@bongos/core 1.19.577 → 1.19.578

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.577",
-  "core_contract": "1.19.577",
-  "source_commit": "762e093b407c02f640fd7c4f28f35b4aba92b905",
+  "core_version": "1.19.578",
+  "core_contract": "1.19.578",
+  "source_commit": "a3f42dff6ab98712306ee86eaedf8191cafa3340",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T16:20:42.564Z",
+  "built_at": "2026-09-07T17:15:54.070Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 451,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2046,
+    "functional_verbatim": 2047,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2521,
-  "tree_sha256": "681bcb585fd2e75cf4e37463230354417f0f352734aa5057de24da8cfb8d8712",
+  "file_count": 2522,
+  "tree_sha256": "96be19d76442ed1b3e663525652a70c6ef60434e80d4ad907df8e294be5f38fe",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2697,7 +2697,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "39e12981a4c704b133c9afc6c10cdb225fbe2cc882e667916eed2785ce0ae5ef"
+      "sha256": "072128c45a7036c0d01bc029a1267bf34ff7bd175226e83d691b8001e4a8eefa"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6812,7 +6812,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "7aa74c059670bd351bf8a4295e408aef4a908e3095711aee93f75408ccd837d5"
+      "sha256": "22201cd63fde334156b40954707d836f8c65a8380a3f346fe7c77abb03ed3b51"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7557,12 +7557,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b2a595c7b297963949c8f0c4d662c56d6ce4334a8f9e92231f47f0cd9233d624"
+      "sha256": "e5249bc21a0842ce0e47203e1b7052aa146161702db57b1c50740d409a7347b2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a2009a9bab221342b0b8b9c3c75a21d2ae02fb2fc281235f6fa7e17513a99ff8"
+      "sha256": "d328d1b9a42a9003642815e8a17cc14f648d53a996c2c6db92a8d1250c570ea8"
     },
     {
       "path": "public-docs/index.html",
@@ -9267,7 +9267,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a06af2e38ee9044c10f14f0ce1392ab85adb8058421222bf894f0f7ed6d77326"
+      "sha256": "71207830c631f2604b55d9e2e6a2db08b0d129499249c4db009c00e871fc2fd7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11179,6 +11179,11 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/manage_manifest_shared_read.mjs",
+      "mode": "0000644",
+      "sha256": "419234978bb7688f83ec14bb2db7fb4be1eec99205595795c705befe5620b89c"
+    },
     {
       "path": "tests/manage_settings_shared_read.mjs",
       "mode": "0000644",
@@ -11642,7 +11647,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "f93044429430c9fff4fe6860bae87ff8f67bc49a485391e659422e63f209e08c"
+      "sha256": "ec536c7bcfe2c9ea29d0df8a0dcbbb5c2764b4f60e0d14218aa0a10bf6afb469"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",

package/docs/module-api-changelog.md

@@ -1603,5 +1603,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.575 with no explicit bump. run 34132732488. (task 1002620)
   1.19.577 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.576 with no explicit bump. run 34142767912. (task 1002620)
+  1.19.578 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.577 with no explicit bump. run 34146835487. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/public-landing/public/projects.html

@@ -5590,6 +5590,7 @@ summary{min-height:24px;padding:3px 0;}
            three cards below share ONE read of the row (task 1003582), so
            dropping the memo here is what keeps each entry a fresh read */
         if (!keepRepo) forgetSettings();
+        if (!keepRepo) forgetManifest();
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
         if (!keepRepo) loadDoor();
@@ -5892,6 +5893,8 @@ summary{min-height:24px;padding:3px 0;}
     if (!inst || !$('mVisRuns')) return;
     if (visPushOpen(inst)) {
       mVisPushSeen = true;
+      forgetManifest(); /* stale from the moment a push is queued — and by the
+                           time it settles both cards share one fresh read */
       visRuns(inst.open_intent.state === 'running'
         ? 'Restarting the project to apply a settings change…'
         : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
@@ -5900,43 +5903,81 @@ summary{min-height:24px;padding:3px 0;}
     if (mVisPushSeen) { mVisPushSeen = false; loadVisRuns(inst); }
   }
 
