@bongos/core 1.21.82 → 1.21.84

package/modules/platform-identity/invite-notices.js

@@ -18,31 +18,96 @@
 //
 // Both writers touch ONLY a `pending` row, so a notice can never create, downgrade or
 // remove a real membership (a member is left as-is; the row is not theirs to change).
-// A login with no hub account is a no-op: there is nobody on the hub to notify, and
-// the project's own row still admits them when they sign in there.
+//
+// A login with no hub account is PARKED by login (task 1004646, migration 031): a
+// platform account is only born when someone signs in to a project THROUGH the hub,
+// so the usual invitee — new to the platform — has none, and dropping the notice
+// meant they never saw it, even after signing in to the hub. The invitations read
+// lists a parked notice for whoever signs in with that login (listParkedInvites).
 //
 // Its own file because platform-identity.js is at the size ratchet; it reuses that
 // file's account lookup and pending-row writers rather than restating them.
 'use strict';
 
+const api = require('../../src/module-api');
 const pi = require('./platform-identity');
 
-// The project noticed an invite for `githubLogin` → a `pending` hub row, if the login
-// has a hub account and no membership in this project yet. Returns { noted } for the
+const loginKey = (githubLogin) => String(githubLogin || '').trim().replace(/^@/, '').toLowerCase();
+
+// The project noticed an invite for `githubLogin` → a `pending` hub row if the login
+// has a hub account, else a parked notice under the login. Returns { noted } for the
 // route's own logging; the route never tells the caller which case happened (see it).
-async function noteProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+async function noteProjectInvite({ clientId, githubLogin }, { pool = api.pool } = {}) {
   const account = await pi.getAccountByLogin(githubLogin, { pool });
-  if (!account) return { noted: false };
+  if (!account) {
+    const login = loginKey(githubLogin);
+    if (!login) return { noted: false };
+    await pool.query(
+      `INSERT INTO platform_identity_parked_invite_notices (client_id, login_lower)
+       VALUES ($1, $2)
+       ON CONFLICT (client_id, login_lower) DO UPDATE SET noted_at = now()`,
+      [clientId, login],
+    );
+    return { noted: true, parked: true };
+  }
   const out = await pi.inviteToProject({ clientId, githubId: account.github_id }, { pool });
   return { noted: !!out.invited };
 }
 
-// The project rescinded the invite for `githubLogin` → drop the `pending` hub row.
+// The project rescinded the invite for `githubLogin` → drop the `pending` hub row and
+// any parked notice under the login (an account made since the notice keeps both
+// reachable, so both go).
 async function clearProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+  const parked = await removeParkedInvite({ clientId, githubLogin }, { pool });
   const account = await pi.getAccountByLogin(githubLogin, { pool });
-  if (!account) return { cleared: false };
+  if (!account) return { cleared: parked.removed };
   const out = await pi.removePendingInvite({ clientId, githubId: account.github_id }, { pool });
-  return { cleared: out.removed };
+  return { cleared: out.removed || parked.removed };
+}
+
+// The parked notices for one signed-in login, in the shape listPendingInvitesForAccount
+// returns, minus any past the invite's 30 days (ADR 0356) and any project the reader
+// already holds a real membership in — signing in there accepted it.
+async function listParkedInvites({ githubLogin, githubId }, { pool = api.pool } = {}) {
+  const login = loginKey(githubLogin);
+  if (!login) return [];
+  const { rows } = await pool.query(
+    `SELECT n.client_id, n.noted_at AS invited_at,
+            c.name AS project_name, c.origin AS project_origin
+       FROM platform_identity_parked_invite_notices n
+       LEFT JOIN platform_identity_sso_clients c ON c.client_id = n.client_id
+      WHERE n.login_lower = $1
+        AND n.noted_at > now() - make_interval(days => $2)
+        AND NOT EXISTS (
+          SELECT 1 FROM platform_identity_project_memberships m
+           WHERE m.client_id = n.client_id AND m.github_id = $3 AND m.membership_kind <> 'pending')
+      ORDER BY n.noted_at DESC`,
+    [login, api.inviteExpiry.INVITE_EXPIRY_DAYS, String(githubId || '')],
+  );
+  return rows;
+}
+
+// The invitee declined, or the project rescinded: drop the parked notice for the login.
+async function removeParkedInvite({ clientId, githubLogin }, { pool = api.pool } = {}) {
+  const login = loginKey(githubLogin);
+  if (!login) return { removed: false };
+  const { rowCount } = await pool.query(
+    `DELETE FROM platform_identity_parked_invite_notices WHERE client_id = $1 AND login_lower = $2`,
+    [clientId, login],
+  );
+  return { removed: rowCount > 0 };
+}
+
+// Everything waiting on one signed-in builder: their pending rows plus the notices
+// parked under their login, one per project (a pending row wins — it is the same
+// invite, written once the account existed).
+async function listInvitesForBuilder({ githubId, githubLogin }, { pool = api.pool } = {}) {
+  const [pending, parked] = await Promise.all([
+    pi.listPendingInvitesForAccount(githubId, { pool }),
+    listParkedInvites({ githubLogin, githubId }, { pool }),
+  ]);
+  const seen = new Set(pending.map((r) => r.client_id));
+  return pending.concat(parked.filter((r) => !seen.has(r.client_id)));
 }
 
