@bongos/core 1.24.25 → 1.24.27

package/modules/hall-ui/public/watch.html

@@ -34,6 +34,8 @@
       </div>
 
       <main id="hall-main">
+        <!-- task 1005043: the page loader, shown until the sealed notice or a pane has something showing. -->
+        <p class="hall-loading hall-loading--page hall-loading--zones" role="status">Loading…</p>
         <!-- Restricted notice — shown by watch.js when the viewer is below the
              floor, with the floor written in from the pack's rank label. -->
         <section class="scroll" id="sealed-scroll" aria-labelledby="sealed-h" hidden>
@@ -166,7 +168,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared component kit (window.OTBKit) — tabs, ledger, pager (task 2166). -->

package/modules/hall-ui/public/watch.js

@@ -754,7 +754,7 @@
         if (!btn || !target.contains(btn)) return;
         const slug = btn.getAttribute('data-doc-open');
         const view = $('#engagement-doc-view');
-        if (view) view.innerHTML = foot('Reading…');
+        if (view) view.innerHTML = '<p class="hall-loading" role="status">Reading…</p>';
         try {
           const res = await fetchJson(`/security/docs/${encodeURIComponent(slug)}`);
           const doc = res.doc || {};

package/modules/hall-ui/public/work.html

@@ -105,7 +105,7 @@
           <p class="claim-count-line" id="claim-count" aria-live="polite"></p>
 
           <div class="task-list" id="task-list">
-            <div class="profile__placeholder">…</div>
+            <div class="hall-loading" role="status">Loading…</div>
           </div>
           <div id="ready-pager-mount"></div>
         </section>
@@ -117,7 +117,7 @@
 
           <table class="ledger" id="wip-table">
             <thead><tr><th></th><th>#</th><th>Task</th><th>Builder</th><th>For</th><th></th></tr></thead>
-            <tbody><tr><td colspan="6" class="ledger__empty">…</td></tr></tbody>
+            <tbody><tr><td colspan="6" class="ledger__empty"><span class="hall-loading" role="status">Loading…</span></td></tr></tbody>
           </table>
           <div id="wip-pager-mount"></div>
         </section>
@@ -139,7 +139,7 @@
           <div class="stat-row" id="works-summary" style="margin-bottom: 14px" hidden></div>
           <p class="scroll__lede">The most recently shipped tasks.</p>
           <div class="history" id="history-list">
-            <div class="profile__placeholder">…</div>
+            <div class="hall-loading" role="status">Loading…</div>
           </div>
           <div id="done-pager-mount"></div>
         </section>
@@ -174,7 +174,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->

package/modules/hall-ui/records/loader.md

@@ -0,0 +1,35 @@
+# The loader — the Bongos mark wherever a hall page waits for its data (task 1005043)
+
+Goal 1000095. Owner ask, 2026-11-03: a smooth load screen with the Bongos logo whenever the hall
+waits for data, in the spirit of monday.com's Vibe data loaders (vibe.monday.com, Skeleton: grey
+shapes breathing 0.4 to 1 and back over 0.8s, in the place the content will land).
+
+- **One component, in `style.css`: `.hall-loading`.** CSS only. `::before` is the ring and the core
+  (a mask of shell.js's brand-mark geometry, painted `--ink` at 30%), `::after` is the dot (the same
+  box, painted `--accent`). Both turn together round the still core, easing out of and back into the
+  logo's own pose every 1.6s; the ink breathes on half that beat. The element's own text is the
+  caption. It arrives 240ms late (filter: opacity), so a read that answers fast never shows it.
+  Sizes: the default (40px, a panel), `--page` (64px, a page's main area), `--inline` (16px, a line).
+- **A page opts in by putting the class on the placeholder it already had**, and gives it
+  `role="status"`. The words did not change; a bare `…` became `Loading…`. A placeholder a script
+  rewrites IN PLACE (atlas's caption, sessions' status line, the goal dependency ledes, the profile's
+  activity placeholder) keeps its plain words, because the class would stay on the finished sentence.
+- **Pages that are blank while they wait get a page loader that puts itself away.** The sealed/body
+  pages (board-room, deploy, fleet, gate, government, market-watch-settings, project-settings,
+  sessions) open their `<main>` on `.hall-loading--wait`, which shows only while every section after
+  it is `[hidden]`. Home and Watch, whose zones and panes are always present, use
+  `.hall-loading--zones`: it shows while no showing zone has a showing child. Both are `:has()`
+  rules inside `@supports`, so a browser without it simply never shows them. No page script hides
+  them. Settings' layout is never `[hidden]`, so `hideLayout()` puts its loader away.
+- **Lists that paint later carry a loader inside them**: Blockers' list (its first `renderList`
+  replaces it), Collab's three ask lists (its failure path now stops them and says why, where the page
+  used to stay blank), the table placeholder rows (the loader sits inside the `ledger__empty` cell).
+- **The skeletons breathe too.** `.kit-skel` and the goal list's `.gr-skel__ring` take the loader's
+  breath, so the Goals list's row skeleton is the Vibe pattern exactly.
+- **DESIGN.md holds.** Transform and filter only; every colour a token (the black in the masks is
+  alpha); the Kill Switch stops it all and leaves the logo. The 20s ambient floor is for the plates:
+  a loader is the live thing on the page, which is also why its dot may spend the accent.
+- **Not covered:** the apex pages (account, projects, community) and the status page run their own
+  sheets; the city, street, goal map and thinking sky draw their own worlds and kept their own lines.
+- **Look at it:** `node scripts/hall-preview/server.js --port 4630 --fixture-me --latency 5000` holds
+  every read 5s (task 1005043 added `--latency`). Tests: `tests/hall_loading.mjs`.

