@bongos/core 1.24.49 → 1.24.51

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.49",
+  "version": "1.24.51",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.49",
+      "version": "1.24.51",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.49",
+  "version": "1.24.51",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11265,5 +11265,17 @@
       "id": "1005088",
       "text": "The Cloud Bongos logo and the browser-tab icon now come from one file, so every page, the hall, the welcome screen, the gates and the fundraising page show exactly the same mark, and phones get a proper home-screen icon."
     }
+  ],
+  "1.24.50": [
+    {
+      "id": "1005089",
+      "text": "The public status page now looks like the rest of Cloud Bongos: same colours, fonts, logo and panels, with a dark mode, and its off-site backup copy is built from the same source so the two always match."
+    }
+  ],
+  "1.24.51": [
+    {
+      "id": "1005090",
+      "text": "The public status page now talks plainly: 'Top builders', 'Recently shipped', 'Spending' instead of the old ancient-city words, and costs show in dollars."
+    }
   ]
 }

package/scripts/status-mirror-sync.js

@@ -23,15 +23,19 @@
 //                           mirror, and the publish REFUSES rather than shipping a
 //                           page whose banner points nowhere.
 //
-// DESIGN: status.js + style.css + cursors/ are byte-identical between the
-// droplet copy and the mirror (#737 parameterized the one differing constant via
-// window.STATUS_API_BASE), so they are PURE COPIES. Only index.html carries the
-// three off-box additions, injected here at stable anchors:
+// DESIGN: status.js + style.css + the shared sheets and brand files the page
+// links (SHARED_ASSETS, at the same paths) are byte-identical between the server
+// copy and the mirror (#737 parameterized the one differing constant via
+// window.STATUS_API_BASE), so they are PURE COPIES. index.html is built from the
+// SAME functions the server serves it with (task 1005089): the server's brand-token
+// stamp (applyBrandTokens) and its theme splice (themeMarkup — the pack's palette,
+// faces, font links and favicon), so the mirror cannot drift from the live page.
+// On top of that it carries the three off-box additions, injected at stable anchors:
 //   1. <script>window.STATUS_API_BASE = <domains.publicOrigin></script>   (head)
 //   2. <div id="offbox-status">…</div>                                    (after <body>)
 //   3. the availability-banner driver <script> (reads domains.statusDataUrl) (before status.js)
 // If any anchor is missing the script THROWS — a silent mis-sync is worse than
-// a failed run.
+// a failed run. tests/status_mirror_sync.mjs holds the mirror equal to the live page.
 //
 // USAGE:
 //   node scripts/status-mirror-sync.js --repo-dir <path-to-mirror-checkout> [--push]
@@ -48,35 +52,25 @@ const { execFileSync } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..');
 const SRC = path.join(REPO_ROOT, 'modules', 'status-ui', 'public');
-const { branding, clientBranding, applyBrandConditionals } = require('../src/branding');
-const { escapeHtml } = require('../src/html-escape');
-
-// Stamp instance-identity tokens into the mirror HTML. The off-box mirror is
-// served by a static Pages host, NOT the branding-injecting Node server — so this
-// script must reproduce serve-internal.applyBrandTokens (task 1705, ADR 0062 §3), else
-// the mirror would render literal {{worldName}}/{{currency}} placeholders. KEEP IN SYNC
-// with src/bongos/serve-internal.js applyBrandTokens. `brand` is the client-safe pack
-// and `publicOrigin` the resolved origin — both injected, never read ambiently, so the
-// transform stays pure and testable.
+const { branding, clientBranding } = require('../src/branding');
+const { stampHtml } = require('../src/asset-version');
+// The server's own serving transforms: the mirror is built with them, not with a
+// copy of them, so the off-box page and the live page are one page (task 1005089).
+const { applyBrandTokens, themeMarkup } = require('../src/bongos/serve-internal');
+
+// The shared files the page links from other modules, published at the SAME paths
+// so the page's root-absolute hrefs resolve on the mirror's host as on the server.
+const SHARED_ASSETS = [
+  'modules/ui-design/public/tokens.css',
+  'modules/hall-ui/public/controls.css',
+  'modules/ui-design/public/brand',
+];
+
+// Stamp instance-identity tokens into the mirror HTML: the server's applyBrandTokens
+// (task 1705, ADR 0062 §3), with every origin INJECTED ('' when absent) so nothing is
+// read ambiently and the transform stays pure and testable.
 function brandTokens(html, brand = {}, publicOrigin = '', buildersOrigin = '') {
-  const world = (brand.identity && brand.identity.worldName) || '';
-  const product = (brand.identity && brand.identity.productName) || '';
-  const tagline = (brand.copy && brand.copy.tagline) || '';
-  const cur = (brand.currency && brand.currency.label) || 'credits';
-  const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
-  const company = (brand.identity && brand.identity.company) || {};
-  const esc = escapeHtml; // the one server escaper (task 1004876)
-  return applyBrandConditionals(html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline })
-    .split('{{worldName}}').join(esc(world))
-    .split('{{productName}}').join(esc(product))
-    .split('{{Currency}}').join(esc(Cur))
-    .split('{{currency}}').join(esc(cur))
-    .split('{{tagline}}').join(esc(tagline))
-    .split('{{companyName}}').join(esc(company.name))
-    .split('{{companySite}}').join(esc(company.site))
-    .split('{{companyTagline}}').join(esc(company.tagline))
-    .split('{{publicOrigin}}').join(esc(publicOrigin || ''))
-    .split('{{buildersOrigin}}').join(esc(buildersOrigin || publicOrigin || ''));
+  return applyBrandTokens(html, brand || {}, publicOrigin || '', buildersOrigin || publicOrigin || '', '', '', '');
 }
 