 // The project's own invite box for `githubLogin`: its hall's watch page, with the login
@@ -58,4 +123,7 @@ function hallInviteUrl(origin, githubLogin) {
   return `${u.origin}/builders/watch${login ? `?invite=${encodeURIComponent(login)}` : ''}`;
 }
 
-module.exports = { noteProjectInvite, clearProjectInvite, hallInviteUrl };
+module.exports = {
+  noteProjectInvite, clearProjectInvite, hallInviteUrl,
+  removeParkedInvite, listInvitesForBuilder,
+};

package/modules/platform-identity/migrations/platform_identity_031_parked_invite_notices.sql

@@ -0,0 +1,45 @@
+-- platform_identity_031_parked_invite_notices.sql — a project's invite notice for a
+-- GitHub login the hub has no account for yet, kept until that person signs in
+-- (task 1004646; ADR 0353 amended).
+--
+-- WHY. POST /sso/invites/notify resolves the invited login to a platform account and,
+-- before this table, dropped the notice when there was none. A platform account is
+-- only created when someone signs in to a PROJECT through the hub — signing in to the
+-- hub itself creates none — so the usual invitee (new to the platform) never saw the
+-- invite on /invitations, even after signing in. Now the notice is PARKED here by
+-- login, and the invitations read lists it for whoever signs in with that login.
+--
+-- THE SHAPE CARRIES THE RULES:
+--   * THE KEY IS (client_id, login_lower), so a re-invite cannot pile up rows: the
+--     writer's upsert restarts noted_at in place.
+--   * NO STATUS COLUMN (ADR 0201 D1.3, ADR 0353). A notice admits nobody: the
+--     project's own access_requests row does, and signing in there accepts it. A
+--     parked notice is hidden at read time once the reader holds a non-pending
+--     membership in that project.
+--   * THE 30-DAY WINDOW IS READ-TIME (ADR 0356, the doorway's INVITE_EXPIRY_DAYS),
+--     exactly as for a pending membership row. Nothing sweeps the rows.
+--   * KEYED BY LOGIN, like the project's own invited access_requests row, which is
+--     what admits the same person — so the notice can claim no more than the invite.
+--
+-- NOTHING HERE IS AUTHORITY (ADR 0016 / ADR 0141).
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). CREATE only, so the
+-- previous release still runs against this schema. Idempotent.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS platform_identity_parked_invite_notices (
+  client_id   text NOT NULL,
+  login_lower text NOT NULL,
+  noted_at    timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (client_id, login_lower)
+);
+
+-- The reader's side: every notice for one login.
+CREATE INDEX IF NOT EXISTS platform_identity_parked_invite_notices_login
+  ON platform_identity_parked_invite_notices (login_lower);
+
+COMMENT ON TABLE platform_identity_parked_invite_notices IS
+  'A project''s invite notice for a GitHub login with no hub account yet (task 1004646). Listed on /invitations for whoever signs in with that login; a notice only, never a way in (ADR 0353). The 30-day window is applied when read (ADR 0356).';
+
+COMMIT;

