@bongos/core 1.24.44 → 1.24.46

package/modules/lifecycle/runner-self-guard.js

@@ -26,11 +26,18 @@
 // paths the registry has always protected, and one that does not is treated as
 // unreadable, which refuses.
 //
-// WHICH CLAIM IS A RUNNER'S. Its worktree name (runner-self.js RUNNER_TREE_RE),
-// read from the claim row. If that read FAILS, the branch name stands in (the
-// runner's branch is its worktree name), so a database hiccup does not switch the
-// wall off for a runner while an ordinary publish still never depends on the read.
-// Telling a runner's session from its owner's on the server is task 1004547.
+// WHICH PUBLISH IS A RUNNER'S (task 1004547). Any one of three says so:
+//   - the claim row's `autonomous` mark, which the claims route sets from the
+//     claiming SESSION (a runner's own login, src/bongos/runner-login.js) and which
+//     no request body can set or clear. This is the reliable one: a worker that
+//     claims under a hand-picked worktree name is still recognised;
+//   - the publishing session is itself a runner's (`publisherIsRunner`), whoever
+//     made the claim;
+//   - the claim's worktree name (runner-self.js RUNNER_TREE_RE), kept for runners
+//     still running under their builder's CLI session until they are re-set-up.
+// If the claim read FAILS, the branch name stands in (the runner's branch is its
+// worktree name), so a database hiccup does not switch the wall off for a runner
+// while an ordinary publish still never depends on the read.
 //
 // FAILS CLOSED on the files: a read that throws, a list at GitHub's 300-file cap,
 // or a matcher that fails its check all refuse. An unattended change that cannot
@@ -49,7 +56,7 @@ const runnerSelf = require('./runner-self');
 // resolved it. Both names are read because the server may store a disambiguated
 // worktree_name beside the one the runner asked for.
 const CLAIM_SQL = `
-  SELECT c.worktree_name, c.requested_worktree_name
+  SELECT c.worktree_name, c.requested_worktree_name, c.autonomous
     FROM claims c WHERE c.task_id = $1
    ORDER BY c.claimed_at DESC, c.id DESC LIMIT 1`;
 
@@ -66,9 +73,11 @@ async function readLatestClaim(taskId, exec = api.pool) {
   }
 }
 
-function isRunnerPublish(claim, branch) {
+function isRunnerPublish(claim, branch, publisherIsRunner = false) {
+  if (publisherIsRunner === true) return true;
   if (claim === CLAIM_UNREADABLE) return runnerSelf.isRunnerTree(branch);
-  return !!claim && (runnerSelf.isRunnerTree(claim.worktree_name) || runnerSelf.isRunnerTree(claim.requested_worktree_name));
+  return !!claim && (claim.autonomous === true
+    || runnerSelf.isRunnerTree(claim.worktree_name) || runnerSelf.isRunnerTree(claim.requested_worktree_name));
 }
 
 // Paths the registry has protected since ADR 0043; a matcher that misses either
@@ -86,9 +95,9 @@ const unreadable = () => ({ code: 'self_modification_unreadable', files: [], pro
 // The route's one call. Returns null (publish as usual) or the refusal
 // { code, files, protected }. `deps` is the test seam, and the route passes a
 // shared getPullRequestFiles so this and the auto-pickup check read GitHub once.
-async function runnerSelfEditRefusal({ taskId, prNumber, branch = null }, deps = {}) {
+async function runnerSelfEditRefusal({ taskId, prNumber, branch = null, publisherIsRunner = false }, deps = {}) {
   const claim = await (deps.readLatestClaim || readLatestClaim)(taskId);
-  if (!isRunnerPublish(claim, branch)) return null;
+  if (!isRunnerPublish(claim, branch, publisherIsRunner)) return null;
   const match = verifiedMatcher(deps.matchProtected || ((files) => api.permissionPathCheck.matchProtected(files)));
   if (!match) return unreadable();
   let rows;

