@bongos/core 1.20.39 → 1.20.41

package/modules/{ui-design → design-styles}/skills/imagegen-frontend-mobile/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Paid: each image is made on the project's image key. It adds the picture files to the project.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/imagegen-frontend-web/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Paid: each image is made on the project's image key. It adds the picture files to the project.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/impeccable/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. A review changes nothing; a fix changes the page.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.
@@ -65,7 +65,7 @@ The full list, grouped:
 
 The setup step is the preamble's world load, done **once per session** and not repeated: the pack, the tokens, the root `DESIGN.md`, and `docs/project-context.template.md` for product truth. The directives that come back are the world's own named rules and its Do's and Don'ts; quote them from the files, never from memory. Then, before editing anything, inspect the target **and at least one source of existing visual truth** for it: the sheet the page loads, a sibling component, the page's states file, or a plate under the instance's assets. A surface is edited only after both have been read.
 
-This skill lives at `modules/ui-design/skills/impeccable/` in the core and at `.claude/skills/impeccable/` once materialised into an instance; the playbooks are always `reference/<name>.md` relative to this file. If a harness has put the file somewhere else, resolve the playbooks relative to wherever this file was read from, and fall back to the module path.
+This skill lives at `modules/design-styles/skills/impeccable/` in the core and at `.claude/skills/impeccable/` once materialised into an instance; the playbooks are always `reference/<name>.md` relative to this file. If a harness has put the file somewhere else, resolve the playbooks relative to wherever this file was read from, and fall back to the module path.
 
 ## The three homes, and what they are here
 

package/modules/{ui-design → design-styles}/skills/industrial-brutalist-ui/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/minimalist-ui/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/policy.json

@@ -1,5 +1,5 @@
 {
-  "_doc": "The vendoring policy for third-party UI skills in the ui-design module (task 1003321, ADR 0198). tests/ui_design_skills.mjs enforces it; modules/ui-design/skills/README.md explains it. A skill lands under skills/vendor/<name>/ only with a PROVENANCE.md sidecar, a licence on the allowlist, a /scan-before-install verdict that is not dangerous, and the PLATFORM PREAMBLE block (PREAMBLE.md, byte-identical) at the top of its SKILL.md body. A dangerous verdict or a licence off the allowlist lands a rebuild spec, never a copy.",
+  "_doc": "The vendoring policy for third-party UI skills in the design-styles module (task 1003321, ADR 0198; moved out of ui-design by task 1004470). tests/ui_design_skills.mjs enforces it; modules/design-styles/skills/README.md explains it. A skill lands under skills/vendor/<name>/ only with a PROVENANCE.md sidecar, a licence on the allowlist, a /scan-before-install verdict that is not dangerous, and the PLATFORM PREAMBLE block (PREAMBLE.md, byte-identical) at the top of its SKILL.md body. A dangerous verdict or a licence off the allowlist lands a rebuild spec, never a copy.",
   "licenceAllowlist": ["Apache-2.0", "MIT", "BSD-2-Clause", "BSD-3-Clause", "CC-BY-4.0"],
   "verdictsThatMayLand": ["clean", "caution"],
   "sidecar": "PROVENANCE.md",

package/modules/{ui-design → design-styles}/skills/redesign-existing-projects/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the existing pages, and you check them on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/stitch-design-taste/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It writes one brief document and changes no pages.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/style/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. The new look is only used once you choose to adopt it.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/npm-release/preview/divert.js

@@ -44,9 +44,19 @@ function pathOf(req) {
   return q === -1 ? url : url.slice(0, q);
 }
 
