@bongos/core 1.24.26 → 1.24.27

package/modules/lifecycle/github-push.js

@@ -1347,6 +1347,7 @@ async function getPullRequestFiles({ number }, deps = {}) {
     for (const f of batch) {
       files.push({
         path: f.filename,
+        previous_path: f.previous_filename || null, // a rename's old path (task 1004546)
         mode: '100644',
         deleted: f.status === 'removed',
         status: f.status,

package/modules/lifecycle/routes/tasks.js

@@ -37,7 +37,7 @@ const { gradeQualityWhere } = require('../db-shared');
 const { helperJoinSql } = require('../page-tweak-artist'); // task 1004432: a page tweak's applier as a helper
 const auth = api;
 const db = require('../db');
-const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); const autoPickupFiles = require('../autopickup-files'); const githubPrClose = require('../github-pr-close'); // ADR 0341 D7 (tests stub the read); ADR 0371 D8
+const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); const autoPickupFiles = require('../autopickup-files'); const githubPrClose = require('../github-pr-close'); const runnerSelfGuard = require('../runner-self-guard'); const { sharedPrReads } = require('../ship-files'); // ADR 0341 D7 (tests stub the read); ADR 0371 D8; task 1004546
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
@@ -1184,7 +1184,7 @@ module.exports = function buildTasksRouter() {
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         prMergeSentence(held);
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
-      const apRefusal = await autoPickupFiles.autoPickupFileRefusal({ taskId: id, prNumber: pr.number }); if (apRefusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(apRefusal.code, 409, { ...apRefusal, message: autoPickupFiles.refusalMessage(apRefusal) }); } // ADR 0371 D8 (task 1004678)
+      const prReads = sharedPrReads(); for (const [guard, refusalFor] of [[autoPickupFiles, autoPickupFiles.autoPickupFileRefusal], [runnerSelfGuard, runnerSelfGuard.runnerSelfEditRefusal]]) { const refusal = await refusalFor({ taskId: id, prNumber: pr.number, branch }, { getPullRequestFiles: prReads.getPullRequestFiles }); if (refusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(refusal.code, 409, { ...refusal, message: guard.refusalMessage(refusal) }); } } // the PR's own files: an auto-pickup round stays on its page (ADR 0371 D8, task 1004678); a runner never changes its own files (task 1004546)
       // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
       // edit that forgets — an assignment must not be able to fail a pushed ship.
       const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })

package/modules/lifecycle/runner-self-guard.js

@@ -0,0 +1,122 @@
+'use strict';
+
+// modules/lifecycle/runner-self-guard.js — the server refuses to publish a
+// runner's change to its own supervisor, safety checks or kill switch, or to any
+// ADR 0043 protected file (task 1004546, ADR 0307 §6).
+//
+// WHY. The runner's own checks (the pre-claim fence and the ship-time diff check)
+// run on the runner's machine, where the worker runs with blanket permissions and
+// could edit or skip them. This one runs on the deployed server, against the pull
+// request's files as GitHub reports them, so nothing on that machine can change it.
+// A runner host holds no push credential (ADR 0055), so publish-branch is its only
+// road to main, and that route asks this file once per publish, beside the
+// auto-pickup files check and in the same shape (autopickup-files.js).
+//
+// TWO LISTS, OVER THE REAL DIFF. The runner's own files (runner-self.js, matched by
+// that file's matcher, required directly) and the ADR 0043 registry (the fence
+// already refuses a DECLARED protected touch; this refuses one the work actually
+// made). The registry is what holds the route line calling this file: tasks.js is
+// on it, so a runner cannot publish its removal.
+//
+// THE REGISTRY MATCHER COMES THROUGH THE DOORWAY. A module reaches core only
+// through src/module-api.js, and task 1004540's grade found that a matcher
+// resolved there could be swapped by a change to that file. So the doorway is on
+// the runner's own list (owner ruling 2026-11-03), and a runner cannot publish a
+// change to it. The matcher is also checked before it is trusted: it must flag two
+// paths the registry has always protected, and one that does not is treated as
+// unreadable, which refuses.
+//
+// WHICH CLAIM IS A RUNNER'S. Its worktree name (runner-self.js RUNNER_TREE_RE),
+// read from the claim row. If that read FAILS, the branch name stands in (the
+// runner's branch is its worktree name), so a database hiccup does not switch the
+// wall off for a runner while an ordinary publish still never depends on the read.
+// Telling a runner's session from its owner's on the server is task 1004547.
+//
+// FAILS CLOSED on the files: a read that throws, a list at GitHub's 300-file cap,
+// or a matcher that fails its check all refuse. An unattended change that cannot
+// be checked goes to a person.
+//
+// Its own small file, on the protected list and on the runner's own list, because
+// the grade of task 1004540 refused the same check written into the shared route
+// helpers and claim reads, which neither list covers.
+
+const api = require('../../src/module-api');
+const githubPush = require('./github-push');
+const { PR_FILES_CAP } = require('./ship-files');
+const runnerSelf = require('./runner-self');
+
+// The task's latest claim, released or not: a publish runs after the ship has
+// resolved it. Both names are read because the server may store a disambiguated
+// worktree_name beside the one the runner asked for.
+const CLAIM_SQL = `
+  SELECT c.worktree_name, c.requested_worktree_name
+    FROM claims c WHERE c.task_id = $1
+   ORDER BY c.claimed_at DESC, c.id DESC LIMIT 1`;
+
+// What a failed claim read answers: not "no claim", which an ordinary publish
+// with no claim row also answers.
+const CLAIM_UNREADABLE = Object.freeze({ unreadable: true });
+
+async function readLatestClaim(taskId, exec = api.pool) {
+  try {
+    const { rows } = await exec.query(CLAIM_SQL, [taskId]);
+    return rows[0] || null;
+  } catch (_) {
+    return CLAIM_UNREADABLE;
+  }
+}
+
+function isRunnerPublish(claim, branch) {
+  if (claim === CLAIM_UNREADABLE) return runnerSelf.isRunnerTree(branch);
+  return !!claim && (runnerSelf.isRunnerTree(claim.worktree_name) || runnerSelf.isRunnerTree(claim.requested_worktree_name));
+}
+
+// Paths the registry has protected since ADR 0043; a matcher that misses either
+// is not the registry's.
+const MATCHER_CANARIES = Object.freeze(['modules/lifecycle/routes/tasks.js', 'migrations/001_canary.sql']);
+function verifiedMatcher(match) {
+  try {
+    if (MATCHER_CANARIES.every((f) => (match([f]) || []).length === 1)) return match;
+  } catch (_) { /* a matcher that throws is not trusted */ }
+  return null;
+}
+
+const unreadable = () => ({ code: 'self_modification_unreadable', files: [], protected: [] });
+
+// The route's one call. Returns null (publish as usual) or the refusal
+// { code, files, protected }. `deps` is the test seam, and the route passes a
+// shared getPullRequestFiles so this and the auto-pickup check read GitHub once.
+async function runnerSelfEditRefusal({ taskId, prNumber, branch = null }, deps = {}) {
+  const claim = await (deps.readLatestClaim || readLatestClaim)(taskId);
+  if (!isRunnerPublish(claim, branch)) return null;
+  const match = verifiedMatcher(deps.matchProtected || ((files) => api.permissionPathCheck.matchProtected(files)));
+  if (!match) return unreadable();
+  let rows;
+  try {
+    rows = await (deps.getPullRequestFiles || ((a) => githubPush.getPullRequestFiles(a)))({ number: Number(prNumber) });
+  } catch (_) {
+    return unreadable();
+  }
+  const list = Array.isArray(rows) ? rows : [];
+  if (list.length >= PR_FILES_CAP) return unreadable();
+  // A rename is checked at both ends: moving a guard away is an edit to it.
+  const changed = [];
+  for (const f of list) {
+    if (f && typeof f.path === 'string' && f.path) changed.push(f.path);
+    if (f && typeof f.previous_path === 'string' && f.previous_path) changed.push(f.previous_path);
+  }
+  return runnerSelf.diffRefusal({ files: changed, protectedHits: match(changed) });
+}
+
+function refusalMessage(r) {
+  const why = r.code === 'self_modification_unreadable'
+    ? "An Autobongos runner's pull request could not be checked in full for changes to the runner's own or protected files. This task goes to a person."
+    : runnerSelf.selfEditMessage(r);
+  return `${why} The pull request was closed (task 1004546).`;
+}
+
+module.exports = {
+  readLatestClaim,
+  runnerSelfEditRefusal,
+  refusalMessage,
+};

