@bongos/core 1.19.520 → 1.19.522

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.520",
-  "core_contract": "1.19.520",
-  "source_commit": "0b8a696f772ade91f8d36d53dece40421efe5b80",
+  "core_version": "1.19.522",
+  "core_contract": "1.19.522",
+  "source_commit": "92092ec628e083687975fa5e95fb265de9a8207e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T21:58:56.926Z",
+  "built_at": "2026-09-03T22:53:47.818Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 431,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2424,
-  "tree_sha256": "9c5de15455eed40571117e977c54f1970629a306a7334b87f1327361cde79375",
+  "tree_sha256": "d22107181dac247687534d9fb4f029fe0db9c6c4f47823d6094370bbeabdbb17",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "53c9b5ab7fac89d337952508b1d3b649d48c8ce68c69542d7bc12bdb2847ca75"
+      "sha256": "fe33a40bdc240cb71aacdafac48a3dd4c68ca1b19ca6362062d9199078e67291"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4942,7 +4942,7 @@
     {
       "path": "modules/hall-ui/public/profile.css",
       "mode": "0000644",
-      "sha256": "2d3b4596ce8cbafcaef71d2882351c764a030bdbfeee51192136ec7f17c86475"
+      "sha256": "1243e933c4ff11e491bac6f1791f269cc80722d6bdceeae7e5dbc1dda5c91324"
     },
     {
       "path": "modules/hall-ui/public/profile.html",
@@ -4957,7 +4957,7 @@
     {
       "path": "modules/hall-ui/public/profile.states.json",
       "mode": "0000644",
-      "sha256": "d981e8d2b50d04d4b0e5cfecd051d2a5b77d7aeac532c712a3b5d269defbd3ce"
+      "sha256": "3df74097937e52577f25255a4612b7be93effc491bc32f2f6bc81ddb91b28929"
     },
     {
       "path": "modules/hall-ui/public/ranks.html",
@@ -5077,7 +5077,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "2b9c0df306a1749975b101e2ac0af36fa72f78d633a187bd32dba0e5beb4bdfc"
+      "sha256": "41aae0ec3164d3f0e4d485ad029c98980b2d18e791a04aa4e7714ba94e776ef9"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -7297,12 +7297,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "23214b713047eeeb22c4a48cabff0d29f24cf56e036c92878db86f628b6ba8d2"
+      "sha256": "1c07f40246b9843cd33e0ae1919777d03202ef9417c01df75f52225a5ff077f4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c8758322c6d80615ad5dccdc9ac9493299105cf0edf15510e5c30fcb4ed9d15"
+      "sha256": "e2b8034f586a5cbd4f4d3c0608ff071d4996f5978c4e6c2212b19d944074170f"
     },
     {
       "path": "public-docs/index.html",
@@ -7702,7 +7702,7 @@
     {
       "path": "scripts/gds/fetch-sound-prefs.js",
       "mode": "0000644",
-      "sha256": "30b30ed76d772e3f2a1b74791b9de08db9ea782258e8e818c34ce3037bff7912"
+      "sha256": "ea36d22031b18f2682ca2e1475a556b21fc2b5817de1f94d872e947247553144"
     },
     {
       "path": "scripts/gds/figma-design-sync.js",
@@ -8972,7 +8972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4f10f2246fe56fc5cd7e786de45b5f5bb4268bb62a59755428d6d91088f397b7"
+      "sha256": "dd2581cc2940a4437b04c711209413036d97339a6e41e9b1cfb27c78ec5d4c14"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10357,7 +10357,7 @@
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",
-      "sha256": "a7e7fceda066fbb6a279d3e249afbb29ac225396f16b377cc910854d5ef35165"
+      "sha256": "de4b33fd78de12daf1b6e07eeb3834ffd19e912ea81c1d2ba91a129a19e7382a"
     },
     {
       "path": "tests/hall_board_world.mjs",
@@ -10412,7 +10412,7 @@
     {
       "path": "tests/hall_profile_world.mjs",
       "mode": "0000644",
-      "sha256": "b35d647c4cb7b90be70dee8e7245396cc901479992fafbf19ceef734d8195399"
+      "sha256": "d35886df220d7726011bc0d61ae85a273a4e9f9ee14c5d10f0a0753f4cfee4eb"
     },
     {
       "path": "tests/hall_reading_world.mjs",
@@ -10822,7 +10822,7 @@
     {
       "path": "tests/memory_pull.mjs",
       "mode": "0000644",
-      "sha256": "22f442f147994e81aed89692fdfd777bd6132448f6dc64019b5474533f75dbc8"
+      "sha256": "d05b6e354ac08cf5512a62b76b213df44ab1ef8639a1ba635319e9b5e8511a5c"
     },
     {
       "path": "tests/merge_lease.mjs",

package/docs/module-api-changelog.md

@@ -1477,5 +1477,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.518 with no explicit bump. run 33802471495. (task 1002620)
   1.19.520 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.519 with no explicit bump. run 33810716476. (task 1002620)
+  1.19.521 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.520 with no explicit bump. run 33813285951. (task 1002620)
+  1.19.522 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.521 with no explicit bump. run 33815020928. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/profile.css

