@bongos/core 1.19.97 → 1.19.99

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.97",
-  "core_contract": "1.19.97",
-  "source_commit": "98de965667e063aac8e2bd2de7a3d05f588aa7b5",
+  "core_version": "1.19.99",
+  "core_contract": "1.19.99",
+  "source_commit": "7ab95a1bcf1751dbc3f5890c41461dcad6826506",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T22:16:31.509Z",
+  "built_at": "2026-08-13T22:41:45.519Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 298,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1549,
-  "tree_sha256": "5057e83f784804f0af10e3b926390ed83212d7b23656b12359d5bdfd429caa25",
+  "tree_sha256": "37c2c9f1fb605b8e730ce3562abac5ed38699596c45f2113f0066464fb12b85f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4127,12 +4127,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "20f03a27edf41b5de61cd36c58e61d2e0acad8cfc68a4bfa23c19786ead8e1f1"
+      "sha256": "1df1aa5e45f918110c6adebcec118d46207c09bfadd5bf17ddc1b563cb67d8f7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "136d49d62b377412dcb7ad5884c8a7ca439bfc41544be3d3a5233a4cd11100e7"
+      "sha256": "4cf100a9e30702e1e1bdcb42c3437e2ce4fe61795bca9c305ce08fb17c42438d"
     },
     {
       "path": "public-docs/index.html",
@@ -4372,7 +4372,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "106a8508531bbb320f72e76e22bffdb4249c2024a9a3711050ba5c54a966ce7e"
+      "sha256": "5f39814ab40306bc3fc5d4160119b85e2134f778dd62a7a6e6183e36a3ed193e"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4392,7 +4392,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "3a77a5f30acaa793ef82b434bf6a87033d580923231f7e66673cdc533a6767d1"
+      "sha256": "5fd5fe20f1cb0186fd4ae69a7124a3305703952c7ac9662421793449b7ba8e26"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5702,7 +5702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4b6c32f29637b84b0e11cd7e0fb7394e4f33d9b520f63c8c34c94de33aa65449"
+      "sha256": "896f7912e0981f27a671fb68d5cada8481f84e2cfc1025c3cb3c69eda95f7fe9"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5737,7 +5737,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "181c9850c374b653136a259d80e276ac285d2ee5f55fadeb9109aef418190d91"
+      "sha256": "6ffe23398bc452b4224e7c4aa49dbd3c4f61a61da0fd51d43bb6c5ce0bd51aa7"
     },
     {
       "path": "src/ui/adapters/claude-design/index.js",
@@ -7212,7 +7212,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "cffae7809fb64eec684987895dc2b82b7de758cd950bea5d013cb210db3c6220"
+      "sha256": "9495982aa30c4e845ab879a571be1d6753e39c3f1e3b2629ae9b41feeaf471cc"
     },
     {
       "path": "tests/provision.mjs",
@@ -7247,7 +7247,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "489ad330f7fe118ffd66a22b0a437743a2f3d3610a5324ba764abc4fc88b0c74"
+      "sha256": "e03bbf258cb4b8ffd3e242ab2ddd927d1f52706347d06b539a386ca502caf1e4"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.97",
+  "version": "1.19.99",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.97",
+      "version": "1.19.99",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.97",
+  "version": "1.19.99",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -533,6 +533,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   color:var(--ink-soft);vertical-align:middle;}
 .tbl tr:last-child td{border-bottom:none;}
 .tbl tr:hover td{background:color-mix(in srgb,var(--accent) 5%,transparent);}
+/* the whole row opens the project card, so it must look like it does */
+.tbl tbody tr{cursor:pointer;}
 .tbl .pname{display:flex;align-items:center;gap:11px;}
 .tbl .pdot{width:11px;height:11px;border-radius:50%;background:var(--acc);flex:0 0 auto;
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
@@ -557,6 +559,35 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colName{width:auto;}
 @media (max-width:780px){.tbl .colTags,.tbl .colType{display:none;}}
 
