@bongos/core 1.19.93 → 1.19.94

package/scripts/gds/run-unit-tests.js

@@ -102,7 +102,6 @@ const KNOWN_FAILING = new Set([
   // diagnoses live in that task. Remove each here as it is fixed.
   // PAIRING: tests/known_failing_ratchet.mjs keeps EXECUTING each parked test
   // and fails the suite the moment one starts passing — so this set cannot rot.
-  'platform_boot',
   'served_paths_shipped',
 ]);
 

package/src/bongos/module-scope-map.js

@@ -192,7 +192,7 @@ const MODULE_GLOBS = {
   // (moduleWebSurfaces → serve-internal). Its public read endpoints stay SHARED
   // core in routes/public.js (the hall + the off-box mirror consume them too).
   'status-ui': ['modules/status-ui/'],
-  // The instance's public landing surface (index/world/gate/create), served by
+  // The instance's public landing surface (index/projects/create), served by
   // platform-server.js from the repo-root public-landing/ dir — not yet a carved
   // module, so the glob lists where the code lives TODAY (the auto-tighten
   // contract above). Its own key, not provisioning's: the front door is broader

package/src/module-api.js

@@ -613,8 +613,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.91 with no explicit bump. run 31727411036. (task 1002620)
 //   1.19.93 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.92 with no explicit bump. run 31735192921. (task 1002620)
+//   1.19.94 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.93 with no explicit bump. run 31742308532. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.93'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.94'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -96,19 +96,6 @@ function stripApexOnly(html, isHub = isModuleEnabled('platform-identity')) {
   return isHub ? html : String(html).replace(APEX_ONLY, '');
 }
 function landingHtml() { return landingPage('index.html'); }
-// The interactive landing gate (public-landing/gate/, ported from amazonprimea
-// in task 1002407). When an instance ships it, it is the apex front door
-// (task 1002408). Unlike the placeholder landing it is a self-contained baked
-// design that reads no window.__BRANDING__, so it is served RAW, not injected.
-// Memoized: absolute path to gate/index.html, or '' when the instance ships no gate.
-let _gateIndexPath; // undefined = unresolved, '' = absent, string = present
-function gateIndexPath() {
-  if (_gateIndexPath === undefined) {
-    const p = path.join(LANDING_DIR, 'gate', 'index.html');
-    _gateIndexPath = fs.existsSync(p) ? p : '';
-  }
-  return _gateIndexPath;
-}
 function isApexHost(req) {
   return !isStatusHost(req) && !isBuildersHost(req);
 }
@@ -127,38 +114,30 @@ function buildPlatformApp() {
   // The whole internal surface — shared verbatim with server.js (ADR 0062 R51).
   mountInternalSurfaces(app);
 