 // ---- the three off-box index.html injections -------------------------------
@@ -152,7 +146,9 @@ function buildMirrorIndex({ srcHtml, apiBase, statusDataUrl, brand }) {
   if (html.includes('offbox-status')) {
     throw new Error('modules/status-ui/public/index.html already contains offbox markup — the source should be the droplet (no-banner) copy. Aborting.');
   }
-  html = injectOnce(html, '</head>', headInject(apiBase) + brandingInject(brand), 'before');
+  // The off-box globals, then the pack's theme exactly as the server splices it —
+  // last in <head>, after the page's own sheets, so the pack wins here as it does live.
+  html = injectOnce(html, '</head>', headInject(apiBase) + brandingInject(brand) + themeMarkup((brand || {}).theme), 'before');
   html = injectOnce(html, '<body>', BANNER_DIV, 'after');
   // Insert the driver right before the main status.js script tag.
   const scriptAnchor = '<script src="/status.js';
@@ -188,17 +184,11 @@ if (require.main === module) {
     fs.copyFileSync(path.join(SRC, rel), path.join(repoDir, rel));
     console.error(`  copied ${rel}`);
   };
-  const copyDir = (rel) => {
-    const from = path.join(SRC, rel), to = path.join(repoDir, rel);
-    if (!fs.existsSync(from)) return;
-    fs.rmSync(to, { recursive: true, force: true });
-    fs.cpSync(from, to, { recursive: true });
-    console.error(`  copied ${rel}/`);
-  };
 
   console.error('[status-mirror-sync] building mirror from modules/status-ui/public/ …');
   const indexHtml = buildMirrorIndex({
-    srcHtml: fs.readFileSync(path.join(SRC, 'index.html'), 'utf8'),
+    // the content-hash ?v= stamp the server serves the index with (#521)
+    srcHtml: stampHtml(fs.readFileSync(path.join(SRC, 'index.html'), 'utf8'), { assetDir: SRC, urlPrefix: '/' }),
     apiBase: b.domains.publicOrigin,
     statusDataUrl: b.domains.statusDataUrl,
     brand: clientBranding(),
@@ -207,12 +197,21 @@ if (require.main === module) {
   console.error('  wrote index.html (with off-box injections)');
   copyFile('status.js');
   copyFile('style.css');
-  copyDir('cursors');
+  // the retired bronze cursors (task 1005089) leave the mirror too
+  fs.rmSync(path.join(repoDir, 'cursors'), { recursive: true, force: true });
+  for (const rel of SHARED_ASSETS) {
+    const from = path.join(REPO_ROOT, rel), to = path.join(repoDir, rel);
+    fs.rmSync(to, { recursive: true, force: true });
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.cpSync(from, to, { recursive: true });
+    console.error(`  copied ${rel}`);
+  }
 
