@bongos/core 1.24.45 → 1.24.47

package/modules/hall-ui/public/watch.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Watch — the attention board behind requireGovernmentPage. The SEALED state (a viewer below the gate) is a real render, not an error page, so it is a state here. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once.",
   "page": "/builders/watch",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/welcome-boot.js

@@ -166,14 +166,18 @@
 
   var root = null, timers = [], returnFocus = null, shown = false, leaving = false;
 
+  function bannerTag(builder) { return builder ? 'div' : 'header'; }
   function overlayHtml(builder, now, when) {
     return '<div class="wb__art" aria-hidden="true"><div class="wb__pan">' +
         '<img class="wb__img" alt="" src="' + artFor(when) + '" decoding="async">' +
         '<div class="wb__fx" id="wb-fx"></div>' +
       '</div></div>' +
       '<div class="wb__cloud wb__cloud--a" aria-hidden="true"></div><div class="wb__cloud wb__cloud--b" aria-hidden="true"></div>' +
-      '<div class="wb__banner">' + logoHtml(window.__BRANDING__) +
-        '<span class="wb__version" id="wb-version" hidden></span></div>' +
+      // For a visitor the welcome IS the page (the shell draws no header for them), so its logo
+      // banner is the page's one <header>; over a signed-in hall the shell's header stands, and the
+      // banner stays a plain block (task 1005080).
+      '<' + bannerTag(builder) + ' class="wb__banner">' + logoHtml(window.__BRANDING__) +
+        '<span class="wb__version" id="wb-version" hidden></span></' + bannerTag(builder) + '>' +
       '<div class="wb__veil" aria-hidden="true"></div>' +
       '<button class="wb__skip" type="button" data-wb-skip>Skip</button>' +
       '<a class="wb__built" href="' + BUILT_ON.href + '" target="_blank" rel="noopener">Built on <b>' + BUILT_ON.label + '</b></a>' +

package/modules/hall-ui/public/work-founding.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Project founding mode (task 1004422) on an ordinary hall page: the founding band above the topbar and today's nav items asleep, rendered from a /me that says founding (kit fixture me-founding.json, the real server shaper's output at stage strategize). The page itself is work.states.json's; only the identity differs. The no-founding case is every other hall states file.",
   "page": "/builders/work",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/",

package/modules/hall-ui/public/work.states.json

@@ -1,11 +1,13 @@
 {
   "_": "The hall's Work Board through modules/ui-design/kit/render.js (task 1003304). Written with the re-skin so the board's four tabs and its selection state are measured at 1440/390/320 in both modes, not just looked at. The populated look is the hall-preview harness (scripts/hall-preview/server.js); this file is the FLOORS.",
   "page": "/builders/work",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,
   "_feeds": "The kit's stub carries a small fixture set, not the hall's task feeds, so the board renders its EMPTY and SKELETON states here — which is the point: an empty queue is a state the floors must hold in. The feed 404s are declared, never hidden.",
-  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/", "/api/(gds|bongos)/tasks", "/api/(gds|bongos)/claims", "/api/(gds|bongos)/goals", "/api/(gds|bongos)/inbox/", "/api/(gds|bongos)/versions"],
+  "ignoreRequests": ["/api/(gds|bongos)/live", "/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/", "/api/(gds|bongos)/tasks", "/api/(gds|bongos)/claims", "/api/(gds|bongos)/goals", "/api/(gds|bongos)/inbox/", "/api/(gds|bongos)/versions"],
   "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "ready": { "auth": true, "expect": { "visible": ["#claim-scroll"], "hidden": ["#wip-scroll", "#backlog-scroll", "#history-scroll"] } },

package/modules/lifecycle/db-claims.js

@@ -108,7 +108,7 @@ function isRebaseGateExempt(task) {
   return Boolean(task) && task.kind === 'infra' && Number(task.priority) === 1;
 }
 