package/modules/lifecycle/runner-self.js

@@ -0,0 +1,154 @@
+'use strict';
+
+// modules/lifecycle/runner-self.js — the files an Autobongos runner must never
+// change: its own supervisor, its safety checks and its kill switch (task 1004546,
+// carrying task 1004540's work; ADR 0307 §6).
+//
+// WHY. Owner rule, 2026-10-02: the runner never edits its own supervisor, safety
+// checks or kill switch. The fence only refused tasks that hit the ADR 0043
+// registry, and none of the runner's own files were on it, so an unattended worker
+// could be handed a bug whose fix loosened the fence, the gauge, the grade cap or
+// the kill switch. This is the ONE list of those files and the ONE spelling of what
+// a runner's claim looks like. Three places ask it:
+//
+//   - the runner, BEFORE the claim, over the task's declared touches[]
+//     (scripts/bongos/autobongos-run.js pickTask, then modules/autonomy/fence.js
+//     decideTask as the gate of record);
+//   - ship.js, inside the worker, over the branch's real diff, so a worker is
+//     stopped before it spends a grade (selfEditRefusal);
+//   - the server, at publish, over the pull request's own files as GitHub reports
+//     them (runner-self-guard.js). This is the wall: the worker can unset its own
+//     environment, it cannot change what the deployed server checks.
+//
+// The last two also refuse an ADR 0043 protected file in the real diff (see
+// diffRefusal), which is what keeps a runner from deleting the server guard's call.
+//
+// A RUNNER-ONLY LIST, NOT THE ADR 0043 REGISTRY. A person may still edit these
+// files at their own rank; only an unattended worker may not. Widening the registry
+// would have raised the floor for every human builder to stop one machine.
+//
+// THE LIST COVERS ITS OWN ENFORCEMENT. Every file that implements a check above is
+// on it: this file, the server guard, the fence, the supervisor, the ship pipeline
+// that runs the ship check, the tests that pin them. The route line that calls the
+// server guard sits in modules/lifecycle/routes/tasks.js, which is deliberately NOT
+// listed (the owner ruled that listing tasks.js whole would refuse a large share of
+// ordinary work). It is on the ADR 0043 registry, which the real-diff checks also
+// read, and tests/autobongos_self_modification.mjs drives the real publish route,
+// so removing that line is refused for a runner and turns CI red for anyone.
+//
+// Requires nothing, so the runner, ship.js and the server all read the same list
+// without the module doorway in between (the grade of task 1004540 found that a
+// matcher resolved through src/module-api.js could be swapped there). The doorway
+// itself is on the list too, for what the server guard still reads through it.
+
+// One pattern per line: an exact path, a directory ending in '/', or a prefix
+// ending in '*' that stays inside one directory.
+const RUNNER_SELF_SURFACES = Object.freeze([
+  // The supervisor and its CLIs (scripts/gds/ holds their forwarders).
+  { pattern: 'scripts/bongos/autobongos-*', why: 'the supervisor, its loop, verify, grade cap, tweak lane and Windows service' },
+  { pattern: 'scripts/gds/autobongos-*', why: 'forwarders to the supervisor' },
+  { pattern: 'scripts/bongos/autonomy-*', why: 'the usage gauge and the autonomy gate' },
+  { pattern: 'scripts/gds/autonomy-*', why: 'forwarders to the gauge and the gate' },
+  { pattern: 'scripts/bongos/sequence.js', why: 'the picker and its halt matrix' },
+  // Its safety checks and kill switch.
+  { pattern: 'modules/autonomy/', why: 'the fence, gauge, cadence, heartbeat and the kill-switch routes' },
+  { pattern: 'modules/lifecycle/runner-self.js', why: 'this list' },
+  { pattern: 'modules/lifecycle/runner-self-guard.js', why: 'the server refusal at publish' },
+  { pattern: 'modules/lifecycle/autopickup.js', why: "the server's auto-pickup limits" },
+  { pattern: 'modules/lifecycle/autopickup-files.js', why: 'the auto-pickup page-files wall' },
+  { pattern: 'modules/government/catalog.js', why: 'the kill switch is a system permission declared here' },
+  { pattern: 'modules/government/protected-surfaces.json', why: 'the ADR 0043 registry the fence also reads' },
+  { pattern: 'src/bongos/permission-path-check.js', why: "the registry's matcher" },
+  // Owner ruling 2026-11-03, reversing the earlier "not the doorway": the server
+  // guard reaches the registry matcher and the claims pool through it, so a runner
+  // that could rewrite it could swap both. About 43 tasks in 90 days touched it.