package/modules/platform-identity/platform-identity.js

@@ -96,7 +96,7 @@ function clientSecretValid(client, presentedSecret) {
 // FEDERATION_SOURCES mirrors modules/government/session-scopes.json — a module may
 // not read another module's files, and the doorway exports no lookup for it — and
 // tests/platform-identity.mjs pins the two lists equal, so a source declared or
-// retired there without the same edit here fails the build instead of drifting.
+// retired there without the same edit here fails the build instead of drifting ('runner' is left out: task 1004547).
 const FEDERATION_SOURCES = Object.freeze(['cli', 'web', null]);
 function sessionUsableForFederation(session) {
   if (!session) return { ok: false, reason: 'no_session' };

package/modules/platform-identity/tests/platform-identity.mjs

@@ -130,12 +130,23 @@ t('a session of an undeclared source (a leftover dev-box token) may NOT federate
   }
 });
 
-t('FEDERATION_SOURCES is exactly the kernel session-source registry', () => {
+// Sources the registry declares that must NOT federate. An Autobongos runner's own
+// login (task 1004547) is a machine working for its builder on ONE project; it has no
+// business signing that person in to other projects through the hub.
+const NEVER_FEDERATES = ['runner'];
+
+t('FEDERATION_SOURCES is exactly the kernel session-source registry, less the machine logins', () => {
   // platform-identity may not read the government module, so it mirrors the list;
   // this pin is what stops the copy drifting from modules/government/session-scopes.json.
   const reg = JSON.parse(readFileSync(new URL('../../government/session-scopes.json', import.meta.url), 'utf8'));
   const declared = reg.scopes.map((r) => (r.source === undefined ? null : r.source));
-  assert.deepEqual([...P.FEDERATION_SOURCES].sort(), declared.sort());
+  for (const s of NEVER_FEDERATES) assert.ok(declared.includes(s), `${s} is still declared, so the exclusion is still needed`);
+  assert.deepEqual([...P.FEDERATION_SOURCES].sort(), declared.filter((s) => !NEVER_FEDERATES.includes(s)).sort());
+});
+
+t('an Autobongos runner login may NOT federate', () => {
+  const r = P.sessionUsableForFederation({ github_id: 1, status: 'active', source: 'runner' });
+  assert.deepEqual(r, { ok: false, reason: 'session_scope' });
 });
 
 t('a service principal (system_role set) may NOT federate', () => {

package/modules/provisioning/core-upgrade-authz.js

@@ -54,6 +54,14 @@ function ownsUpgradableProject(inst, builder) {
 function requireOwnProjectOrPin({ pinGate, provisioning, pool, log }) {
   return async function ownProjectOrPinGate(req, res, next) {
     const raw = req.params ? req.params.id : undefined;
+    // An Autobongos runner's own login never takes the owner door (task 1004547):
+    // an unattended machine does not move a live version, even its owner's. It falls
+    // to the permission gate, which refuses it, because a runner session holds no
+    // system permission (src/bongos/auth.js resolveHeldPermissions).
+    if (req.builder && req.builder.runner) {
+      req.coreUpgradeAuthority = 'pin';
+      return pinGate(req, res, next);
+    }
     if (typeof raw === 'string' && ID_RE.test(raw)) {
       try {
         const inst = await provisioning.getInstanceById(pool, Number(raw));

package/modules/public-landing/public/account.html

@@ -19,6 +19,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/community.html

@@ -36,6 +36,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/connections.html

@@ -22,6 +22,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/contact.html

@@ -16,6 +16,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (task 1003336, ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/guild.html

@@ -29,6 +29,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/index.html

@@ -41,6 +41,7 @@
 <!-- The world's token layer. Root-absolute so the server's ?v= content stamp
      applies (a relative href is never stamped, and a four-hour browser cache
      then styles new markup with an old sheet). -->
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/world.css">
 <style>
 /* ── PAGE-LOCAL SHEET ────────────────────────────────────────────────────

package/modules/public-landing/public/invitations.html

@@ -23,6 +23,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/privacy.html

@@ -14,6 +14,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (task 1003336, ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/projects.html

