@bongos/core 1.24.57 → 1.24.59

package/modules/hall-ui/public/settings-software-update.js

@@ -66,49 +66,12 @@
     </div>`;
   }
 
-  // "Ask for this upgrade" (task 1004595). A project the hub's operator runs cannot take an
-  // update itself, so instead of a dead end the page offers one press that reaches the people
-  // who run its server, and then says that it was asked. The server decides whether it is
-  // offered (`ask.available`) and remembers the request (`ask.requested`).
   function longDate(iso) {
     const d = new Date(iso);
     if (!Number.isFinite(d.getTime())) return null;
     try { return d.toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' }); } catch (e) { return d.toISOString().slice(0, 10); }
   }
 
-  // Asked, and still waiting: for this very version, or recently enough that asking again
-  // would only be refused.
-  function askPending(ask, offered) {
-    const r = ask && ask.requested;
-    if (!r) return false;
-    if (r.version === offered) return true;
-    const again = Date.parse(ask.ask_again_after);
-    return Number.isFinite(again) && Date.now() < again;
-  }
-
-  function askHtml(ask, offered, { lead }) {
-    const team = ask.hub_host ? `the team at ${escapeHtml(ask.hub_host)}` : 'the team that runs this project\'s server';
-    if (askPending(ask, offered)) {
-      const r = ask.requested;
-      const when = longDate(r.requested_at);
-      return `<div class="su-door su-ask">
-      <p class="panel-status panel-status--ok" role="status">Upgrade requested${when ? ` on ${escapeHtml(when)}` : ''}${r.by ? ` by @${escapeHtml(r.by)}` : ''}, for version ${mono(r.version)}. ${team.charAt(0).toUpperCase() + team.slice(1)} has your request. This page shows the new version once it is installed.</p>
-    </div>`;
-    }
-    const last = ask.requested && longDate(ask.requested.requested_at);
-    const before = last ? ` You last asked on ${escapeHtml(last)}, for ${mono(ask.requested.version)}.` : '';
-    const intro = lead
-      ? `<p class="panel-hint">This project runs on a server that ${team} looks after, so they install its updates. Ask them for this one and they are told which version you want.${before}</p>`
-      : `<p class="panel-hint">If that page does not let you in, ask ${team} to install it for you.${before}</p>`;
-    return `<div class="su-door su-ask">
-      ${intro}
-      <div class="row-end">
-        <button type="button" class="pbtn ${lead ? 'pbtn--save' : 'pbtn--quiet'}" id="su-ask">Ask for this upgrade</button>
-        <span class="panel-hint" id="su-ask-status" role="status"></span>
-      </div>
-    </div>`;
-  }
-
   // Where the Update button goes, and what it says it will do. Only a plain same-origin path
   // or an http(s) URL is ever put in an href; anything else draws no button.
   function doorHtml(data, offered) {
@@ -116,9 +79,9 @@
     if (!data.can_update) {
       return '<p class="panel-hint su-door">Only the people allowed to upgrade this project see an Update button here.</p>';
     }
-    const ask = data.ask || {};
+    // No request-the-upgrade button any more (task 1005128): a project the hub hosts always has
+    // the hub's door, so `cli` is only ever a server its owner runs themselves.
     if (door.kind === 'cli') {
-      if (ask.available) return askHtml(ask, offered, { lead: true });
       return '<p class="panel-hint su-door">This project is upgraded on the server that runs it: <code>bongos upgrade</code> there takes this version, with the same health check and rollback.</p>';
     }
     const url = String(door.url || '');
@@ -134,7 +97,7 @@
     return `<div class="row-end su-door">
       <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}</a>
       <span class="panel-hint">Takes a few minutes. The project restarts once, checks itself, and goes back to the version it runs now if it does not come back healthy.${where ? ` A small window from ${escapeHtml(where)} opens for a moment to start it.` : ''}</span>
-    </div>${door.kind === 'hub' && ask.available ? askHtml(ask, offered, { lead: false }) : ''}`;
+    </div>`;
   }
 