+/* ── the project card ──
+   An overlay INSIDE the map, not a destination: opening a project must not cost
+   you the sky you were reading (direction §9). It sits above .shell (z-index 40)
+   because a modal under the page chrome is a modal you can click behind.
+
+   The scrim is a plain rgba black in BOTH modes on purpose, so it needs no dark
+   override at all — a token here would have to be ink, and ink is near-white in
+   dark, which paints a white sheet over the page instead of dimming it. */
+.cardScrim{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;
+  padding:24px;background:rgba(0,0,0,.55);backdrop-filter:blur(3px);}
+.projCard{position:relative;width:min(420px,100%);background:var(--bg-card);border:1.5px solid var(--line);
+  border-radius:var(--r-card,20px);box-shadow:var(--shadow-card);padding:30px 28px 26px;text-align:center;}
+.projCard .cardDot{display:block;width:54px;height:54px;border-radius:50%;margin:0 auto 16px;
+  background:var(--acc,var(--accent));box-shadow:0 0 0 8px color-mix(in srgb,var(--acc,var(--accent)) 18%,transparent);}
+.projCard h3{font-family:var(--font-display);font-weight:700;font-size:21px;color:var(--ink);margin-bottom:6px;}
+.projCard .cardTag{font-size:14px;color:var(--ink-faint);font-weight:600;line-height:1.5;margin-bottom:14px;}
+.projCard .cardRel{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
+  border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);margin-bottom:18px;}
+:root[data-mode="dark"] .projCard .cardRel{color:var(--sun-lit);}
+@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .projCard .cardRel{color:var(--sun-lit);}}
+.projCard .cardActions{display:flex;gap:10px;justify-content:center;flex-wrap:wrap;}
+.projCard .cardX{position:absolute;top:10px;right:12px;width:30px;height:30px;border-radius:50%;
+  border:none;background:none;cursor:pointer;font-size:14px;color:var(--ink-faint);line-height:1;}
+.projCard .cardX:hover{background:var(--accent-soft);color:var(--accent-deep);}
+@media (prefers-reduced-motion:no-preference){
+  .cardScrim:not([hidden]) .projCard{animation:cardIn .16s ease-out;}
+  @keyframes cardIn{from{opacity:0;transform:translateY(6px) scale(.98);}to{opacity:1;transform:none;}}
+}
+
 /* ── your projects: search + a state filter whose pills carry live counts, so
    a state with nothing in it reads 0 before you click it. The filter GROUPS
    the chip outcomes; it never relabels them — "Live" holds both `live` and

package/public-landing/projects.html

@@ -159,6 +159,22 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       </div>
       <div class="hintbar"><span><kbd>click a project</kbd> open it</span></div>
     </div>
+
+    <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
+         a project must not cost you the sky you were reading (direction §9).
+         Real markup, never JS-built (C7) — the same reason every other view
+         ships as markup — so its copy is in the document and its ids are stable.
+         Filled by openCard(); it carries no project identity of its own. -->
+    <div class="cardScrim" id="cardScrim" hidden>
+      <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
+        <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
+        <span class="cardDot" id="cardDot"></span>
+        <h3 id="cardName"></h3>
+        <p class="cardTag" id="cardTag"></p>
+        <p class="cardRel" id="cardRel" hidden></p>
+        <div class="cardActions" id="cardActions"></div>
+      </div>
+    </div>
   </div>
 
   <div class="wrap viewWrap" id="sub-table-body" hidden>
@@ -512,7 +528,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
      and the sort comparator as if a row existed. This keeps the self entry a
      view-level concern (the owner's call, 2026-08-13) while still letting the
      search box match it by the same predicate every other project uses. */
-  var SELF_PROJECT = { name: productName, tagline: 'this platform' };
+  var SELF_PROJECT = { name: productName, tagline: 'this platform', isSelf: true };
   var mapSort = { key: 'name', dir: 1 };
 
