@bongos/core 1.19.577 → 1.19.579

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.577",
-  "core_contract": "1.19.577",
-  "source_commit": "762e093b407c02f640fd7c4f28f35b4aba92b905",
+  "core_version": "1.19.579",
+  "core_contract": "1.19.579",
+  "source_commit": "8b206e9f473df316fc1981854a479d1ba509d76e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T16:20:42.564Z",
+  "built_at": "2026-09-07T17:52:17.407Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 451,
+    "docs_redacted": 452,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2046,
+    "functional_verbatim": 2047,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2521,
-  "tree_sha256": "681bcb585fd2e75cf4e37463230354417f0f352734aa5057de24da8cfb8d8712",
+  "file_count": 2523,
+  "tree_sha256": "bd13bef2ae141fa766ed5c8a67894be21c62263079037e763bc1533ff500afdc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1792,7 +1792,7 @@
     {
       "path": "docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md",
       "mode": "0000644",
-      "sha256": "2c82050a733a0a82dde5079bbc486fc3378b2be954817a811aab92b9e46c9c5b"
+      "sha256": "9240caa363815ca9bbd49993bd73ecda85c6f91280ac152f344f69c77928bd22"
     },
     {
       "path": "docs/adr/0256-the-visibility-ceiling-is-the-sign-in-gate-too-and-the-reader-moves-to-the-composer.md",
@@ -1809,10 +1809,15 @@
       "mode": "0000644",
       "sha256": "28f3644d3d9dcd2985b7e3f42cf2135af86203eee35b6e509d1ff98f630f1228"
     },
+    {
+      "path": "docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md",
+      "mode": "0000644",
+      "sha256": "772b9153d882f6bbd5000ee90b83e05d550ee4f04d4f5392db36e223d9a58c59"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "30bb35e65ebd2dc8c5eb0aad7e30d5875d0c764265f398547abd545b62ee7d7c"
+      "sha256": "bf52fa642d9a576a88f961b46fbb68352e3fd8dd79004440f5e4182e549039ed"
     },
     {
       "path": "docs/api-reference.md",
@@ -1847,12 +1852,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "8bdf39ea0b8ed9583f9ef68b0edae767eec9c2825f8ef355d678b3db3d08b5e1"
+      "sha256": "da770863626202ff2566de7f0a152eebc086662c74d86423794d378fca2d83e6"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cd51497ccca735bf1f8178291b427f4166aff79870a080a4a9d036238f0ff90c"
+      "sha256": "423614f0519d1e94e605e439b53a2bac7a63c2ae8005b0021c71e6c81f38edfc"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2697,7 +2702,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "39e12981a4c704b133c9afc6c10cdb225fbe2cc882e667916eed2785ce0ae5ef"
+      "sha256": "cb7bb494b4b2ad905f1067b6f3c11e6331faa8beaad533c70d4a5009c456a807"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6812,7 +6817,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "7aa74c059670bd351bf8a4295e408aef4a908e3095711aee93f75408ccd837d5"
+      "sha256": "0154fab4db489db2eb1955bffdd9b0585ff7fe28607897e75c26d83c7edfc3e0"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7557,12 +7562,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b2a595c7b297963949c8f0c4d662c56d6ce4334a8f9e92231f47f0cd9233d624"
+      "sha256": "ce40726e213f4a94fd3983d81c5919e4cc435fda1d666e7cf598fc2f963b8741"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a2009a9bab221342b0b8b9c3c75a21d2ae02fb2fc281235f6fa7e17513a99ff8"
+      "sha256": "6ce1fcd5c0378c8001b8249d8359d04ecfa5730e07dc3e21cda4952fcf1deeae"
     },
     {
       "path": "public-docs/index.html",
@@ -9267,7 +9272,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a06af2e38ee9044c10f14f0ce1392ab85adb8058421222bf894f0f7ed6d77326"
+      "sha256": "c1da85daf5425cfb3bbd7d8e29e6995e90ead6088565476973954ca366ef14f5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11179,6 +11184,11 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/manage_manifest_shared_read.mjs",
+      "mode": "0000644",
+      "sha256": "419234978bb7688f83ec14bb2db7fb4be1eec99205595795c705befe5620b89c"
+    },
     {
       "path": "tests/manage_settings_shared_read.mjs",
       "mode": "0000644",
@@ -11642,7 +11652,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "f93044429430c9fff4fe6860bae87ff8f67bc49a485391e659422e63f209e08c"
+      "sha256": "d32fd31e368acdaaf1d4f31b775f62ef8e20ea4f5810a37fddb8ef1dba1487b6"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",

package/docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md

@@ -150,7 +150,10 @@ Stated plainly, because a privacy fix that oversells itself is worse than none:
    than the ordering one and it is untouched here: it is inherent in publishing a named list
    at all, and closing it needs a different mechanism (a delay, a decoy, or accepting that a
    project's *departure* from the public list is public). Filed separately rather than
-   silently implied to be fixed.
+   silently implied to be fixed — and **now decided**: the owner chose to accept it and say
+   so in the copy ([ADR 0259](<redacted>.md),
+   [task 1003672](https://cloudbongos.com/builders#/task/1003672)), which also carries the
+   §6.3 residual below.
 3. **Position is stable within one epoch.** Two snapshots taken the same day can still tell
    black holes apart, though not name them. The rotation bounds this to the epoch.
 

