* | routes: `autonomy` (the `/autonomy/precheck`); pollers: `routine-timers` | — (registers NO port; reaches the lifecycle `tallyPeerVotes` via the doorway) | `^1.11.0` |
 | **`status-ui`** *(core-domain web surface, default-on; R84)* | webSurfaces: `{ host: "status.", dir: "public" }` (the status dashboard at `status.<apex>`) | — (registers NO port, NO routes; pure host-routed static surface) | `^1.11.0` |
 | **`hall-ui`** *(core-domain web surface, default-on; R85)* | webSurfaces: `{ host: "builders.", dir: "public" }` (the authenticated builders' hall) | — (registers NO port; keeps a DEDICATED serving block in `serve-internal.js`, unlike `status-ui`) | `^1.11.0` |
+| **`public-landing`** *(core-domain web surface, default-on; task 1003322 / ADR 0218)* | webSurfaces: `{ apexRoot: true, dir: "public" }` (the front door at the apex root: `/`, `/projects`, `/create`, `/privacy`, `/terms`, `/contact`) | — (registers NO port; the first surface that is not a subdomain, and like `hall-ui` it keeps a DEDICATED serving block — in `platform-server.js`) | `^1.19.0` |
 | **`lifecycle`** *(core-domain, default-on; R86)* | routes: `tasks`, `claims`, `versions`, `done-when`, `goals`, `dependencies`, `gate-approvals`, `analytics` | provides `lifecycle` (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads); resolves `reward`, `onboarding` | `^1.12.0` |
 | **`provisioning`** *(default-off; [ADR 0111](adr/<redacted>.md))* | routes: `provisioning` (own+Archon rank-gated) | provides `provisioning.instanceState` | `^1.14.0` |
 | **`ui-design`** *(core-domain, default-on; [ADR 0197](adr/<redacted>.md))* | skills: `design`, `design-sync`, `figma-design-sync` (the /design playbook + the two tool round-trips); the ADR 0081 adapters, sync CLIs and validator live in the module dir | — (registers NO port, NO routes; declaration-only — disabling it withdraws the skills and touches no served surface) | `^1.19.0` |

package/docs/recipes/ui-look-before-you-ship.md

@@ -15,7 +15,7 @@ Edge or Chrome must be installed. If neither launches, every kit command prints
 ## 1. Stub — serve the surface the way the instance would
 
 ```
-node modules/ui-design/kit/serve.js                          # public-landing at http://127.0.0.1:3412/
+node modules/ui-design/kit/serve.js                          # the front door at http://127.0.0.1:3412/
 AUTH=1 STUB_PORT=3413 node modules/ui-design/kit/serve.js    # the same, signed in (/me answers { builder })
 SURFACE=hall-ui PREFIX=/builders/ node modules/ui-design/kit/serve.js
 CHILD=1 node modules/ui-design/kit/serve.js                  # the child-instance shape (apex-only regions stripped)
@@ -25,7 +25,7 @@ FAIL=featured,progress node modules/ui-design/kit/serve.js   # those feeds answe
 
 The stub runs the page through the **instance's real transforms** — the apex-only strip, the brand-token stamp, the pack's theme injection, run by the core-side command `scripts/gds/ui-kit-transform.js` (a module may not require core, so the stub spawns the command and memoises the page) — then the content-hash `?v=` stamp, with the instance's own branding pack, and answers the public feeds from `kit/fixtures/`. It also serves `docs/` raw, so a mock under `docs/design/mocks/` renders with its relative links: `http://127.0.0.1:3412/docs/design/mocks/hub/v2.html`.
 
-`SURFACE` is a checkout directory (`public-landing`, `modules/hall-ui/public`) or a module key whose manifest declares a `webSurfaces` dir. `PREFIX` is the URL prefix the surface's pages and assets live under (the hall's is `/builders/`).
+`SURFACE` is a checkout directory (`modules/hall-ui/public`) or a module key whose manifest declares a `webSurfaces` dir (`public-landing`, `hall-ui`). `PREFIX` is the URL prefix the surface's pages and assets live under (the hall's is `/builders/`).
 
 ## 2. Render — every state, every width, both modes, audited
 
@@ -74,7 +74,7 @@ Then a state's own `expect` (a band open, a dialog present, a field's value, a c
 
 Actions: `click`, `focus`, `press`, `fill`, `wait`, `clickAt x y`, `clickIfVisible`, `dispatchClick`, `check`, `back`, `forward`. Expectations: `expanded`, `dialog`, `visible[]`, `hidden[]`, `open`, `closed`, `activeId`, `activeText`, `expandedIds[]`, `param{}`, `attr[[sel,name,value]]`, `text[[sel,value]]`, `href[[sel,value]]`, `count[[sel,n]]`, `value[[sel,v]]`, `hasClass[[sel,class,bool]]`, `checked`, `noOverflow`, `top[[sel,px]]` (an element's viewport top — assert it closed, open a band, assert it again: the proof an overlay did not push the page). The kit validates the file before it opens a browser and names every problem.
 
-The worked examples: `public-landing/projects.states.json` (the hub's thirteen), `public-landing/index.states.json` (the landing's four), `modules/hall-ui/public/ranks.states.json` (a second surface under its own prefix — it renders **red**, deliberately: the hall predates the 24px floor and Ranks has no `<h1>`, and the states file declares the shell's un-fixtured feeds rather than hiding the findings; idea 1000863 carries them).
+The worked examples: `modules/public-landing/public/projects.states.json` (the hub's thirteen), `modules/public-landing/public/index.states.json` (the landing's four), `modules/hall-ui/public/ranks.states.json` (a second surface under its own prefix — it renders **red**, deliberately: the hall predates the 24px floor and Ranks has no `<h1>`, and the states file declares the shell's un-fixtured feeds rather than hiding the findings; idea 1000863 carries them).
 
 ## 3. Probe — the interaction contract, as PASS/FAIL lines
 
@@ -83,7 +83,7 @@ node modules/ui-design/kit/probe.js --page /projects
 node modules/ui-design/kit/probe.js --page / --only "Escape"
 ```
 