   /* Catalog origins become hrefs, so they are scheme-checked before they are
@@ -576,8 +592,13 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       a.setAttribute('data-generated', '');
       a.setAttribute('data-rel', relOf(p));
       var href = safeHttpUrl(p.origin);
+      /* The href STAYS, and stays honest, even though a plain click now opens
+         the card instead of following it: it is what makes the orb a real link
+         — focusable, Enter-activatable, and still ctrl/middle-clickable into a
+         new tab. The card is layered over that, not substituted for it. */
       a.href = href || '#';
       if (href) { a.target = '_blank'; a.rel = 'noopener'; }
+      a.setAttribute('data-origin', String(p.origin || ''));
       a.title = p.tagline || p.name || '';
       a.style.cssText = '--acc:' + accentOf(p) +
         ';--d:' + slot[2] + 'px;left:' + slot[0] + '%;top:' + slot[1] + '%';
@@ -602,7 +623,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       var rel = relOf(p);
       var pill = rel === 'owner' ? ' <span class="pill">yours</span>'
         : rel === 'builder' ? ' <span class="pill">you build here</span>' : '';
-      return '<tr data-generated>' +
+      return '<tr data-generated data-origin="' + esc(String(p.origin || '')) + '">' +
         '<td class="colName"><span class="pname"><span class="pdot" style="--acc:' +
           accentOf(p) + '"></span>' +
           '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
@@ -665,6 +686,90 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     $('mapCount').textContent = shown + (shown === 1 ? ' project' : ' projects');
   }
 
+  /* ══ THE PROJECT CARD ══════════════════════════════════════════════════════
+     Every orb and every row opens THIS. Before, each one navigated: catalog
+     orbs into a new tab and the platform's own orb — an <a href="/"> — straight
+     back to the landing page, so clicking the project you were standing on threw
+     away the map to show you a marketing page. Direction §9 called for one
+     overlay card serving every project, self included; the owner adopted it
+     2026-08-13. The card is layered OVER the links rather than replacing them,
+     so ctrl/middle-click still opens a project's site directly.
+
+     It states only what the public catalog actually carries — name, tagline,
+     your relationship, a door — because /projects/featured selects four columns
+     and cannot answer anything richer for a catalog row (task 1002744 owns that
+     data path). A card that showed builders or liveness here would be inventing
+     both, the same C6 lie the table's em dashes exist to avoid. ══ */
+
+  var cardReturn = null;   /* the element focus came from, to hand it back */
+
+  function projByOrigin(o) {
+    for (var i = 0; i < catalog.length; i++) if (String(catalog[i].origin) === o) return catalog[i];
+    return null;
+  }
+
+  function openCard(p, rel, returnTo) {
+    var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
+    $('cardDot').style.setProperty('--acc', p.isSelf ? 'var(--accent)' : accentOf(p));
+    $('cardName').textContent = p.name || '';
+    $('cardTag').textContent = p.tagline || '';
+    var label = rel === 'owner' ? 'yours' : rel === 'builder' ? 'you build here' : '';
+    $('cardRel').textContent = label;
+    $('cardRel').hidden = !label;
+    /* the platform's door is same-tab: / is this site, and a new tab for the
+       page you are already on is a bug, not a courtesy */
+    $('cardActions').innerHTML = href
+      ? '<a class="btn small" href="' + esc(href) + '"' +
+        (p.isSelf ? '' : ' target="_blank" rel="noopener"') + '>' +
+        (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
+      : '';
+    cardReturn = returnTo || null;
+    $('cardScrim').hidden = false;
+    $('cardClose').focus();
+  }
+
+  function closeCard() {
+    if ($('cardScrim').hidden) return;
+    $('cardScrim').hidden = true;
+    if (cardReturn && cardReturn.focus) cardReturn.focus();
+    cardReturn = null;
+  }
+
+  /* Delegated, so orbs and rows rebuilt by every filter keystroke stay wired
+     without re-binding. A modified click is left ALONE — ctrl/cmd/shift/middle
+     mean "open in a new tab" everywhere else on the web and the orb is a real
+     link, so intercepting them would break an expectation the markup makes. */
+  function isPlainClick(ev) {
+    return !(ev.metaKey || ev.ctrlKey || ev.shiftKey || ev.altKey || ev.button > 0);
+  }
+
+  $('orbField').addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('.worldOrb');
+    if (!a || !isPlainClick(ev)) return;
+    ev.preventDefault();
+    if (a.id === 'selfOrb') return openCard(SELF_PROJECT, selfRel(), a);
+    var p = projByOrigin(a.getAttribute('data-origin') || '');
+    if (p) openCard(p, relOf(p), a);
+  });
+
+  $('mapRows').addEventListener('click', function (ev) {
+    /* the row's own "Open →" keeps its job — the card is for the rest of the row */
+    if (ev.target.closest && ev.target.closest('a')) return;
+    var tr = ev.target.closest && ev.target.closest('tr');
+    if (!tr || !isPlainClick(ev)) return;
+    if (tr.id === 'selfRow') return openCard(SELF_PROJECT, selfRel(), null);
+    var p = projByOrigin(tr.getAttribute('data-origin') || '');
+    if (p) openCard(p, relOf(p), null);
+  });
+
+  $('cardClose').addEventListener('click', closeCard);
+  $('cardScrim').addEventListener('click', function (ev) {
+    if (ev.target === $('cardScrim')) closeCard();   /* backdrop only, never the card */
+  });
+  document.addEventListener('keydown', function (ev) {
+    if (ev.key === 'Escape') closeCard();
+  });
+
   function loadCatalog() {
     fetch(API + '/projects/featured', { credentials: 'same-origin' })
       .then(function (res) { if (!res.ok) throw new Error('catalog'); return res.json(); })