package/modules/hall-ui/records/update-pill.md

@@ -0,0 +1,12 @@
+# The Update pill — a newer core, taken in place from any hall page (task 1005041)
+
+The owner, 2026-11-03: upgrading Bongos from a project's hall was "way too obstructing and not obvious what to do", and it should feel like the Claude app, which just tells you to restart. A hosted project's owner used to meet a full-width banner, go to Settings, press Update, land on the hub's deploy door on another site, press Check, then Confirm, then wait there. What this settled:
+
+- **A pill, not a strip.** `update-pill.js` draws one button at the head of the top bar's right side (the Link GitHub chip's spot and shape, one step louder: an accent dot), for the same viewers the banner had (`core.pin.move`). Four faces: `Update`, `Updating…`, `Reload` (filled accent, the Claude moment) and `Update held`. It has no dismiss: it is quiet enough to leave. The one-time "Bongos is updated" note (`core-move-notice.js`) is the same card, pinned under the top bar's right end, not a second strip.
+- **The card is step one, Update now is step two (ADR 0293 D4).** The card names the version (`from → to`, small mono under plain-language highlights from the release notes) and Update now sends exactly that one. A door that names another version is never sent: the card shows the door's version and the next press takes it.
+- **The act stays where it was.** On the platform the pill calls its own door (`/provisioning/control-plane`, then the core-upgrade POST). On a hosted project it opens the hub's door as a small window (`&handoff=1`); `deploy-handoff.js` there says `ready`, hears `go` with the version, and moves the project with the owner's own hub session. The hub hears only the window that opened it, from the project's registered address (`domain`), naming the version its own preview would move to. No word from the hall means one press in the window, never a move on load. Self-hosted: the card names `bongos upgrade`; operator-run: "Ask for this update".
+- **Progress is read off the project's own `/version`**, with the hold (`GET /core-update` `held`) asked every fifth look for a rollback. The run is remembered in `localStorage` (`bongos.update.run`) so it follows the owner across pages and survives the restart; it is forgotten when the version lands or after 45 minutes.
+- **Settings uses the same flow.** Settings → Software update's Update button hands its reading to `OTBUpdatePill.updateNow`; its `href` stays the door's for a page whose pill script did not load.
+- **shell.js got smaller.** The banner's 109 lines became a 61-line loader that fetches `/core-update` once per page and loads the pill only when there is news or a run in flight (1,499 → 1,451 lines).
+
+Tests: `tests/update_pill.mjs` (the pure half, and the real shell + pill in a DOM stub: who sees it, never a link, both doors, refusals, a blocked window, held, a run across pages, done → Reload), `tests/deploy_handoff.mjs` (the hub's three refusals, and its page run for real). Each origin, opener and version check was deleted once and watched to go red. Harness fixture: `core-update.json` (behind, so the pill shows).

package/modules/lifecycle/github-push.js

@@ -1347,6 +1347,7 @@ async function getPullRequestFiles({ number }, deps = {}) {
     for (const f of batch) {
       files.push({
         path: f.filename,
+        previous_path: f.previous_filename || null, // a rename's old path (task 1004546)
         mode: '100644',
         deleted: f.status === 'removed',
         status: f.status,