package/modules/platform-identity/routes/my-projects.js

@@ -29,6 +29,7 @@ const projectStats = require('../project-stats');
 const applicationEcho = require('../application-echo');
 const guilds = require('../guilds');
 const guildEngagements = require('../guild-engagements');
+const inviteNotices = require('../invite-notices');
 const hubKeys = require('../hub-keys');
 const { isAccountActive } = require('../account-visibility');
 const { projectPublishability } = require('../publish-gate');
@@ -302,10 +303,12 @@ module.exports = function myProjectsRoutes() {
     }
   });
 
-  // rank: any-builder — the caller's OWN pending invitations (ADR 0141 §5).
+  // rank: any-builder — the caller's OWN pending invitations (ADR 0141 §5), plus the
+  // notices parked under their login before they had a hub account (task 1004646).
   router.get('/my-projects/invites', requireBuilder, async (req, res) => {
     try {
-      const invites = await pi.listPendingInvitesForAccount(req.builder.github_id, { pool });
+      const invites = await inviteNotices.listInvitesForBuilder(
+        { githubId: req.builder.github_id, githubLogin: req.builder.github_login }, { pool });
       res.json({ invites: invites.map((i) => ({ client_id: i.client_id, name: i.project_name || i.project_origin || i.client_id, origin: i.project_origin || null, invited_at: i.invited_at })) });
     } catch (err) {
       console.error('[platform-identity] GET /my-projects/invites', err);
@@ -324,7 +327,8 @@ module.exports = function myProjectsRoutes() {
     if (!clientId) return res.fail('bad_client_id', 400);
     try {
       const out = await pi.removePendingInvite({ clientId, githubId: req.builder.github_id }, { pool });
-      if (!out.removed) return res.fail('no_pending_invite', 404);
+      const parked = await inviteNotices.removeParkedInvite({ clientId, githubLogin: req.builder.github_login }, { pool });
+      if (!out.removed && !parked.removed) return res.fail('no_pending_invite', 404);
       res.json({ ok: true, accepted: false });
     } catch (err) {
       console.error('[platform-identity] decline invite', err);

package/modules/provisioning/birth.js

@@ -21,6 +21,11 @@
 // that came and went would leave a stale line behind.
 
 const BIRTH_KEY = 'founding_birth';
+// The wizard's ship-mode answer (task 1004629): auto | manual, stamped beside the birth on
+// the row the create route just made. Reserved like the birth (out of SETTINGS_VOCAB): the
+// instance's own project_settings['ship.mode'] is where the setting LIVES and where the
+// owner changes it later; this is only what the project was born with.
+const SHIP_MODE_KEY = 'ship_mode';
 const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
 
 const storedOf = (row) => (row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings) ? row.settings : {});
@@ -43,11 +48,18 @@ function demoBox(row) {
   return { people, hours_each: hours };
 }
 
+// The closed ship-mode list is the core's own (src/bongos/project-settings.js), never retyped here.
+const parseShipMode = (raw) => require('../../src/module-api').projectSettings.parseShipMode(raw);
+
+// bornShipMode(row) — PURE. The ship mode the wizard asked for, or '' for none (or junk).
+const bornShipMode = (row) => parseShipMode(storedOf(row)[SHIP_MODE_KEY]).mode || '';
+
 // The companion env (SETTINGS_COMPANION_ENV). src/branding.js maps them onto founding.*.
 const BIRTH_COMPANION_ENV = Object.freeze({
   FOUNDING_BIRTH: bornAt,
   DEMO_PEOPLE: (row) => { const d = demoBox(row); return d ? String(d.people) : ''; },
   DEMO_HOURS: (row) => { const d = demoBox(row); return d ? String(d.hours_each) : ''; },
+  SHIP_MODE: bornShipMode,
 });
 
