@bongos/core 1.24.59 → 1.24.61

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.59",
-  "core_contract": "1.24.59",
-  "source_commit": "a6ac4e31607a82978349eba6f0d2c113bdc48345",
+  "core_version": "1.24.61",
+  "core_contract": "1.24.61",
+  "source_commit": "074455f5f70a80b93f2d0d0b300cd1e0ffde4c7c",
   "source_ref": "HEAD",
-  "built_at": "2026-11-07T15:21:01.170Z",
+  "built_at": "2026-11-07T15:53:12.866Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4571,
-  "tree_sha256": "0d58836fc7200aa61d37a68fc94e1fef65ba9556f5afb9e9c7105fcc474f0d4b",
+  "tree_sha256": "3a47117d4d3f490712a748e2757c6055a16f91e1d1709e2368024622ba8ec308",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "3fc7cefeb390fc6bab3c33c0a57753a90d1addaf559e3d6afecb50957819bc84"
+      "sha256": "f68f2148356fbb2b200e4449395cd70c0de995a6dbd83824daabb448b878d0eb"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -2477,7 +2477,7 @@
     {
       "path": "docs/branding-contract.md",
       "mode": "0000644",
-      "sha256": "8b3cc175530daab089182c44d63d8d924ec67bcf42c0ccb520e9cf6fea5982f6"
+      "sha256": "ad17037122411275bdcca49a5a7069deb2d2dddbdf7ef47fde859f51df6ea91d"
     },
     {
       "path": "docs/branding-fill-prompt.md",
@@ -2492,12 +2492,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "9f6c2622a044bc47c67ce6e1555af9a956f4189c2057ee80ba969744cd194aed"
+      "sha256": "7f97e11caa94b1693f38586940150ace84c2f9057f4d7fcc64eb80645d1512ea"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "1503133709b601acaf90536389f65a6ba32725867e79ad210432538c641382e7"
+      "sha256": "0fee9a8650df406535da5ceef77962fc63167990d3ca32290cded778219c7e80"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2997,7 +2997,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "9f5ad5e2fbbe0ef916d7a9519118fb06655553451f13d6070220ce93f083b89f"
+      "sha256": "1f1c7b5865a042ecc60fbb68c806b97fbf125370a6d17537cb6178c747c774dc"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b68ba24d900494bac49e77694a228c04794d1c0b5a43c4733159ee5429cbec4f"
+      "sha256": "61622b0e04b04643ec4dbb40fa1ca22010c7afc1e27da81d878c69b194ecac26"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3097,7 +3097,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "16e8909e4de1207587056fece1ee2fc2455778f569d3338043fd6bc5eb05543d"
+      "sha256": "88b9f5d7e3070c780c640b83c10cdbffd6411143d2a4e3c0f9bdd2a48126d9a1"
     },
     {
       "path": "docs/project-context.template.md",
@@ -10762,7 +10762,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "de0fb5b87a4069bb068b1aaa267678a90c82f42fb4ca615bbdb019de53020c36"
+      "sha256": "27630b553805d9ceabfdf773637df3a1198a3ca6bc7a2fc3fe9ac8b78e0744a6"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -11297,7 +11297,7 @@
     {
       "path": "modules/status-ui/public/README.md",
       "mode": "0000644",
-      "sha256": "77452dd9a7fcd5fb0b080cd74bc3c87dbd5dd02b30bc75e63076467291ddcdc3"
+      "sha256": "75f17ca1a5953b38a8166fe0aa6daa6fa5582c8ca163c69db87c6e96d297d1a0"
     },
     {
       "path": "modules/status-ui/public/explore.html",
@@ -11352,7 +11352,7 @@
     {
       "path": "modules/ui-design/docs/design-contract.md",
       "mode": "0000644",
-      "sha256": "a4032fc607a6864db56531bb68bbd89a4a55c58d41b1798e7500b8c23bca104b"
+      "sha256": "8a4375a548f75143f3ca3b05b5841ea8f02224b6613a45676985ad1f2038dcd0"
     },
     {
       "path": "modules/ui-design/kit/README.md",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "38c4ec31d6cb51fd92185003e550832f29d0e44f18f3a2df2b7d3594bdca972e"
+      "sha256": "dc1a30721a1d7001d1bdf3cef618f61c5153d415aa8a23b185f856a3188479ee"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0a9fbd43bcf2caa7e6c2b6faeef134a0dc96d7c5f1ee29519edf5d48ffb78db9"
+      "sha256": "b491bd0afc113786b92c543a484947d6ec14b0b9719985bb821bee081e6340a6"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "9735ab47bbd28140534686e37156442e586d1a7c5abce86f23ab0d546c9da0a7"
+      "sha256": "244eb52141bda5874d8575bc0e62b785fa775f9aa51f124e9cfc7509a709f713"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12267,7 +12267,7 @@
     {
       "path": "scripts/bongos/css-literal-scan.js",
       "mode": "0000644",
-      "sha256": "8da46806402a840192f29f93d98afd6b5018715f6fd4ce6fbe060e23ffc977de"
+      "sha256": "1dbcdb46cfd195c1080bdd37bc8337b0926cd5f6e281cd131656801f6c92b236"
     },
     {
       "path": "scripts/bongos/cutover-codemod.js",
@@ -15812,7 +15812,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "0d5a45ed0f8b8f907169a886504749887a659fbd2bdff23c28fa8146c3742a05"
+      "sha256": "ab9d8ea8916de44b0b716cacd8e42a3d51cc8e78e04eaac9837365765d0d17d3"
     },
     {
       "path": "src/bongos/sign-in-pages.js",
@@ -15842,7 +15842,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "fc21c374775cd9951283b28b319d687dda5b768113a7ca7734191fe6c139d6a4"
+      "sha256": "95b6aa41a818f16a2e48e62dda45e42e8800eeff8e1b959ce3e55e7ff22c504c"
     },
     {
       "path": "src/build-info.js",
@@ -15877,7 +15877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "06c54ea826895a4de9a90970d7b72e6479fada3880d45e1c1f164f29e7c319c5"
+      "sha256": "27521706c60b70d9a73933dd7385d00db4846d5e7eff66f8df918671016e3a82"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16677,7 +16677,7 @@
     {