   // One entry: its text, and — only in the hall whose ledger the ids belong to, which is
@@ -223,8 +186,7 @@
       html += row('Newest for this project', `${mono(u.running)} — this project is up to date.`, '<span class="su-pill su-pill--ok">Up to date</span>');
     } else {
       const when = ago(u.offered_published_at);
-      const pending = data.can_update && data.ask && data.ask.available && askPending(data.ask, u.offered);
-      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${onHold ? 'On hold' : pending ? 'Requested' : 'Update ready'}</span>`);
+      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${onHold ? 'On hold' : 'Update ready'}</span>`);
       // No button to take again the very version that was just rolled back here (task 1004730).
       if (!onHold) html += doorHtml(data, u.offered);
       html += whatsNewHtml(u.whats_new, (data.door || {}).kind === 'local');
@@ -237,9 +199,6 @@
     body.innerHTML = html + historyHtml(data.history);
     if (note) note.textContent = notes.join(' ');
 
-    const askBtn = byId('su-ask');
-    if (askBtn) askBtn.addEventListener('click', () => askForUpgrade(data, askBtn));
-
     // The same press as the pill's Update now; only when it took the update in place is the
     // link's own navigation stopped.
     const updateBtn = byId('su-update');
@@ -259,32 +218,6 @@
     }
   }
 
-  // One press: the server sends the request and remembers it; the panel redraws from its
-  // answer. "Asked recently" carries the stored request, so it redraws as pending too.
-  async function askForUpgrade(data, btn) {
-    const status = byId('su-ask-status');
-    btn.disabled = true;
-    btn.textContent = 'Asking…';
-    if (status) status.textContent = '';
-    try {
-      const res = await api.request('POST', `${API}/software-update/request`, { body: {} });
-      const err = (res.data && res.data.error) || {};
-      const request = (res.data && res.data.request) || (err.details && err.details.request);
-      if ((res.ok || res.status === 429) && request) {
-        const again = new Date(Date.parse(request.requested_at) + 24 * 3600 * 1000).toISOString();
-        render({ ...data, ask: { ...data.ask, requested: request, ask_again_after: again } });
-        return;
-      }
-      // Every refusal the server sends carries a sentence; a bare code is only ever a
-      // proxy or a crash, so the status stands in for it.
-      throw new Error(err.message && err.message !== err.code ? err.message : `HTTP ${res.status}`);
-    } catch (e) {
-      btn.disabled = false;
-      btn.textContent = 'Ask for this upgrade';
-      if (status) status.textContent = `Could not send the request: ${String(e.message || 'unknown error').replace(/\.$/, '')}.`;
-    }
-  }
-
   async function load() {
     if (asked) return;
     asked = true;

package/modules/hall-ui/public/update-pill.js

@@ -23,7 +23,6 @@
 //          with &handoff=1, this page tells it the version over postMessage, and the hub
 //          posts the move with the owner's OWN hub session (deploy-handoff.js). This
 //          project's server gains no capability; the only thing that crosses is a version.
-//   ask    a hosted project the hub's operator runs: "Ask for this update" (task 1004595).
 //   cli    a self-hosted instance: no button; the card names the command.
 //
 // PROGRESS IS READ, NEVER GUESSED (deploy.js's rule). The page watches its own public
@@ -41,9 +40,10 @@
   var RUN_KEY = 'bongos.update.run';
   var MSG = 'bongos-update'; // the tag deploy-handoff.js answers to; both sides check it
   var VERSION_RE = /^\d+\.\d+\.\d+$/;
-  // A hub door as the server words it (core-update.js HUB_UPGRADE_URL_RE's shape): an
-  // origin and /deploy?project=<slug>, nothing else. Anything else draws no button.
-  var HUB_DOOR_RE = /^(https?:\/\/[^\s"'<>/]+)\/deploy\?project=[A-Za-z0-9._%-]+$/;
+  // A hub door as the server words it (core-update.js updateDoor): an origin and
+  // /deploy?project=<slug>, or /deploy?host=<address> for a hosted project whose server never
+  // learned its slug (task 1005128). Anything else draws no button.
+  var HUB_DOOR_RE = /^(https?:\/\/[^\s"'<>/]+)\/deploy\?(?:project|host)=[A-Za-z0-9._%-]+$/;
   var SETTINGS_HREF = '/settings#software-update';
   var HIGHLIGHTS = 3;
   var LINE_MAX = 120;
@@ -101,14 +101,13 @@
   function doorPlan(sw) {
     if (!sw || sw.can_update !== true) return { kind: 'none' };
     var door = sw.door || {};
-    var ask = sw.ask || {};
     if (door.kind === 'local' && door.url === '/deploy') return { kind: 'local' };
     if (door.kind === 'hub') {
       var m = HUB_DOOR_RE.exec(String(door.url || ''));
-      if (!m) return ask.available ? { kind: 'ask' } : { kind: 'none' };
+      if (!m) return { kind: 'none' };
       return { kind: 'hub', url: door.url, origin: m[1] };
     }
-    if (door.kind === 'cli') return ask.available ? { kind: 'ask' } : { kind: 'cli' };
+    if (door.kind === 'cli') return { kind: 'cli' };
     return { kind: 'none' };
   }
 