package/src/module-api.js

@@ -621,8 +621,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.95 with no explicit bump. run 31748829423. (task 1002620)
 //   1.19.97 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.96 with no explicit bump. run 31749223878. (task 1002620)
+//   1.19.98 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.97 with no explicit bump. run 31749841394. (task 1002620)
+//   1.19.99 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.98 with no explicit bump. run 31750941866. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.97'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.99'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -60,12 +60,58 @@ const HOST = process.env.HOST || '127.0.0.1';
 // branding pack is injected once at boot (theme + window.__BRANDING__), exactly
 // as the hall pages are, so the look + identity come from config, not hardcode.
 const LANDING_DIR = path.join(__dirname, '..', 'public-landing');
+// ── CONTENT-STAMPED STATIC ASSETS (task 1002766) ──
+// The landing HTML is `cf-cache-status: DYNAMIC` and never cached, but the
+// assets it references come back `Cache-Control: public, max-age=14400` — four
+// hours, Cloudflare's default Browser Cache TTL, not a header this app sets. So
+// after a deploy a RETURNING visitor gets brand-new markup styled by a
+// stylesheet up to four hours old: markup whose components that stylesheet has
+// never heard of. Measured live — a cached cosmos.css of 25,693 bytes with no
+// `.shell{` against 42,610 fresh — and again when the project card shipped and
+// rendered as an unstyled block at the foot of the page.
+//
+// A COLD visitor is unaffected, which is exactly what makes it easy to miss:
+// whoever deploys usually reloads in the browser holding the stale copy.
+//
+// Fixed by changing the URL rather than by fighting the header: a content hash
+// means a new core produces a new URL, so there is nothing to invalidate and no
+// Cloudflare purge token to hold (task 1002766 weighed both). Same `?v=<sha8>`
+// shape serve-internal.js already stamps onto the hall's own scripts.
+//
+// Stamped by RESOLUTION, not by a path allow-list: a URL is an asset if it
+// actually names a file under public-landing/. Routes (`/projects`, `/create`)
+// and API paths resolve to nothing and are left alone, so a new asset is
+// stamped the day it is added and nobody has to remember to list it.
+const _assetStamps = new Map();
+function assetStamp(url) {
+  if (!_assetStamps.has(url)) {
+    let v = '';
+    try {
+      const abs = path.resolve(LANDING_DIR, '.' + url);
+      // never let a template's own text walk out of the landing dir
+      if (abs.startsWith(LANDING_DIR + path.sep)) {
+        v = require('node:crypto').createHash('sha256')
+          .update(fs.readFileSync(abs)).digest('hex').slice(0, 8);
+      }
+    } catch { v = ''; }   // not a file → not an asset → no stamp
+    _assetStamps.set(url, v);
+  }
+  return _assetStamps.get(url);
+}
+const LOCAL_ASSET = /(href|src)="(\/[A-Za-z0-9._~/-]+\.[A-Za-z0-9]+)"/g;
+function stampAssets(html) {
+  return String(html).replace(LOCAL_ASSET, (m, attr, url) =>
+    assetStamp(url) ? `${attr}="${url}?v=${assetStamp(url)}"` : m);
+}
+
 const _landingPages = new Map(); // memoized per file; '' if absent (instance ships no landing)
 function landingPage(file) {
   if (!_landingPages.has(file)) {
     let html = '';
     try {
-      html = injectBrandingGlobal(stripApexOnly(fs.readFileSync(path.join(LANDING_DIR, file), 'utf8')));
+      // stamped LAST, so anything a later transform introduces is stamped too
+      html = stampAssets(injectBrandingGlobal(stripApexOnly(
+        fs.readFileSync(path.join(LANDING_DIR, file), 'utf8'))));
     } catch { /* absent → '' */ }
     _landingPages.set(file, html);
   }