       "path": "tests/brand_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "26684884f85c8ad99966ae4f7713552cc12709c0d41100b3d7a5b60b8d50c9af"
+      "sha256": "e39a15c534b0989c75ae44254de290b0487a33f5e0ec986ec10119d87ed217e6"
     },
     {
       "path": "tests/branding.mjs",
@@ -17412,7 +17412,7 @@
     {
       "path": "tests/design_counts_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "2fd9ecdc86bb0a9b2392db350568eb4776a27b3d3bd43e896686475707a61a85"
+      "sha256": "3e7457685c915d01d11ba4dd1481e726f82c83a3ce481f5190893e4b0636b7bc"
     },
     {
       "path": "tests/design_reference.mjs",
@@ -22237,7 +22237,7 @@
     {
       "path": "tests/status_company_attribution.mjs",
       "mode": "0000644",
-      "sha256": "585ab3d5617d01bfecfa67c157ce9bbaa0d5f5f9064faa41cfaa52ad55380670"
+      "sha256": "becfaa842aa426f4b34a11a4e7364b1a8c1da30847b1580ed63256362a35d048"
     },
     {
       "path": "tests/status_default_version.mjs",

package/config/branding.neutral.json

@@ -6,7 +6,8 @@
     "company": {
       "name": "",
       "site": "",
-      "tagline": ""
+      "tagline": "",
+      "mark": ""
     }
   },
   "llmProjectName": "this project",

package/docs/branding-contract.md

@@ -21,7 +21,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 |---|---|
 | `identity.productName` | The product name (e.g. "Example"). **Required.** |
 | `identity.worldName` | The in-world / civilization name rendered at runtime (e.g. "Example"). **Required.** |
-| `identity.company` | `{ name, site, tagline }` of the operating company — every field may be empty. `tagline` is the free-text clause that follows the name in the status page footer ("{{worldName}} is the work of **name**, *tagline*."), so put a location there if you want one; there is no separate location field. The footer stamps them as `{{companyName}}` / `{{companySite}}` / `{{companyTagline}}`, and each clause sits in a `<!--brand-if:KEY-->…<!--/brand-if:KEY-->` region that drops whole when its field is empty: no name hides the whole sentence, no site renders the name unlinked, no tagline ends the sentence at the name. (task [#1002853](https://cloudbongos.com/builders#/task/1002853)) |
+| `identity.company` | `{ name, site, tagline, mark }` of the operating company — every field may be empty. `mark` is an image URL for the company's mark, stamped as `{{companyMark}}` in the landing's maker band inside a `brand-if:companyMark` region: no mark, no image (task 1005139). `tagline` is the free-text clause that follows the name in the status page footer ("{{worldName}} is the work of **name**, *tagline*."), so put a location there if you want one; there is no separate location field. The footer stamps them as `{{companyName}}` / `{{companySite}}` / `{{companyTagline}}`, and each clause sits in a `<!--brand-if:KEY-->…<!--/brand-if:KEY-->` region that drops whole when its field is empty: no name hides the whole sentence, no site renders the name unlinked, no tagline ends the sentence at the name. (task [#1002853](https://cloudbongos.com/builders#/task/1002853)) |
 | `llmProjectName` | The project name injected into grader / architect / onboarding **LLM prompts**, so a non-OTB instance is graded against its own identity. **Required.** |
 | `domains.publicOrigin` | Public game/app origin. **Required.** |
 | `domains.buildersOrigin` / `statusOrigin` | Hall + status origins. **These three (`publicOrigin`/`buildersOrigin`/`statusOrigin`) are the docs-discovery contract** ([ADR 0114](adr/0114-instance-docs-discovery-contract.md)): the hall is the canonical doc-reading surface, `/docs` on `publicOrigin` renders the API reference, the status page is the outage fallback. `GET <publicOrigin>/api/bongos` re-advertises them (`hall`/`status`/`public`) so an agent resolves the surfaces with no hard-coded host. |

package/docs/copy-inventory.md

@@ -2236,7 +2236,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/connections.html:187` |
 | `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/contact.html:130` |
 | `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/guild.html:282` |
-| `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/index.html:953` |
+| `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/index.html:954` |
 | `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/invitations.html:190` |
 | `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/privacy.html:143` |
 | `afe83bbbd0d4` | certain | A non-profit, capture-resistant commons. | `modules/public-landing/public/projects.html:2185` |
@@ -2277,10 +2277,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `093091159e05` | certain | At present, all Bongos projects are held by {{companyName}} or its pilot clients. | `modules/public-landing/public/index.html:784` |
 | `caf18d1a2b8e` | certain | Auto (recommended) | `modules/public-landing/public/projects.html:2032` |
 | `b7ac7fbd7209` | certain | Back to your projects | `modules/public-landing/public/projects.html:1148` |
-| `4782de01c86b` | certain | Bongos Managed. | `modules/public-landing/public/index.html:912` |
+| `4782de01c86b` | certain | Bongos Managed. | `modules/public-landing/public/index.html:913` |
 | `750136e8637c` | certain | Bringing AI to the builder, ideator, and artist in everyone. | `modules/public-landing/public/index.html:769` |
