@bongos/core 1.24.57 → 1.24.59

package/scripts/bongos/provision-units.js

@@ -447,9 +447,27 @@ function hubUpgradeEnvVarsFor(inst) {
   return { [`${provisionedEnvPrefix()}_HUB_UPGRADE_URL`]: origin ? `${origin}/deploy?project=${encodeURIComponent(String(inst.slug))}` : '' };
 }
 
+// THE BACKFILL (task 1005128). Only a settings-apply wrote that line, and one runs only when a
+// setting changes, so a project provisioned before task 1004608 (toast) never got it and its
+// owner was offered "Ask for this upgrade" instead of the Update button. Every core move now
+// carries the line too: the web.env as it stands, with that ONE line set, or null when it is
+// already right, there is nothing to write, or the file is empty (a missing file is never
+// "patched" into a one-line body). PURE; the core-upgrade leg does the read and the write.
+function hubUpgradeEnvPatch(body, inst) {
+  const vars = hubUpgradeEnvVarsFor(inst);
+  const [key] = Object.keys(vars);
+  const text = String(body == null ? '' : body);
+  if (!key || !vars[key] || !text.trim()) return null;
+  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const have = new RegExp(`^${esc}=(.*)$`, 'm').exec(text);
+  if (have && have[1].trim() === vars[key]) return null;
+  return upsertEnvVars(text, vars);
+}
+
 module.exports = {
   federationHubOrigin,
   hubUpgradeEnvVarsFor,
+  hubUpgradeEnvPatch,
   ENV_PREFIX_PACK,
   envPrefixMismatch,
   normalizePackEnvPrefix,

package/scripts/hall-preview/server.js

@@ -208,9 +208,6 @@ const CANNED_WRITES = [
   // a vote cast from the street's matter card (task 1004528), so the card's
   // answer (the toast, the building lighting) renders here too.
   ['POST', /^government\/board\/items\/\d+\/votes$/, 'government__board__items__votes.post'],
-  // Settings → Software update's "Ask for this upgrade" (task 1004595), so the
-  // pending line the panel draws after the press renders here too.
-  ['POST', /^software-update\/request$/, 'software-update__request.post'],
   // the studio's AI pages (task 1004921): a file uploads, a request is sent
   // (it answers as 1002, the running one), and money is added.
   ['POST', /^ai-studio\/uploads$/, 'ai-studio__uploads.post'],

package/scripts/status-mirror-sync.js

@@ -12,7 +12,10 @@
 // outage resilience (ADR 0029) from a SEPARATE repo. Before this script there
 // was no sync, so every change to the status surface silently missed the live page
 // (that's how #726's reorg + #731's theming never showed up). This makes the
-// publish deterministic and CI-driven.
+// publish deterministic. It is NOT CI-driven: no workflow in .github/workflows/ runs
+// it (there is no sync-status-mirror.yml in this repo), so a status-surface change reaches the
+// off-box page only when someone runs this by hand with a mirror checkout — see USAGE
+// and docs/recipes/ops-gotchas.md (task 1005131 / task 1005133).
 //
 // CONFIG (task 1002510 — no host identity is baked in here; ADR 0062 §3):
 //   domains.publicOrigin  — the origin the mirror calls cross-origin

package/src/bongos/routes/auth.js

@@ -51,7 +51,7 @@ const { escapeHtml } = require('../../html-escape'); // the one server escaper (
 // the browser-approved device flow the CLI gets when Google is offered.
 const { googleConfigured } = require('../auth-google');
 const { startBrowserDeviceFlow, isBrowserDeviceCode, pollBrowserDeviceFlow } = require('../device-approval');
-const { renderSignInChooser } = require('../sign-in-pages');
+const { renderSignInChooser, signInHead } = require('../sign-in-pages');
 
 // Render a small standalone HTML page in the builders' hall palette. Used for
 // OAuth error branches so the visitor sees something coherent rather than a
@@ -103,10 +103,7 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${escapeHtml(worldName)} — ${escapeHtml(copy.titleSuffix)}</title>
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Cinzel:wght@500;700&family=EB+Garamond:ital,wght@0,400;0,500&display=swap" rel="stylesheet">
-<link rel="stylesheet" href="/builders/style.css">
+${signInHead()}
 </head><body>
 <header class="hall">
   <p class="hall__epigraph">${escapeHtml(copy.epigraph)}</p>
@@ -167,10 +164,7 @@ function renderAccessPendingPage(login, startHref) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${escapeHtml(worldName)} — confirming access</title>
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Cinzel:wght@500;700&family=EB+Garamond:ital,wght@0,400;0,500&display=swap" rel="stylesheet">
-<link rel="stylesheet" href="/builders/style.css">
+${signInHead()}
 </head><body>
 <header class="hall">
   <p class="hall__epigraph">${escapeHtml(epigraph)}</p>
@@ -1494,6 +1488,7 @@ module.exports.webRedirectOrigin = () => WEB_REDIRECT_ORIGIN;
 // The auth-error page renderer (task 1439): pure over the branding pack, so a
 // test can prove every visible string is brand-owned (no OTB lore baked in).
 module.exports.renderAuthErrorPage = renderAuthErrorPage;
+module.exports.renderAccessPendingPage = renderAccessPendingPage;
 // The admitting-rank label for per-branch strings (task 1002616) — exported for
 // the same reason: the test proves the label is pack-owned, never "Archon".
 module.exports.admitterLabel = admitterLabel;

