@bongos/core 1.24.26 → 1.24.27

package/tests/core_upgrade_owner_door.mjs

@@ -430,26 +430,12 @@ function boot({ provisioning, deployUrl, pathname = '/settings', hash = '', held
   vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
   windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions: { 'core.pin.move': true } });
   return {
-    banner: () => inserted.find((e) => String(e._html).includes('is available')),
-    notice: () => inserted.find((e) => e.id === 'core-update-notice'),
     deployItem: () => els.get('nav-deploy'),
   };
 }
 const settle = () => new Promise((r) => setTimeout(r, 0));
 const HUB = 'https://cloudbongos.com/deploy?project=hoodify-finance';
 
-// Task 1004296 moved the hand-off: a hall without a door of its own sends its owner to
-// Settings → Software update, whose Update button carries the hub address (GET
-// /software-update's `door`). The banner and the rail no longer link off-site.
-await t('on a hosted project, the banner\'s Upgrade goes to Settings → Software update, not off-site', async () => {
-  const b = boot({ provisioning: false, deployUrl: HUB });
-  await settle();
-  assert.ok(b.banner(), 'the banner renders');
-  assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, 'Upgrade opens the Software update panel');
-  assert.ok(!b.banner().innerHTML.includes(HUB), 'never the hub address directly, even when an older server sends one');
-  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the local /deploy, which this hall no longer has');
-});
-
 await t('on a hosted project, the rail\'s Deploy item stays hidden — it is the platform hall\'s page', async () => {
   const b = boot({ provisioning: false, deployUrl: HUB });
   await settle();
@@ -458,54 +444,16 @@ await t('on a hosted project, the rail\'s Deploy item stays hidden — it is the
   assert.equal(item.dataset.module, 'provisioning', 'its module gate stays, so a hall without the door hides it');
 });
 
-await t('a hall with no door of its own and no hub still links to Software update', async () => {
-  for (const url of [null, 'javascript:alert(1)', 42]) {
-    const b = boot({ provisioning: false, deployUrl: url });
-    await settle();
-    assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, `Software update for ${JSON.stringify(url)}`);
-    assert.doesNotMatch(b.banner().innerHTML, /javascript:/);
-  }
-});
-
-await t('on the Software update panel itself, the banner points rather than linking to the page it is on', async () => {
-  const b = boot({ provisioning: false, pathname: '/settings', hash: '#software-update' });
-  await settle();
-  assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, 'no link to where you already are');
-  assert.match(b.banner().innerHTML, /core-update-notice__hint/);
-});
-
-await t('on the platform, the local door wins: the banner links /deploy and the rail keeps it', async () => {
+// The banner that used to link here is the Update pill now (task 1005041): where its Update now
+// goes on each kind of hall, and the held version it refuses to offer, are pinned against the
+// real pill in tests/update_pill.mjs. What stays here is the rail.
+await t('on the platform, the rail keeps its local /deploy', async () => {
   const b = boot({ provisioning: true, deployUrl: HUB });
   await settle();
-  assert.match(b.banner().innerHTML, /href="\/deploy"/);
-  assert.ok(!b.banner().innerHTML.includes(HUB));
-  assert.ok(!b.banner().innerHTML.includes('software-update'), 'the platform takes its update at its own door');
   const item = b.deployItem();
   assert.notEqual(item.getAttribute('href'), HUB, 'the rail keeps the local /deploy');
   assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');
 });
 
-// Task 1004730: a version this project already tried and rolled back is not announced as
-// "available" with an Upgrade button. The banner says what happened instead, in the owner's
-// words, and points at Software update for the rest.
-await t('a held version: the banner says it was tried and rolled back, and the project is still fine', async () => {
-  const held = { version: '1.19.1033', still_on: '1.19.871', message: 'long form' };
-  const b = boot({ provisioning: false, held });
-  await settle();
-  const n = b.notice();
-  assert.ok(n, 'the banner renders');
-  assert.doesNotMatch(n.innerHTML, /is available/);
-  assert.match(n.innerHTML, /1\.19\.1033<\/strong> was tried on this project and rolled back/);
-  assert.match(n.innerHTML, /still on 1\.19\.871 and working/);
-  assert.match(n.innerHTML, /href="\/settings#software-update">Details</);
-  assert.doesNotMatch(n.innerHTML, />Upgrade</, 'no button to take the version that just failed');
-});
-
-await t('a hold on an OLDER version than the one now out leaves the ordinary banner', async () => {
-  const b = boot({ provisioning: false, held: { version: '1.19.900', still_on: '1.19.871', message: 'x' } });
-  await settle();
-  assert.ok(b.banner(), 'the newer release is announced as usual');
-});
-
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/deploy_handoff.mjs