-A **probes file** (`<surface>/<page>.probes.json`) is a sequence: each probe opens the page (or continues the previous probe's page with `"continue": true`), drives steps from the same action vocabulary, and states what must be true with the same expectations. An uncaught page error during a probe fails it. The disclosure contract ships first — `public-landing/projects.probes.json` (24 probes: Enter opens on the first item, arrows cycle and skip hidden cells, Escape returns focus, Tab out closes, a click outside closes, one band closes the other, the views, the card yields Escape, the fold under 480, signed out nothing throws) and `index.probes.json` (10, the landing).
+A **probes file** (`<surface>/<page>.probes.json`) is a sequence: each probe opens the page (or continues the previous probe's page with `"continue": true`), drives steps from the same action vocabulary, and states what must be true with the same expectations. An uncaught page error during a probe fails it. The disclosure contract ships first — `modules/public-landing/public/projects.probes.json` (24 probes: Enter opens on the first item, arrows cycle and skip hidden cells, Escape returns focus, Tab out closes, a click outside closes, one band closes the other, the views, the card yields Escape, the fold under 480, signed out nothing throws) and `index.probes.json` (10, the landing).
 
 ## 4. Read the shots, fix in one batch, re-run once
 

package/modules/copy-desk/tests/copy_flags.mjs

@@ -32,7 +32,7 @@ const FAKE = {
   counts: { strings: 3, unique_ids: 2, certain: 3, heuristic: 0, duplicate_ids: 1 },
   surfaces: {
     'builders-hall': { at: 'modules/hall-ui/public', files: 2, strings: 2 },
-    landing: { at: 'public-landing', files: 1, strings: 1 },
+    landing: { at: 'modules/public-landing/public', files: 1, strings: 1 },
   },
   duplicates: [
     { id: 'dup1', surface: 'builders-hall', text: 'Could not save.', occurrences: 2,
@@ -41,7 +41,7 @@ const FAKE = {
   entries: [
     { id: 'dup1', surface: 'builders-hall', text: 'Could not save.', file: 'modules/hall-ui/public/a.js', line: 10, origin: 'js-notice', confidence: 'certain' },
     { id: 'dup1', surface: 'builders-hall', text: 'Could not save.', file: 'modules/hall-ui/public/b.js', line: 20, origin: 'js-notice', confidence: 'certain' },
-    { id: 'solo', surface: 'landing', text: 'Enter the future.', file: 'public-landing/index.html', line: 4, origin: 'html-text', confidence: 'certain' },
+    { id: 'solo', surface: 'landing', text: 'Enter the future.', file: 'modules/public-landing/public/index.html', line: 4, origin: 'html-text', confidence: 'certain' },
   ],
 };
 const INDEX = registry.indexRegistry(FAKE);
@@ -137,7 +137,7 @@ await test('the snapshot is taken from the registry', () => {
   const r = ok({ scope: 'string', surface: 'landing', string_id: 'solo', reason: GOOD_REASON });
   assert.equal(r.ok, true);
   assert.equal(r.value.text_at_flag, 'Enter the future.');
-  assert.equal(r.value.file_at_flag, 'public-landing/index.html');