+  { pattern: 'src/module-api.js', why: 'the module doorway the server guard reaches the registry matcher and the pool through' },
+  // The only review between a worker and main, and the road to it.
+  { pattern: 'modules/grading/', why: 'the grader' },
+  { pattern: 'scripts/bongos/ship.js', why: 'the ship driver' },
+  { pattern: 'scripts/bongos/ship-*', why: 'the ship phases, including the ship-time self-edit check' },
+  { pattern: 'modules/lifecycle/github-push.js', why: 'the server-mediated publish and its pull-request files read' },
+  { pattern: 'modules/lifecycle/ship-files.js', why: 'the files-read cap the server guard fails closed on' },
+  // The tests that pin all of the above.
+  { pattern: 'tests/autobongos_*', why: 'the tests that pin the runner' },
+  { pattern: 'tests/autonomy_*', why: 'the tests that pin the autonomy module' },
+]);
+
+// A repo path as git spells it. Windows separators and a leading './' are folded,
+// and case is ignored, so a declared touch cannot slip past on its spelling.
+function normalisePath(p) {
+  return String(p || '').trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '').toLowerCase();
+}
+
+function matches(file, pattern) {
+  const pat = pattern.toLowerCase();
+  if (pat.endsWith('/')) return file.startsWith(pat);
+  if (pat.endsWith('*')) {
+    const prefix = pat.slice(0, -1);
+    return file.startsWith(prefix) && !file.slice(prefix.length).includes('/');
+  }
+  return file === pat;
+}
+
+// The runner's own files among `files`: [{ file, pattern }], in input order.
+function matchRunnerSelf(files) {
+  const out = [];
+  for (const raw of Array.isArray(files) ? files : []) {
+    const file = normalisePath(raw);
+    if (!file) continue;
+    const hit = RUNNER_SELF_SURFACES.find((s) => matches(file, s.pattern));
+    if (hit) out.push({ file: String(raw), pattern: hit.pattern });
+  }
+  return out;
+}
+
+// What a runner's claim looks like: the worktree name autobongos-run.js's
+// worktreeName() generates. The supervisor, its boot reconciliation and the server
+// guard all read this one regex.
+const RUNNER_TREE_RE = /^autobongos-\d+-[0-9a-f]{6}$/;
+const isRunnerTree = (name) => RUNNER_TREE_RE.test(String(name || ''));
+
+// Set by the supervisor on every worker it spawns, so ship.js knows it is running
+// unattended. A worker can unset it; the server guard does not read it.
+const RUNNER_WORKER_ENV = 'AUTOBONGOS_WORKER';
+
+// The verdict over a runner's REAL diff, shared by ship.js and the server: null, or
+// { code, files, protected }. `files` are the runner's own; `protected` are ADR
+// 0043 registry hits, which ADR 0307 §6 says never reach an unattended worker. The
+// pre-claim fence reads those from the declared touches; this reads them from what
+// the work actually changed. That is also what holds the one line in
+// modules/lifecycle/routes/tasks.js that calls the server guard: that file is on
+// the registry, so a runner cannot publish a change to it.
+function diffRefusal({ files, protectedHits = [] } = {}) {
+  const own = [...new Set(matchRunnerSelf(files).map((h) => h.file))];
+  const prot = [...new Set((protectedHits || []).map((h) => (h && h.file) || h).filter((f) => typeof f === 'string' && f))];
+  if (!own.length && !prot.length) return null;
+  return { code: own.length ? 'self_modification' : 'runner_protected_path', files: own, protected: prot };
+}
+
+// The ship-time check: null outside a runner's worker, else diffRefusal.
+// `matchProtected` is the ADR 0043 matcher, passed in because this file requires
+// nothing; it is only called inside a worker.
+function selfEditRefusal({ files, env = process.env, matchProtected = null } = {}) {
+  if (!env || env[RUNNER_WORKER_ENV] !== '1') return null;
+  return diffRefusal({ files, protectedHits: matchProtected ? matchProtected(files) : [] });
+}
+
+function selfEditMessage(refusal) {
+  const r = refusal || {};
+  const parts = [];
+  if (r.files && r.files.length) parts.push(`its own supervisor, safety checks or kill switch (${r.files.slice(0, 10).join(', ')})`);
+  if (r.protected && r.protected.length) parts.push(`a protected permission, migration, infrastructure or pipeline file (${r.protected.slice(0, 10).join(', ')})`);
+  return `An Autobongos runner may not change ${parts.join(', or ') || 'these files'}. This task goes to a person.`;
+}
+
+module.exports = {
+  RUNNER_SELF_SURFACES,
+  matchRunnerSelf,
+  RUNNER_TREE_RE,
+  isRunnerTree,
+  RUNNER_WORKER_ENV,
+  diffRefusal,
+  selfEditRefusal,
+  selfEditMessage,
+};