package/modules/lifecycle/routes/tasks.js

@@ -37,7 +37,7 @@ const { gradeQualityWhere } = require('../db-shared');
 const { helperJoinSql } = require('../page-tweak-artist'); // task 1004432: a page tweak's applier as a helper
 const auth = api;
 const db = require('../db');
-const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); const autoPickupFiles = require('../autopickup-files'); const githubPrClose = require('../github-pr-close'); // ADR 0341 D7 (tests stub the read); ADR 0371 D8
+const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); const autoPickupFiles = require('../autopickup-files'); const githubPrClose = require('../github-pr-close'); const runnerSelfGuard = require('../runner-self-guard'); const { sharedPrReads } = require('../ship-files'); // ADR 0341 D7 (tests stub the read); ADR 0371 D8; task 1004546
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
@@ -1184,7 +1184,7 @@ module.exports = function buildTasksRouter() {
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         prMergeSentence(held);
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
-      const apRefusal = await autoPickupFiles.autoPickupFileRefusal({ taskId: id, prNumber: pr.number }); if (apRefusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(apRefusal.code, 409, { ...apRefusal, message: autoPickupFiles.refusalMessage(apRefusal) }); } // ADR 0371 D8 (task 1004678)
+      const prReads = sharedPrReads(); for (const [guard, refusalFor] of [[autoPickupFiles, autoPickupFiles.autoPickupFileRefusal], [runnerSelfGuard, runnerSelfGuard.runnerSelfEditRefusal]]) { const refusal = await refusalFor({ taskId: id, prNumber: pr.number, branch }, { getPullRequestFiles: prReads.getPullRequestFiles }); if (refusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(refusal.code, 409, { ...refusal, message: guard.refusalMessage(refusal) }); } } // the PR's own files: an auto-pickup round stays on its page (ADR 0371 D8, task 1004678); a runner never changes its own files (task 1004546)
       // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
       // edit that forgets — an assignment must not be able to fail a pushed ship.
       const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })

package/modules/lifecycle/runner-self-guard.js

@@ -0,0 +1,122 @@
+'use strict';
+
+// modules/lifecycle/runner-self-guard.js — the server refuses to publish a
+// runner's change to its own supervisor, safety checks or kill switch, or to any
+// ADR 0043 protected file (task 1004546, ADR 0307 §6).
+//
+// WHY. The runner's own checks (the pre-claim fence and the ship-time diff check)
+// run on the runner's machine, where the worker runs with blanket permissions and
+// could edit or skip them. This one runs on the deployed server, against the pull
+// request's files as GitHub reports them, so nothing on that machine can change it.
+// A runner host holds no push credential (ADR 0055), so publish-branch is its only
+// road to main, and that route asks this file once per publish, beside the
+// auto-pickup files check and in the same shape (autopickup-files.js).
+//
+// TWO LISTS, OVER THE REAL DIFF. The runner's own files (runner-self.js, matched by
+// that file's matcher, required directly) and the ADR 0043 registry (the fence
+// already refuses a DECLARED protected touch; this refuses one the work actually
+// made). The registry is what holds the route line calling this file: tasks.js is
+// on it, so a runner cannot publish its removal.
+//
+// THE REGISTRY MATCHER COMES THROUGH THE DOORWAY. A module reaches core only
+// through src/module-api.js, and task 1004540's grade found that a matcher
+// resolved there could be swapped by a change to that file. So the doorway is on
+// the runner's own list (owner ruling 2026-11-03), and a runner cannot publish a
+// change to it. The matcher is also checked before it is trusted: it must flag two
+// paths the registry has always protected, and one that does not is treated as
+// unreadable, which refuses.
+//
+// WHICH CLAIM IS A RUNNER'S. Its worktree name (runner-self.js RUNNER_TREE_RE),
+// read from the claim row. If that read FAILS, the branch name stands in (the
+// runner's branch is its worktree name), so a database hiccup does not switch the
+// wall off for a runner while an ordinary publish still never depends on the read.
+// Telling a runner's session from its owner's on the server is task 1004547.
+//
+// FAILS CLOSED on the files: a read that throws, a list at GitHub's 300-file cap,
+// or a matcher that fails its check all refuse. An unattended change that cannot
+// be checked goes to a person.
+//
+// Its own small file, on the protected list and on the runner's own list, because
+// the grade of task 1004540 refused the same check written into the shared route
+// helpers and claim reads, which neither list covers.
+
+const api = require('../../src/module-api');
+const githubPush = require('./github-push');
+const { PR_FILES_CAP } = require('./ship-files');
+const runnerSelf = require('./runner-self');
+
+// The task's latest claim, released or not: a publish runs after the ship has
+// resolved it. Both names are read because the server may store a disambiguated
+// worktree_name beside the one the runner asked for.
+const CLAIM_SQL = `
+  SELECT c.worktree_name, c.requested_worktree_name
+    FROM claims c WHERE c.task_id = $1
+   ORDER BY c.claimed_at DESC, c.id DESC LIMIT 1`;
+
+// What a failed claim read answers: not "no claim", which an ordinary publish
+// with no claim row also answers.
+const CLAIM_UNREADABLE = Object.freeze({ unreadable: true });
+
+async function readLatestClaim(taskId, exec = api.pool) {
+  try {
+    const { rows } = await exec.query(CLAIM_SQL, [taskId]);
+    return rows[0] || null;
+  } catch (_) {
+    return CLAIM_UNREADABLE;
+  }
+}
+
+function isRunnerPublish(claim, branch) {
+  if (claim === CLAIM_UNREADABLE) return runnerSelf.isRunnerTree(branch);
+  return !!claim && (runnerSelf.isRunnerTree(claim.worktree_name) || runnerSelf.isRunnerTree(claim.requested_worktree_name));
+}
+
+// Paths the registry has protected since ADR 0043; a matcher that misses either
+// is not the registry's.
+const MATCHER_CANARIES = Object.freeze(['modules/lifecycle/routes/tasks.js', 'migrations/001_canary.sql']);
+function verifiedMatcher(match) {
+  try {
+    if (MATCHER_CANARIES.every((f) => (match([f]) || []).length === 1)) return match;
+  } catch (_) { /* a matcher that throws is not trusted */ }
+  return null;
+}
+
+const unreadable = () => ({ code: 'self_modification_unreadable', files: [], protected: [] });
+
+// The route's one call. Returns null (publish as usual) or the refusal
+// { code, files, protected }. `deps` is the test seam, and the route passes a
+// shared getPullRequestFiles so this and the auto-pickup check read GitHub once.
+async function runnerSelfEditRefusal({ taskId, prNumber, branch = null }, deps = {}) {
+  const claim = await (deps.readLatestClaim || readLatestClaim)(taskId);
+  if (!isRunnerPublish(claim, branch)) return null;
+  const match = verifiedMatcher(deps.matchProtected || ((files) => api.permissionPathCheck.matchProtected(files)));
+  if (!match) return unreadable();
+  let rows;
+  try {
+    rows = await (deps.getPullRequestFiles || ((a) => githubPush.getPullRequestFiles(a)))({ number: Number(prNumber) });
+  } catch (_) {
+    return unreadable();
+  }
+  const list = Array.isArray(rows) ? rows : [];
+  if (list.length >= PR_FILES_CAP) return unreadable();
+  // A rename is checked at both ends: moving a guard away is an edit to it.
+  const changed = [];
+  for (const f of list) {
+    if (f && typeof f.path === 'string' && f.path) changed.push(f.path);
+    if (f && typeof f.previous_path === 'string' && f.previous_path) changed.push(f.previous_path);
+  }
+  return runnerSelf.diffRefusal({ files: changed, protectedHits: match(changed) });
+}
+
+function refusalMessage(r) {
+  const why = r.code === 'self_modification_unreadable'
+    ? "An Autobongos runner's pull request could not be checked in full for changes to the runner's own or protected files. This task goes to a person."
+    : runnerSelf.selfEditMessage(r);
+  return `${why} The pull request was closed (task 1004546).`;
+}
+
+module.exports = {
+  readLatestClaim,
+  runnerSelfEditRefusal,
+  refusalMessage,
+};

