@bongos/core 1.19.96 → 1.19.98

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.96",
-  "core_contract": "1.19.96",
-  "source_commit": "de62c4bfbfbe46d6479fdfbfb97dc0873611c6a5",
+  "core_version": "1.19.98",
+  "core_contract": "1.19.98",
+  "source_commit": "6616c83d7f0ee7029db21b183e3983fc16568aad",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T22:10:53.979Z",
+  "built_at": "2026-08-13T22:25:33.504Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 298,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1549,
-  "tree_sha256": "fc9aca20647400c8086abd620cf8832fdc20b5695b0dc56bb6cae9c303d41182",
+  "tree_sha256": "729068034b75cf1c5878e8099c36f949384e07228d6337ea7387c7d586abd68e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4127,12 +4127,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5e745806419d6f06345f86548e6dab1997086a56087f87e06172fab999df9203"
+      "sha256": "1fac3202890f9d9899a8aaa72a473e4f73b6c27dccc28dd7a064a3c5b1367b85"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5f0a6df46c69e1584b8ed6a9023858fbb769114c5912dcb87448effd645fe6b4"
+      "sha256": "b8338943bf583ab9caa3686836ebeafb43be12df7f156f991763278abcca02dc"
     },
     {
       "path": "public-docs/index.html",
@@ -4372,7 +4372,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "106a8508531bbb320f72e76e22bffdb4249c2024a9a3711050ba5c54a966ce7e"
+      "sha256": "5f39814ab40306bc3fc5d4160119b85e2134f778dd62a7a6e6183e36a3ed193e"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4392,7 +4392,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "a79a9a26b3e33b539d3731c3629a6e4302352f9e89559e42df6bf5801dd86ef6"
+      "sha256": "5fd5fe20f1cb0186fd4ae69a7124a3305703952c7ac9662421793449b7ba8e26"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5702,7 +5702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aae1ee2bdf9de2e173d26cfa7c1ad4af1b2f14e8be763903d70af840a08b1465"
+      "sha256": "fb7a891d2f7b815e57271245e93c4e4ede5f78bedb76e4648fcbf56b69ad3de3"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7212,7 +7212,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "59a6bcd44d374802b31e8ccf487b8fbbf6322d6bfac7f079d69f39d7bd8a02db"
+      "sha256": "9495982aa30c4e845ab879a571be1d6753e39c3f1e3b2629ae9b41feeaf471cc"
     },
     {
       "path": "tests/provision.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.96",
+  "version": "1.19.98",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.96",
+      "version": "1.19.98",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.96",
+  "version": "1.19.98",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -533,6 +533,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   color:var(--ink-soft);vertical-align:middle;}
 .tbl tr:last-child td{border-bottom:none;}
 .tbl tr:hover td{background:color-mix(in srgb,var(--accent) 5%,transparent);}
+/* the whole row opens the project card, so it must look like it does */
+.tbl tbody tr{cursor:pointer;}
 .tbl .pname{display:flex;align-items:center;gap:11px;}
 .tbl .pdot{width:11px;height:11px;border-radius:50%;background:var(--acc);flex:0 0 auto;
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
@@ -557,6 +559,35 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colName{width:auto;}
 @media (max-width:780px){.tbl .colTags,.tbl .colType{display:none;}}
 
+/* ── the project card ──
+   An overlay INSIDE the map, not a destination: opening a project must not cost
+   you the sky you were reading (direction §9). It sits above .shell (z-index 40)
+   because a modal under the page chrome is a modal you can click behind.
+
+   The scrim is a plain rgba black in BOTH modes on purpose, so it needs no dark
+   override at all — a token here would have to be ink, and ink is near-white in
+   dark, which paints a white sheet over the page instead of dimming it. */
+.cardScrim{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;
+  padding:24px;background:rgba(0,0,0,.55);backdrop-filter:blur(3px);}
+.projCard{position:relative;width:min(420px,100%);background:var(--bg-card);border:1.5px solid var(--line);
+  border-radius:var(--r-card,20px);box-shadow:var(--shadow-card);padding:30px 28px 26px;text-align:center;}
+.projCard .cardDot{display:block;width:54px;height:54px;border-radius:50%;margin:0 auto 16px;
+  background:var(--acc,var(--accent));box-shadow:0 0 0 8px color-mix(in srgb,var(--acc,var(--accent)) 18%,transparent);}
+.projCard h3{font-family:var(--font-display);font-weight:700;font-size:21px;color:var(--ink);margin-bottom:6px;}
+.projCard .cardTag{font-size:14px;color:var(--ink-faint);font-weight:600;line-height:1.5;margin-bottom:14px;}
+.projCard .cardRel{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
+  border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);margin-bottom:18px;}
+:root[data-mode="dark"] .projCard .cardRel{color:var(--sun-lit);}
+@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .projCard .cardRel{color:var(--sun-lit);}}
+.projCard .cardActions{display:flex;gap:10px;justify-content:center;flex-wrap:wrap;}
+.projCard .cardX{position:absolute;top:10px;right:12px;width:30px;height:30px;border-radius:50%;
+  border:none;background:none;cursor:pointer;font-size:14px;color:var(--ink-faint);line-height:1;}
+.projCard .cardX:hover{background:var(--accent-soft);color:var(--accent-deep);}
+@media (prefers-reduced-motion:no-preference){
+  .cardScrim:not([hidden]) .projCard{animation:cardIn .16s ease-out;}
+  @keyframes cardIn{from{opacity:0;transform:translateY(6px) scale(.98);}to{opacity:1;transform:none;}}
+}
+
 /* ── your projects: search + a state filter whose pills carry live counts, so
    a state with nothing in it reads 0 before you click it. The filter GROUPS
    the chip outcomes; it never relabels them — "Live" holds both `live` and