package/modules/public-landing/public/account.html

@@ -164,7 +164,7 @@
     </a>
   </section>
 
-  <p class="loading" id="loading">Reading your account…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your account…</p>
   <div class="alert" id="pageAlert" role="alert"></div>
 
   <!-- signed in: ships hidden, revealed once GET /me/cross-project answers -->
@@ -223,7 +223,7 @@
       <h2 id="aWaysIn-h">ways to sign in</h2>
       <p class="aSide">GitHub, Google or both. Each one opens this same account, with the same credits, ranks and history.</p>
       <div class="aBody">
-        <p class="aWhat" id="waysLoading">Reading your ways to sign in…</p>
+        <p class="aWhat loading-mark loading-mark--inline" id="waysLoading" role="status">Reading your ways to sign in…</p>
         <ul class="mineRows" id="waysList"></ul>
         <p class="finePrint">Linking never joins two accounts. If the other one already has its own account here, we say so and change nothing.</p>
         <p class="projMsg" id="waysMsg" role="status" aria-live="polite"></p>
@@ -296,7 +296,7 @@
       <h2 id="aBuilding-h">projects you build on</h2>
       <p class="aSide">The projects you have joined as a builder. Only you see this list.</p>
       <div class="aBody">
-        <p class="aWhat" id="buildingLoading">Reading the projects you build on…</p>
+        <p class="aWhat loading-mark loading-mark--inline" id="buildingLoading" role="status">Reading the projects you build on…</p>
         <p class="aWhat" id="buildingEmpty" hidden>You’re not building on any other projects yet.</p>
         <ul class="mineRows" id="buildingList"></ul>
         <p class="projMsg" id="buildingMsg" role="status" aria-live="polite"></p>