package/src/bongos/routes/core-update.js

@@ -34,7 +34,6 @@ const { readSoftwareUpdate } = require('../software-update');
 const { followForShape } = require('../../../scripts/bongos/update-channel.js');
 const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
-const upgradeRequest = require('../upgrade-request');
 const { readUpgradeHold } = require('../upgrade-hold');
 const { moveNotice, moveHistory, readInstalledReleaseNotes } = require('../core-moves');
 
@@ -82,10 +81,35 @@ function hubManageLinks(config) {
 // address as <PREFIX>_HUB_UPGRADE_URL (task 1004608). Without it, those owners were told to
 // run `bongos upgrade` on a server the platform runs. Only the hub's /deploy path is taken.
 const HUB_UPGRADE_URL_RE = /^https?:\/\/[^\s"'<>/]+\/deploy\?project=[A-Za-z0-9._%-]+$/;
-function updateDoor({ provisioning, idp, hubUpgradeUrl }) {
+// THE LAST FALLBACK (task 1005128). A hosted project whose web.env predates the line above
+// (toast, 2026-11) named neither, fell to `cli`, and its owner was offered "Ask for this
+// upgrade" instead of the Update button — the owner: "if the update is generally available
+// then they should be able to download it". So a project that answers on a name under its
+// hub's own domain (the hub's rule for "a project we host") is sent to that hub's door by its
+// address instead of its slug: `<hub>/deploy?host=<host>`. The hub resolves the address among
+// the visitor's OWN projects, exactly as it resolves a slug, and the hand-off still only
+// accepts the project's registered origin. A self-hosted instance on its own domain stays
+// `cli`: nobody at the hub can reach its server.
+function projectHost(raw) {
+  const host = String(raw || '').trim().toLowerCase();
+  if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) return null;
+  if (/^\d+(\.\d+)+$/.test(host)) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return host;
+}
+function hubHostedDoor({ hub, host }) {
+  const h = projectHost(host);
+  let origin = null;
+  let hubHost = null;
+  try { const u = new URL(String(hub)); if (/^https?:$/.test(u.protocol)) { origin = u.origin; hubHost = u.host.toLowerCase(); } } catch { /* no hub */ }
+  if (!h || !origin || h === hubHost || !h.endsWith(`.${hubHost}`)) return null;
+  return `${origin}/deploy?host=${encodeURIComponent(h)}`;
+}
+function updateDoor({ provisioning, idp, hubUpgradeUrl, hub = null, host = null }) {
   if (provisioning) return { kind: 'local', url: '/deploy' };
   const url = hubDeployUrl(idp)
-    || (typeof hubUpgradeUrl === 'string' && HUB_UPGRADE_URL_RE.test(hubUpgradeUrl.trim()) ? hubUpgradeUrl.trim() : null);
+    || (typeof hubUpgradeUrl === 'string' && HUB_UPGRADE_URL_RE.test(hubUpgradeUrl.trim()) ? hubUpgradeUrl.trim() : null)
+    || hubHostedDoor({ hub, host });
   return url ? { kind: 'hub', url } : { kind: 'cli', url: null };
 }
 
@@ -187,25 +211,15 @@ async function resolveChannel(selfChannel) {
   return { channel, source: channel ? 'deploy' : 'default' };
 }
 
-// "Ask for this upgrade" (task 1004595): what src/bongos/upgrade-request.js needs from
-// the outside world, resolved per request so a test can stand every piece in. The receipt
-// goes into the SAME store the public redeem route reads (routes/feedback.js).
-function defaultAskDeps() {
-  const ps = require('../project-settings');
-  const fb = require('./feedback');
-  return {
-    hub: fb.feedbackHub(),
-    host: configuredHost(),
-    getSetting: ps.getSetting,
-    setSetting: ps.setSetting,
-    issueReceipt: (r) => fb.defaultReceiptStore().issue(r),
-  };
+// The hub this project belongs to: the same answer the direct feedback door uses (null on the
+// hub itself, so the platform never points at itself).
+function safeHub() {
+  try { return require('./feedback').feedbackHub(); } catch { return null; }
 }
 
 // The host this project answers on, from its OWN branding pack (domains is server-only):
-// the origin the hub calls back to redeem the receipt. Never read from the request: a
-// Host or X-Forwarded-Host header is the caller's to write, and would let them point the
-// hub's call-back at any address they like. '' when the pack names none.
+// what decides whether the hub hosts it (hubHostedDoor). Never read from the request: a
+// Host or X-Forwarded-Host header is the caller's to write. '' when the pack names none.
 function configuredHost() {
   try {
     const d = require('../../branding').branding().domains || {};
@@ -213,18 +227,6 @@ function configuredHost() {
   } catch { return ''; }
 }
 