@@ -0,0 +1,206 @@
+// tests/deploy_handoff.mjs — the hub's half of the in-place update (task 1005041).
+//
+// A hosted project's hall opens the hub's deploy door as a small window and tells it which
+// version to take (update-pill.js). The safety of that rests on three refusals, each pinned
+// here by EXECUTING the real deploy-handoff.js: a message from any window but the opener, or
+// from any origin but the project's registered address, is not heard; a version the hub's own
+// preview would not move to is shown to the owner, never sent; and with no word from the hall
+// the window waits for a press. It never moves anything on load by itself.
+import assert from 'node:assert/strict';
+import { test, afterEach } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const FILE = path.join(ROOT, 'modules/hall-ui/public/deploy-handoff.js');
+const SRC = fs.readFileSync(FILE, 'utf8');
+const H = require_(FILE);
+
+const PREVIEW = { instance_id: '14', slug: 'toast', reading: 'ok', behind: true, recommended_version: '1.21.30', viewer_may_move: true, open_intent: null };
+const OPENER = {};
+const GO = { tag: 'bongos-update', step: 'go', to: '1.21.30' };
+const base = { data: GO, source: OPENER, opener: OPENER, origin: 'https://toast.cloudbongos.com', allowed: 'https://toast.cloudbongos.com', preview: PREVIEW };
+
+// ── the rule ──────────────────────────────────────────────────────────────────
+
+test('the one message that may start the move', () => {
+  assert.equal(H.judgeGo(base), null);
+});
+
+test('a message from any window but the one that opened this is not heard', () => {
+  assert.equal(H.judgeGo({ ...base, source: {} }), 'not_opener');
+  assert.equal(H.judgeGo({ ...base, opener: null }), 'not_opener');
+});
+
+test('a message from any origin but the project\'s own address is not heard', () => {
+  assert.equal(H.judgeGo({ ...base, origin: 'https://evil.example' }), 'wrong_origin');
+  assert.equal(H.judgeGo({ ...base, origin: 'https://toast.cloudbongos.com.evil.example' }), 'wrong_origin');
+  assert.equal(H.judgeGo({ ...base, origin: 'http://toast.cloudbongos.com' }), 'wrong_origin', 'the scheme counts');
+  assert.equal(H.judgeGo({ ...base, allowed: null }), 'wrong_origin', 'a project with no address can be asked by nobody');
+});
+
+test('only the version the hub itself would move to is sent', () => {
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, to: '1.21.31' } }), 'wrong_version');
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, to: undefined } }), 'wrong_version');
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, to: '1.21.30 ' } }), 'wrong_version');
+});
+
+test('nothing to move, a viewer who may not, or a run already open: refused', () => {
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, behind: false } }), 'nothing_to_move');
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, reading: 'no_answer' } }), 'nothing_to_move');
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, viewer_may_move: false } }), 'not_allowed');
+  assert.equal(H.judgeGo({ ...base, preview: { ...PREVIEW, open_intent: { action: 'restart' } } }), 'busy');
+});
+
+test('another page\'s message is not this protocol', () => {
+  assert.equal(H.judgeGo({ ...base, data: { ...GO, tag: 'other' } }), 'not_go');
+  assert.equal(H.judgeGo({ ...base, data: 'go' }), 'not_go');
+});
+
+test('the allowed origin is the project\'s registered address, and nothing that is not a host', () => {
+  assert.equal(H.projectOrigin({ domain: 'Toast.CloudBongos.com' }, 'https:'), 'https://toast.cloudbongos.com');
+  assert.equal(H.projectOrigin({ domain: 'toast.cloudbongos.com' }, 'http:'), 'http://toast.cloudbongos.com', 'http only on a harness served over http');
+  for (const domain of [null, '', 'localhost', 'a b.com', 'evil.com/path', 'evil.com?x', 'https://evil.com', '-x.com']) {
+    assert.equal(H.projectOrigin({ domain }, 'https:'), null, JSON.stringify(domain));
+  }
+});
+
+test('the window is the handoff only when asked for it', () => {
+  assert.equal(H.wanted({ search: '?project=toast&handoff=1' }), true);
+  assert.equal(H.wanted({ search: '?handoff=1' }), true);
+  assert.equal(H.wanted({ search: '?project=toast' }), false);
+  assert.equal(H.wanted({ search: '?handoff=10' }), false);
+  assert.equal(H.wanted(null), false);
+});
+
+// ── the page, run for real ────────────────────────────────────────────────────
+
+const armed = new Set();
+afterEach(() => { for (const id of armed) clearTimeout(id); armed.clear(); });
+const settle = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+const plain = (x) => JSON.parse(JSON.stringify(x));
+
+function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }] } = {}) {
+  const told = [];
+  const requests = [];
+  const listeners = {};
+  let closed = false;
+  const main = { _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+  const bodyEl = { _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+  const buttons = {};
+  const documentObj = {
+    documentElement: { setAttribute() {} },
+    getElementById(id) {
+      if (id === 'hall-main') return main;