package/docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md

@@ -0,0 +1,128 @@
+# ADR 0259 — A project's departure from the public list is public, and the copy says so
+
+- **Status:** accepted
+- **Date:** 2026-09-07
+- **Task:** [task 1003672](https://cloudbongos.com/builders#/task/1003672) (BONGOS-V1, goal 1000046 — *Project creation*)
+- **Deciders:** the owner (choosing between accept / delay / decoys), Claude
+- **Related:** [ADR 0255](<redacted>.md) §6.2 (which filed this leak rather than implying it fixed) · [ADR 0182](<redacted>.md) D2a (the stealth redaction and its `STEALTH_ANONYMOUS_KEEPS` allow-list) · [ADR 0253](<redacted>.md) (the `visibility_source` provenance this feed joins)
+
+---
+
+## 1. The channel
+
+The public projects feed publishes a named list plus a count of anonymous rows. When a
+project flips to stealth, its named row **leaves the identified block** and the anonymous
+count **rises by one**. An observer who keeps yesterday's feed and diffs it against today's
+reads that off directly:
+
+> *Mercury is gone, and there is one more black hole.*
+
+That names the project that went stealth, and the moment it happened, with no reference to
+ordering at all.
+
+**Everything ADR 0182 D2a does is defeated by it.** That ADR takes real trouble to keep any
+stable per-project key off an anonymous row — `STEALTH_ANONYMOUS_KEEPS = ['state', 'orb']`
+is an allow-list precisely so a column added next year is anonymous without anyone
+remembering to come back to it. But the identity was never carried *on* the anonymous row.
+It is carried by the **absence** of the named row that used to sit beside it.
+
+**It is larger than the leak [ADR 0255](<redacted>.md)
+closed.** The ordering channel needed repeated sampling and correlation to be useful. This
+one is a single diff of two snapshots and it is exact.
+
+## 2. Why no ordering fix reaches it
+
+It is not an ordering property, so no `ORDER BY` change touches it. It is inherent in
+publishing a named list at all: any list that names its members leaks a member's departure
+to anyone who read it twice. The three ways out are all product decisions with visible
+costs, which is why 0255 filed this rather than fixing it:
+
+| Option | Cost |
+|---|---|
+| **Accept it, and say so** | An observer archiving the list learns who went stealth, and when. |
+| **Delay** — keep the named row for a window | A privacy control that takes days to take effect, which is the wrong direction for a privacy control. |
+| **Decoys** — pad the anonymous block | The count stops being truthful. It is truthful today. |
+
+## 3. Decision
+
+**Accept it, and make the copy say so.**
+
+The promise stealth actually keeps is about the project's *contents*, not about the
+*transition*. An anonymous row stays anonymous: no name, no tagline, no art, no origin, no
+stable key, nothing that survives to the next snapshot. What is not private is the act of
+stepping off the named list, because the named list is published and readers may keep
+copies of it.
+
+Two reasons this is the right end of the trade, and not merely the cheapest:
+
+1. **It is already the honest reading of the existing promise.** ADR 0182 D2a made existence
+   and count public *by design* — the map shows that hidden projects are there. A count that
+   is public and truthful is a count whose changes are public. Delay and decoys both work by
+   making a currently-honest number less honest.
+
+2. **The alternatives damage the control they defend.** A delay means an owner clicks the
+   privacy setting and is not private yet, which is a worse failure than the one it fixes —
+   the owner believes they are hidden while they are not. Decoys spend the count's
+   truthfulness on a guarantee that is still only probabilistic.
+
+### 3.1 What "say so" means concretely
+
+The owner-facing copy for Stealth previously read:
+
+> The map shows only that something is there. Its name, and everything else about it, stay
+> yours — and nobody can ask to join.
+
+Every clause is true and the paragraph as a whole still oversells, because a reader takes
+"its name stays yours" to cover the switch itself. The copy now names the boundary in both
+places an owner meets this setting — the choice's blurb and the explanatory fold — in the
+plain register [ADR 0182](<redacted>.md)'s interview fixed for this
+card (the space metaphor belongs to the drawn orb, never to the words).
+
+**A privacy control that oversells is worse than one that admits a limit**, which is the
+same standard 0255 §6 set for itself.
+
+## 4. What a future fix must not do
+
+Recorded so a later attempt does not undo the two guarantees that *are* held:
+
+- **No stable per-project key on an anonymous row** — the `STEALTH_ANONYMOUS_KEEPS`
+  allow-list ([ADR 0182](<redacted>.md) D2a). A decoy scheme that
+  needs to tell its own padding apart from real rows is the classic way this gets
+  reintroduced.
+- **No anonymous ordering an observer can predict or correlate**
+  ([ADR 0255](<redacted>.md) §3) — the trailing
+  block's keyed, rotating permutation.
+
+## 5. The residual this does not address either
+
+Within one 24h epoch the anonymous block's permutation is stable, so two snapshots taken the
+same day can tell black holes apart — though not name them. Bounded by the rotation, and
+carried here from [ADR 0255](<redacted>.md) §6.3 so
+both residuals live in one place. Accepted on the same reasoning: the fix is a per-request
+permutation, which breaks pagination exactly the way `ORDER BY random()` was rejected for in
+0255.
+
+## 6. Consequences
+
+- No behaviour changes in `modules/platform-identity/projects-feed.js`. The feed, the
+  redaction allow-list and the permutation are all untouched — this ADR decides that they
+  are *finished*, not that they need more.
+- The Stealth copy carries the boundary in both surfaces, and
+  `tests/projects_hub.mjs` pins that it does, so the sentence cannot quietly drop out of a
+  future copy edit and leave the page overselling again.
+- [ADR 0255](<redacted>.md) §6.2's "filed
+  separately" is now resolved, and points here.
+
+## Alternatives rejected
+
+- **A delay window before the named row is dropped.** Rejected: the setting would not take
+  effect when the owner sets it, and the owner would not know that. It converts an
+  information leak into a false belief, which is worse.
+- **Decoy rows padding the anonymous block.** Rejected: it spends the count's honesty, and a
+  decoy scheme needs some way to distinguish padding from real rows — the exact stable key
+  D2a forbids.
+- **Dropping the named list.** Rejected: the map's whole purpose is showing what is being
+  built here; a list nobody can read protects a privacy nobody asked for at the cost of the
+  feature.
+- **Saying nothing and leaving the copy as it was.** Rejected: the copy would keep implying a
+  guarantee the system does not make. That is the failure mode this ADR exists to close.