 // stampBirth(db, instanceId, now) — the create route's one write, on the row it just
@@ -61,4 +73,19 @@ async function stampBirth(db, instanceId, now = new Date()) {
   );
 }
 
-module.exports = { BIRTH_KEY, BIRTH_COMPANION_ENV, stampBirth };
+// stampShipMode(db, instanceId, raw) — the wizard's ship-mode answer, on the row the create
+// route just made. An absent or unusable answer writes nothing, so the instance reads "never
+// chosen" and asks at its first ship (task 1004630). Write-once, like the birth.
+async function stampShipMode(db, instanceId, raw) {
+  const { mode } = parseShipMode(raw);
+  if (!mode) return false;
+  await db.query(
+    `UPDATE provisioning_instances
+        SET settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object($2::text, $3::text)
+      WHERE id = $1 AND NOT (COALESCE(settings, '{}'::jsonb) ? $2::text)`,
+    [instanceId, SHIP_MODE_KEY, mode],
+  );
+  return true;
+}
+
+module.exports = { BIRTH_KEY, BIRTH_COMPANION_ENV, SHIP_MODE_KEY, stampBirth, stampShipMode };

package/modules/provisioning/routes/provisioning.js

@@ -359,7 +359,7 @@ module.exports = function provisioningRoutes() {
       // exactly the set the panel preselected. An explicit [] is the different
       // answer "none of them". maxItems is a sanity ceiling well above a catalog
       // that is three modules wide today.
-      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' }, demo: { type: 'object' },   // the wizard's terms tick (task 1004417, ../terms-ack.js); the demo route's { people, hours_each } (task 1004420, ../demo.js)
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' }, demo: { type: 'object' }, ship_mode: { type: 'string', enum: ['auto', 'manual'] },   // the wizard's terms tick (task 1004417, ../terms-ack.js); the demo route's { people, hours_each } (task 1004420, ../demo.js)
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
@@ -475,6 +475,8 @@ module.exports = function provisioningRoutes() {
       // provision intent exists, so the runner's web.env already carries the marker and the demo's box.
       // Best-effort: a project that misses its marker opens as an ordinary hall; the create still stands.
       if (created) await birth.stampBirth(pool, instance.id).catch((err) => log.error('[provisioning] birth marker not stamped', err));
+      // The wizard's ship mode (task 1004629) rides beside it; a miss means the project asks at its first ship.
+      if (created) await birth.stampShipMode(pool, instance.id, body.ship_mode).catch((err) => log.error('[provisioning] ship mode not stamped', err));
       const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       // Enqueue the provision intent (idempotent: an already-open intent is returned)
       // — but ONLY when the instance actually needs standing up. Blindly enqueueing on

package/modules/public-landing/public/account.html

@@ -624,6 +624,7 @@
   });
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/assets/cosmos.css

@@ -628,6 +628,14 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .signinDoor:hover{background:var(--ink);color:var(--bg);}
 /* a long GitHub login truncates instead of pushing Sign out off the screen */
 .who>span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:14ch;}
+/* what is waiting on you (task 1004646, assets/invite-badge.js): a count on the chip and on
+   the band's Invitations item — the accent fill with --accent-on ink, the .btn pairing */
+.invBadge{display:inline-flex;align-items:center;justify-content:center;min-width:20px;height:20px;padding:0 6px;
+  border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);
+  font-family:var(--font-body);font-size:12px;font-weight:700;line-height:1;letter-spacing:0;vertical-align:middle;}
+.who>.invBadge{max-width:none;overflow:visible;}
+.bandT .invBadge{margin-left:10px;}
+.invWaiting{margin:6px 0 4px;font-size:15.5px;font-weight:600;}
 /* keyboard focus on the two search pills is VISIBLE — the input's own outline
    is off by design, so the pill carries the ring */
 .search:focus-within{box-shadow:0 0 0 3px color-mix(in srgb,var(--accent) 40%,transparent);}

