@bongos/core 1.19.521 → 1.19.522

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.521",
-  "core_contract": "1.19.521",
-  "source_commit": "e4f2e1b87d89acb6c50a86896af501eff629a49f",
+  "core_version": "1.19.522",
+  "core_contract": "1.19.522",
+  "source_commit": "92092ec628e083687975fa5e95fb265de9a8207e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T22:32:55.137Z",
+  "built_at": "2026-09-03T22:53:47.818Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 431,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2424,
-  "tree_sha256": "5cf629aad21665a1b205bb6529f9103bde6140bdaa5d5bb8bb950677b588c058",
+  "tree_sha256": "d22107181dac247687534d9fb4f029fe0db9c6c4f47823d6094370bbeabdbb17",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f19fae1616ebe6fcb885f54592364bc673ed8df8ac23c857377c7959490c87b6"
+      "sha256": "fe33a40bdc240cb71aacdafac48a3dd4c68ca1b19ca6362062d9199078e67291"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4942,7 +4942,7 @@
     {
       "path": "modules/hall-ui/public/profile.css",
       "mode": "0000644",
-      "sha256": "2d3b4596ce8cbafcaef71d2882351c764a030bdbfeee51192136ec7f17c86475"
+      "sha256": "1243e933c4ff11e491bac6f1791f269cc80722d6bdceeae7e5dbc1dda5c91324"
     },
     {
       "path": "modules/hall-ui/public/profile.html",
@@ -4957,7 +4957,7 @@
     {
       "path": "modules/hall-ui/public/profile.states.json",
       "mode": "0000644",
-      "sha256": "d981e8d2b50d04d4b0e5cfecd051d2a5b77d7aeac532c712a3b5d269defbd3ce"
+      "sha256": "3df74097937e52577f25255a4612b7be93effc491bc32f2f6bc81ddb91b28929"
     },
     {
       "path": "modules/hall-ui/public/ranks.html",
@@ -7297,12 +7297,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b18f028ece28c2fd6605db03201f068504d5b57a2a402d79f2f28bad551e2ddc"
+      "sha256": "1c07f40246b9843cd33e0ae1919777d03202ef9417c01df75f52225a5ff077f4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d6b8d673c517a74dc369500ba850c49d367d860455f97c3a265525c5588057a4"
+      "sha256": "e2b8034f586a5cbd4f4d3c0608ff071d4996f5978c4e6c2212b19d944074170f"
     },
     {
       "path": "public-docs/index.html",
@@ -8972,7 +8972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "192a36ccb6a9fb1b60332dda5c8ad12c5b53d104d9f9554d72505645ed66d7d3"
+      "sha256": "dd2581cc2940a4437b04c711209413036d97339a6e41e9b1cfb27c78ec5d4c14"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10412,7 +10412,7 @@
     {
       "path": "tests/hall_profile_world.mjs",
       "mode": "0000644",
-      "sha256": "b35d647c4cb7b90be70dee8e7245396cc901479992fafbf19ceef734d8195399"
+      "sha256": "d35886df220d7726011bc0d61ae85a273a4e9f9ee14c5d10f0a0753f4cfee4eb"
     },
     {
       "path": "tests/hall_reading_world.mjs",

package/docs/module-api-changelog.md

@@ -1479,5 +1479,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.519 with no explicit bump. run 33810716476. (task 1002620)
   1.19.521 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.520 with no explicit bump. run 33813285951. (task 1002620)
+  1.19.522 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.521 with no explicit bump. run 33815020928. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/profile.css

@@ -70,7 +70,12 @@
 #activity-scroll .ledger td a,
 #charts-scroll a,
 #works-scroll .scroll__lede a,
-#xp-scroll a {
+#xp-scroll a,
+/* The signed-out empty state (renderEmpty) — two links inside a prose
+   sentence. --fixture-me always answers /me, so this markup never
+   rendered in the re-skin's passes and its links stayed 18px (walk
+   1003309). Joining the list keeps ONE recipe, not a second copy. */
+#profile-head .profile__placeholder a {
   display: inline-block;
   min-width: 24px;
   min-height: 24px;

package/modules/hall-ui/public/profile.states.json

@@ -89,6 +89,7 @@
       }
     },
     "out": {
+      "_": "A signed-out visitor with no ?id= gets renderEmpty(), not a bounce — but this state only RENDERS that empty markup against the kit's own stub. Run it WITHOUT --base-out: under the hall-preview harness's --fixture-me the /me read still answers, so `out` quietly renders the viewer's own populated profile and the empty state is never measured. That is how its two prose links sat at 18px, under the 24px control floor, through the whole re-skin (walk 1003309, fixed in task 1003497).",
       "auth": false,
       "actions": [
         [

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.521",
+  "version": "1.19.522",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.521",
+      "version": "1.19.522",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.521",
+  "version": "1.19.522",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.521'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.522'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_profile_world.mjs

@@ -456,3 +456,41 @@ test('the profile states file renders each rail key, so the floors cover every s
   assert.equal(states.states.activity.url, '/profile#activity');
   assert.ok(states.states.activity.expect.visible.includes('#activity-tabs'));
 });
+
+// ---- the signed-out empty state (task 1003497) -------------------------------
+
+// renderEmpty() is what a visitor with NO session and no ?id= sees. The
+// hall-preview harness always answers /me, so under --fixture-me the `out`
+// state renders the viewer's own profile and this markup never appeared in the
+// re-skin's own passes — its two prose links were 18px tall on every render
+// until the walk (task 1003309) put the state through the kit's own stub.
+test('the signed-out empty state carries two prose links, and they take the 24px recipe', () => {
+  const empty = /function renderEmpty\(\)[\s\S]*?\n  \}/.exec(profileJs);
+  assert.ok(empty, 'renderEmpty() present');
+  assert.match(empty[0], /class="profile__placeholder"/, 'the empty state is the placeholder block');
+  const links = empty[0].match(/<a\s[^>]*href=/g) || [];
+  assert.equal(links.length, 2, 'two prose links: the roster, and sign in');
+
+  // The recipe is ONE rule, shared. The empty state must join that selector
+  // list rather than grow a second copy of the same five declarations.
+  const recipe = /#works-scroll \.ledger td a,[\s\S]*?\{([^}]*)\}/.exec(profileCss);
+  assert.ok(recipe, 'the prose-link recipe block is findable');
+  assert.match(recipe[0], /#profile-head \.profile__placeholder a\b/,
+    'the empty state\'s links are IN the shared recipe, not a separate rule');
+  assert.match(recipe[1], /min-height:\s*24px/, 'the recipe buys the height');
+  assert.match(recipe[1], /min-width:\s*24px/, 'and the width');
+  assert.match(recipe[1], /display:\s*inline-block/, 'which an inline anchor cannot take without this');
+});
+
+test('the out state says out loud that it only renders empty against the kit stub', () => {
+  const states = JSON.parse(read('profile.states.json'));
+  const out = states.states.out;
+  assert.equal(out.auth, false, 'out is the signed-out state');
+  // The file-level `_` said this in its last clause and it was still missed —
+  // which is how the state went unmeasured. The warning belongs ON the state a
+  // reader is about to run.
+  assert.ok(out._ && /stub/i.test(out._),
+    'the out state carries its own note naming the kit stub as the only way it renders empty');
+  assert.ok(/fixture-me/.test(out._),
+    'and names --fixture-me as the thing that hides the empty state');
+});