+      if (id === 'ho-body') return bodyEl;
+      if (!bodyEl._html.includes(`id="${id}"`)) return null;
+      return (buttons[id] ||= { _on: {}, addEventListener(ev, fn) { this._on[ev] = fn; } });
+    },
+  };
+  if (opener) opener.postMessage = (msg, origin) => told.push({ msg, origin });
+  const windowObj = {
+    OTB: realOTB(), document: documentObj, opener, __handoffHearMs: 30,
+    location: { protocol: 'https:', pathname: '/deploy', search: '?project=toast&handoff=1', assign() {} },
+    addEventListener: (ev, fn) => { (listeners[ev] ||= []).push(fn); },
+    setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); armed.add(id); return id; },
+    close() { closed = true; },
+  };
+  const api = {
+    request: (method, p, opts) => {
+      requests.push({ method, path: p, body: opts && opts.body });
+      if (p === '/api/bongos/provisioning/fleet') return Promise.resolve({ ok: true, status: 200, data: { instances: rows } });
+      if (method === 'GET' && /core-upgrade$/.test(p)) return Promise.resolve({ ok: true, status: 200, data: { ok: true, preview } });
+      if (method === 'POST') return Promise.resolve(post);
+      return Promise.resolve({ ok: false, status: 404, data: null });
+    },
+  };
+  const sandbox = { window: windowObj, console, Promise, JSON };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'deploy-handoff.js' });
+  windowObj.OTBDeployHandoff.run({ api });
+  return {
+    told, requests, body: bodyEl, buttons, closed: () => closed,
+    message: (data, { source = opener, origin = 'https://toast.cloudbongos.com' } = {}) => { for (const fn of listeners.message || []) fn({ data, source, origin }); },
+    posts: () => requests.filter((r) => r.method === 'POST'),
+  };
+}
+
+test('it says "ready" only to the project\'s own address, and moves nothing until it hears', async () => {
+  const b = boot();
+  await settle(5);
+  assert.deepEqual(plain(b.told), [{ msg: { tag: 'bongos-update', step: 'ready' }, origin: 'https://toast.cloudbongos.com' }]);
+  assert.equal(b.posts().length, 0, 'nothing moves on load');
+});
+
+test('the go from the project\'s own hall moves it to that version, says so, and closes', async () => {
+  const b = boot();
+  await settle(5);
+  b.message(GO);
+  await settle(5);
+  assert.equal(b.posts().length, 1);
+  assert.equal(b.posts()[0].path, '/api/bongos/provisioning/instances/14/core-upgrade');
+  assert.deepEqual(plain(b.posts()[0].body), { to: '1.21.30' });
+  assert.deepEqual(plain(b.told[1]), { msg: { tag: 'bongos-update', step: 'started', to: '1.21.30' }, origin: 'https://toast.cloudbongos.com' });
+  assert.match(b.body.innerHTML, /The update has started/);
+});
+
+test('a go from another site, or another window, moves nothing', async () => {
+  const b = boot();
+  await settle(5);
+  b.message(GO, { origin: 'https://evil.example' });
+  b.message(GO, { source: {} });
+  await settle(5);
+  assert.equal(b.posts().length, 0);
+});
+
+test('a go naming another version is shown to the owner, never sent', async () => {
+  const b = boot();
+  await settle(5);
+  b.message({ ...GO, to: '1.21.31' });
+  await settle(5);
+  assert.equal(b.posts().length, 0);
+  assert.match(b.body.innerHTML, /A different version is ready/);
+  assert.match(b.body.innerHTML, /Update to 1\.21\.30/, 'the press names the hub\'s own version');
+});
+
+test('no word from the hall: one press, naming the version, and only the press moves it', async () => {
+  const b = boot();
+  await settle(60);
+  assert.equal(b.posts().length, 0, 'waiting is not consent');
+  assert.match(b.body.innerHTML, /id="ho-go"/);
+  b.buttons['ho-go']._on.click();
+  await settle(5);
+  assert.deepEqual(plain(b.posts()[0].body), { to: '1.21.30' });
+});
+
+test('opened by hand, with no hall behind it: the press, never an automatic move', async () => {
+  const b = boot({ opener: null });
+  await settle(5);
+  assert.equal(b.posts().length, 0);
+  assert.match(b.body.innerHTML, /Update to 1\.21\.30/);
+});
+
+test('a refusal is said in the server\'s words, here and to the hall', async () => {
+  const b = boot({ post: { ok: false, status: 409, data: { error: { code: 'intent_conflict', message: 'A restart is running for this project.' } } } });
+  await settle(5);
+  b.message(GO);
+  await settle(5);
+  assert.match(b.body.innerHTML, /A restart is running for this project\./);
+  assert.deepEqual(plain(b.told[1]), { msg: { tag: 'bongos-update', step: 'refused', message: 'A restart is running for this project.' }, origin: 'https://toast.cloudbongos.com' });
+});
+
+test('a project already current, or one with no address, says so and moves nothing', async () => {
+  const cur = boot({ preview: { ...PREVIEW, behind: false } });
+  await settle(5);
+  assert.match(cur.body.innerHTML, /already runs the newest version/);
+  const none = boot({ rows: [{ id: '14', slug: 'toast', domain: null }] });
+  await settle(60);
+  assert.equal(none.told.length, 0, 'nobody to say "ready" to');
+  assert.match(none.body.innerHTML, /id="ho-go"/, 'the press is still there');
+});