package/docs/adr/README.md

@@ -350,3 +350,4 @@ This keeps the decision history honest and traceable.
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.
 | 0257 | [**Auth resolves before the hall mounts anything, and a widget's boot read may never navigate** ([task 1003673](https://cloudbongos.com/builders#/task/1003673) · goal 1000063 — *The front door*). An invite-only instance could not admit its FIRST builder, and the symptom lied about where the fault was: an owner saw an empty Access-requests queue and no approve button, because **signing in does not file a request** — only the landing's *Request access* form does, and that form was unreachable. A signed-out visitor to `/builders` was bounced to GitHub, refused as a first-timer ("request access first"), and pointed back at `/builders` to be bounced again. Reproduced against `main`, not just an old pin. `builders.js` was already careful — `/me` is read `softAuth` and a 401 there renders the landing — but `DOMContentLoaded` called `mountHallWidgets()` FIRST, synchronously, and `goals.js`'s mount-time read of `/goals` goes through a `getJSON` with no `softAuth`, which answers 401 by NAVIGATING. The widget's read raced `renderLanding()` and won. **Decision: the front door settles which page this is before anything else runs** — `boot()` reads `/me` (soft), then either renders the landing and stops (nothing mounts, nothing else fetches) or mounts the hall, handing the resolved payload to `loadAll()` so the page still asks once. Widgets are member surfaces (`renderLanding` hid them all after the fact anyway), so not mounting them while signed out removes the CLASS rather than the one instance of it that was found; **a widget's own boot read may never navigate** is the belt beside it (`goals.js` reads soft and renders nothing without a session). A 401 during boot is not an instruction to go and sign in — only a user action is. `tests/hall_landing_boot.mjs` executes the real `builders.js` in a DOM stub and was confirmed to FAIL against the pre-fix file. Rejected: patching `goals.js` alone (it was merely first); making the 401 redirect soft everywhere (an expired session mid-visit SHOULD be sent to sign in — the line is boot vs user action); open enrollment as the cure (removes the gate [ADR 0050](<redacted>.md) chose deliberately instead of repairing the door).](<redacted>.md) | hall-ui / admission / front door |
 | 0258 | [**The public CLI is a generated client-only package, and its file list is proven by running it** ([task 1003679](https://cloudbongos.com/builders#/task/1003679) · goal 1000054 — *A newcomer can build without the UI*). The core ships private as `@bongos/core` ([ADR 0108](<redacted>.md)), so a newcomer with no credential can install NOTHING and the web hall is the only way in — the owner's words: "how am I supposed to easily take on tasks as a new builder? I should be able to do everything without the UI." Open task 1002025 proposed publishing the core, which ships the SERVER and bypasses [ADR 0099](<redacted>.md)'s redaction pipeline (dormant until ~2026-11). **Decision: generate a separate public `@cloudbongos/cli` from the core and do not publish the core.** Four load-bearing parts. (1) SCOPED NAME, because npm shares one namespace between org names and unscoped packages — the bare `cloudbongos` is unpublishable *precisely because the owner owns that org*, which npm reports as "invalid" and reads like the name is taken; and a package name cannot be created on the npm website at all (it exists on first publish, which is why "Add Existing Package" answered `Forbidden`). (2) THE FILE LIST IS DECLARED AND PROVEN BY BEHAVIOUR, never computed — a static require-closure CANNOT answer this, because `src/module-api.js` is the doorway a module may only import ([ADR 0083](<redacted>.md)) and it *names* every kernel capability, so a static walk sees 33 `src/` files from `start.js` alone where runtime resolves **one** (`api-prefix.js`, which imports nothing) — the same trap as task 1003677's unsatisfiable done-when. So the test packs the tarball, installs it into an empty dir with NO repo, and runs every verb: it may fail for want of a session, never for a missing file. That caught two real holes on its first strengthened run — `clients/bongos-client/index.mjs`, reached by a dynamic `import()` no `require()` walk can see, and a hand-listed `files` array that dropped `clients/` and produced a tarball which installed cleanly then died on first use; both are now build-time refusals, and the `files` array is derived from the manifest. (3) `claim`/`ship`/`dev`/`serve`/`module`/`upgrade`/`onboard`/`doctor`/`exec`/`package-core` are ABSENT and the CLI says WHY plus the next step (`bongos shell` → a cloud box with the full CLI) — a bare `unknown command` teaches nothing, which is the exact failure being fixed. The supported journey is `login` → `start` → `shell`. (4) A REDACTION GATE fails the build closed on non-loopback IPv4 (RFC 5737 doc ranges exempt), token/key shapes, and every domain + owner login readable from the instance's own `config/branding.json` — needles come from host config so the core carries no instance identity ([ADR 0062 §7](<redacted>.md)); `cloudbongos.com` is allowlisted as public by design. No `repository` field while the core repo is private (it would 404 for every user and publish the owner's login for nothing). 31 files, one dependency (`undici`), version independent of the core's ([ADR 0161](<redacted>.md)). `@bongos/client` is VENDORED, not depended on — a public package depending on a private one is uninstallable. **The owner runs `npm publish`; a builder must not.** Task 1002025 is superseded. Rejected: publishing the core; deriving from a static closure (structurally impossible past the doorway); waiting for the mirror (dormant, and this is a build product not a source release); an unscoped name; depending on `@bongos/client`; a degraded `claim`; shipping all of `src/` to make lazy getters safe.](<redacted>.md) | cli / distribution / public surface |
+| 0259 | [**A project’s departure from the public list is public, and the copy says so** ([task 1003672](https://cloudbongos.com/builders#/task/1003672) · goal 1000046 — *Project creation*). Decides the leak [ADR 0255](<redacted>.md) §6.2 deliberately filed rather than implied fixed. The public projects feed publishes a named list plus a count of anonymous rows, so when a project flips to stealth its named row LEAVES the identified block while the count RISES BY ONE — *“Mercury is gone, and there is one more black hole”* names it, and the moment, from a single diff of two snapshots. **Everything [ADR 0182](<redacted>.md) D2a does is defeated by it**, because the identity was never carried ON the anonymous row (`STEALTH_ANONYMOUS_KEEPS` is an allow-list precisely so a column added next year is anonymous by default) — it is carried by the ABSENCE of the named row that used to sit beside it. **Larger than the channel 0255 closed**, which needed repeated sampling and correlation; this one is exact and needs two reads. No `ORDER BY` change touches it: it is inherent in publishing a named list at all, so every fix is a product decision with a visible cost and the owner’s call, not a builder’s. **Decision: accept it, and make the copy say so.** Two reasons it is the right end of the trade and not merely the cheapest — (1) it is ALREADY the honest reading of the existing promise, since D2a made existence and count public *by design*, and a count that is public and truthful is a count whose CHANGES are public; (2) both alternatives damage the control they defend. A **delay window** means the owner clicks the privacy setting and is not private yet *without knowing it*, converting an information leak into a false belief — strictly worse, and the wrong direction for a privacy control. **Decoys** spend the count’s truthfulness (it is truthful today) on a guarantee that is still only probabilistic, and a decoy scheme needs some way to tell padding from real rows — the exact stable per-project key D2a forbids. The promise stealth actually keeps is about the project’s CONTENTS, not the TRANSITION: an anonymous row stays anonymous (no name, tagline, art, origin, or key surviving to the next snapshot); what is not private is stepping off a published list readers may keep copies of. So the copy — which read *“its name, and everything else about it, stay yours”*, every clause true and the paragraph as a whole overselling, because a reader takes it to cover the switch — now names the boundary in BOTH places an owner meets the setting (the choice’s blurb and the what-changes fold), in the plain register 0182’s interview fixed for this card. **A privacy control that oversells is worse than one that admits a limit**, the same standard 0255 §6 set for itself. **No behaviour changes** in `projects-feed.js` — the feed, the redaction allow-list and the keyed rotating permutation are decided FINISHED, not insufficient. `tests/projects_hub.mjs` pins the sentence in both surfaces (the copy IS the fix, so a future edit tightening the blurb must not quietly drop it) and re-applies the no-space-metaphor ban to it. Carries 0255 §6.3’s smaller residual so both live in one place: within one 24h epoch the permutation is stable, so same-day snapshots tell black holes apart (not name them) — accepted on the same reasoning, since the fix is a per-request permutation, which breaks pagination exactly as `ORDER BY random()` was rejected for. Guards recorded for any future attempt: no stable per-project key on an anonymous row, and no anonymous ordering an observer can predict or correlate. Rejected: the delay; decoys; dropping the named list (protects a privacy nobody asked for at the cost of the feature); and saying nothing, which is the failure mode this closes.](<redacted>.md) | platform-identity / privacy boundary / copy honesty |