 | `3aaad242a24c` | certain | Build command | `modules/public-landing/public/projects.html:1964` |
-| `0f1ec6cf9dfa` | certain | Build equity in multiple projects. | `modules/public-landing/public/index.html:926` |
+| `0f1ec6cf9dfa` | certain | Build equity in multiple projects. | `modules/public-landing/public/index.html:927` |
 | `0379baef7921` | certain | Builder guild access | `modules/public-landing/public/projects.html:2008` |
 | `9e64afc8d912` | certain | Builder of the month | `modules/public-landing/public/community.html:234` |
 | `39b61cc5172e` | certain | Builder of the week | `modules/public-landing/public/account.html:119` |
@@ -2335,7 +2335,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/connections.html:187` |
 | `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/contact.html:130` |
 | `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/guild.html:282` |
-| `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/index.html:959` |
+| `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/index.html:960` |
 | `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/invitations.html:190` |
 | `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/privacy.html:143` |
 | `90a128c97eae` | certain | Builders' hall | `modules/public-landing/public/projects.html:977` |
@@ -2349,14 +2349,14 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/connections.html:187` |
 | `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/contact.html:130` |
 | `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/guild.html:282` |
-| `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/index.html:953` |
+| `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/index.html:954` |
 | `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/invitations.html:190` |
 | `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/privacy.html:143` |
 | `bd315dd71ea7` | certain | Built by agents, on Cloud Bongos. | `modules/public-landing/public/terms.html:154` |
-| `d23b1ca38aee` | certain | Built by {{companyName}}, {{productName}} is our way of making AI co-building usable by entire project groups, | `modules/public-landing/public/index.html:897` |
+| `d23b1ca38aee` | certain | Built by {{companyName}}, {{productName}} is our way of making AI co-building usable by entire project groups, | `modules/public-landing/public/index.html:898` |
 | `20b4fa9a0424` | certain | Built on Bongos. | `modules/public-landing/public/index.html:783` |
 | `8639cc7fcada` | certain | Buttons here ask the platform to act; each row reports only what was verified, and when. A standup keeps going | `modules/public-landing/public/projects.html:1084` |
-| `101339c676b4` | certain | Buy microtransaction packages of code modules on our marketplace. | `modules/public-landing/public/index.html:914` |
+| `101339c676b4` | certain | Buy microtransaction packages of code modules on our marketplace. | `modules/public-landing/public/index.html:915` |
 | `aae97f9d46e9` | certain | By GitHub username. The invite is sent from your project’s own hall — that is the invite that lets them in — a | `modules/public-landing/public/projects.html:1392` |
 | `50d493f08964` | certain | Can find me | `modules/public-landing/public/account.html:251` |
 | `48d721eb2ed7` | certain | Can’t find me | `modules/public-landing/public/account.html:252` |
@@ -2423,8 +2423,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2f12266c6e37` | certain | Docker — use my repository’s Dockerfile | `modules/public-landing/public/projects.html:1961` |
 | `47d1558b17a3` | certain | Domain you own | `modules/public-landing/public/projects.html:1830` |
 | `8d812912c392` | certain | Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or o | `modules/public-landing/public/terms.html:143` |
-| `d919980d2ca5` | certain | Download our core code and protocols, and build instantly with your team. | `modules/public-landing/public/index.html:910` |
-| `41c49e22002d` | certain | Download the CLI | `modules/public-landing/public/index.html:943` |
+| `d919980d2ca5` | certain | Download our core code and protocols, and build instantly with your team. | `modules/public-landing/public/index.html:911` |
+| `41c49e22002d` | certain | Download the CLI | `modules/public-landing/public/index.html:944` |
 | `544a3fb1602a` | certain | Each is the builder who earned the most {{currency}} across every project in that time, among the builders who | `modules/public-landing/public/community.html:237` |
 | `31881554ecb8` | certain | Each sign-in creates a session: a random token. A signed-out or expired session stays on record but can no lon | `modules/public-landing/public/privacy.html:113` |
 | `b451221d44da` | certain | Each week is decided once, the first time a community page asks for it after it ends, and it does not change a | `modules/public-landing/public/community.html:301` |
@@ -2432,7 +2432,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a4a940d2a56` | certain | Emersonian Circles | `modules/public-landing/public/index.html:798` |
 | `9150fa905ba4` | certain | Enough for a small version. Trim it to one shared list, voting and a winner reveal; accounts and notifications | `modules/public-landing/public/projects.html:1606` |
 | `05fed739a9e1` | certain | Enter Genesis | `modules/public-landing/public/projects.html:2160` |