-async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false, autoPickup = false }) {
+async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false, autoPickup = false, autonomous = false }) {
   const heldPermissions = await claimPermissionsFor(builderId); // BV1.R106 — before the tx opens
   // ADR 0371 D5: a marked claim needs the project's switch and cap, read before the
   // tx like the permissions above; the COUNT runs inside it, under the lock.
@@ -433,9 +433,12 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
 
     // The column is named only on a marked claim, so an ordinary claim's insert is
     // byte-identical to before core_275.
+    // `autonomous` (core_295, task 1004547) is the server's mark that an Autobongos
+    // runner's own login made this claim — set by the claims route from the SESSION,
+    // never from the body. Like auto_pickup, the column is named only when true.
     const insertClaim = await client.query(
-      `INSERT INTO claims (task_id, builder_id, worktree_name, requested_worktree_name, head_sha, reserved_migration_number, creator_session_id${autoPickup ? ', auto_pickup' : ''})
-       VALUES ($1, $2, $3, $4, $5, $6, $7${autoPickup ? ', TRUE' : ''})
+      `INSERT INTO claims (task_id, builder_id, worktree_name, requested_worktree_name, head_sha, reserved_migration_number, creator_session_id${autoPickup ? ', auto_pickup' : ''}${autonomous ? ', autonomous' : ''})
+       VALUES ($1, $2, $3, $4, $5, $6, $7${autoPickup ? ', TRUE' : ''}${autonomous ? ', TRUE' : ''})
        RETURNING id, task_id, builder_id, worktree_name, requested_worktree_name, claimed_at, head_sha, reserved_migration_number`,
       [taskId, builderId, finalWorktreeName, requestedWorktreeName, headSha ?? null, reservedMigrationNumber, creatorSessionId ?? null]
     );

package/modules/lifecycle/routes/claims.js

@@ -305,6 +305,10 @@ module.exports = function buildClaimsRouter() {
         creatorSessionId: resolveCreatorSessionId(bindSession, req.gdsSession?.session_id),
         enforceOverlap: enforceTouches === true,
         autoPickup: autoPickup === true,
+        // task 1004547: an Autobongos runner's own login marks its claim
+        // autonomous. Read from the SESSION (auth.requireBuilder), never the body,
+        // so a worker cannot claim its way out of the runner-only walls.
+        autonomous: !!(req.builder && req.builder.runner),
       });
       const { just_unlocked: justUnlocked, overlap_warning: overlapWarning, sibling_overlap_warning: siblingOverlapWarning, page_notice: pageNotice, ...claim } = claimResult;
       const task = await db.getTask(Number(taskId));
@@ -476,6 +480,12 @@ module.exports = function buildClaimsRouter() {
     if (taskIds.length === 0) {
       return res.fail('task_ids_required', 400);
     }
+    // task 1004547: a batch claim binds only its first row to the session, so it
+    // cannot carry the autonomous mark row by row. A runner works one task per
+    // worker and never batch-claims, so its own login is refused here outright.
+    if (req.builder && req.builder.runner) {
+      return res.fail('runner_batch_refused', { status: 403, message: 'An Autobongos runner claims one task at a time. Use POST /claims.' });
+    }
     if (taskIds.length > 20) {
       // Safety cap. The optimizer doesn't return more than a handful at a time,
       // and unlimited batches let one slow transaction lock up the table.

package/modules/lifecycle/routes/tasks.js

@@ -1184,7 +1184,7 @@ module.exports = function buildTasksRouter() {
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         prMergeSentence(held);
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
-      const prReads = sharedPrReads(); for (const [guard, refusalFor] of [[autoPickupFiles, autoPickupFiles.autoPickupFileRefusal], [runnerSelfGuard, runnerSelfGuard.runnerSelfEditRefusal]]) { const refusal = await refusalFor({ taskId: id, prNumber: pr.number, branch }, { getPullRequestFiles: prReads.getPullRequestFiles }); if (refusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(refusal.code, 409, { ...refusal, message: guard.refusalMessage(refusal) }); } } // the PR's own files: an auto-pickup round stays on its page (ADR 0371 D8, task 1004678); a runner never changes its own files (task 1004546)
+      const prReads = sharedPrReads(); for (const [guard, refusalFor] of [[autoPickupFiles, autoPickupFiles.autoPickupFileRefusal], [runnerSelfGuard, runnerSelfGuard.runnerSelfEditRefusal]]) { const refusal = await refusalFor({ taskId: id, prNumber: pr.number, branch, publisherIsRunner: !!(req.builder && req.builder.runner) }, { getPullRequestFiles: prReads.getPullRequestFiles }); if (refusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(refusal.code, 409, { ...refusal, message: guard.refusalMessage(refusal) }); } } // the PR's own files: an auto-pickup round stays on its page (ADR 0371 D8, task 1004678); a runner never changes its own files (task 1004546), whoever's claim it is when a runner login publishes (task 1004547)
       // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
       // edit that forgets — an assignment must not be able to fail a pushed ship.
       const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })

package/modules/lifecycle/runner-self-guard.js

@@ -26,11 +26,18 @@
 // paths the registry has always protected, and one that does not is treated as
 // unreadable, which refuses.
 //
-// WHICH CLAIM IS A RUNNER'S. Its worktree name (runner-self.js RUNNER_TREE_RE),
-// read from the claim row. If that read FAILS, the branch name stands in (the
-// runner's branch is its worktree name), so a database hiccup does not switch the
-// wall off for a runner while an ordinary publish still never depends on the read.
-// Telling a runner's session from its owner's on the server is task 1004547.
+// WHICH PUBLISH IS A RUNNER'S (task 1004547). Any one of three says so:
+//   - the claim row's `autonomous` mark, which the claims route sets from the
+//     claiming SESSION (a runner's own login, src/bongos/runner-login.js) and which
+//     no request body can set or clear. This is the reliable one: a worker that
+//     claims under a hand-picked worktree name is still recognised;
+//   - the publishing session is itself a runner's (`publisherIsRunner`), whoever
+//     made the claim;
+//   - the claim's worktree name (runner-self.js RUNNER_TREE_RE), kept for runners
+//     still running under their builder's CLI session until they are re-set-up.
+// If the claim read FAILS, the branch name stands in (the runner's branch is its
+// worktree name), so a database hiccup does not switch the wall off for a runner
+// while an ordinary publish still never depends on the read.
 //
 // FAILS CLOSED on the files: a read that throws, a list at GitHub's 300-file cap,
 // or a matcher that fails its check all refuse. An unattended change that cannot
@@ -49,7 +56,7 @@ const runnerSelf = require('./runner-self');
 // resolved it. Both names are read because the server may store a disambiguated
 // worktree_name beside the one the runner asked for.
 const CLAIM_SQL = `
-  SELECT c.worktree_name, c.requested_worktree_name
+  SELECT c.worktree_name, c.requested_worktree_name, c.autonomous
     FROM claims c WHERE c.task_id = $1
    ORDER BY c.claimed_at DESC, c.id DESC LIMIT 1`;
 
@@ -66,9 +73,11 @@ async function readLatestClaim(taskId, exec = api.pool) {
   }
 }
 
-function isRunnerPublish(claim, branch) {
+function isRunnerPublish(claim, branch, publisherIsRunner = false) {
+  if (publisherIsRunner === true) return true;
   if (claim === CLAIM_UNREADABLE) return runnerSelf.isRunnerTree(branch);
-  return !!claim && (runnerSelf.isRunnerTree(claim.worktree_name) || runnerSelf.isRunnerTree(claim.requested_worktree_name));
+  return !!claim && (claim.autonomous === true
+    || runnerSelf.isRunnerTree(claim.worktree_name) || runnerSelf.isRunnerTree(claim.requested_worktree_name));
 }
 