-/** The Set-Cookie value that removes the steering cookie. */
-function clearCookie() {
-  return `${COOKIE_NAME}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`;
+/** Path/HttpOnly/SameSite/Secure the steering cookie is set with; the clear repeats them. */
+function steerFlags(req) {
+  return `HttpOnly; SameSite=Lax${req && req.secure ? '; Secure' : ''}`;
+}
+
+/** The Set-Cookie value that sets the steering cookie. */
+function setCookie(version, req) {
+  return `${COOKIE_NAME}=${version}; Path=/; ${steerFlags(req)}`;
+}
+
+/** The Set-Cookie value that removes it: same Path, SameSite and Secure as the set (task 1004466). */
+function clearCookie(req) {
+  return `${COOKIE_NAME}=; Path=/; Max-Age=0; ${steerFlags(req)}`;
 }
 
 // Run an express-style gate to its verdict without letting it write a response of its own:
@@ -77,14 +87,14 @@ function createDivert({ supervisor, forward, requireBuilder, requirePermission }
     const st = supervisor.status();
     if (st.state !== 'running' || st.version !== wanted) {
       // The preview this cookie pointed at is gone: drop the cookie and serve the live hall.
-      res.append('Set-Cookie', clearCookie());
+      res.append('Set-Cookie', clearCookie(req));
       return next();
     }
     const p = pathOf(req);
     if (AUTH_PATH.test(p) || PREVIEW_PATH.test(p)) return next();
     if (req.headers.authorization) return next();
     if (!(await passes(requireBuilder, req)) || !(await passes(mayPreview, req))) {
-      res.append('Set-Cookie', clearCookie());
+      res.append('Set-Cookie', clearCookie(req));
       return next();
     }
     supervisor.touch();
@@ -92,4 +102,4 @@ function createDivert({ supervisor, forward, requireBuilder, requirePermission }
   };
 }
 
-module.exports = { createDivert, cookieVersion, clearCookie, AUTH_PATH, PREVIEW_PATH };
+module.exports = { createDivert, cookieVersion, clearCookie, setCookie, AUTH_PATH, PREVIEW_PATH };

package/modules/npm-release/preview/proxy.js

@@ -74,7 +74,10 @@ function createProxy({ port, banner, exitHref, httpImpl = http } = {}) {
       { host: '127.0.0.1', port: port(), method: req.method, path: req.originalUrl || req.url, headers },
       (upRes) => {
         const out = {};
-        for (const [k, v] of Object.entries(upRes.headers)) if (!HOP.has(k)) out[k] = v;
+        // SET-COOKIE NEVER CROSSES (task 1004466). The preview shares the live hall's origin,
+        // so a cookie it set would overwrite the live hall's own (cb_stealth, the session,
+        // the steering cookie) and lock its owner out. Its cookies stay with the child.
+        for (const [k, v] of Object.entries(upRes.headers)) if (!HOP.has(k) && k.toLowerCase() !== 'set-cookie') out[k] = v;
         const isPage = /^text\/html\b/i.test(String(upRes.headers['content-type'] || ''));
         if (!isPage) {
           res.writeHead(upRes.statusCode, out);

package/modules/npm-release/routes/preview.js

@@ -20,8 +20,8 @@
 
 const express = require('express');
 const api = require('../../../src/module-api');
-const { createDivert, clearCookie } = require('../preview/divert');
-const { createProxy, COOKIE_NAME } = require('../preview/proxy');
+const { createDivert, clearCookie, setCookie } = require('../preview/divert');
+const { createProxy } = require('../preview/proxy');
 const { previewable } = require('../preview/supervisor');
 const { VERSION_RE, PACKAGE } = require('../preview/commands');
 
@@ -119,14 +119,15 @@ module.exports = function buildNpmReleasePreviewRouter({
     if (!VERSION_RE.test(v) || st.state !== 'running' || st.version !== v) {
       return failure(res, 409, 'preview_not_running', 'That preview is not running.');
     }
-    const secure = req.secure ? '; Secure' : '';
-    res.append('Set-Cookie', `${COOKIE_NAME}=${v}; Path=/; HttpOnly; SameSite=Lax${secure}`);
+    res.append('Set-Cookie', setCookie(v, req));
+    res.set('Cache-Control', 'no-store');
     sup.touch();
     return res.redirect(302, '/');
   });
 
   router.get('/npm-release/preview/exit', api.requireBuilder, mayPreview, (req, res) => {
-    res.append('Set-Cookie', clearCookie());
+    res.append('Set-Cookie', clearCookie(req));
+    res.set('Cache-Control', 'no-store');
     res.redirect(302, '/deploy');
   });
 

package/modules/pixel-art/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/pixel-art/module.json

