@bongos/core 1.19.992 → 1.19.994

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.992",
-  "core_contract": "1.19.992",
-  "source_commit": "b050bdcbee08970a2f54ba939e4ef7f7b2583381",
+  "core_version": "1.19.994",
+  "core_contract": "1.19.994",
+  "source_commit": "2d0c99af93af0f1d1728f6fce1dbce057f209d4c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T20:51:51.595Z",
+  "built_at": "2026-09-23T22:40:55.441Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 518,
+    "docs_redacted": 519,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2401,
+    "functional_verbatim": 2404,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2945,
-  "tree_sha256": "4097079e3007248addbcbb19a43c23b3584f074f63cfb4a36951d04dd28d1886",
+  "file_count": 2949,
+  "tree_sha256": "4b408d832b68004c07a3d8ad8143cc76a7a5c40c651ba47878f8ae27230568c6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -242,7 +242,7 @@
     {
       "path": ".claude/skills/ship-check/SKILL.md",
       "mode": "0000644",
-      "sha256": "b02e2655888aef8b53857e8e71353583da7d8242908750cec32562a5c2ffd15f"
+      "sha256": "da8d8fe4cd1979c18d3fe644293ee49da37a1112b3defc4442483170236ba74f"
     },
     {
       "path": ".claude/skills/status/SKILL.md",
@@ -2139,10 +2139,15 @@
       "mode": "0000644",
       "sha256": "8a59c1aa7f81d335e96c6305bb4f22689c4a0fee627eecdec9585e76a3477bea"
     },
+    {
+      "path": "docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md",
+      "mode": "0000644",
+      "sha256": "e340529dfadefde589ac92a24e2c0d0e52729c3c54e2350ee8e201ff52679c9e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "465a6e705a62c9d57ccca883d11ef09afa22e39dfdcb42f572c09a7411aef475"
+      "sha256": "24e9de3d847413d66e61aa90c24422a836f9c6c560894166373c26b9f540240e"
     },
     {
       "path": "docs/api-reference.md",
@@ -2702,7 +2707,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "2e21f7c9375cce2766a60eb3d33e0d7aeb1097c819cc6f2e445b23e2618f300f"
+      "sha256": "152674a5c94919cfac381bccea17b915d665e77008307d59d3802041c06b0d1d"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2712,7 +2717,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "47569dfa1c5d507174585d586c5ab619caa3bbf99bbeb24cdb26381ea25cb5e7"
+      "sha256": "aff2b4b93d88dd46eb74dacd0d51c4a959d1a860b9fda1646f3bd2c842780885"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2792,7 +2797,7 @@
     {
       "path": "docs/packs/engineer.md",
       "mode": "0000644",
-      "sha256": "76c058f9fa63846caf132e2b4703ae7913572d59dbcb47f3e8b565f21262fea8"
+      "sha256": "942fcc04e8e47520f6ea071fae30ab0d1ad6c86f4c241c489ded38793650cfa9"
     },
     {
       "path": "docs/packs/ideator.md",
@@ -2957,7 +2962,7 @@
     {
       "path": "docs/recipes/ui-look-before-you-ship.md",
       "mode": "0000644",
-      "sha256": "cf1c7a9960fbe987fe5f457c1ba7311183356cd7c4badd22b366b5fe49f6642b"
+      "sha256": "d142999612eaa8b8663835379fbce04a825ac1cf006f28ce41cbfce77a16827f"
     },
     {
       "path": "docs/recipes/upgrading-the-core.md",
@@ -5712,7 +5717,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "714bbacc99433c307b949c7f882a081e3dfb77b86c8e472c82a7729b513f7d74"
+      "sha256": "4ced170bd5acf06b98663514e3f93664c8d2a1416e8539837a127ad80c1ee79c"
     },
     {
       "path": "modules/lifecycle/check-rollup.js",
@@ -7782,7 +7787,7 @@
     {
       "path": "modules/ui-design/kit/README.md",
       "mode": "0000644",
-      "sha256": "b4026257861bb71c4dcecf22c408adc04bc2827110a464c5961046895287be15"
+      "sha256": "3af3f265b8b4a864f1454fb56a904b252cba6593188e419e629f700e847769e0"
     },
     {
       "path": "modules/ui-design/kit/check-mock.js",
@@ -7847,7 +7852,7 @@
     {
       "path": "modules/ui-design/kit/lib.js",
       "mode": "0000644",
-      "sha256": "e619d3a55683defd9b3560567eeb40af28de71af63865f49e43bdcd44439c047"
+      "sha256": "b0f15b680cefd4f3e94a698ad1d70dfa47eb94828e911198f39cd3c79c8d6e5a"
     },
     {
       "path": "modules/ui-design/kit/png.js",
@@ -7862,7 +7867,7 @@
     {
       "path": "modules/ui-design/kit/render.js",
       "mode": "0000644",
-      "sha256": "e521e6f1c9bc23dc16814303b04a3e95f9a31f8389a63ac20859959bbbec8ee3"
+      "sha256": "85bfb7a8b4e0ba0f3d09be42852b5670c4012e1db370205252c1523f0cc499c7"
     },
     {
       "path": "modules/ui-design/kit/serve.js",
@@ -8177,12 +8182,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3b59f773dda29971e3d49ea6d78364db3e51600641e9211c9860dfb0aa1b1d9e"
+      "sha256": "886b77d3e78846e2ac7160ee992c62370feca07cedeac66ae1e71c0f4723f5a7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "56028c71f30866f4beea2f6902771f011ce4fefe51b5448b5b48075bf2fdf8f1"
+      "sha256": "c6b01ed3391c36e6a05936826c2926683568412b7d3b15d50deeeb5e970dce15"
     },
     {
       "path": "public-docs/index.html",
@@ -9259,6 +9264,11 @@
       "mode": "0000644",
       "sha256": "f73e495ab63fbca755e652d284e378d9b2afef67fe43c4c5a66e2962c92cef1d"
     },
+    {
+      "path": "scripts/gds/render-check.js",
+      "mode": "0000644",
+      "sha256": "f7e3a3fd8aec3b23ffa146b15410836be42c61fa9e0c03a5215247c7f6ae8944"
+    },
     {
       "path": "scripts/gds/render-ideas.js",
       "mode": "0000644",
@@ -9522,7 +9532,7 @@
     {
       "path": "scripts/gds/ship-check.js",
       "mode": "0000644",
-      "sha256": "24e94cd822d5d9e75d2596ac85af854a6d965eb94a7859996792ddfd0f83e898"
+      "sha256": "230a6ee6d37952e380e4cdeecfabea14258d0877c35ca2c4c71de9e4eb7f0b69"
     },
     {
       "path": "scripts/gds/ship-deploy-target.js",
@@ -9787,7 +9797,7 @@
     {
       "path": "scripts/gds/visual-review-nudge.js",
       "mode": "0000644",
-      "sha256": "a86b2cd427c9b52090d906b0b5febb9d8098fae1589e01828e4d7698d38db599"
+      "sha256": "38e98180ddfd59189dedc3d3655d0a0672bde9a364cbaea5846aa4f16296107e"
     },
     {
       "path": "scripts/gds/worktree-claim-guard.js",
@@ -10222,7 +10232,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "860067ab748034a9318878640268ecb791138d914e0ee3e8ea7d6ee2ee6137f8"
+      "sha256": "bc208fde6a6f87de913925e670e21c54db09f8797b7e0a0f773b5d83d2fe200f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13674,6 +13684,11 @@
       "mode": "0000644",
       "sha256": "39eaa32121eae07fa7f508d60324e896e4c1b98c53ff390bb8bdca4b952c874f"
     },
+    {
+      "path": "tests/render_check.mjs",
+      "mode": "0000644",
+      "sha256": "591864e7700b47198754ede53e45488b3143743bb46349b545ea4f0d96b5571f"
+    },
     {
       "path": "tests/render_prefs.mjs",
       "mode": "0000644",
@@ -14537,7 +14552,12 @@
     {
       "path": "tests/ui_design_kit.mjs",
       "mode": "0000644",
-      "sha256": "3559864426fc870316dbdbf9624e7b44e54f893f4cb84d07fc26206a809c0c14"
+      "sha256": "a7c3dae0463bba01a767b0a6cc92082451537a1082567a72b1e47c7020b59666"
+    },
+    {
+      "path": "tests/ui_design_kit_fit.mjs",
+      "mode": "0000644",
+      "sha256": "0f07a002d400c4e90ead7206334425bd80647a2cb844bbc9733758eb3f719a12"
     },
     {
       "path": "tests/ui_design_skills.mjs",
@@ -14662,7 +14682,7 @@
     {
       "path": "tests/visual_review.mjs",
       "mode": "0000644",
-      "sha256": "6c583bd0cb3c2611044e5adad4c17a57d5aed89ba5daf921c355903df239a2ab"
+      "sha256": "102e80ed4c6c61583d9dfeca23db321be9b871cab3d8f47e4594674b7ecd3cf5"
     },
     {
       "path": "tests/wandering_prefs.mjs",

package/.claude/skills/ship-check/SKILL.md

@@ -28,6 +28,11 @@ It changes nothing: every step is a `--check`; the **fix →** column is what to
 1. Every `✗` row names the generator to run. Run it, look at the diff it produced, commit it on your
    branch. Then re-run `/ship-check` until every row is `✓`.
 2. `fitness.js` failures name their own fix inline; warnings are advisory (budgets, ratchets).
+   The `render-fit` row is advisory too (`!`, never a `✗`): when the branch changed a page, it renders
+   it at 1280 + 390 and names any text past its box or overlapping siblings by element and page
+   (`scripts/gds/render-check.js`, ADR 0329). Look at the shots it names; fix the element, or say in the
+   ship notes why it is right. `·` means no Edge or Chrome on this machine, so nothing was rendered.
+   A big page takes minutes; `--no-render` leaves the row out when you are iterating on something else.
 3. With `--tests`: a failing test is only "environmental" if the SAME test fails on an untouched
    checkout of `origin/main`. Compare by test name, never by count — a Windows baseline of ~25
    environment failures has masked real regressions before (see `docs/recipes/windows-builders.md`).