-| `af5ca714d375` | certain | Equity issuance, business filing, and builder compensation. | `modules/public-landing/public/index.html:917` |
+| `af5ca714d375` | certain | Equity issuance, business filing, and builder compensation. | `modules/public-landing/public/index.html:918` |
 | `ca61755eef01` | certain | Erased for good: | `modules/public-landing/public/projects.html:1491` |
 | `78611d18f54b` | certain | Every part of this — what is stored, where, and for how long — is public. This site runs Cloud Bongos, free so | `modules/public-landing/public/privacy.html:138` |
 | `069634b92263` | certain | Every project gets one on this platform, at its own handle. You can point a domain you already own at it inste | `modules/public-landing/public/projects.html:1254` |
@@ -2468,21 +2468,21 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f1e93ba98ceb` | certain | Find a builder | `modules/public-landing/public/projects.html:876` |
 | `f1e93ba98ceb` | certain | Find a builder | `modules/public-landing/public/terms.html:72` |
 | `f1e93ba98ceb` | certain | Find a builder | `modules/public-landing/public/terms.html:85` |
-| `0208e4bbba9c` | certain | Find a project | `modules/public-landing/public/index.html:940` |
+| `0208e4bbba9c` | certain | Find a project | `modules/public-landing/public/index.html:941` |
 | `0208e4bbba9c` | certain | Find a project | `modules/public-landing/public/projects.html:825` |
 | `483a7eff25f2` | certain | Find a project to join | `modules/public-landing/public/index.html:773` |
 | `964c23113e4f` | certain | Follow the people :) | `modules/public-landing/public/contact.html:115` |
 | `0a0667aea2db` | certain | Footer doors before launch: privacy, terms and contact pages linked from the landing page and the hub | `modules/public-landing/public/index.html:873` |
 | `1977ccbf64e3` | certain | For Cloud Bongos itself — the platform these projects run on — two environments of its own. | `modules/public-landing/public/contact.html:125` |
-| `f510ba460300` | certain | For builders | `modules/public-landing/public/index.html:923` |
-| `dbced351ca0d` | certain | For founders | `modules/public-landing/public/index.html:907` |
+| `f510ba460300` | certain | For builders | `modules/public-landing/public/index.html:924` |
+| `dbced351ca0d` | certain | For founders | `modules/public-landing/public/index.html:908` |
 | `6007218fd3d9` | certain | For-profit company | `modules/public-landing/public/projects.html:1702` |
 | `1497b6e85da0` | certain | Free core only | `modules/public-landing/public/projects.html:1997` |
 | `aab2b51efeab` | certain | Free while we find our feet. Your project’s repo and server are yours — | `modules/public-landing/public/projects.html:1557` |
 | `0808df6e434c` | certain | From your settings you can hide your statistics, drop out of the recruiting directory, or make your account pr | `modules/public-landing/public/terms.html:128` |
 | `255bc1ce35eb` | certain | Full access | `modules/public-landing/public/projects.html:1674` |
 | `688eb71d9170` | certain | Future payouts | `modules/public-landing/public/projects.html:1910` |
-| `8bb1f00b1558` | certain | Get access to our advanced project presets and module packages. | `modules/public-landing/public/index.html:916` |
+| `8bb1f00b1558` | certain | Get access to our advanced project presets and module packages. | `modules/public-landing/public/index.html:917` |
 | `36e5a4d78071` | certain | GitHub handle | `modules/public-landing/public/projects.html:2149` |
 | `36e5a4d78071` | certain | GitHub handle | `modules/public-landing/public/projects.html:2150` |
 | `98eb6344d39e` | certain | GitHub owner | `modules/public-landing/public/projects.html:1799` |
@@ -2491,7 +2491,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8c815a28df30` | certain | GitHub, Google or both. Each one opens this same account, with the same credits, ranks and history. | `modules/public-landing/public/account.html:221` |
 | `cf1458a108cd` | certain | Guild name or /g/ address | `modules/public-landing/public/projects.html:1409` |
 | `4a96e3af1110` | certain | Guild name or address | `modules/public-landing/public/projects.html:1408` |
-| `41778f67b4c9` | certain | Have us handle your hosting. | `modules/public-landing/public/index.html:915` |
+| `41778f67b4c9` | certain | Have us handle your hosting. | `modules/public-landing/public/index.html:916` |
 | `50dd0f948962` | certain | Have you found a way into our little system of minimal importance? Contact the project owner directly. | `modules/public-landing/public/contact.html:121` |
 | `ccd4861996eb` | certain | Hide it | `modules/public-landing/public/account.html:276` |
 | `978da2e651bd` | certain | Hosted projects | `modules/public-landing/public/terms.html:119` |
@@ -2615,12 +2615,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/connections.html:187` |
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/contact.html:130` |
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/guild.html:282` |
-| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/index.html:953` |
+| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/index.html:954` |
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/invitations.html:190` |
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/privacy.html:143` |
