@bongos/core 1.19.521 → 1.19.523

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.521",
-  "core_contract": "1.19.521",
-  "source_commit": "e4f2e1b87d89acb6c50a86896af501eff629a49f",
+  "core_version": "1.19.523",
+  "core_contract": "1.19.523",
+  "source_commit": "4d6bf53e6443bf737775e277080d2f14f574edad",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T22:32:55.137Z",
+  "built_at": "2026-09-03T23:12:58.339Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 431,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2424,
-  "tree_sha256": "5cf629aad21665a1b205bb6529f9103bde6140bdaa5d5bb8bb950677b588c058",
+  "tree_sha256": "baf1d9a541cc968505997bdc199995e36491ed289791585d1d3dcf1bb66ff004",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f19fae1616ebe6fcb885f54592364bc673ed8df8ac23c857377c7959490c87b6"
+      "sha256": "595be3b748b8664a50fcde28667fbe25e1cf43894753499e9f7b0bbf30518e89"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4942,7 +4942,7 @@
     {
       "path": "modules/hall-ui/public/profile.css",
       "mode": "0000644",
-      "sha256": "2d3b4596ce8cbafcaef71d2882351c764a030bdbfeee51192136ec7f17c86475"
+      "sha256": "1243e933c4ff11e491bac6f1791f269cc80722d6bdceeae7e5dbc1dda5c91324"
     },
     {
       "path": "modules/hall-ui/public/profile.html",
@@ -4957,7 +4957,7 @@
     {
       "path": "modules/hall-ui/public/profile.states.json",
       "mode": "0000644",
-      "sha256": "d981e8d2b50d04d4b0e5cfecd051d2a5b77d7aeac532c712a3b5d269defbd3ce"
+      "sha256": "3df74097937e52577f25255a4612b7be93effc491bc32f2f6bc81ddb91b28929"
     },
     {
       "path": "modules/hall-ui/public/ranks.html",
@@ -5077,7 +5077,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "41aae0ec3164d3f0e4d485ad029c98980b2d18e791a04aa4e7714ba94e776ef9"
+      "sha256": "f3d877972513fa23f2819a91f34c4901ca5e692faad6dcf096377a6b1d5b1be4"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -5152,7 +5152,7 @@
     {
       "path": "modules/hall-ui/public/work.states.json",
       "mode": "0000644",
-      "sha256": "c6356fe3a0640cddbe49ee2d91b30d6dece74ca58105067f1384d1e7d0718117"
+      "sha256": "929512f085f138f93170f643dbd68615dfbf6d5fcd5f0bf1abf30a081154b536"
     },
     {
       "path": "modules/ideas/CLAUDE.md",
@@ -7297,12 +7297,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b18f028ece28c2fd6605db03201f068504d5b57a2a402d79f2f28bad551e2ddc"
+      "sha256": "36fb0fa1abd3d8ec9b1bee4457ec3a8541e1b753aaaf9fcf93780ac65e3efc9a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d6b8d673c517a74dc369500ba850c49d367d860455f97c3a265525c5588057a4"
+      "sha256": "51c3aef45b0e71569102672d27df52abaff4814663a45da0731ac8b3e9557e0e"
     },
     {
       "path": "public-docs/index.html",
@@ -8972,7 +8972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "192a36ccb6a9fb1b60332dda5c8ad12c5b53d104d9f9554d72505645ed66d7d3"
+      "sha256": "aaf11ce9202e128bdcdd317e26a27a2d1f1ff1a7f73d6d996dc0a79f879ad3b6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10362,7 +10362,7 @@
     {
       "path": "tests/hall_board_world.mjs",
       "mode": "0000644",
-      "sha256": "b0ef3e407d7bd9266231dc089f1288ee40efb113e40333f79d3de4436db6cc21"
+      "sha256": "196742bcff58511c21c891011a48448ef95a292bd84dc164d3fccb2620de838a"
     },
     {
       "path": "tests/hall_catalog_world.mjs",
@@ -10412,7 +10412,7 @@
     {
       "path": "tests/hall_profile_world.mjs",
       "mode": "0000644",
-      "sha256": "b35d647c4cb7b90be70dee8e7245396cc901479992fafbf19ceef734d8195399"
+      "sha256": "d35886df220d7726011bc0d61ae85a273a4e9f9ee14c5d10f0a0753f4cfee4eb"
     },
     {
       "path": "tests/hall_reading_world.mjs",

package/docs/module-api-changelog.md

@@ -1479,5 +1479,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.519 with no explicit bump. run 33810716476. (task 1002620)
   1.19.521 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.520 with no explicit bump. run 33813285951. (task 1002620)
+  1.19.522 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.521 with no explicit bump. run 33815020928. (task 1002620)
+  1.19.523 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.522 with no explicit bump. run 33816191865. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/profile.css