package/tests/projects_hub.mjs

@@ -238,7 +238,7 @@ test('the renderer preserves the self row exactly as it preserves the self orb',
     'a wholesale innerHTML= on #mapRows destroys the static self row');
   assert.match(SCRIPT, /querySelectorAll\('tr\[data-generated\]'\)/,
     'generated rows must be removed selectively, like .worldOrb[data-generated]');
-  assert.match(SCRIPT, /<tr data-generated>/, 'generated rows must be markable');
+  assert.match(SCRIPT, /<tr data-generated[ >]/, 'generated rows must be markable');
 });
 
 test('"only mine" no longer hides the platform from a signed-in builder', () => {
@@ -307,3 +307,66 @@ test('the hub and the landing hero share one typing cadence', () => {
     assert.ok(heroHolds.includes(n), `hold ${n}ms should match the hero's cadence (${heroHolds.join('/')})`);
   }
 });
+
+/* ── The project card (task 1002770) ────────────────────────────────────────
+   Every orb used to navigate: catalog orbs into a new tab, and the platform's
+   own orb straight back to the landing page — so clicking the project you were
+   standing on threw away the map. Direction §9's overlay, owner-adopted. ── */
+
+test('the card is real markup in the map, not a JS-built node (C7)', () => {
+  assert.match(HUB, /id="cardScrim"/);
+  assert.match(HUB, /id="projCard"/);
+  // it lives inside the map view, not as a fourth destination
+  const map = (HUB.match(/<section id="view-map">([\s\S]*?)<\/section>/) || [, ''])[1];
+  assert.match(map, /id="cardScrim"/, 'the card is an overlay INSIDE the map');
+  assert.doesNotMatch(HUB, /id="view-detail"/, 'and never a view of its own');
+});
+
+test('the card is a labelled modal dialog', () => {
+  const card = (HUB.match(/<div class="projCard"[^>]*>/) || [''])[0];
+  assert.match(card, /role="dialog"/);
+  assert.match(card, /aria-modal="true"/);
+  assert.match(card, /aria-labelledby="cardName"/);
+  assert.match(HUB, /id="cardClose"[^>]*aria-label="Close"/, 'and has a labelled close control');
+});
+
+test('the platform orb opens the card instead of leaving for the landing page', () => {
+  // the reported bug: <a id="selfOrb" href="/"> navigated away on a plain click
+  assert.match(SCRIPT, /a\.id === 'selfOrb'\) return openCard\(SELF_PROJECT/,
+    'a plain click on the self orb must open the card');
+  // the href stays — it is what keeps the orb a real, focusable, ctrl-clickable link
+  assert.match(HUB, /id="selfOrb" href="\/"/, 'the orb stays a real link');
+});
+
+test('a modified click is left alone — the orb is still a link', () => {
+  assert.match(SCRIPT, /function isPlainClick/);
+  const fn = (SCRIPT.match(/function isPlainClick\(ev\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  for (const k of ['metaKey', 'ctrlKey', 'shiftKey']) {
+    assert.match(fn, new RegExp(k), `${k} must fall through to the browser`);
+  }
+});
+
+test('the card closes by Escape, backdrop and the close control', () => {
+  assert.match(SCRIPT, /ev\.key === 'Escape'/);
+  assert.match(SCRIPT, /ev\.target === \$\('cardScrim'\)/, 'backdrop only — a click on the card must not close it');
+  assert.match(SCRIPT, /\$\('cardClose'\)\.addEventListener\('click', closeCard\)/);
+});
+
+test('focus enters the card and is handed back on close', () => {
+  assert.match(SCRIPT, /\$\('cardClose'\)\.focus\(\)/, 'focus must move into the dialog');
+  assert.match(SCRIPT, /cardReturn(\.focus)?/, 'and return to where it came from');
+  assert.match(SCRIPT, /cardReturn\.focus\(\)/);
+});
+
+test('the card claims nothing the public catalog cannot answer (C6)', () => {
+  const card = (HUB.match(/<div class="cardScrim"[\s\S]*?<\/div>\s*<\/div>/) || [''])[0];
+  // /projects/featured selects origin, name, tagline, art_url — and nothing else
+  for (const invented of [/Builders/i, /\blive\b/i, /uptime/i, /\btags\b/i]) {
+    assert.doesNotMatch(card, invented, `the card must not invent ${invented}`);
+  }
+});
+
+test('the row keeps its own Open link working underneath the card', () => {
+  assert.match(SCRIPT, /if \(ev\.target\.closest && ev\.target\.closest\('a'\)\) return;/,
+    'a click on the row\'s own anchor must not be swallowed by the card handler');
+});