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/projects.html:2185` |
 | `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/terms.html:154` |
-| `275ca0d5ce65` | certain | Open source. | `modules/public-landing/public/index.html:910` |
+| `275ca0d5ce65` | certain | Open source. | `modules/public-landing/public/index.html:911` |
 | `1e116d8fe95a` | certain | Open to recruiters | `modules/public-landing/public/account.html:121` |
 | `1e116d8fe95a` | certain | Open to recruiters | `modules/public-landing/public/account.html:133` |
 | `1e116d8fe95a` | certain | Open to recruiters | `modules/public-landing/public/community.html:189` |
@@ -2662,7 +2662,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `875e313de939` | certain | Physical files or work is the main one | `modules/public-landing/public/projects.html:1746` |
 | `af309d83b861` | certain | Pick a project from the map, or paste any project’s address — its owner sees your application in their own que | `modules/public-landing/public/invitations.html:173` |
 | `d4e9bf625ab3` | certain | Pick one of your repositories | `modules/public-landing/public/projects.html:1769` |
-| `384c5b38f500` | certain | Play as a: game or learning experience. | `modules/public-landing/public/index.html:928` |
+| `384c5b38f500` | certain | Play as a: game or learning experience. | `modules/public-landing/public/index.html:929` |
 | `b131252149e6` | certain | Play cloud hop while you wait | `modules/public-landing/public/projects.html:2122` |
 | `fe7e815b989c` | certain | Privacy Page | `modules/public-landing/public/contact.html:118` |
 | `d0c4d9ddcd71` | certain | Private individual | `modules/public-landing/public/projects.html:1709` |
@@ -2786,7 +2786,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `26e3868ace39` | certain | Sort the projects | `modules/public-landing/public/projects.html:960` |
 | `fa9afbbe8173` | certain | Sorted by name, A to Z. | `modules/public-landing/public/projects.html:981` |
 | `2ae36be1c531` | certain | Start a project | `modules/public-landing/public/index.html:774` |
-| `2ae36be1c531` | certain | Start a project | `modules/public-landing/public/index.html:939` |
+| `2ae36be1c531` | certain | Start a project | `modules/public-landing/public/index.html:940` |
 | `2ae36be1c531` | certain | Start a project | `modules/public-landing/public/projects.html:936` |
 | `e7c7838545ee` | certain | Start command | `modules/public-landing/public/projects.html:1967` |
 | `9a042be7cfd7` | certain | Starting from zero | `modules/public-landing/public/projects.html:1739` |
@@ -2824,7 +2824,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `502ab071ba33` | certain | The short version: this is free software run by its owner, your code stays yours, and you are responsible for  | `modules/public-landing/public/terms.html:105` |
 | `40ed6300ba27` | certain | The six most recent shipped tasks. | `modules/public-landing/public/index.html:845` |
 | `c0c201325b44` | certain | The totals add up everyone else. | `modules/public-landing/public/guild.html:226` |
-| `73230bca8688` | certain | The {{companyName}} mark | `modules/public-landing/public/index.html:894` |
+| `73230bca8688` | certain | The {{companyName}} mark | `modules/public-landing/public/index.html:895` |
 | `ae77c49f9671` | certain | Their handle | `modules/public-landing/public/connections.html:174` |
 | `ae77c49f9671` | certain | Their handle | `modules/public-landing/public/connections.html:175` |
 | `541d5a7612a9` | certain | Their name or handle | `modules/public-landing/public/community.html:312` |
@@ -2851,7 +2851,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `50f764cf1229` | certain | Two things, and only two: a name — this project already has one — and a description of what it is. Modules, ar | `modules/public-landing/public/projects.html:1240` |
 | `b0c3729108be` | certain | Type a country | `modules/public-landing/public/projects.html:1657` |
 | `bd1761f316f7` | certain | Type a state or province | `modules/public-landing/public/projects.html:1661` |
-| `a165999f36a9` | certain | Types of projects | `modules/public-landing/public/index.html:908` |
+| `a165999f36a9` | certain | Types of projects | `modules/public-landing/public/index.html:909` |
 | `2f740afee113` | certain | US and EU | `modules/public-landing/public/projects.html:1681` |
 | `693b824cb0b9` | certain | US only | `modules/public-landing/public/projects.html:1680` |
 | `11416e2b83fa` | certain | Use these | `modules/public-landing/public/projects.html:1617` |
@@ -2859,7 +2859,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b97287183335` | certain | View Projects | `modules/public-landing/public/index.html:802` |
 | `f68a38de7e1b` | certain | Visitors who aren’t signed in meet a sign-in door instead of the project’s pages — its front page, its status  | `modules/public-landing/public/projects.html:1284` |
 | `3d6b0bf6c2db` | certain | Waiting on you | `modules/public-landing/public/invitations.html:154` |
-| `3597d73ce7f9` | certain | Ways to get paid/rewarded | `modules/public-landing/public/index.html:924` |
+| `3597d73ce7f9` | certain | Ways to get paid/rewarded | `modules/public-landing/public/index.html:925` |
 | `5361539434e0` | certain | We already have a legal entity | `modules/public-landing/public/projects.html:1696` |