@@ -0,0 +1,12 @@
+{
+  "key": "pixel-art",
+  "title": "Pixel-art skills (tile generation, tile and animation review, feedback capture, the Figma tile canvas)",
+  "description": "The five pixel-art SKILLS an instance with a pixel-art world turns on: otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture and otb-figma-sync (task 1004470, owner ruling on blocker 1000139). They were orphans in the core's .claude/skills/: docs attributed them to art-pipeline / character-anim, neither of which has a module.json (ADR 0272), and modules/art-pipeline/ never publishes because it carries copyrighted reference maps (ADR 0098). This module carries ONLY the skill text, never a reference map, a palette, a rubric or the generation pipeline — those stay with the instance's own art-pipeline host module, which the skills read at their documented paths. default: false because most instances have no pixel-art world, and every skill description is resident in every session whether it is used or not. Declaration-only: no routes, no migrations, no port, so turning it off withdraws only these skills.",
+  "version": "1.0.0",
+  "coreVersion": "^1.19.0",
+  "default": false,
+  "maintenance": { "status": "core-maintained" },
+  "contributes": { "skills": ["otb-tile-generate", "otb-design-review", "otb-character-review", "otb-feedback-capture", "otb-figma-sync"] },
+  "provides": [],
+  "consumes": []
+}

package/modules/provisioning/starter-bundles.js

@@ -124,6 +124,21 @@ const OPTIONAL_MODULES = Object.freeze([
     summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.',
     aliases: Object.freeze(['chatroom', 'talk', 'messaging', 'community', 'announcements', 'notifications']),
   }),
+  // The two opt-in SKILL modules of task 1004470: no routes and no page, only extra
+  // commands for the AI. Off by default because every command's description costs
+  // context in every session, used or not.
+  Object.freeze({
+    key: 'design-styles',
+    label: 'Design styles',
+    summary: 'Extra ways for the AI to style your pages: ready-made looks, a polish pass, and a way to author your own look.',
+    aliases: Object.freeze(['theme', 'branding', 'visual', 'taste', 'aesthetic', 'layout']),
+  }),
+  Object.freeze({
+    key: 'pixel-art',
+    label: 'Pixel-art tools',
+    summary: 'Commands to generate game tiles and sprites, score them against your art rules, and keep a style guide.',
+    aliases: Object.freeze(['tileset', 'graphics', 'artwork', 'retro', 'drawing', 'gamedev']),
+  }),
 ]);
 
 // The opt-in keys alone, for the membership tests the normalizer runs. Derived,

package/modules/ui-design/kit/serve.js

@@ -130,6 +130,8 @@ const STARTER_BUNDLES_FIXTURE = {
   optional: [
     { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets, for reading, research and review.', aliases: ['bots', 'assistants', 'automation', 'llm', 'helpers'] },
     { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.', aliases: ['chatroom', 'talk', 'messaging', 'community', 'announcements', 'notifications'] },
+    { key: 'design-styles', label: 'Design styles', summary: 'Extra ways for the AI to style your pages: ready-made looks, a polish pass, and a way to author your own look.', aliases: ['theme', 'branding', 'visual', 'taste', 'aesthetic', 'layout'] },
+    { key: 'pixel-art', label: 'Pixel-art tools', summary: 'Commands to generate game tiles and sprites, score them against your art rules, and keep a style guide.', aliases: ['tileset', 'graphics', 'artwork', 'retro', 'drawing', 'gamedev'] },
   ],
 };
 