@@ -70,7 +70,12 @@
 #activity-scroll .ledger td a,
 #charts-scroll a,
 #works-scroll .scroll__lede a,
-#xp-scroll a {
+#xp-scroll a,
+/* The signed-out empty state (renderEmpty) — two links inside a prose
+   sentence. --fixture-me always answers /me, so this markup never
+   rendered in the re-skin's passes and its links stayed 18px (walk
+   1003309). Joining the list keeps ONE recipe, not a second copy. */
+#profile-head .profile__placeholder a {
   display: inline-block;
   min-width: 24px;
   min-height: 24px;

package/modules/hall-ui/public/profile.states.json

@@ -89,6 +89,7 @@
       }
     },
     "out": {
+      "_": "A signed-out visitor with no ?id= gets renderEmpty(), not a bounce — but this state only RENDERS that empty markup against the kit's own stub. Run it WITHOUT --base-out: under the hall-preview harness's --fixture-me the /me read still answers, so `out` quietly renders the viewer's own populated profile and the empty state is never measured. That is how its two prose links sat at 18px, under the 24px control floor, through the whole re-skin (walk 1003309, fixed in task 1003497).",
       "auth": false,
       "actions": [
         [

package/modules/hall-ui/public/style.css

@@ -1526,6 +1526,12 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   display: flex;
   flex-direction: column;
   gap: 4px;
+  /* A flex item defaults to min-width:auto, i.e. it will not shrink below its
+     content — and a <select> sizes to its widest OPTION. At 320 that made the
+     goal filter 331px and pushed the whole PAGE sideways, since this row has
+     no scroller of its own the way .kit-tabs does (task 1003498). */
+  min-width: 0;
+  max-width: 100%;
   font-family: var(--label-face);
   font-size: var(--label-size);
   letter-spacing: var(--label-space);
@@ -1533,7 +1539,12 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   color: var(--ink-faint);
 }
 .filter select {
-  min-width: 150px;
+  /* The floor keeps the controls in a filter bar a uniform width — but a
+     bare 150px would itself refuse to shrink in a cell narrower than that,
+     which is the very failure this task is about. min() keeps the floor
+     wherever there is room and drops it where there is not. */
+  min-width: min(150px, 100%);
+  max-width: 100%;
   min-height: 32px;
   font-family: var(--font-body);
   padding: 4px 8px;
@@ -1545,7 +1556,8 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 /* task 1829: the Work Board free-text search box, sized to match the filter
    selects it sits alongside. */
 .filter input[type="search"] {
-  min-width: 200px;
+  min-width: min(200px, 100%);
+  max-width: 100%;
   min-height: 32px;
   font-family: var(--font-body);
   padding: 4px 8px;

package/modules/hall-ui/public/work.states.json

@@ -12,7 +12,7 @@
     "in-progress": { "auth": true, "url": "/builders/work#in-progress", "actions": [["wait", 400]], "expect": { "visible": ["#wip-scroll"] } },
     "backlog": { "auth": true, "url": "/builders/work#backlog", "actions": [["wait", 400]], "expect": { "visible": ["#backlog-scroll"] } },
     "completed": { "auth": true, "url": "/builders/work#completed", "actions": [["wait", 400]], "expect": { "visible": ["#history-scroll"] } },
-    "filters-open": { "auth": true, "actions": [["clickIfVisible", "#work-filters [aria-expanded=\"false\"]"], ["wait", 250]] },
+    "filters-open": { "_": "The drawer open — the state that catches a filter CONTROL refusing to shrink. A <select> sizes to its widest OPTION and .filter is a flex item, so at 320 the goal filter stood at 331px and pushed the whole PAGE sideways (scrollWidth 358) instead of scrolling in a row of its own the way .kit-tabs does. 320 is the width that shows it — 1440 and 390 stay clean either way (walk 1003309, fixed in task 1003498).", "auth": true, "actions": [["clickIfVisible", "#work-filters [aria-expanded=\"false\"]"], ["wait", 250]] },
     "out": { "auth": false }
   },
   "reducedMotion": { "auth": true }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.521",
+  "version": "1.19.523",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.521",
+      "version": "1.19.523",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.521",
+  "version": "1.19.523",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.521'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.523'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_board_world.mjs