 | `784aa2a44bf0` | certain | We couldn’t read your GitHub repositories just now, so enter the repo by hand below. | `modules/public-landing/public/projects.html:1766` |
 | `0d15556febdd` | certain | We don’t have one yet | `modules/public-landing/public/projects.html:1711` |
@@ -2909,7 +2909,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `101301013616` | certain | Why there is nowhere to type the value | `modules/public-landing/public/projects.html:1374` |
 | `f1474a4af906` | certain | Will anyone under 18 build? | `modules/public-landing/public/projects.html:1663` |
 | `5ca5f2595a65` | certain | Word documents, spreadsheets, other software. | `modules/public-landing/public/projects.html:1745` |
-| `a581f96fb2c8` | certain | Work as a paid contractor for companies big, medium and small. | `modules/public-landing/public/index.html:927` |
+| `a581f96fb2c8` | certain | Work as a paid contractor for companies big, medium and small. | `modules/public-landing/public/index.html:928` |
 | `ee4b8cc687f7` | certain | Works shipped | `modules/public-landing/public/guild.html:259` |
 | `8a4892d03781` | certain | World round: PRODUCT.md and four style candidates across landing, hall and status | `modules/public-landing/public/index.html:867` |
 | `2388a450deb9` | certain | You agree to follow the terms and usage policies of the AI company whose model answers your request, and OpenR | `modules/public-landing/public/terms.html:136` |

package/docs/copy-registry.json

@@ -394,7 +394,7 @@
         "modules/public-landing/public/connections.html:187",
         "modules/public-landing/public/contact.html:130",
         "modules/public-landing/public/guild.html:282",
-        "modules/public-landing/public/index.html:959",
+        "modules/public-landing/public/index.html:960",
         "modules/public-landing/public/invitations.html:190",
         "modules/public-landing/public/privacy.html:143",
         "modules/public-landing/public/projects.html:977",
@@ -452,7 +452,7 @@
         "modules/public-landing/public/connections.html:187",
         "modules/public-landing/public/contact.html:130",
         "modules/public-landing/public/guild.html:282",
-        "modules/public-landing/public/index.html:953",
+        "modules/public-landing/public/index.html:954",
         "modules/public-landing/public/invitations.html:190",
         "modules/public-landing/public/privacy.html:143",
         "modules/public-landing/public/projects.html:2185",
@@ -506,7 +506,7 @@
         "modules/public-landing/public/connections.html:187",
         "modules/public-landing/public/contact.html:130",
         "modules/public-landing/public/guild.html:282",
-        "modules/public-landing/public/index.html:953",
+        "modules/public-landing/public/index.html:954",
         "modules/public-landing/public/invitations.html:190",
         "modules/public-landing/public/privacy.html:143",
         "modules/public-landing/public/projects.html:2185",
@@ -578,7 +578,7 @@
         "modules/public-landing/public/connections.html:187",
         "modules/public-landing/public/contact.html:130",
         "modules/public-landing/public/guild.html:282",
-        "modules/public-landing/public/index.html:953",
+        "modules/public-landing/public/index.html:954",
         "modules/public-landing/public/invitations.html:190",
         "modules/public-landing/public/privacy.html:143",
         "modules/public-landing/public/terms.html:154"
@@ -963,7 +963,7 @@
       "occurrences": 3,
       "at": [
         "modules/public-landing/public/index.html:774",
-        "modules/public-landing/public/index.html:939",
+        "modules/public-landing/public/index.html:940",
         "modules/public-landing/public/projects.html:936"
       ]
     },
@@ -1581,7 +1581,7 @@
       "text": "Find a project",
       "occurrences": 2,
       "at": [
-        "modules/public-landing/public/index.html:940",
+        "modules/public-landing/public/index.html:941",
         "modules/public-landing/public/projects.html:825"
       ]
     },
@@ -21537,7 +21537,7 @@
       "surface": "landing",
       "text": "A non-profit, capture-resistant commons.",
       "file": "modules/public-landing/public/index.html",
-      "line": 953,
+      "line": 954,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -21906,7 +21906,7 @@
       "surface": "landing",
       "text": "Bongos Managed.",
       "file": "modules/public-landing/public/index.html",
-      "line": 912,
+      "line": 913,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -21933,7 +21933,7 @@
       "surface": "landing",
       "text": "Build equity in multiple projects.",
       "file": "modules/public-landing/public/index.html",
-      "line": 926,
+      "line": 927,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -22428,7 +22428,7 @@
       "surface": "landing",
       "text": "Builders' hall",
       "file": "modules/public-landing/public/index.html",
-      "line": 959,
+      "line": 960,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -22554,7 +22554,7 @@
       "surface": "landing",
       "text": "Built by agents, on Cloud Bongos.",
       "file": "modules/public-landing/public/index.html",
-      "line": 953,