-  // Apex landing. On the apex host (not status./builders.):
-  //   * if this instance ships the interactive landing gate (public-landing/gate/),
-  //     the gate is the front door — GET / 302-redirects to /gate/ (mirrors the
-  //     amazonprimea Caddy rule this replaces, task 1002408). The redirect (not a
-  //     direct serve at /) is required so the browser base URL becomes /gate/ and
-  //     the gate's relative asset paths (sprites/…, ../world, ../assets) resolve.
-  //   * otherwise GET / serves the branding-injected minimal placeholder.
-  // Both fall through to the 404 tail when neither is present, and to the landing
-  // asset handler below for non-/ paths (e.g. the mascot image).
+  // THE APEX FRONT DOOR (task 1002743). GET / serves the real landing page,
+  // branding-injected and apex-stripped like every other landing surface.
+  //
+  // It used to 302 to /gate/ — the interactive orb sky (task 1002408). That
+  // redirect is gone with the gate itself: the landing page is now the front
+  // door and /projects is the hub the sky became a view inside. The redirect
+  // could only be removed once the landing page carried real doors into the
+  // hub, which it does (front-door-and-hub-direction.md §3); removing it
+  // earlier would have left navigation worse than it was.
+  //
+  // NOTE THE INFRA HALF: on a live instance the reverse proxy may carry its own
+  // `redir / /gate/ 302` (ADR 0152 records the Caddy @gate block). Caddy runs
+  // that before the request ever reaches Node, so this change alone does not
+  // move a deployed apex — the operator has to drop that rule, and the
+  // pre-launch basic_auth it sits with, at launch.
+  //
+  // Falls through to the 404 tail when the instance ships no landing page, and
+  // to the landing asset handler below for non-/ paths (e.g. the mascot image).
   app.get('/', (req, res, next) => {
     if (!isApexHost(req)) return next();
-    if (gateIndexPath()) return res.redirect(302, '/gate/');
     const html = landingHtml();
     if (!html) return next();
     res.type('html').send(html);
   });
-  // /gate → /gate/ (so the gate's relative asset paths resolve against the dir),
-  // and /gate/ serves the gate's own index RAW — a self-contained baked design,
-  // so no window.__BRANDING__ injection. The gate's sub-assets (/gate/*, /world/*,
-  // /assets/*) are served by the express.static(LANDING_DIR) handler below with no
-  // extra rule, which also closes the amazonprimea Caddy gap where /assets/anim/idle/*
-  // (the buddha idle frames) fell through to the app instead of the static server.
-  // One handler for both forms — Express's non-strict routing matches /gate and
-  // /gate/ interchangeably, so branch on the real req.path: /gate 301→ /gate/
-  // (so relative asset paths resolve against the dir), /gate/ serves the index.
-  app.get(['/gate', '/gate/'], (req, res, next) => {
-    if (!isApexHost(req)) return next();
-    const p = gateIndexPath();
-    if (!p) return next();
-    if (!req.path.endsWith('/')) return res.redirect(301, '/gate/');
-    return res.type('html').sendFile(p);
-  });
   // The branded project-creation experience (goal 35, task 2081) — a sibling
   // landing page at a clean /create URL, branding-injected like the landing.
   app.get('/create', (req, res, next) => {
@@ -167,9 +146,12 @@ function buildPlatformApp() {
     if (!html) return next();
     res.type('html').send(html);
   });
-  // The owner's my-projects surface (goal 1000059, task 1002693) — the durable
-  // place to find, watch, and manage one's instances after the /create tab
-  // closes. A sibling landing page, branding-injected like /create.
+  // THE PROJECT HUB (task 1002743) — one surface holding every project-shaped
+  // action: the map of what exists (the orb sky the gate used to own, plus the
+  // directory table), the owner's own projects, and starting a new one. The
+  // view is chosen client-side from `?view=map|mine|new`; this route matches on
+  // path only and serves byte-identical HTML for every view, which is why all
+  // three ship as real markup rather than being built by script.
   app.get('/projects', (req, res, next) => {
     if (!isApexHost(req)) return next();
     const html = landingPage('projects.html');

package/tests/known_failing_ratchet.mjs

@@ -32,16 +32,15 @@ const TESTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 // ">=7 host tests" non-vacuity floor had gone stale after ADR 0107 moved the
 // host-module tests to modules/<key>/tests/; it is a regex specimen self-test
 // now, and idea 1000542 — which owned it — is superseded.)
-const MAX_KNOWN_FAILING = 2;
+// Ratcheted down 2 → 1 by task 1002743, which unparked platform_boot. The
+// diagnosis its entry asked for turned out to be the one it suspected: the apex
+// really was redirecting instead of serving the landing page, and the test was
+// right all along. The apex flip removed the redirect, so the test passes and
+// the entry had to go in the same change — this file fails the suite the moment
+// a parked test starts passing.
+const MAX_KNOWN_FAILING = 1;
 
 const KNOWN_FAILING = {
-  platform_boot: {
-    owner: 'task 1002617 (parked in run-unit-tests KNOWN_FAILING by task 1002611)',
-    why: 'GET / on the apex returns 302, not the 200 landing page the test expects. '
-       + 'Possibly a REAL product bug (the apex redirecting instead of serving the '
-       + 'landing) rather than a test problem, so it was deliberately not "fixed" by '
-       + 'relaxing the assertion. Diagnose the redirect first.',
-  },
   served_paths_shipped: {
     owner: 'task 1002617; collides with the ACTIVE claim "make the /docs/openapi.json endpoint self-healing"',
     why: 'Asserts serve-internal.js reads docs/api/openapi.json. That exact path is what '

package/tests/landing_page.mjs

@@ -209,12 +209,25 @@ test('the ripples are hidden under reduced motion — they rest at full stroke',
 });
 
 test('the self-typing eyebrow degrades to real text, not an empty span', () => {
-  // the script only decorates; markup must already carry the word
-  assert.match(HTML, /<span class="typed" id="typed">bongos<\/span>/);
+  // the script only decorates; markup must already carry the whole sentence
+  assert.match(HTML, /type <b>bongos<\/b> in <span class="typed" id="typed">any AI<\/span>/);
   assert.match(CODE, /matchMedia\('\(prefers-reduced-motion: reduce\)'\)/);
   assert.match(CODE, /if \(!reduce\) \{/, 'the typing loop is skipped under reduced motion');
 });
 