   // ---- commit + (optionally) push -------------------------------------------
 
   const git = (args) => execFileSync('git', ['-C', repoDir, ...args], { encoding: 'utf8' });
-  git(['add', 'index.html', 'status.js', 'style.css', 'cursors']);
+  git(['add', '-A', '--', 'index.html', 'status.js', 'style.css', 'modules']);
+  git(['rm', '-r', '-q', '--cached', '--ignore-unmatch', 'cursors']);
   const status = git(['status', '--porcelain']);
   if (!status.trim()) {
     console.error('[status-mirror-sync] mirror already up to date — nothing to publish.');
@@ -228,4 +227,4 @@ if (require.main === module) {
   console.error(`[status-mirror-sync] published. The Pages host rebuilds ${b.domains.statusOrigin || 'the mirror'} in ~1 min.`);
 }
 
-module.exports = { buildMirrorIndex, injectOnce, brandTokens };
+module.exports = { buildMirrorIndex, injectOnce, brandTokens, SHARED_ASSETS };

package/src/bongos/serve-internal.js

@@ -835,15 +835,16 @@ function mountInternalSurfaces(app) {
     const surface = surfaceOf(req);
     if (!surface) return next();
     // /api/* already handled above; everything else on a surface host serves from
-    // the module's static dir. The index page comes from the stamped in-memory copy
-    // (asset ?v= = content hash); everything else falls through to the on-disk
-    // static handler.
-    if ((req.method === 'GET' || req.method === 'HEAD') &&
-        (req.path === '/' || req.path === '/index.html') &&
-        surface.html['index.html']) {
+    // the module's static dir. Each page ("/" is the index, "/explore[.html]" its
+    // sibling; task 1005089) comes from the stamped + branded in-memory copy (asset
+    // ?v= = content hash); everything else falls through to the on-disk static handler.
+    // The map's keys are fixed at boot (the dir's own .html files), so a slug can only name a shipped page.
+    const pm = /^\/(?:([a-z0-9-]+)(?:\.html)?)?$/i.exec(req.path);
+    const page = pm && `${pm[1] || 'index'}.html`;
+    if ((req.method === 'GET' || req.method === 'HEAD') && page && surface.html[page]) {
       res.set('Cache-Control', 'public, max-age=60');
       res.type('html');
-      return res.send(surface.html['index.html']);
+      return res.send(surface.html[page]);
     }
     return surface.static(req, res, next);
   });

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.49'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.51'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/loading_mark.mjs

@@ -170,11 +170,11 @@ test('apex: each page waits with the size that fits it', () => {
 
 test('status: its two waiting tablets wear the loader, and a failed or empty read stops it', () => {
   const html = read(STATUS, 'index.html');
-  assert.ok(html.includes('<div id="versions" class="versions">\n      <p class="empty loading-mark" role="status">The masons are at their tools…</p>'));
-  assert.ok(html.includes('<div id="world-snapshot" class="world-snapshot">\n      <p class="empty loading-mark" role="status">The cartographers are still at their survey…</p>'));
-  // the header's "Tablet being consulted…" is rewritten in place before any read
+  assert.ok(html.includes('<div id="versions" class="versions">\n      <p class="empty loading-mark" role="status">Loading the versions…</p>'));
+  assert.ok(html.includes('<div id="world-snapshot" class="world-snapshot">\n      <p class="empty loading-mark" role="status">Loading the latest snapshot…</p>'));
+  // the header's "Checking for updates…" is rewritten in place before any read
   // starts (stampRefreshTime), so it is never a wait and keeps its plain words
-  assert.match(html, /<span class="herm__updated" id="last-updated">Tablet being consulted…<\/span>/);
+  assert.match(html, /<span class="herm__updated" id="last-updated">Checking for updates…<\/span>/);
   // The Kill Switch is the last thing in the status sheet, so nothing can outrank it.
   assert.match(STATUS_CSS.trimEnd(), /@media \(prefers-reduced-motion: reduce\) \{\n {2}\*, \*::before, \*::after \{ animation: none !important; transition: none !important; \}\n\}$/);
 