package/public-landing/projects.html

@@ -159,6 +159,22 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       </div>
       <div class="hintbar"><span><kbd>click a project</kbd> open it</span></div>
     </div>
+
+    <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
+         a project must not cost you the sky you were reading (direction §9).
+         Real markup, never JS-built (C7) — the same reason every other view
+         ships as markup — so its copy is in the document and its ids are stable.
+         Filled by openCard(); it carries no project identity of its own. -->
+    <div class="cardScrim" id="cardScrim" hidden>
+      <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
+        <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
+        <span class="cardDot" id="cardDot"></span>
+        <h3 id="cardName"></h3>
+        <p class="cardTag" id="cardTag"></p>
+        <p class="cardRel" id="cardRel" hidden></p>
+        <div class="cardActions" id="cardActions"></div>
+      </div>
+    </div>
   </div>
 
   <div class="wrap viewWrap" id="sub-table-body" hidden>
@@ -457,13 +473,30 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     $('markPrefix').textContent = prefix;
     if (REDUCED || prefix !== 'cloud' || word !== 'bongos') return;
     var PREFIXES = ['cloud', 'claude', 'chatgpt', 'gemini'];
-    var wi = 0, ci = PREFIXES[0].length, dir = -1;
-    setInterval(function () {
-      ci += dir;
-      if (ci <= 0) { dir = 1; wi = (wi + 1) % PREFIXES.length; ci = 0; }
-      else if (ci >= PREFIXES[wi].length) { dir = -1; ci = PREFIXES[wi].length; }
-      $('markPrefix').textContent = PREFIXES[wi].slice(0, ci);
-    }, 190);
+
+    /* Type, HOLD, erase — the landing hero's cadence (index.html), not a
+       symmetric ping-pong. The single reversing interval this replaced turned
+       around on the very tick it completed a word, so `claude bongos` finished
+       and was already being deleted: the reader never got to see the word the
+       whole animation exists to show. A hold is the only part of the cycle that
+       carries meaning; the typing is just how it arrives.
+
+       `cloud` rests longest because it is the real wordmark and the state the
+       mark should sit in most — the others are the joke, and the joke lands
+       once. Same two numbers the hero uses, so the two surfaces read as one
+       system rather than two animations that happen to share a font. */
+    var TYPE = 72, ERASE = 38, HOLD = 900, HOLD_HOME = 2100;
+    var el = $('markPrefix'), wi = 0;
+    (function cycle() {
+      var w = PREFIXES[wi++ % PREFIXES.length], i = 0;
+      (function type() {
+        if (i <= w.length) { el.textContent = w.slice(0, i++); setTimeout(type, TYPE); }
+        else setTimeout(function erase() {
+          if (el.textContent.length) { el.textContent = el.textContent.slice(0, -1); setTimeout(erase, ERASE); }
+          else cycle();
+        }, w === 'cloud' ? HOLD_HOME : HOLD);
+      })();
+    })();
   })();
 
   /* ══ THE MAP ═══════════════════════════════════════════════════════════════
@@ -495,7 +528,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
      and the sort comparator as if a row existed. This keeps the self entry a
      view-level concern (the owner's call, 2026-08-13) while still letting the
      search box match it by the same predicate every other project uses. */
-  var SELF_PROJECT = { name: productName, tagline: 'this platform' };
+  var SELF_PROJECT = { name: productName, tagline: 'this platform', isSelf: true };
   var mapSort = { key: 'name', dir: 1 };
 