@@ -70,7 +70,12 @@
 #activity-scroll .ledger td a,
 #charts-scroll a,
 #works-scroll .scroll__lede a,
-#xp-scroll a {
+#xp-scroll a,
+/* The signed-out empty state (renderEmpty) — two links inside a prose
+   sentence. --fixture-me always answers /me, so this markup never
+   rendered in the re-skin's passes and its links stayed 18px (walk
+   1003309). Joining the list keeps ONE recipe, not a second copy. */
+#profile-head .profile__placeholder a {
   display: inline-block;
   min-width: 24px;
   min-height: 24px;

package/modules/hall-ui/public/profile.states.json

@@ -89,6 +89,7 @@
       }
     },
     "out": {
+      "_": "A signed-out visitor with no ?id= gets renderEmpty(), not a bounce — but this state only RENDERS that empty markup against the kit's own stub. Run it WITHOUT --base-out: under the hall-preview harness's --fixture-me the /me read still answers, so `out` quietly renders the viewer's own populated profile and the empty state is never measured. That is how its two prose links sat at 18px, under the 24px control floor, through the whole re-skin (walk 1003309, fixed in task 1003497).",
       "auth": false,
       "actions": [
         [

package/modules/hall-ui/public/style.css

@@ -3203,6 +3203,17 @@ a.stat-tile:hover .stat-tile__sub { color: var(--ink-soft); }
   outline: none;
 }
 .palette__input::placeholder { color: var(--ink-faint); }
+/* palette.js auto-focuses this on open, so the ring is the first thing a
+   keyboard user needs — and it had none. .palette__panel clips (overflow:
+   hidden), which ate the world's ring (a 3px-offset outline inside an 8px
+   halo) and is why the outline was dropped here in the first place. So the
+   indication moves INSIDE the input's own box — the same inset form the 64px
+   rail's items use, for the same reason (task 1003496). */
+.palette__input:focus-visible {
+  outline: 2px solid var(--focus);
+  outline-offset: -2px;
+  box-shadow: none;
+}
 .palette__list {
   list-style: none;
   margin: 0;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.520",
+  "version": "1.19.522",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.520",
+      "version": "1.19.522",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.520",
+  "version": "1.19.522",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fetch-sound-prefs.js

@@ -85,4 +85,7 @@ async function main() {
   }
 }
 
-main().then(() => process.exit(0)).catch(() => process.exit(0));
+// No process.exit: calling it while undici is still tearing down the fetches above
+// aborts this hook on Windows with the win/async.c UV_HANDLE_CLOSING assertion, so
+// SessionStart reports a hook error. Nothing else holds the loop — it exits on its own.
+main().catch(() => {});

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.520'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.522'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_audit.mjs