@@ -19,6 +19,7 @@
      space sky both modes ride on, light/dark governing the cards. The server
      re-injects the branding :root AFTER stylesheets, so the pack stays
      authoritative. Design contract: docs/design/projects-surfaces-redesign-direction.md -->
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- The apex is dark only (task 1003336, ADR 0204): data-mode="dark" is fixed on
      <html> above — no pre-paint script, no stored choice, no OS preference. Light

package/modules/public-landing/public/terms.html

@@ -14,6 +14,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (task 1003336, ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/raise/views/gate.html

@@ -10,6 +10,7 @@
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
 <script src="{{base}}/assets/mode.js"></script>
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="{{base}}/assets/raise.css">
 </head>
 <body class="gate-body">

package/modules/raise/views/nda.html

@@ -10,6 +10,7 @@
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
 <script src="{{base}}/assets/mode.js"></script>
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="{{base}}/assets/raise.css">
 </head>
 <body>

package/modules/raise/views/page.html

@@ -10,6 +10,7 @@
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
 <script src="{{base}}/assets/mode.js"></script>
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="{{base}}/assets/raise.css?v={{assetVersion}}">
 <script src="{{base}}/assets/raise.js?v={{assetVersion}}" defer></script>
 {{editorAssets}}

package/modules/status-ui/public/index.html

@@ -9,6 +9,7 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Cinzel:wght@500;700&family=EB+Garamond:ital,wght@0,400;0,500;0,600;1,400;1,500&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
   <link rel="stylesheet" href="/style.css?v=2026-06-12-wip3">
 </head>
 <body>

package/modules/ui-design/kit/README.md

@@ -14,7 +14,7 @@ A **look** is a branding pack from the module's style library (`modules/ui-desig
 
 Two of the floors are about fit ([task 1004203](https://cloudbongos.com/builders#/task/1004203), [ADR 0329](../../../docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)): `text-fit` (text past its box, SVG text past its card) and `sibling-overlap` (text-bearing siblings on top of each other). `scripts/bongos/render-check.js` runs just those two over the pages a branch changed, and `/ship-check` shows them as an advisory row.
 
-A surface describes itself in two JSON files beside it — `<page>.states.json` and `<page>.probes.json` — in the vocabularies `lib.js` defines and validates. The full loop, the file shapes and the failure table: [`docs/recipes/ui-look-before-you-ship.md`](../../../docs/recipes/ui-look-before-you-ship.md). Exit codes everywhere: 0 clean · 1 problems · 2 a broken file or usage · 3 no browser.
+A surface describes itself in two JSON files beside it — `<page>.states.json` and `<page>.probes.json` — in the vocabularies `lib.js` defines and validates. A page served at the surface root (the hall's Home, `/builders/`) reads `index.states.json`. A file (or one state) may carry `"storage": { "session": {…}, "local": {…} }`, written into the browser before the page's own scripts run, so a first-visit question renders as a returning visitor sees it: every hall file seeds `hall-craft-asked` so the mode picker stays out of the shots ([task 1005080](https://cloudbongos.com/builders#/task/1005080)). A hall state that needs real data (a goal's detail, the Settings sections) passes against the hall-preview harness with `--base-in`/`--base-out`, one render at a time. The full loop, the file shapes and the failure table: [`docs/recipes/ui-look-before-you-ship.md`](../../../docs/recipes/ui-look-before-you-ship.md). Exit codes everywhere: 0 clean · 1 problems · 2 a broken file or usage · 3 no browser.
 
 ## The anti-pattern detector (`tells.js`, and the rendered twins in `lib.js`)
 

package/modules/ui-design/kit/fixtures/versions.json

@@ -0,0 +1 @@
+{"versions":[{"id":"BONGOS-V1","name":"Cloud Bongos — platform (V1)","status":"shipped","scope_doc_path":null,"started_at":"2026-06-01T00:00:00.000Z","shipped_at":"2026-09-01T00:00:00.000Z","done_when":"The platform builds itself."},{"id":"BONGOS-V2","name":"The ten working areas","status":"building","scope_doc_path":null,"started_at":"2026-09-01T00:00:00.000Z","shipped_at":null,"done_when":"Every working area has a goal."}],"page":{"limit":50,"offset":0,"total":2}}