-// The page's ask state. Fail-soft: a stored row that cannot be read is "not asked yet",
-// never a 500 on the whole Software update panel.
-async function readAsk({ update, door, deps }) {
-  const offered = update && update.reading === 'ok' ? update.offered : null;
-  const base = { offered, host: upgradeRequest.projectHost(deps.host), doorKind: door.kind, hub: deps.hub };
-  let stored = null;
-  if (offered && upgradeRequest.isOperatorRun(base)) {
-    try { stored = upgradeRequest.parseStored(await deps.getSetting(upgradeRequest.SETTING_KEY)); } catch { stored = null; }
-  }
-  return upgradeRequest.askState({ ...base, stored });
-}
-
 // A core move this project's own ledger says was rolled back (task 1004730,
 // src/bongos/upgrade-hold.js): which version was tried, why in plain words, and that this
 // project is still on its old version and working. Both reads carry it, the Software update
@@ -270,16 +272,13 @@ function buildCoreUpdateRouter({
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
-  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl() }),
-  askDeps = defaultAskDeps,
+  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl(), hub: safeHub(), host: configuredHost() }),
   upgradeHold = readUpgradeHold,
   releaseNotes = readInstalledReleaseNotes,
   seenMove = defaultSeenMove,
 } = {}) {
   contributeCoreUpdateToDocket();
   const router = express.Router();
-  // One send at a time: a double press waits for the first and is answered from its row.
-  let asking = null;
 
   router.get(
     '/core-update',
@@ -341,53 +340,13 @@ function buildCoreUpdateRouter({
         resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel, follow: followFor(door) })), channel_source: source })),
         canUpdate(req),
       ]);
-      const ask = await readAsk({ update, door, deps: askDeps() });
       const held = await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.offered : null });
       // The history only for a viewer who holds core.pin.move (see safeMoved's gate note).
       const history = can === true ? await safeHistory(upgrades) : null;
-      res.json({ ok: true, update, door, can_update: can === true, ask, held, history });
+      res.json({ ok: true, update, door, can_update: can === true, held, history });
     }, { errorCode: 'software_update_failed', message: false }),
   );
 
-  // POST /software-update/request — "Ask for this upgrade" (task 1004595). On a project
-  // the hub's operator runs, sends one request for the version this project is offered
-  // to the operator, through the direct feedback door, and remembers it so the page can
-  // say it is pending. The version is the server's own reading, never the caller's.
-  // Idempotent per version; a different version waits out a 24h cooldown (429).
-  // rank: core.pin.move — the same atom as the Update button the panel draws.
-  router.post(
-    '/software-update/request',
-    auth.requireBuilder,
-    auth.requirePermission('core.pin.move'),
-    asyncHandler('POST /software-update/request', async (req, res) => {
-      while (asking) { try { await asking; } catch { /* the next one tries for itself */ } }
-      const run = (async () => {
-        let running = null;
-        try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-        const { channel } = await resolveChannel(selfChannel);
-        const door = updateDoor(doorInputs());
-        const update = await softwareUpdate({ running, channel, follow: followFor(door) });
-        const deps = askDeps();
-        return upgradeRequest.requestUpgrade({
-          host: deps.host,
-          running,
-          wanted: update && update.reading === 'ok' ? update.offered : null,
-          builder: req.builder,
-          doorKind: door.kind,
-        }, deps);
-      })();
-      asking = run;
-      let out;
-      try { out = await run; } finally { if (asking === run) asking = null; }
-      if (out.status >= 400) {
-        const { error, message, ...details } = out.body;
-        if (details.retry_after_seconds) res.set('Retry-After', String(details.retry_after_seconds));
-        return res.fail(error, { status: out.status, message, details });
-      }
-      res.status(out.status).json(out.body);
-    }, { errorCode: 'upgrade_request_failed', message: false }),
-  );
-
   // GET /project/manage-link — the hub's page for THIS project, where its owner takes it
   // offline or disconnects it (task 1004570). On a hosted project the owner is its Archon,
   // so the read is Archon-only: a builder below that is refused and the hall draws no
@@ -410,4 +369,5 @@ module.exports = buildCoreUpdateRouter;
 module.exports.hubManageLinks = hubManageLinks;
 module.exports.hubDeployUrl = hubDeployUrl;
 module.exports.updateDoor = updateDoor;
+module.exports.hubHostedDoor = hubHostedDoor;
 module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/bongos/routes/feedback.js

@@ -78,8 +78,7 @@ function makeReceiptStore({ now = Date.now, ttlMs = RECEIPT_TTL_MS, max = RECEIP
 }
 
