@bongos/core 1.24.56 → 1.24.58

package/modules/hall-ui/public/settings-software-update.js

@@ -66,49 +66,12 @@
     </div>`;
   }
 
-  // "Ask for this upgrade" (task 1004595). A project the hub's operator runs cannot take an
-  // update itself, so instead of a dead end the page offers one press that reaches the people
-  // who run its server, and then says that it was asked. The server decides whether it is
-  // offered (`ask.available`) and remembers the request (`ask.requested`).
   function longDate(iso) {
     const d = new Date(iso);
     if (!Number.isFinite(d.getTime())) return null;
     try { return d.toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' }); } catch (e) { return d.toISOString().slice(0, 10); }
   }
 
-  // Asked, and still waiting: for this very version, or recently enough that asking again
-  // would only be refused.
-  function askPending(ask, offered) {
-    const r = ask && ask.requested;
-    if (!r) return false;
-    if (r.version === offered) return true;
-    const again = Date.parse(ask.ask_again_after);
-    return Number.isFinite(again) && Date.now() < again;
-  }
-
-  function askHtml(ask, offered, { lead }) {
-    const team = ask.hub_host ? `the team at ${escapeHtml(ask.hub_host)}` : 'the team that runs this project\'s server';
-    if (askPending(ask, offered)) {
-      const r = ask.requested;
-      const when = longDate(r.requested_at);
-      return `<div class="su-door su-ask">
-      <p class="panel-status panel-status--ok" role="status">Upgrade requested${when ? ` on ${escapeHtml(when)}` : ''}${r.by ? ` by @${escapeHtml(r.by)}` : ''}, for version ${mono(r.version)}. ${team.charAt(0).toUpperCase() + team.slice(1)} has your request. This page shows the new version once it is installed.</p>
-    </div>`;
-    }
-    const last = ask.requested && longDate(ask.requested.requested_at);
-    const before = last ? ` You last asked on ${escapeHtml(last)}, for ${mono(ask.requested.version)}.` : '';
-    const intro = lead
-      ? `<p class="panel-hint">This project runs on a server that ${team} looks after, so they install its updates. Ask them for this one and they are told which version you want.${before}</p>`
-      : `<p class="panel-hint">If that page does not let you in, ask ${team} to install it for you.${before}</p>`;
-    return `<div class="su-door su-ask">
-      ${intro}
-      <div class="row-end">
-        <button type="button" class="pbtn ${lead ? 'pbtn--save' : 'pbtn--quiet'}" id="su-ask">Ask for this upgrade</button>
-        <span class="panel-hint" id="su-ask-status" role="status"></span>
-      </div>
-    </div>`;
-  }
-
   // Where the Update button goes, and what it says it will do. Only a plain same-origin path
   // or an http(s) URL is ever put in an href; anything else draws no button.
   function doorHtml(data, offered) {
@@ -116,9 +79,9 @@
     if (!data.can_update) {
       return '<p class="panel-hint su-door">Only the people allowed to upgrade this project see an Update button here.</p>';
     }
-    const ask = data.ask || {};
+    // No request-the-upgrade button any more (task 1005128): a project the hub hosts always has
+    // the hub's door, so `cli` is only ever a server its owner runs themselves.
     if (door.kind === 'cli') {
-      if (ask.available) return askHtml(ask, offered, { lead: true });
       return '<p class="panel-hint su-door">This project is upgraded on the server that runs it: <code>bongos upgrade</code> there takes this version, with the same health check and rollback.</p>';
     }
     const url = String(door.url || '');
@@ -134,7 +97,7 @@
     return `<div class="row-end su-door">
       <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}</a>
       <span class="panel-hint">Takes a few minutes. The project restarts once, checks itself, and goes back to the version it runs now if it does not come back healthy.${where ? ` A small window from ${escapeHtml(where)} opens for a moment to start it.` : ''}</span>
-    </div>${door.kind === 'hub' && ask.available ? askHtml(ask, offered, { lead: false }) : ''}`;
+    </div>`;
   }
 
   // One entry: its text, and — only in the hall whose ledger the ids belong to, which is
@@ -223,8 +186,7 @@
       html += row('Newest for this project', `${mono(u.running)} — this project is up to date.`, '<span class="su-pill su-pill--ok">Up to date</span>');
     } else {
       const when = ago(u.offered_published_at);
-      const pending = data.can_update && data.ask && data.ask.available && askPending(data.ask, u.offered);
-      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${onHold ? 'On hold' : pending ? 'Requested' : 'Update ready'}</span>`);
+      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${onHold ? 'On hold' : 'Update ready'}</span>`);
       // No button to take again the very version that was just rolled back here (task 1004730).
       if (!onHold) html += doorHtml(data, u.offered);
       html += whatsNewHtml(u.whats_new, (data.door || {}).kind === 'local');
@@ -237,9 +199,6 @@
     body.innerHTML = html + historyHtml(data.history);
     if (note) note.textContent = notes.join(' ');
 