+  /* ── the project's own manifest, read ONCE per manage entry (task 1003554) ─
+     Two cards render off the SAME cross-origin GET of the project's manifest —
+     how the project is reached (brand.project.platformVisibility) and how
+     people join (brand.project.joinability) — and each used to ask for itself:
+     two identical round trips to somebody else's server on every entry.
+
+     Memoised like ensureSettings() and keyed on the project the same way, so a
+     switch is never served the last one's answer. The difference that matters
+     is WHEN it is dropped. The settings row is read once per entry and a memo
+     that lives for that entry is right; this answer instead goes stale the
+     moment a settings push is queued, and the re-read after that push settles
+     is the ONLY thing that can say the new value took. So forgetManifest() is
+     called from the push-open branch of renderVisState/renderJoinState, which
+     runs on every repaint while the push is open and reads nothing itself: by
+     the time it settles the memo is already empty, and the two cards' re-reads
+     then share one read rather than racing two. A lifetime memo here would
+     freeze both lines at their pre-restart value — an efficiency cleanup
+     turned into a wrong answer on screen.
+
+     It RESOLVES with every outcome rather than throwing, so one unreachable
+     project fans out to both lines and neither goes silent: status 0 means it
+     could not be reached at all, any other status is the project's own
+     refusal. The 8s budget and its abort belong to the shared read now — one
+     timer for the pair, not one each. */
+  var manifestPromise = null;
+  var manifestFor = null;   /* which project the memo holds — a switch must not reuse it */
+
+  function ensureManifest(domain) {
+    if (manifestPromise && manifestFor === manageId) return manifestPromise;
+    manifestFor = manageId;
+    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
+    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
+    manifestPromise = fetch('https://' + domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+      .then(function (res) {
+        /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
+           error page) is not an older core — carry the status, don't guess */
+        if (!res.ok) return { ok: false, status: res.status, data: null };
+        return res.json().then(function (m) { return { ok: true, status: res.status, data: m }; });
+      })
+      .catch(function () { return { ok: false, status: 0, data: null }; })
+      .then(function (ans) { if (timer) clearTimeout(timer); return ans; });
+    return manifestPromise;
+  }
+
+  /* Drop the memo so the next ensureManifest() is a real read — at each manage
+     entry, and for the whole time a settings push is open. */
+  function forgetManifest() { manifestPromise = null; manifestFor = null; }
+
   /* what the project RUNS: its own public manifest, read cross-origin (the
      same GET /instance the platform's runner reads after a restart) */
   function loadVisRuns(inst) {
     if (!inst || inst.status !== 'active' || !inst.domain) { visRuns(''); return; }
     var asked = manageId;
     visRuns('Checking what the project is running…');
-    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
-    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
-    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
-      .then(function (res) {
-        /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
-           error page) is not an older core — say what happened, not a guess */
-        if (!res.ok) throw new Error('http:' + res.status);
-        return res.json();
-      })
-      .then(function (m) {
-        if (asked !== manageId) return;
-        var p = m && m.brand && m.brand.project;
-        var v = p && p.platformVisibility;
-        if (!p || typeof p !== 'object') {
-          visRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
-          return;
-        }
-        var o = VIS_OPTIONS[v];
-        if (!o) { visRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
-        var want = mVisSettings && mVisSettings.value;
-        visRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
-          (want && want !== v && VIS_OPTIONS[want] ? ' — the saved choice (' + esc(VIS_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
-      })
-      .catch(function (err) {
-        if (asked !== manageId) return;
-        var http = /^http:(\d+)$/.exec(String(err && err.message));
-        visRuns(http
-          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+    ensureManifest(inst.domain).then(function (ans) {
+      if (asked !== manageId) return;
+      if (!ans.ok) {
+        visRuns(ans.status
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(String(ans.status)) + ').'
           : 'Couldn’t reach the project to check what it’s running right now.');
-      })
-      .then(function () { if (timer) clearTimeout(timer); });
+        return;
+      }
+      var m = ans.data;
+      var p = m && m.brand && m.brand.project;
+      var v = p && p.platformVisibility;
+      if (!p || typeof p !== 'object') {
+        visRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+        return;
+      }
+      var o = VIS_OPTIONS[v];
+      if (!o) { visRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+      var want = mVisSettings && mVisSettings.value;
+      visRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+        (want && want !== v && VIS_OPTIONS[want] ? ' — the saved choice (' + esc(VIS_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+    });
   }
 
   /* ── the settings row, read ONCE per manage entry (task 1003582) ─────────
@@ -6305,6 +6346,7 @@ summary{min-height:24px;padding:3px 0;}
     if (!inst || !$('mJoinRuns')) return;
     if (visPushOpen(inst)) {
       mJoinPushSeen = true;
+      forgetManifest(); /* the same one settle, the same one drop */
       joinRuns(inst.open_intent.state === 'running'
         ? 'Restarting the project to apply a settings change…'
         : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
@@ -6313,40 +6355,33 @@ summary{min-height:24px;padding:3px 0;}
     if (mJoinPushSeen) { mJoinPushSeen = false; loadJoinRuns(inst); }
   }
 