 // The process's one receipt store. Shared, because a receipt is redeemed at the public
-// route below whoever issued it: the CLI's POST /feedback/receipt, or this project's own
-// "Ask for this upgrade" (src/bongos/upgrade-request.js, task 1004595).
+// route below whoever issued it (the CLI's POST /feedback/receipt).
 let sharedStore = null;
 function defaultReceiptStore() {
   if (!sharedStore) sharedStore = makeReceiptStore();

package/src/bongos/serve-internal.js

@@ -44,7 +44,7 @@ const { buildStampedHtml, hashFile } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildBongosDownloads, installScriptReader } = require('../bongos-downloads');
 const { clientBranding, branding, applyBrandConditionals } = require('../branding');
-const { nightTintCss } = require('../night-tint');
+const { themeMarkup } = require('../theme-markup');
 const { linkPreviewTags } = require('../link-preview');
 const { prelaunchGate } = require('./prelaunch-gate');
 const { platformVisibilityGate } = require('./platform-visibility-gate');
@@ -84,75 +84,10 @@ function tryLoadInstanceConfig(name, roots = [resolveInstanceRoot(), ROOT]) {
   return null;
 }
 
-// Map the pack's camelCase theme color keys → the kebab-case CSS custom
-// properties the hall/status stylesheets read (public-{builders,status}/style.css
-// :root). R57 (task 1196).
-const COLOR_VARS = {
-  bg: '--bg', bgCard: '--bg-card', bgDeep: '--bg-deep', bgFrame: '--bg-frame',
-  ink: '--ink', inkSoft: '--ink-soft', inkFaint: '--ink-faint',
-  rule: '--rule', ruleSoft: '--rule-soft',
-  accent: '--accent', accentDeep: '--accent-deep', sea: '--sea', terracotta: '--terracotta',
-};
-
-// Build the THEME markup for a served page from the client-safe pack's theme:
-// a <style> overriding the :root palette + font-family vars, the web-font <link>s,
-// and the favicon <link>. Returns '' when the pack carries no theme (so a pack
-// without a `theme.ui` block is a no-op and the stylesheet's own defaults stand).
-// The <style> is emitted so it lands AFTER the page's own stylesheet <link>
-// (which sits earlier in <head>) — equal specificity, later wins — making the
-// pack authoritative over style.css. For OTB the values equal style.css's
-// parchment defaults, so the render is byte-identical; a neutral instance gets
-// its plain palette + system fonts. R57 (task 1196, ADR 0062 §3).
-function themeMarkup(theme) {
-  if (!theme) return '';
-  const decls = [];
-  for (const [key, cssVar] of Object.entries(COLOR_VARS)) {
-    const v = cssSafe(theme.colors?.[key]);
-    if (v) decls.push(`${cssVar}:${v};`);
-  }
-  const display = cssSafe(theme.fonts?.display);
-  if (display) decls.push(`--font-display:${display};`);
-  const body = cssSafe(theme.fonts?.body);
-  if (body) decls.push(`--font-body:${body};`);
-  let out = '';
-  for (const href of theme.fonts?.links || []) {
-    out += `<link rel="stylesheet" href="${esc(href)}">`;
-  }
-  // `backdrop` paints the page background (e.g. the Cloud Bongos sunrise gradient,
-  // ADR 0064 / R74) over the flat var(--bg); omitted packs (OTB) keep --bg.
-  const css = [];
-  if (decls.length) css.push(`:root{${decls.join('')}}`);
-  const backdrop = cssSafe(theme.backdrop);
-  if (backdrop) css.push(`body{background:${backdrop};}`);
-  // The night tint (ADR 0358): a hall wearing a look takes a hint of its accent into
-  // its dark grounds. Written as the sheet's own two dark twins, after the sheet, so
-  // equal specificity wins on order. clientBranding only sets it with a look, so a
-  // hall that chose none keeps the sheet's pure black.
-  if (theme.nightTint === true) css.push(nightTintCss());
-  if (css.length) out += `<style>${css.join('')}</style>`;
-  // esc() is lossless in an attribute: the HTML parser decodes the entities back
-  // before anything reads the URL, so the neutral pack's inline `data:image/svg+xml,
-  // <svg …>` favicon resolves to exactly the same bytes it does today.
-  if (theme.favicon) out += `<link rel="icon" href="${esc(theme.favicon)}">`;
-  if (theme.appleTouchIcon) out += `<link rel="apple-touch-icon" href="${esc(theme.appleTouchIcon)}">`;
-  return out;
-}
-
-// A pack-supplied value on its way into <style> TEXT. esc() is the wrong tool
-// here and would corrupt the output: CSS is not entity-decoded, so a font stack
-// like `"Cinzel", serif` would reach the browser as `&quot;Cinzel&quot;, serif`
-// and simply not parse. There is no encoding that both survives CSS and
-// neutralizes markup, so this fails closed instead. The only way out of a <style>
-// element is a literal `</style`, every route to it begins with `<`, and no
-// colour, font stack, or backdrop has a legitimate use for one — so a value
-// carrying `<` is dropped whole rather than emitted half-escaped. Dropping one
-// declaration loses that pack's colour and falls back to style.css's default;
-// emitting it loses the page.
-function cssSafe(v) {
-  const s = String(v == null ? '' : v);
-  return s.includes('<') ? '' : s;
-}
-
+// The pack's THEME markup (the :root palette + faces <style>, the font links, the
+// favicon) is built by src/theme-markup.js, so a page rendered outside this file —
+// the sign-in screens — gets the identical splice without requiring the server
+// (task 1005135). Re-exported below for every caller that already reads it here.
 // Serialize a pack value for injection INSIDE a <script> element. JSON.stringify
 // alone is not enough: its output is valid JSON, but the browser reads a script
 // body as raw text FIRST, so a `</script>` anywhere in the pack ends the element