-    const askBtn = byId('su-ask');
-    if (askBtn) askBtn.addEventListener('click', () => askForUpgrade(data, askBtn));
-
     // The same press as the pill's Update now; only when it took the update in place is the
     // link's own navigation stopped.
     const updateBtn = byId('su-update');
@@ -259,32 +218,6 @@
     }
   }
 
-  // One press: the server sends the request and remembers it; the panel redraws from its
-  // answer. "Asked recently" carries the stored request, so it redraws as pending too.
-  async function askForUpgrade(data, btn) {
-    const status = byId('su-ask-status');
-    btn.disabled = true;
-    btn.textContent = 'Asking…';
-    if (status) status.textContent = '';
-    try {
-      const res = await api.request('POST', `${API}/software-update/request`, { body: {} });
-      const err = (res.data && res.data.error) || {};
-      const request = (res.data && res.data.request) || (err.details && err.details.request);
-      if ((res.ok || res.status === 429) && request) {
-        const again = new Date(Date.parse(request.requested_at) + 24 * 3600 * 1000).toISOString();
-        render({ ...data, ask: { ...data.ask, requested: request, ask_again_after: again } });
-        return;
-      }
-      // Every refusal the server sends carries a sentence; a bare code is only ever a
-      // proxy or a crash, so the status stands in for it.
-      throw new Error(err.message && err.message !== err.code ? err.message : `HTTP ${res.status}`);
-    } catch (e) {
-      btn.disabled = false;
-      btn.textContent = 'Ask for this upgrade';
-      if (status) status.textContent = `Could not send the request: ${String(e.message || 'unknown error').replace(/\.$/, '')}.`;
-    }
-  }
-
   async function load() {
     if (asked) return;
     asked = true;

package/modules/hall-ui/public/update-pill.js

@@ -23,7 +23,6 @@
 //          with &handoff=1, this page tells it the version over postMessage, and the hub
 //          posts the move with the owner's OWN hub session (deploy-handoff.js). This
 //          project's server gains no capability; the only thing that crosses is a version.
-//   ask    a hosted project the hub's operator runs: "Ask for this update" (task 1004595).
 //   cli    a self-hosted instance: no button; the card names the command.
 //
 // PROGRESS IS READ, NEVER GUESSED (deploy.js's rule). The page watches its own public
@@ -41,9 +40,10 @@
   var RUN_KEY = 'bongos.update.run';
   var MSG = 'bongos-update'; // the tag deploy-handoff.js answers to; both sides check it
   var VERSION_RE = /^\d+\.\d+\.\d+$/;
-  // A hub door as the server words it (core-update.js HUB_UPGRADE_URL_RE's shape): an
-  // origin and /deploy?project=<slug>, nothing else. Anything else draws no button.
-  var HUB_DOOR_RE = /^(https?:\/\/[^\s"'<>/]+)\/deploy\?project=[A-Za-z0-9._%-]+$/;
+  // A hub door as the server words it (core-update.js updateDoor): an origin and
+  // /deploy?project=<slug>, or /deploy?host=<address> for a hosted project whose server never
+  // learned its slug (task 1005128). Anything else draws no button.
+  var HUB_DOOR_RE = /^(https?:\/\/[^\s"'<>/]+)\/deploy\?(?:project|host)=[A-Za-z0-9._%-]+$/;
   var SETTINGS_HREF = '/settings#software-update';
   var HIGHLIGHTS = 3;
   var LINE_MAX = 120;
@@ -101,14 +101,13 @@
   function doorPlan(sw) {
     if (!sw || sw.can_update !== true) return { kind: 'none' };
     var door = sw.door || {};
-    var ask = sw.ask || {};
     if (door.kind === 'local' && door.url === '/deploy') return { kind: 'local' };
     if (door.kind === 'hub') {
       var m = HUB_DOOR_RE.exec(String(door.url || ''));
-      if (!m) return ask.available ? { kind: 'ask' } : { kind: 'none' };
+      if (!m) return { kind: 'none' };
       return { kind: 'hub', url: door.url, origin: m[1] };
     }
-    if (door.kind === 'cli') return ask.available ? { kind: 'ask' } : { kind: 'cli' };
+    if (door.kind === 'cli') return { kind: 'cli' };
     return { kind: 'none' };
   }
 