   /* Catalog origins become hrefs, so they are scheme-checked before they are
@@ -559,8 +592,13 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       a.setAttribute('data-generated', '');
       a.setAttribute('data-rel', relOf(p));
       var href = safeHttpUrl(p.origin);
+      /* The href STAYS, and stays honest, even though a plain click now opens
+         the card instead of following it: it is what makes the orb a real link
+         — focusable, Enter-activatable, and still ctrl/middle-clickable into a
+         new tab. The card is layered over that, not substituted for it. */
       a.href = href || '#';
       if (href) { a.target = '_blank'; a.rel = 'noopener'; }
+      a.setAttribute('data-origin', String(p.origin || ''));
       a.title = p.tagline || p.name || '';
       a.style.cssText = '--acc:' + accentOf(p) +
         ';--d:' + slot[2] + 'px;left:' + slot[0] + '%;top:' + slot[1] + '%';
@@ -585,7 +623,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       var rel = relOf(p);
       var pill = rel === 'owner' ? ' <span class="pill">yours</span>'
         : rel === 'builder' ? ' <span class="pill">you build here</span>' : '';
-      return '<tr data-generated>' +
+      return '<tr data-generated data-origin="' + esc(String(p.origin || '')) + '">' +
         '<td class="colName"><span class="pname"><span class="pdot" style="--acc:' +
           accentOf(p) + '"></span>' +
           '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
@@ -648,6 +686,90 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     $('mapCount').textContent = shown + (shown === 1 ? ' project' : ' projects');
   }
 
+  /* ══ THE PROJECT CARD ══════════════════════════════════════════════════════
+     Every orb and every row opens THIS. Before, each one navigated: catalog
+     orbs into a new tab and the platform's own orb — an <a href="/"> — straight
+     back to the landing page, so clicking the project you were standing on threw
+     away the map to show you a marketing page. Direction §9 called for one
+     overlay card serving every project, self included; the owner adopted it
+     2026-08-13. The card is layered OVER the links rather than replacing them,
+     so ctrl/middle-click still opens a project's site directly.
+
+     It states only what the public catalog actually carries — name, tagline,
+     your relationship, a door — because /projects/featured selects four columns
+     and cannot answer anything richer for a catalog row (task 1002744 owns that
+     data path). A card that showed builders or liveness here would be inventing
+     both, the same C6 lie the table's em dashes exist to avoid. ══ */
+
+  var cardReturn = null;   /* the element focus came from, to hand it back */
+
+  function projByOrigin(o) {
+    for (var i = 0; i < catalog.length; i++) if (String(catalog[i].origin) === o) return catalog[i];
+    return null;
+  }
+
+  function openCard(p, rel, returnTo) {
+    var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
+    $('cardDot').style.setProperty('--acc', p.isSelf ? 'var(--accent)' : accentOf(p));
+    $('cardName').textContent = p.name || '';
+    $('cardTag').textContent = p.tagline || '';
+    var label = rel === 'owner' ? 'yours' : rel === 'builder' ? 'you build here' : '';
+    $('cardRel').textContent = label;
+    $('cardRel').hidden = !label;
+    /* the platform's door is same-tab: / is this site, and a new tab for the
+       page you are already on is a bug, not a courtesy */
+    $('cardActions').innerHTML = href
+      ? '<a class="btn small" href="' + esc(href) + '"' +
+        (p.isSelf ? '' : ' target="_blank" rel="noopener"') + '>' +
+        (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
+      : '';
+    cardReturn = returnTo || null;
+    $('cardScrim').hidden = false;
+    $('cardClose').focus();
+  }
+
+  function closeCard() {
+    if ($('cardScrim').hidden) return;
+    $('cardScrim').hidden = true;
+    if (cardReturn && cardReturn.focus) cardReturn.focus();
+    cardReturn = null;
+  }
+
+  /* Delegated, so orbs and rows rebuilt by every filter keystroke stay wired
+     without re-binding. A modified click is left ALONE — ctrl/cmd/shift/middle
+     mean "open in a new tab" everywhere else on the web and the orb is a real
+     link, so intercepting them would break an expectation the markup makes. */
+  function isPlainClick(ev) {
+    return !(ev.metaKey || ev.ctrlKey || ev.shiftKey || ev.altKey || ev.button > 0);
+  }
+
+  $('orbField').addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('.worldOrb');
+    if (!a || !isPlainClick(ev)) return;
+    ev.preventDefault();
+    if (a.id === 'selfOrb') return openCard(SELF_PROJECT, selfRel(), a);
+    var p = projByOrigin(a.getAttribute('data-origin') || '');
+    if (p) openCard(p, relOf(p), a);
+  });
+
+  $('mapRows').addEventListener('click', function (ev) {
+    /* the row's own "Open →" keeps its job — the card is for the rest of the row */
+    if (ev.target.closest && ev.target.closest('a')) return;
+    var tr = ev.target.closest && ev.target.closest('tr');
+    if (!tr || !isPlainClick(ev)) return;
+    if (tr.id === 'selfRow') return openCard(SELF_PROJECT, selfRel(), null);
+    var p = projByOrigin(tr.getAttribute('data-origin') || '');
+    if (p) openCard(p, relOf(p), null);
+  });
+
+  $('cardClose').addEventListener('click', closeCard);
+  $('cardScrim').addEventListener('click', function (ev) {
+    if (ev.target === $('cardScrim')) closeCard();   /* backdrop only, never the card */
+  });
+  document.addEventListener('keydown', function (ev) {
+    if (ev.key === 'Escape') closeCard();
+  });
+
   function loadCatalog() {
     fetch(API + '/projects/featured', { credentials: 'same-origin' })
       .then(function (res) { if (!res.ok) throw new Error('catalog'); return res.json(); })