-  /* what the project RUNS: its own public manifest, read cross-origin */
+  /* what the project RUNS: the SAME shared manifest read the reach card uses
+     (task 1003554) — a different key out of one answer, not a second GET */
   function loadJoinRuns(inst) {
     if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
     var asked = manageId;
     joinRuns('Checking what the project is running…');
-    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
-    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
-    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
-      .then(function (res) {
-        if (!res.ok) throw new Error('http:' + res.status);
-        return res.json();
-      })
-      .then(function (m) {
-        if (asked !== manageId) return;
-        var p = m && m.brand && m.brand.project;
-        var v = p && p.joinability;
-        if (!p || typeof p !== 'object') {
-          joinRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
-          return;
-        }
-        var o = JOIN_OPTIONS[v];
-        if (!o) { joinRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
-        var want = mJoinSettings && mJoinSettings.value;
-        joinRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
-          (want && want !== v && JOIN_OPTIONS[want] ? ' — the saved choice (' + esc(JOIN_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
-      })
-      .catch(function (err) {
-        if (asked !== manageId) return;
-        var http = /^http:(\d+)$/.exec(String(err && err.message));
-        joinRuns(http
-          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+    ensureManifest(inst.domain).then(function (ans) {
+      if (asked !== manageId) return;
+      if (!ans.ok) {
+        joinRuns(ans.status
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(String(ans.status)) + ').'
           : 'Couldn’t reach the project to check what it’s running right now.');
-      })
-      .then(function () { if (timer) clearTimeout(timer); });
+        return;
+      }
+      var m = ans.data;
+      var p = m && m.brand && m.brand.project;
+      var v = p && p.joinability;
+      if (!p || typeof p !== 'object') {
+        joinRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+        return;
+      }
+      var o = JOIN_OPTIONS[v];
+      if (!o) { joinRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+      var want = mJoinSettings && mJoinSettings.value;
+      joinRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+        (want && want !== v && JOIN_OPTIONS[want] ? ' — the saved choice (' + esc(JOIN_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+    });
   }
 
   function loadJoinability(inst) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.577",
+  "version": "1.19.578",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.577",
+      "version": "1.19.578",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.577",
+  "version": "1.19.578",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.577'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.578'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/manage_manifest_shared_read.mjs