@@ -263,13 +262,6 @@
       note = '<p class="upd-card__note">Takes a few minutes. The project restarts once, and goes back to the version it runs now on its own if the new one is not healthy.' +
         (host ? ' A small window from ' + esc(host) + ' opens for a moment to start it.' : '') + '</p>';
       action = '<button type="button" class="upd-btn upd-btn--go" id="upd-go">Update now</button>';
-    } else if (plan.kind === 'ask') {
-      var ask = state.sw.ask || {};
-      var team = ask.hub_host ? 'the team at ' + ask.hub_host : 'the team that runs this project\'s server';
-      var asked = ask.requested && ask.requested.version === state.offered;
-      note = '<p class="upd-card__note">' + esc(asked ? 'You asked ' + team + ' for this update. This shows the new version once it is installed.'
-        : 'This project runs on a server that ' + team + ' looks after, so they install its updates.') + '</p>';
-      if (!asked) action = '<button type="button" class="upd-btn upd-btn--go" id="upd-ask">Ask for this update</button>';
     } else if (plan.kind === 'cli') {
       note = '<p class="upd-card__note">This project is updated on the server that runs it: <code>bongos upgrade</code> there takes this version, and puts the old one back if it fails.</p>';
     } else {
@@ -294,7 +286,6 @@
     var on = function (id, fn) { var el = c.querySelector('#' + id); if (el) el.addEventListener('click', fn); };
     on('upd-close', closeCard);
     on('upd-go', function () { updateNow(); });
-    on('upd-ask', function (e) { askForIt(e.currentTarget); });
     on('upd-reload', reload);
     on('upd-open', function () { updateNow(); });
   }
@@ -565,22 +556,6 @@
     if (root.location && root.location.reload) root.location.reload();
   }
 
-  // "Ask for this update" (task 1004595): one press reaches the people who run the server.
-  function askForIt(btn) {
-    btn.disabled = true;
-    btn.textContent = 'Asking…';
-    state.api.request('POST', '/api/bongos/software-update/request', { body: {} }).then(function (res) {
-      var data = (res && res.data) || {};
-      var request = data.request || (data.error && data.error.details && data.error.details.request);
-      if (!((res.ok || res.status === 429) && request)) throw new Error(errorOf(res, 'Could not send the request.'));
-      state.sw.ask = Object.assign({}, state.sw.ask, { requested: request });
-      drawCard();
-    }).then(null, function (e) {
-      state.error = String((e && e.message) || 'Could not send the request.');
-      drawCard();
-    });
-  }
-
   /** shell.js hands over GET /core-update's answer; the pill decides what, if anything, to show. */
   function mount(data, opts) {
     state.api = opts && opts.api;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.56",
+  "version": "1.24.58",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.56",
+      "version": "1.24.58",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.56",
+  "version": "1.24.58",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11307,5 +11307,17 @@
       "id": "1005087",
       "text": "The Studio, the thinking sky, the tweak editor, the city, approvals, the atlas and the welcome screen now take their colours and fonts from the project's own branding, so a re-branded project sees them in its own colours; the"
     }
+  ],
+  "1.24.57": [
+    {
+      "id": "1005093",
+      "text": "Stylesheets can no longer gain new typed-in colours, text sizes, corners, shadows or breakpoints without the build failing, and the public design reference must be regenerated whenever its sources change."
+    }
+  ],
+  "1.24.58": [
+    {
+      "id": "1005128",
+      "text": "A project's owner now takes a new Bongos version with one Update button; the \"ask the team for this upgrade\" step is gone for every hosted project."
+    }
   ]
 }