 // Paths the registry has protected since ADR 0043; a matcher that misses either
@@ -86,9 +95,9 @@ const unreadable = () => ({ code: 'self_modification_unreadable', files: [], pro
 // The route's one call. Returns null (publish as usual) or the refusal
 // { code, files, protected }. `deps` is the test seam, and the route passes a
 // shared getPullRequestFiles so this and the auto-pickup check read GitHub once.
-async function runnerSelfEditRefusal({ taskId, prNumber, branch = null }, deps = {}) {
+async function runnerSelfEditRefusal({ taskId, prNumber, branch = null, publisherIsRunner = false }, deps = {}) {
   const claim = await (deps.readLatestClaim || readLatestClaim)(taskId);
-  if (!isRunnerPublish(claim, branch)) return null;
+  if (!isRunnerPublish(claim, branch, publisherIsRunner)) return null;
   const match = verifiedMatcher(deps.matchProtected || ((files) => api.permissionPathCheck.matchProtected(files)));
   if (!match) return unreadable();
   let rows;

package/modules/platform-identity/platform-identity.js

@@ -96,7 +96,7 @@ function clientSecretValid(client, presentedSecret) {
 // FEDERATION_SOURCES mirrors modules/government/session-scopes.json — a module may
 // not read another module's files, and the doorway exports no lookup for it — and
 // tests/platform-identity.mjs pins the two lists equal, so a source declared or
-// retired there without the same edit here fails the build instead of drifting.
+// retired there without the same edit here fails the build instead of drifting ('runner' is left out: task 1004547).
 const FEDERATION_SOURCES = Object.freeze(['cli', 'web', null]);
 function sessionUsableForFederation(session) {
   if (!session) return { ok: false, reason: 'no_session' };

package/modules/platform-identity/tests/platform-identity.mjs

@@ -130,12 +130,23 @@ t('a session of an undeclared source (a leftover dev-box token) may NOT federate
   }
 });
 
-t('FEDERATION_SOURCES is exactly the kernel session-source registry', () => {
+// Sources the registry declares that must NOT federate. An Autobongos runner's own
+// login (task 1004547) is a machine working for its builder on ONE project; it has no
+// business signing that person in to other projects through the hub.
+const NEVER_FEDERATES = ['runner'];
+
+t('FEDERATION_SOURCES is exactly the kernel session-source registry, less the machine logins', () => {
   // platform-identity may not read the government module, so it mirrors the list;
   // this pin is what stops the copy drifting from modules/government/session-scopes.json.
   const reg = JSON.parse(readFileSync(new URL('../../government/session-scopes.json', import.meta.url), 'utf8'));
   const declared = reg.scopes.map((r) => (r.source === undefined ? null : r.source));
-  assert.deepEqual([...P.FEDERATION_SOURCES].sort(), declared.sort());
+  for (const s of NEVER_FEDERATES) assert.ok(declared.includes(s), `${s} is still declared, so the exclusion is still needed`);
+  assert.deepEqual([...P.FEDERATION_SOURCES].sort(), declared.filter((s) => !NEVER_FEDERATES.includes(s)).sort());
+});
+
+t('an Autobongos runner login may NOT federate', () => {
+  const r = P.sessionUsableForFederation({ github_id: 1, status: 'active', source: 'runner' });
+  assert.deepEqual(r, { ok: false, reason: 'session_scope' });
 });
 
 t('a service principal (system_role set) may NOT federate', () => {

package/modules/provisioning/core-upgrade-authz.js

@@ -54,6 +54,14 @@ function ownsUpgradableProject(inst, builder) {
 function requireOwnProjectOrPin({ pinGate, provisioning, pool, log }) {
   return async function ownProjectOrPinGate(req, res, next) {
     const raw = req.params ? req.params.id : undefined;
+    // An Autobongos runner's own login never takes the owner door (task 1004547):
+    // an unattended machine does not move a live version, even its owner's. It falls
+    // to the permission gate, which refuses it, because a runner session holds no
+    // system permission (src/bongos/auth.js resolveHeldPermissions).
+    if (req.builder && req.builder.runner) {
+      req.coreUpgradeAuthority = 'pin';
+      return pinGate(req, res, next);
+    }
     if (typeof raw === 'string' && ID_RE.test(raw)) {
       try {
         const inst = await provisioning.getInstanceById(pool, Number(raw));

package/modules/public-landing/public/account.html

@@ -19,6 +19,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/community.html