@@ -263,13 +262,6 @@
       note = '<p class="upd-card__note">Takes a few minutes. The project restarts once, and goes back to the version it runs now on its own if the new one is not healthy.' +
         (host ? ' A small window from ' + esc(host) + ' opens for a moment to start it.' : '') + '</p>';
       action = '<button type="button" class="upd-btn upd-btn--go" id="upd-go">Update now</button>';
-    } else if (plan.kind === 'ask') {
-      var ask = state.sw.ask || {};
-      var team = ask.hub_host ? 'the team at ' + ask.hub_host : 'the team that runs this project\'s server';
-      var asked = ask.requested && ask.requested.version === state.offered;
-      note = '<p class="upd-card__note">' + esc(asked ? 'You asked ' + team + ' for this update. This shows the new version once it is installed.'
-        : 'This project runs on a server that ' + team + ' looks after, so they install its updates.') + '</p>';
-      if (!asked) action = '<button type="button" class="upd-btn upd-btn--go" id="upd-ask">Ask for this update</button>';
     } else if (plan.kind === 'cli') {
       note = '<p class="upd-card__note">This project is updated on the server that runs it: <code>bongos upgrade</code> there takes this version, and puts the old one back if it fails.</p>';
     } else {
@@ -294,7 +286,6 @@
     var on = function (id, fn) { var el = c.querySelector('#' + id); if (el) el.addEventListener('click', fn); };
     on('upd-close', closeCard);
     on('upd-go', function () { updateNow(); });
-    on('upd-ask', function (e) { askForIt(e.currentTarget); });
     on('upd-reload', reload);
     on('upd-open', function () { updateNow(); });
   }
@@ -565,22 +556,6 @@
     if (root.location && root.location.reload) root.location.reload();
   }
 
-  // "Ask for this update" (task 1004595): one press reaches the people who run the server.
-  function askForIt(btn) {
-    btn.disabled = true;
-    btn.textContent = 'Asking…';
-    state.api.request('POST', '/api/bongos/software-update/request', { body: {} }).then(function (res) {
-      var data = (res && res.data) || {};
-      var request = data.request || (data.error && data.error.details && data.error.details.request);
-      if (!((res.ok || res.status === 429) && request)) throw new Error(errorOf(res, 'Could not send the request.'));
-      state.sw.ask = Object.assign({}, state.sw.ask, { requested: request });
-      drawCard();
-    }).then(null, function (e) {
-      state.error = String((e && e.message) || 'Could not send the request.');
-      drawCard();
-    });
-  }
-
   /** shell.js hands over GET /core-update's answer; the pill decides what, if anything, to show. */
   function mount(data, opts) {
     state.api = opts && opts.api;

package/modules/status-ui/public/style.css

@@ -250,11 +250,14 @@ a:hover { text-decoration-color: currentColor; }
   /* drawn from the one mark (modules/ui-design/public/brand/mark.svg, task 1005088) */
   --mark-ink: var(--ink);
 }
+/* the wordmark: the pack's productName, lowercase and light, as the hall's lockup
+   (DESIGN.md "Naming"; task 1005135) */
 .topbar__name {
   font-family: var(--font-display);
-  font-size: var(--ds-text-xl);
-  font-weight: 500;
+  font-size: var(--ds-text-lg);
+  font-weight: 300;
   letter-spacing: -0.01em;
+  text-transform: lowercase;
   color: var(--ink);
   white-space: nowrap;
   overflow: hidden;

package/modules/ui-design/public/brand/png-sources.json

@@ -0,0 +1,10 @@
+{
+  "apple-touch-icon.png": {
+    "page": "b665654a1cdfa7fb91f9aef0ab4a06831922c2e12bd7eb3dea572dd0db4988a2",
+    "png": "953557984586881b25452b8642f595dfad39d17b86459cee5c5b080b74165362"
+  },
+  "og-card.png": {
+    "page": "5f7d738dd440ed4760017fe4e468ec8a593745536336f819d4a3bd2c32a5c38d",
+    "png": "e168fdd0f4ac94754af089e7240be7cbba46704b36a617252f2942c97e8835e2"
+  }
+}

package/modules/ui-design/public/brand.css

@@ -15,6 +15,11 @@ body[data-page="brand"] {
   font-family: var(--font-body);
 }
 