package/scripts/bongos/css-literal-scan.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+'use strict';
+// css-literal-scan.js — the detector behind the per-stylesheet DESIGN COUNTS
+// ratchet in fitness-ratchets.js (task 1005093, goal 1000138 "one Cloud Bongos
+// design system"; DESIGN.md, the Fifteen Rule and the --ds-* scales).
+//
+// WHAT IT COUNTS, per tracked stylesheet, in five kinds:
+//   colours     — every typed-in colour: a hex (#abc, #aabbcc, #aabbccdd) or a
+//                 colour function (rgb/rgba/hsl/hsla/hwb/lab/lch/oklab/oklch).
+//                 Counted per OCCURRENCE. The one literal the Fifteen Rule allows
+//                 — black or white with alpha as a scrim/shadow/halo
+//                 (rgba(0,0,0,.4), rgb(255 255 255 / .2)) — is not counted.
+//                 Named colours (red, white…) are not detected.
+//   font_sizes  — font-size / font declarations whose value carries a typed-in
+//                 non-zero length (px, rem, em, pt, %, vw…) instead of a token.
+//   radii       — *-radius declarations with a typed-in non-zero length.
+//   shadows     — box-shadow / text-shadow declarations that are not none/inherit
+//                 and carry a typed-in length or colour.
+//   breakpoints — @media / @container rules with a typed-in length (a custom
+//                 property cannot be used in a media query, so these never become
+//                 tokens; the count stops the set of breakpoints sprawling).
+// Sizes, radii, shadows and breakpoints are counted per DECLARATION / RULE.
+//
+// WHAT IT DOES NOT COUNT. A custom-property declaration (`--x: #123`) is a token
+// DEFINITION — tokens.css and the hall's token block are exactly where literals
+// belong — so its value is skipped. Page-private palettes are guarded separately
+// (tests/hall_private_palettes.mjs). Custom-property NAMES are removed from a
+// value before it is read (so --ds-space-12 is not a "12"), and url(...) bodies
+// are emptied (a data URI is not a colour). A literal inside a var() fallback
+// DOES count: a fallback is a typed-in value.
+//
+// Scope: every tracked *.css outside docs/ (the design mocks there are not
+// served), node_modules and vendor/.
+//
+// Print the counts:  node scripts/bongos/css-literal-scan.js [--all]
+
+const path = require('path');
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const KINDS = ['colours', 'font_sizes', 'radii', 'shadows', 'breakpoints'];
+
+const EXCLUDE_RE = /^docs\/|(^|\/)(node_modules|vendor)\//;
+const COMMENT_RE = /\/\*[\s\S]*?\*\//g;
+const URL_RE = /url\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\)/gi;
+const VAR_NAME_RE = /--[\w-]+/g;
+// A declaration: a property, a colon, and a value that ends at ; or } (a selector
+// such as `a:hover {` ends at `{`, so it never matches).
+const DECL_RE = /(?:^|[{;\s])(-?-?[a-zA-Z][\w-]*)\s*:\s*([^;{}]+)(?=[;}])/g;
+const AT_RULE_RE = /@(media|container)\b([^{;]*)\{/g;
+const HEX_RE = /#[0-9a-fA-F]{3,8}(?![\w-])/g;
+const COLOUR_FN_RE = /(?<![\w-])(?:rgba?|hsla?|hwb|lab|lch|oklab|oklch)\(([^()]*)\)/gi;
+const LENGTH_RE = /(?<![\w.#-])(\d*\.?\d+)(px|rem|em|pt|vw|vh|vmin|vmax|ch|ex|%)(?![\w%])/g;
+const MEDIA_LENGTH_RE = /(?<![\w.-])\d*\.?\d+(px|em|rem)(?![\w])/;
+const NO_SHADOW_RE = /^\s*(none|inherit|initial|unset|revert)\s*(!important)?\s*$/i;
+
+/** True for black or white with alpha — the Fifteen Rule's one allowed literal. */
+function isScrim(args) {
+  const parts = args.split(/[\s,/]+/).filter(Boolean);
+  if (parts.length !== 4) return false;
+  const rgb = parts.slice(0, 3).map((p) => p.toLowerCase());
+  const black = rgb.every((p) => p === '0' || p === '0%');
+  const white = rgb.every((p) => p === '255' || p === '100%');
+  return black || white;
+}
+
+function colourCount(value) {
+  let n = (value.match(HEX_RE) || []).length;
+  COLOUR_FN_RE.lastIndex = 0;
+  let m;
+  while ((m = COLOUR_FN_RE.exec(value))) {
+    const fn = m[0].slice(0, m[0].indexOf('(')).toLowerCase();
+    if ((fn === 'rgb' || fn === 'rgba') && isScrim(m[1])) continue;
+    n += 1;
+  }
+  return n;
+}
+
+function hasLength(value) {
+  LENGTH_RE.lastIndex = 0;
+  let m;
+  while ((m = LENGTH_RE.exec(value))) if (Number(m[1]) !== 0) return true;
+  return false;
+}
+
+/** The five counts for one stylesheet's text. */
+function countSheet(text) {
+  const counts = Object.fromEntries(KINDS.map((k) => [k, 0]));
+  const css = String(text).replace(COMMENT_RE, ' ').replace(URL_RE, 'url()');
+  AT_RULE_RE.lastIndex = 0;
+  let m;
+  while ((m = AT_RULE_RE.exec(css))) if (MEDIA_LENGTH_RE.test(m[2])) counts.breakpoints += 1;
+  DECL_RE.lastIndex = 0;
+  while ((m = DECL_RE.exec(css))) {
+    const prop = m[1].toLowerCase();
+    if (prop.startsWith('--')) continue; // a token definition
+    const value = m[2].replace(VAR_NAME_RE, ' ');
+    counts.colours += colourCount(value);
+    if ((prop === 'font-size' || prop === 'font') && hasLength(value)) counts.font_sizes += 1;
+    else if (prop.endsWith('radius') && hasLength(value)) counts.radii += 1;
+    else if ((prop === 'box-shadow' || prop === 'text-shadow') && !NO_SHADOW_RE.test(value)
+      && (hasLength(value) || colourCount(value) > 0)) counts.shadows += 1;
+  }
+  return counts;
+}
+
+function trackedStylesheets(root = ROOT) {
+  const out = execFileSync('git', ['ls-files', '-z', '--', '*.css'], { cwd: root, encoding: 'utf8' });
+  return out.split('\0').filter((f) => f && !EXCLUDE_RE.test(f)).sort();
+}
+
+/**
+ * Counts for every tracked stylesheet: { sheets: { [path]: counts }, scanned }.
+ * Sheets whose five counts are all zero are omitted (a missing sheet reads as zero).
+ */
+function scanCssLiterals({ root = ROOT, files = null, read = null } = {}) {
+  const list = files || trackedStylesheets(root);
+  const reader = read || ((f) => fs.readFileSync(path.join(root, f), 'utf8'));
+  const sheets = {};
+  let scanned = 0;
+  for (const f of list) {
+    let text;
+    try { text = reader(f); } catch { continue; }
+    scanned += 1;
+    const c = countSheet(text);
+    if (KINDS.some((k) => c[k] > 0)) sheets[f] = c;
+  }
+  return { sheets, scanned };
+}
+
+if (require.main === module) {
+  const { sheets, scanned } = scanCssLiterals();
+  const totals = Object.fromEntries(KINDS.map((k) => [k, 0]));
+  for (const [f, c] of Object.entries(sheets)) {
+    for (const k of KINDS) totals[k] += c[k];
+    if (process.argv.includes('--all') || KINDS.some((k) => c[k] > 0)) {
+      process.stdout.write(`${f}  ${KINDS.map((k) => `${k}=${c[k]}`).join(' ')}\n`);
+    }
+  }
+  process.stdout.write(`\n${scanned} stylesheet(s) scanned · totals ${KINDS.map((k) => `${k}=${totals[k]}`).join(' ')}\n`);
+}
+
+module.exports = { scanCssLiterals, countSheet, KINDS };