package/tests/government_protected_surfaces.mjs

@@ -328,6 +328,21 @@ const ADDED_SINCE_R101 = [
     why: 'split out of the protected ship.js: the ship-mode step every ship runs '
        + 'before it lands, so an edit here could change how work reaches main.',
   },
+  // task 1004546: the Autobongos self-edit wall. The grade of task 1004540 refused a
+  // version whose guard lived in unprotected shared files, so it moved into these two
+  // small ones and they sit beside the rest of the publish pipeline.
+  {
+    after: 'modules/lifecycle/publish-reconciler.js',
+    glob: 'modules/lifecycle/runner-self.js',
+    why: 'the one list of files an unattended runner may never change, and the shape of '
+       + "a runner's claim; an edit here could let a runner loosen its own fence.",
+  },
+  {
+    after: 'modules/lifecycle/runner-self.js',
+    glob: 'modules/lifecycle/runner-self-guard.js',
+    why: "the server's refusal to publish a runner's change to its own supervisor, safety "
+       + 'checks or kill switch, read against the pull request\'s real files.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from

package/tests/hub_connections_page.mjs

@@ -77,7 +77,7 @@ test('the body: a door, a loading line, the inactive and unreadable lines, then
   assert.match(MAIN, /<h1>connections<\/h1>/);
   assert.match(MAIN, /it grants no rank and no access to anything/, 'a connection is never authority (ADR 0016, ADR 0202)');
   assert.match(MAIN, /<section class="aDoor" id="door" hidden aria-labelledby="door-h">[\s\S]*?href="\/api\/bongos\/auth\/web\/start\?return=\/connections&amp;repos=1"/, 'signed out, the door returns here');
-  assert.match(MAIN, /<p class="loading" id="loading">/);
+  assert.match(MAIN, /<p class="loading loading-mark loading-mark--page" id="loading" role="status">/); // the Bongos-mark loader (task 1005053)
   assert.match(MAIN, /<p class="mineEmpty" id="inactive" hidden>/);
   assert.match(MAIN, /<p class="projMsg err" id="readFailed" role="alert" hidden>/);
   assert.match(MAIN, /<p class="projMsg" id="connMsg" role="status" aria-live="polite" hidden><\/p>/);

package/tests/hub_invitations_page.mjs

@@ -56,7 +56,7 @@ test('the page wears the hub’s bar, with Invitations as the one current place;
 test('the body: a door, a loading line, the four lists in order under one heading, the empty line, and the join field', () => {
   assert.match(MAIN, /<h1>invitations<\/h1>/);
   assert.match(MAIN, /<section class="aDoor" id="door" hidden aria-labelledby="door-h">[\s\S]*?href="\/api\/bongos\/auth\/web\/start\?return=\/invitations&amp;repos=1"/, 'signed out, the door returns here');
-  assert.match(MAIN, /<p class="loading" id="loading">/);
+  assert.match(MAIN, /<p class="loading loading-mark loading-mark--page" id="loading" role="status">/); // the Bongos-mark loader (task 1005053)
   const section = (MAIN.match(/<section id="mineInvites" aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
   assert.ok(section, 'the invitations section ships as markup, never hidden on its own: it is the page');
   assert.match(section, /<p class="mineEmpty" id="invitesNone" hidden>[^<]+<\/p>/, 'one empty line, down until the reads have answered');