package/docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md

@@ -0,0 +1,28 @@
+# ADR 0329 — The rendered fit check is a kit floor and an advisory ship-check row, not a grader worker
+
+- **Status:** Accepted (2026-09-23)
+- **Task:** [task 1004203](https://cloudbongos.com/builders#/task/1004203) (goal 1000095 — UI quality)
+- **Relates to:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (no new gates), [ADR 0197](0197-the-ui-design-module.md) (the kit), [ADR 0223](0223-the-detector-is-two-tiers-in-the-kit.md) (floors and tells), [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) (the artist gate holds the deploy)
+
+## Context
+
+Nothing in the pipeline renders a page. The grader reads the diff, so a layout bug that looks right in code ships unseen. Two did in September 2026: goal titles clipped to a character count still ran past their cards, on the goal forest ([task 1003480](https://cloudbongos.com/builders#/task/1003480)) and on the goal map ([task 1004204](https://cloudbongos.com/builders#/task/1004204)); and a second child in a `#view-manage .mSec` card would have landed on the first, because every `.mSec > div` takes the same grid cell (caught by hand in [task 1003078](https://cloudbongos.com/builders#/task/1003078)). Both were found only by opening a browser. The owner's rule since then is that every page change gets a before/after review by a person, and the deploy holds on an open artist review (ADR 0241). This check is the machine half of that: something that looks at the rendered page before a person has to.
+
+The task left open where the check should live: an advisory row in `/ship-check`, a grader worker whose findings ride the panel, or both. It had to stay a signal (ADR 0162).
+
+## Decision
+
+1. **The measurement is two new floors in the kit** (`modules/ui-design/kit/lib.js`), beside the seven that exist. `factsInPage` collects them in the real page and `auditFloors` reports them, so `render.js` shows them in every render of every states file:
+   - **`text-fit`**: text runs more than 1px past its box. HTML text is measured word by word with a `Range` against the padding box of its nearest non-inline ancestor. Measuring by word means the space a soft wrap hangs past the line never counts. A box that clips on purpose (a horizontal scroller, `text-overflow: ellipsis`, a visually-hidden label under 4px) is skipped. SVG text is measured against the smallest `<rect>` in its own `<g>` (up to three levels) that contains its start point. That is the card, so a title past its card is caught even when a `clipPath` hides the overflow.
+   - **`sibling-overlap`**: two children of the same parent overlap by more than 2px in both directions, where both carry text and both are in-flow and block-level. A wrapped inline's box spans lines, and absolute, fixed, sticky and negative-margin layering is deliberate, so all of those are excluded.
+2. **`scripts/gds/render-check.js` runs it on the pages a branch changed.** It maps the changed paths to states files: a page or its own script reaches `<page>.states.json`, and a shared script or sheet reaches every page in its directory whose HTML names it. It renders them with the kit at 1280 and 390, using the hall-preview harness for `hall-ui` (the hall's states files are written against it) and the kit's own stubs for everything else. It renders one colour mode (the file's first): the fit floors measure geometry, and the pack's two font stacks are the same in both modes. It also skips the reduced-motion pass (`render.js --no-reduced-motion`). It reads the two fit floors from each render's structured facts and reports one finding per element, with every render it appeared in and its largest measure. Element paths carry `:nth-of-type`, so two same-class siblings are told apart. The whole run has a 12-minute budget inside ship-check's 15-minute cap, and a render that times out is killed with everything it started. At most six states files are rendered: the pages the branch changed come first, then the pages a shared file reaches. The rest are listed with the command that renders them.
+3. **`/ship-check` runs it as an advisory row.** A new `advisory` step kind: a finding shows as `!` with the elements, and a machine with no Edge or Chrome shows `·`. Neither changes ship-check's exit code, and a missing script reads `skipped`, not stale. `--no-render` leaves the row out. `ship.js` does not run it and the grader does not read it. The claim-time nudge for UI work names it.
+4. **Not a grader worker.** The grader runs on the server and grades the diff. To render, it would need a browser on the grader host, the fixtures and the harness it serves, and a model of which states to load. That is a new dependency and a new cost on every graded ship, and it would carry signal the builder has already seen at ship-check. The artist gate (ADR 0241) is the person who looks before deploy. If a later look at the grade audit shows fit bugs reaching the artist review anyway, a worker can read `render-check.js`'s output. Nothing here stops that.
+
+## Consequences
+
+- **Measured quiet on the pages as they stand.** A sweep of every states file in the repo (1280 and 390, one colour mode each, 276 renders) found one text overflow and no overlaps. The overflow is real: on the Work board's backlog tab at 390, an unbreakable `People/Operations/Security` pushes a title 44px out of its column. It is filed separately. The false-positive shapes the first sweep hit (wrapped inline siblings, a sticky top bar over scrolled content, the hanging wrap space) are excluded by rule, and `tests/ui_design_kit_fit.mjs` pins each of them.
+- **The done-when is reproduced**, and the result is recorded in the task's ship notes. Re-introducing the 24-character title clip on the goal map reports 14 titles 3–15px past their cards, by element and page. A second child in the `#mVisibility` `.mSec` card reports `#mVis ∩ #mVisibility > div.projMsg:nth-of-type(2)` on `/projects` at 1280, as one finding across the eight manage states. At 390 the card stacks to one column, so nothing overlaps there. The clean pages report nothing.
+- **`render.js` exits 1 on these floors** like on any other floor. It is a builder's tool, not a pipeline step, so that is a finding, not a gate.
+- **The unit lane gains one browser test** (`tests/ui_design_kit_fit.mjs`). It skips where there is no system browser, so the pure pins in `tests/ui_design_kit.mjs` stay browser-free.
+- **The kit's `SIZES` gains 1280**, the review sheet's desktop width. `render.js` still renders 1440/390/320 unless `--sizes` names it.