package/modules/ui-design/module.json

@@ -1,12 +1,12 @@
 {
   "key": "ui-design",
-  "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the skills, the styles)",
-  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; and the reserved homes for the look-before-you-ship kit (kit/), the vetted UI skills (skills/) and the style library (styles/) the sibling tasks land. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
+  "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the styles)",
+  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; the look-before-you-ship kit (kit/) and the style library (styles/). The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470; /design reaches them when that module is on. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"], "disciplines": ["ui"] },
+  "contributes": { "skills": ["design", "design-sync", "figma-design-sync"], "disciplines": ["ui"] },
   "declarativeSeams": { "skills": ["design", "design-sync", "figma-design-sync"] },
   "provides": [],
   "consumes": []

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.39",
+  "version": "1.20.41",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.39",
+      "version": "1.20.41",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.39",
+  "version": "1.20.41",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8343,5 +8343,17 @@
       "id": "1004464",
       "text": "Setting up an app on Render from the project wizard no longer fails when the owner leaves the build command empty. The box now comes filled in with Render's usual build command for the chosen language, which the owner can chan"
     }
+  ],
+  "1.20.40": [
+    {
+      "id": "1004466",
+      "text": "Stop the version preview from overwriting the live hall's cookies, and make leaving a preview reliably clear it."
+    }
+  ],
+  "1.20.41": [
+    {
+      "id": "1004470",
+      "text": "Projects that don't do pixel art or design styling no longer carry 18 unused AI commands in every session (about a third less to load); projects that want them turn them on with one setting."
+    }
   ]
 }

package/scripts/gds/doc-cli-guard.js

@@ -39,7 +39,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 const DOC_CLI_ALLOW = new Map([
   ['.claude/skills/paint/SKILL.md::scripts/gds/art-stage.js',
     'art-stage.js ships with the art-pipeline HOST module, which publish-manifest.js excludes from core — absent from a core-only checkout by design; the skill says so inline.'],
-  ['.claude/skills/otb-tile-generate/SKILL.md::scripts/gds/art-stage.js',
+  ['modules/pixel-art/skills/otb-tile-generate/SKILL.md::scripts/gds/art-stage.js',
     'same as paint/SKILL.md — the art staging CLI travels with the excluded art-pipeline module, not the portable core.'],
   ['docs/session-logs/2026-09-10-task-1003507-the-box-that-could-not-be-reaped.md::scripts/gds/box.js',
     'a dated session log — the historical record, never rewritten — of work on a CLI the dev-box removal deleted (task 1003893); it describes what was run then, not what to run now.'],

package/scripts/gds/fitness-ratchets.js

@@ -421,7 +421,10 @@ function apiAliasCallerMetrics() {
 function skillListingMetrics() {
   try {
     const lint = require('./skill-lint.js');
-    return { skill_listing_chars: lint.lintSkills(lint.listSkillFiles()).listingChars };
+    // Resident skills only (task 1004470): a skill owned by a module this checkout leaves
+    // off (pixel-art, design-styles — both default: false) is in no session's listing here.
+    const files = lint.listSkillFiles();
+    return { skill_listing_chars: lint.lintSkills(files, { resident: lint.residentSkillFiles(undefined, { files }) }).listingChars };
   } catch (e) {
     // Fail open, but never SILENTLY: an unenforced ratchet that says nothing is
     // indistinguishable from a passing one, which is how a budget stops being a

package/scripts/gds/fitness.js

@@ -1198,7 +1198,8 @@ function checkSkillFrontmatter() {
     return { name: 'skill frontmatter parses (task 1003548)', ok: true, hardFail: false, violations, warnings: [`skill-lint unavailable: ${e.message}`], note: 'linter missing — check skipped.' };
   }
   const files = lint.listSkillFiles(INSTANCE_ROOT);
-  const report = lint.lintSkills(files);
+  // Lint every file; count the listing over the skills RESIDENT here (task 1004470).
+  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(INSTANCE_ROOT, { files }) });
   const rel = (f) => path.relative(INSTANCE_ROOT, f).replace(/\\/g, '/');
   const long = [];
   for (const r of report.results) {