package/modules/lifecycle/runner-self.js

@@ -0,0 +1,154 @@
+'use strict';
+
+// modules/lifecycle/runner-self.js — the files an Autobongos runner must never
+// change: its own supervisor, its safety checks and its kill switch (task 1004546,
+// carrying task 1004540's work; ADR 0307 §6).
+//
+// WHY. Owner rule, 2026-10-02: the runner never edits its own supervisor, safety
+// checks or kill switch. The fence only refused tasks that hit the ADR 0043
+// registry, and none of the runner's own files were on it, so an unattended worker
+// could be handed a bug whose fix loosened the fence, the gauge, the grade cap or
+// the kill switch. This is the ONE list of those files and the ONE spelling of what
+// a runner's claim looks like. Three places ask it:
+//
+//   - the runner, BEFORE the claim, over the task's declared touches[]
+//     (scripts/bongos/autobongos-run.js pickTask, then modules/autonomy/fence.js
+//     decideTask as the gate of record);
+//   - ship.js, inside the worker, over the branch's real diff, so a worker is
+//     stopped before it spends a grade (selfEditRefusal);
+//   - the server, at publish, over the pull request's own files as GitHub reports
+//     them (runner-self-guard.js). This is the wall: the worker can unset its own
+//     environment, it cannot change what the deployed server checks.
+//
+// The last two also refuse an ADR 0043 protected file in the real diff (see
+// diffRefusal), which is what keeps a runner from deleting the server guard's call.
+//
+// A RUNNER-ONLY LIST, NOT THE ADR 0043 REGISTRY. A person may still edit these
+// files at their own rank; only an unattended worker may not. Widening the registry
+// would have raised the floor for every human builder to stop one machine.
+//
+// THE LIST COVERS ITS OWN ENFORCEMENT. Every file that implements a check above is
+// on it: this file, the server guard, the fence, the supervisor, the ship pipeline
+// that runs the ship check, the tests that pin them. The route line that calls the
+// server guard sits in modules/lifecycle/routes/tasks.js, which is deliberately NOT
+// listed (the owner ruled that listing tasks.js whole would refuse a large share of
+// ordinary work). It is on the ADR 0043 registry, which the real-diff checks also
+// read, and tests/autobongos_self_modification.mjs drives the real publish route,
+// so removing that line is refused for a runner and turns CI red for anyone.
+//
+// Requires nothing, so the runner, ship.js and the server all read the same list
+// without the module doorway in between (the grade of task 1004540 found that a
+// matcher resolved through src/module-api.js could be swapped there). The doorway
+// itself is on the list too, for what the server guard still reads through it.
+
+// One pattern per line: an exact path, a directory ending in '/', or a prefix
+// ending in '*' that stays inside one directory.
+const RUNNER_SELF_SURFACES = Object.freeze([
+  // The supervisor and its CLIs (scripts/gds/ holds their forwarders).
+  { pattern: 'scripts/bongos/autobongos-*', why: 'the supervisor, its loop, verify, grade cap, tweak lane and Windows service' },
+  { pattern: 'scripts/gds/autobongos-*', why: 'forwarders to the supervisor' },
+  { pattern: 'scripts/bongos/autonomy-*', why: 'the usage gauge and the autonomy gate' },
+  { pattern: 'scripts/gds/autonomy-*', why: 'forwarders to the gauge and the gate' },
+  { pattern: 'scripts/bongos/sequence.js', why: 'the picker and its halt matrix' },
+  // Its safety checks and kill switch.
+  { pattern: 'modules/autonomy/', why: 'the fence, gauge, cadence, heartbeat and the kill-switch routes' },
+  { pattern: 'modules/lifecycle/runner-self.js', why: 'this list' },
+  { pattern: 'modules/lifecycle/runner-self-guard.js', why: 'the server refusal at publish' },
+  { pattern: 'modules/lifecycle/autopickup.js', why: "the server's auto-pickup limits" },
+  { pattern: 'modules/lifecycle/autopickup-files.js', why: 'the auto-pickup page-files wall' },
+  { pattern: 'modules/government/catalog.js', why: 'the kill switch is a system permission declared here' },
+  { pattern: 'modules/government/protected-surfaces.json', why: 'the ADR 0043 registry the fence also reads' },
+  { pattern: 'src/bongos/permission-path-check.js', why: "the registry's matcher" },
+  // Owner ruling 2026-11-03, reversing the earlier "not the doorway": the server
+  // guard reaches the registry matcher and the claims pool through it, so a runner
+  // that could rewrite it could swap both. About 43 tasks in 90 days touched it.
+  { pattern: 'src/module-api.js', why: 'the module doorway the server guard reaches the registry matcher and the pool through' },
+  // The only review between a worker and main, and the road to it.
+  { pattern: 'modules/grading/', why: 'the grader' },
+  { pattern: 'scripts/bongos/ship.js', why: 'the ship driver' },
+  { pattern: 'scripts/bongos/ship-*', why: 'the ship phases, including the ship-time self-edit check' },
+  { pattern: 'modules/lifecycle/github-push.js', why: 'the server-mediated publish and its pull-request files read' },
+  { pattern: 'modules/lifecycle/ship-files.js', why: 'the files-read cap the server guard fails closed on' },
+  // The tests that pin all of the above.
+  { pattern: 'tests/autobongos_*', why: 'the tests that pin the runner' },
+  { pattern: 'tests/autonomy_*', why: 'the tests that pin the autonomy module' },
+]);
+
+// A repo path as git spells it. Windows separators and a leading './' are folded,
+// and case is ignored, so a declared touch cannot slip past on its spelling.
+function normalisePath(p) {
+  return String(p || '').trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '').toLowerCase();
+}
+
+function matches(file, pattern) {
+  const pat = pattern.toLowerCase();
+  if (pat.endsWith('/')) return file.startsWith(pat);
+  if (pat.endsWith('*')) {
+    const prefix = pat.slice(0, -1);
+    return file.startsWith(prefix) && !file.slice(prefix.length).includes('/');
+  }
+  return file === pat;
+}
+
+// The runner's own files among `files`: [{ file, pattern }], in input order.
+function matchRunnerSelf(files) {
+  const out = [];
+  for (const raw of Array.isArray(files) ? files : []) {
+    const file = normalisePath(raw);
+    if (!file) continue;
+    const hit = RUNNER_SELF_SURFACES.find((s) => matches(file, s.pattern));
+    if (hit) out.push({ file: String(raw), pattern: hit.pattern });
+  }
+  return out;
+}
+
+// What a runner's claim looks like: the worktree name autobongos-run.js's
+// worktreeName() generates. The supervisor, its boot reconciliation and the server
+// guard all read this one regex.
+const RUNNER_TREE_RE = /^autobongos-\d+-[0-9a-f]{6}$/;
+const isRunnerTree = (name) => RUNNER_TREE_RE.test(String(name || ''));
+
+// Set by the supervisor on every worker it spawns, so ship.js knows it is running
+// unattended. A worker can unset it; the server guard does not read it.
+const RUNNER_WORKER_ENV = 'AUTOBONGOS_WORKER';
+
+// The verdict over a runner's REAL diff, shared by ship.js and the server: null, or
+// { code, files, protected }. `files` are the runner's own; `protected` are ADR
+// 0043 registry hits, which ADR 0307 §6 says never reach an unattended worker. The
+// pre-claim fence reads those from the declared touches; this reads them from what
+// the work actually changed. That is also what holds the one line in
+// modules/lifecycle/routes/tasks.js that calls the server guard: that file is on
+// the registry, so a runner cannot publish a change to it.
+function diffRefusal({ files, protectedHits = [] } = {}) {
+  const own = [...new Set(matchRunnerSelf(files).map((h) => h.file))];
+  const prot = [...new Set((protectedHits || []).map((h) => (h && h.file) || h).filter((f) => typeof f === 'string' && f))];
+  if (!own.length && !prot.length) return null;
+  return { code: own.length ? 'self_modification' : 'runner_protected_path', files: own, protected: prot };
+}
+
+// The ship-time check: null outside a runner's worker, else diffRefusal.
+// `matchProtected` is the ADR 0043 matcher, passed in because this file requires
+// nothing; it is only called inside a worker.
+function selfEditRefusal({ files, env = process.env, matchProtected = null } = {}) {
+  if (!env || env[RUNNER_WORKER_ENV] !== '1') return null;
+  return diffRefusal({ files, protectedHits: matchProtected ? matchProtected(files) : [] });
+}
+
+function selfEditMessage(refusal) {
+  const r = refusal || {};
+  const parts = [];
+  if (r.files && r.files.length) parts.push(`its own supervisor, safety checks or kill switch (${r.files.slice(0, 10).join(', ')})`);
+  if (r.protected && r.protected.length) parts.push(`a protected permission, migration, infrastructure or pipeline file (${r.protected.slice(0, 10).join(', ')})`);
+  return `An Autobongos runner may not change ${parts.join(', or ') || 'these files'}. This task goes to a person.`;
+}
+
+module.exports = {
+  RUNNER_SELF_SURFACES,
+  matchRunnerSelf,
+  RUNNER_TREE_RE,
+  isRunnerTree,
+  RUNNER_WORKER_ENV,
+  diffRefusal,
+  selfEditRefusal,
+  selfEditMessage,
+};