+  assert.equal(r.value.file_at_flag, 'modules/public-landing/public/index.html');
   assert.equal(r.value.line_at_flag, 4);
   assert.equal(r.value.registry_schema, 1);
 });
@@ -153,7 +153,7 @@ await test('a caller-supplied snapshot is IGNORED', () => {
   });
   assert.equal(r.ok, true);
   assert.equal(r.value.text_at_flag, 'Enter the future.');
-  assert.equal(r.value.file_at_flag, 'public-landing/index.html');
+  assert.equal(r.value.file_at_flag, 'modules/public-landing/public/index.html');
   assert.equal(r.value.line_at_flag, 4);
 });
 

package/modules/public-landing/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/public-landing/module.json

@@ -0,0 +1,15 @@
+{
+  "key": "public-landing",
+  "title": "The front door",
+  "description": "The instance's public front door served at the APEX ROOT — the landing page (/), the projects hub (/projects, and the /create redirect into its ?view=new wizard), the three footer doors (/privacy, /terms, /contact) and every asset behind them. The third WEB-SURFACE core-domain module after status-ui (BV1.R84) and hall-ui (BV1.R85), carved in task 1003322 (ADR 0218; named in ADR 0197 §8 — the front door keeps its own key, because a customer of the ui-design capability is not part of it). default-on: an instance ships its front door like it ships its hall. Registers no port and contributes no routes — it declares a webSurface, and where hall-ui and status-ui name a Host PREFIX this one declares apexRoot:true, since the apex is whatever host is left once the subdomains are taken (ADR 0218 §2; host:\"\" is rejected, because every host string startsWith \"\"). Like the hall, the declaration is the discovery + scope-map + window.__MODULES__ record: the bytes are served by platform-server.js's dedicated landing block, which keeps the apex-only sentinel strip, the branding-token stamp and the ?v= content stamp and only re-points its root at this module's public/ dir. Disabling the module removes the front door outright — the apex then answers the game-less 404 tail. The world it renders (DESIGN.md, the token contract, the direction records) is the INSTANCE's; the method for building one stays in modules/ui-design/.",
+  "coreVersion": "^1.19.0",
+  "default": true,
+  "maintenance": { "status": "core-maintained" },
+  "contributes": {
+    "webSurfaces": [
+      { "apexRoot": true, "dir": "public" }
+    ]
+  },
+  "provides": [],
+  "consumes": []
+}

package/modules/ui-design/kit/lib.js

@@ -53,7 +53,7 @@ function normalizePageArg(page) {
   if (typeof page === 'string' && /^[A-Za-z]:[\\/]/.test(page) && /[\\/]$/.test(page)) return '/';
   return page;
 }
-// A surface is a directory of the checkout: 'public-landing', 'modules/<key>/public',
+// A surface is a directory of the checkout ('modules/<key>/public') or a module KEY
 // or a module KEY whose manifest declares a webSurfaces dir. Nothing is hardcoded.
 function resolveSurfaceDir(surface, root = REPO_ROOT) {
   if (!surface) return null;
@@ -234,7 +234,7 @@ function reducedMotionProblems({ running = [], frames = 0 } = {}) {
 }
 