package/docs/adr/README.md

@@ -420,3 +420,4 @@ This keeps the decision history honest and traceable.
 | 0326 | [**An upgrade may ADD a deny rule to a file the instance owns** ([task 1004156](https://cloudbongos.com/builders#/task/1004156), goal 1000090 — BONGOS-V2). Task 1003966 gave the instance starter its deny rules — no reading `.env` files, keys or session tokens, no shelving with the repo-global stash — and they reached **nobody who was already here**. The starter is written only when `.claude/settings.json` is ABSENT, and `bongos upgrade` materializes from the published package, which excludes that file on purpose; so an upgrade always takes the starter branch, always finds a settings.json already there, and left it alone. Every instance on the allow-only starter from task 1003962 — the live one included — kept it forever. That was deliberate ("rewriting a file the instance owns is the line task 1003962 drew"), and the recorded remedy was manual: re-run `bongos init`, or delete the file. **A manual remedy for a security gap protects the instances whose owners read release notes, which is not the set that needs protecting.** The owner's call: ADD the missing deny rules and NAME each one in the run output. The argument is that a deny rule is **monotonic in the safe direction** — an allow rule widens what the local agent may do, a deny rule can only narrow, so appending one cannot make any instance less safe than it was a moment earlier. That is what makes this the one merge worth doing without asking per-instance, and it extends [ADR 0121](0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md) §2's already-licensed "merge OR leave-and-report" from `--adopt` to every materialize. "Never clobber" survives in the sense that was load-bearing: **nothing the instance wrote is removed, reordered or rewritten** — their allow rules, own denies, `ask` list, hooks, env and every key outside `permissions` come back exactly as they were, with new rules appended after. Deliberately NOT done: **no provenance**, so an owner who deletes a rule we add gets it back next upgrade and (deny beating allow in Claude Code's order) cannot override it with an allow — rejected as speculative machinery for a case nobody has hit, revisit on a real complaint; a file that will not parse, or whose `permissions`/`permissions.deny` is not the expected shape, is left BYTE-FOR-BYTE alone and reported, the posture task 1004023 took for the core's own file, because a half-understood rewrite of a permissions file is worse than the gap; and **the allow half is never topped up** — the safety argument is directionality and does not survive being applied to a rule that grants. `materializeClaude` gains `summary.settingsDenyAdded` + `settingsDenyUncheckable`, both printed through `log()` since `upgrade.js` does not iterate `summary.notes`. The test asserting an instance's settings.json comes back byte-identical is superseded by a strictly stronger one — every rule still there, unmoved, deny-only growth — the weaker spelling being what froze the gap in place. **AMENDED 2026-09-22 by [task 1004158](https://cloudbongos.com/builders#/task/1004158): the two shelf rules are now starter-only and the top-up asks for the CREDENTIAL half alone.** 0326 itself named this exclusion as the remedy if the rule ever bit; the owner took it ahead of that, because the monotonicity argument licenses a rule about reading a secret and does not reach one that guards a workflow — with no provenance and deny beating allow, an instance that loses the shelf cannot give it back. A fresh instance still gets both. The top-up only ever appends, so this is **forward-looking only**: an instance that already took them keeps them, live included.](0326-an-upgrade-may-add-a-deny-rule-to-a-file-the-instance-owns.md) | security / instance onboarding |
 | 0327 | [**A `cloud-host` runs on the owner's own account, and the key is borrowed, not stored** ([task 1004175](https://cloudbongos.com/builders#/task/1004175), goal 1000106 — BONGOS-V2). [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) moved a `cloud-host` to Render to stop being a landlord but left **whose account** unexamined; [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 then ruled the platform token is ours and "never per-customer". Standing it up disproved the premise: a Render API key is issued against a **user** and carries their rights in **every workspace they belong to** — the owner's reached three, one of them another builder's, holding their live production. The same check found `mercury` **already on Render**, run by its own owner, which 0323 would have migrated OFF a correct setup onto our bill. The remaining landlord relationship was never the servers; it was the **account**. **Decisions:** (1) each project brings its own platform key — we hold no billing relationship for anyone's compute, and a leaked key's blast radius is exactly its own owner's account, a property that comes from the decision and not from cryptography; (2) the key is **borrowed for standup and cleared**, never stored, because nothing afterwards needs it — Render auto-deploys from Git, the deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)) is a push, liveness is the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull — so it rides the queue as a short-lived value encrypted with the existing `secret-box.js`, the [ADR 0133](0133-github-app-manifest-onboarding-signin.md) handshake's shape; (3) we **never destroy a customer's infrastructure** — teardown disconnects, the owner deletes their own services, a safety property first and the reason (2) works; (4) **two shapes, not three** (`dedicated-cloud-host` removed — on someone's own account a bigger plan is a setting, finishing 0323 §1's own "plan size, not a second code path"), and the **free tier is free**, 0323 §7's cap retired with its premise. **Deliberately NOT built, because nothing is stored:** an asymmetric sealing module, per-row credential binding, rotation/revocation, and the separate-unix-user precondition — each designed in full, then deleted when the retention question was asked instead of assumed. **Stated honestly:** encrypting the in-transit value protects it from a database dump, NOT from a compromised web tier, because the owner's key arrives there in plaintext first; that defence was never available at any retention length. **§5 records a measurement, fixed elsewhere:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §2's boundary is enforced by the CODE, not the kernel — `cloudbongos.service` runs `User=lars` with no sandboxing and `/etc/cloudbongos/box.env` is mode 600 owned by `lars`, so the web tier CAN read the DigitalOcean, Cloudflare and platform tokens; 0325 §4's "root-only" is not what is on the box. (A second finding in the same section — a "mode 777" key file — was **void and is corrected in place**: the path is a symlink, whose mode display is meaningless, to a 600 target. It was inferred from an `ls` rather than an attempted read.) **Resolved 2026-09-23 by [task 1004176](https://cloudbongos.com/builders#/task/1004176)**, and more narrowly than §5 proposed — not the unix split (which would mean relocating the checkout, config dir, `web.env` and the secret-box master key the web tier legitimately needs), but a systemd drop-in with `InaccessiblePaths`, verified as the service user; proving it as **root** reports "no effect" against a working config, because `CAP_DAC_OVERRIDE` bypasses the mode-000 over-mount. It is emphatically NOT a precondition here — that is the point of storing nothing, and had we sealed per-project keys with a private key in that same file the two would have had to land together. **Consequences:** the migration shrinks to an **adoption**; the cost ledger's question inverts (our spend on a `cloud-host` is ~\$0 and correct — what an owner is worth telling is THEIR Render cost, a different column, [task 1004148](https://cloudbongos.com/builders#/task/1004148)); and metering loses its forcing function, cost *visibility* surviving as a feature while billing for hosting does not ([task 1001949](https://cloudbongos.com/builders#/task/1001949)). Rejected: storing each key sealed with a key pair (three days plus a live-site infra change, to keep a value needed once); one platform account holding every project (0325 §4 as written — keeps us the billing landlord and makes one credential reach every customer); generating a Blueprint and having the owner click once in Render (simplest, but the click is the exact friction `cloud-host` exists to remove); and keeping the key in the browser to call Render directly (standup is a runner job with retries and an audit trail, not a page that stays open).](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) | hosting / provisioning / credentials |
 | 0328 | [**A hosted project's authority is its membership row, not its owner column** ([task 1003882](https://cloudbongos.com/builders#/task/1003882), goal 1000094 — BONGOS-V2). The owner's decision (2026-09-13): every API action must name its project, and a non-member may only apply. Two "project" concepts exist and answer different questions: `provisioning_instances` (the hub's fleet registry, single `owner_builder_id`, [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md)) and `<redacted>` (`client_id, github_id, membership_kind ∈ {owner,member,visitor,pending}`, already correct, already backing `GET /my-projects`). The composition this needs already exists once, in the opposite direction: `provisioning.projectOwnedBy` is a published port (task 1003580) that `platform-identity/invite-authz.js` already consumes via `resolveOptional` to ask "does this builder own this project" without importing provisioning (ADR 0083). **The gap is that the module which owns the fact does not use it on itself, and has grown three separate local copies of it instead of one** — `instanceAccessDenied` (6 routes), `resolveOwnInstance` (4 routes) and `disconnect.js`'s own inline copy (1 route) all implement "owner OR archon", while 3 routes (`teardown`, `domain`, `github-app`) implement only "owner" with no archon override at all — an existing inconsistency between sibling routes in the same module, not just duplication, and none of the three implementations is visible to `route-rank-check.js`. Decision: (1) project scope stays the existing path segment, resolved through `slug` (the `client_id = slug` join key [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) already establishes); (2) Phase 1 extracts one local `requireProjectOwner` helper replacing all three implementations — a behavior-preserving swap for 11 routes and a stated, intentional archon-override widening for the 3 that lacked it — no new port needed since provisioning already holds the column; Phase 2 adds a new port `platform-identity.projectMembershipKind` and widens the same helper to admit `owner` OR `member`, falling back to the Phase 1 column check when platform-identity isn't installed (ADR 0083's degrade-gracefully contract) — a NEW parallel axis, not a fifth branch on `requirePermission`, mirroring why the ownership axis ([ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3, R100) is kept separate; (3) a caller with NO membership row still gets 404 `instance_not_found` (existence-hidden, unchanged), but a `pending`/`visitor` row gets 403 `project_membership_required` naming `POST /my-projects/join` (ADR 0141/0201/0247's existing apply flow) — the "apply to join it" the owner's decision names, routed into the flow that already ships rather than a second one; (4) `route-rank-check.js` gains a `project_scope_missing` finding (blocker on write, concerns on read) for any `/provisioning/instances/:id...` route missing the gate, the same structural read it already gives `requirePermission`; (5) migration order is the 14 evidenced routes only — the task's own "96 write routes" figure is the whole app's census, and the other ~82 act on a single-tenant instance's own Bongos board, which [ADR 0100](0100-two-repo-instance-model.md) §3 already isolates one-database-per-repo and has no project dimension to name. Filed: [task 1004159](https://cloudbongos.com/builders#/task/1004159) (the helper) · [task 1004160](https://cloudbongos.com/builders#/task/1004160) (route-rank-check.js, depends on 1004159) · [task 1004161](https://cloudbongos.com/builders#/task/1004161) (the membership port, depends on 1004159) · [task 1004162](https://cloudbongos.com/builders#/task/1004162) (the 403/404 split, depends on 1004161). Rejected: a second `provisioning_instance_members` table (the membership table already exists and joins on the same key — a second one repeats the mistake ADR 0325 already refused); folding project authority into `requirePermission` as a fifth axis (same reasoning R100 already applied to `.own` keys); migrating all 96 write routes (re-litigates ADR 0100's single-tenant model, not this decision); dropping 404 existence-hiding entirely (a total stranger should learn nothing, exactly as `invite-authz.js` already guarantees).](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) | security / authorization / provisioning |
+| 0329 | [**The rendered fit check is a kit floor and an advisory ship-check row, not a grader worker** ([task 1004203](https://cloudbongos.com/builders#/task/1004203), goal 1000095 — UI quality). Nothing in the pipeline rendered a page, so titles clipped by character count ran past their cards (task 1003480, task 1004204) and a second `.mSec` child would have landed on the first (task 1003078), each found only in a browser. Two new kit floors, `text-fit` (text measured word by word past its box; SVG text past its card rect) and `sibling-overlap` (in-flow, block-level, text-bearing siblings), run in every `render.js` render; `scripts/gds/render-check.js` renders the pages a branch changed at 1280 + 390 and `/ship-check` shows them as an ADVISORY row that never flips its exit (ADR 0162). Not a grader worker: that would put a browser, fixtures and a harness on the grader host for signal the builder already saw; the artist gate (ADR 0241) stays the human look before deploy.](0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md) | ui-design / kit + ship-check |

package/docs/file-map.md

@@ -433,7 +433,7 @@ tests/
 ├── recall/SKILL.md                ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)
 ├── scan-before-install/SKILL.md   ← /scan-before-install — quarantine-fetch a third-party repo/plugin, deterministic floor + tiered subagent panel over the scrubbed mirror, arithmetic verdict + honest-limits report to the builder's own config dir; prints install commands (pinned SHA only), never installs (goal 1000055)
 ├── session-handoff/SKILL.md       ← /session-handoff — compose a clean, paste-ready next-steps prompt to START a fresh session with (keeps context light by curating what carries forward); read-only, distinct from /builder-ship's ledger notes and /builder-end's close-out
-├── ship-check/SKILL.md            ← /ship-check — run every freshness + fitness check ship.js will run (repo-map/session-index/file-map/api-docs/copy-registry --check, linkify, skill-lint, fitness; --tests adds the DB-free lane) in ONE command before shipping, with the healing command per stale artifact (task 1003548; script scripts/gds/ship-check.js)
+├── ship-check/SKILL.md            ← /ship-check — run every freshness + fitness check ship.js will run (repo-map/session-index/file-map/api-docs/copy-registry --check, linkify, skill-lint, fitness; --tests adds the DB-free lane; an ADVISORY render-fit row renders the changed pages via scripts/gds/render-check.js, ADR 0329) in ONE command before shipping, with the healing command per stale artifact (task 1003548; script scripts/gds/ship-check.js)
 ├── status/SKILL.md                ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
 ├── strand-fix/SKILL.md            ← /strand-fix N — walk ONE stranded confirmed task (strand:no_branch_no_tip / land_not_proven — the shape the reconciler gave up on) to shipped: find the work (main commit / unpushed branch / conflicting PR / nowhere), do the one sanctioned move, verify the flip; also clears a 409 REBASE_REQUIRED claim gate (task 1003365)
 └── worktree-clean/SKILL.md        ← /worktree-clean — list the per-claim worktrees whose branch already landed on main (scripts/gds/stale-worktrees.js) and remove each through the junction-safe worktree.js remove; never raw git worktree remove (task 1003365)

package/docs/module-api-changelog.md

@@ -2458,5 +2458,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.990 with no explicit bump. run 35916061384. (task 1002620)
   1.19.992 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.991 with no explicit bump. run 35918717050. (task 1002620)
+  1.19.993 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.992 with no explicit bump. run 35920872835. (task 1002620)
+  1.19.994 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.993 with no explicit bump. run 35929622479. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/packs/engineer.md

@@ -23,7 +23,7 @@ Engineering is the project's **default loop**, so this pack introduces no new dy
    - If the change is observable in the running app, use the preview/verification workflow (preview → reload → console + page check → screenshot proof) yourself first. Verify, then share the proof.
    - **A change to a page people see is reviewed by your human before it ships — the project default for every builder (owner, 2026-09-23).** Render it before and after, in both modes, at desktop and phone width; open the shots for them with `node scripts/gds/review-sheet.js` (a terminal shows no images — this opens one page in their browser); wait for their OK, then ship. With nobody to ask, list the shots in the ship notes and ship: the change also files a visual review on the board that holds the deploy (ADR 0241), never the ship.
    - If it is not browser-observable (a different runtime, types, tooling), say so and verify the way that *does* exercise it.
-   - `/ship-check` runs every freshness and fitness gate `ship.js` will run, and prints the healing command for each stale generated file.
+   - `/ship-check` runs every freshness and fitness gate `ship.js` will run, and prints the healing command for each stale generated file. When your branch changed a page, it also renders it at 1280 + 390 and names any text past its box or overlapping siblings — an advisory row, never a gate (ADR 0329).
 