package/modules/ui-design/kit/lib.js

@@ -79,7 +79,16 @@ function resolveSurfaceDir(surface, root = REPO_ROOT) {
   return null;
 }
 // The states/probes file for a page lives BESIDE the surface: <dir>/<page>.states.json.
-function sidecarPath(surfaceDir, urlPath, kind) { return path.join(surfaceDir, `${pageName(urlPath)}.${kind}.json`); }
+function sidecarPath(surfaceDir, urlPath, kind) {
+  const named = path.join(surfaceDir, `${pageName(urlPath)}.${kind}.json`);
+  // A page served at the surface ROOT ("/builders/") has no last segment of its own — the
+  // segment is the surface's prefix — so its sidecar is index.<kind>.json (task 1005080).
+  if (/\/$/.test(String(urlPath || '').split('?')[0]) && !fs.existsSync(named)) {
+    const index = path.join(surfaceDir, `index.${kind}.json`);
+    if (fs.existsSync(index)) return index;
+  }
+  return named;
+}
 function readJson(file) { return JSON.parse(fs.readFileSync(file, 'utf8')); }
 
 // ── the action vocabulary (states + probes) ───────────────────────────────────
@@ -332,6 +341,37 @@ function reducedMotionProblems({ running = [], frames = 0 } = {}) {
 // floor and not proof, and a reviewer verifies each tell in context (task 1003329, ADR 0223).
 function craftTells(facts) { return (facts && facts.tells ? facts.tells : []).map((t) => `tell: ${t}`); }
 