package/docs/copy-inventory.md

@@ -4,7 +4,7 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1707 strings** across 3 surfaces · 1476 distinct pieces of copy · 1707 certain, 0 heuristic · 162 shown in more than one place.
+**1706 strings** across 3 surfaces · 1475 distinct pieces of copy · 1706 certain, 0 heuristic · 162 shown in more than one place.
 
 ## Surfaces
 
@@ -12,7 +12,7 @@
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 78 | 1234 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
-| `landing` | `modules/public-landing/public` | 5 | 373 |
+| `landing` | `modules/public-landing/public` | 5 | 372 |
 
 ## Confidence, and why it is on every row
 
@@ -1422,7 +1422,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 373 strings
+## `landing` — 372 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1788,7 +1788,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5becfcad07c3` | certain | — people ask from the project’s hall, you approve each one from the hall’s Watch page, and then they sign in. | `modules/public-landing/public/projects.html:809` |
 | `9ac56aa4e540` | certain | — projects hosted by the platform run on servers rented from DigitalOcean, with their web address and traffic  | `modules/public-landing/public/privacy.html:65` |
 | `39719e6e1d56` | certain | — shipped as | `modules/public-landing/public/projects.html:778` |
-| `78a1684630fa` | certain | — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody c | `modules/public-landing/public/projects.html:828` |
 | `b5bac008ba11` | certain | — the project is on the map under its name, and anyone who finds it can join. | `modules/public-landing/public/projects.html:828` |
 | `728661ec4c4a` | certain | — when a shipped task is graded, the change it made (the code diff) is sent to the model the grader runs on, A | `modules/public-landing/public/privacy.html:64` |
 | `ff1318762145` | certain | — whoever signs in with GitHub becomes a member at once, at the newcomer rank. | `modules/public-landing/public/projects.html:809` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1707,
-    "unique_ids": 1476,
-    "certain": 1707,
+    "strings": 1706,
+    "unique_ids": 1475,
+    "certain": 1706,
     "heuristic": 0,
     "duplicate_ids": 162
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 5,
-      "strings": 373
+      "strings": 372
     }
   },
   "blind_spots": [
@@ -16093,15 +16093,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "78a1684630fa",
-      "surface": "landing",
-      "text": "— the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.",
-      "file": "modules/public-landing/public/projects.html",
-      "line": 828,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "b5bac008ba11",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -1603,5 +1603,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.575 with no explicit bump. run 34132732488. (task 1002620)
   1.19.577 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.576 with no explicit bump. run 34142767912. (task 1002620)
+  1.19.578 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.577 with no explicit bump. run 34146835487. (task 1002620)
+  1.19.579 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.578 with no explicit bump. run 34149317186. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/public-landing/public/projects.html