package/modules/public-landing/public/account.html

@@ -164,7 +164,7 @@
     </a>
   </section>
 
-  <p class="loading" id="loading">Reading your account…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your account…</p>
   <div class="alert" id="pageAlert" role="alert"></div>
 
   <!-- signed in: ships hidden, revealed once GET /me/cross-project answers -->
@@ -223,7 +223,7 @@
       <h2 id="aWaysIn-h">ways to sign in</h2>
       <p class="aSide">GitHub, Google or both. Each one opens this same account, with the same credits, ranks and history.</p>
       <div class="aBody">
-        <p class="aWhat" id="waysLoading">Reading your ways to sign in…</p>
+        <p class="aWhat loading-mark loading-mark--inline" id="waysLoading" role="status">Reading your ways to sign in…</p>
         <ul class="mineRows" id="waysList"></ul>
         <p class="finePrint">Linking never joins two accounts. If the other one already has its own account here, we say so and change nothing.</p>
         <p class="projMsg" id="waysMsg" role="status" aria-live="polite"></p>
@@ -296,7 +296,7 @@
       <h2 id="aBuilding-h">projects you build on</h2>
       <p class="aSide">The projects you have joined as a builder. Only you see this list.</p>
       <div class="aBody">
-        <p class="aWhat" id="buildingLoading">Reading the projects you build on…</p>
+        <p class="aWhat loading-mark loading-mark--inline" id="buildingLoading" role="status">Reading the projects you build on…</p>
         <p class="aWhat" id="buildingEmpty" hidden>You’re not building on any other projects yet.</p>
         <ul class="mineRows" id="buildingList"></ul>
         <p class="projMsg" id="buildingMsg" role="status" aria-live="polite"></p>