+test('the eyebrow types the ASSISTANT, never the word you type (task 1002743)', () => {
+  // "bongos" is the constant — it is the word a person types — and the
+  // assistant is what varies. Cycling the first slot produced "type claude in
+  // any AI", which nobody does and which inverts the claim the line makes.
+  assert.doesNotMatch(HTML, /type <span class="typed"/, 'the typed span must not hold the typed-word slot');
+  const words = CODE.match(/words\s*=\s*\[([^\]]*)\]/);
+  assert.ok(words, 'the eyebrow word list must be findable');
+  assert.doesNotMatch(words[1], /'bongos'/, 'bongos is fixed copy, never a cycled word');
+  for (const ai of ['Claude', 'ChatGPT', 'Gemini']) {
+    assert.match(words[1], new RegExp(`'${ai}'`), `${ai} must be one of the cycled assistants`);
+  }
+});
+
 test('nothing about the platform is hardcoded — the file is portable (C5)', () => {
   // the source repo link is a real, deliberate attribution; every OTHER mention
   // of an origin must be a token.

package/tests/projects_hub.mjs

@@ -0,0 +1,205 @@
+// tests/projects_hub.mjs — the /projects HUB contract (task 1002743).
+//
+// /projects is one surface holding three views — map (sky | table), your
+// projects, and new project — under a persistent shell, selected by
+// `?view=map|mine|new`. The design contract is docs/design/projects-hub-direction.md
+// plus its approved mock; this file pins the parts of it a later change could
+// break silently, and the numbered constraints it cites are that document's §7.
+//
+// Static analysis on purpose: the page's structure must be true of the FILE, not
+// only of a booted server, because C7 is precisely "real markup, not JS-built".
+// The served shape (branding injection, apex stripping, the id="projectsList"
+// contract) is covered by tests/public_landing_projects.mjs.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
+const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8');
+const STYLE = (HUB.match(/<style>([\s\S]*?)<\/style>/) || [, ''])[1];
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+test('all three views ship as real markup, not built by script (C7)', () => {
+  for (const v of ['map', 'mine', 'new']) {
+    assert.match(HUB, new RegExp(`id="view-${v}"`), `view-${v} must exist in the markup`);
+  }
+  // the map's two sub-views and the manage list are markup too
+  assert.match(HUB, /id="sub-sky-body"/);
+  assert.match(HUB, /id="sub-table-body"/);
+  assert.match(HUB, /id="projectsList"/);
+  // and the copy a crawler reads is in the document, not in a template string
+  assert.match(HUB, /Start a project/);
+  assert.match(HUB, /Your projects/);
+});
+
+test('the nav carries Home plus the three views, and Home is not a view', () => {
+  assert.match(HUB, /data-nav="home"[^>]*>Home|<a href="\/" class="navHome" data-nav="home">Home/);
+  for (const v of ['map', 'mine', 'new']) {
+    assert.match(HUB, new RegExp(`href="\\?view=${v}"\\s+data-nav="${v}"`),
+      `the nav must deep-link ?view=${v}`);
+  }
+  // Home navigates to the landing page; it must never take the current-view pill
+  assert.match(SCRIPT, /if \(a\.dataset\.nav === 'home'\) return;/,
+    'the view router must leave Home as a real navigation');
+  assert.match(SCRIPT, /a\.dataset\.nav !== 'home' && a\.dataset\.nav === v/,
+    'Home must be excluded from the aria-current pill');
+});
+
+test('?view= is the deep-link contract, read on boot and written with replaceState', () => {
+  assert.match(SCRIPT, /new URLSearchParams\(location\.search\)\.get\('view'\)/);
+  assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v\)/);
+  // the landing page's CTAs have always pointed here — this is the bug they hit
+  const landing = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
+  assert.match(landing, /href="\/projects\?view=new"/,
+    'the landing CTA target must stay a view the hub knows');
+});
+
+test('no page-local :root — it would silently defeat re-branding (C1)', () => {
+  // injectBrandingGlobal() splices the pack's :root at the END of <head>, at