package/modules/public-landing/public/assets/cosmos.css

@@ -545,6 +545,51 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .alert summary{cursor:pointer;font-size:12.5px;font-weight:700;}
 .alert details p{margin-top:6px;font-family:var(--font-mono);font-size:12px;font-weight:500;overflow-wrap:anywhere;}
 .loading{font-size:14.5px;font-weight:600;color:var(--ink-faint);padding:14px 0;}
+/* ── the loader (task 1005053; the hall's, task 1005043) ──────────────────────
+   The Bongos mark wherever an apex page waits for its data: the bar's own mark
+   (the ring, the core and the accent dot) as two masks on the placeholder the
+   page already had, whose words stay as its caption. The ring and the dot turn
+   together round the still core, easing out of and back into the logo's pose
+   each beat, and the ink breathes, after the Vibe skeleton the owner pointed at
+   (vibe.monday.com: 0.4 to 1 and back, 0.8s). Three sizes: the default for a
+   section, --page for a page with nothing else to show yet, --inline for a line
+   in a band or a list.
+
+   DESIGN.md holds it: CSS only, transform and filter only (the breath and the
+   arrival are filter: opacity(), not opacity), every colour a var() or a mix of
+   one; the black in the masks is alpha, not paint. The 20s floor is for the
+   ambient plates: a loader is the live thing on the page, so it keeps a loader's
+   tempo and its dot spends the accent. It arrives after 240ms, so a read that
+   answers faster never shows it; under the Kill Switch it is the still logo.
+   It is a grid, not a positioned dot: the ring and the dot share one cell, so
+   the dot stays on the ring whatever padding a page gives its placeholder. */
+.loading-mark{
+  --lm-size:40px;
+  display:grid;justify-items:center;align-items:center;gap:12px;
+  padding:28px 0;text-align:center;color:var(--ink-faint);
+  animation:loading-mark-arrive 500ms cubic-bezier(.16,1,.3,1) 240ms both;
+}
+.loading-mark::before,.loading-mark::after{
+  content:"";grid-area:1/1;width:var(--lm-size);height:var(--lm-size);
+  -webkit-mask:var(--lm-shape) center/contain no-repeat;mask:var(--lm-shape) center/contain no-repeat;
+  animation:loading-mark-turn 1.6s cubic-bezier(.45,.05,.55,.95) infinite;
+}
+/* the ring and the core: one ink, breathing */
+.loading-mark::before{
+  --lm-shape:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'%3E%3Cpath d='M137 31 A78 78 0 1 0 170 66' fill='none' stroke='black' stroke-width='15' stroke-linecap='round'/%3E%3Ccircle cx='100' cy='100' r='55'/%3E%3C/svg%3E");
+  background:color-mix(in srgb,var(--ink) 30%,var(--bg-card));
+  animation:loading-mark-turn 1.6s cubic-bezier(.45,.05,.55,.95) infinite,loading-mark-breathe .8s ease-in-out infinite alternate-reverse;
+}
+/* the dot: the accent, laid exactly over the mark and turning with it */
+.loading-mark::after{
+  --lm-shape:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'%3E%3Ccircle cx='156' cy='46' r='12'/%3E%3C/svg%3E");
+  background:var(--accent);
+}
+.loading-mark--page{--lm-size:64px;padding:72px 0;gap:16px;}
+.loading-mark--inline{--lm-size:16px;grid-template-columns:var(--lm-size) minmax(0,1fr);justify-items:start;gap:8px;padding:0;text-align:left;}
+@keyframes loading-mark-arrive{from{filter:opacity(0);transform:translateY(6px);}}
+@keyframes loading-mark-turn{to{transform:rotate(1turn);}}
+@keyframes loading-mark-breathe{from{filter:opacity(.45);}}
 .empty{border:2px dashed var(--line);border-radius:18px;padding:22px;text-align:center;}
 .empty p{font-size:14.5px;font-weight:600;color:var(--ink-soft);margin-bottom:14px;line-height:1.55;}
 .foot{position:relative;z-index:1;text-align:center;font-size:13px;font-weight:600;color:var(--foot-ink);padding:0 20px 34px;text-shadow:var(--chrome-glow);}