@@ -36,6 +36,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/connections.html

@@ -22,6 +22,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/contact.html

@@ -16,6 +16,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (task 1003336, ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/guild.html

@@ -29,6 +29,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/index.html

@@ -41,6 +41,7 @@
 <!-- The world's token layer. Root-absolute so the server's ?v= content stamp
      applies (a relative href is never stamped, and a four-hour browser cache
      then styles new markup with an old sheet). -->
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/world.css">
 <style>
 /* ── PAGE-LOCAL SHEET ────────────────────────────────────────────────────

package/modules/public-landing/public/invitations.html

@@ -23,6 +23,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/privacy.html

@@ -14,6 +14,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (task 1003336, ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/public-landing/public/projects.html

@@ -19,6 +19,7 @@
      space sky both modes ride on, light/dark governing the cards. The server
      re-injects the branding :root AFTER stylesheets, so the pack stays
      authoritative. Design contract: docs/design/projects-surfaces-redesign-direction.md -->
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- The apex is dark only (task 1003336, ADR 0204): data-mode="dark" is fixed on
      <html> above — no pre-paint script, no stored choice, no OS preference. Light

package/modules/public-landing/public/terms.html

@@ -14,6 +14,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="/assets/cosmos.css">
 <!-- Dark only, like every apex page (task 1003336, ADR 0204): data-mode="dark" is fixed on <html>. -->
 <style>

package/modules/raise/views/gate.html

@@ -10,6 +10,7 @@
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
 <script src="{{base}}/assets/mode.js"></script>
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="{{base}}/assets/raise.css">
 </head>
 <body class="gate-body">

package/modules/raise/views/nda.html

@@ -10,6 +10,7 @@
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
 <script src="{{base}}/assets/mode.js"></script>
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="{{base}}/assets/raise.css">
 </head>
 <body>

package/modules/raise/views/page.html

@@ -10,6 +10,7 @@
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400&family=Manrope:wght@300;400;500;600&display=swap">
 <script src="{{base}}/assets/mode.js"></script>
+<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
 <link rel="stylesheet" href="{{base}}/assets/raise.css?v={{assetVersion}}">
 <script src="{{base}}/assets/raise.js?v={{assetVersion}}" defer></script>
 {{editorAssets}}

package/modules/status-ui/public/index.html

@@ -9,6 +9,7 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Cinzel:wght@500;700&family=EB+Garamond:ital,wght@0,400;0,500;0,600;1,400;1,500&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
   <link rel="stylesheet" href="/style.css?v=2026-06-12-wip3">
 </head>
 <body>

package/modules/ui-design/kit/README.md

@@ -14,7 +14,7 @@ A **look** is a branding pack from the module's style library (`modules/ui-desig
 
 Two of the floors are about fit ([task 1004203](https://cloudbongos.com/builders#/task/1004203), [ADR 0329](../../../docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)): `text-fit` (text past its box, SVG text past its card) and `sibling-overlap` (text-bearing siblings on top of each other). `scripts/bongos/render-check.js` runs just those two over the pages a branch changed, and `/ship-check` shows them as an advisory row.
 
-A surface describes itself in two JSON files beside it — `<page>.states.json` and `<page>.probes.json` — in the vocabularies `lib.js` defines and validates. The full loop, the file shapes and the failure table: [`docs/recipes/ui-look-before-you-ship.md`](../../../docs/recipes/ui-look-before-you-ship.md). Exit codes everywhere: 0 clean · 1 problems · 2 a broken file or usage · 3 no browser.
+A surface describes itself in two JSON files beside it — `<page>.states.json` and `<page>.probes.json` — in the vocabularies `lib.js` defines and validates. A page served at the surface root (the hall's Home, `/builders/`) reads `index.states.json`. A file (or one state) may carry `"storage": { "session": {…}, "local": {…} }`, written into the browser before the page's own scripts run, so a first-visit question renders as a returning visitor sees it: every hall file seeds `hall-craft-asked` so the mode picker stays out of the shots ([task 1005080](https://cloudbongos.com/builders#/task/1005080)). A hall state that needs real data (a goal's detail, the Settings sections) passes against the hall-preview harness with `--base-in`/`--base-out`, one render at a time. The full loop, the file shapes and the failure table: [`docs/recipes/ui-look-before-you-ship.md`](../../../docs/recipes/ui-look-before-you-ship.md). Exit codes everywhere: 0 clean · 1 problems · 2 a broken file or usage · 3 no browser.
 