+  // equal specificity but later in order. A page-local one outranks it forever.
+  assert.doesNotMatch(STYLE, /(^|\s):root\s*\{/,
+    'page-local :root defeats the branding pack — scope custom properties to their component');
+});
+
+test('the page grounds on .sky, never on body (C3)', () => {
+  // themeMarkup() emits body{background:<light>} after cosmos.css in BOTH modes
+  // and is not mode-aware, so .sky is the only mode-aware full-page paint.
+  assert.match(HUB, /<div class="sky"/);
+  assert.match(COSMOS, /\.sky\{[^}]*background:var\(--sky-bg\)/);
+  assert.doesNotMatch(STYLE, /body\s*\{[^}]*background/,
+    'the hub must not paint its own body background');
+});
+
+test('every dark override in the page is written twice (C2)', () => {
+  const explicit = (STYLE.match(/:root\[data-mode="dark"\]/g) || []).length;
+  const media = (STYLE.match(/:root:not\(\[data-mode="light"\]\)/g) || []).length;
+  assert.equal(explicit, media,
+    'each :root[data-mode="dark"] rule needs its prefers-color-scheme twin');
+});
+
+test('apex-only sections use balanced sentinels so a child instance loses them (C5)', () => {
+  const starts = (HUB.match(/<!--apex-only:start-->/g) || []).length;
+  const ends = (HUB.match(/<!--apex-only:end-->/g) || []).length;
+  assert.equal(starts, ends, 'apex-only sentinels must be balanced');
+  assert.ok(starts >= 2, 'the hall link and the commons claim are both apex-only');
+  // the platform's own orb is apex-only, and it must be MARKUP — stripApexOnly()
+  // is a string transform and cannot reach anything a script renders later
+  const apexBlocks = HUB.match(/<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g) || [];
+  assert.ok(apexBlocks.some((b) => b.includes('selfOrb')),
+    'the platform self-orb must sit inside the sentinels, in markup');
+  assert.ok(apexBlocks.some((b) => b.includes('buildersOrigin')),
+    'the hall link is apex-only — a child instance has no hall');
+});
+
+test('cross-host links are server-stamped tokens, never client-filled', () => {
+  // clientBranding() deliberately withholds domains, so window.__BRANDING__ can
+  // never re-point a hall/apex href. Only the {{token}} pass can.
+  assert.match(HUB, /href="\{\{buildersOrigin\}\}"/);
+  assert.match(HUB, /<title>\{\{productName\}\}/);
+});
+
+test('the hall link is not labelled "Enter the Hall"', () => {
+  // tests/public_landing_projects.mjs forbids that copy on this page: the hall
+  // my-projects card was removed in task 1002675 and an owner must not be sent
+  // there to find their own projects.
+  assert.doesNotMatch(HUB, /Enter the Hall/i);
+});
+
+test('orb accents are tokens, never literal hexes (§6)', () => {
+  // ONE palette serves both the map's spheres and the manage cards, so a
+  // project reads the same colour in either view
+  const accents = (SCRIPT.match(/var ORB_ACCENTS = \[([^\]]*)\]/) || [, ''])[1];
+  assert.ok(accents.length, 'the orb accent list must be findable');
+  assert.doesNotMatch(accents, /#[0-9a-f]{3,8}/i,
+    'a hardcoded hex does not follow a re-theme — derive from tokens');
+  for (const t of ['--sea', '--terracotta', '--accent', '--sun-lit', '--gold-soft']) {
+    assert.match(accents, new RegExp(`var\\(${t}\\)`), `${t} must be one of the orb accents`);
+  }
+  const glows = (SCRIPT.match(/var ORB_GLOWS = ([^;]*);/) || [, ''])[1];
+  assert.doesNotMatch(glows, /rgba?\(/, 'orb glows must derive from the accents, not literal rgba');
+  assert.equal((SCRIPT.match(/var ORB_ACCENTS/g) || []).length, 1,
+    'one palette, not two — the map and the manage cards must not drift apart');
+});
+
+test('accents are assigned by canonical position, not by hashing the name', () => {
+  // a name hash collided: with five tokens and four projects it put three of
+  // them on the same ember and the sky stopped being readable
+  assert.match(SCRIPT, /function assignAccents/);
+  assert.doesNotMatch(SCRIPT, /hashIndex\(p\.name/,
+    'name-hashed accents collide — assign from a canonical order');
+});
+
+test('the mark holds "bongos" and types the assistant, not the other way round', () => {