package/scripts/bongos/design-generators-fresh.js

@@ -0,0 +1,32 @@
+'use strict';
+// design-generators-fresh.js — the design system's generated files are fresh
+// (task 1005093, goal 1000138). Part of fitness.js's "generated artifacts fresh"
+// check; kept in its own file because fitness.js sits at the 1,500-line budget.
+//
+// Both generated files read the shared token sheet (modules/ui-design/public/tokens.css) and the brand pack; the public
+// reference also reads the hall's sheets and DESIGN.md. A stylesheet edit without a
+// regeneration used to surface only as a failing unit test; this names it in fitness.
+// Skipped when the ui-design module is not in the checkout. `root` is injectable for
+// tests/design_counts_ratchet.mjs, which runs it against a copied tree.
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const { REPO_ROOT } = require('./fitness-lib.js');
+
+function checkDesignGeneratorsFresh(root = REPO_ROOT) {
+  const violations = [];
+  for (const [script, out, task] of [
+    ['gen-design-tokens.js', 'config/design-tokens.neutral.json', '1005082'],
+    ['gen-design-reference.js', 'modules/ui-design/public/brand.html (the public /brand page)', '1005083'],
+  ]) {
+    const gen = path.join(root, 'modules', 'ui-design', 'scripts', script);
+    if (!fs.existsSync(gen)) continue;
+    try { execFileSync(process.execPath, [gen, '--check'], { cwd: root, stdio: 'pipe' }); }
+    catch { violations.push(`${out} is STALE — a design source (the token sheet, the brand pack, a hall sheet or DESIGN.md) changed without a regeneration. Run \`node modules/ui-design/scripts/${script}\` and commit (task ${task}).`); }
+  }
+  return violations;
+}
+
+module.exports = { checkDesignGeneratorsFresh };