@@ -429,3 +429,47 @@ test('RUN: the three notices are inbox lines with a kind, a line and — where o
   covered.api.renderProfile(ME.builder);
   assert.equal(covered.el('attention-system').innerHTML, '', 'a covered need is not an action');
 });
+
+// ---- 9. the filter drawer fits the narrowest phone (task 1003498) -----------
+
+// At 320 the goal select sized itself to its widest OPTION ("BONGOS-V1 —
+// general …") at 331px, and `.filter` — a flex item at the default
+// min-width:auto — could not shrink under it. Both sat with their right edge at
+// 357 inside a visible-overflow parent, so they pushed the PAGE sideways rather
+// than scrolling in a row of their own (walk 1003309). The status tab strip
+// overflows too, but its row is overflow-x:auto and scrolls itself, which is
+// why the fix belongs on the control and not on the drawer.
+const ruleFor = (css, selector) => {
+  const re = new RegExp(`(?:^|\\r?\\n)${selector.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\{([^}]*)\\}`);
+  const m = re.exec(css);
+  assert.ok(m, `${selector} rule present in style.css`);
+  return m[1];
+};
+
+test('a filter control may shrink below its content, so the drawer never pushes the page', () => {
+  const filter = ruleFor(styleCss, '.filter');
+  assert.match(filter, /min-width:\s*0\b/, '.filter is a flex item: min-width:auto is what pinned it to its content');
+  assert.match(filter, /max-width:\s*100%/, 'and it may not exceed the row it sits in');
+
+  // The select is the thing with the runaway intrinsic width. It keeps its
+  // 150px floor for wide screens — a filter narrower than that is unreadable —
+  // and gains a cap so a long option label cannot widen it past its cell.
+  const select = ruleFor(styleCss, '.filter select');
+  assert.match(select, /max-width:\s*100%/, 'the select is capped to its cell');
+  // The floor is expressed so it CANNOT itself pin the control: a bare 150px
+  // would refuse to shrink in a cell narrower than 150px, which is the same
+  // failure this task fixed one level up (grader nit, task 1003498).
+  assert.match(select, /min-width:\s*min\(150px,\s*100%\)/, 'the floor holds where there is room and drops where there is not');
+
+  // The free-text search box sits in the same wrapping row and would do the
+  // same thing at 320 with its 200px floor.
+  assert.match(ruleFor(styleCss, '.filter input[type="search"]'), /max-width:\s*100%/,
+    'the search box is capped the same way');
+});
+
+test('the tab strip is left alone — it scrolls in its own row and never moved the page', () => {
+  // Named so a later reader does not "fix" the wider element and miss the cause.
+  const strip = /\.setup__tabs\s*\{([^}]*)\}/.exec(styleCss) || /\.kit-tabs\s*\{([^}]*)\}/.exec(styleCss);
+  assert.ok(strip, 'the tab strip rule is present');
+  assert.match(strip[1], /overflow-x:\s*auto/, 'it scrolls itself, which is why it is not the overflow cause');
+});

package/tests/hall_profile_world.mjs

@@ -456,3 +456,41 @@ test('the profile states file renders each rail key, so the floors cover every s
   assert.equal(states.states.activity.url, '/profile#activity');
   assert.ok(states.states.activity.expect.visible.includes('#activity-tabs'));
 });
+
+// ---- the signed-out empty state (task 1003497) -------------------------------
+
+// renderEmpty() is what a visitor with NO session and no ?id= sees. The
+// hall-preview harness always answers /me, so under --fixture-me the `out`
+// state renders the viewer's own profile and this markup never appeared in the
+// re-skin's own passes — its two prose links were 18px tall on every render
+// until the walk (task 1003309) put the state through the kit's own stub.
+test('the signed-out empty state carries two prose links, and they take the 24px recipe', () => {
+  const empty = /function renderEmpty\(\)[\s\S]*?\n  \}/.exec(profileJs);
+  assert.ok(empty, 'renderEmpty() present');
+  assert.match(empty[0], /class="profile__placeholder"/, 'the empty state is the placeholder block');
+  const links = empty[0].match(/<a\s[^>]*href=/g) || [];
+  assert.equal(links.length, 2, 'two prose links: the roster, and sign in');
+
+  // The recipe is ONE rule, shared. The empty state must join that selector
+  // list rather than grow a second copy of the same five declarations.
+  const recipe = /#works-scroll \.ledger td a,[\s\S]*?\{([^}]*)\}/.exec(profileCss);
+  assert.ok(recipe, 'the prose-link recipe block is findable');
+  assert.match(recipe[0], /#profile-head \.profile__placeholder a\b/,
+    'the empty state\'s links are IN the shared recipe, not a separate rule');
+  assert.match(recipe[1], /min-height:\s*24px/, 'the recipe buys the height');
+  assert.match(recipe[1], /min-width:\s*24px/, 'and the width');
+  assert.match(recipe[1], /display:\s*inline-block/, 'which an inline anchor cannot take without this');
+});
+
+test('the out state says out loud that it only renders empty against the kit stub', () => {
+  const states = JSON.parse(read('profile.states.json'));
+  const out = states.states.out;
+  assert.equal(out.auth, false, 'out is the signed-out state');
+  // The file-level `_` said this in its last clause and it was still missed —
+  // which is how the state went unmeasured. The warning belongs ON the state a
+  // reader is about to run.
+  assert.ok(out._ && /stub/i.test(out._),
+    'the out state carries its own note naming the kit stub as the only way it renders empty');
+  assert.ok(/fixture-me/.test(out._),
+    'and names --fixture-me as the thing that hides the empty state');
+});