 ## The anti-pattern detector (`tells.js`, and the rendered twins in `lib.js`)
 

package/modules/ui-design/kit/fixtures/versions.json

@@ -0,0 +1 @@
+{"versions":[{"id":"BONGOS-V1","name":"Cloud Bongos — platform (V1)","status":"shipped","scope_doc_path":null,"started_at":"2026-06-01T00:00:00.000Z","shipped_at":"2026-09-01T00:00:00.000Z","done_when":"The platform builds itself."},{"id":"BONGOS-V2","name":"The ten working areas","status":"building","scope_doc_path":null,"started_at":"2026-09-01T00:00:00.000Z","shipped_at":null,"done_when":"Every working area has a goal."}],"page":{"limit":50,"offset":0,"total":2}}

package/modules/ui-design/kit/lib.js

@@ -79,7 +79,16 @@ function resolveSurfaceDir(surface, root = REPO_ROOT) {
   return null;
 }
 // The states/probes file for a page lives BESIDE the surface: <dir>/<page>.states.json.
-function sidecarPath(surfaceDir, urlPath, kind) { return path.join(surfaceDir, `${pageName(urlPath)}.${kind}.json`); }
+function sidecarPath(surfaceDir, urlPath, kind) {
+  const named = path.join(surfaceDir, `${pageName(urlPath)}.${kind}.json`);
+  // A page served at the surface ROOT ("/builders/") has no last segment of its own — the
+  // segment is the surface's prefix — so its sidecar is index.<kind>.json (task 1005080).
+  if (/\/$/.test(String(urlPath || '').split('?')[0]) && !fs.existsSync(named)) {
+    const index = path.join(surfaceDir, `index.${kind}.json`);
+    if (fs.existsSync(index)) return index;
+  }
+  return named;
+}
 function readJson(file) { return JSON.parse(fs.readFileSync(file, 'utf8')); }
 
 // ── the action vocabulary (states + probes) ───────────────────────────────────
@@ -332,6 +341,37 @@ function reducedMotionProblems({ running = [], frames = 0 } = {}) {
 // floor and not proof, and a reviewer verifies each tell in context (task 1003329, ADR 0223).
 function craftTells(facts) { return (facts && facts.tells ? facts.tells : []).map((t) => `tell: ${t}`); }
 