+/* The hall's sheet paints its plate veil as a fixed body::after over the page
+   (black in dark); the hall lifts its shell above it, and so does this page —
+   otherwise the whole reference reads through the veil, dimmed (task 1005135). */
+body[data-page="brand"] > * { position: relative; z-index: 1; }
+
 /* ---- the bar: the mark, the name, the sections ---- */
 .ref-head {
   box-sizing: border-box;
@@ -134,6 +139,7 @@ body[data-page="brand"] {
   font-weight: 300;
   font-size: var(--ds-text-headline);
   letter-spacing: -0.01em;
+  text-transform: lowercase;
   color: var(--ink);
 }
 .ref-lockup__mark { width: 72px; height: 72px; }

package/modules/ui-design/public/brand.html

@@ -13,7 +13,7 @@
 </head>
 <body data-page="brand">
 <header class="ref-head">
-  <a class="ref-head__brand" href="/"><svg class="ref-head__mark" viewBox="0 0 200 200" aria-hidden="true"><use href="/modules/ui-design/public/brand/mark.svg#mark"/></svg><span>cloud bongos</span></a>
+  <a class="ref-head__brand" href="/"><svg class="ref-head__mark" viewBox="0 0 200 200" aria-hidden="true"><use href="/modules/ui-design/public/brand/mark.svg#mark"/></svg><span>{{productName}}</span></a>
 </header>
 <main class="ref-main">
   <h1 class="ref-title">Design system</h1>
@@ -27,7 +27,7 @@
     
     <div class="ref-lockup">
       <svg class="ref-lockup__mark" viewBox="0 0 200 200" aria-hidden="true"><use href="/modules/ui-design/public/brand/mark.svg#mark"/></svg>
-      <span class="ref-lockup__name">cloud bongos</span>
+      <span class="ref-lockup__name">{{productName}}</span>
     </div>
     <div class="ref-naming">
       <p><strong>The wordmark is lowercase; the name in a sentence is capitalised</strong> (owner, 2026-11-06):</p>

package/modules/ui-design/scripts/gen-design-reference.js

@@ -152,7 +152,6 @@ function build(src = read()) {
   for (const cls of NEEDS) {
     if (!new RegExp(cls.replace(/[.[\]-]/g, '\\$&') + '(?![a-z0-9_-])').test(allCss)) throw new Error(`the hall's sheets no longer define ${cls}`);
   }
-  const product = (src.pack.identity && src.pack.identity.productName) || '';
   const naming = readNaming(src.design);
   const files = readBrandFiles(src.genBrand, SRC.brandDir);
   const OTB = src.otb;
@@ -199,7 +198,7 @@ function build(src = read()) {
   parts.push(section('ref-logo', 'Logo and name', 'The mark is one file every page draws from. The ring and the planet take the ink; the moon takes the accent.', `
     <div class="ref-lockup">
       <svg class="ref-lockup__mark" viewBox="0 0 200 200" aria-hidden="true"><use href="${BRAND_URL}mark.svg#mark"/></svg>
-      <span class="ref-lockup__name">${esc(product.toLowerCase())}</span>
+      <span class="ref-lockup__name">{{productName}}</span>
     </div>
     <div class="ref-naming">
       ${naming.lead.map((p) => `<p>${p}</p>`).join('\n      ')}
@@ -315,7 +314,7 @@ function build(src = read()) {
 </head>
 <body data-page="brand">
 <header class="ref-head">
-  <a class="ref-head__brand" href="/"><svg class="ref-head__mark" viewBox="0 0 200 200" aria-hidden="true"><use href="${BRAND_URL}mark.svg#mark"/></svg><span>${esc(product.toLowerCase())}</span></a>
+  <a class="ref-head__brand" href="/"><svg class="ref-head__mark" viewBox="0 0 200 200" aria-hidden="true"><use href="${BRAND_URL}mark.svg#mark"/></svg><span>{{productName}}</span></a>
 </header>
 <main class="ref-main">
   <h1 class="ref-title">Design system</h1>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.57",
+  "version": "1.24.59",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.57",
+      "version": "1.24.59",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.57",
+  "version": "1.24.59",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-docs/index.html