package/src/bongos/sign-in-pages.js

@@ -10,8 +10,9 @@
 // auth error page in routes/auth.js, so every sign-in screen reads as one place.
 'use strict';
 
-const { branding } = require('../branding');
+const { branding, clientBranding } = require('../branding');
 const { escapeHtml } = require('../html-escape');
+const { themeMarkup } = require('../theme-markup');
 
 const GITHUB_MARK = '<svg aria-hidden="true" width="18" height="18" viewBox="0 0 16 16" style="vertical-align:-3px;margin-right:8px"><path fill="currentColor" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59 .4 .07 .55-.17 .55-.38 0-.19-.01-.82-.01-1.49-2.01 .37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53 .63-.01 1.08 .58 1.23 .82 .72 1.21 1.87 .87 2.33 .66 .07-.52 .28-.87 .51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87 .31-1.59 .82-2.15-.08-.2-.36-1.02 .08-2.12 0 0 .67-.21 2.2 .82 .64-.18 1.32-.27 2-.27 .68 0 1.36 .09 2 .27 1.53-1.04 2.2-.82 2.2-.82 .44 1.1 .16 1.92 .08 2.12 .51 .56 .82 1.27 .82 2.15 0 3.07-1.87 3.75-3.65 3.95 .29 .25 .54 .73 .54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21 .15 .46 .55 .38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>';
 const GOOGLE_MARK = '<svg aria-hidden="true" width="18" height="18" viewBox="0 0 48 48" style="vertical-align:-3px;margin-right:8px"><path fill="#EA4335" d="M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"/><path fill="#4285F4" d="M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"/><path fill="#FBBC05" d="M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z"/><path fill="#34A853" d="M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"/></svg>';
@@ -20,7 +21,22 @@ function worldName() {
   try { return branding().identity?.worldName || 'Sign in'; } catch { return 'Sign in'; }
 }
 
-// One page shell: the hall stylesheet, a header, and a body the caller built
+// The look every sign-in screen shares (task 1005135): the hall stylesheet, then
+// the pack's own palette, faces and favicon, spliced exactly as every served page
+// gets them (src/theme-markup.js, the same splice serve-internal applies). The pack's faces are the only faces;
+// these pages once loaded a retired pair of inscription faces on top of the hall sheet. The
+// header and main are lifted over the hall's fixed plate veil (body::after, black in
+// dark), which otherwise dims the whole page — the hall lifts its shell the same way.
+// A branding hiccup degrades to the hall sheet's own neutral values, never a crash.
+function signInHead() {
+  let theme = '';
+  try { theme = themeMarkup(clientBranding().theme); } catch { theme = ''; }
+  return `<link rel="stylesheet" href="/builders/style.css">
+${theme}
+<style>body > header, body > main { position: relative; z-index: 1; } body > header.hall { padding: var(--ds-space-md) var(--ds-space-gutter-narrow) 0; } body > main { padding: var(--ds-space-sm) var(--ds-space-gutter-narrow) var(--ds-space-xl); }</style>`;
+}
+
+// One page shell: the shared head, a header, and a body the caller built
 // (already escaped). Never a script: these pages work with forms and links alone.
 function renderPage({ title, heading, subtitle, bodyHtml }) {
   return `<!doctype html>
@@ -29,7 +45,7 @@ function renderPage({ title, heading, subtitle, bodyHtml }) {
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="referrer" content="no-referrer">
 <title>${escapeHtml(worldName())} — ${escapeHtml(title)}</title>
-<link rel="stylesheet" href="/builders/style.css">
+${signInHead()}
 <style>
   .signinChoices{display:flex;flex-direction:column;gap:12px;max-width:340px;margin:8px auto 0}
   .signinChoices .landing__btn{display:block;text-align:center}
@@ -154,4 +170,4 @@ ${choiceButtons(view)}
   });
 }
 
-module.exports = { renderSignInChooser, renderExistingAccountHint, renderDeviceApprovalPage };
+module.exports = { renderSignInChooser, renderExistingAccountHint, renderDeviceApprovalPage, signInHead };

package/src/brand-mark.js

@@ -16,7 +16,16 @@ const fs = require('node:fs');
 const path = require('node:path');
 