package/modules/public-landing/public/community.html

@@ -230,7 +230,7 @@
          same for every viewer but "Builders you may know", shown signed in like its menu item. -->
     <section id="home" data-view="home" aria-labelledby="homeH">
       <h2 id="homeH">Top builders</h2>
-      <p class="commMsg" id="homeLoading" role="status">Reading the top builders…</p>
+      <p class="commMsg loading-mark" id="homeLoading" role="status">Reading the top builders…</p>
       <p class="projMsg err" id="homeFailed" role="alert" hidden></p>
       <ul class="homeCrowns" id="homeCrowns" hidden>
         <li class="homeCard"><h3 class="commSub">Builder of the week</h3><p class="crownWhen" id="crownWeekWhen"></p><div class="homeBody" id="crownWeek"></div></li>
@@ -282,7 +282,7 @@
       </div>
       <p class="commNote" id="boardNote">{{Currency}} earned across every project, since each builder started.</p>
       <div class="commFor" id="boardFor" hidden></div>
-      <p class="commMsg" id="boardLoading" role="status">Reading the leaderboard…</p>
+      <p class="commMsg loading-mark" id="boardLoading" role="status">Reading the leaderboard…</p>
       <p class="projMsg err" id="boardFailed" role="alert" hidden></p>
       <p class="commMsg" id="boardEmpty" hidden></p>
       <ol class="commRows" id="boardList" data-unit="{{currency}}" aria-labelledby="boardH"></ol>
@@ -295,7 +295,7 @@
          every viewer, and states the rule in full (the spec: the formula is public). -->
     <section id="week" data-view="week" aria-labelledby="weekH" hidden>
       <h2 id="weekH">Builder of the week</h2>
-      <p class="commMsg" id="weekLoading" role="status">Reading the builder of the week…</p>
+      <p class="commMsg loading-mark" id="weekLoading" role="status">Reading the builder of the week…</p>
       <p class="projMsg err" id="weekFailed" role="alert" hidden></p>
       <div class="commCrown" id="weekCrown" hidden></div>
       <p class="commMsg" id="weekNone" hidden></p>
@@ -339,7 +339,7 @@
     <section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>
       <h2 id="recruitH">Open to recruiters</h2>
       <p class="lede">Builders who keep their numbers hidden but are open to hearing from projects. Only project owners see who they are, and only by name.</p>
-      <p class="commMsg" id="recruitLoading" role="status">Checking whether you can see this list…</p>
+      <p class="commMsg loading-mark" id="recruitLoading" role="status">Checking whether you can see this list…</p>
       <div class="commDoor" id="recruitDoor" hidden>
         <p>Sign in to see whether this list is open to you.</p>
         <a class="btn" id="recruitSignin" href="/api/bongos/auth/web/start?return=/community/recruiters&amp;repos=1">

package/modules/public-landing/public/connections.html

@@ -137,7 +137,7 @@
     </a>
   </section>
 
-  <p class="loading" id="loading">Reading your connections…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your connections…</p>
   <!-- a 403 from the connections routes is about the VIEWER: their platform
        profile is not active yet (ADR 0202 D4 §1), so they cannot take part -->
   <p class="mineEmpty" id="inactive" hidden>Connections open once your profile is active. It turns on the first time you sign in to a project with your {{productName}} account, in your browser.</p>

package/modules/public-landing/public/guild.html

@@ -178,7 +178,7 @@
 </div>
 
 <main class="gld" id="guild">
-  <p class="loading" id="loading">Reading this guild…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading this guild…</p>
   <div class="alert" id="pageAlert" role="alert"></div>
 
   <!-- NO GUILD HERE: an unknown slug, a malformed one, and an unlisted guild seen

package/modules/public-landing/public/invitations.html

@@ -147,7 +147,7 @@
     </a>
   </section>
 
-  <p class="loading" id="loading">Reading your invitations…</p>
+  <p class="loading loading-mark loading-mark--page" id="loading" role="status">Reading your invitations…</p>
 
   <!-- ══ INVITATIONS · JOIN BY ADDRESS (task 1003774, moved here by task 1004276) ══
        No Accept button on a project's invite — ADR 0335 retired that hub-only flip
@@ -798,9 +798,9 @@
       return !s || p.name.toLowerCase().indexOf(s) !== -1 || p.host.indexOf(s) !== -1;
     });
   }
-  function pickNote(text) {
+  function pickNote(text, waiting) {
     var li = document.createElement('li');
-    li.className = 'joinList__note';
+    li.className = 'joinList__note' + (waiting ? ' loading-mark loading-mark--inline' : '');
     li.setAttribute('role', 'presentation');
     li.textContent = text;
     return li;
@@ -838,7 +838,7 @@
     picker.active = -1;
     input.removeAttribute('aria-activedescendant');
     if (!picker.projects) {
-      list.appendChild(pickNote('Loading projects…'));
+      list.appendChild(pickNote('Loading projects…', true));
     } else if (!picker.projects.length) {
       closePicker();
       return;