@@ -0,0 +1,205 @@
+// tests/manage_manifest_shared_read.mjs — one read of the project's OWN
+// manifest per manage entry, EXECUTED (task 1003554).
+//
+// The defect this pins shut: entering /projects?view=manage fetched
+// https://<project>/api/gds/instance twice, identically and cross-origin,
+// because the two cards that render a "what it runs right now" line — how the
+// project is reached (brand.project.platformVisibility) and how people join
+// (brand.project.joinability) — each asked the project for themselves. Two
+// round trips to somebody else's server, each with its own 8s budget, for one
+// answer.
+//
+// It is the sibling of tests/manage_settings_shared_read.mjs, and the reason it
+// is a separate reader rather than the same memo: the settings row is read once
+// per entry and never again, so a memo that lives for the entry is right. This
+// answer goes stale the moment a settings push is queued, and the re-read once
+// that push settles is the ONLY thing that can say the new value took. So the
+// memo is dropped for as long as the push is open. A lifetime memo here would
+// freeze both lines at their pre-restart value — an efficiency cleanup turned
+// into a wrong answer on screen.
+//
+// tests/projects_hub.mjs pins that both cards go through the shared reader;
+// this file lifts the reader out of modules/public-landing/public/projects.html,
+// runs it in a vm under a scripted fetch, and counts the round trips. The
+// vm-harness precedent is tests/project_door_ui.mjs.
+//
+// What it proves, and why each matters:
+//   • both cards of one entry cost ONE round trip — the defect itself
+//   • forgetManifest() makes the next read real, so entry and tab return each
+//     ask the project as it is now, never as it was last visit
+//   • the push-open drop is what makes the settle re-read real, and the two
+//     cards re-reading after one settle still cost one round trip
+//   • switching projects is never served the previous project's manifest
+//   • a refusal RESOLVES carrying its status and an unreachable project
+//     resolves with status 0 — so ONE failure reaches BOTH lines and neither
+//     card goes silent waiting on a rejection nobody handed it
+//   • the 8s abort budget is the shared read's, and it is cleared once
+//
+// Run:  node --test --test-reporter=tap tests/manage_manifest_shared_read.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The reader, sliced from the page verbatim. Both boundaries are asserted so a
+// rename cannot leave this file executing an empty string and passing.
+const START = SCRIPT.indexOf('  var manifestPromise = null;');
+const END = SCRIPT.indexOf('  function loadVisRuns(');
+assert.ok(START > 0, 'the shared reader must start at its memo declaration');
+assert.ok(END > START, 'the shared reader must sit above its first consumer');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureManifest(', 'function forgetManifest(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the harness ──────────────────────────────────────────────────────────────
+// Narrow on purpose: the region touches fetch, manageId and the abort timer,
+// and nothing else — so the stub stays honest about what it can prove.
+
+function boot({ ok = true, status = 200, body = { brand: { project: { platformVisibility: 'public', joinability: 'open' } } }, reject = false } = {}) {
+  const requests = [];
+  const timers = { set: 0, cleared: 0 };
+  const sandbox = {
+    Promise, JSON, String, Object, Error, AbortController,
+    manageId: '18',
+    setTimeout: (fn, ms) => { timers.set++; timers.ms = ms; return { fn }; },
+    clearTimeout: () => { timers.cleared++; },
+    fetch: (url, init = {}) => {
+      requests.push({ url, mode: init.mode });
+      return reject
+        ? Promise.reject(new Error('network'))
+        : Promise.resolve({ ok, status, json: () => Promise.resolve(body) });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#shared-manifest-read' });
+
+  return { requests, timers, sandbox };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the two cards of one manage entry cost ONE round trip, not two', async () => {
+  // Arrange — the page's own entry pass: the reach card, then the join card
+  const ui = boot();
+
+  // Act
+  const answers = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 1, 'one cross-origin GET served both lines');
+  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/gds/instance');
+  assert.equal(ui.requests[0].mode, 'cors', 'the project is somebody else’s origin');
+  for (const a of answers) {
+    assert.equal(a.ok, true);
+    assert.equal(a.data.brand.project.joinability, 'open', 'both callers got the same manifest');
+  }
+});
+
+test('forgetManifest makes the next read real — entry and tab return never reuse the last visit’s answer', async () => {
+  // Arrange
+  const ui = boot();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Act — what loadManage does at the top of every entry + tab return pass
+  ui.sandbox.forgetManifest();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the second entry asked the project again');
+});
+
+test('a settled push re-reads for real, and the two cards still share ONE round trip', async () => {
+  // Arrange — the reason this memo is not ensureSettings()'s: an answer read
+  // before a push cannot say whether the restart took
+  const ui = boot();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Act — the push opens (renderVisState/renderJoinState each drop the memo on
+  // every repaint while it is open), then it settles and both cards re-read
+  ui.sandbox.forgetManifest();
+  ui.sandbox.forgetManifest();
+  const after = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'one re-read after the settle — not one per card, and not zero');
+  assert.equal(after[0].ok, true);
+});
+
+test('switching projects is never served the previous project’s manifest', async () => {
+  // Arrange — the memo is warm for project 18
+  const ui = boot();
+  await ui.sandbox.ensureManifest('one.example.com');
+
+  // Act — the owner opens a different project; loadManage has not forgotten yet
+  ui.sandbox.manageId = '19';
+  await ui.sandbox.ensureManifest('two.example.com');
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
+  assert.equal(ui.requests[1].url, 'https://two.example.com/api/gds/instance');
+});
+
+test('a project that answered-and-refused RESOLVES carrying its status — both lines can say so', async () => {
+  // Arrange — a pre-launch gate or a proxy error page, which is NOT an older core
+  const ui = boot({ ok: false, status: 403 });
+
+  // Act
+  const [a, b] = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(a.ok, false);
+  assert.equal(a.status, 403, 'the status reaches the card, which prints it verbatim');
+  assert.equal(a.data, null, 'no body is claimed for a refusal');
+  assert.deepEqual(b, a, 'the second card is handed the same refusal, not left waiting');
+});
+
+test('an unreachable project RESOLVES with status 0, so one failure fans out to both lines', async () => {
+  // Arrange — the failure that used to reject into two separate catches
+  const ui = boot({ reject: true });
+
+  // Act
+  const [a, b] = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(a.ok, false);
+  assert.equal(a.status, 0, 'status 0 is "could not reach it at all" — a different sentence from a refusal');
+  assert.deepEqual(b, a, 'neither line goes silent on a shared rejection');
+  assert.equal(ui.requests.length, 1, 'one failed attempt, not one per card');
+});
+
+test('the 8s abort budget belongs to the shared read, and is cleared once', async () => {
+  // Arrange
+  const ui = boot();
+
+  // Act
+  await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.timers.set, 1, 'one timer for the pair, not one each');
+  assert.equal(ui.timers.ms, 8000, 'the budget the two cards used to keep separately');
+  assert.equal(ui.timers.cleared, 1, 'and it is cleared when the answer lands');
+});