package/scripts/gds/publish-manifest.js

@@ -65,6 +65,8 @@ const PUBLISH_ALLOWLIST = [
   'modules/specialities/',  // role sub-specialities (task 1003855, ADR 0296). default:true, so it MUST be here, and the copy-desk asymmetry above applies verbatim: the settings panel ships regardless because modules/hall-ui/ is allowlisted as one subtree, so omitting this line would put a "Your specialities" section in every instance's settings page whose every call 404s.
   'modules/copy-desk/',      // the artist's loop over user-facing TEXT (goal 1000074, ADR 0178). default:true, so it MUST be here — and note the ASYMMETRY that makes omitting it worse than useless: its hall surface ships regardless, because modules/hall-ui/ is allowlisted as one subtree. A released core carrying the page and the nav entry but not the routes behind them puts a tab in every instance's hall whose every call 404s. The module and its page are only ever added or removed together; tests/publish_manifest.mjs holds that pair.
   'modules/ui-design/',      // the design contract + its adapters/CLIs + the /design playbook (task 1003324, ADR 0197). default:true, so it MUST be here: a released core without it would materialize skills (design, design-sync, figma-design-sync) whose CLIs and adapters do not exist.
+  'modules/design-styles/',  // the thirteen opt-in design-style skills split out of ui-design (task 1004470). default:false, but MUST be here: shipped is not enabled, and a released core without it hands an instance that turns it on an "unknown module" with nothing to materialize. Skill text only.
+  'modules/pixel-art/',      // the five opt-in pixel-art skills (task 1004470), which shipped from .claude/skills/ before this. default:false. SKILL.md text only — never a reference map, a palette or generated art: those are modules/art-pipeline/, which CONTENT_EXCLUDE keeps out below for the copyright reason (ADR 0098).
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/public-landing/', // the front door (task 1003322, ADR 0218) — the repo-root public-landing/ entry this replaces was always here, and for the same reason: default:true, and it is the only thing an instance serves at its apex root. Omit it and a released core answers the game-less 404 tail on its own home page.

package/scripts/gds/skill-lint.js

@@ -25,7 +25,10 @@
 // Usage:
 //   node scripts/gds/skill-lint.js                 lint every skill Claude Code can load — .claude/skills/*
 //                                                  plus the module-owned modules/*/skills/* that materialize
-//                                                  into it; exit 1 on any error
+//                                                  into it; exit 1 on any error. The listing total counts
+//                                                  only the skills RESIDENT here: a skill owned by a module
+//                                                  this checkout's config leaves off is linted, not counted
+//                                                  (task 1004470)
 //   node scripts/gds/skill-lint.js <file...>       lint specific files
 //   node scripts/gds/skill-lint.js --hook          PostToolUse mode: read the hook JSON on stdin, lint the
 //                                                  edited file if it is a SKILL.md, print findings, exit 0
@@ -146,11 +149,28 @@ function listSkillFiles(root = REPO_ROOT) {
   return [...core, ...owned];
 }
 