+// ── storage seeded before a page's own scripts run (task 1005080) ─────────────
+// { "storage"?: { "session"?: { key: "value" }, "local"?: { key: "value" } } } on a states or
+// probes file — and the same object on one state — is written into the browser's storage by
+// an init script, so a page that asks a one-time question on first visit (the hall's mode
+// picker) renders as a returning visitor sees it. A state that MEANS the first visit leaves
+// it out. A state's own storage is merged over the file's.
+function validateStorage(st, at) {
+  if (st === undefined) return [];
+  if (!st || typeof st !== 'object' || Array.isArray(st)) return [`${at}: an object { session?, local? }`];
+  const errors = [];
+  for (const k of Object.keys(st)) {
+    if (k !== 'session' && k !== 'local') { errors.push(`${at}.${k}: unknown store (session | local)`); continue; }
+    const m = st[k];
+    if (!m || typeof m !== 'object' || Array.isArray(m) || !Object.values(m).every((v) => typeof v === 'string')) errors.push(`${at}.${k}: an object of string → string`);
+  }
+  return errors;
+}
+function mergeStorage(...layers) {
+  const out = { session: {}, local: {} };
+  for (const s of layers) if (s) for (const k of ['session', 'local']) Object.assign(out[k], s[k] || {});
+  return out;
+}
+async function seedStorage(ctx, ...layers) {
+  const st = mergeStorage(...layers);
+  if (!Object.keys(st.session).length && !Object.keys(st.local).length) return;
+  await ctx.addInitScript((s) => {
+    try { for (const [k, v] of Object.entries(s.session)) window.sessionStorage.setItem(k, v); } catch (_) { /* storage refused */ }
+    try { for (const [k, v] of Object.entries(s.local)) window.localStorage.setItem(k, v); } catch (_) { /* storage refused */ }
+  }, st);
+}
+
 // ── the states file ───────────────────────────────────────────────────────────
 // { "page": "/projects", "surface"?: "public-landing" (a module key), "stub"?: { prefix?, child? },
 //   "modes"?: ["dark" | "light", …] (the modes the page renders; default both — a page that pins
@@ -339,7 +379,8 @@ function craftTells(facts) { return (facts && facts.tells ? facts.tells : []).ma
 //   stub.fixtures?: { "<fixture name>": "<other fixture file>" } (serve another file under a name — an empty list, a
 //   failure shape — for the states in THIS file; task 1003345),
 //   "ignoreControls"?: [selectors], "states": { name: { url?, auth?, actions?, expect? } },
-//   "reducedMotion"?: { auth?, url?, actions? } }
+//   "reducedMotion"?: { auth?, url?, actions? },
+//   "storage"?: { session?, local? } (seeded before load; a state may carry its own — see seedStorage) }
 function validateStatesFile(json) {
   if (!json || typeof json !== 'object' || Array.isArray(json)) return { ok: false, errors: ['a states file is a JSON object'] };
   const errors = [];
@@ -349,6 +390,7 @@ function validateStatesFile(json) {
   if (json.modeQuery !== undefined && json.modeQuery !== false && typeof json.modeQuery !== 'string') errors.push('modeQuery: the query param the page reads for its colour mode (default "mode"), or false');
   if (json.modes !== undefined && !(Array.isArray(json.modes) && json.modes.length && json.modes.every((m) => MODES.includes(m)))) errors.push('modes: a non-empty array of "dark" | "light" — the modes the page renders (default both); a page that pins one mode declares it here');
   for (const k of ['ignoreRequests', 'ignoreConsole', 'ignoreControls']) if (json[k] !== undefined && !(Array.isArray(json[k]) && json[k].every((s) => typeof s === 'string'))) errors.push(`${k}: an array of strings`);
+  errors.push(...validateStorage(json.storage, 'storage'));
   const states = json.states;
   if (!states || typeof states !== 'object' || Array.isArray(states) || !Object.keys(states).length) errors.push('states: required — a non-empty object of name → { url?, auth?, actions?, expect? }');
   else {
@@ -359,6 +401,7 @@ function validateStatesFile(json) {
       if (s.auth !== undefined && typeof s.auth !== 'boolean') errors.push(`states.${name}.auth: true (signed-in stub) or false`);
       errors.push(...validateActions(s.actions, `states.${name}.actions`));
       errors.push(...validateExpect(s.expect, `states.${name}.expect`));
+      errors.push(...validateStorage(s.storage, `states.${name}.storage`));
     }
   }
   if (json.reducedMotion !== undefined) {
@@ -386,6 +429,7 @@ function validateProbesFile(json) {
   const errors = [];
   if (typeof json.page !== 'string' || !json.page.startsWith('/')) errors.push('page: required — the root-relative path the probes open');
   errors.push(...validateStub(json.stub, 'stub'));
+  errors.push(...validateStorage(json.storage, 'storage'));
   if (!Array.isArray(json.probes) || !json.probes.length) errors.push('probes: required — a non-empty array');
   else json.probes.forEach((pr, i) => {
     const at = `probes[${i}]`;
@@ -396,6 +440,7 @@ function validateProbesFile(json) {
     if (pr.url !== undefined && (typeof pr.url !== 'string' || !pr.url.startsWith('/'))) errors.push(`${at}.url: a root-relative path`);
     if (pr.continue !== undefined && typeof pr.continue !== 'boolean') errors.push(`${at}.continue: boolean (reuse the previous probe's page)`);
     if (pr.continue && i === 0) errors.push(`${at}.continue: the first probe has nothing to continue`);
+    errors.push(...validateStorage(pr.storage, `${at}.storage`));
     errors.push(...validateActions(pr.steps, `${at}.steps`));
     if (!pr.expect || typeof pr.expect !== 'object' || !Object.keys(pr.expect).length) errors.push(`${at}.expect: required — a probe with nothing to expect proves nothing`);
     else errors.push(...validateExpect(pr.expect, `${at}.expect`));
@@ -527,7 +572,7 @@ module.exports = {
   REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS,
   argOf, hasFlag, listArg, pageName, normalizePageArg, resolveSurfaceDir, sidecarPath, readJson,
   runActions, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
-  validateStatesFile, validateProbesFile, NoBrowserError, launchBrowser, attachCollectors, withMode,
+  validateStatesFile, validateProbesFile, mergeStorage, seedStorage, NoBrowserError, launchBrowser, attachCollectors, withMode,
   freePort, startStub, parseColor, composite, luminance, contrastRatio, instancePack, packColors,
   listStyles, resolveStyle, styleBrandingFile,
 };