@@ -452,3 +452,78 @@ test('the verdict classes and the scrim exist in the token tier, in both modes',
   assert.match(css, /--scrim:/, 'the modal scrim is a token, not a sheet-local literal');
   assert.match(read('copy-desk.css'), /::backdrop\s*\{[^}]*var\(--scrim\)/, 'the copy-desk backdrop takes it');
 });
+
+// ---- 10. an outline: none always names its replacement (task 1003496) -----
+
+// The walk (task 1003309) found the command palette's input dropping the
+// world's focus ring with nothing put back — and palette.js AUTO-FOCUSES it on
+// open, so a keyboard user landed in a field with no indication of where they
+// were. A rule may drop the outline; it may not drop the INDICATION. The
+// exceptions are selectors that are not keyboard stops at all.
+const OUTLINE_NONE_EXEMPT = {
+  main: 'the skip link\'s programmatic target — main takes tabindex="-1" focus so the reader lands past the nav, and ringing the whole page would be noise, not information',
+};
+
+// Innermost rule blocks only, so a rule inside @media is read as itself and the
+// wrapping at-rule is never mistaken for a selector.
+function rulesDeclaring(css, decl) {
+  const out = [];
+  const clean = css.replace(/\/\*[\s\S]*?\*\//g, '');
+  for (const m of clean.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+    if (decl.test(m[2])) out.push(m[1].trim().replace(/\s+/g, ' '));
+  }
+  return out;
+}
+
+const OUTLINE_OFF = /outline\s*:\s*(none|0)\s*[;}]|outline\s*:\s*(none|0)\s*$/;
+// The base a focus rule would be written against: `.x:focus` and `.x` both want
+// a `.x:focus-visible`.
+const baseSelectors = (sel) =>
+  sel.split(',').map((s) => s.trim().replace(/:(focus-visible|focus-within|focus|hover|active)\b/g, '').trim()).filter(Boolean);
+
+function unringed(sheets) {
+  const all = sheets.map(([, css]) => css).join('\n');
+  const offenders = [];
+  for (const [file, css] of sheets) {
+    for (const rule of rulesDeclaring(css, OUTLINE_OFF)) {
+      for (const base of baseSelectors(rule)) {
+        if (OUTLINE_NONE_EXEMPT[base]) continue;
+        // The replacement may live in any hall sheet — they all load together.
+        if (all.includes(base + ':focus-visible')) continue;
+        offenders.push(`${file}: "${rule}" drops the outline with no ${base}:focus-visible`);
+      }
+    }
+  }
+  return offenders;
+}
+
+const hallSheets = () =>
+  fs.readdirSync(HALL).filter((f) => f.endsWith('.css')).sort().map((f) => [f, read(f)]);
+
+test('no hall sheet drops a focus ring without putting an indication back', () => {
+  assert.deepEqual(unringed(hallSheets()), [],
+    'outline: none is allowed only next to a :focus-visible replacement for the same selector');
+});
+
+test('the focus-ring guard CATCHES a suppression, and reads a replacement', () => {
+  const bad = [['x.css', '.thing { outline: none; }']];
+  assert.equal(unringed(bad).length, 1, 'a bare suppression is caught');
+  const paired = [['x.css', '.thing { outline: none; }\n.thing:focus-visible { outline: 2px solid var(--focus); }']];
+  assert.deepEqual(unringed(paired), [], 'a replacement in the same sheet satisfies it');
+  const crossSheet = [['a.css', '.thing { outline: none; }'], ['b.css', '.thing:focus-visible { outline: 2px solid var(--focus); }']];
+  assert.deepEqual(unringed(crossSheet), [], 'the hall loads its sheets together, so the replacement may sit in another one');
+  const media = [['x.css', '@media (min-width: 900px) { .thing { outline: none; } }']];
+  assert.equal(unringed(media).length, 1, 'a rule inside @media is read as itself, not as the at-rule');
+});
+
+test('the command palette input rings from the token tier, inside its own box', () => {
+  const css = read('style.css');
+  const rule = /\.palette__input:focus-visible\s*\{([^}]*)\}/.exec(css);
+  assert.ok(rule, '.palette__input:focus-visible exists');
+  assert.match(rule[1], /var\(--focus\)/, 'the ring is the world\'s --focus, which style.css redefines per mode');
+  // .palette__panel clips (overflow: hidden), which is WHY the global ring — a
+  // 3px-offset outline inside an 8px halo — was suppressed here. The
+  // replacement has to sit INSIDE the input's box or the panel eats it.
+  assert.match(css, /\.palette__panel\s*\{[^}]*overflow:\s*hidden/, 'the panel still clips, so the inset form is still the right one');
+  assert.match(rule[1], /outline-offset:\s*-|inset/, 'the indication sits inside the input, not outside it');
+});