package/tests/loading_mark.mjs

@@ -0,0 +1,203 @@
+// tests/loading_mark.mjs — the Bongos-mark loader on the apex pages and the status page
+// (task 1005053, goal 1000095; the hall's own is task 1005043).
+//
+// Owner ask, 2026-11-03: a smooth load screen with the Bongos logo anywhere the
+// software waits for data, in the spirit of monday.com's Vibe data loaders. The
+// apex pages (cosmos.css) and the status page (its own sheet) each carry the same
+// CSS component, .loading-mark, in their own tokens; a page opts in by putting the
+// class on the placeholder it already had, whose words stay as the caption. These
+// cases read the real sheets and pages, per surface: the loader keeps DESIGN.md's
+// motion and colour rules, its rest frame is the logo, and no waiting placeholder
+// is left as a bare line of text.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const STATUS = path.join(ROOT, 'modules', 'status-ui', 'public');
+const read = (dir, f) => fs.readFileSync(path.join(dir, f), 'utf8').replace(/\r\n/g, '\n');
+
+const COSMOS = read(LANDING, 'assets/cosmos.css');
+const STATUS_CSS = read(STATUS, 'style.css');
+const APEX_PAGES = ['account', 'community', 'connections', 'guild', 'invitations', 'projects'];
+
+// The loader's section of a sheet: from its banner to the last of its keyframes.
+function section(css, banner) {
+  const start = css.indexOf(banner);
+  assert.ok(start > -1, `the loader's banner is in the sheet: ${banner}`);
+  const end = css.indexOf('@keyframes loading-mark-breathe', start);
+  assert.ok(end > start, 'the loader section ends on its breath');
+  return css.slice(start, css.indexOf('}', css.indexOf('}', end) + 1) + 1);
+}
+const SURFACES = {
+  apex: { css: COSMOS, loader: section(COSMOS, '/* ── the loader (task 1005053') },
+  status: { css: STATUS_CSS, loader: section(STATUS_CSS, '/* ---------- The loader (task 1005053') },
+};
+const flat = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\s+/g, ' ');
+const masksOf = (css) => [...css.matchAll(/url\("data:image\/svg\+xml,([^"]+)"\)/g)].map((m) => decodeURIComponent(m[1]));
+function keyframes(css, name) {
+  const m = css.match(new RegExp(`@keyframes ${name} ?\\{`));
+  assert.ok(m, `@keyframes ${name} exists`);
+  let depth = 1, i = m.index + m[0].length;
+  for (; i < css.length && depth; i++) depth += css[i] === '{' ? 1 : css[i] === '}' ? -1 : 0;
+  return css.slice(m.index + m[0].length, i - 1);
+}
+
+test('the apex loader is the bar\'s own Bongos mark, and the status loader is the same mark', () => {
+  // The apex bar draws the mark inline (account.html's .bongosMark); the loader's
+  // two masks carry exactly its arc, core and dot, so the loader IS the logo.
+  const bar = read(LANDING, 'account.html');
+  const arc = bar.match(/<path class="mr" d="([^"]+)"/)[1];
+  assert.match(bar, /<circle class="mp" cx="100" cy="100" r="55"/);
+  assert.match(bar, /<circle cx="156" cy="46" r="12" style="fill:var\(--accent\)"\/>/);
+  const [ring, dot] = masksOf(SURFACES.apex.loader);
+  assert.ok(ring.includes(`d='${arc}'`), 'the ring is the bar mark\'s arc');
+  assert.ok(ring.includes("<circle cx='100' cy='100' r='55'/>"), 'the core is the bar mark\'s core');
+  assert.ok(dot.includes("<circle cx='156' cy='46' r='12'/>"), 'the dot is the bar mark\'s dot');
+  // The status page has no Bongos mark of its own: its loader carries the apex's two
+  // masks byte for byte, so the two surfaces cannot drift into two logos.
+  assert.deepEqual(masksOf(SURFACES.status.loader), masksOf(SURFACES.apex.loader));
+});
+
+for (const [name, { css, loader }] of Object.entries(SURFACES)) {
+  test(`${name}: it moves in CSS only, on transform and filter only, and rests on the logo`, () => {
+    for (const frame of ['loading-mark-arrive', 'loading-mark-turn', 'loading-mark-breathe']) {
+      const body = keyframes(css, frame);
+      const props = [...body.matchAll(/([a-z-]+)\s*:/g)].map((m) => m[1]);
+      assert.ok(props.length, `${frame} animates something`);
+      for (const p of props) assert.ok(['transform', 'filter'].includes(p), `${frame} animates ${p}, not transform or filter`);
+    }
+    // The turn has no `from`, so 0deg (the logo's own pose, the dot top right) is where
+    // it starts and where the Kill Switch leaves it; the arrival and the breath have no
+    // `to`, so their resting value is the element as styled, fully shown.
+    assert.match(keyframes(css, 'loading-mark-turn'), /^\s*to ?\{ ?transform: ?rotate\(1turn\); ?\}\s*$/);
+    assert.match(keyframes(css, 'loading-mark-arrive'), /^\s*from ?\{/);
+    assert.match(keyframes(css, 'loading-mark-breathe'), /^\s*from ?\{/);
+    // It arrives 240ms late, so a read that answers faster never shows it.