+// ── storage seeded before a page's own scripts run (task 1005080) ─────────────
+// { "storage"?: { "session"?: { key: "value" }, "local"?: { key: "value" } } } on a states or
+// probes file — and the same object on one state — is written into the browser's storage by
+// an init script, so a page that asks a one-time question on first visit (the hall's mode
+// picker) renders as a returning visitor sees it. A state that MEANS the first visit leaves
+// it out. A state's own storage is merged over the file's.
+function validateStorage(st, at) {
+  if (st === undefined) return [];
+  if (!st || typeof st !== 'object' || Array.isArray(st)) return [`${at}: an object { session?, local? }`];
+  const errors = [];
+  for (const k of Object.keys(st)) {
+    if (k !== 'session' && k !== 'local') { errors.push(`${at}.${k}: unknown store (session | local)`); continue; }
+    const m = st[k];
+    if (!m || typeof m !== 'object' || Array.isArray(m) || !Object.values(m).every((v) => typeof v === 'string')) errors.push(`${at}.${k}: an object of string → string`);
+  }
+  return errors;
+}
+function mergeStorage(...layers) {
+  const out = { session: {}, local: {} };
+  for (const s of layers) if (s) for (const k of ['session', 'local']) Object.assign(out[k], s[k] || {});
+  return out;
+}
+async function seedStorage(ctx, ...layers) {
+  const st = mergeStorage(...layers);
+  if (!Object.keys(st.session).length && !Object.keys(st.local).length) return;
+  await ctx.addInitScript((s) => {
+    try { for (const [k, v] of Object.entries(s.session)) window.sessionStorage.setItem(k, v); } catch (_) { /* storage refused */ }
+    try { for (const [k, v] of Object.entries(s.local)) window.localStorage.setItem(k, v); } catch (_) { /* storage refused */ }
+  }, st);
+}
+
 // ── the states file ───────────────────────────────────────────────────────────
 // { "page": "/projects", "surface"?: "public-landing" (a module key), "stub"?: { prefix?, child? },
 //   "modes"?: ["dark" | "light", …] (the modes the page renders; default both — a page that pins
@@ -339,7 +379,8 @@ function craftTells(facts) { return (facts && facts.tells ? facts.tells : []).ma
 //   stub.fixtures?: { "<fixture name>": "<other fixture file>" } (serve another file under a name — an empty list, a
 //   failure shape — for the states in THIS file; task 1003345),
 //   "ignoreControls"?: [selectors], "states": { name: { url?, auth?, actions?, expect? } },
-//   "reducedMotion"?: { auth?, url?, actions? } }
+//   "reducedMotion"?: { auth?, url?, actions? },
+//   "storage"?: { session?, local? } (seeded before load; a state may carry its own — see seedStorage) }
 function validateStatesFile(json) {
   if (!json || typeof json !== 'object' || Array.isArray(json)) return { ok: false, errors: ['a states file is a JSON object'] };
   const errors = [];
@@ -349,6 +390,7 @@ function validateStatesFile(json) {
   if (json.modeQuery !== undefined && json.modeQuery !== false && typeof json.modeQuery !== 'string') errors.push('modeQuery: the query param the page reads for its colour mode (default "mode"), or false');
   if (json.modes !== undefined && !(Array.isArray(json.modes) && json.modes.length && json.modes.every((m) => MODES.includes(m)))) errors.push('modes: a non-empty array of "dark" | "light" — the modes the page renders (default both); a page that pins one mode declares it here');
   for (const k of ['ignoreRequests', 'ignoreConsole', 'ignoreControls']) if (json[k] !== undefined && !(Array.isArray(json[k]) && json[k].every((s) => typeof s === 'string'))) errors.push(`${k}: an array of strings`);
+  errors.push(...validateStorage(json.storage, 'storage'));
   const states = json.states;
   if (!states || typeof states !== 'object' || Array.isArray(states) || !Object.keys(states).length) errors.push('states: required — a non-empty object of name → { url?, auth?, actions?, expect? }');
   else {
@@ -359,6 +401,7 @@ function validateStatesFile(json) {
       if (s.auth !== undefined && typeof s.auth !== 'boolean') errors.push(`states.${name}.auth: true (signed-in stub) or false`);
       errors.push(...validateActions(s.actions, `states.${name}.actions`));
       errors.push(...validateExpect(s.expect, `states.${name}.expect`));
+      errors.push(...validateStorage(s.storage, `states.${name}.storage`));
     }
   }
   if (json.reducedMotion !== undefined) {
@@ -386,6 +429,7 @@ function validateProbesFile(json) {
   const errors = [];
   if (typeof json.page !== 'string' || !json.page.startsWith('/')) errors.push('page: required — the root-relative path the probes open');
   errors.push(...validateStub(json.stub, 'stub'));
+  errors.push(...validateStorage(json.storage, 'storage'));
   if (!Array.isArray(json.probes) || !json.probes.length) errors.push('probes: required — a non-empty array');
   else json.probes.forEach((pr, i) => {
     const at = `probes[${i}]`;
@@ -396,6 +440,7 @@ function validateProbesFile(json) {
     if (pr.url !== undefined && (typeof pr.url !== 'string' || !pr.url.startsWith('/'))) errors.push(`${at}.url: a root-relative path`);
     if (pr.continue !== undefined && typeof pr.continue !== 'boolean') errors.push(`${at}.continue: boolean (reuse the previous probe's page)`);
     if (pr.continue && i === 0) errors.push(`${at}.continue: the first probe has nothing to continue`);
+    errors.push(...validateStorage(pr.storage, `${at}.storage`));
     errors.push(...validateActions(pr.steps, `${at}.steps`));
     if (!pr.expect || typeof pr.expect !== 'object' || !Object.keys(pr.expect).length) errors.push(`${at}.expect: required — a probe with nothing to expect proves nothing`);
     else errors.push(...validateExpect(pr.expect, `${at}.expect`));
@@ -527,7 +572,7 @@ module.exports = {
   REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS,
   argOf, hasFlag, listArg, pageName, normalizePageArg, resolveSurfaceDir, sidecarPath, readJson,
   runActions, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
-  validateStatesFile, validateProbesFile, NoBrowserError, launchBrowser, attachCollectors, withMode,
+  validateStatesFile, validateProbesFile, mergeStorage, seedStorage, NoBrowserError, launchBrowser, attachCollectors, withMode,
   freePort, startStub, parseColor, composite, luminance, contrastRatio, instancePack, packColors,
   listStyles, resolveStyle, styleBrandingFile,
 };