package/src/module-api.js

@@ -619,8 +619,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.94 with no explicit bump. run 31746921919. (task 1002620)
 //   1.19.96 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.95 with no explicit bump. run 31748829423. (task 1002620)
+//   1.19.97 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.96 with no explicit bump. run 31749223878. (task 1002620)
+//   1.19.98 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.97 with no explicit bump. run 31749841394. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.96'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.98'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -238,7 +238,7 @@ test('the renderer preserves the self row exactly as it preserves the self orb',
     'a wholesale innerHTML= on #mapRows destroys the static self row');
   assert.match(SCRIPT, /querySelectorAll\('tr\[data-generated\]'\)/,
     'generated rows must be removed selectively, like .worldOrb[data-generated]');
-  assert.match(SCRIPT, /<tr data-generated>/, 'generated rows must be markable');
+  assert.match(SCRIPT, /<tr data-generated[ >]/, 'generated rows must be markable');
 });
 
 test('"only mine" no longer hides the platform from a signed-in builder', () => {
@@ -271,3 +271,102 @@ test('the count includes the platform when it is shown', () => {
     'the count must not ignore the self entry it is rendering beside');
   assert.match(SCRIPT, /var shown = list\.length \+ \(selfShown \? 1 : 0\)/);
 });
+
+/* ── The wordmark's cadence (task 1002765) ──────────────────────────────────
+   The mark completed a word and erased it on the same tick, so the word the
+   animation exists to show was never legible. Owner-reported, twice. ── */
+
+test('the wordmark HOLDS the finished word before erasing it', () => {
+  const mark = (SCRIPT.match(/function typeMark\(\)([\s\S]*?)\n  \}\)\(\);/) || [, ''])[1];
+  assert.ok(mark, 'typeMark() must exist');
+  // the regression shape: one interval that flips direction the moment it
+  // completes a word, so there is no dwell at full length
+  assert.doesNotMatch(mark, /setInterval/,
+    'a single reversing interval cannot hold — it turns around on the tick it completes');
+  assert.match(mark, /HOLD\s*=\s*\d+/, 'the hold must be a named duration, not an accident of timing');
+  // and it must actually be a pause worth reading, not a couple of frames
+  const hold = Number((mark.match(/HOLD\s*=\s*(\d+)/) || [, 0])[1]);
+  assert.ok(hold >= 600, `the hold must be legible; got ${hold}ms`);
+});
+
+test('the wordmark rests on the real product name, not on a joke', () => {
+  const mark = (SCRIPT.match(/function typeMark\(\)([\s\S]*?)\n  \}\)\(\);/) || [, ''])[1];
+  assert.match(mark, /w === 'cloud' \? HOLD_HOME : HOLD/,
+    'the canonical prefix should dwell longest — it is the wordmark, the others are the gag');
+  const home = Number((mark.match(/HOLD_HOME\s*=\s*(\d+)/) || [, 0])[1]);
+  const hold = Number((mark.match(/HOLD\s*=\s*(\d+)/) || [, 0])[1]);
+  assert.ok(home > hold, 'the resting state must outlast the alternates');
+});
+
+test('the hub and the landing hero share one typing cadence', () => {
+  // two surfaces, one system — a divergence here is a visible inconsistency
+  const LANDING = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
+  const heroHolds = [...LANDING.matchAll(/\?\s*(\d+)\s*:\s*(\d+)\)/g)].map(m => [m[1], m[2]]).flat();
+  const mark = (SCRIPT.match(/function typeMark\(\)([\s\S]*?)\n  \}\)\(\);/) || [, ''])[1];