@@ -54,6 +54,8 @@
     }
     #topbar .mark { width: 28px; height: 28px; flex-shrink: 0; --mark-ink: var(--ink); }
     #topbar strong { font-family: var(--font-display); font-size: var(--ds-text-xl); font-weight: 500; }
+    /* the wordmark: the pack's productName, lowercase and light (DESIGN.md "Naming"; task 1005135) */
+    #topbar .wordmark { font-size: var(--ds-text-lg); font-weight: 300; letter-spacing: -0.01em; text-transform: lowercase; }
     #topbar .muted {
       font-family: var(--font-mono); font-size: var(--ds-text-2xs); letter-spacing: .12em;
       text-transform: uppercase; color: var(--ink-soft);
@@ -72,7 +74,7 @@
 <body>
   <div id="topbar">
     <svg class="mark" viewBox="0 0 200 200" aria-hidden="true"><use href="/modules/ui-design/public/brand/mark.svg#mark"/></svg>
-    <strong>{{productName}} — API</strong>
+    <strong><span class="wordmark">{{productName}}</span> — API</strong>
     <span class="muted">OpenAPI 3.1</span>
     <span class="spacer"></span>
     <a href="/docs/openapi.json" download>Download spec</a>

package/release-notes.json

@@ -11313,5 +11313,21 @@
       "id": "1005093",
       "text": "Stylesheets can no longer gain new typed-in colours, text sizes, corners, shadows or breakpoints without the build failing, and the public design reference must be regenerated whenever its sources change."
     }
+  ],
+  "1.24.58": [
+    {
+      "id": "1005128",
+      "text": "A project's owner now takes a new Bongos version with one Update button; the \"ask the team for this upgrade\" step is gone for every hosted project."
+    }
+  ],
+  "1.24.59": [
+    {
+      "id": "1005135",
+      "text": "The name beside the logo now reads 'cloud bongos' in lowercase everywhere, taken from the project's branding, and the sign-in and error pages use the same fonts and colours as the rest of the site."
+    },
+    {
+      "id": "1005133",
+      "text": "The logo files and the link-preview pictures are now checked automatically, so a logo change can no longer ship with out-of-date copies; the docs now say plainly that the off-site status page is updated by hand."
+    }
   ]
 }

package/scripts/bongos/design-generators-fresh.js

@@ -4,7 +4,8 @@
 // check; kept in its own file because fitness.js sits at the 1,500-line budget.
 //
 // Both generated files read the shared token sheet (modules/ui-design/public/tokens.css) and the brand pack; the public
-// reference also reads the hall's sheets and DESIGN.md. A stylesheet edit without a
+// reference also reads the hall's sheets and DESIGN.md. The logo set (scripts/bongos/gen-brand.js)
+// reads mark.svg and the pack, and checks its two PNGs by hash (task 1005133). A stylesheet edit without a
 // regeneration used to surface only as a failing unit test; this names it in fitness.
 // Skipped when the ui-design module is not in the checkout. `root` is injectable for
 // tests/design_counts_ratchet.mjs, which runs it against a copied tree.
@@ -17,14 +18,21 @@ const { REPO_ROOT } = require('./fitness-lib.js');
 
 function checkDesignGeneratorsFresh(root = REPO_ROOT) {
   const violations = [];
-  for (const [script, out, task] of [
-    ['gen-design-tokens.js', 'config/design-tokens.neutral.json', '1005082'],
-    ['gen-design-reference.js', 'modules/ui-design/public/brand.html (the public /brand page)', '1005083'],
+  const UI = ['modules', 'ui-design', 'scripts'];
+  for (const [dir, script, out, why, task] of [
+    [UI, 'gen-design-tokens.js', 'config/design-tokens.neutral.json', 'a design source (the token sheet, the brand pack, a hall sheet or DESIGN.md)', '1005082'],
+    [UI, 'gen-design-reference.js', 'modules/ui-design/public/brand.html (the public /brand page)', 'a design source (the token sheet, the brand pack, a hall sheet or DESIGN.md)', '1005083'],
+    // The logo and favicon set, and the two PNGs by hash (task 1005133): mark.svg or the
+    // pack's colours changed without a regeneration. A PNG needs `--png` (a system browser).
+    [['scripts', 'bongos'], 'gen-brand.js', 'the logo set in modules/ui-design/public/brand/', 'mark.svg or the brand pack', '1005133'],
   ]) {
-    const gen = path.join(root, 'modules', 'ui-design', 'scripts', script);
+    const gen = path.join(root, ...dir, script);
     if (!fs.existsSync(gen)) continue;
     try { execFileSync(process.execPath, [gen, '--check'], { cwd: root, stdio: 'pipe' }); }
-    catch { violations.push(`${out} is STALE — a design source (the token sheet, the brand pack, a hall sheet or DESIGN.md) changed without a regeneration. Run \`node modules/ui-design/scripts/${script}\` and commit (task ${task}).`); }
+    catch (e) {
+      const said = String((e && e.stderr) || '').trim().split('\n').filter(Boolean).join(' ');
+      violations.push(`${out} is STALE — ${why} changed without a regeneration. Run \`node ${[...dir, script].join('/')}\`${script === 'gen-brand.js' ? ' (with --png for a PNG)' : ''} and commit (task ${task}).${said ? ` [${said}]` : ''}`);
+    }
   }
   return violations;
 }