 5. **Ship with a real handoff.** `/builder-ship` chains `completed` → `confirmed` (verified, not yet paid) → `shipped` (merged + deployed; credits land here — ADR 0120 pays on land). Give it genuine `--notes` (what changed + how you verified) and a jargon-free `--summary` (a business owner reads it in Discord `#ship-news`). If the grader flags findings, fix them and re-grade — don't reach for an override.
 

package/docs/recipes/ui-look-before-you-ship.md

@@ -45,6 +45,8 @@ node modules/ui-design/kit/render.js --page / --style expedition        # the sa
 | `console-errors` | a `console.error` or an uncaught page error (the file's `ignoreConsole` regexes excepted) |
 | `failed-requests` | a 4xx/5xx response the file did not declare in `ignoreRequests` |
 | `horizontal-overflow` | `scrollWidth` wider than the viewport |
+| `text-fit` | a word of text more than 1px past its box (the padding box of its nearest non-inline ancestor), or an SVG `<text>` past the smallest `<rect>` in its own `<g>` that holds its start — a scroller, `text-overflow: ellipsis` and a visually-hidden label are skipped ([ADR 0329](../adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)) |
+| `sibling-overlap` | two in-flow, block-level children of one parent that both carry text overlapping by more than 2px each way — absolute, fixed, sticky and negative-margin layering is deliberate and skipped |
 | `one-header-main-h1` | not exactly one *rendered* `<header>`, `<main>` and `<h1>` |
 | `controls-24px` | a visible control under 24px on either side (`ignoreControls` for the skip link and the like) |
 | `top-bar-80px` | a `<header>` taller than 80px |
@@ -52,6 +54,8 @@ node modules/ui-design/kit/render.js --page / --style expedition        # the sa
 
 Then a state's own `expect` (a band open, a dialog present, a field's value, a class, a query param). Shots and `report.json` land in `%TMP%/ui-design-kit/<surface>/<page>/` (or `--out`). Exit 0 is `ALL CLEAN`; 1 lists the problems; 2 is a broken states file, named line by line.
 