 // The Night ink: the chrome world's ink on a dark ground, which every dark twin of the mark uses.
-const NIGHT_INK = '#e2e1e4';
+// It is the pack's deep ground (theme.ui.colors.bgDeep in config/branding.neutral.json), read
+// from the pack the core ships rather than typed in here, so a palette change reaches the mark
+// (task 1005133). Read relative to this file: src/ sits in the core root beside config/.
+function readNightInk() {
+  try {
+    const pack = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'config', 'branding.neutral.json'), 'utf8'));
+    return pack.theme.ui.colors.bgDeep || 'currentColor';
+  } catch { return 'currentColor'; }
+}
+const NIGHT_INK = readNightInk();
 // The two custom properties the source colours itself by, exactly as written there.
 const INK_VAR = 'var(--mark-ink,currentColor)';
 const DOT_VAR = 'var(--mark-dot,var(--accent,currentColor))';

package/src/error-page.js

@@ -3,7 +3,9 @@
 // A person who mistypes an address, or lands on a page that broke, used to get a bare
 // "404 — not found" in plain text: the one screen of the product with no product on it.
 // This is that screen in the chrome world: the shared mark, the product name, a heading,
-// one sentence and a way back, on the pack's colours and faces in both modes.
+// one sentence and a way back, on the pack's colours and faces in both modes. The name
+// beside the mark is the pack's productName, shown lowercase (DESIGN.md "Naming"); the
+// colours are the hall sheet's tier, never a block of this page's own (task 1005135).
 //
 // WHO GETS IT: a browser asking for a page. An API-shaped path keeps its JSON (the
 // self-describing 404 of api-path-404.js; the trailing error net answers the R01
@@ -44,24 +46,23 @@ function errorPageTemplate(status, { notFound = 'Page not found.' } = {}) {
 <meta name="robots" content="noindex">
 <title>${escapeHtml(heading)} · {{productName}}</title>
 <link rel="icon" href="/modules/ui-design/public/brand/favicon.svg" type="image/svg+xml">
-<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">
+<!-- The hall's sheet carries the shared scales (tokens.css), the derived colour tier
+     and both dark twins, so this page declares no colour of its own (task 1005135). -->
+<link rel="stylesheet" href="/modules/hall-ui/public/style.css">
 <style>
-/* The fallback contract tier at zero specificity: the pack's spliced :root always wins. */
-:where(html){--bg:#edecee;--bg-card:#fbfafc;--ink:#17181a;--ink-soft:#55565a;--ink-faint:#65656a;--rule-soft:#dcdbdd;--accent:#fb9569;--accent-deep:#a3481a;--font-display:"Manrope","Segoe UI",system-ui,sans-serif;--font-body:"Manrope","Segoe UI",system-ui,sans-serif}
-html{color-scheme:light;--accent-ink:color-mix(in srgb,var(--accent) 45%,#240e00);--focus:color-mix(in srgb,var(--accent-deep) 82%,#3a1400)}
-html[data-theme="dark"]{color-scheme:dark;--bg:#000000;--bg-card:#101012;--ink:#ffffff;--ink-soft:#c0c0c0;--ink-faint:#a8a8a8;--rule-soft:rgba(255,255,255,.08);--accent-ink:var(--accent);--focus:var(--accent)}
-@media (prefers-color-scheme:dark){html:not([data-theme]){color-scheme:dark;--bg:#000000;--bg-card:#101012;--ink:#ffffff;--ink-soft:#c0c0c0;--ink-faint:#a8a8a8;--rule-soft:rgba(255,255,255,.08);--accent-ink:var(--accent);--focus:var(--accent)}}
 *{box-sizing:border-box}
 body{margin:0;min-height:100vh;display:flex;flex-direction:column;background:var(--bg);color:var(--ink);font-family:var(--font-body);font-size:var(--ds-text-2xl,17px);line-height:1.5}
+header,main{position:relative;z-index:1}
 header{display:flex;align-items:center;gap:var(--ds-space-xs,10px);min-height:56px;padding:0 var(--ds-space-gutter-narrow,20px);border-bottom:var(--ds-line,1px) solid var(--rule-soft)}
 .mark{width:28px;height:28px;--mark-ink:var(--ink)}
-.name{font-family:var(--font-display);font-size:var(--ds-text-xl,16px);font-weight:500;color:var(--ink);text-decoration:none}
+.name{font-family:var(--font-display);font-size:var(--ds-text-lg,15px);font-weight:300;letter-spacing:-.01em;text-transform:lowercase;color:var(--ink);text-decoration:none}
 main{flex:1;display:flex;align-items:center;justify-content:center;padding:var(--ds-space-xl,52px) var(--ds-space-gutter-narrow,20px)}
 .card{max-width:34rem}
-.code{margin:0 0 var(--ds-space-sm,14px);font-family:"JetBrains Mono",ui-monospace,monospace;font-size:var(--ds-text-2xs,11px);letter-spacing:.14em;text-transform:uppercase;color:var(--ink-soft)}
+.code{margin:0 0 var(--ds-space-sm,14px);font-family:var(--font-mono);font-size:var(--ds-text-2xs,11px);letter-spacing:.14em;text-transform:uppercase;color:var(--ink-soft)}
 h1{margin:0 0 var(--ds-space-sm,14px);font-family:var(--font-display);font-size:var(--ds-text-headline,clamp(26px,3.1vw,42px));font-weight:300;line-height:1.06;letter-spacing:-.035em}
 p.sub{margin:0 0 var(--ds-space-md,22px);color:var(--ink-soft)}
-a.back{display:inline-flex;align-items:center;min-height:46px;padding:0 var(--ds-space-md,22px);border-radius:var(--ds-radius-pill,999px);background:var(--accent);color:#2a1305;font-weight:500;text-decoration:none}
+a.back{display:inline-flex;align-items:center;min-height:46px;padding:0 var(--ds-space-md,22px);border-radius:var(--ds-radius-pill,999px);background:var(--accent);color:var(--accent-on);font-weight:500;text-decoration:none}
+a.back:hover{background:var(--accent-lift);text-decoration:none}
 a:focus-visible{outline:2px solid var(--focus);outline-offset:3px;box-shadow:0 0 0 8px var(--bg)}
 </style>
 </head>