package/scripts/bongos/gen-brand.js

@@ -17,17 +17,23 @@
 //   og-card.png      1200x630, the link-preview card every public page names (task 1005091):
 //                    the dark mark and the lowercase wordmark on the void (--png; needs a browser)
 //
-// Deterministic text, so `--check` is a clean gate (tests/brand_mark.mjs runs it). The PNG is
-// rendered by the system browser and only written with --png.
+// Deterministic text, so `--check` is a clean gate (tests/brand_mark.mjs runs it; fitness runs it
+// through scripts/bongos/design-generators-fresh.js). The PNGs are rendered by the system browser
+// and only written with --png; a browser's pixels are not byte-stable across machines, so they
+// are checked by hash instead (task 1005133): --png records, in png-sources.json beside them,
+// a hash of the exact page each was rendered from and a hash of the PNG written. --check fails
+// when the page a PNG would be rendered from today differs from the one recorded (a source or a
+// colour moved without a re-render), or when the PNG is not the one that render wrote.
 //
 // Usage:
 //   node scripts/bongos/gen-brand.js          # write the SVG variants
 //   node scripts/bongos/gen-brand.js --png    # … and render apple-touch-icon.png + og-card.png
-//   node scripts/bongos/gen-brand.js --check  # write nothing; exit 2 if a variant is stale
+//   node scripts/bongos/gen-brand.js --check  # write nothing; exit 2 if a variant or a PNG is stale
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { NIGHT_INK, readMarkSource, markParts, markFile, faviconSvg } = require('../../src/brand-mark');
+const crypto = require('node:crypto');
+const { readMarkSource, markParts, markFile, faviconSvg } = require('../../src/brand-mark');
 const { escapeHtml } = require('../../src/html-escape');
 
 const ROOT = path.resolve(__dirname, '..', '..');
@@ -59,22 +65,71 @@ function ogCardHtml({ markSvg, name, fontLinks = [], fontFamily = 'sans-serif' }
     '</body></html>';
 }
 