@@ -186,12 +186,12 @@ test('status: its two waiting tablets wear the loader, and a failed or empty rea
   // ...and stopWaiting itself, run: it takes the class off and leaves the words alone.
   const src = js.match(/function stopWaiting\(el\) \{[\s\S]*?\n\}/)[0];
   const removed = [];
-  const wait = { textContent: 'The masons are at their tools…', classList: { remove: (c) => removed.push(c) } };
+  const wait = { textContent: 'Loading the versions…', classList: { remove: (c) => removed.push(c) } };
   const host = { querySelectorAll: (sel) => (sel === '.loading-mark' ? [wait] : []) };
   const ctx = vm.createContext({});
   vm.runInContext(`${src}; this.stopWaiting = stopWaiting;`, ctx);
   ctx.stopWaiting(host);
   ctx.stopWaiting(null);
   assert.deepEqual(removed, ['loading-mark']);
-  assert.equal(wait.textContent, 'The masons are at their tools…');
+  assert.equal(wait.textContent, 'Loading the versions…');
 });

package/tests/status_company_attribution.mjs

@@ -26,7 +26,7 @@ test('a pack with no company drops the whole attribution sentence, not half of i
   const out = stamp({ name: '', site: 'https://ignored.example', tagline: 'ignored' });
   assert.doesNotMatch(out, /is the work of|ignored/);
   assert.doesNotMatch(out, /\{\{|brand-if/);
-  assert.match(out, /Tokens are wrought/, 'the neighbouring footer lines survive');
+  assert.match(out, /Tokens are awarded by review/, 'the neighbouring footer lines survive');
 });
 