package/tests/projects_hub.mjs

@@ -1418,14 +1418,17 @@ test('the save sends the choice and shows the platform’s receipt verbatim —
 
 test('what the project RUNS comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadVisRuns');
+  const manifest = fnHub('ensureManifest');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/,
+  assert.match(manifest, /'https:\/\/' \+ domain \+ '\/api\/gds\/instance'/,
     'the same public GET /instance the platform’s runner reads after a restart');
+  assert.doesNotMatch(runs, /fetch\(/, 'the card fires no GET of its own — one manifest read serves the pair (task 1003554)');
   assert.match(runs, /m\.brand && m\.brand\.project/);
   assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
   assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
   assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
-  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
+  assert.match(manifest, /if \(!res\.ok\) return \{ ok: false, status: res\.status, data: null \};/,
+    'a refusal is not an older core — its status is carried out to both cards, not thrown away');
   assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
   assert.doesNotMatch(runs, /mVisSettings\.value\)\s*\+\s*'<\/b>'|runs as <b>' \+ esc\(VIS_OPTIONS\[want\]/,
     'the platform’s stored choice is never painted as what the project runs');
@@ -1598,15 +1601,39 @@ test('the joinability save sends the one key and shows the platform’s receipt
 test('what the project RUNS for joinability comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadJoinRuns');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/, 'the same public GET /instance the runner reads');
+  assert.match(runs, /ensureManifest\(inst\.domain\)/, 'the same public GET /instance the runner reads, through the shared reader');
+  assert.doesNotMatch(runs, /fetch\(/, 'the second card of the pair adds no round trip of its own (task 1003554)');
   assert.match(runs, /p && p\.joinability/, 'the manifest key is brand.project.joinability');
   assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
   assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
   assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
-  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
   assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
 });
 
+/* One read of the project's own manifest per manage entry (task 1003554), the
+   sibling of the settings-row share above. Two cards read two keys out of the
+   SAME cross-origin GET and each used to fetch it for itself. The memo differs
+   from ensureSettings() in one load-bearing way — it is dropped for as long as
+   a push is open, because the re-read after it settles is the only thing that
+   can say the new value took. tests/manage_manifest_shared_read.mjs runs the
+   reader; this pins that both cards go through it and that the drop is there. */
+test('the two “what it runs” lines share ONE read of the project’s manifest', () => {
+  const ensure = fnHub('ensureManifest');
+  assert.match(ensure, /if \(manifestPromise && manifestFor === manageId\) return manifestPromise;/,
+    'memoised AND keyed on the project — a switch must never be served the last one’s manifest');
+  assert.match(ensure, /setTimeout\(function \(\) \{ ctl\.abort\(\); \}, 8000\)/, 'one 8s budget for the pair, not one each');
+  for (const fn of ['loadVisRuns', 'loadJoinRuns']) {
+    assert.match(fnHub(fn), /ensureManifest\(inst\.domain\)/, `${fn} reads the manifest through the shared reader`);
+    assert.doesNotMatch(fnHub(fn), /fetch\(/, `${fn} fires no GET of its own`);
+  }
+  assert.match(SCRIPT, /if \(!keepRepo\) forgetManifest\(\);/,
+    'the memo is dropped on entry + tab return, so neither is ever served the last visit’s answer');
+  for (const fn of ['renderVisState', 'renderJoinState']) {
+    assert.match(fnHub(fn), /forgetManifest\(\);/,
+      `${fn} drops the memo while a push is open — a lifetime memo would freeze the line at its pre-restart value`);
+  }
+});
+
 test('the joinability in-flight line shares the visibility section’s push predicate and re-asks the manifest when it settles', () => {
   const st = fnHub('renderJoinState');
   assert.match(st, /if \(visPushOpen\(inst\)\)/, 'one settings push carries every key — one predicate, shared');