-// Lint a set of files; returns per-file results plus the listing total vs budget.
-function lintSkills(files) {
+// The subset of listSkillFiles() that is actually RESIDENT for an instance — what
+// claude-materialize.js would land in its .claude/skills/ (task 1004470). Linting still
+// covers every file (a defect in an opt-in module's skill must not wait for the module
+// to be switched on), but the listing cost is a per-session number, and a skill owned by
+// a module the instance leaves off is never in that session's listing. Enablement is the
+// materialiser's own rule (moduleSkillRoster: the instance's config/modules.json, else the
+// module's `default`), read from there rather than restated. Fails open to the full list
+// if the materialiser cannot load, so the number can only ever over-report.
+function residentSkillFiles(root = REPO_ROOT, { instanceDir = root, files = listSkillFiles(root) } = {}) {
+  let off;
+  try { off = require('./claude-materialize.js').disabledModuleSkills({ coreRoot: root, instanceDir }); } catch (_) { return files; }
+  return files.filter((f) => !off.has(path.basename(path.dirname(f))));
+}
+
+// Lint a set of files; returns per-file results plus the listing total vs budget. The
+// listing counts `resident` (a list of paths) when given, else every linted file.
+function lintSkills(files, { resident } = {}) {
   const results = files.map((f) => lintSkillFile(fs.readFileSync(f, 'utf8'), { file: f }));
-  const listingChars = results.reduce((a, r) => a + r.listingChars, 0);
-  return { results, listingChars, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
+  const counted = resident ? new Set(resident.map((f) => path.resolve(f))) : null;
+  const listed = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
+  const listingChars = listed.reduce((a, r) => a + r.listingChars, 0);
+  return { results, listingChars, listedSkills: listed.length, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
 // The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
@@ -170,7 +190,8 @@ function format(report, { relTo = REPO_ROOT } = {}) {
   }
   const errs = report.results.reduce((a, r) => a + r.errors.length, 0);
   const warns = report.results.reduce((a, r) => a + r.warnings.length, 0);
-  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s); listing ${report.listingChars} chars (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
+  const resident = report.listedSkills !== undefined && report.listedSkills !== report.results.length ? ` (the ${report.listedSkills} resident here; the rest belong to modules this instance leaves off)` : '';
+  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s); listing ${report.listingChars} chars${resident} (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
   return out.join('\n');
 }
 
@@ -196,10 +217,11 @@ function main() {
     return;
   }
   const files = argv.filter((a) => !a.startsWith('--'));
-  const report = lintSkills(files.length ? files.map((f) => path.resolve(f)) : listSkillFiles());
+  const all = files.length ? null : listSkillFiles();
+  const report = all ? lintSkills(all, { resident: residentSkillFiles(REPO_ROOT, { files: all }) }) : lintSkills(files.map((f) => path.resolve(f)));
   if (json) console.log(JSON.stringify(report, null, 1)); else console.log(format(report));
   process.exitCode = report.results.some((r) => r.errors.length) ? 1 : 0;
 }
 
-module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, splitFrontmatter, isSkillMd, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
+module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
 if (require.main === module) main();

package/src/bongos/module-scope-map.js

@@ -269,8 +269,9 @@ const MODULE_GLOBS = {
   // than instance hosting and the web-surface precedent is one key per surface.
   'public-landing': ['modules/public-landing/'],
   // --- the design capability (task 1003324, ADR 0197): the design contract, its
-  //     adapters + sync CLIs + validator, the /design playbook, and the reserved homes
-  //     for the kit / the vendored UI skills / the style library. default-on,
+  //     adapters + sync CLIs + validator, the /design playbook, the kit and the style
+  //     library (the design-style skills are the design-styles key since task
+  //     1004470). default-on,
   //     declaration-only (three skills, no routes/port/migrations). The three
   //     scripts/gds/ shims are core-side entry points over the module's CLIs —
   //     listed for task affinity (the memory/ideas precedent: a command travels with
@@ -302,6 +303,11 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- the two opt-in SKILL modules (task 1004470): declaration-only, default-off.
+  //     Each owns only its own dir — the skills ship from modules/<key>/skills/,
+  //     not .claude/skills/, so there is no core skill dir to list. ---
+  'pixel-art': ['modules/pixel-art/'],
+  'design-styles': ['modules/design-styles/'],
   // --- the COPY half of the design contract: the artist's loop over user-facing
   //     TEXT (goal 1000074). ADR 0081 gave design TOKENS a repo-owned source of
   //     truth; text had none. R01 built the inventory (the copy-inventory