-async function renderOgCard(dir) {
+// The page apple-touch-icon.png is rendered from: the light mark on the pack's ground. Pure.
+function touchIconHtml({ markSvg, bg }) {
+  return `<html><body style="margin:0;background:${bg}">` +
+    `<img src="data:image/svg+xml;base64,${Buffer.from(markSvg).toString('base64')}" style="display:block;width:128px;height:128px;margin:26px">` +
+    '</body></html>';
+}
+
+// Each PNG as the exact page and viewport it is rendered from, given the SVG variants it
+// draws (the text gen-brand writes, not the files on disk, so a stale SVG shows here too).
+function pngPages(files, pack) {
+  return {
+    'apple-touch-icon.png': {
+      width: 180, height: 180, wait: 'load',
+      html: touchIconHtml({ markSvg: files['mark-light.svg'], bg: pack.theme.ui.colors.bg }),
+    },
+    'og-card.png': {
+      width: 1200, height: 630, wait: 'networkidle',
+      html: ogCardHtml({
+        markSvg: files['mark-dark.svg'],
+        name: pack.identity.productName,
+        fontLinks: pack.theme.ui.fonts.links,
+        fontFamily: pack.theme.ui.fonts.display,
+      }),
+    },
+  };
+}
+
+const sha256 = (buf) => crypto.createHash('sha256').update(buf).digest('hex');
+// The hash of a render's input: the page and the viewport it is shot at.
+function pageHash(p) { return sha256(JSON.stringify([p.width, p.height, p.html])); }
+
+const PNG_MANIFEST = 'png-sources.json';
+
+// The PNGs that do not match what --png would write today, each with the reason. Pure I/O
+// read of the brand folder; writes nothing.
+function stalePngs(dir, pages) {
+  let manifest = {};
+  try { manifest = JSON.parse(fs.readFileSync(path.join(dir, PNG_MANIFEST), 'utf8')); } catch { manifest = {}; }
+  const stale = [];
+  for (const [name, p] of Object.entries(pages)) {
+    const rec = manifest[name];
+    const file = path.join(dir, name);
+    if (!rec || !fs.existsSync(file)) { stale.push(`${name} (not recorded in ${PNG_MANIFEST})`); continue; }
+    if (rec.page !== pageHash(p)) stale.push(`${name} (its source page changed since it was rendered)`);
+    else if (rec.png !== sha256(fs.readFileSync(file))) stale.push(`${name} (the file is not the one --png wrote)`);
+  }
+  return stale;
+}
+
+async function renderPngs(dir, pages) {
   const { launchBrowser } = require('../../modules/ui-design/kit/lib'); // eslint-disable-line global-require
-  const pack = readPack();
   const browser = await launchBrowser();
+  const manifest = {};
   try {
-    const page = await browser.newPage({ viewport: { width: 1200, height: 630 }, deviceScaleFactor: 1 });
-    await page.setContent(ogCardHtml({
-      markSvg: fs.readFileSync(path.join(dir, 'mark-dark.svg'), 'utf8'),
-      name: pack.identity.productName,
-      fontLinks: pack.theme.ui.fonts.links,
-      fontFamily: pack.theme.ui.fonts.display,
-    }));
-    await page.waitForLoadState('networkidle');
-    await page.evaluate(() => document.fonts.ready);
-    await page.screenshot({ path: path.join(dir, 'og-card.png'), omitBackground: false });
+    for (const [name, p] of Object.entries(pages)) {
+      const page = await browser.newPage({ viewport: { width: p.width, height: p.height }, deviceScaleFactor: 1 });
+      await page.setContent(p.html);
+      await page.waitForLoadState(p.wait);
+      await page.evaluate(() => document.fonts.ready);
+      await page.screenshot({ path: path.join(dir, name), omitBackground: false });
+      await page.close();
+      manifest[name] = { page: pageHash(p), png: sha256(fs.readFileSync(path.join(dir, name))) };
+    }
   } finally { await browser.close(); }
+  fs.writeFileSync(path.join(dir, PNG_MANIFEST), JSON.stringify(manifest, null, 2) + '\n');
 }
 
 // { filename: text } for every SVG variant. Pure given the source and the colours.
@@ -84,33 +139,21 @@ function brandFiles(src, colors) {
   const mono = '#000000';
   return {
     'mark-light.svg': markFile(parts, { ink: colors.ink, dot: colors.accent, label: 'logo' }),
-    'mark-dark.svg': markFile(parts, { ink: NIGHT_INK, dot: colors.accent, label: 'logo' }),
+    'mark-dark.svg': markFile(parts, { ink: colors.bgDeep, dot: colors.accent, label: 'logo' }),
     'mark-mono.svg': markFile(parts, { ink: mono, dot: mono, label: 'logo' }),
     'mark-body.svg': markFile(parts, { ink: mono, dot: mono, only: ['ring', 'disc'] }),
     'mark-dot.svg': markFile(parts, { ink: mono, dot: mono, only: ['dot'] }),
-    'favicon.svg': faviconSvg({ ink: colors.ink, accent: colors.accent }, src) + '\n',
+    'favicon.svg': faviconSvg({ ink: colors.ink, accent: colors.accent, night: colors.bgDeep }, src) + '\n',
   };
 }
 