+      "line": 954,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -22590,7 +22590,7 @@
       "surface": "landing",
       "text": "Built by {{companyName}}, {{productName}} is our way of making AI co-building usable by entire project groups, whether that's a 5,000-person company, a 100-person department, a college research project, or a solo dev.",
       "file": "modules/public-landing/public/index.html",
-      "line": 897,
+      "line": 898,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -22617,7 +22617,7 @@
       "surface": "landing",
       "text": "Buy microtransaction packages of code modules on our marketplace.",
       "file": "modules/public-landing/public/index.html",
-      "line": 914,
+      "line": 915,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23220,7 +23220,7 @@
       "surface": "landing",
       "text": "Download our core code and protocols, and build instantly with your team.",
       "file": "modules/public-landing/public/index.html",
-      "line": 910,
+      "line": 911,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23229,7 +23229,7 @@
       "surface": "landing",
       "text": "Download the CLI",
       "file": "modules/public-landing/public/index.html",
-      "line": 943,
+      "line": 944,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23301,7 +23301,7 @@
       "surface": "landing",
       "text": "Equity issuance, business filing, and builder compensation.",
       "file": "modules/public-landing/public/index.html",
-      "line": 917,
+      "line": 918,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23625,7 +23625,7 @@
       "surface": "landing",
       "text": "Find a project",
       "file": "modules/public-landing/public/index.html",
-      "line": 940,
+      "line": 941,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23679,7 +23679,7 @@
       "surface": "landing",
       "text": "For builders",
       "file": "modules/public-landing/public/index.html",
-      "line": 923,
+      "line": 924,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23688,7 +23688,7 @@
       "surface": "landing",
       "text": "For founders",
       "file": "modules/public-landing/public/index.html",
-      "line": 907,
+      "line": 908,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23751,7 +23751,7 @@
       "surface": "landing",
       "text": "Get access to our advanced project presets and module packages.",
       "file": "modules/public-landing/public/index.html",
-      "line": 916,
+      "line": 917,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -23832,7 +23832,7 @@
       "surface": "landing",
       "text": "Have us handle your hosting.",
       "file": "modules/public-landing/public/index.html",
-      "line": 915,
+      "line": 916,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -24948,7 +24948,7 @@
       "surface": "landing",
       "text": "Open source",
       "file": "modules/public-landing/public/index.html",
-      "line": 953,
+      "line": 954,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -24993,7 +24993,7 @@
       "surface": "landing",
       "text": "Open source.",
       "file": "modules/public-landing/public/index.html",
-      "line": 910,
+      "line": 911,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -25371,7 +25371,7 @@
       "surface": "landing",
       "text": "Play as a: game or learning experience.",
       "file": "modules/public-landing/public/index.html",
-      "line": 928,
+      "line": 929,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -26487,7 +26487,7 @@
       "surface": "landing",
       "text": "Start a project",
       "file": "modules/public-landing/public/index.html",
-      "line": 939,
+      "line": 940,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -26829,7 +26829,7 @@
       "surface": "landing",
       "text": "The {{companyName}} mark",
       "file": "modules/public-landing/public/index.html",
-      "line": 894,
+      "line": 895,
       "origin": "html-attr:alt",
       "confidence": "certain"
     },
@@ -27072,7 +27072,7 @@
       "surface": "landing",
       "text": "Types of projects",
       "file": "modules/public-landing/public/index.html",
-      "line": 908,
+      "line": 909,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -27144,7 +27144,7 @@
       "surface": "landing",
       "text": "Ways to get paid/rewarded",
       "file": "modules/public-landing/public/index.html",
-      "line": 924,
+      "line": 925,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -27594,7 +27594,7 @@
       "surface": "landing",
       "text": "Work as a paid contractor for companies big, medium and small.",
       "file": "modules/public-landing/public/index.html",
-      "line": 927,
+      "line": 928,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -121,7 +121,7 @@
 │   ├── raise/                   ← the /raise investor page (task 1004847, ADR 0384, default-off; hub only): password-gated for investors (signing in accepts the NDA, non-binding interest), edited in place by any active builder with every change logged. The copy in content/ is the owner's words — never reword it in code. module.json, CLAUDE.md, raise.js (pure), page.js, web.js (the GET-only raise.web port core mounts at /raise), db.js, routes/ (every write), migrations/, content/, views/, public/.