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.39'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.41'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -507,10 +507,12 @@ t('moduleSkillSources: a non-slug name never reaches path.join; a vendored dir w
 t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disabled-module skill is excluded', () => {
   if (!existsSync(join(ROOT, '.claude', 'hooks'))) return;
   const dir = mkdtempSync(join(tmpdir(), 'rb-e2e-'));
-  // Target instance: demo-branded, art-pipeline OFF (so its otb-* skills must be dropped).
+  // Target instance: demo-branded, pixel-art OFF (so its otb-* skills must be dropped).
+  // Since task 1004470 those skills are the pixel-art module's (they were orphans in the
+  // core's .claude/skills/ that art-pipeline, which has no manifest here, never owned).
   mkdirSync(join(dir, 'config'), { recursive: true });
   writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ domains: { publicOrigin: 'https://demo.cloudbongos.com', buildersOrigin: 'https://demo.cloudbongos.com', statusOrigin: 'https://demo.cloudbongos.com', oauthOrigin: 'https://demo.cloudbongos.com' }, configDir: 'cloudbongos', envPrefix: 'BONGOS' }));
-  writeFileSync(join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'art-pipeline': false } }));
+  writeFileSync(join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'art-pipeline': false, 'pixel-art': false } }));
   const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
   // Founder core → demo: a branding delta exists and rules are built. The NEUTRAL
   // core now carries its own dev-loop hooks (task 1003125), so this body runs there
@@ -531,12 +533,11 @@ t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disable
   }
   assert.deepEqual(offenders, [], `founder origin/config-dir survived in: ${offenders.join(', ')}`);
 
-  // (b) art-pipeline is off → its otb-* skills are excluded; a core skill remains.
-  //     (The exclusion map, like the rebrand rules, resolves on a founder core.)
-  if (founderDelta) {
-    assert.ok(res.excludedSkills.includes('otb-tile-generate'), `art-pipeline skill excluded (got ${res.excludedSkills.join(',')})`);
-    assert.ok(!existsSync(join(dir, '.claude', 'skills', 'otb-tile-generate')), 'excluded skill not written');
-  }
+  // (b) pixel-art is off → its otb-* skills are excluded; a core skill remains. This used
+  //     to self-scope to a founder core, the only place an art-pipeline manifest existed;
+  //     the pixel-art module ships in the neutral core, so it now runs everywhere.
+  assert.ok(res.excludedSkills.includes('otb-tile-generate'), `pixel-art skill excluded (got ${res.excludedSkills.join(',')})`);
+  assert.ok(!existsSync(join(dir, '.claude', 'skills', 'otb-tile-generate')), 'excluded skill not written');
   assert.ok(existsSync(join(dir, '.claude', 'skills', 'builder-ship')), 'a core skill is still materialized');
   rmSync(dir, { recursive: true, force: true });
 });

package/tests/module_loader.mjs

@@ -276,7 +276,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/npm_release_preview_divert.mjs

@@ -159,6 +159,16 @@ test('a cookie for a preview that is not running is dropped and the live hall an
   }
 });
 
+test('the clearing cookie repeats the set attributes, Secure included (task 1004466)', () => {
+  const { setCookie } = require('../modules/npm-release/preview/divert.js');
+  for (const secure of [false, true]) {
+    const req = { secure };
+    const attrs = (c) => c.split('; ').slice(1).filter((a) => !/^Max-Age=/.test(a)).join('; ');
+    assert.equal(attrs(clearCookie(req)), attrs(setCookie('1.19.1000', req)), 'secure=' + secure);
+    assert.equal(/; Secure$/.test(clearCookie(req)), secure);
+  }
+});
+
 test('the clearing cookie expires the steering cookie for the whole site', () => {
   assert.match(clearCookie(), /^bongos_preview=; Path=\/; Max-Age=0/);
 });