package/modules/ui-design/kit/probe.js

@@ -72,6 +72,7 @@ async function main() {
         if (ctx) await ctx.close();
         const [W, H] = lib.SIZES[pr.width || 1440];
         ctx = await browser.newContext({ viewport: { width: W, height: H }, deviceScaleFactor: 1 });
+        await lib.seedStorage(ctx, json.storage, pr.storage);
         page = await ctx.newPage();
         errors = [];
         page.on('pageerror', (e) => errors.push(String(e.message).split('\n')[0]));

package/modules/ui-design/kit/render.js

@@ -97,6 +97,7 @@ async function main() {
       const st = json.states[name];
       const [W, H] = lib.SIZES[w];
       const ctx = await browser.newContext({ viewport: { width: W, height: H }, deviceScaleFactor: 1, colorScheme: mode });
+      await lib.seedStorage(ctx, json.storage, st.storage);
       const page = await ctx.newPage();
       const logs = lib.attachCollectors(page, collectorOpts);
       const base = st.auth ? baseIn : baseOut;
@@ -121,6 +122,7 @@ async function main() {
     const rm = json.reducedMotion || {};
     for (const mode of lib.hasFlag(args, '--no-reduced-motion') ? [] : modes) {
       const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 }, colorScheme: mode, reducedMotion: 'reduce' });
+      await lib.seedStorage(ctx, json.storage, rm.storage);
       const page = await ctx.newPage();
       await page.goto((rm.auth === false ? baseOut : baseIn) + lib.withMode(rm.url || json.page, mode, json.modeQuery), { waitUntil: 'load' });
       await page.waitForTimeout(lib.SETTLE_MS);

package/modules/ui-design/kit/serve.js

@@ -106,6 +106,7 @@ const FEEDS = {
   '/public/cost-summary': 'cost-summary',
   '/public/recent-shipped': 'recent-shipped',
   '/public/leaderboard': 'leaderboard',
+  '/public/versions': 'versions', // the roadmap and goals pages' version dates (task 1005080)
   '/projects/featured': 'featured',
 };
 // /founding/builders (task 1004424) answers a never-founded project's empty list by default,

package/modules/ui-design/module.json

@@ -1,7 +1,7 @@
 {
   "key": "ui-design",
   "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the styles)",
-  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; the look-before-you-ship kit (kit/) and the style library (styles/). The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470; /design reaches them when that module is on. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
+  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; the look-before-you-ship kit (kit/) and the style library (styles/). The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470; /design reaches them when that module is on. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port. Since task 1005081 it also ships public/tokens.css, the shared token sheet (the scales: type, spacing, corners, shadows, motion, stacking) every surface loads at /modules/ui-design/public/tokens.css, so disabling it now also withdraws that sheet and the hall's scale aliases lose their values.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "category": { "parent": "pages" },