-async function renderTouchIcon(dir, colors) {
-  const { launchBrowser } = require('../../modules/ui-design/kit/lib'); // eslint-disable-line global-require
-  const svg = fs.readFileSync(path.join(dir, 'mark-light.svg'), 'utf8');
-  const browser = await launchBrowser();
-  try {
-    const page = await browser.newPage({ viewport: { width: 180, height: 180 }, deviceScaleFactor: 1 });
-    await page.setContent(`<html><body style="margin:0;background:${colors.bg}">` +
-      `<img src="data:image/svg+xml;base64,${Buffer.from(svg).toString('base64')}" style="display:block;width:128px;height:128px;margin:26px">` +
-      '</body></html>');
-    await page.waitForLoadState('load');
-    await page.screenshot({ path: path.join(dir, 'apple-touch-icon.png'), omitBackground: false });
-  } finally { await browser.close(); }
-}
-
 async function main() {
   const args = process.argv.slice(2);
   const dir = brandDir();
-  const colors = packColors();
+  const pack = readPack();
+  const colors = pack.theme.ui.colors;
   const files = brandFiles(readMarkSource({ root: ROOT }), colors);
+  const pages = pngPages(files, pack);
   const stale = [];
   for (const [name, text] of Object.entries(files)) {
     const file = path.join(dir, name);
@@ -120,11 +163,14 @@ async function main() {
     if (!args.includes('--check')) fs.writeFileSync(file, text);
   }
   if (args.includes('--check')) {
-    if (stale.length) { process.stderr.write(`gen-brand: stale — ${stale.join(', ')}. Run: node scripts/bongos/gen-brand.js\n`); process.exit(2); }
-    process.stdout.write('gen-brand: the logo and favicon set match mark.svg\n');
+    const pngs = stalePngs(dir, pages);
+    if (stale.length) process.stderr.write(`gen-brand: stale — ${stale.join(', ')}. Run: node scripts/bongos/gen-brand.js\n`);
+    if (pngs.length) process.stderr.write(`gen-brand: stale PNG — ${pngs.join('; ')}. Run: node scripts/bongos/gen-brand.js --png\n`);
+    if (stale.length || pngs.length) process.exit(2);
+    process.stdout.write('gen-brand: the logo and favicon set match mark.svg, and the PNGs match their sources\n');
     return;
   }
-  if (args.includes('--png')) { await renderTouchIcon(dir, colors); await renderOgCard(dir); }
+  if (args.includes('--png')) await renderPngs(dir, pages);
   process.stdout.write(`gen-brand: ${stale.length ? `wrote ${stale.join(', ')}` : 'nothing to write'}${args.includes('--png') ? ' + apple-touch-icon.png + og-card.png' : ''}\n`);
 }
 

package/scripts/bongos/provision-core-upgrade.js

@@ -338,6 +338,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     log(`  ✓ would then read ${versionUrl} on the box and require it to say ${to}`);
     return { ok: true, served: null, preflight: verdict };
   }
+  backfillHubUpgradeUrl(inst, deps, boxExec);
   try {
     log(`  [upgrade] (in ${runDir}) ${cmd}`);
     boxExec(cmd, { cwd: runDir });
@@ -672,6 +673,34 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
 // HERE rather than left to instanceUser()'s own throw: that throw is correct today, but
 // a call site whose safety depends on a helper's internals is one refactor away from a
 // shell-injection path (and the apply leg's own guard sits at the route, not here).
+// WHERE THIS PROJECT'S UPDATE BUTTON GOES, written on every move (task 1005128): a project
+// provisioned before task 1004608 has no <PREFIX>_HUB_UPGRADE_URL line, and only a
+// settings-apply ever wrote one. The move restarts the service, so the line is read the moment
+// the new core comes up. BEST-EFFORT: it is written before the move and never decides it; an
+// unreadable file, a refused write or a line already right changes nothing and fails nothing.
+function backfillHubUpgradeUrl(inst, deps, boxExec) {
+  // The slug is interpolated into a shell command below, so it is checked HERE, at the point
+  // of use, not trusted to a caller that validated it earlier (the rule coreUpgradeInstance
+  // states for its own command).
+  if (!inst || !isValidSlug(inst.slug)) return false;
+  try {
+    const { hubUpgradeEnvPatch, webEnvPath } = require('./provision-units.js'); // eslint-disable-line global-require
+    const sudoP = deps.privileged ? 'sudo ' : '';
+    const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
+    if (!read || read.softFailed) return false;
+    const next = hubUpgradeEnvPatch(read.stdout, inst);
+    if (!next) return false;
+    const write = inst.hosting_shape === 'cloud-host' ? (deps.controlWriteFile || deps.writeFile) : deps.writeFile;
+    if (typeof write !== 'function') return false;
+    write(webEnvPath(inst), next, { mode: 0o600, sudo: true });
+    deps.log('  [config] wrote where this project\'s Update button goes into web.env (read on restart)');
+    return true;
+  } catch (e) {
+    deps.log(`  [config] could not write the Update button's address (${(e && e.message) || e}); the move goes on`);
+    return false;
+  }
+}
+
 function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', automatic = false, selfRoot = selfInstanceRoot, runAs = null, migrateAs = null } = {}) {
   if (!isValidSlug(inst && inst.slug)) {
     throw new Error(`upgradeInvocation: refusing to build a shell command from an invalid slug ${JSON.stringify(inst && inst.slug)}`);
@@ -1164,4 +1193,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, backfillHubUpgradeUrl, snapshotCoreVersions, snapshotAllCoreVersions };