+  // `bongos` is the word a person types; the assistant is what varies. This is
+  // the same correction the landing hero needed.
+  assert.match(HUB, /<span id="markWord">bongos<\/span>/);
+  const prefixes = (SCRIPT.match(/var PREFIXES = \[([^\]]*)\]/) || [, ''])[1];
+  assert.ok(prefixes.length, 'the typed prefix list must be findable');
+  assert.doesNotMatch(prefixes, /'bongos'/, 'bongos is the constant, never a typed variant');
+  assert.match(prefixes, /'claude'/);
+});
+
+test('the typing and the map both respect prefers-reduced-motion (C9)', () => {
+  assert.match(SCRIPT, /prefers-reduced-motion: reduce/);
+  assert.match(SCRIPT, /if \(REDUCED \|\|/, 'the typing loop must be skipped under reduced motion');
+});
+
+test('the owner poll is view-guarded — it must not run on the map (C8)', () => {
+  assert.match(SCRIPT, /function shouldPoll\(\)[\s\S]*?currentView === 'mine'/,
+    'the settled-card refresh must only run in the view that has cards');
+});
+
+test('catalog origins are scheme-checked before they become hrefs', () => {
+  // esc() neutralizes HTML metacharacters but NOT a `javascript:` URI, and this
+  // page drives teardown / revive / domain-attach for the signed-in owner — so
+  // script running in its origin is not a small thing. Same predicate the
+  // landing page's catalog band already uses (public-landing/index.html:544).
+  assert.match(SCRIPT, /function safeHttpUrl/);
+  assert.match(SCRIPT, /u\.protocol === 'https:' \|\| u\.protocol === 'http:'/);
+  // and no raw origin may reach an href
+  assert.doesNotMatch(SCRIPT, /a\.href = p\.origin/, 'orb hrefs must go through safeHttpUrl');
+  assert.doesNotMatch(SCRIPT, /href="' \+ esc\(p\.origin\)/, 'table hrefs must go through safeHttpUrl');
+});
+
+test('liveness is never claimed for a catalog row the hub did not probe (C6)', () => {
+  // the public feed carries origin/name/tagline/art_url and nothing else — a
+  // chip saying "live" here would assert more than anything verified
+  assert.match(SCRIPT, /chip calm/, 'an unprobed catalog row gets the calm chip');
+  assert.doesNotMatch(SCRIPT, /chip live[^']*'\s*\+\s*esc\(p\./,
+    'no catalog row may be rendered as live');
+  // the three active outcomes stay three in the manage list
+  for (const label of ['unreachable', 'live\\?', 'live']) {
+    assert.match(SCRIPT, new RegExp(`'${label}'`), `the ${label} outcome must survive`);
+  }
+});
+
+test('the gate is retired — no route, no files, no links into it', () => {
+  // the FILES, not the directory: git cannot track an empty dir, so a stale
+  // working tree may keep the folder while the commit is clean
+  for (const f of ['index.html', 'space.js', 'space.css']) {
+    assert.equal(fs.existsSync(path.join(ROOT, 'public-landing', 'gate', f)), false,
+      `public-landing/gate/${f} must be gone: express.static would keep serving it`);
+  }
+  const server = fs.readFileSync(path.join(ROOT, 'src', 'platform-server.js'), 'utf8');
+  assert.doesNotMatch(server, /res\.redirect\(302, '\/gate\/'\)/,
+    'the apex must serve the landing page, not redirect into the gate');
+  assert.doesNotMatch(server, /gateIndexPath/);
+  assert.doesNotMatch(HUB, /href="\/gate/);
+});
+
+test('/create still answers — the hub links it rather than absorbing it', () => {
+  // Task 1002743's Part 3 was AMENDED by the owner on 2026-08-13 to move the
+  // "/create redirects into the hub" clause to task 1002763, which carries the
+  // port that makes it safe. ?view=new is step 1 of the four-beat rail, so
+  // redirecting /create here before the wizard lives in the hub would let a
+  // visitor name a project and then go nowhere — creation would break. The
+  // wizard also has four id collisions with this page and a replaceState that
+  // strips the query string. Until 1002763 lands, /create must keep answering.
+  assert.ok(fs.existsSync(path.join(ROOT, 'public-landing', 'create.html')));
+  assert.match(SCRIPT, /location\.assign\('\/create'/);
+  assert.match(HUB, /href="\/create"/, 'the empty state must still point at the wizard');
+});