package/modules/public-landing/public/assets/cosmos.css

@@ -545,6 +545,51 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .alert summary{cursor:pointer;font-size:12.5px;font-weight:700;}
 .alert details p{margin-top:6px;font-family:var(--font-mono);font-size:12px;font-weight:500;overflow-wrap:anywhere;}
 .loading{font-size:14.5px;font-weight:600;color:var(--ink-faint);padding:14px 0;}
+/* ── the loader (task 1005053; the hall's, task 1005043) ──────────────────────
+   The Bongos mark wherever an apex page waits for its data: the bar's own mark
+   (the ring, the core and the accent dot) as two masks on the placeholder the
+   page already had, whose words stay as its caption. The ring and the dot turn
+   together round the still core, easing out of and back into the logo's pose
+   each beat, and the ink breathes, after the Vibe skeleton the owner pointed at
+   (vibe.monday.com: 0.4 to 1 and back, 0.8s). Three sizes: the default for a
+   section, --page for a page with nothing else to show yet, --inline for a line
+   in a band or a list.
+
+   DESIGN.md holds it: CSS only, transform and filter only (the breath and the
+   arrival are filter: opacity(), not opacity), every colour a var() or a mix of
+   one; the black in the masks is alpha, not paint. The 20s floor is for the
+   ambient plates: a loader is the live thing on the page, so it keeps a loader's
+   tempo and its dot spends the accent. It arrives after 240ms, so a read that
+   answers faster never shows it; under the Kill Switch it is the still logo.
+   It is a grid, not a positioned dot: the ring and the dot share one cell, so
+   the dot stays on the ring whatever padding a page gives its placeholder. */
+.loading-mark{
+  --lm-size:40px;
+  display:grid;justify-items:center;align-items:center;gap:12px;
+  padding:28px 0;text-align:center;color:var(--ink-faint);
+  animation:loading-mark-arrive 500ms cubic-bezier(.16,1,.3,1) 240ms both;
+}
+.loading-mark::before,.loading-mark::after{
+  content:"";grid-area:1/1;width:var(--lm-size);height:var(--lm-size);
+  -webkit-mask:var(--lm-shape) center/contain no-repeat;mask:var(--lm-shape) center/contain no-repeat;
+  animation:loading-mark-turn 1.6s cubic-bezier(.45,.05,.55,.95) infinite;
+}
+/* the ring and the core: one ink, breathing */
+.loading-mark::before{
+  --lm-shape:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'%3E%3Cpath d='M137 31 A78 78 0 1 0 170 66' fill='none' stroke='black' stroke-width='15' stroke-linecap='round'/%3E%3Ccircle cx='100' cy='100' r='55'/%3E%3C/svg%3E");
+  background:color-mix(in srgb,var(--ink) 30%,var(--bg-card));
+  animation:loading-mark-turn 1.6s cubic-bezier(.45,.05,.55,.95) infinite,loading-mark-breathe .8s ease-in-out infinite alternate-reverse;
+}
+/* the dot: the accent, laid exactly over the mark and turning with it */
+.loading-mark::after{
+  --lm-shape:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'%3E%3Ccircle cx='156' cy='46' r='12'/%3E%3C/svg%3E");
+  background:var(--accent);
+}
+.loading-mark--page{--lm-size:64px;padding:72px 0;gap:16px;}
+.loading-mark--inline{--lm-size:16px;grid-template-columns:var(--lm-size) minmax(0,1fr);justify-items:start;gap:8px;padding:0;text-align:left;}
+@keyframes loading-mark-arrive{from{filter:opacity(0);transform:translateY(6px);}}
+@keyframes loading-mark-turn{to{transform:rotate(1turn);}}
+@keyframes loading-mark-breathe{from{filter:opacity(.45);}}
 .empty{border:2px dashed var(--line);border-radius:18px;padding:22px;text-align:center;}
 .empty p{font-size:14.5px;font-weight:600;color:var(--ink-soft);margin-bottom:14px;line-height:1.55;}
 .foot{position:relative;z-index:1;text-align:center;font-size:13px;font-weight:600;color:var(--foot-ink);padding:0 20px 34px;text-shadow:var(--chrome-glow);}