@@ -825,7 +825,7 @@ summary{min-height:24px;padding:3px 0;}
         <div id="mDoor"><p class="finePrint">Reading the project’s settings…</p></div>
         <details class="finePrint" id="mDoorWhat">
           <summary>What each choice changes</summary>
-          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
+          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
         </details>
       </div>
 
@@ -5590,6 +5590,7 @@ summary{min-height:24px;padding:3px 0;}
            three cards below share ONE read of the row (task 1003582), so
            dropping the memo here is what keeps each entry a fresh read */
         if (!keepRepo) forgetSettings();
+        if (!keepRepo) forgetManifest();
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
         if (!keepRepo) loadDoor();
@@ -5892,6 +5893,8 @@ summary{min-height:24px;padding:3px 0;}
     if (!inst || !$('mVisRuns')) return;
     if (visPushOpen(inst)) {
       mVisPushSeen = true;
+      forgetManifest(); /* stale from the moment a push is queued — and by the
+                           time it settles both cards share one fresh read */
       visRuns(inst.open_intent.state === 'running'
         ? 'Restarting the project to apply a settings change…'
         : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
@@ -5900,43 +5903,81 @@ summary{min-height:24px;padding:3px 0;}
     if (mVisPushSeen) { mVisPushSeen = false; loadVisRuns(inst); }
   }
 
+  /* ── the project's own manifest, read ONCE per manage entry (task 1003554) ─
+     Two cards render off the SAME cross-origin GET of the project's manifest —
+     how the project is reached (brand.project.platformVisibility) and how
+     people join (brand.project.joinability) — and each used to ask for itself:
+     two identical round trips to somebody else's server on every entry.
+
+     Memoised like ensureSettings() and keyed on the project the same way, so a
+     switch is never served the last one's answer. The difference that matters
+     is WHEN it is dropped. The settings row is read once per entry and a memo
+     that lives for that entry is right; this answer instead goes stale the
+     moment a settings push is queued, and the re-read after that push settles
+     is the ONLY thing that can say the new value took. So forgetManifest() is
+     called from the push-open branch of renderVisState/renderJoinState, which
+     runs on every repaint while the push is open and reads nothing itself: by
+     the time it settles the memo is already empty, and the two cards' re-reads
+     then share one read rather than racing two. A lifetime memo here would
+     freeze both lines at their pre-restart value — an efficiency cleanup
+     turned into a wrong answer on screen.
+
+     It RESOLVES with every outcome rather than throwing, so one unreachable
+     project fans out to both lines and neither goes silent: status 0 means it
+     could not be reached at all, any other status is the project's own
+     refusal. The 8s budget and its abort belong to the shared read now — one
+     timer for the pair, not one each. */
+  var manifestPromise = null;
+  var manifestFor = null;   /* which project the memo holds — a switch must not reuse it */
+
+  function ensureManifest(domain) {
+    if (manifestPromise && manifestFor === manageId) return manifestPromise;
+    manifestFor = manageId;
+    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
+    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
+    manifestPromise = fetch('https://' + domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+      .then(function (res) {
+        /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
+           error page) is not an older core — carry the status, don't guess */
+        if (!res.ok) return { ok: false, status: res.status, data: null };
+        return res.json().then(function (m) { return { ok: true, status: res.status, data: m }; });
+      })
+      .catch(function () { return { ok: false, status: 0, data: null }; })
+      .then(function (ans) { if (timer) clearTimeout(timer); return ans; });
+    return manifestPromise;
+  }
+
+  /* Drop the memo so the next ensureManifest() is a real read — at each manage
+     entry, and for the whole time a settings push is open. */
+  function forgetManifest() { manifestPromise = null; manifestFor = null; }
+
   /* what the project RUNS: its own public manifest, read cross-origin (the
      same GET /instance the platform's runner reads after a restart) */
   function loadVisRuns(inst) {
     if (!inst || inst.status !== 'active' || !inst.domain) { visRuns(''); return; }
     var asked = manageId;
     visRuns('Checking what the project is running…');
-    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
-    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
-    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
-      .then(function (res) {
-        /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
-           error page) is not an older core — say what happened, not a guess */
-        if (!res.ok) throw new Error('http:' + res.status);
-        return res.json();
-      })
-      .then(function (m) {
-        if (asked !== manageId) return;
-        var p = m && m.brand && m.brand.project;
-        var v = p && p.platformVisibility;
-        if (!p || typeof p !== 'object') {
-          visRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
-          return;
-        }
-        var o = VIS_OPTIONS[v];
-        if (!o) { visRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
-        var want = mVisSettings && mVisSettings.value;
-        visRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
-          (want && want !== v && VIS_OPTIONS[want] ? ' — the saved choice (' + esc(VIS_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
-      })
-      .catch(function (err) {
-        if (asked !== manageId) return;
-        var http = /^http:(\d+)$/.exec(String(err && err.message));
-        visRuns(http
-          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+    ensureManifest(inst.domain).then(function (ans) {
+      if (asked !== manageId) return;
+      if (!ans.ok) {
+        visRuns(ans.status
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(String(ans.status)) + ').'
           : 'Couldn’t reach the project to check what it’s running right now.');
-      })
-      .then(function () { if (timer) clearTimeout(timer); });
+        return;
+      }
+      var m = ans.data;
+      var p = m && m.brand && m.brand.project;
+      var v = p && p.platformVisibility;
+      if (!p || typeof p !== 'object') {
+        visRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+        return;
+      }
+      var o = VIS_OPTIONS[v];
+      if (!o) { visRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+      var want = mVisSettings && mVisSettings.value;
+      visRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+        (want && want !== v && VIS_OPTIONS[want] ? ' — the saved choice (' + esc(VIS_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+    });
   }
 