package/modules/ui-design/public/tokens.css

@@ -0,0 +1,125 @@
+/* modules/ui-design/public/tokens.css — THE SHARED TOKEN SHEET (task 1005081,
+   goal 1000138 "One Cloud Bongos design system").
+
+   One sheet every Cloud Bongos surface loads — the hall, the landing + the
+   projects hub, the status page and the raise page — served at the one stable
+   path /modules/ui-design/public/tokens.css on every host (serve-internal.js's
+   module-asset route; the kit's stub serves the same path).
+
+   WHAT IS HERE: the named SCALES — type sizes, spacing, corners, shadows,
+   motion and stacking layers. Every value was already in use (the hall's token
+   block, DESIGN.md's rhythm/shapes/motion), so loading this sheet moves nothing.
+
+   WHAT IS NOT HERE: the fifteen brand tokens (thirteen colours + two font
+   stacks). Those are the instance pack's API — serve-internal.js themeMarkup()
+   splices config/branding.*.json theme.ui as a plain :root at the END of <head>,
+   after every sheet, so the pack always wins. This sheet declares none of the
+   fifteen, so there is nothing for it to win against. No colour literal lives
+   here except black with alpha (the shadows) — the Fifteen Rule's one exception.
+
+   WHY --ds-*: the surfaces grew their own scale names, and some collide with a
+   DIFFERENT meaning (cosmos.css spends --line as a colour; raise.css sets
+   --radius to 10px). A shared name would silently change whichever surface did
+   not define it, so every scale is namespaced and each surface keeps its own
+   names as aliases until a later task migrates it (the hall's aliases live in
+   modules/hall-ui/public/style.css: --radius → --ds-radius-panel, …).
+
+   DARK TWINS: the one mode-dependent scale (the shadow) is written twice,
+   byte-identical — the switch rule (the hall's html[data-theme], the apex's
+   :root[data-mode]) and the prefers-color-scheme twin for first paint.
+
+   KILL SWITCH: each surface keeps its own `animation/transition: none
+   !important` rule; this sheet additionally zeroes its durations under
+   prefers-reduced-motion so a rule built on them stays still too. */
+
+:root {
+  /* ---- type sizes: the steps the hall's 113 literal sizes cluster on, small
+          to large. The "-plus" half steps are the ones a later migration
+          should collapse into their neighbours. The four fluid roles are
+          DESIGN.md's display/headline/figure/title. ---- */
+  --ds-text-3xs:       10.5px;
+  --ds-text-2xs:       11px;
+  --ds-text-2xs-plus:  11.5px;
+  --ds-text-xs:        12px;
+  --ds-text-xs-plus:   12.5px;
+  --ds-text-sm:        13px;
+  --ds-text-sm-plus:   13.5px;
+  --ds-text-md:        14px;
+  --ds-text-md-plus:   14.5px;
+  --ds-text-lg:        15px;
+  --ds-text-xl:        16px;
+  --ds-text-2xl:       17px;
+  --ds-text-3xl:       20px;
+  --ds-text-4xl:       22px;
+  --ds-text-5xl:       26px;
+  --ds-text-title:     clamp(23px, 2.4vw, 32px);
+  --ds-text-headline:  clamp(26px, 3.1vw, 42px);
+  --ds-text-figure:    clamp(30px, 3.7vw, 52px);
+  --ds-text-display:   clamp(34px, 6.7vw, 96px);
+
+  /* ---- spacing: DESIGN.md's rhythm (6/10/14/22/34/52) + the band gutters ---- */
+  --ds-space-hair:          6px;
+  --ds-space-xs:            10px;
+  --ds-space-sm:            14px;
+  --ds-space-md:            22px;
+  --ds-space-lg:            34px;
+  --ds-space-xl:            52px;
+  --ds-space-gutter:        26px;
+  --ds-space-gutter-narrow: 20px;
+
+  /* ---- the hairline: a WIDTH, never a colour ---- */
+  --ds-line: 1px;
+
+  /* ---- corners: pill or nothing for controls; panels and tiles ---- */
+  --ds-radius-pill:  999px;
+  --ds-radius-panel: 16px;
+  --ds-radius-tile:  10px;
+
+  /* ---- shadows: the world has no UI shadow vocabulary; this is spent only
+          where an element floats over a scrim. Black with alpha. ---- */
+  --ds-shadow-pop: 0 18px 40px rgba(0, 0, 0, .28);
+
+  /* ---- motion: state changes take the one easing; an authored entrance
+          takes the exponential ease-out (DESIGN.md, Motion). ---- */
+  --ds-dur-fast:    150ms;
+  --ds-dur-base:    200ms;
+  --ds-dur-slow:    320ms;
+  --ds-dur-slower:  420ms;
+  --ds-dur-arrive:  700ms;
+  --ds-stagger:     70ms;
+  --ds-ease:        cubic-bezier(.2, .7, .3, 1);
+  --ds-ease-arrive: cubic-bezier(.16, 1, .3, 1);
+
+  /* ---- stacking layers, low to high: the reading hairline under the top
+          bar, the chrome, the phone drawer over its scrim, a confirm dialog
+          over the drawer, the fullscreen diagram over everything. ---- */
+  --ds-z-progress:     25;
+  --ds-z-topbar:       30;
+  --ds-z-sidebar:      40;
+  --ds-z-scrim:        140;
+  --ds-z-drawer:       150;
+  --ds-z-modal:        160;
+  --ds-z-diagram-full: 9999;
+}
+
+/* ---------- dark: written twice, byte-identical ---------- */
+html[data-theme="dark"], :root[data-mode="dark"] {
+  --ds-shadow-pop: 0 18px 40px rgba(0, 0, 0, .62);
+}
+@media (prefers-color-scheme: dark) {
+  html:not([data-theme]):not([data-mode="light"]) {
+    --ds-shadow-pop: 0 18px 40px rgba(0, 0, 0, .62);
+  }
+}
+
+/* ---------- the kill switch, for the motion scale ---------- */
+@media (prefers-reduced-motion: reduce) {
+  :root {
+    --ds-dur-fast:   0ms;
+    --ds-dur-base:   0ms;
+    --ds-dur-slow:   0ms;
+    --ds-dur-slower: 0ms;
+    --ds-dur-arrive: 0ms;
+    --ds-stagger:    0ms;
+  }
+}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.44",
+  "version": "1.24.46",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.44",
+      "version": "1.24.46",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.44",
+  "version": "1.24.46",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11227,5 +11227,25 @@
       "id": "1005051",
       "text": "Goals now opens with the version's progress and the timeline of every version, so the separate Roadmap page is gone from the sidebar. Old Roadmap links open Goals. The Tasks board's 'see the version' line points at Goals too."
     }
+  ],
+  "1.24.45": [
+    {
+      "id": "1005070",
+      "text": "The hall's sidebar now appears instantly on every page instead of popping in late, and Building mode shows a single Home button."
+    }
+  ],
+  "1.24.46": [
+    {
+      "id": "1005081",
+      "text": "Cloud Bongos now has one shared set of design measurements (text sizes, spacing, corner shapes, shadows, animation timing and layering) that the builders hall, the landing page, the projects map, the status page and the invest"
+    },
+    {
+      "id": "1004547",
+      "text": "An Autobongos PC can now sign in with a login of its own, so the server always knows its work is automatic and it can never move a live version or flip its own off switch."
+    },
+    {
+      "id": "1005080",
+      "text": "The screenshot checker builders use before shipping a design change shows the real hall pages again, instead of a pop-up covering every page. Two small accessibility fixes came with it: a few tiny links are now big enough to t"
+    }
   ]
 }