package/modules/public-landing/public/assets/invite-badge.js

@@ -0,0 +1,91 @@
+/* assets/invite-badge.js — WHAT IS WAITING ON YOU, said where you already look
+   (task 1004646; the owner's report of 2026-10-08 that invitations "aren't obvious").
+
+   /invitations lists what asks you in, but the only way there was the profile band,
+   with nothing saying anything was waiting. This counts what is waiting — a project's
+   invite (GET /my-projects/invites) and a guild's invite or a join request to a guild
+   you own (GET /me/guild-requests) — and, when it is more than none, paints:
+     - a count on the identity chip (#who) and on the profile band's Invitations item;
+     - on /projects?view=mine, a line "You have N invitations waiting →" under the
+       view's heading.
+   A guild's engagement with a project is left out: it asks nothing of you.
+
+   Hub only, with no flag of its own: the Invitations item sits inside the apex-only
+   region, which a child instance strips, so there this file finds no item and reads
+   nothing. Signed out, both reads 401 and nothing is painted. A failed read counts
+   as none — a badge is a convenience, never the record.
+
+   Built from nodes only. window.InviteBadge.refresh() re-reads, for a page
+   that has just answered one (the invitations page's Decline and Accept). */
+(function () {
+  'use strict';
+  var API = '/api/bongos';
+  function $(id) { return document.getElementById(id); }
+  function item() { var m = $('menuProfile'); return m && m.querySelector('a[href="/invitations"]'); }
+
+  function readCount(path, pick) {
+    return fetch(API + path, { credentials: 'same-origin', headers: { Accept: 'application/json' } })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) { return d ? pick(d) : 0; })
+      .catch(function () { return 0; });
+  }
+  function len(x) { return Array.isArray(x) ? x.length : 0; }
+
+  function badge(host, n, label) {
+    if (!host) return;
+    var b = host.querySelector('.invBadge');
+    if (!n) { if (b) b.remove(); return; }
+    if (!b) {
+      b = document.createElement('b');
+      b.className = 'invBadge';
+      var shown = document.createElement('span');
+      shown.setAttribute('aria-hidden', 'true');
+      var said = document.createElement('span');
+      said.className = 'vh';
+      b.appendChild(shown);
+      b.appendChild(said);
+      // before the chip's chevron; at the end of a band item
+      host.insertBefore(b, host.querySelector('svg.cv'));
+    }
+    b.firstChild.textContent = n > 99 ? '99+' : String(n);
+    b.lastChild.textContent = ', ' + label;
+  }
+
+  // at the top of the mine view, under its heading and lede — the list of projects
+  // below it can be long, and the Invitations pointer sits at its foot
+  function mineLine(n, label) {
+    var view = $('view-mine');
+    var hero = view && view.querySelector('.hero');
+    if (!hero) return;
+    var p = $('mineInvitesWaiting');
+    if (!n) { if (p) p.remove(); return; }
+    if (!p) {
+      p = document.createElement('p');
+      p.id = 'mineInvitesWaiting';
+      p.className = 'invWaiting';
+      var a = document.createElement('a');
+      a.href = '/invitations';
+      p.appendChild(a);
+      hero.appendChild(p);
+    }
+    p.firstChild.textContent = 'You have ' + label + ' waiting →';
+  }
+
+  function paint(n) {
+    var label = n + (n === 1 ? ' invitation' : ' invitations');
+    badge($('who'), n, label + ' waiting');
+    badge(item(), n, label + ' waiting');
+    mineLine(n, label);
+  }
+
+  function refresh() {
+    if (!item()) return Promise.resolve(0);
+    return Promise.all([
+      readCount('/my-projects/invites', function (d) { return len(d.invites); }),
+      readCount('/me/guild-requests', function (d) { return len(d.incoming) + len(d.owner_incoming); }),
+    ]).then(function (c) { var n = c[0] + c[1]; paint(n); return n; });
+  }
+
+  window.InviteBadge = { refresh: refresh, paint: paint };
+  refresh();
+})();

package/modules/public-landing/public/contact.html

@@ -120,6 +120,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/guild.html

@@ -629,6 +629,7 @@
   load();
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/invitations.html