+**The fit floors run on their own before you ship.** `/ship-check` renders the pages your branch changed (`node scripts/gds/render-check.js`: a page or its script reaches its own states file, a shared script or sheet reaches every page whose HTML names it) at 1280 + 390 and lists any `text-fit` / `sibling-overlap` finding by element and page — an advisory row, never a gate ([ADR 0329](../adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)). `--files a,b` checks named paths instead of the branch diff.
+
 ### The states file — `<surface>/<page>.states.json`
 
 ```json

package/modules/lifecycle/cascade.js

@@ -649,6 +649,7 @@ module.exports = {
   CASCADE_SOURCE,
   COPY_VISUAL_MODULES,
   hasCopyOrVisualWork,
+  isUiSurfacePath,
   artistReviewBody,
   cascadeSourceRef,
   assertRuleShape,

package/modules/ui-design/kit/README.md

@@ -12,6 +12,8 @@ node modules/ui-design/kit/contrast.js --pack [look] | --url <url> [--glyphs sel
 
 A **look** is a branding pack from the module's style library (`modules/ui-design/styles/<name>/`, task 1003323): `STYLE=<name>` lays it over the instance's own pack through `GDS_BRANDING_FILE`, so any surface renders under any look with no page edit.
 
+Two of the floors are about fit ([task 1004203](https://cloudbongos.com/builders#/task/1004203), [ADR 0329](../../../docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)): `text-fit` (text past its box, SVG text past its card) and `sibling-overlap` (text-bearing siblings on top of each other). `scripts/gds/render-check.js` runs just those two over the pages a branch changed, and `/ship-check` shows them as an advisory row.
+
 A surface describes itself in two JSON files beside it — `<page>.states.json` and `<page>.probes.json` — in the vocabularies `lib.js` defines and validates. The full loop, the file shapes and the failure table: [`docs/recipes/ui-look-before-you-ship.md`](../../../docs/recipes/ui-look-before-you-ship.md). Exit codes everywhere: 0 clean · 1 problems · 2 a broken file or usage · 3 no browser.
 
 ## The anti-pattern detector (`tells.js`, and the rendered twins in `lib.js`)

package/modules/ui-design/kit/lib.js

@@ -26,13 +26,17 @@ const FLOORS = Object.freeze([
   'console-errors',       // no console.error and no uncaught page error
   'failed-requests',      // no 4xx/5xx response the states file did not declare expected
   'horizontal-overflow',  // documentElement.scrollWidth fits the viewport
-  'one-header-main-h1',   // exactly one <header>, one <main>, one <h1>
+  'text-fit',             // no text runs past its box (HTML) or its card rect (SVG)
+  'sibling-overlap',      // no two in-flow, block-level, text-bearing siblings overlap
+  'one-header-main-h1',  // exactly one <header>, one <main>, one <h1>
   'controls-24px',        // every visible control clears 24px on both sides
   'top-bar-80px',         // the page's <header> is at most 80px tall
   'reduced-motion',       // under prefers-reduced-motion nothing runs and no rAF loop
 ]);
 
-const SIZES = Object.freeze({ 1440: [1440, 900], 390: [390, 844], 320: [320, 700] });
+// 1280 is the review sheet's desktop width; render.js renders DEFAULT_SIZES unless --sizes names it.
+const SIZES = Object.freeze({ 1440: [1440, 900], 1280: [1280, 800], 390: [390, 844], 320: [320, 700] });
+const DEFAULT_SIZES = Object.freeze([1440, 390, 320]);
 const MODES = Object.freeze(['dark', 'light']);
 const CHANNELS = Object.freeze(['msedge', 'chrome']);
 const SETTLE_MS = 900; // fonts + the pages' own boot fetches; the scratchpad value that never flaked
@@ -205,6 +209,71 @@ function factsInPage(spec) {
   if (hLines > 3) tells.push(`headline-lines: the h1 wraps to ${hLines} lines`);
   if (overshoot.length) tells.push(`bounce-easing: ${overshoot.join(' | ')}`);
   out.tells = tells;
+  // The fit floors (task 1004203): both defects were found only by opening a browser — titles run past
+  // their cards (task 1003480), a second grid child landing on the first (task 1003078). Text is measured
+  // word by word, so the space a soft wrap hangs past the line never counts; scrollers and ellipsis clip on purpose.
+  // A selector-ish path up to the nearest id; :nth-of-type tells same-tag siblings apart.
+  const where = (el) => {
+    const parts = [];
+    for (let a = el; a && a !== document.body && parts.length < 3; a = a.parentElement) {
+      const cls = String(a.getAttribute('class') || '').trim();
+      const same = a.parentElement ? [...a.parentElement.children].filter((c) => c.tagName === a.tagName) : [a];
+      const nth = same.length > 1 ? `:nth-of-type(${same.indexOf(a) + 1})` : '';
+      parts.unshift(a.id ? '#' + a.id : a.tagName.toLowerCase() + (cls ? '.' + cls.split(/\s+/)[0] : '') + nth);
+      if (a.id) break;
+    }
+    return parts.join(' > ');
+  };
+  const quote = (s) => String(s).trim().replace(/[\u0000-\u001f\u007f]+/g, ' ').slice(0, 32); // page text echoed to a terminal
+  const seen = new Map();
+  const vis = (el) => { if (!seen.has(el)) seen.set(el, shown(el)); return seen.get(el); };
+  const NO_TEXT = /^(SCRIPT|STYLE|NOSCRIPT|TEMPLATE|TEXTAREA|OPTION|SELECT|TITLE)$/;
+  const textFit = [], overlaps = [], boxed = new Set();
+  const walk = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
+  for (let n = walk.nextNode(); n; n = walk.nextNode()) {
+    const el = n.parentElement;
+    if (!n.nodeValue.trim() || !el || NO_TEXT.test(el.tagName) || el.closest('svg') || !vis(el)) continue;
+    let box = el;
+    while (box && /^(inline|contents)$/.test(getComputedStyle(box).display)) box = box.parentElement;
+    if (!box || box === document.body || boxed.has(box)) continue;
+    const cs = getComputedStyle(box);
+    if (/auto|scroll/.test(cs.overflowX) || cs.textOverflow === 'ellipsis' || box.clientWidth < 4) continue; // < 4: a visually-hidden label
+    const b = box.getBoundingClientRect(), left = b.left + box.clientLeft, right = left + box.clientWidth;
+    const past = (range) => Math.max(0, ...[...range.getClientRects()].filter((r) => r.width > 0).flatMap((r) => [r.right - right, left - r.left]));
+    const all = document.createRange(); all.selectNodeContents(n);
+    if (past(all) <= 1) continue;
+    let over = 0;
+    for (const m of n.nodeValue.matchAll(/\S+/g)) { const w = document.createRange(); w.setStart(n, m.index); w.setEnd(n, m.index + m[0].length); over = Math.max(over, past(w)); }
+    if (over > 1) { boxed.add(box); textFit.push(`${where(box)} "${quote(n.nodeValue)}" ${Math.round(over)}px past its box`); }
+  }
+  // An SVG text's box is the smallest <rect> in its own <g> (up to three levels) holding where it starts.
+  qa('svg text').forEach((tx) => {
+    if (!(tx.textContent || '').trim() || !vis(tx)) return;
+    const t = tx.getBoundingClientRect();
+    if (!t.width) return;
+    const x = t.left + 1, y = t.top + t.height / 2;
+    let card = null;
+    for (let g = tx.parentElement, k = 0; g && k < 3 && !card && g.tagName.toLowerCase() !== 'svg'; g = g.parentElement, k++) {
+      for (const r of [...g.children].filter((c) => c.tagName.toLowerCase() === 'rect').map((c) => c.getBoundingClientRect())) {
+        if (x >= r.left && x <= r.right && y >= r.top && y <= r.bottom && (!card || r.width * r.height < card.width * card.height)) card = r;
+      }
+    }
+    const over = card ? Math.max(t.right - card.right, card.left - t.left) : 0;
+    if (over > 1) textFit.push(`${where(tx)} "${quote(tx.textContent)}" ${Math.round(over)}px past its card`);
+  });
+  // Overlap counts only block-level, in-flow children that both carry text: a wrapped inline's box spans
+  // lines, and absolute/sticky/negative-margin layering is deliberate.
+  const inFlowBlock = (c) => { const s = getComputedStyle(c); return !/^(inline|contents)/.test(s.display) && !/absolute|fixed|sticky/.test(s.position) && s.float === 'none' && ![s.marginTop, s.marginRight, s.marginBottom, s.marginLeft].some((m) => parseFloat(m) < 0); };
+  qa('body, body *').forEach((parent) => {
+    if (parent.children.length < 2 || parent.closest('svg') || !vis(parent)) return;
+    const kids = [...parent.children].slice(0, 200).filter((c) => !NO_TEXT.test(c.tagName) && (c.textContent || '').trim() && vis(c) && inFlowBlock(c));
+    const rs = kids.map((c) => c.getBoundingClientRect());
+    for (let i = 0; i < kids.length; i++) for (let j = i + 1; j < kids.length; j++) {
+      const ix = Math.min(rs[i].right, rs[j].right) - Math.max(rs[i].left, rs[j].left), iy = Math.min(rs[i].bottom, rs[j].bottom) - Math.max(rs[i].top, rs[j].top);
+      if (ix > 2 && iy > 2) overlaps.push(`${where(kids[i])} ∩ ${where(kids[j])} ${Math.round(ix)}x${Math.round(iy)}`);
+    }
+  });
+  out.textFit = textFit; out.overlaps = overlaps;
   return out;
 }
 // Pure: compare collected facts against an expectation. Returns problem strings.
@@ -239,6 +308,9 @@ function expectProblems(facts, expect = {}) {
 function auditFloors(facts, { width, mode } = {}) {
   const p = [];
   if (facts.scrollWidth > facts.clientWidth + 1) p.push(`horizontal-overflow: scrollWidth ${facts.scrollWidth} > ${width || facts.clientWidth}`);
+  const some = (list) => list.slice(0, 5).join(' | ') + (list.length > 5 ? ` (+${list.length - 5} more)` : '');
+  if (facts.textFit && facts.textFit.length) p.push(`text-fit: ${some(facts.textFit)}`);
+  if (facts.overlaps && facts.overlaps.length) p.push(`sibling-overlap: ${some(facts.overlaps)}`);
   if (facts.headers !== 1 || facts.mains !== 1 || facts.h1s !== 1) p.push(`one-header-main-h1: header ${facts.headers} main ${facts.mains} h1 ${facts.h1s}`);
   if (facts.smallControls && facts.smallControls.length) p.push(`controls-24px: ${facts.smallControls.join(' | ')}`);
   if (facts.bar && facts.bar.h > 80) p.push(`top-bar-80px: header is ${facts.bar.h}px`);
@@ -448,7 +520,7 @@ function packColors(pack) {
 }
 
 module.exports = {
-  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS, EXPECT_KEYS,
+  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS, EXPECT_KEYS,
   argOf, hasFlag, listArg, pageName, normalizePageArg, resolveSurfaceDir, sidecarPath, readJson,
   validateActions, runActions, validateExpect, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
   validateStatesFile, validateProbesFile, NoBrowserError, launchBrowser, attachCollectors, withMode,

package/modules/ui-design/kit/render.js

@@ -14,6 +14,7 @@
 //     --modes dark,light  --sizes 1440,390,320  --only a,b  --out <dir>
 //     --style <name>      render under a look from the style library (STYLE= on the stubs; task 1003323)
 //     --base-out <url> --base-in <url>   use running stubs instead of starting two
+//     --no-reduced-motion                skip the reduced-motion pass
 //
 // Exit 0 ALL CLEAN · 1 problems · 2 usage/contract · 3 no browser.
 const fs = require('node:fs');
@@ -68,7 +69,7 @@ async function main() {
   if (lib.hasFlag(args, '--help')) usage('');
   const { file, json, surface } = locate(args);
   const modes = lib.listArg(args, '--modes', json.modes || [...lib.MODES]).filter((m) => lib.MODES.includes(m));
-  const sizes = lib.listArg(args, '--sizes', Object.keys(lib.SIZES)).map(Number).filter((w) => lib.SIZES[w]);
+  const sizes = lib.listArg(args, '--sizes', lib.DEFAULT_SIZES).map(Number).filter((w) => lib.SIZES[w]);
   const only = lib.listArg(args, '--only', null);
   const names = Object.keys(json.states).filter((n) => !only || only.includes(n));
   if (!names.length) usage(`--only names no state of ${path.basename(file)}`);
@@ -116,8 +117,9 @@ async function main() {
       await ctx.close();
     }
     // reduced motion: the kill switch, exercised with the file's own interaction
+    // (--no-reduced-motion skips it: render-check reads only the fit floors)