package/scripts/bongos/fitness.js

@@ -540,7 +540,7 @@ const KERNEL_FILES = [
   'src/bongos/auth-admission.js',            // membership kind, admission gate, first-admin seating
   'src/bongos/auth-github.js',               // GitHub device + web OAuth flows
   'src/bongos/auth-idp.js',                  // hub federation, assertion + logout-token verification
-  'src/bongos/auth-discord.js',              // Discord OAuth link + guild membership
+  'src/bongos/auth-discord.js', 'src/bongos/runner-login.js', // Discord OAuth link + guild membership; an Autobongos PC's own login + its limits (task 1004547; requires only pool/db-kernel)
   'src/bongos/route-rank-check.js',          // deterministic route→rank classification
   'src/bongos/permission-path-check.js',     // protected-path matcher (PROTECTED_GLOBS, ADR 0043)
   'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)

package/scripts/bongos/gen-hall-sitemap.js

@@ -269,7 +269,9 @@ function build() {
     };
   });
 
-  const inAnyCraft = new Set(CRAFTS.flatMap((c) => crafts.tabs[c]));
+  // 'home' is in every craft: there the plate under the brand IS the Home button
+  // (tasks 1005065, 1005070), so no mode lists the Home tab beside it.
+  const inAnyCraft = new Set(['home', ...CRAFTS.flatMap((c) => crafts.tabs[c])]);
   const findings = {
     broken: dedupe(broken).sort((a, b) => (a.from + a.href).localeCompare(b.from + b.href)),
     orphan: rows.filter((r) => r.url !== '/' && !r.nav.length && !r.in.length).map((r) => r.url),