 test('a full company renders the linked name and its tagline', () => {

package/tests/status_page_chrome.mjs

@@ -0,0 +1,195 @@
+// tests/status_page_chrome.mjs — the status page on the chrome world (task 1005089,
+// goal 1000138; DESIGN.md "Naming": the owner moved the status page onto this world,
+// keeping its fixed status vocabulary as the hall does).
+//
+// What this pins, DB-free and browser-free:
+//   * nothing of the retired Greek ledger look survives in the surface: no parchment
+//     colours, no Cinzel / EB Garamond, no bronze cursors, no amphora or laurel
+//     sprite, no double-ruled frame;
+//   * every page title carries the product name from the branding pack;
+//   * the sheet declares no page :root, writes its dark tier twice byte-identical,
+//     and carries the hall's status vocabulary value for value;
+//   * explore is served through the branding injection, so it loads the pack's faces;
+//   * the off-box mirror IS the live page: the server's response for "/" on the
+//     status host, and the mirror's index built from the same source, are equal once
+//     each side's own injections are taken out — and every file the page links is one
+//     the mirror publishes.
+//
+// Run:  node --test tests/status_page_chrome.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const DIR = path.join(ROOT, 'modules', 'status-ui', 'public');
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8').replace(/\r\n/g, '\n');
+const decomment = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '');
+const CSS = read('modules', 'status-ui', 'public', 'style.css');
+const CODE = decomment(CSS);
+
+function surfaceFiles(dir = DIR, out = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) surfaceFiles(p, out);
+    else if (/\.(html|css|js)$/.test(e.name)) out.push(p);
+  }
+  return out;
+}
+
+// The retired look, as literals. The parchment hexes are the old sheet's :root.
+const RETIRED = [
+  /Cinzel/i, /Garamond/i, /cursors\//, /hand-pointer\.png/, /sigil-amphora/, /orn-(laurel|column|coin|scroll|map|diamond)/,
+  /#ece0c2|#f6ecd2|#ddc99c|#e3d0a4|#2a2110|#6e5b3a|#735f3d|#8b6f2c|#b89a55|#4a7d5c|#2f5a3f|#2d6e7e|#a85530/i,
+  /rgba\(\s*(139, 111, 44|60, 40, 10|42, 33, 16|243, 230, 198)/,
+  /upper-roman/,
+];
+
+test('nothing of the Greek ledger look is left in the status surface', () => {
+  const hits = [];
+  for (const f of surfaceFiles()) {
+    const text = fs.readFileSync(f, 'utf8');
+    for (const re of RETIRED) if (re.test(text)) hits.push(`${path.relative(ROOT, f)}: ${re}`);
+  }
+  assert.deepEqual(hits, []);
+  assert.equal(fs.existsSync(path.join(DIR, 'cursors')), false, 'the bronze cursors are gone');
+  // no double-ruled frame: a panel is one hairline, no inset rule, no shadow
+  const panel = CODE.match(/\n\.tablet \{([^}]*)\}/);
+  assert.ok(panel, 'the panel rule exists');
+  assert.match(panel[1], /border: var\(--line\) solid var\(--rule-soft\);/);
+  assert.match(panel[1], /border-radius: var\(--ds-radius-panel\);/);
+  assert.doesNotMatch(panel[1], /box-shadow/);
+  assert.doesNotMatch(CODE, /\.tablet::(before|after)/, 'no carved corner ornaments');
+});
+
+test('every page title carries the product name from the pack', () => {
+  const pages = fs.readdirSync(DIR).filter((f) => f.endsWith('.html'));
+  assert.ok(pages.length >= 2);
+  for (const p of pages) {
+    const title = fs.readFileSync(path.join(DIR, p), 'utf8').match(/<title>([^<]*)<\/title>/);