package/scripts/bongos/fitness-ratchets.js

@@ -27,6 +27,13 @@
 //     docs-entropy scanner's three counts, reused as a library
 //   source_text_only_tests — test files that only read source text and match
 //     its wording, never running the code (task 1004868)
+//   design counts — PER STYLESHEET, the typed-in colours, font sizes, radii,
+//     shadows and breakpoints (task 1005093, goal 1000138; detector:
+//     css-literal-scan.js). Kept in their own `design_counts` object rather than
+//     `metrics` — ~60 sheets × 5 kinds would drown the metric line — but with the
+//     same verdict: higher than baseline fails, lower nudges a ratchet-down. A
+//     sheet with no baseline row has a baseline of zero, so a NEW sheet starts on
+//     the --ds-* tokens.
 //
 // The knip dead-code ratchet needs node_modules + ~seconds, so it is NOT part
 // of the in-suite check: CI runs `node scripts/bongos/fitness-ratchets.js --knip`
@@ -535,6 +542,46 @@ function skillListingMetrics() {
   }
 }
 
+// ---------- design counts (task 1005093) ----------
+
+const DESIGN_HINT = ' — use a --ds-* scale token (modules/ui-design/public/tokens.css) or one of the fifteen colour '
+  + 'tokens instead of a typed-in value (DESIGN.md, the Fifteen Rule). Run '
+  + '`node scripts/bongos/css-literal-scan.js` to see every sheet\'s counts and the rule.';
+
+// Current per-sheet counts, or null when the scan found no stylesheet at all —
+// a collapsed enumeration is a scan defect, never a flattering all-zero tree.
+function designCounts() {
+  const { scanCssLiterals } = require('./css-literal-scan.js');
+  const { sheets, scanned } = scanCssLiterals();
+  if (!scanned) {
+    process.stderr.write('fitness-ratchets: design counts NOT MEASURED — the stylesheet scan enumerated ZERO files, which is a scan defect, not a clean tree\n');
+    return null;
+  }
+  return sheets;
+}
+
+// Pure verdict over { sheet: { kind: n } } maps. Keys starting with `_` are notes.
+function compareDesignCounts(current, baseline) {
+  const { KINDS } = require('./css-literal-scan.js');
+  const violations = [];
+  const warnings = [];
+  const sheets = new Set([...Object.keys(current || {}), ...Object.keys(baseline || {})].filter((k) => !k.startsWith('_')));
+  for (const sheet of [...sheets].sort()) {
+    const cur = (current || {})[sheet] || {};
+    const base = (baseline || {})[sheet] || {};
+    for (const kind of KINDS) {
+      const value = cur[kind] || 0;
+      const floor = base[kind] || 0;
+      if (value > floor) {
+        violations.push(`design count ${kind} in ${sheet} regressed: ${value} > baseline ${floor} — fix the regression; never raise the baseline to pass${DESIGN_HINT}`);
+      } else if (value < floor) {
+        warnings.push(`ratchet-down available: design count ${kind} in ${sheet} improved to ${value} (baseline ${floor}) — lower it in config/fitness-baselines.json design_counts`);
+      }
+    }
+  }
+  return { violations, warnings };
+}
+
 function computeMetrics({ withDocs = true } = {}) {
   const files = trackedJsFiles();
   const contents = new Map(files.map((f) => [f, readRepoFile(f)]));
@@ -560,15 +607,28 @@ function computeMetrics({ withDocs = true } = {}) {
 // computeMetrics() sweep — git ls-files plus every tracked .js plus the
 // docs-entropy scan, measured at 23.7s + 2.5s + 2.8s, i.e. ~29s of this file's
 // 29s runtime, which is what pushed it into the 90s timeout in the first place.
-function checkQualityRatchets({ baselinePath = BASELINE_PATH, metrics: injectedMetrics = null } = {}) {
+// `designCounts` (task 1005093) is injectable the same way; when a test injects
+// `metrics` alone, the stylesheet scan is skipped rather than run for real.
+function checkQualityRatchets({ baselinePath = BASELINE_PATH, metrics: injectedMetrics = null, designCounts: injectedDesign = null } = {}) {
   const metrics = injectedMetrics === null ? computeMetrics() : injectedMetrics;
-  const { metrics: baselines, error: baselineError } = readBaselines(baselinePath);
+  const { metrics: baselines, error: baselineError, parsed } = readBaselines(baselinePath);
   const { violations, warnings } = compareToBaselines(metrics, baselines);
+  const design = injectedDesign !== null ? injectedDesign : (injectedMetrics === null ? designCounts() : null);
+  if (design) {
+    const designBaseline = parsed && parsed.design_counts;
+    if (!baselineError && (!designBaseline || typeof designBaseline !== 'object')) {
+      violations.push('config/fitness-baselines.json has no "design_counts" object — the per-stylesheet design ratchet cannot verify anything, so it fails CLOSED. Bootstrap deliberately: node scripts/bongos/fitness-ratchets.js --update-baselines');
+    } else if (designBaseline) {
+      const d = compareDesignCounts(design, designBaseline);
+      violations.push(...d.violations);
+      warnings.push(...d.warnings);
+    }
+  }
   // task 1003227: an unreadable baseline file is a hard failure, not silence. Put it
   // FIRST so it is the headline rather than buried under per-metric noise.
   if (baselineError) violations.unshift(baselineError);
   return {
-    name: 'quality ratchets — size, duplication, cycles, console, doc entropy, legacy GDS literals, source-text-only tests only tighten (task 1003129)',
+    name: 'quality ratchets — size, duplication, cycles, console, doc entropy, legacy GDS literals, source-text-only tests, per-stylesheet design counts only tighten (task 1003129)',
     hardFail: violations.length > 0,
     violations,
     warnings,
@@ -598,6 +658,12 @@ function main() {
     // this file cannot be eaten by a refresh either.
     const preserved = existingFile && typeof existingFile === 'object' ? { ...existingFile } : {};
     delete preserved.metrics;
+    // design_counts is recomputed too (task 1005093), keeping its `_` notes.
+    const design = designCounts();
+    if (design) {
+      const notes = Object.fromEntries(Object.entries(preserved.design_counts || {}).filter(([k]) => k.startsWith('_')));
+      preserved.design_counts = { ...notes, ...design };
+    }
     if (!preserved._comment) {
       preserved._comment = 'fitness-ratchets baselines (task 1003129): quality debt recorded at gate-adoption. Shrink-only — lower a value when the metric improves; raising one to pass CI is out of policy.';
     }
@@ -647,6 +713,7 @@ module.exports = {
   readBaselines,
   computeMetrics,
   compareToBaselines,
+  compareDesignCounts,
   sourceTextTestMetrics,
   duplicateWindowCount,
   normalizeLines,