+    assert.match(flat(loader), /\.loading-mark ?\{[^}]*animation: ?loading-mark-arrive 500ms cubic-bezier\(\.16, ?1, ?\.3, ?1\) 240ms both;/);
+    // The Kill Switch stops every animation, the pseudo-elements included.
+    assert.match(flat(css), /@media \(prefers-reduced-motion: ?reduce\) ?\{ ?\*, ?\*::before, ?\*::after ?\{ ?animation: ?none !important; ?transition: ?none !important; ?\} ?\}/);
+  });
+
+  test(`${name}: every colour is a token; the black in the masks is alpha, not paint`, () => {
+    const css = flat(loader);
+    assert.doesNotMatch(css, /#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(/, 'no colour literal');
+    const paints = [...css.matchAll(/(?:background|color): ?([^;]+);/g)].map((m) => m[1].trim());
+    assert.equal(paints.length, 3, 'the ink, the dot and the caption are painted');
+    for (const p of paints) assert.match(p, /^(var\(--[a-z-]+\)|color-mix\(in srgb, ?var\(--ink\) 30%, ?var\(--bg-card\)\))$/, `${p} is a token or a mix of one`);
+    // The one accent is the dot: the live thing on a waiting page (the One Warm Thing Rule).
+    assert.equal((css.match(/var\(--accent\)/g) || []).length, 1, 'the accent paints the dot alone');
+    const masks = masksOf(loader);
+    assert.equal(masks.length, 2, 'two masks: the ring and core, and the dot');
+    for (const m of masks) assert.doesNotMatch(m.replace(/stroke='black'|fill='none'/g, ''), /fill='|stroke='|#/, 'a mask carries no colour of its own');
+  });
+
+  test(`${name}: the dot shares the ring's grid cell, so no page padding can knock it off`, () => {
+    const css = flat(loader);
+    assert.match(css, /\.loading-mark ?\{[^}]*display: ?grid;/);
+    assert.match(css, /\.loading-mark::before, ?\.loading-mark::after ?\{[^}]*grid-area: ?1 ?\/ ?1;/);
+    assert.doesNotMatch(css, /position: ?absolute|top: ?|left: ?/, 'nothing is positioned by hand');
+  });
+}
+
+test('apex: three sizes, and a hidden placeholder stays hidden', () => {
+  const css = flat(SURFACES.apex.loader);
+  assert.match(css, /\.loading-mark--page ?\{[^}]*--lm-size: ?64px;/);
+  assert.match(css, /\.loading-mark--inline ?\{[^}]*--lm-size: ?16px;[^}]*grid-template-columns: ?var\(--lm-size\) minmax\(0, ?1fr\);/);
+  // The loader is display: grid, which outranks the browser's own [hidden]; the
+  // apex pages put a placeholder away with .hidden, so cosmos's rule must win.
+  assert.match(COSMOS, /\[hidden\]\{display:none !important;\}/);
+});
+
+test('apex: every waiting placeholder wears the loader, in the markup and as the scripts write it', () => {
+  // A status line rewritten IN PLACE (its words become the answer) keeps its plain
+  // words: the loader belongs to a placeholder that is hidden or replaced when the
+  // data lands. Each one is named here with why.
+  const IN_PLACE = new Set([
+    "community.html:say('Searching…')",                                   // the search's status line, rewritten with the count
+    "projects.html:hint('h-renderKey', 'Checking with Render…')",         // the Render key's hint, rewritten with the answer
+    "projects.html:say('Reading your organisations from GitHub…')",       // the org picker's status line
+    "projects.html:say('Checking with GitHub…')",                         // the same line
+    "projects.html:inviteSay(id, 'Finding your project’s invite page…'", // the invite box's message, after a press
+    "projects.html:inviteSay(id, 'Finding the guild’s members…'",        // the same, for a guild
+  ]);
+  const WAIT_WORD = '(?:Loading|Reading|Opening|Checking|Finding|Searching|Looking|Fetching)';
+  const ELEMENT = new RegExp(`<(p|div|li|span|td)\\b([^>]*)>\\s*${WAIT_WORD}\\b[^<]*…\\s*<\\/\\1>`, 'g');
+  const LITERAL = new RegExp(`[a-zA-Z]+\\((?:id, )?'${WAIT_WORD}[^']*…'`, 'g');
+  const misses = [];
+  for (const page of APEX_PAGES) {
+    const html = read(LANDING, `${page}.html`);
+    for (const m of html.matchAll(ELEMENT)) {
+      if (!/\bloading-mark\b/.test(m[2])) misses.push(`${page}.html: ${m[0].slice(0, 100)}`);
+    }
+    for (const line of html.split('\n')) {
+      for (const m of line.matchAll(LITERAL)) {
+        if (/loading-mark/.test(line) || /pickNote\('[^']*', true\)/.test(line)) continue;
+        const key = `${page}.html:${m[0]}`;
+        if (!IN_PLACE.has(key) && !IN_PLACE.has(`${key})`)) misses.push(key);
+      }
+    }
+  }
+  assert.deepEqual(misses, [], 'every waiting placeholder wears the loader');
+});
+
+test('apex: each page waits with the size that fits it', () => {
+  const html = Object.fromEntries(APEX_PAGES.map((p) => [p, read(LANDING, `${p}.html`)]));
+  // a page with nothing else to show yet: the page size