+    assert.ok(title, `${p} has a title`);
+    assert.match(title[1], /\{\{productName\}\}/, `${p}: the title names the product`);
+  }
+});
+
+test('the page draws the shared mark and favicon, and names no face of its own', () => {
+  const html = read('modules', 'status-ui', 'public', 'index.html');
+  assert.ok(html.includes('<use href="/modules/ui-design/public/brand/mark.svg#mark"/>'), 'the top bar draws the one mark by reference');
+  assert.ok(html.includes('<link rel="icon" href="/modules/ui-design/public/brand/favicon.svg"'));
+  assert.doesNotMatch(html, /fonts\.googleapis\.com/, 'the faces come from the pack splice, not the page');
+  assert.ok(html.indexOf('/modules/hall-ui/public/controls.css') > html.indexOf('/modules/ui-design/public/tokens.css'), 'the shared controls follow the scales');
+  assert.ok(html.indexOf('/modules/hall-ui/public/controls.css') < html.indexOf('href="/style.css'), 'and precede the page sheet');
+  // exactly one header (the top bar), one main, one h1
+  assert.equal((html.match(/<header\b/g) || []).length, 1);
+  assert.equal((html.match(/<main\b/g) || []).length, 1);
+  assert.equal((html.match(/<h1\b/g) || []).length, 1);
+});
+
+test('the sheet declares no page :root, and its dark tier is written twice, byte-identical', () => {
+  assert.doesNotMatch(CODE, /(^|[\s,}]):root\b/, 'no :root — the pack splices the only one');
+  assert.match(CODE, /:where\(html\) \{/, 'the fallback contract tier sits at zero specificity');
+  const switchBody = CODE.match(/\nhtml\[data-theme="dark"\] \{([^}]*)\}/);
+  const mediaBody = CODE.match(/@media \(prefers-color-scheme: dark\) \{\s*html:not\(\[data-theme\]\) \{([^}]*)\}/);
+  assert.ok(switchBody && mediaBody, 'both dark twins exist');
+  const norm = (s) => s.split('\n').map((l) => l.trim()).filter(Boolean).join('\n');
+  assert.equal(norm(mediaBody[1]), norm(switchBody[1]));
+  // the dark tier re-pins no accent (the Unpinned Accent Rule)
+  assert.doesNotMatch(switchBody[1], /--(accent|accent-deep|sea|terracotta):/);
+});
+
+test('the status vocabulary is the hall\'s, value for value, in both modes', () => {
+  const hall = decomment(read('modules', 'hall-ui', 'public', 'style.css'));
+  const NAMES = ['--ok', '--ok-weak', '--warn', '--warn-weak', '--danger', '--danger-weak', '--info', '--info-weak'];
+  const valuesIn = (body) => Object.fromEntries(NAMES.map((n) => {
+    const m = body.match(new RegExp(`\\n\\s*${n}:\\s*([^;]+);`));
+    assert.ok(m, `${n} is declared`);
+    return [n, m[1].trim()];
+  }));
+  const lightOf = (src, open) => { const at = src.indexOf(open); assert.ok(at > -1, open); return src.slice(at, src.indexOf('}', at)); };
+  assert.deepEqual(valuesIn(lightOf(CODE, '\nhtml {')), valuesIn(lightOf(hall, '\n:root {')));
+  assert.deepEqual(valuesIn(lightOf(CODE, '\nhtml[data-theme="dark"] {')), valuesIn(lightOf(hall, '\nhtml[data-theme="dark"] {')));
+});
+
+// ── served ────────────────────────────────────────────────────────────────────
+// node:http, not fetch: fetch silently drops a Host override (tests/module_asset_subdomain.mjs).
+function get(port, p, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+async function withServer(fn) {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try { return await fn(server.address().port); } finally { await new Promise((r) => server.close(r)); }
+}
+
+test('explore is served through the branding injection: the pack\'s faces, the product name', async () => {