package/modules/ui-design/kit/probe.js

@@ -72,6 +72,7 @@ async function main() {
         if (ctx) await ctx.close();
         const [W, H] = lib.SIZES[pr.width || 1440];
         ctx = await browser.newContext({ viewport: { width: W, height: H }, deviceScaleFactor: 1 });
+        await lib.seedStorage(ctx, json.storage, pr.storage);
         page = await ctx.newPage();
         errors = [];
         page.on('pageerror', (e) => errors.push(String(e.message).split('\n')[0]));

package/modules/ui-design/kit/render.js

@@ -97,6 +97,7 @@ async function main() {
       const st = json.states[name];
       const [W, H] = lib.SIZES[w];
       const ctx = await browser.newContext({ viewport: { width: W, height: H }, deviceScaleFactor: 1, colorScheme: mode });
+      await lib.seedStorage(ctx, json.storage, st.storage);
       const page = await ctx.newPage();
       const logs = lib.attachCollectors(page, collectorOpts);
       const base = st.auth ? baseIn : baseOut;
@@ -121,6 +122,7 @@ async function main() {
     const rm = json.reducedMotion || {};
     for (const mode of lib.hasFlag(args, '--no-reduced-motion') ? [] : modes) {
       const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 }, colorScheme: mode, reducedMotion: 'reduce' });
+      await lib.seedStorage(ctx, json.storage, rm.storage);
       const page = await ctx.newPage();
       await page.goto((rm.auth === false ? baseOut : baseIn) + lib.withMode(rm.url || json.page, mode, json.modeQuery), { waitUntil: 'load' });
       await page.waitForTimeout(lib.SETTLE_MS);

package/modules/ui-design/kit/serve.js

@@ -106,6 +106,7 @@ const FEEDS = {
   '/public/cost-summary': 'cost-summary',
   '/public/recent-shipped': 'recent-shipped',
   '/public/leaderboard': 'leaderboard',
+  '/public/versions': 'versions', // the roadmap and goals pages' version dates (task 1005080)
   '/projects/featured': 'featured',
 };
 // /founding/builders (task 1004424) answers a never-founded project's empty list by default,

package/modules/ui-design/module.json

@@ -1,7 +1,7 @@
 {
   "key": "ui-design",
   "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the styles)",
-  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; the look-before-you-ship kit (kit/) and the style library (styles/). The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470; /design reaches them when that module is on. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
+  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; the look-before-you-ship kit (kit/) and the style library (styles/). The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470; /design reaches them when that module is on. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port. Since task 1005081 it also ships public/tokens.css, the shared token sheet (the scales: type, spacing, corners, shadows, motion, stacking) every surface loads at /modules/ui-design/public/tokens.css, so disabling it now also withdraws that sheet and the hall's scale aliases lose their values.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "category": { "parent": "pages" },