     const rm = json.reducedMotion || {};
-    for (const mode of modes) {
+    for (const mode of lib.hasFlag(args, '--no-reduced-motion') ? [] : modes) {
       const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 }, colorScheme: mode, reducedMotion: 'reduce' });
       const page = await ctx.newPage();
       await page.goto((rm.auth === false ? baseOut : baseIn) + lib.withMode(rm.url || json.page, mode, json.modeQuery), { waitUntil: 'load' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.992",
+  "version": "1.19.994",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.992",
+      "version": "1.19.994",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.992",
+  "version": "1.19.994",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/render-check.js

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+'use strict';
+// scripts/gds/render-check.js — render the pages a branch changed and report text wider than its box and
+// overlapping siblings, naming the element and the page (task 1004203, ADR 0329).
+//
+// Why: nothing else in the pipeline renders a page. The grader reads the diff, so a title clipped by character
+// count that still ran past its card (task 1003480) and a second grid child landing on the first (task 1003078)
+// both shipped looking correct in code and were found only by opening a browser.
+//
+// A SIGNAL, never a gate (ADR 0162): /ship-check shows it as an advisory row; ship.js and the grader never
+// read it. The measurement is the kit's `text-fit` + `sibling-overlap` floors (modules/ui-design/kit/lib.js);
+// this file only picks the pages, runs the kit's renderer at 1280 + 390, and keeps those two floors.
+//
+//   node scripts/gds/render-check.js                     the pages this branch changed against origin/main
+//   node scripts/gds/render-check.js --base <ref>        ... against another base
+//   node scripts/gds/render-check.js --files a,b         the pages these repo paths reach
+//
+// Exit 0 nothing found or nothing to render · 1 findings · 3 no system browser.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawn, spawnSync } = require('node:child_process');
+const { isUiSurfacePath } = require('../../modules/lifecycle/cascade');
+const kit = require('../../modules/ui-design/kit/lib');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const RENDER_JS = path.join(REPO_ROOT, 'modules', 'ui-design', 'kit', 'render.js');
+const HARNESS_JS = path.join(REPO_ROOT, 'scripts', 'hall-preview', 'server.js');
+const FIT_FLOORS = Object.freeze(['text-fit', 'sibling-overlap']);
+const SIZES = Object.freeze([1280, 390]);
+const MAX_STATES_FILES = 6; // a shared sheet reaches every page; past this the builder runs render.js by hand
+// The whole run fits inside ship-check's 15-minute cap on a slow step, so ship-check never has to kill it
+// (a killed parent cannot stop its harness and renderers). Files that would start past it are listed instead.
+const RUN_BUDGET_MS = 12 * 60 * 1000;
+const MIN_RENDER_MS = 60 * 1000;
+const HARNESS_BOOT_MS = 30 * 1000;
+const rel = (file) => path.relative(REPO_ROOT, file).split(path.sep).join('/');
+
+// statesFilesFor — the states files a list of changed repo paths reaches. A page, or a file named like one
+// (goal-map.js), reaches its own <page>.states.json; any other script, sheet or image reaches every page in
+// the same public dir whose HTML names it (text-fit.js → goal-map, goals). Own pages come first, so the
+// MAX_STATES_FILES cut never drops the page the builder changed for pages a shared sheet reaches.
+function statesFilesFor(paths, root = REPO_ROOT) {
+  const own = new Set(), reached = new Set();
+  for (const p of paths) {
+    if (!isUiSurfacePath(p)) continue;
+    const dir = p.slice(0, p.indexOf('/public/') + '/public'.length);
+    const file = p.slice(dir.length + 1);
+    const beside = path.join(root, dir, `${file.replace(/\.[^./]+$/, '')}.states.json`);
+    if (!file.includes('/') && fs.existsSync(beside)) { own.add(beside); continue; }
+    if (/\.html?$/i.test(file) || !fs.existsSync(path.join(root, dir))) continue;
+    const named = new RegExp(`(^|[/"'=\\s])${path.basename(file).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`);
+    for (const html of fs.readdirSync(path.join(root, dir)).filter((f) => f.endsWith('.html'))) {
+      const states = path.join(root, dir, html.replace(/\.html$/, '.states.json'));
+      if (fs.existsSync(states) && named.test(fs.readFileSync(path.join(root, dir, html), 'utf8'))) reached.add(states);
+    }
+  }
+  return [...[...own].sort(), ...[...reached].filter((f) => !own.has(f)).sort()];
+}
+
+// fitFindings — every element the two fit floors named in one render.js report.json, read from the
+// structured facts (auditFloors' problem line stops at five). One finding per element across all the
+// renders it appeared in, with its largest measure — a title past its card at 1280 and 390 is one finding.
+const MEASURE = / (\d+)px past its (?:box|card)$| (\d+)x(\d+)$/;
+function fitFindings(report) {
+  const byElement = new Map();
+  for (const [render, r] of Object.entries((report && report.renders) || {})) {
+    const facts = (r && r.facts) || {};
+    for (const [floor, items] of [['text-fit', facts.textFit], ['sibling-overlap', facts.overlaps]]) {
+      for (const item of items || []) {
+        const m = MEASURE.exec(item);
+        const key = `${floor}: ${m ? item.slice(0, m.index) : item}`;
+        const size = m ? (m[1] ? Number(m[1]) : Number(m[2]) * Number(m[3])) : 0;
+        if (!byElement.has(key)) byElement.set(key, { key, measure: '', size: -1, renders: [] });
+        const f = byElement.get(key);
+        f.renders.push(render);
+        if (size > f.size) { f.size = size; f.measure = m ? m[0].trim() : ''; }
+      }
+    }
+  }
+  return [...byElement.values()].map((f) => ({ page: report.page, problem: f.measure ? `${f.key} — ${f.measure}` : f.key, renders: f.renders }));
+}
+
+// Two pages of one name (hall-ui/index, public-landing/index) must never share a shots folder.
+function shotsDir(outRoot, file) {
+  return path.join(outRoot, rel(file).replace(/\.states\.json$/, '').replace(/[\\/]/g, '_'));
+}
+
+function changedFiles(base) {
+  const git = (...args) => spawnSync('git', args, { cwd: REPO_ROOT, encoding: 'utf8' });
+  const mergeBase = git('merge-base', base, 'HEAD').stdout.trim();
+  if (!mergeBase) return null;
+  const listed = `${git('diff', '--name-only', mergeBase).stdout}\n${git('ls-files', '--others', '--exclude-standard').stdout}`;
+  return [...new Set(listed.split(/\r?\n/).filter(Boolean))];
+}
+
+// Kill a child and everything it started (render.js starts two stubs and a browser).
+const DETACH = process.platform !== 'win32';
+function killTree(child) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  try {
+    if (process.platform === 'win32') spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' });
+    else process.kill(-child.pid, 'SIGKILL');
+  } catch { /* already gone */ }
+}
+
+// The hall's states files are written against the hall-preview harness (their notes say so): its fixtures
+// carry the populated pages, where the kit's own stub serves the hall its signed-out, empty reads. Its
+// output is read for the whole run, since a pipe left unread fills and stalls it mid-render.
+async function startHarness({ script = HARNESS_JS, bootMs = HARNESS_BOOT_MS } = {}) {
+  const port = await kit.freePort();
+  const proc = spawn(process.execPath, [script, '--port', String(port), '--fixture-me'], { cwd: REPO_ROOT, stdio: ['ignore', 'pipe', 'pipe'], detached: DETACH });
+  const stop = () => killTree(proc);
+  await new Promise((resolve, reject) => {
+    let said = '', ready = false;
+    const fail = (why) => { clearTimeout(timer); stop(); reject(new Error(`${why}: ${said.trim()}`)); };
+    const timer = setTimeout(() => fail(`the hall-preview harness did not start within ${bootMs / 1000}s`), bootMs);
+    const hear = (d) => {
+      if (ready) return;
+      said += d;
+      if (/hall-preview: http/.test(said)) { ready = true; clearTimeout(timer); resolve(); }
+    };
+    proc.stdout.on('data', hear);
+    proc.stderr.on('data', hear);
+    proc.on('exit', (code) => { if (!ready) fail(`the hall-preview harness exited ${code}`); });
+  });
+  return { base: `http://localhost:${port}`, pid: proc.pid, stop };
+}
+
+// Run a node script without blocking the event loop (the harness's pipes keep draining meanwhile);
+// past timeoutMs the script and everything it started are killed.
+function runNode(args, timeoutMs) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, args, { cwd: REPO_ROOT, stdio: ['ignore', 'ignore', 'pipe'], detached: DETACH });
+    let stderr = '';
+    child.stderr.on('data', (d) => { if (stderr.length < 4000) stderr += d; });
+    const timer = setTimeout(() => killTree(child), timeoutMs);
+    child.on('error', (e) => { clearTimeout(timer); resolve({ status: null, signal: null, stderr: e.message }); });
+    child.on('close', (status, signal) => { clearTimeout(timer); resolve({ status, signal, stderr }); });
+  });
+}
+
+// One states file through the kit's renderer: { findings, note?, noBrowser? }. ONE colour mode (the file's
+// first): the fit floors measure geometry, and the pack's two font stacks are the same in both modes. No
+// reduced-motion pass either — only the fit floors are read. render.js still runs everything when asked.
+async function renderStatesFile(file, { outRoot, harness, timeoutMs }) {
+  const json = kit.readJson(file);
+  const out = shotsDir(outRoot, file);
+  const mode = (json.modes || kit.MODES)[0];
+  const args = [RENDER_JS, '--states', file, '--sizes', SIZES.join(','), '--modes', mode, '--no-reduced-motion', '--out', out];
+  if (json.surface === 'hall-ui' && harness) args.push('--base-in', harness.base, '--base-out', harness.base);
+  const r = await runNode(args, timeoutMs);
+  if (r.status === kit.EXIT.NO_BROWSER) return { findings: [], noBrowser: true, note: String(r.stderr || '').trim().split('\n')[0] };
+  const reportFile = path.join(out, 'report.json');
+  if (r.status === kit.EXIT.USAGE || !fs.existsSync(reportFile)) {
+    const why = String(r.stderr || `exit ${r.status}${r.signal ? ` (${r.signal})` : ''}`).trim().split('\n').slice(0, 2).join(' ');
+    return { findings: [], note: `${rel(file)}: the renderer produced no report — ${why}` };
+  }
+  return { findings: fitFindings(kit.readJson(reportFile)), out };
+}
+
+async function main() {
+  const started = Date.now();
+  const args = process.argv.slice(2);
+  const explicit = kit.listArg(args, '--files', null);
+  const paths = explicit || changedFiles(kit.argOf(args, '--base', 'origin/main'));
+  if (!paths) { console.log('render-check: no merge base with origin/main — nothing to compare against, nothing rendered'); return 0; }
+  const all = statesFilesFor(paths);
+  const uiCount = paths.filter(isUiSurfacePath).length;
+  if (!all.length) {
+    console.log(uiCount
+      ? `render-check: ${uiCount} rendered-surface file(s) changed, but no <page>.states.json reaches them — nothing to measure (docs/recipes/ui-look-before-you-ship.md)`
+      : 'render-check: no rendered surface changed — nothing to render');
+    return 0;
+  }
+  const outRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'render-check-'));
+  console.log(`render-check — text past its box and overlapping siblings at ${SIZES.join(' + ')} (a signal, never a gate)`);
+  let harness = null;
+  const findings = [], notes = [], unrendered = all.slice(MAX_STATES_FILES).map((f) => [f, `past ${MAX_STATES_FILES}`]);
+  try {
+    const files = all.slice(0, MAX_STATES_FILES);
+    if (files.some((f) => kit.readJson(f).surface === 'hall-ui')) harness = await startHarness();