+  for (const [page, words] of [['account', 'Reading your account…'], ['connections', 'Reading your connections…'], ['guild', 'Reading this guild…'], ['invitations', 'Reading your invitations…']]) {
+    assert.ok(html[page].includes(`<p class="loading loading-mark loading-mark--page" id="loading" role="status">${words}</p>`), `${page} waits on the page loader`);
+  }
+  assert.ok(html.projects.includes('<div class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your projects…</div>'));
+  assert.ok(html.projects.includes('<div class="loading loading-mark loading-mark--page" id="mLoading" role="status">Reading the project…</div>'));
+  // a section of a page: the default
+  for (const id of ['homeLoading', 'boardLoading', 'weekLoading', 'recruitLoading']) {
+    assert.match(html.community, new RegExp(`<p class="commMsg loading-mark" id="${id}" role="status">`), `community's ${id}`);
+  }
+  // a line in a band or a list: inline. The manage page's thirteen sections each wait on
+  // their own read, so a mark the height of the line keeps the page from jumping.
+  assert.equal((html.projects.match(/><p class="finePrint loading-mark loading-mark--inline" role="status">(?:Reading the project…|Reading the project’s settings…|Checking the repository on GitHub…)<\/p><\/div>/g) || []).length, 14);
+  assert.ok(html.account.includes('<p class="aWhat loading-mark loading-mark--inline" id="waysLoading" role="status">'));
+  assert.ok(html.account.includes('<p class="aWhat loading-mark loading-mark--inline" id="buildingLoading" role="status">'));
+  assert.ok(html.projects.includes('<div id="ghBusy" class="hint loading-mark loading-mark--inline" role="status" hidden>'));
+  // the scripts write them back the same way, and the picker's first open wears it too
+  for (const call of ['repoVisMsg(', 'visMsg(', 'joinMsg(', 'doorMsg(', 'envMsg(']) {
+    assert.ok(html.projects.includes(`${call}'<p class="finePrint loading-mark loading-mark--inline" role="status">`), `${call} writes the loader`);
+  }
+  for (const call of ['visRuns(', 'joinRuns(']) {
+    assert.ok(html.projects.includes(`${call}'<span class="loading-mark loading-mark--inline" role="status">Checking what the project is running…</span>');`), `${call} writes the loader`);
+  }
+  assert.match(html.projects, /wait\.className = 'finePrint loading-mark loading-mark--inline'; wait\.setAttribute\('role', 'status'\);/);
+  assert.match(html.invitations, /li\.className = 'joinList__note' \+ \(waiting \? ' loading-mark loading-mark--inline' : ''\);/);
+});
+
+test('status: its two waiting tablets wear the loader, and a failed or empty read stops it', () => {
+  const html = read(STATUS, 'index.html');
+  assert.ok(html.includes('<div id="versions" class="versions">\n      <p class="empty loading-mark" role="status">The masons are at their tools…</p>'));
+  assert.ok(html.includes('<div id="world-snapshot" class="world-snapshot">\n      <p class="empty loading-mark" role="status">The cartographers are still at their survey…</p>'));
+  // the header's "Tablet being consulted…" is rewritten in place before any read
+  // starts (stampRefreshTime), so it is never a wait and keeps its plain words
+  assert.match(html, /<span class="herm__updated" id="last-updated">Tablet being consulted…<\/span>/);
+  // The Kill Switch is the last thing in the status sheet, so nothing can outrank it.
+  assert.match(STATUS_CSS.trimEnd(), /@media \(prefers-reduced-motion: reduce\) \{\n {2}\*, \*::before, \*::after \{ animation: none !important; transition: none !important; \}\n\}$/);
+
+  const js = read(STATUS, 'status.js');
+  // the three ways a tablet can end its wait without data each stop the loader
+  assert.match(js, /\} catch \(_\) \{\n {4}stopWaiting\(els\.worldSnapshot\);\n {4}return;\n {2}\}/);
+  assert.match(js, /if \(snapshots\.length === 0\) \{ stopWaiting\(els\.worldSnapshot\); return; \}/);
+  assert.match(js, /loadVersions\(\)\.catch\(\(e\) => \{ stopWaiting\(els\.versions\); console\.error\('versions', e\); \}\)/);
+  // ...and stopWaiting itself, run: it takes the class off and leaves the words alone.
+  const src = js.match(/function stopWaiting\(el\) \{[\s\S]*?\n\}/)[0];
+  const removed = [];
+  const wait = { textContent: 'The masons are at their tools…', classList: { remove: (c) => removed.push(c) } };
+  const host = { querySelectorAll: (sel) => (sel === '.loading-mark' ? [wait] : []) };
+  const ctx = vm.createContext({});
+  vm.runInContext(`${src}; this.stopWaiting = stopWaiting;`, ctx);
+  ctx.stopWaiting(host);
+  ctx.stopWaiting(null);
+  assert.deepEqual(removed, ['loading-mark']);
+  assert.equal(wait.textContent, 'The masons are at their tools…');
+});