package/public-landing/gate/README.md

@@ -1,137 +0,0 @@
-# Cloud Bongos — landing gate (interactive)
-
-`index.html` is the Cloud Bongos landing experience — a small state machine over one
-self-contained page (`space.css` + `space.js` for the space side; the download scene + its
-drag physics live in the inline `<script>`), built from **drawn ATLA-style sprites**
-(`sprites/*.png` — a `> cloud bongos` terminal, an enter key, a search bar, and download tiles)
-refracting the backdrop through SVG displacement maps.
-
-## The flow (tasks 1721, 1722)
-
-Four body-class views: `view-entry` → `view-space` → `view-download` / `view-detail`.
-
-1. **Entry — type `bongos`, in space** (`#entry`, `view-entry`). Every visit lands here: the
-   `> cloud ▊` terminal floating in the **space sky** (deep-blue → sunrise gradient, drifting
-   clouds), *not* the temple world. Typing `bongos` is the ritual on every visit; the enter key
-   lights, and pressing enter flashes through into the circles. Driven by `space.js`
-   (`entryKey` / `enterSite`), reusing the terminal + enter CSS.
-2. **Space — the circles** (`#space` / `#space-canvas`, `view-space`). A pannable, zoomable sky
-   of project orbs, sized by number of builders, moving as a **living gravity cluster** — every
-   orb attracts every other by its mass (∝ size³), so the field swirls, bodies sling past one
-   another, and a small orb is sometimes briefly caught circling a big one like a moon (task
-   1733; see "The gravity" below). Project data is **inlined** in `space.js` (`PROJECTS`) — Caddy
-   404s `*.json` on staging — so swap in a real registry by changing `PROJECTS` + `layout()`.
-   - **Drag** empty sky to pan · **scroll** to zoom (toward the cursor).
-   - **Hover** an orb for an info card; **click** it to dive in.
-   - **Space bar** opens a search scoped to the orbs **currently in view** (client-side match
-     over name/tagline/tags now; the Claude-backed answer is a dormant seam, `aiAnswer()`, per
-     the "interaction now, AI wired next" decision).
-   - **Click empty sky** drops a new project circle.
-3. **Download — Cloud Bongos' install page** (`#land` in `.stage`, `view-download`). Clicking the
-   Cloud Bongos orb zooms **straight** into the search + download-tiles scene over the
-   temple-world backdrop — **no type-`bongos` gate in between** (that already happened at entry).
-   `space.js` fires `cb:show-download`; the inline script reveals `#land` and runs its drag.
-4. **Detail — other projects** (`#detail`, `view-detail`). Clicking any non-self orb opens a
-   themed "full story — coming soon" page with a link out to its live site.
-
-**ESC** rises from the download or detail page back to the circles (`space.js` → `cb:hide-download`).
-
-## The download scene's elastic-tether drag (task 1534)
-
-Every download sprite (search bar, tiles, wordmark) is draggable. Grab one and it resists like
-it's anchored; pull past the threshold and it snaps free, hovers, then drifts slowly home and
-re-docks, carrying a faint idle bob at rest. The physics is scoped to `.stage`, so it never
-grabs the entry terminal (which `space.js` owns). **This scene is separate from the space
-gravity below — the download interaction is unchanged by task 1733.**
-
-## The space gravity — a living n-body cluster (task 1733)
-
-The project orbs on the **space** view (`view-space`) are a real gravitational simulation, all
-in `space.js`. Each orb is a body with **mass ∝ size³** (more builders → bigger → heavier →
-pulls harder), so the sky behaves like planets, suns and the occasional fleeting moon rather
-than a fixed scatter. Under the hood:
-
-- **Softened Newtonian gravity**, every pair, so a close pass *slings* instead of blowing up
-  (no singularities).
-- A **fixed-timestep leapfrog integrator** (`physStep`) for accurate, energy-stable motion; the
-  frame loop (`tick` → `render`) interpolates between steps for smoothness.
-- **Soft collisions** so discs bounce rather than overlap; a **soft containment well** plus a
-  **band thermostat** keep the swirl bounded and lively *forever* — energy is free to ebb and
-  flow inside a band, and only a runaway collapse or blow-up gets a gentle nudge back.
-- Net drift is removed each step, so the cluster stays centred on screen (and stays put when a