package/scripts/bongos/fitness.js

@@ -200,7 +200,7 @@ function checkNestedDocsPresent() {
 // here would false-fail every PR (the gitignored whole file is absent from a clean checkout, so it
 // always reads as "would change"); `--check-block` is the exact, non-noisy gate. (docs/file-map.md +
 // the OpenAPI docs are still fully committed and unchanged by ADR 0110 — they keep the plain --check.)
-function checkGeneratedArtifactsFresh() {
+function checkGeneratedArtifactsFresh({ designRoot = REPO_ROOT } = {}) { // designRoot: tests only (task 1005093)
   const violations = [];
   try {
     execFileSync(process.execPath, [path.join(__dirname, 'gen-repo-map.js'), '--check-block'], { cwd: REPO_ROOT, stdio: 'pipe' });
@@ -254,9 +254,10 @@ function checkGeneratedArtifactsFresh() {
   } catch {
     violations.push('docs/page-inventory.json + docs/page-inventory.md are STALE (or two pages claim one id) — a page was added, renamed, retitled or changed its scripts/states. Run `node scripts/bongos/page-inventory.js` and commit (task 1004314).');
   }
+  violations.push(...require('./design-generators-fresh.js').checkDesignGeneratorsFresh(designRoot)); // task 1005093
   // NB the role packs' responsibility blocks are generated too, but their freshness
   // is asserted by role-pack-guard.js — one check owns "the packs are correct".
-  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections, the API spec + typed client GENERATE from the routes (both gitignored, task 1004866), docs/copy-registry.json + copy-inventory.md (the reader-facing copy, task 1003556) and docs/page-inventory.json + page-inventory.md (every page and its stable id, task 1004314). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
+  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections, the API spec + typed client GENERATE from the routes (both gitignored, task 1004866), docs/copy-registry.json + copy-inventory.md (the reader-facing copy, task 1003556) and docs/page-inventory.json + page-inventory.md (every page and its stable id, task 1004314), and the design system config/design-tokens.neutral.json + public /brand reference (task 1005093). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
 }
 