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.57'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.59'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/theme-markup.js

@@ -0,0 +1,81 @@
+// src/theme-markup.js — the branding pack's THEME markup for a served page (R57, task
+// 1196, ADR 0062 §3). Moved out of src/bongos/serve-internal.js (which re-exports it)
+// so a page built outside the server's HTML maps — the sign-in screens in
+// src/bongos/sign-in-pages.js — splices the pack exactly as every other page does,
+// without requiring the server module that mounts the routes that render it
+// (task 1005135). Pure over its input.
+'use strict';
+
+const { escapeHtml: esc } = require('./html-escape');
+const { nightTintCss } = require('./night-tint');
+
+// Map the pack's camelCase theme color keys → the kebab-case CSS custom
+// properties the hall/status stylesheets read (public-{builders,status}/style.css
+// :root). R57 (task 1196).
+const COLOR_VARS = {
+  bg: '--bg', bgCard: '--bg-card', bgDeep: '--bg-deep', bgFrame: '--bg-frame',
+  ink: '--ink', inkSoft: '--ink-soft', inkFaint: '--ink-faint',
+  rule: '--rule', ruleSoft: '--rule-soft',
+  accent: '--accent', accentDeep: '--accent-deep', sea: '--sea', terracotta: '--terracotta',
+};
+
+// Build the THEME markup for a served page from the client-safe pack's theme:
+// a <style> overriding the :root palette + font-family vars, the web-font <link>s,
+// and the favicon <link>. Returns '' when the pack carries no theme (so a pack
+// without a `theme.ui` block is a no-op and the stylesheet's own defaults stand).
+// The <style> is emitted so it lands AFTER the page's own stylesheet <link>
+// (which sits earlier in <head>) — equal specificity, later wins — making the
+// pack authoritative over style.css. For OTB the values equal style.css's
+// parchment defaults, so the render is byte-identical; a neutral instance gets
+// its plain palette + system fonts. R57 (task 1196, ADR 0062 §3).
+function themeMarkup(theme) {
+  if (!theme) return '';
+  const decls = [];
+  for (const [key, cssVar] of Object.entries(COLOR_VARS)) {
+    const v = cssSafe(theme.colors?.[key]);
+    if (v) decls.push(`${cssVar}:${v};`);
+  }
+  const display = cssSafe(theme.fonts?.display);
+  if (display) decls.push(`--font-display:${display};`);
+  const body = cssSafe(theme.fonts?.body);
+  if (body) decls.push(`--font-body:${body};`);
+  let out = '';
+  for (const href of theme.fonts?.links || []) {
+    out += `<link rel="stylesheet" href="${esc(href)}">`;
+  }
+  // `backdrop` paints the page background (e.g. the Cloud Bongos sunrise gradient,
+  // ADR 0064 / R74) over the flat var(--bg); omitted packs (OTB) keep --bg.
+  const css = [];
+  if (decls.length) css.push(`:root{${decls.join('')}}`);
+  const backdrop = cssSafe(theme.backdrop);
+  if (backdrop) css.push(`body{background:${backdrop};}`);
+  // The night tint (ADR 0358): a hall wearing a look takes a hint of its accent into
+  // its dark grounds. Written as the sheet's own two dark twins, after the sheet, so
+  // equal specificity wins on order. clientBranding only sets it with a look, so a
+  // hall that chose none keeps the sheet's pure black.
+  if (theme.nightTint === true) css.push(nightTintCss());
+  if (css.length) out += `<style>${css.join('')}</style>`;
+  // esc() is lossless in an attribute: the HTML parser decodes the entities back
+  // before anything reads the URL, so the neutral pack's inline `data:image/svg+xml,
+  // <svg …>` favicon resolves to exactly the same bytes it does today.
+  if (theme.favicon) out += `<link rel="icon" href="${esc(theme.favicon)}">`;
+  if (theme.appleTouchIcon) out += `<link rel="apple-touch-icon" href="${esc(theme.appleTouchIcon)}">`;
+  return out;
+}
+
+// A pack-supplied value on its way into <style> TEXT. esc() is the wrong tool
+// here and would corrupt the output: CSS is not entity-decoded, so a font stack
+// like `"Cinzel", serif` would reach the browser as `&quot;Cinzel&quot;, serif`
+// and simply not parse. There is no encoding that both survives CSS and
+// neutralizes markup, so this fails closed instead. The only way out of a <style>
+// element is a literal `</style`, every route to it begins with `<`, and no
+// colour, font stack, or backdrop has a legitimate use for one — so a value
+// carrying `<` is dropped whole rather than emitted half-escaped. Dropping one
+// declaration loses that pack's colour and falls back to style.css's default;
+// emitting it loses the page.
+function cssSafe(v) {
+  const s = String(v == null ? '' : v);
+  return s.includes('<') ? '' : s;
+}
+
+module.exports = { themeMarkup };