+  for (const n of [mark.match(/HOLD_HOME\s*=\s*(\d+)/)[1], mark.match(/HOLD\s*=\s*(\d+)/)[1]]) {
+    assert.ok(heroHolds.includes(n), `hold ${n}ms should match the hero's cadence (${heroHolds.join('/')})`);
+  }
+});
+
+/* ── The project card (task 1002770) ────────────────────────────────────────
+   Every orb used to navigate: catalog orbs into a new tab, and the platform's
+   own orb straight back to the landing page — so clicking the project you were
+   standing on threw away the map. Direction §9's overlay, owner-adopted. ── */
+
+test('the card is real markup in the map, not a JS-built node (C7)', () => {
+  assert.match(HUB, /id="cardScrim"/);
+  assert.match(HUB, /id="projCard"/);
+  // it lives inside the map view, not as a fourth destination
+  const map = (HUB.match(/<section id="view-map">([\s\S]*?)<\/section>/) || [, ''])[1];
+  assert.match(map, /id="cardScrim"/, 'the card is an overlay INSIDE the map');
+  assert.doesNotMatch(HUB, /id="view-detail"/, 'and never a view of its own');
+});
+
+test('the card is a labelled modal dialog', () => {
+  const card = (HUB.match(/<div class="projCard"[^>]*>/) || [''])[0];
+  assert.match(card, /role="dialog"/);
+  assert.match(card, /aria-modal="true"/);
+  assert.match(card, /aria-labelledby="cardName"/);
+  assert.match(HUB, /id="cardClose"[^>]*aria-label="Close"/, 'and has a labelled close control');
+});
+
+test('the platform orb opens the card instead of leaving for the landing page', () => {
+  // the reported bug: <a id="selfOrb" href="/"> navigated away on a plain click
+  assert.match(SCRIPT, /a\.id === 'selfOrb'\) return openCard\(SELF_PROJECT/,
+    'a plain click on the self orb must open the card');
+  // the href stays — it is what keeps the orb a real, focusable, ctrl-clickable link
+  assert.match(HUB, /id="selfOrb" href="\/"/, 'the orb stays a real link');
+});
+
+test('a modified click is left alone — the orb is still a link', () => {
+  assert.match(SCRIPT, /function isPlainClick/);
+  const fn = (SCRIPT.match(/function isPlainClick\(ev\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  for (const k of ['metaKey', 'ctrlKey', 'shiftKey']) {
+    assert.match(fn, new RegExp(k), `${k} must fall through to the browser`);
+  }
+});
+
+test('the card closes by Escape, backdrop and the close control', () => {
+  assert.match(SCRIPT, /ev\.key === 'Escape'/);
+  assert.match(SCRIPT, /ev\.target === \$\('cardScrim'\)/, 'backdrop only — a click on the card must not close it');
+  assert.match(SCRIPT, /\$\('cardClose'\)\.addEventListener\('click', closeCard\)/);
+});
+
+test('focus enters the card and is handed back on close', () => {
+  assert.match(SCRIPT, /\$\('cardClose'\)\.focus\(\)/, 'focus must move into the dialog');
+  assert.match(SCRIPT, /cardReturn(\.focus)?/, 'and return to where it came from');
+  assert.match(SCRIPT, /cardReturn\.focus\(\)/);
+});
+
+test('the card claims nothing the public catalog cannot answer (C6)', () => {
+  const card = (HUB.match(/<div class="cardScrim"[\s\S]*?<\/div>\s*<\/div>/) || [''])[0];
+  // /projects/featured selects origin, name, tagline, art_url — and nothing else
+  for (const invented of [/Builders/i, /\blive\b/i, /uptime/i, /\btags\b/i]) {
+    assert.doesNotMatch(card, invented, `the card must not invent ${invented}`);
+  }
+});
+
+test('the row keeps its own Open link working underneath the card', () => {
+  assert.match(SCRIPT, /if \(ev\.target\.closest && ev\.target\.closest\('a'\)\) return;/,
+    'a click on the row\'s own anchor must not be swallowed by the card handler');
+});