-  visitor adds a new orb, which is flung into the swirl).
-
-Verified stable over a 60-minute headless simulation (no NaN, never off-screen, never
-interpenetrating). It replaced the earlier "drift around fixed anchors" motion.
-
-### Tuning the gravity
-
-All knobs live in the `GRAV` block near the top of `space.js`:
-
-| You want…                            | Edit (in `GRAV`)                                  |
-|--------------------------------------|---------------------------------------------------|
-| Livelier / faster swirl              | `SWIRL` ↑ (or `THERMO_LO` ↑)                       |
-| Calmer, slower motion                | `SWIRL` ↓ / `THERMO_LO` ↓                          |
-| Tighter cluster (less panning)       | `CONTAIN_R` ↓                                      |
-| Stronger pull between orbs           | `G` ↑                                              |
-| Fewer hard slingshots on near-misses | `SOFTEN` ↑                                         |
-| Bouncier contacts (→ elastic)        | `REST` → 1                                         |
-| Sharper size→mass contrast           | lower `R_REF`, or raise the `massFor` exponent     |
-
-Turn it off (freeze the orbs): comment out `initOrbits()` in `layout()` and the
-`requestAnimationFrame(tick)` at the bottom of the IIFE — pan, zoom, hover, dive, search and the
-table all keep working.
-
-> **Live:** password-locked at **staging.cloudbongos.com** (the future landing page, parked
-> for review). Setup + the password live in [`docs/recipes/cloudbongos-staging-gate.md`](../../../docs/recipes/cloudbongos-staging-gate.md).
-> Branding (logo coin / wordmark / mascot / code-glyphs) is still being finished and is
-> intentionally untouched here.
-
-## Preview it locally
-
-The page links to art one folder up (`../world/assets/…`), so it must be served from the
-**`brand/cloud-bongos/`** folder — not from `gate/` itself, or those paths break.
-
-**Easiest (Claude Code preview):** start the `gate-preview` server in `.claude/launch.json`,
-then open `http://127.0.0.1:8137/gate/index.html`.
-
-**From a terminal** (repo root): `python3 -m http.server --directory brand/cloud-bongos 8137`,
-then open <http://127.0.0.1:8137/gate/index.html>.
-
-Use a Chromium browser (Chrome/Edge) — the live-glass refraction relies on `backdrop-filter`
-with an SVG displacement map. Safari ignores the displacement and falls back to a plain
-frost, which still looks fine.
-
-## Tuning the drag
-
-All behaviour is in the single `<script>` at the bottom of `index.html`, which opens with a
-commented **TUNING** block. Common tweaks:
-
-| You want…                                | Edit (in the TUNING block)        |
-|------------------------------------------|-----------------------------------|
-| Harder / easier to pull a pane free      | `THRESHOLD` — ↑ harder, ↓ easier  |
-| How far a tap can move before it's a drag | `DEADZONE` — px                   |
-| Freed panes wait longer before returning | `HOVER` — milliseconds            |
-| Slower, more drifty return               | `DRIFT_MAXV` — ↓ slower           |
-| Wider, more wandering return path        | `WMAG` ↑ and/or `TURN` ↓          |
-| More / less idle "breathing"             | `BOB_X`, `BOB_Y` (px) — `0` = off |
-
-### Which elements are draggable
-
-The drag targets **`.mark`** (the wordmark) + every **`.el`** sprite pane (terminal, enter,
-search, tiles). To add one, give it the `el` class (or push it into the `els` array); to
-exclude one, filter it out of `els`.
-
-### Why it does not fight the other animations
-
-The drag only ever applies `transform: translate(…)` to each pane, and it owns that property
-exclusively — so the float/reveal animations were replaced by the drag's own idle bob, and
-the enter key's reveal uses opacity + blur only (no transform). The **scene** transforms
-(the dive's scale/translate) live on the parent `.gate`/`.land` containers, so they compose
-with the per-pane drag instead of clobbering it. When a scene settles, `measure()` re-runs
-so a freshly-revealed pane drags from the right home.
-
-### Turn the drag off
-
-Delete the second `<script>` IIFE (the drag) — the type→dive interaction and all the art
-keep working untouched.