   /* ── the settings row, read ONCE per manage entry (task 1003582) ─────────
@@ -6305,6 +6346,7 @@ summary{min-height:24px;padding:3px 0;}
     if (!inst || !$('mJoinRuns')) return;
     if (visPushOpen(inst)) {
       mJoinPushSeen = true;
+      forgetManifest(); /* the same one settle, the same one drop */
       joinRuns(inst.open_intent.state === 'running'
         ? 'Restarting the project to apply a settings change…'
         : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
@@ -6313,40 +6355,33 @@ summary{min-height:24px;padding:3px 0;}
     if (mJoinPushSeen) { mJoinPushSeen = false; loadJoinRuns(inst); }
   }
 
-  /* what the project RUNS: its own public manifest, read cross-origin */
+  /* what the project RUNS: the SAME shared manifest read the reach card uses
+     (task 1003554) — a different key out of one answer, not a second GET */
   function loadJoinRuns(inst) {
     if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
     var asked = manageId;
     joinRuns('Checking what the project is running…');
-    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
-    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
-    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
-      .then(function (res) {
-        if (!res.ok) throw new Error('http:' + res.status);
-        return res.json();
-      })
-      .then(function (m) {
-        if (asked !== manageId) return;
-        var p = m && m.brand && m.brand.project;
-        var v = p && p.joinability;
-        if (!p || typeof p !== 'object') {
-          joinRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
-          return;
-        }
-        var o = JOIN_OPTIONS[v];
-        if (!o) { joinRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
-        var want = mJoinSettings && mJoinSettings.value;
-        joinRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
-          (want && want !== v && JOIN_OPTIONS[want] ? ' — the saved choice (' + esc(JOIN_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
-      })
-      .catch(function (err) {
-        if (asked !== manageId) return;
-        var http = /^http:(\d+)$/.exec(String(err && err.message));
-        joinRuns(http
-          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+    ensureManifest(inst.domain).then(function (ans) {
+      if (asked !== manageId) return;
+      if (!ans.ok) {
+        joinRuns(ans.status
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(String(ans.status)) + ').'
           : 'Couldn’t reach the project to check what it’s running right now.');
-      })
-      .then(function () { if (timer) clearTimeout(timer); });
+        return;
+      }
+      var m = ans.data;
+      var p = m && m.brand && m.brand.project;
+      var v = p && p.joinability;
+      if (!p || typeof p !== 'object') {
+        joinRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+        return;
+      }
+      var o = JOIN_OPTIONS[v];
+      if (!o) { joinRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+      var want = mJoinSettings && mJoinSettings.value;
+      joinRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+        (want && want !== v && JOIN_OPTIONS[want] ? ' — the saved choice (' + esc(JOIN_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+    });
   }
 
   function loadJoinability(inst) {
@@ -6554,7 +6589,7 @@ summary{min-height:24px;padding:3px 0;}
   var DOOR_OPTIONS = {
     public: { label: 'Public', blurb: 'The project is on the map under its name, and anyone who finds it can join.' },
     private: { label: 'Private', blurb: 'On the map under its name, but nobody joins on their own — people ask, and you decide.' },
-    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join.' }
+    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet.' }
   };
   var mDoorSettings = null;  /* the platform row's last answer: { value, options } */
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.577",
+  "version": "1.19.579",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.577",
+      "version": "1.19.579",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.577",
+  "version": "1.19.579",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.577'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.579'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/manage_manifest_shared_read.mjs