package/modules/public-landing/public/community.html

@@ -230,7 +230,7 @@
          same for every viewer but "Builders you may know", shown signed in like its menu item. -->
     <section id="home" data-view="home" aria-labelledby="homeH">
       <h2 id="homeH">Top builders</h2>
-      <p class="commMsg" id="homeLoading" role="status">Reading the top builders…</p>
+      <p class="commMsg loading-mark" id="homeLoading" role="status">Reading the top builders…</p>
       <p class="projMsg err" id="homeFailed" role="alert" hidden></p>
       <ul class="homeCrowns" id="homeCrowns" hidden>
         <li class="homeCard"><h3 class="commSub">Builder of the week</h3><p class="crownWhen" id="crownWeekWhen"></p><div class="homeBody" id="crownWeek"></div></li>
@@ -282,7 +282,7 @@
       </div>
       <p class="commNote" id="boardNote">{{Currency}} earned across every project, since each builder started.</p>
       <div class="commFor" id="boardFor" hidden></div>
-      <p class="commMsg" id="boardLoading" role="status">Reading the leaderboard…</p>
+      <p class="commMsg loading-mark" id="boardLoading" role="status">Reading the leaderboard…</p>
       <p class="projMsg err" id="boardFailed" role="alert" hidden></p>
       <p class="commMsg" id="boardEmpty" hidden></p>
       <ol class="commRows" id="boardList" data-unit="{{currency}}" aria-labelledby="boardH"></ol>
@@ -295,7 +295,7 @@
          every viewer, and states the rule in full (the spec: the formula is public). -->
     <section id="week" data-view="week" aria-labelledby="weekH" hidden>
       <h2 id="weekH">Builder of the week</h2>
-      <p class="commMsg" id="weekLoading" role="status">Reading the builder of the week…</p>
+      <p class="commMsg loading-mark" id="weekLoading" role="status">Reading the builder of the week…</p>
       <p class="projMsg err" id="weekFailed" role="alert" hidden></p>
       <div class="commCrown" id="weekCrown" hidden></div>
       <p class="commMsg" id="weekNone" hidden></p>
@@ -339,7 +339,7 @@
     <section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>
       <h2 id="recruitH">Open to recruiters</h2>
       <p class="lede">Builders who keep their numbers hidden but are open to hearing from projects. Only project owners see who they are, and only by name.</p>
-      <p class="commMsg" id="recruitLoading" role="status">Checking whether you can see this list…</p>
+      <p class="commMsg loading-mark" id="recruitLoading" role="status">Checking whether you can see this list…</p>
       <div class="commDoor" id="recruitDoor" hidden>
         <p>Sign in to see whether this list is open to you.</p>
         <a class="btn" id="recruitSignin" href="/api/bongos/auth/web/start?return=/community/recruiters&amp;repos=1">

package/modules/public-landing/public/connections.html

@@ -137,7 +137,7 @@
     </a>
   </section>
 
-  <p class="loading" id="loading">Reading your connections…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your connections…</p>
   <!-- a 403 from the connections routes is about the VIEWER: their platform
        profile is not active yet (ADR 0202 D4 §1), so they cannot take part -->
   <p class="mineEmpty" id="inactive" hidden>Connections open once your profile is active. It turns on the first time you sign in to a project with your {{productName}} account, in your browser.</p>

package/modules/public-landing/public/guild.html

@@ -178,7 +178,7 @@
 </div>
 
 <main class="gld" id="guild">
-  <p class="loading" id="loading">Reading this guild…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading this guild…</p>
   <div class="alert" id="pageAlert" role="alert"></div>
 
   <!-- NO GUILD HERE: an unknown slug, a malformed one, and an unlisted guild seen

package/modules/public-landing/public/invitations.html

@@ -147,7 +147,7 @@
     </a>
   </section>
 
-  <p class="loading" id="loading">Reading your invitations…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your invitations…</p>
 
   <!-- ══ INVITATIONS · JOIN BY ADDRESS (task 1003774, moved here by task 1004276) ══
        No Accept button on a project's invite — ADR 0335 retired that hub-only flip
@@ -798,9 +798,9 @@
       return !s || p.name.toLowerCase().indexOf(s) !== -1 || p.host.indexOf(s) !== -1;
     });
   }
-  function pickNote(text) {
+  function pickNote(text, waiting) {
     var li = document.createElement('li');
-    li.className = 'joinList__note';
+    li.className = 'joinList__note' + (waiting ? ' loading-mark loading-mark--inline' : '');
     li.setAttribute('role', 'presentation');
     li.textContent = text;
     return li;
@@ -838,7 +838,7 @@
     picker.active = -1;
     input.removeAttribute('aria-activedescendant');
     if (!picker.projects) {
-      list.appendChild(pickNote('Loading projects…'));
+      list.appendChild(pickNote('Loading projects…', true));
     } else if (!picker.projects.length) {
       closePicker();
       return;