 // ---- deterministic cron routine boundary (System 4 / ADR 0078) -------------

package/scripts/bongos/provision-core-upgrade.js

@@ -338,6 +338,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     log(`  ✓ would then read ${versionUrl} on the box and require it to say ${to}`);
     return { ok: true, served: null, preflight: verdict };
   }
+  backfillHubUpgradeUrl(inst, deps, boxExec);
   try {
     log(`  [upgrade] (in ${runDir}) ${cmd}`);
     boxExec(cmd, { cwd: runDir });
@@ -672,6 +673,34 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
 // HERE rather than left to instanceUser()'s own throw: that throw is correct today, but
 // a call site whose safety depends on a helper's internals is one refactor away from a
 // shell-injection path (and the apply leg's own guard sits at the route, not here).
+// WHERE THIS PROJECT'S UPDATE BUTTON GOES, written on every move (task 1005128): a project
+// provisioned before task 1004608 has no <PREFIX>_HUB_UPGRADE_URL line, and only a
+// settings-apply ever wrote one. The move restarts the service, so the line is read the moment
+// the new core comes up. BEST-EFFORT: it is written before the move and never decides it; an
+// unreadable file, a refused write or a line already right changes nothing and fails nothing.
+function backfillHubUpgradeUrl(inst, deps, boxExec) {
+  // The slug is interpolated into a shell command below, so it is checked HERE, at the point
+  // of use, not trusted to a caller that validated it earlier (the rule coreUpgradeInstance
+  // states for its own command).
+  if (!inst || !isValidSlug(inst.slug)) return false;
+  try {
+    const { hubUpgradeEnvPatch, webEnvPath } = require('./provision-units.js'); // eslint-disable-line global-require
+    const sudoP = deps.privileged ? 'sudo ' : '';
+    const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
+    if (!read || read.softFailed) return false;
+    const next = hubUpgradeEnvPatch(read.stdout, inst);
+    if (!next) return false;
+    const write = inst.hosting_shape === 'cloud-host' ? (deps.controlWriteFile || deps.writeFile) : deps.writeFile;
+    if (typeof write !== 'function') return false;
+    write(webEnvPath(inst), next, { mode: 0o600, sudo: true });
+    deps.log('  [config] wrote where this project\'s Update button goes into web.env (read on restart)');
+    return true;
+  } catch (e) {
+    deps.log(`  [config] could not write the Update button's address (${(e && e.message) || e}); the move goes on`);
+    return false;
+  }
+}
+
 function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', automatic = false, selfRoot = selfInstanceRoot, runAs = null, migrateAs = null } = {}) {
   if (!isValidSlug(inst && inst.slug)) {
     throw new Error(`upgradeInvocation: refusing to build a shell command from an invalid slug ${JSON.stringify(inst && inst.slug)}`);
@@ -1164,4 +1193,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, backfillHubUpgradeUrl, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/bongos/provision-units.js

@@ -447,9 +447,27 @@ function hubUpgradeEnvVarsFor(inst) {
   return { [`${provisionedEnvPrefix()}_HUB_UPGRADE_URL`]: origin ? `${origin}/deploy?project=${encodeURIComponent(String(inst.slug))}` : '' };
 }
 
+// THE BACKFILL (task 1005128). Only a settings-apply wrote that line, and one runs only when a
+// setting changes, so a project provisioned before task 1004608 (toast) never got it and its
+// owner was offered "Ask for this upgrade" instead of the Update button. Every core move now
+// carries the line too: the web.env as it stands, with that ONE line set, or null when it is
+// already right, there is nothing to write, or the file is empty (a missing file is never
+// "patched" into a one-line body). PURE; the core-upgrade leg does the read and the write.
+function hubUpgradeEnvPatch(body, inst) {
+  const vars = hubUpgradeEnvVarsFor(inst);
+  const [key] = Object.keys(vars);
+  const text = String(body == null ? '' : body);
+  if (!key || !vars[key] || !text.trim()) return null;
+  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const have = new RegExp(`^${esc}=(.*)$`, 'm').exec(text);
+  if (have && have[1].trim() === vars[key]) return null;
+  return upsertEnvVars(text, vars);
+}
+
 module.exports = {
   federationHubOrigin,
   hubUpgradeEnvVarsFor,
+  hubUpgradeEnvPatch,
   ENV_PREFIX_PACK,
   envPrefixMismatch,
   normalizePackEnvPrefix,