@@ -0,0 +1,205 @@
+// tests/manage_manifest_shared_read.mjs — one read of the project's OWN
+// manifest per manage entry, EXECUTED (task 1003554).
+//
+// The defect this pins shut: entering /projects?view=manage fetched
+// https://<project>/api/gds/instance twice, identically and cross-origin,
+// because the two cards that render a "what it runs right now" line — how the
+// project is reached (brand.project.platformVisibility) and how people join
+// (brand.project.joinability) — each asked the project for themselves. Two
+// round trips to somebody else's server, each with its own 8s budget, for one
+// answer.
+//
+// It is the sibling of tests/manage_settings_shared_read.mjs, and the reason it
+// is a separate reader rather than the same memo: the settings row is read once
+// per entry and never again, so a memo that lives for the entry is right. This
+// answer goes stale the moment a settings push is queued, and the re-read once
+// that push settles is the ONLY thing that can say the new value took. So the
+// memo is dropped for as long as the push is open. A lifetime memo here would
+// freeze both lines at their pre-restart value — an efficiency cleanup turned
+// into a wrong answer on screen.
+//
+// tests/projects_hub.mjs pins that both cards go through the shared reader;
+// this file lifts the reader out of modules/public-landing/public/projects.html,
+// runs it in a vm under a scripted fetch, and counts the round trips. The
+// vm-harness precedent is tests/project_door_ui.mjs.
+//
+// What it proves, and why each matters:
+//   • both cards of one entry cost ONE round trip — the defect itself
+//   • forgetManifest() makes the next read real, so entry and tab return each
+//     ask the project as it is now, never as it was last visit
+//   • the push-open drop is what makes the settle re-read real, and the two
+//     cards re-reading after one settle still cost one round trip
+//   • switching projects is never served the previous project's manifest
+//   • a refusal RESOLVES carrying its status and an unreachable project
+//     resolves with status 0 — so ONE failure reaches BOTH lines and neither
+//     card goes silent waiting on a rejection nobody handed it
+//   • the 8s abort budget is the shared read's, and it is cleared once
+//
+// Run:  node --test --test-reporter=tap tests/manage_manifest_shared_read.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The reader, sliced from the page verbatim. Both boundaries are asserted so a
+// rename cannot leave this file executing an empty string and passing.
+const START = SCRIPT.indexOf('  var manifestPromise = null;');
+const END = SCRIPT.indexOf('  function loadVisRuns(');
+assert.ok(START > 0, 'the shared reader must start at its memo declaration');
+assert.ok(END > START, 'the shared reader must sit above its first consumer');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureManifest(', 'function forgetManifest(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the harness ──────────────────────────────────────────────────────────────
+// Narrow on purpose: the region touches fetch, manageId and the abort timer,
+// and nothing else — so the stub stays honest about what it can prove.
+
+function boot({ ok = true, status = 200, body = { brand: { project: { platformVisibility: 'public', joinability: 'open' } } }, reject = false } = {}) {
+  const requests = [];
+  const timers = { set: 0, cleared: 0 };
+  const sandbox = {
+    Promise, JSON, String, Object, Error, AbortController,
+    manageId: '18',
+    setTimeout: (fn, ms) => { timers.set++; timers.ms = ms; return { fn }; },
+    clearTimeout: () => { timers.cleared++; },
+    fetch: (url, init = {}) => {
+      requests.push({ url, mode: init.mode });
+      return reject
+        ? Promise.reject(new Error('network'))
+        : Promise.resolve({ ok, status, json: () => Promise.resolve(body) });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#shared-manifest-read' });
+
+  return { requests, timers, sandbox };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the two cards of one manage entry cost ONE round trip, not two', async () => {
+  // Arrange — the page's own entry pass: the reach card, then the join card
+  const ui = boot();
+
+  // Act
+  const answers = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 1, 'one cross-origin GET served both lines');
+  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/gds/instance');
+  assert.equal(ui.requests[0].mode, 'cors', 'the project is somebody else’s origin');
+  for (const a of answers) {
+    assert.equal(a.ok, true);
+    assert.equal(a.data.brand.project.joinability, 'open', 'both callers got the same manifest');
+  }
+});
+
+test('forgetManifest makes the next read real — entry and tab return never reuse the last visit’s answer', async () => {
+  // Arrange
+  const ui = boot();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Act — what loadManage does at the top of every entry + tab return pass
+  ui.sandbox.forgetManifest();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the second entry asked the project again');
+});
+
+test('a settled push re-reads for real, and the two cards still share ONE round trip', async () => {
+  // Arrange — the reason this memo is not ensureSettings()'s: an answer read
+  // before a push cannot say whether the restart took
+  const ui = boot();
+  await ui.sandbox.ensureManifest('demo.example.com');
+
+  // Act — the push opens (renderVisState/renderJoinState each drop the memo on
+  // every repaint while it is open), then it settles and both cards re-read
+  ui.sandbox.forgetManifest();
+  ui.sandbox.forgetManifest();
+  const after = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'one re-read after the settle — not one per card, and not zero');
+  assert.equal(after[0].ok, true);
+});
+
+test('switching projects is never served the previous project’s manifest', async () => {
+  // Arrange — the memo is warm for project 18
+  const ui = boot();
+  await ui.sandbox.ensureManifest('one.example.com');
+
+  // Act — the owner opens a different project; loadManage has not forgotten yet
+  ui.sandbox.manageId = '19';
+  await ui.sandbox.ensureManifest('two.example.com');
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
+  assert.equal(ui.requests[1].url, 'https://two.example.com/api/gds/instance');
+});
+
+test('a project that answered-and-refused RESOLVES carrying its status — both lines can say so', async () => {
+  // Arrange — a pre-launch gate or a proxy error page, which is NOT an older core
+  const ui = boot({ ok: false, status: 403 });
+
+  // Act
+  const [a, b] = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(a.ok, false);
+  assert.equal(a.status, 403, 'the status reaches the card, which prints it verbatim');
+  assert.equal(a.data, null, 'no body is claimed for a refusal');
+  assert.deepEqual(b, a, 'the second card is handed the same refusal, not left waiting');
+});
+
+test('an unreachable project RESOLVES with status 0, so one failure fans out to both lines', async () => {
+  // Arrange — the failure that used to reject into two separate catches
+  const ui = boot({ reject: true });
+
+  // Act
+  const [a, b] = await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(a.ok, false);
+  assert.equal(a.status, 0, 'status 0 is "could not reach it at all" — a different sentence from a refusal');
+  assert.deepEqual(b, a, 'neither line goes silent on a shared rejection');
+  assert.equal(ui.requests.length, 1, 'one failed attempt, not one per card');
+});
+
+test('the 8s abort budget belongs to the shared read, and is cleared once', async () => {
+  // Arrange
+  const ui = boot();
+
+  // Act
+  await Promise.all([
+    ui.sandbox.ensureManifest('demo.example.com'),
+    ui.sandbox.ensureManifest('demo.example.com'),
+  ]);
+
+  // Assert
+  assert.equal(ui.timers.set, 1, 'one timer for the pair, not one each');
+  assert.equal(ui.timers.ms, 8000, 'the budget the two cards used to keep separately');
+  assert.equal(ui.timers.cleared, 1, 'and it is cleared when the answer lands');
+});

package/tests/projects_hub.mjs

@@ -1418,14 +1418,17 @@ test('the save sends the choice and shows the platform’s receipt verbatim —
 