@@ -232,11 +232,13 @@
      button on failure. `onRemoved` carries whatever else the caller needs after
      the row is gone (the empty-line flip). The busy/idle label swap the /projects
      copy carries is for its Leave button, which never moved here. */
+  /* the bar's waiting count (assets/invite-badge.js, task 1004646) follows an answer here */
+  function recount() { if (typeof window !== 'undefined' && window.InviteBadge) window.InviteBadge.refresh(); }
   function postThenRemoveRow(url, row, btn, onRemoved) {
     btn.disabled = true;
     fetch(url, { method: 'POST', credentials: 'same-origin' })
       .then(function (r) { return r.ok ? r.json() : Promise.reject(); })
-      .then(function () { row.remove(); if (onRemoved) onRemoved(); })
+      .then(function () { row.remove(); if (onRemoved) onRemoved(); recount(); })
       .catch(function () { btn.disabled = false; });
   }
 
@@ -481,7 +483,7 @@
     msg.className = 'projMsg';
     msg.textContent = '';
     guildPost('/guild-requests/' + encodeURIComponent(id) + '/decline').then(function (res) {
-      if (res.ok) { row.remove(); paintInvitesSection(); return; }
+      if (res.ok) { row.remove(); paintInvitesSection(); recount(); return; }
       btns.forEach(function (b) { b.disabled = false; });
       if (res.status === 401) { sessionExpired(msg); return; }
       msg.className = 'projMsg err';
@@ -582,6 +584,7 @@
           radios.forEach(function (r) { r.disabled = true; });
           page.hidden = false;
           msg.className = 'projMsg ok';
+          recount();
           msg.textContent = 'You’ve joined ' + name + (on ? ', and your numbers count toward its totals.' : ', and your numbers are left out of its totals.');
           return;
         }
@@ -660,6 +663,7 @@
           hint.hidden = true;
           msg.className = 'projMsg ok';
           msg.textContent = who + ' is in ' + (r.guild.name || r.guild.slug) + ' now.';
+          recount();
           return;
         }
         accept.textContent = 'Accept';
@@ -961,6 +965,7 @@
   });
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/privacy.html

@@ -129,6 +129,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/projects.html

@@ -1950,6 +1950,31 @@ summary{min-height:24px;padding:3px 0;}
                   </div>
                   <span class="acts"><button type="button" class="rowChg" data-row-chg aria-expanded="false">Edit</button></span>
                 </div>
+
+                <!-- how finished work ships (task 1004629, ADR 0369): Auto unless the owner
+                     says otherwise. It rides the create as ship_mode and becomes the project's
+                     own ship mode, which its settings page can change any time. -->
+                <div class="setRow" data-row="ship">
+                  <span class="k">Shipping</span>
+                  <div class="v"><span class="rowV" data-row-v></span><small class="rowS" data-row-s></small>
+                    <div class="opts" hidden>
+                      <fieldset class="appOpts" id="shipOpts">
+                        <legend>When the AI finishes a task</legend>
+                        <label class="appOpt">
+                          <input type="radio" name="shipMode" value="auto" checked>
+                          <span><b>Auto (recommended)</b>
+                            <span>The AI ships finished work on its own. You don’t run any commands.</span></span>
+                        </label>
+                        <label class="appOpt">
+                          <input type="radio" name="shipMode" value="manual">
+                          <span><b>Manual</b>
+                            <span>The AI stops before each ship and waits for you to approve it.</span></span>
+                        </label>
+                      </fieldset>
+                    </div>
+                  </div>
+                  <span class="acts"><button type="button" class="rowChg" data-row-chg aria-expanded="false">Edit</button></span>
+                </div>
               </div>
               <div class="hint" id="h-review">&nbsp;</div>
               <div class="nav">
@@ -4476,7 +4501,7 @@ summary{min-height:24px;padding:3px 0;}
        request omits the field), [] = the owner switched them all off, [...] =
        what they picked. Never seed it with the preselect — that would store an
        answer nobody gave. */
-    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false, appPlatform: 'later', physics: null, demo: null, look: null, termsAck: false, confirmed: {} };
+    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false, appPlatform: 'later', shipMode: 'auto', physics: null, demo: null, look: null, termsAck: false, confirmed: {} };
     try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
     var authKnown = false;   /* flips true when the boot's /me settles, either way */
 