package/tests/brand_mark.mjs

@@ -100,7 +100,7 @@ test('the brand folder holds exactly what gen-brand.js writes from the source (l
   const c = packColors();
   assert.match(files['mark-light.svg'], new RegExp(c.ink));
   assert.match(files['mark-light.svg'], new RegExp(c.accent));
-  assert.match(files['mark-dark.svg'], /#e2e1e4/);
+  assert.match(files['mark-dark.svg'], new RegExp(c.bgDeep), 'the dark logo is drawn in the pack\'s Night ink (bgDeep)');
   assert.doesNotMatch(files['mark-mono.svg'], new RegExp(c.accent), 'mono is one ink');
   assert.match(files['favicon.svg'], /prefers-color-scheme:dark/, 'the tab icon has its night twin');
   const png = fs.readFileSync(path.join(ROOT, BRAND_DIR, 'apple-touch-icon.png'));
@@ -193,3 +193,13 @@ test('one favicon: every page fallback and the pack point at favicon.svg; a look
   assert.match(looked.theme.ui.favicon, /stroke-width='24'/, 'the small cut');
   assert.equal(looked.theme.ui.appleTouchIcon, '', 'the pack-coloured touch icon steps aside');
 });
+
+// task 1005133: the Night ink every dark twin of the mark uses is the pack's bgDeep, read
+// from config/branding.neutral.json — not a hex typed into src/brand-mark.js.
+test('the Night ink comes from the brand pack, not a typed-in colour', () => {
+  const { NIGHT_INK, faviconSvg } = require('../src/brand-mark.js');
+  const pack = JSON.parse(read('config', 'branding.neutral.json'));
+  assert.equal(NIGHT_INK, pack.theme.ui.colors.bgDeep);
+  assert.doesNotMatch(read('src', 'brand-mark.js').replace(/\/\/.*$/gm, ''), /#[0-9a-f]{3,8}\b/i, 'src/brand-mark.js types in no colour');
+  assert.match(faviconSvg({ ink: '#111111', accent: '#222222' }), new RegExp(`--i:${pack.theme.ui.colors.bgDeep}`), 'a looked favicon\'s night twin');
+});

package/tests/brand_surfaces.mjs

@@ -144,7 +144,7 @@ test('a page route that throws answers the branded 500 to a browser and JSON to
   assert.ok(errorPageTemplate(404, { notFound: 'Gone.' }).includes('<h1>Gone.</h1>'));
 });
 
-test('the error page and the docs write their dark tier twice, byte-identical', () => {
+test('the docs write their dark tier twice, byte-identical; the error page writes none of its own', () => {
   const twins = (src) => {
     const a = src.match(/html\[data-theme="dark"\]\s*\{([^}]*)\}/);
     const b = src.match(/@media \(prefers-color-scheme:\s*dark\)\s*\{\s*html:not\(\[data-theme\]\)\s*\{([^}]*)\}/);
@@ -152,7 +152,10 @@ test('the error page and the docs write their dark tier twice, byte-identical',
     const norm = (s) => s.replace(/\s+/g, ' ').trim();
     assert.equal(norm(b[1]), norm(a[1]));
   };
-  twins(errorPageTemplate(404));
+  // the error page takes its colours and both dark twins from the hall's sheet (task 1005135)
+  const ep = errorPageTemplate(404);
+  assert.ok(ep.includes('<link rel="stylesheet" href="/modules/hall-ui/public/style.css">'), 'the error page loads the shared sheet');
+  assert.doesNotMatch(ep, /data-theme="dark"|prefers-color-scheme/, 'no private dark tier');
   twins(fs.readFileSync(path.join(ROOT, 'public-docs', 'index.html'), 'utf8'));
 });