package/tests/hall_profile_world.mjs

@@ -456,3 +456,41 @@ test('the profile states file renders each rail key, so the floors cover every s
   assert.equal(states.states.activity.url, '/profile#activity');
   assert.ok(states.states.activity.expect.visible.includes('#activity-tabs'));
 });
+
+// ---- the signed-out empty state (task 1003497) -------------------------------
+
+// renderEmpty() is what a visitor with NO session and no ?id= sees. The
+// hall-preview harness always answers /me, so under --fixture-me the `out`
+// state renders the viewer's own profile and this markup never appeared in the
+// re-skin's own passes — its two prose links were 18px tall on every render
+// until the walk (task 1003309) put the state through the kit's own stub.
+test('the signed-out empty state carries two prose links, and they take the 24px recipe', () => {
+  const empty = /function renderEmpty\(\)[\s\S]*?\n  \}/.exec(profileJs);
+  assert.ok(empty, 'renderEmpty() present');
+  assert.match(empty[0], /class="profile__placeholder"/, 'the empty state is the placeholder block');
+  const links = empty[0].match(/<a\s[^>]*href=/g) || [];
+  assert.equal(links.length, 2, 'two prose links: the roster, and sign in');
+
+  // The recipe is ONE rule, shared. The empty state must join that selector
+  // list rather than grow a second copy of the same five declarations.
+  const recipe = /#works-scroll \.ledger td a,[\s\S]*?\{([^}]*)\}/.exec(profileCss);
+  assert.ok(recipe, 'the prose-link recipe block is findable');
+  assert.match(recipe[0], /#profile-head \.profile__placeholder a\b/,
+    'the empty state\'s links are IN the shared recipe, not a separate rule');
+  assert.match(recipe[1], /min-height:\s*24px/, 'the recipe buys the height');
+  assert.match(recipe[1], /min-width:\s*24px/, 'and the width');
+  assert.match(recipe[1], /display:\s*inline-block/, 'which an inline anchor cannot take without this');
+});
+
+test('the out state says out loud that it only renders empty against the kit stub', () => {
+  const states = JSON.parse(read('profile.states.json'));
+  const out = states.states.out;
+  assert.equal(out.auth, false, 'out is the signed-out state');
+  // The file-level `_` said this in its last clause and it was still missed —
+  // which is how the state went unmeasured. The warning belongs ON the state a
+  // reader is about to run.
+  assert.ok(out._ && /stub/i.test(out._),
+    'the out state carries its own note naming the kit stub as the only way it renders empty');
+  assert.ok(/fixture-me/.test(out._),
+    'and names --fixture-me as the thing that hides the empty state');
+});

package/tests/memory_pull.mjs

@@ -23,9 +23,11 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { spawnSync } from 'node:child_process';
 
 const require = createRequire(import.meta.url);
 const pull = require('../.claude/hooks/pull-memory.js');
+const hookPath = require.resolve('../.claude/hooks/pull-memory.js');
 
 let passed = 0;
 let failed = 0;
@@ -186,6 +188,17 @@ test('encodeProjectPath: replaces / and . with -', () => {
   assert.equal(pull.encodeProjectPath('/Users/x/Desktop/Claude-OTB'), '-Users-x-Desktop-Claude-OTB');
 });
 
+// The old /[/.]/ class silently no-opped on a Windows path — separator, drive
+// colon and spaces all survived, so resolveMemoryDir built a path with a drive
+// letter buried mid-string that no mkdir could create and every file "failed"
+// (task 1003567). Must match the encoder in scripts/gds/ship-memory-sync.js.
+test('encodeProjectPath: Windows path — separator, drive colon and spaces all become -', () => {
+  assert.equal(
+    pull.encodeProjectPath(String.raw`C:\Users\x\Desktop\Cloud Bongos\cloud-bongos`),
+    'C--Users-x-Desktop-Cloud-Bongos-cloud-bongos',
+  );
+});
+
 test('tsToMs: ISO string, epoch ms, Date, and garbage', () => {
   assert.equal(pull.tsToMs('2026-05-30T00:00:00Z'), Date.parse('2026-05-30T00:00:00Z'));
   assert.equal(pull.tsToMs(1234), 1234);
@@ -413,14 +426,20 @@ await testAsync('pullMemory: 0 written + skips → summary does not read like a
 });
 
 await testAsync('pullMemory: no session → silent null', async () => {
+  // cli-lib freezes its session-file paths at require time, so an in-process
+  // HOME swap cannot unsee a real session — this must run in a FRESH process
+  // with a stubbed home, or it silently passes only where no session exists
+  // (i.e. CI) and fires a REAL network pull on a signed-in box (task 1003567).
   const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-pull-nosess-'));
-  const origHome = process.env.HOME;
-  process.env.HOME = tmpHome;
   try {
-    const r = await pull.pullMemory({ startCwd: process.cwd() });
-    assert.equal(r, null);
+    const child = spawnSync(
+      process.execPath,
+      ['-e', 'require(process.argv[1]).pullMemory({ startCwd: process.argv[2] }).then((r) => console.log(JSON.stringify(r)))', hookPath, process.cwd()],
+      { env: { ...process.env, HOME: tmpHome, USERPROFILE: tmpHome }, encoding: 'utf8' },
+    );
+    assert.equal(child.status, 0, `child exited ${child.status}: ${child.stderr}`);
+    assert.equal(child.stdout.trim(), 'null', `expected null, got: ${child.stdout.trim()}`);
   } finally {
-    process.env.HOME = origHome;
     fs.rmSync(tmpHome, { recursive: true, force: true });
   }
 });