 // ── the states file ───────────────────────────────────────────────────────────
-// { "page": "/projects", "surface"?: "public-landing", "stub"?: { prefix?, child? },
+// { "page": "/projects", "surface"?: "public-landing" (a module key), "stub"?: { prefix?, child? },
 //   "modes"?: ["dark" | "light", …] (the modes the page renders; default both — a page that pins
 //   one mode declares it here), "modeQuery"?: "mode" | false, "ignoreRequests"?: [regex strings], "ignoreConsole"?: [...],
 //   stub.fixtures?: { "<fixture name>": "<other fixture file>" } (serve another file under a name — an empty list, a

package/modules/ui-design/kit/render.js

@@ -8,7 +8,7 @@
 // through two stubs this file starts itself (signed out, signed in), then a
 // reduced-motion pass per mode. Writes the shots + a JSON report; exits non-zero on any problem.
 //
-//   node modules/ui-design/kit/render.js --page /projects              (public-landing/projects.states.json)
+//   node modules/ui-design/kit/render.js --page /projects              (surface defaults to the public-landing module key)
 //   node modules/ui-design/kit/render.js --page /builders/ranks --surface hall-ui
 //   node modules/ui-design/kit/render.js --states <file>               (explicit file)
 //     --modes dark,light  --sizes 1440,390,320  --only a,b  --out <dir>

package/modules/ui-design/kit/serve.js

@@ -10,9 +10,9 @@
 // fixtures/ so a page boots with real-shaped data and no database. Serves docs/
 // raw so a mock under docs/design/mocks/ renders with its relative links.
 //
-//   node modules/ui-design/kit/serve.js                  -> http://127.0.0.1:3412/  (public-landing)
-//   SURFACE=<dir or module key>   a checkout dir ("public-landing", "modules/hall-ui/public") or a
-//                                 module key whose manifest declares a webSurfaces dir
+//   node modules/ui-design/kit/serve.js                  -> http://127.0.0.1:3412/  (the public-landing module)
+//   SURFACE=<dir or module key>   a checkout dir ("modules/hall-ui/public") or a module
+//                                 key ("public-landing") whose manifest declares a webSurfaces dir
 //   PREFIX=/builders/             the URL prefix the surface's pages + assets are served under
 //   STUB_REPO=<checkout>          the checkout to serve (default: the one this file sits in)
 //   STUB_PORT=<n>                 default 3412 (0 = any free port; the port is printed)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.442",
+  "version": "1.19.444",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.442",
+      "version": "1.19.444",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.442",
+  "version": "1.19.444",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -54,12 +54,12 @@ const REPORT_REL = 'docs/copy-inventory.md';
 const SURFACES = [
   { id: 'builders-hall', kind: 'dir', at: 'modules/hall-ui/public', exts: ['.html', '.js'] },
   { id: 'status-dashboard', kind: 'dir', at: 'modules/status-ui/public', exts: ['.html', '.js'] },
-  // THE LANDING SURFACE IS public-landing/, NOT src/platform-server.js. The first
+  // THE LANDING SURFACE IS modules/public-landing/public/, NOT src/platform-server.js. The first
   // cut pointed here at the server file, which only fs.readFileSync's these
   // templates — so its JS patterns matched a handful of incidental literals and the
   // page's ACTUAL copy (hero, meta/og text, every section) was silently absent
   // while the registry reported a number. Caught by the grader on task 1003112.
-  { id: 'landing', kind: 'dir', at: 'public-landing', exts: ['.html'] },
+  { id: 'landing', kind: 'dir', at: 'modules/public-landing/public', exts: ['.html'] },
 ];
 