package/tests/nav_permission_atoms.mjs

@@ -93,8 +93,9 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // says a held core version was tried and rolled back; task 1004731: the one-time
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852); task 1004938: the
-// Market Watch settings nav item and its fuel glyph.
-const SHELL_SHA = '1a23b1cf13567eff';
+// Market Watch settings nav item and its fuel glyph; task 1005041: the Update pill replaced the
+// core-update banner.
+const SHELL_SHA = '9e32caf8aa17dd36';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/software_update.mjs

@@ -345,11 +345,15 @@ test('read only when its group opens — most visits to Settings are for somethi
 
 const answerWith = (over) => ok({ ...FIXTURE, ...over, update: { ...FIXTURE.update, ...(over.update || {}) } });
 
+// task 1005041: the button runs the Update pill's in-place flow, so it no longer reads as a
+// trip off-site; its href stays the hub's door only for a page whose pill script did not load,
+// and the hint names the hub whose small window opens for a moment.
 test('a hosted project\'s button names the hub it opens; a self-hosted one names the command', async () => {
   const hub = bootPanel(() => answerWith({ door: { kind: 'hub', url: 'https://cloudbongos.com/deploy?project=mercury' } }));
   await hub.settle();
-  assert.match(hub.body(), /href="https:\/\/cloudbongos\.com\/deploy\?project=mercury">Update to [\d.]+ ↗</);
-  assert.match(hub.body(), /on cloudbongos\.com:/);
+  assert.match(hub.body(), /href="https:\/\/cloudbongos\.com\/deploy\?project=mercury">Update to [\d.]+</);
+  assert.doesNotMatch(hub.body(), /↗/, 'it updates in place; it is not a link off-site any more');
+  assert.match(hub.body(), /A small window from cloudbongos\.com opens for a moment/);
 
   const cli = bootPanel(() => answerWith({ door: { kind: 'cli', url: null } }));
   await cli.settle();