package/tests/public_landing_projects.mjs

@@ -119,3 +119,62 @@ test('create.html: the poll give-up points at /projects — "the hall has it" is
   assert.match(body, /\/projects/, 'the give-up path must hand the owner the projects page');
   assert.doesNotMatch(body, /the hall has it/, 'the false poll-stop copy must be gone');
 });
+
+/* ── Content-stamped assets (task 1002766) ──────────────────────────────────
+   The landing HTML is never cached but its assets come back max-age=14400 —
+   Cloudflare's default browser TTL, not ours. So a returning visitor gets new
+   markup with up to four-hour-old CSS: markup whose components that stylesheet
+   has never heard of. Twice now that has shipped a visibly broken page. The URL
+   carries the version so there is nothing to invalidate. ── */
+
+test('the stylesheet URL carries a content stamp, so new markup cannot meet old CSS', async () => {
+  const res = await request('/projects');
+  assert.equal(res.status, 200);
+  const m = res.body.match(/href="\/assets\/cosmos\.css\?v=([0-9a-f]+)"/);
+  assert.ok(m, 'cosmos.css must be served with a ?v= content stamp');
+  assert.equal(m[1].length, 8, 'the stamp is the first 8 hex of a sha256');
+  assert.doesNotMatch(res.body, /href="\/assets\/cosmos\.css"/,
+    'no unstamped copy may survive alongside the stamped one');
+});
+
+test('the stamp is derived from CONTENT, so it changes only when the file does', async () => {
+  const fsMod = await import('node:fs');
+  const pathMod = await import('node:path');
+  const cryptoMod = await import('node:crypto');
+  const url = await import('node:url');
+  const root = pathMod.dirname(url.fileURLToPath(import.meta.url));
+  const css = fsMod.readFileSync(pathMod.join(root, '..', 'public-landing', 'assets', 'cosmos.css'));
+  const want = cryptoMod.createHash('sha256').update(css).digest('hex').slice(0, 8);
+  const res = await request('/projects');
+  assert.ok(res.body.includes(`cosmos.css?v=${want}`),
+    'the stamp must be the hash of the bytes actually on disk');
+});
+
+test('every landing surface is stamped, not just the one that broke', async () => {
+  for (const p of ['/', '/projects', '/create']) {
+    const res = await request(p);
+    if (res.status !== 200) continue;
+    assert.doesNotMatch(res.body, /(href|src)="\/assets\/[^"?]+"/,
+      `${p} still serves an unstamped /assets/ URL`);
+  }
+});
+
+test('routes and API paths are never mistaken for assets', async () => {
+  // stamping resolves the URL against public-landing/ — a route names no file,
+  // so it must come back untouched rather than acquiring a meaningless ?v=
+  const res = await request('/projects');
+  assert.match(res.body, /href="\/create"/, '/create is a route, not an asset');
+  assert.doesNotMatch(res.body, /href="\/create\?v=/);
+  assert.doesNotMatch(res.body, /href="\/projects\?v=/);
+  assert.doesNotMatch(res.body, /\/api\/bongos\/[^"]*\?v=[0-9a-f]{8}/,
+    'API paths must never be stamped');
+});
+
+test('a stamped asset still serves — the query string is not part of the filename', async () => {
+  const page = await request('/projects');
+  const stamped = (page.body.match(/\/assets\/cosmos\.css\?v=[0-9a-f]+/) || [])[0];
+  assert.ok(stamped, 'need a stamped URL to fetch');
+  const res = await request(stamped);
+  assert.equal(res.status, 200, 'express.static must ignore the ?v= when resolving the file');
+  assert.match(res.body, /\.shell\{/, 'and it must be the real stylesheet');
+});