 // Attributes whose value is COPY a person reads (not wiring). The matchers are
@@ -70,7 +70,7 @@ const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${att
 // What this tool knowingly does not see. Printed in the report — an inventory that
 // implies completeness it does not have is worse than a short one.
 const BLIND_SPOTS = [
-  'Landing-page transforms: `public-landing/*.html` is scanned as authored, but the server rewrites it before a visitor sees it — `{{token}}` placeholders are filled from the branding pack, and `<!--apex-only:start--> … <!--apex-only:end-->` sections are STRIPPED on a child instance (src/platform-server.js `landingPage()`). So a row here may be copy that this instance never renders, and a rendered sentence may differ from its authored form.',
+  'Landing-page transforms: `modules/public-landing/public/*.html` is scanned as authored, but the server rewrites it before a visitor sees it — `{{token}}` placeholders are filled from the branding pack, and `<!--apex-only:start--> … <!--apex-only:end-->` sections are STRIPPED on a child instance (src/platform-server.js `landingPage()`). So a row here may be copy that this instance never renders, and a rendered sentence may differ from its authored form.',
   'Server-side messages: route failures (`res.fail` reasons), validation text and API error copy live in server JS and are not walked here. A person reads them, so widening to them is a deliberate later step, not an oversight to quietly fix.',
   'Skill and playbook prose: `.claude/skills/**/SKILL.md` is read by agents and by builders and is arguably the largest body of project voice. Out of scope on purpose — it is not UI, and mixing it in would drown the UI signal.',
   'Discord copy: outbound broadcast text is composed in `modules/discord/*.js` at send time. User-facing, but not part of any UI surface.',

package/scripts/gds/fitness-checks-identity.js

@@ -141,11 +141,27 @@ const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'i
 // silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
 const { stripCommentsForIdentity } = require('./identity-strip');
 
+// An APEX-ONLY region is content the server DELETES on every instance that is not
+// the hub (`stripApexOnly`, src/platform-server.js — ADR 0152; the front door became
+// a module in ADR 0218, which is what first brought these pages under this gate).
+// This check exists so "a non-OTB instance renders ITS OWN brand"; text inside these
+// sentinels never reaches a non-hub instance at all, so it cannot produce that
+// failure. The hub's own landing legitimately NAMES the projects hosted on it, and
+// that catalog is exactly what the sentinels wrap.
+//
+// BLANKED, not removed, so a violation's reported line number still points at the
+// real line. Applied BEFORE the comment strip, which would otherwise eat the
+// sentinels (they are HTML comments) and take the region's boundaries with them.
+const APEX_ONLY_REGION = /<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g;
+function blankApexOnly(text) {
+  return String(text).replace(APEX_ONLY_REGION, (m) => m.replace(/[^\n]/g, ' '));
+}
+
 // Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
 // Returns violation strings. Exported for the "actually catches a re-hardcode" test.
 function scanPromptIdentity(relFile, text, ext = path.extname(relFile)) {
   const violations = [];
-  stripCommentsForIdentity(text, ext).split('\n').forEach((raw, i) => {
+  stripCommentsForIdentity(blankApexOnly(text), ext).split('\n').forEach((raw, i) => {
     if (!raw.trim()) return;
     for (const re of PROMPT_IDENTITY_LITERALS) {
       const m = raw.match(re);
@@ -318,4 +334,5 @@ module.exports = {
   collectIdentityFiles,
   scanPromptIdentity,
   stripCommentsForIdentity,
+  blankApexOnly,           // ADR 0218 — apex-only regions never reach a child instance (tested)
 };

package/scripts/gds/publish-manifest.js

@@ -66,6 +66,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/ui-design/',      // the design contract + its adapters/CLIs + the /design playbook (task 1003324, ADR 0197). default:true, so it MUST be here: a released core without it would materialize skills (design, design-sync, figma-design-sync) whose CLIs and adapters do not exist.
   'modules/hall-ui/',
   'modules/status-ui/',
+  'modules/public-landing/', // the front door (task 1003322, ADR 0218) — the repo-root public-landing/ entry this replaces was always here, and for the same reason: default:true, and it is the only thing an instance serves at its apex root. Omit it and a released core answers the game-less 404 tail on its own home page.
   'modules/dev-box/',
   'modules/discord/',
   'modules/provisioning/',   // instance-hosting control plane — CORE like its sibling dev-box (same do-api/cf-tunnel toolchain, all core). Reclassified IN so the core CLI scripts/gds/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
@@ -137,7 +138,6 @@ const PUBLISH_ALLOWLIST = [
   '.gitattributes',
   'package.json',
   'package-lock.json',
-  'public-landing/',
   // --- served-at-runtime app assets a standalone MUST carry (task 2078) ---
   // The generated typed API client is served at /lib/bongos-client.js as
   // window.BongosClient; shell.js + builders.js call it at the TOP of every hall