+  const { clientBranding } = require('../src/branding.js');
+  const brand = clientBranding();
+  await withServer(async (port) => {
+    for (const p of ['/explore', '/explore.html']) {
+      const r = await get(port, p, 'status.example.com');
+      assert.equal(r.status, 200, p);
+      // the href is attribute-escaped on the way in (themeMarkup), so & arrives as &amp;
+      for (const href of brand.theme.fonts.links) assert.ok(r.body.includes(`<link rel="stylesheet" href="${href.replace(/&/g, '&amp;')}">`), `${p} loads the pack's faces`);
+      assert.ok(r.body.includes(`<title>Explore — projects on the map · ${brand.identity.productName}</title>`), `${p} names the product`);
+      assert.doesNotMatch(r.body, /\{\{productName\}\}/);
+    }
+    // an asset still comes off disk
+    assert.equal((await get(port, '/explore.js', 'status.example.com')).status, 200);
+  });
+});
+
+test('the off-box mirror is the live page, and publishes every file the page links', async () => {
+  const mirror = require('../scripts/status-mirror-sync.js');
+  const { stampHtml } = require('../src/asset-version.js');
+  const { clientBranding, branding } = require('../src/branding.js');
+  const brand = clientBranding();
+  const src = stampHtml(read('modules', 'status-ui', 'public', 'index.html'), { assetDir: DIR, urlPrefix: '/' });
+  const apiBase = branding().domains.publicOrigin || 'https://origin.example.test';
+  const built = mirror.buildMirrorIndex({ srcHtml: src, apiBase, statusDataUrl: 'https://data.example.test/status.json', brand });
+
+  const live = await withServer(async (port) => (await get(port, '/', 'status.example.com')).body);
+  assert.ok(live.includes(brand.theme.fonts.links[0].replace(/&/g, '&amp;')), 'the live page splices the pack');
+
+  // each side minus its own injections: the server's client bundle + globals, and the
+  // mirror's three off-box additions + its globals
+  const liveCore = live
+    .replace(/<script src="\/lib\/bongos-client\.js[^"]*"><\/script>/, '')
+    .replace(/<script>window\.__BRANDING__=[\s\S]*?<\/script>/, '');
+  const mirrorCore = built
+    .replace(/ {2}<!-- #737: off-box mirror runs cross-origin against the droplet\. -->\n {2}<script>window\.STATUS_API_BASE = [^\n]*<\/script>\n {2}<script>window\.__BRANDING__ = [^\n]*<\/script>\n/, '')
+    .replace(/\n<!-- Off-box availability banner \(ADR 0029\)[\s\S]*?<div id="offbox-status" role="status" aria-live="polite"><\/div>\n/, '')
+    .replace(/<!-- Off-box availability banner driver \(ADR 0029\)[\s\S]*?<\/script>\n/, '');
+  // the origin token is the one value the two resolve from different places on a
+  // checkout with no domains; normalise it before comparing
+  const norm = (s) => s.split(apiBase).join('{{origin}}');
+  assert.equal(norm(mirrorCore), norm(liveCore));
+
+  // every root-absolute file the page links is published: its own files are copied
+  // from the surface dir, the shared ones at the same path
+  const refs = [...src.matchAll(/\b(?:href|src)="(\/[^"?#]+)/g)].map((m) => m[1]).filter((u) => !u.startsWith('//'));
+  assert.ok(refs.length >= 5);
+  for (const u of refs) {
+    const rel = u.slice(1).replace(/#.*$/, '');
+    const own = ['status.js', 'style.css'].includes(rel);
+    const shared = mirror.SHARED_ASSETS.some((a) => rel === a || rel.startsWith(`${a}/`));
+    assert.ok(own || shared, `the mirror publishes ${u}`);
+    assert.ok(fs.existsSync(path.join(own ? DIR : ROOT, rel)), `${u} exists to publish`);
+  }
+});