+    for (const [i, file] of files.entries()) {
+      const left = RUN_BUDGET_MS - (Date.now() - started);
+      if (left < MIN_RENDER_MS) { unrendered.unshift(...files.slice(i).map((f) => [f, 'out of time'])); break; }
+      const res = await renderStatesFile(file, { outRoot, harness, timeoutMs: left });
+      if (res.noBrowser) { console.log(`render-check: no system browser, nothing rendered — ${res.note}`); return kit.EXIT.NO_BROWSER; }
+      if (res.note) notes.push(res.note);
+      findings.push(...res.findings.map((x) => ({ ...x, shots: res.out })));
+      console.log(`  ${rel(file)}: ${res.findings.length ? `${res.findings.length} finding(s)` : res.note ? 'no report' : 'clean'}${res.out ? `  (shots: ${res.out})` : ''}`);
+    }
+  } finally {
+    if (harness) harness.stop();
+  }
+  for (const [f, why] of unrendered) console.log(`  not rendered (${why}): node modules/ui-design/kit/render.js --states ${rel(f)} --sizes 1280,390`);
+  for (const n of notes) console.log(`✗ ${n}`);
+  for (const f of findings) console.log(`✗ ${f.page} ${f.problem}  [${f.renders.join(', ')}]  shots: ${f.shots}`);
+  const unmeasured = notes.length ? `; ${notes.length} states file(s) not measured` : '';
+  console.log(findings.length || notes.length ? `${findings.length} finding(s)${unmeasured} — look at the shots, then fix the element or say in the ship notes why it is right` : 'nothing past its box, no overlapping siblings');
+  return findings.length || notes.length ? 1 : 0;
+}
+
+module.exports = { FIT_FLOORS, SIZES, statesFilesFor, fitFindings, shotsDir, startHarness };
+if (require.main === module) {
+  main().then((code) => { process.exitCode = code; }, (e) => { console.error(`render-check: ${e.stack || e.message}`); process.exitCode = 1; });
+}

package/scripts/gds/ship-check.js

@@ -10,7 +10,9 @@
 // call with one table. It CHANGES NOTHING: every step is a --check; the "fix" column is what to run.
 //
 // Usage:
-//   node scripts/gds/ship-check.js            checks only (fast; no tests)
+//   node scripts/gds/ship-check.js            checks only (fast; no tests) — plus, when the branch changed a
+//                                             page, an ADVISORY render of it (render-check.js; never flips the exit;
+//                                             minutes on a big page — --no-render skips it)
 //   node scripts/gds/ship-check.js --tests    also run the DB-free unit lane (npm test) and list failures
 //   node scripts/gds/ship-check.js --json
 // Exit 1 when any check is stale/failing, 0 when everything is fresh.
@@ -22,7 +24,9 @@ const path = require('node:path');
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Each step: a label, the argv to run (node scripts run with THIS node), the command that heals it,
-// and how to read a non-zero exit. `optional` steps are skipped when their script is absent.
+// and how to read a non-zero exit. `optional` steps are skipped when their script is absent. An `advisory`
+// step is a signal, never a gate (ADR 0162): a non-zero exit reads `warn` (3 = no browser reads `skipped`).
+// `onlyWith` names the flag that adds a step; `skipWith` the flag that leaves one out.
 const STEPS = [
   { key: 'fitness', label: 'fitness.js (architecture + budgets + freshness gate)', argv: ['scripts/gds/fitness.js'], fix: 'read the ✗ lines above; each names its fix' },
   { key: 'repo-map', label: 'nested CLAUDE.md symbol blocks fresh', argv: ['scripts/gds/gen-repo-map.js', '--check-block'], fix: 'node scripts/gds/gen-repo-map.js' },
@@ -32,6 +36,7 @@ const STEPS = [
   { key: 'copy-registry', label: 'docs/copy-registry.json fresh', argv: ['scripts/gds/copy-inventory.js', '--check'], fix: 'node scripts/gds/copy-inventory.js', optional: true },
   { key: 'linkify', label: 'no bare #NNN task refs in committed markdown', argv: ['scripts/gds/linkify-refs.js', '--check'], fix: 'node scripts/gds/linkify-refs.js', optional: true },
   { key: 'skill-lint', label: 'SKILL.md frontmatter parses', argv: ['scripts/gds/skill-lint.js'], fix: 'fix the ✗ lines (description: >- block scalars)' },
+  { key: 'render-fit', label: 'rendered text fit + sibling overlap on the pages this branch changed (advisory)', argv: ['scripts/gds/render-check.js'], fix: 'look at the shots it names; fix the element, or say in the ship notes why it is right', advisory: true, optional: true, skipWith: '--no-render', slow: true },
   { key: 'tests', label: 'DB-free unit lane (npm test)', argv: ['scripts/gds/run-unit-tests.js'], fix: 'read the FAIL lines; compare against origin/main before calling any of them environmental', onlyWith: '--tests', slow: true },
 ];
 
@@ -42,18 +47,18 @@ function runStep(step, { cwd = REPO_ROOT } = {}) {
   const r = spawnSync(process.execPath, [script, ...step.argv.slice(1)], { cwd, encoding: 'utf8', timeout: step.slow ? 15 * 60 * 1000 : 5 * 60 * 1000, env: { ...process.env, GDS_QUIET: '1' } });
   const out = ((r.stdout || '') + (r.stderr || '')).trim().split(/\r?\n/);
   const failing = out.filter((l) => /^\s*(✗|FAIL|not ok|STALE|✘)/.test(l) || /STALE|is stale|would update|failed/i.test(l));
-  return { ...step, status: r.status === 0 ? 'ok' : 'fail', code: r.status, signal: r.signal, ms: Date.now() - t0, tail: (failing.length ? failing : out.slice(-4)).slice(0, 12).join('\n') };
+  return { ...step, status: r.status === 0 ? 'ok' : !step.advisory ? 'fail' : r.status === 3 ? 'skipped' : 'warn', code: r.status, signal: r.signal, ms: Date.now() - t0, tail: (failing.length ? failing : out.slice(-4)).slice(0, 12).join('\n') };
 }
 
 function summarize(results) {
   const stale = results.filter((r) => r.status === 'fail' || r.status === 'missing');
-  return { ok: stale.length === 0, stale: stale.map((r) => r.key), results };
+  return { ok: stale.length === 0, stale: stale.map((r) => r.key), warned: results.filter((r) => r.status === 'warn').map((r) => r.key), results };
 }
 
 function format(summary) {
   const lines = ['ship-check — what ship.js will trip on', ''];
   for (const r of summary.results) {
-    const mark = r.status === 'ok' ? '✓' : r.status === 'skipped' ? '·' : '✗';
+    const mark = r.status === 'ok' ? '✓' : r.status === 'skipped' ? '·' : r.status === 'warn' ? '!' : '✗';
     lines.push(`${mark} ${r.label}  (${r.ms} ms)`);
     if (r.status !== 'ok' && r.status !== 'skipped') {
       for (const t of String(r.tail).split('\n')) lines.push(`    ${t}`);
@@ -62,12 +67,13 @@ function format(summary) {
   }
   lines.push('');
   lines.push(summary.ok ? 'all fresh — ship.js preflight should pass; the grader and CI are the remaining gates.' : `${summary.stale.length} stale: ${summary.stale.join(', ')} — heal, commit, re-run.`);
+  if (summary.warned.length) lines.push(`advisory (a signal, never a gate): ${summary.warned.join(', ')}`);
   return lines.join('\n');
 }
 
 function main() {
   const argv = process.argv.slice(2);
-  const steps = STEPS.filter((s) => !s.onlyWith || argv.includes(s.onlyWith));
+  const steps = STEPS.filter((s) => (!s.onlyWith || argv.includes(s.onlyWith)) && !(s.skipWith && argv.includes(s.skipWith)));
   const results = steps.map((s) => runStep(s));
   const summary = summarize(results);
   console.log(argv.includes('--json') ? JSON.stringify(summary, null, 1) : format(summary));

package/scripts/gds/visual-review-nudge.js

@@ -31,6 +31,7 @@ function visualReviewNudge(task) {
     '🎨 This task changes a page people see.',
     '  Build it with /design, and check it in a real browser at desktop and phone width, light and dark.',
     '  Before you ship: open the before/after for your human (node scripts/gds/review-sheet.js) and wait for their OK.',
+    '  /ship-check renders the pages you changed and names any text past its box or overlapping siblings (a signal, not a gate).',
   ];
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.992'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.994'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/render_check.mjs

@@ -0,0 +1,127 @@
+// tests/render_check.mjs — the rendered fit check (task 1004203, ADR 0329): which pages a changed path
+// reaches, which report rows it keeps, and that /ship-check shows it as a signal that never flips its exit
+// (ADR 0162). DB-free and browser-free; the in-page measurement is pinned in tests/ui_design_kit_fit.mjs.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { FIT_FLOORS, SIZES, statesFilesFor, fitFindings, shotsDir, startHarness } from '../scripts/gds/render-check.js';
+import { STEPS, runStep, summarize, format } from '../scripts/gds/ship-check.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const names = (paths) => statesFilesFor(paths, ROOT).map((f) => path.basename(f));
+
+test('a changed page or its own script reaches the states file beside it', () => {
+  assert.deepEqual(names(['modules/hall-ui/public/goal-map.js']), ['goal-map.states.json']);
+  assert.deepEqual(names(['modules/hall-ui/public/goal-map.html']), ['goal-map.states.json']);
+  assert.deepEqual(names(['modules/public-landing/public/projects.html']), ['projects.states.json']);
+});
+
+test('a shared asset reaches every page in its dir whose HTML names it', () => {
+  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goal-map.states.json', 'goals.states.json']);
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['projects.states.json']);
+});
+
+test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {
+  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js', 'modules/hall-ui/public/work.js']), ['work.states.json', 'goal-map.states.json', 'goals.states.json']);
+  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js', 'modules/hall-ui/public/goal-map.js']), ['goal-map.states.json', 'goals.states.json'], 'a page reached both ways is listed once, as its own');
+});
+
+test('a path that is not a rendered surface, or a page with no states file, reaches nothing', () => {
+  assert.deepEqual(names(['src/bongos/db.js', 'modules/hall-ui/public/goal-map.states.json', 'modules/hall-ui/routes/x.js']), []);
+  assert.deepEqual(names(['modules/hall-ui/public/deploy.html']), [], 'a page without a states file does not fall back to the pages that link to it');
+});
+
+test('fitFindings names every element from the structured facts, once per element across renders, with its largest measure', () => {
+  const title = (n, px) => `g.gm-nodes > g.gm-node:nth-of-type(${n}) > text.gm-name "Title ${n}…" ${px}px past its card`;
+  const report = {
+    page: '/builders/goal-map',
+    renders: {
+      // seven titles: more than auditFloors' five-item problem line names
+      'dark-1280-map': { facts: { textFit: [1, 2, 3, 4, 5, 6, 7].map((n) => title(n, 10)), overlaps: [] }, problems: ['controls-24px: a.x "Docs" 40x17'] },
+      'dark-390-map': { facts: { textFit: [title(1, 14)], overlaps: ['#mVisibility > div:nth-of-type(1) ∩ #mVisibility > div:nth-of-type(2) 640x48'] } },
+      'dark-390-out': { facts: {} },
+    },
+  };
+  const found = fitFindings(report);
+  assert.equal(found.filter((f) => f.problem.startsWith('text-fit: ')).length, 7, 'every element is named, not the first five');
+  assert.deepEqual(found[0], {
+    page: '/builders/goal-map',
+    problem: 'text-fit: g.gm-nodes > g.gm-node:nth-of-type(1) > text.gm-name "Title 1…" — 14px past its card',
+    renders: ['dark-1280-map', 'dark-390-map'],
+  }, 'one finding across widths, carrying the largest overflow');
+  assert.deepEqual(found.at(-1), {
+    page: '/builders/goal-map',
+    problem: 'sibling-overlap: #mVisibility > div:nth-of-type(1) ∩ #mVisibility > div:nth-of-type(2) — 640x48',
+    renders: ['dark-390-map'],
+  });
+  assert.deepEqual(fitFindings({ page: '/x', renders: {} }), []);