@@ -5956,7 +5981,6 @@ summary{min-height:24px;padding:3px 0;}
     if (appOptsEl) appOptsEl.addEventListener('change', function (ev) {
       if (ev.target && ev.target.name === 'appPlatform' && !ev.target.disabled) { state.appPlatform = ev.target.value; saveDraft(); syncRenderSetup(); paintSetup(); }
     });
-
     /* ── Render (task 1004352, ADR 0348) ──
        The flow itself is renderConnect(), shared with an existing project's page (task
        1004184). Here it reads and writes the draft (`state`), so every answer but the key
@@ -6073,7 +6097,14 @@ summary{min-height:24px;padding:3px 0;}
       return 'Workspace ' + ws + ' — a new app (' + runtimeLabel(state.renderRuntime || 'node') + ', ' + plan + ')' + db + '. Render bills you directly.';
     }
 
-    var ROWS = ['code', 'address', 'app', 'extras', 'team', 'rewards', 'run'];
+    /* the ship row (task 1004629): anything but 'manual' — an older draft has none — is Auto */
+    function shipModeChoice() { return state.shipMode === 'manual' ? 'manual' : 'auto'; }
+    function syncShipStep() {
+      var pick = shipModeChoice();
+      root.querySelectorAll('#shipOpts input[name=shipMode]').forEach(function (i) { i.checked = i.value === pick; });
+    }
+
+    var ROWS = ['code', 'address', 'app', 'extras', 'team', 'rewards', 'run', 'ship'];
     function rowEl(key) { return root.querySelector('#reviewRows .setRow[data-row="' + key + '"]'); }
     function confirmedRows() {
       if (!state.confirmed || typeof state.confirmed !== 'object') state.confirmed = {};
@@ -6118,6 +6149,7 @@ summary{min-height:24px;padding:3px 0;}
       if (key === 'extras') renderModules();
       if (key === 'code') syncHome();
       if (key === 'app') { syncAppStep(); syncRenderSetup(); }
+      if (key === 'ship') syncShipStep();
     }
     function closeRow(key) {
       var row = rowEl(key);
@@ -6182,6 +6214,8 @@ summary{min-height:24px;padding:3px 0;}
        controls' own handlers run first (they are on the targets), then the row repaints */
     ['input', 'change'].forEach(function (type) {
       $('reviewRows').addEventListener(type, function (ev) {
+        /* the ship row's radios have no handler of their own (task 1004629) */
+        if (type === 'change' && ev.target.name === 'shipMode') { state.shipMode = ev.target.value; saveDraft(); }
         if (ev.target.closest && ev.target.closest('.setRow.open .opts')) {
           var row = ev.target.closest('.setRow'), t = rowText(row.getAttribute('data-row'));
           row.querySelector('[data-row-v]').textContent = t.v;
@@ -6247,6 +6281,11 @@ summary{min-height:24px;padding:3px 0;}
         if (a.framing === 'open-source') return { v: 'Free core only', s: 'The free core, on your own machines.' };
         return { v: 'Everything, for you', s: 'Hosting, payouts and the starter kit, managed.' };
       }
+      if (key === 'ship') {
+        return shipModeChoice() === 'manual'
+          ? { v: 'Manual', s: 'The AI waits for you to approve each ship. You can change this later in your project’s settings.' }
+          : { v: 'Auto (recommended)', s: 'The AI ships finished work on its own. You can change this later in your project’s settings.' };
+      }
       return { v: '', s: '' };
     }
     /* paint every row from the draft, and the locked Continue under them */
@@ -6407,7 +6446,9 @@ summary{min-height:24px;padding:3px 0;}
                existing history instead of pushing a fresh tree, which a repo that already
                has commits rejects as unrelated history. state.mode already tracked
                greenfield|adopt for the UI — it has to reach the server too. */
-            onboard_mode: state.mode === 'adopt' ? 'adopt' : 'greenfield'
+            onboard_mode: state.mode === 'adopt' ? 'adopt' : 'greenfield',
+            /* the ship row (task 1004629): becomes the new project's own ship mode */
+            ship_mode: shipModeChoice()
           })
         });
       }).then(function (res) {
@@ -7175,7 +7216,7 @@ summary{min-height:24px;padding:3px 0;}
          is three-valued and null is its "nothing said" sentinel; leaving the key out
          left it UNDEFINED, which is not null — so pickedModules() reached .slice()
          on it and the second project's Modules step threw. */
-      state = { step: 1, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false, appPlatform: 'later', physics: null, demo: null, look: null, termsAck: false, confirmed: {} };
+      state = { step: 1, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false, appPlatform: 'later', shipMode: 'auto', physics: null, demo: null, look: null, termsAck: false, confirmed: {} };
       $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
       $('f-noaddr').checked = false; $('f-desc').value = '';
       $('termsAck').checked = false; paintDoors(); demoShow('intro'); checksShow('main');
@@ -11142,6 +11183,8 @@ summary{min-height:24px;padding:3px 0;}
     .then(function (data) {
       me = data.builder || data.me || data;
       renderWho();
+      /* renderWho rebuilds the chip, so the waiting count is painted again on it (task 1004646) */
+      if (window.InviteBadge) window.InviteBadge.refresh();
       paintShellIdentity();
       wizard.onAuth();
       $('gate').hidden = true;
@@ -11174,6 +11217,7 @@ summary{min-height:24px;padding:3px 0;}
     .then(loadSelfShipped, loadSelfShipped);
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/projects.states.json