package/tests/status_page_wording.mjs

@@ -0,0 +1,129 @@
+// tests/status_page_wording.mjs — the status page speaks the project's current
+// voice, not the old Greek-city ledger (task 1005090, goal 1000138; docs/voice.md).
+//
+// The page moved onto the chrome world in task 1005089 with its words untouched;
+// this task rewrote them. What this pins: no word of the city vocabulary
+// ("citizens who shape her stones", "tablet last consulted", "works wrought",
+// "architects", drachmas…) is left anywhere a visitor can read it — the page's
+// text, its title and meta, its accessible names, and every string status.js
+// writes into the page. Class names, ids and code comments are not read, so a
+// selector like `.foundry__chart` is not a finding; a sentence is.
+//
+// Run:  node --test tests/status_page_wording.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const DIR = path.join(ROOT, 'modules', 'status-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(DIR, f), 'utf8');
+
+// The retired vocabulary, as whole words.
+const CITY = /\b(citizens?|stones?|tablets?|wrought|architects?|inscri(be|bed|ption|ptions)|lately|masons?|cartographers?|purse|treasury|foundry|forge|senate|lawmen|inspector|athens|civili[sz]ation|endeavou?rs?|portraits?|consult(ed|ing)?|archive|her stones|city|city's|ledger|hand at|hands)\b|\bdr\./i;
+
+// What a visitor reads in the markup: text between tags, and the attributes that
+// are read aloud or shown (title, alt, aria-label, placeholder, meta content).
+function visibleHtml(html) {
+  const noComments = html.replace(/<!--[\s\S]*?-->/g, ' ').replace(/<(script|style)\b[\s\S]*?<\/\1>/gi, ' ');
+  const out = [];
+  for (const m of noComments.matchAll(/\b(?:aria-label|title|alt|placeholder|content)="([^"]*)"/g)) out.push(m[1]);
+  for (const m of noComments.replace(/<[^>]*>/g, '\n').split('\n')) if (m.trim()) out.push(m.trim());
+  return out;
+}
+
+// What status.js writes: its string literals, minus comments, minus any markup
+// inside a template, minus the literals that are a selector, id or key.
+function visibleJs(js) {
+  // line comments first: a `/*` inside one (a path like /public/*) would otherwise
+  // open a block comment that swallows the code after it
+  const code = js.replace(/(^|[^:\\'"`])\/\/.*$/gm, '$1').replace(/\/\*[\s\S]*?\*\//g, '');
+  const out = [];
+  for (const m of code.matchAll(/'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)"|`((?:[^`\\]|\\.)*)`/g)) {
+    const lit = (m[1] ?? m[2] ?? m[3] ?? '').replace(/<[^>]*>/g, ' ').replace(/\$\{[^}]*\}/g, ' ').trim();
+    if (!lit) continue;
+    if (/^[a-z0-9_\-.#:[\]=" ]*$/.test(lit) && !/\s\S+\s/.test(lit)) continue; // a selector, id, class list or key
+    out.push(lit);
+  }
+  return out;
+}
+
+// The pages as the server serves them on the status host (stamped + branded), so
+// the check reads what a visitor's browser receives, not the template.
+function get(port, p) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: 'status.example.com' } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+async function servedPages() {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try {
+    const port = server.address().port;
+    const out = {};
+    for (const f of fs.readdirSync(DIR).filter((n) => n.endsWith('.html'))) {
+      const r = await get(port, f === 'index.html' ? '/' : `/${f}`);
+      assert.equal(r.status, 200, f);
+      out[f] = r.body;
+    }
+    return out;
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+test('no Greek-city word is left in what the status page shows', async () => {
+  const hits = [];
+  const pages = await servedPages();
+  assert.ok(Object.keys(pages).length >= 2);
+  for (const [f, html] of Object.entries(pages)) {
+    for (const line of visibleHtml(html)) if (CITY.test(line)) hits.push(`${f}: ${line.slice(0, 120)}`);
+  }
+  for (const f of ['status.js', 'explore.js']) {
+    for (const line of visibleJs(read(f))) if (CITY.test(line)) hits.push(`${f}: ${line.slice(0, 120)}`);
+  }
+  assert.deepEqual(hits, []);
+});
+
+test('the reader really reads the page (a guard that sees nothing passes everything)', async () => {
+  const html = visibleHtml((await servedPages())['index.html']);
+  assert.ok(html.includes('Recently shipped'), 'a heading is read');
+  assert.ok(html.some((l) => /^How .+ is being built, in the open/.test(l)), 'the meta description is read');
+  assert.ok(html.includes('Filter shipped tasks by date range'), 'an accessible name is read');
+  const js = visibleJs(read('status.js'));
+  assert.ok(js.includes('Nothing shipped in this window.'), 'a string status.js writes is read');
+  assert.ok(!js.includes('foundry__chart'), 'a class name is not');
+  // and the old lines would have been caught
+  for (const old of ['Architects of {{worldName}}', 'tablet last consulted at', 'works wrought, last 7 days', 'Citizens who have set the most stone.', '12 dr.']) {
+    assert.ok(CITY.test(old), `the guard catches "${old}"`);
+  }
+});
+
+test('money reads as dollars, not drachmas', () => {
+  // run the page's own two formatters
+  const js = read('status.js');
+  const fn = (name) => js.match(new RegExp(`function ${name}\\(n\\) \\{[\\s\\S]*?\\n\\}`))[0];
+  const ctx = vm.createContext({});
+  vm.runInContext(`${fn('fmtUsd')}\n${fn('fmtMoney')}\nthis.fmtMoney = fmtMoney;`, ctx);
+  assert.equal(ctx.fmtMoney(12.5), '$12.50');
+  assert.equal(ctx.fmtMoney(48297.4), `$${(48297).toLocaleString()}`);
+  assert.equal(ctx.fmtMoney(null), '—');
+  assert.doesNotMatch(js, /fmtDr|dr\.`/);
+});