+  assert.deepEqual(fitFindings(null), []);
+  assert.deepEqual([...FIT_FLOORS], ['text-fit', 'sibling-overlap']);
+  assert.deepEqual([...SIZES], [1280, 390]);
+});
+
+test('two pages of one name never share a shots folder', () => {
+  const out = path.join(os.tmpdir(), 'rc');
+  const hall = shotsDir(out, path.join(ROOT, 'modules', 'hall-ui', 'public', 'index.states.json'));
+  const landing = shotsDir(out, path.join(ROOT, 'modules', 'public-landing', 'public', 'index.states.json'));
+  assert.notEqual(hall, landing);
+  assert.equal(path.basename(hall), 'modules_hall-ui_public_index');
+});
+
+const alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };
+const waitDead = async (pid) => { for (let i = 0; i < 50 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100)); return !alive(pid); };
+
+test('a harness that never says it is up is killed on the boot timeout, not left holding its port', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rc-harness-'));
+  const pidFile = path.join(dir, 'pid');
+  const script = path.join(dir, 'silent.js');
+  fs.writeFileSync(script, `require('fs').writeFileSync(${JSON.stringify(pidFile)}, String(process.pid)); setInterval(() => {}, 1000);`);
+  await assert.rejects(startHarness({ script, bootMs: 1500 }), /did not start within 1\.5s/);
+  assert.ok(await waitDead(Number(fs.readFileSync(pidFile, 'utf8'))), 'the silent harness was killed');
+});
+
+test('a harness that comes up is handed back with a stop that ends it', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rc-harness-'));
+  const script = path.join(dir, 'up.js');
+  fs.writeFileSync(script, `console.log('hall-preview: http://localhost:' + process.argv[3] + '/'); setInterval(() => {}, 1000);`);
+  const harness = await startHarness({ script, bootMs: 5000 });
+  assert.match(harness.base, /^http:\/\/localhost:\d+$/);
+  assert.ok(alive(harness.pid));
+  harness.stop();
+  assert.ok(await waitDead(harness.pid), 'stop() ended the harness');
+});
+
+test('the CLI renders nothing, and says why, when no page a states file describes changed', () => {
+  const cli = (files) => spawnSync(process.execPath, [path.join(ROOT, 'scripts', 'gds', 'render-check.js'), '--files', files], { cwd: ROOT, encoding: 'utf8' });
+  const none = cli('src/bongos/db.js');
+  assert.equal(none.status, 0);
+  assert.match(none.stdout, /no rendered surface changed/);
+  const noStates = cli('modules/hall-ui/public/deploy.html');
+  assert.equal(noStates.status, 0);
+  assert.match(noStates.stdout, /1 rendered-surface file\(s\) changed, but no <page>\.states\.json reaches them/);
+});
+
+test('ship-check runs the render check as an advisory row: findings warn, no browser skips, neither flips the exit', () => {
+  const step = STEPS.find((s) => s.key === 'render-fit');
+  assert.ok(step && step.advisory && step.argv[0] === 'scripts/gds/render-check.js');
+  assert.ok(step.optional, 'an absent script is skipped, never counted as stale');
+  assert.equal(step.skipWith, '--no-render');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ship-check-advisory-'));
+  const script = (name, code) => { fs.writeFileSync(path.join(dir, name), `console.log('✗ a finding'); process.exit(${code});`); return name; };
+  const warn = runStep({ key: 'r', label: 'r', argv: [script('found.js', 1)], fix: 'f', advisory: true }, { cwd: dir });
+  const skip = runStep({ key: 's', label: 's', argv: [script('nobrowser.js', 3)], fix: 'f', advisory: true }, { cwd: dir });
+  const gate = runStep({ key: 'g', label: 'g', argv: [script('stale.js', 1)], fix: 'f' }, { cwd: dir });
+  assert.equal(warn.status, 'warn');
+  assert.match(warn.tail, /✗ a finding/);
+  assert.equal(skip.status, 'skipped');
+  assert.equal(gate.status, 'fail', 'a non-advisory step still fails');
+  const advisoryOnly = summarize([warn, skip]);
+  assert.equal(advisoryOnly.ok, true);
+  assert.deepEqual(advisoryOnly.warned, ['r']);
+  assert.match(format(advisoryOnly), /! r[\s\S]*advisory \(a signal, never a gate\): r/);
+  assert.equal(summarize([warn, gate]).ok, false);
+});

package/tests/ui_design_kit.mjs

@@ -27,9 +27,10 @@ const readJson = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8
 
 // ── the contract ──────────────────────────────────────────────────────────────
 test('the platform floors are a pinned list — a floor cannot vanish quietly', () => {
-  assert.deepEqual([...lib.FLOORS], ['console-errors', 'failed-requests', 'horizontal-overflow', 'one-header-main-h1', 'controls-24px', 'top-bar-80px', 'reduced-motion']);
+  assert.deepEqual([...lib.FLOORS], ['console-errors', 'failed-requests', 'horizontal-overflow', 'text-fit', 'sibling-overlap', 'one-header-main-h1', 'controls-24px', 'top-bar-80px', 'reduced-motion']);
   assert.deepEqual(lib.EXIT, { CLEAN: 0, PROBLEMS: 1, USAGE: 2, NO_BROWSER: 3 });
-  assert.deepEqual(Object.keys(lib.SIZES), ['320', '390', '1440']);
+  assert.deepEqual(Object.keys(lib.SIZES), ['320', '390', '1280', '1440']);
+  assert.deepEqual([...lib.DEFAULT_SIZES], [1440, 390, 320], 'render.js renders these unless --sizes names 1280');
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
@@ -95,6 +96,10 @@ test('auditFloors names each floor a render breaks, and says nothing about a cle
   assert.ok(p.some((x) => x.startsWith('top-bar-80px') && /96px/.test(x)));
   assert.ok(p.some((x) => /data-mode "light" under a dark scheme/.test(x)));
   assert.deepEqual(lib.auditFloors({ ...clean(), mode: null }, { mode: 'dark' }), [], 'a page that sets no data-mode is not held to one');
+  assert.deepEqual(lib.auditFloors({ ...clean(), textFit: [], overlaps: [] }, { width: 1440, mode: 'dark' }), []);
+  const fit = lib.auditFloors({ ...clean(), textFit: ['#t1 "Governance" 15px past its card', 'b', 'c', 'd', 'e', 'f', 'g'], overlaps: ['#mSec > div ∩ #mSec > div 640x48'] }, { width: 1280 });
+  assert.ok(fit.includes('text-fit: #t1 "Governance" 15px past its card | b | c | d | e (+2 more)'), fit.join(' / '));
+  assert.ok(fit.includes('sibling-overlap: #mSec > div ∩ #mSec > div 640x48'));
 });
 
 test('expectProblems compares every expectation the vocabulary allows', () => {

package/tests/ui_design_kit_fit.mjs

@@ -0,0 +1,75 @@
+// tests/ui_design_kit_fit.mjs — the kit's two fit floors measured in a real page (task 1004203, ADR 0329):
+// text past its box (HTML, and SVG text past its card) and overlapping text-bearing siblings, with the shapes
+// that clip or layer ON PURPOSE staying silent. Needs the system Edge or Chrome the kit drives; with neither,
+// the test skips — tests/ui_design_kit.mjs pins the pure audit without one.
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const lib = require(path.join(ROOT, 'modules', 'ui-design', 'kit', 'lib.js'));
+
+let browser = null;
+try { browser = await lib.launchBrowser(); } catch (e) { if (!(e instanceof lib.NoBrowserError)) throw e; }
+after(() => browser && browser.close());
+
+// Each shape the done-when names, beside the look-alikes that must NOT report: the .mSec one-cell grid with a
+// second child (task 1003078), a card title past its rect (task 1003480), ellipsis, a scroller, an absolute
+// overlay, a visually-hidden label, wrapped prose whose soft-wrap space hangs past the line, two wrapped
+// inline siblings (their boxes span lines), and a sticky head over rows scrolled under it.
+const PAGE = `<!doctype html><html><head><style>
+  body { margin: 0; font: 16px/1.4 monospace; }
+  .box { width: 120px; }
+  .nowrap { white-space: nowrap; }
+  .cell { display: grid; grid-template-columns: 100px 1fr; width: 400px; }
+  .cell > div { grid-column: 2; grid-row: 1; }
+  .vh { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
+</style></head><body><header></header><main><h1>fit</h1>
+  <p id="prose" class="box">a paragraph of ordinary words that wraps across several lines inside its box</p>
+  <div id="spills" class="box nowrap">averyveryverylongunbreakabletitle</div>
+  <div id="ellipsis" class="box nowrap" style="overflow: hidden; text-overflow: ellipsis">averyveryverylongunbreakabletitle</div>
+  <div id="scroller" class="box nowrap" style="overflow-x: auto">averyveryverylongunbreakabletitle</div>
+  <span class="vh">a visually hidden label far wider than one pixel</span>
+  <section id="mSec" class="cell"><h2>Head</h2><div>the first child's text</div><div>a second child's text</div></section>
+  <section id="alone" class="cell"><h2>Head</h2><div>the only child</div></section>
+  <p id="inline" class="box"><code>the first inline code run</code> then <code>a second inline code run</code></p>
+  <div id="rows" style="height: 60px; overflow: auto"><div style="position: sticky; top: 0">a sticky head</div><div>row one</div><div>row two</div><div>row three</div><div>row four</div></div>
+  <div id="layer" style="position: relative"><div>the base text</div><div style="position: absolute; top: 0">an overlay</div></div>
+  <svg width="400" height="100">
+    <g id="fits"><rect width="200" height="40"/><text x="10" y="25">fits</text></g>
+    <g id="over" transform="translate(0 50)"><rect width="60" height="40"/><text x="10" y="25">WWWWWWWWWWWW</text></g>
+  </svg>
+</main></body></html>`;
+
+test('the fit floors report the overflow and the overlap by element, and nothing that clips or layers on purpose', { skip: !browser && 'no system Edge or Chrome' }, async () => {
+  const ctx = await browser.newContext({ viewport: { width: 1280, height: 800 } });
+  const page = await ctx.newPage();
+  await page.setContent(PAGE);
+  await page.evaluate(() => { document.getElementById('rows').scrollTop = 30; });
+  const facts = await page.evaluate(lib.factsInPage, {});
+  await ctx.close();
+
+  assert.equal(facts.textFit.length, 2, facts.textFit.join('\n'));
+  assert.match(facts.textFit.find((f) => f.startsWith('#spills')) || '', /^#spills "averyvery.*" \d+px past its box$/);
+  assert.match(facts.textFit.find((f) => f.startsWith('#over')) || '', /^#over > text "WWWW.*" \d+px past its card$/);
+  assert.deepEqual(facts.overlaps.map((o) => o.replace(/ \d+x\d+$/, '')), ['#mSec > div:nth-of-type(1) ∩ #mSec > div:nth-of-type(2)']);
+
+  const problems = lib.auditFloors(facts, { width: 1280 });
+  assert.ok(problems.some((p) => p.startsWith('text-fit: ') && p.includes('#spills') && p.includes('#over > text')));
+  assert.ok(problems.some((p) => p.startsWith('sibling-overlap: #mSec > div:nth-of-type(1) ∩ #mSec > div:nth-of-type(2)')));
+});
+
+test('an overlap among <body>\'s own children is caught too — the one-cell grid one level up', { skip: !browser && 'no system Edge or Chrome' }, async () => {
+  const ctx = await browser.newContext({ viewport: { width: 1280, height: 800 } });
+  const page = await ctx.newPage();
+  await page.setContent(`<!doctype html><html><head><style>
+    body { margin: 0; display: grid; grid-template-columns: 1fr; }
+    body > div { grid-column: 1; grid-row: 1; }
+  </style></head><body><div id="first">the first child's text</div><div id="second">a second child's text</div></body></html>`);
+  const facts = await page.evaluate(lib.factsInPage, {});
+  await ctx.close();
+  assert.deepEqual(facts.overlaps.map((o) => o.replace(/ \d+x\d+$/, '')), ['#first ∩ #second']);
+});

package/tests/visual_review.mjs

@@ -75,6 +75,7 @@ await test('a task that names a page file in its description is told to use /des
   assert.match(lines.join('\n'), /\/design/);
   assert.match(lines.join('\n'), /review-sheet\.js/);
   assert.match(lines.join('\n'), /OK/);
+  assert.match(lines.join('\n'), /\/ship-check renders the pages you changed/, 'the automatic fit check is named (task 1004203)');
 });
 
 await test('touches[], a UI module label, and the artist craft nudge too — the same predicate the review uses', () => {