@@ -55,6 +55,7 @@
     "in-new-review-extras": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"extras\"] [data-row-chg]"],["wait",900]],"expect":{"visible":["#modQ","#modCards .tpill","#modCoreNote"]}},
     "in-new-review-team": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"team\"] [data-row-chg]"],["wait",300],["click","[data-phys-solo=\"many\"]"],["wait",600]],"expect":{"visible":["#physTeam","#physGuessLine","#teamCards","#reviewRows .setRow[data-row=\"rewards\"]"]}},
     "in-new-review-run": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"run\"] [data-row-chg]"],["wait",300],["click","[data-phys=\"framing\"][data-val=\"hybrid\"]"],["wait",600]],"expect":{"visible":["#physSuite"]}},
+    "in-new-review-ship": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"ship\"] [data-row-chg]"],["wait",300],["click","#shipOpts input[value=\"manual\"]"],["wait",300]],"expect":{"visible":["#shipOpts"]}},
     "in-new-review-confirmed": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200]],"expect":{"visible":["#reviewGo","#reviewRows .setRow.done"],"text":[["#reviewGo","Looks right, continue"]]}},
     "in-new-look": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["click","#reviewGo"],["wait",500]],"expect":{"visible":["#panel-look","#wizLook","#wizRecap","#doCreate"],"hidden":["#panel-review"],"attr":[["#wizRoom","data-screen","look"]]}},
     "in-new-done": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["click","#reviewGo"],["wait",500],["click","#doCreate"],["wait",1500]],"expect":{"visible":["#panel-done","#hop","#hopCanvas","#hopStatus","#hopJump"],"hidden":["#panel-look","#qWrap","#wizBack","#wizInvite","#liveProgress","#humanSteps","#wizInviteLater","#stepPager"]}},

package/modules/public-landing/public/terms.html

@@ -134,6 +134,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms" aria-current="page">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>