 test('what the project RUNS comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadVisRuns');
+  const manifest = fnHub('ensureManifest');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/,
+  assert.match(manifest, /'https:\/\/' \+ domain \+ '\/api\/gds\/instance'/,
     'the same public GET /instance the platform’s runner reads after a restart');
+  assert.doesNotMatch(runs, /fetch\(/, 'the card fires no GET of its own — one manifest read serves the pair (task 1003554)');
   assert.match(runs, /m\.brand && m\.brand\.project/);
   assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
   assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
   assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
-  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
+  assert.match(manifest, /if \(!res\.ok\) return \{ ok: false, status: res\.status, data: null \};/,
+    'a refusal is not an older core — its status is carried out to both cards, not thrown away');
   assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
   assert.doesNotMatch(runs, /mVisSettings\.value\)\s*\+\s*'<\/b>'|runs as <b>' \+ esc\(VIS_OPTIONS\[want\]/,
     'the platform’s stored choice is never painted as what the project runs');
@@ -1540,6 +1543,30 @@ test('the join-door labels are PLAIN — the space metaphor is the orb’s, neve
   assert.doesNotMatch(options, /unlisted/i, 'dark matter is DERIVED — there is deliberately no way to choose it');
 });
 
+/* ADR 0259: the one thing Stealth does NOT hide is the switch itself. A project
+   leaving the named list while the anonymous count rises names it to anyone
+   holding yesterday's feed — inherent in publishing a named list, and the owner
+   chose to accept it and say so rather than pay for a delay or decoys. The
+   copy is the whole fix, so the copy is what gets pinned: without this, a
+   future edit tightening the blurb drops the caveat and the page goes back to
+   implying a guarantee the feed does not make. */
+test('the Stealth copy names its own limit — switching is visible, even though the project is not (ADR 0259)', () => {
+  const options = (SCRIPT.match(/var DOOR_OPTIONS = \{[\s\S]*?\n  \};/) || [''])[0];
+  const fold = (HUB.match(/<details class="finePrint" id="mDoorWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(options && fold, 'both the option table and the fold must be extractable');
+  for (const [where, text] of [['the choice’s blurb', options], ['the what-changes fold', fold]]) {
+    assert.match(text, /Switching to Stealth is itself visible/,
+      `${where} states the boundary — a privacy control that oversells is worse than one that admits a limit`);
+    assert.match(text, /comparing the map before and after can tell which project went quiet/,
+      `${where} says HOW it is visible, so the owner can judge it rather than take our word`);
+  }
+  /* the plain-register rule this card is held to still binds the new sentence
+     (the space metaphor is the drawn orb's, never the copy's) */
+  for (const word of ['planet', 'star', 'black hole', 'dark matter', 'feed', 'snapshot']) {
+    assert.doesNotMatch(options.toLowerCase(), new RegExp(`\\b${word}\\b`), `"${word}" must not reach a choice’s blurb`);
+  }
+});
+
 test('the join-door pick is a real radio group built from the server’s own options list', () => {
   const render = fnHub('renderDoor');
   assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!DOOR_OPTIONS\[v\]; \}\)/,
@@ -1598,15 +1625,39 @@ test('the joinability save sends the one key and shows the platform’s receipt
 test('what the project RUNS for joinability comes only from its own manifest, and every answer is said', () => {
   const runs = fnHub('loadJoinRuns');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/, 'the same public GET /instance the runner reads');
+  assert.match(runs, /ensureManifest\(inst\.domain\)/, 'the same public GET /instance the runner reads, through the shared reader');
+  assert.doesNotMatch(runs, /fetch\(/, 'the second card of the pair adds no round trip of its own (task 1003554)');
   assert.match(runs, /p && p\.joinability/, 'the manifest key is brand.project.joinability');
   assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
   assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
   assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
-  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
   assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
 });
 
+/* One read of the project's own manifest per manage entry (task 1003554), the
+   sibling of the settings-row share above. Two cards read two keys out of the
+   SAME cross-origin GET and each used to fetch it for itself. The memo differs
+   from ensureSettings() in one load-bearing way — it is dropped for as long as
+   a push is open, because the re-read after it settles is the only thing that
+   can say the new value took. tests/manage_manifest_shared_read.mjs runs the
+   reader; this pins that both cards go through it and that the drop is there. */
+test('the two “what it runs” lines share ONE read of the project’s manifest', () => {
+  const ensure = fnHub('ensureManifest');
+  assert.match(ensure, /if \(manifestPromise && manifestFor === manageId\) return manifestPromise;/,
+    'memoised AND keyed on the project — a switch must never be served the last one’s manifest');
+  assert.match(ensure, /setTimeout\(function \(\) \{ ctl\.abort\(\); \}, 8000\)/, 'one 8s budget for the pair, not one each');
+  for (const fn of ['loadVisRuns', 'loadJoinRuns']) {
+    assert.match(fnHub(fn), /ensureManifest\(inst\.domain\)/, `${fn} reads the manifest through the shared reader`);
+    assert.doesNotMatch(fnHub(fn), /fetch\(/, `${fn} fires no GET of its own`);
+  }
+  assert.match(SCRIPT, /if \(!keepRepo\) forgetManifest\(\);/,
+    'the memo is dropped on entry + tab return, so neither is ever served the last visit’s answer');
+  for (const fn of ['renderVisState', 'renderJoinState']) {
+    assert.match(fnHub(fn), /forgetManifest\(\);/,
+      `${fn} drops the memo while a push is open — a lifetime memo would freeze the line at its pre-restart value`);
+  }
+});
+
 test('the joinability in-flight line shares the visibility section’s push predicate and re-asks the manifest when it settles', () => {
   const st = fnHub('renderJoinState');
   assert.match(st, /if \(visPushOpen\(inst\)\)/, 'one settings push carries every key — one predicate, shared');