 │   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/bongos/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
 │   ├── render-deploy/           ← the deploy page for a project whose app deploys through Render (task 1004270, default-OFF). The service's Render deploys, each tied to its commit and the Bongos tasks in it, what is live now, and deploy + roll back behind a two-step confirm the server also holds. The owner's Render key is never stored: it rides each request in a header. Uses the one Render client, scripts/bongos/render-api.js, and its ownerId guard. `deploys.js` (shaping + ledger), `render.js` (key + client), `routes/` (app, history, act), `public/deploy.js` (the page, mounted in /deploy), `migrations/` (one two-id table)
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/bongos/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470 (below); design-taste-frontend-v1 was deleted. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/bongos/, which keeps thin shims), docs/design-contract.md (moved from docs/). Contributes.skills design (the /design playbook) + design-sync + figma-design-sync; no routes/port/migrations, but it DOES serve files every surface loads (task 1005139): public/tokens.css (the shared --ds-* token sheet every surface links, task 1005081), public/brand/ (mark.svg, the one logo source, plus the logo, favicon and PNG files scripts/bongos/gen-brand.js writes from it, with png-sources.json recording the PNGs' hashes, tasks 1005088/1005133), and public/brand.html + brand.css (the /brand design-system reference on the hub, task 1005083). Its generators: scripts/gen-design-tokens.js (config/design-tokens.neutral.json) and scripts/gen-design-reference.js (brand.html), plus core's scripts/bongos/gen-brand.js; all three are checked fresh by fitness (scripts/bongos/design-generators-fresh.js). Disabling the module 404s those files (the module-asset route serves enabled modules only) and drops /brand, so every surface loses its token sheet and logo. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470 (below); design-taste-frontend-v1 was deleted. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── design-styles/           ← the opt-in design-style skills (task 1004470, default-OFF): split out of ui-design so the thirteen descriptions are not resident on an instance that never designs a page; an instance turns it on with "design-styles": true in config/modules.json, and /design says plainly when it is off. Declaration-only: module.json, CLAUDE.md, skills/. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in modules/ui-design/styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's modules/ui-design/styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json.
 │   ├── pixel-art/               ← the opt-in pixel-art skills (task 1004470, default-OFF): otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture, otb-figma-sync under skills/<name>/SKILL.md — moved out of .claude/skills/, where they were orphans no manifest owned. Skill TEXT only: the pipeline, palette, rubric and the copyrighted reference maps stay in the instance's never-published art-pipeline (ADR 0098). module.json, CLAUDE.md, skills/.
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest (its otb-character-review skill is the pixel-art module's since task 1004470). CLAUDE.md, module.json.
@@ -271,7 +271,7 @@
 │   │   ├── world.css               ← the WORLD token layer (ADR 0196): contract tier = the pack, derived tier both modes, root-absolute plate token pairs, the reduced-motion kill switch; no page composition
 │   │   ├── world/                  ← the six production plates + <file>.json provenance sidecars (embed-prompt.mjs --scan clean): r2-chrome-blobs-set.webp, r2-chrome-blob-one.webp, r2-bongos-chrome-b.webp (black plates, dark mode, lighten; each beside the verbatim .jpg it is encoded from) and their -cut.webp alpha twins (light mode); og-card.jpg (the social card, captured from the page)
 │   │   ├── cosmos.css              ← the HUB component sheet (task 1002696): contract tier synced to the pack, its own derived + dark tiers, the .btn/.chip/.strip/.proj/.tbl vocabulary; measured by tests/cosmos_token_contrast.mjs
-│   │   └── verro-medallion.png     ← the Verro Labs mark (apex-only block)
+│   │   └── verro-medallion.png     ← the hub maker's mark; shown only when the pack names it as identity.company.mark (task 1005139)
 │
 ├── public/                         ← example.com — the game (product)
 │   ├── index.html

package/docs/module-api-changelog.md

@@ -3372,5 +3372,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.57 with no explicit bump. run 42380593295. (task 1002620)
   1.24.59 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.58 with no explicit bump. run 42385816081. (task 1002620)
+  1.24.60 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.59 with no explicit bump. run 42387285187. (task 1002620)
+  1.24.61 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.60 with no explicit bump. run 42387971712. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -4014,7 +4014,7 @@
       "surface": "landing",
       "title": "{{productName}}: {{tagline}}",
       "states_read": ["out","in","out-projects","in-profile","cli-out"],
-      "files_hash": "f1572bf4d31ba334",
+      "files_hash": "40d8d50f1bbcbd70",
       "reading_hash": "317e0e1b725dc1f0",
       "counts": {"lines":85,"placed":50,"shared":16,"unplaced":19},
       "omitted": {"data":6},
@@ -4072,39 +4072,39 @@
         {"key":"L0050","section":"A project as a codebase, regardless of function.","text":"Footer doors before launch: privacy, terms and contact pages linked from the landing page and the hub","placement":"placed","file":"modules/public-landing/public/index.html","line":873,"string_id":"0a0667aea2db"},
         {"key":"L0051","section":"A project as a codebase, regardless of function.","text":"26 Aug","placement":"unplaced","occurrences":2},
         {"key":"L0052","section":"A project as a codebase, regardless of function.","text":"Task titles are write-once, no route can edit one, so a wrong title is permanent","placement":"placed","file":"modules/public-landing/public/index.html","line":879,"string_id":"052e2da986c2"},
-        {"key":"L0053","section":"A project as a codebase, regardless of function.","text":"For founders","placement":"placed","file":"modules/public-landing/public/index.html","line":907,"string_id":"dbced351ca0d"},
-        {"key":"L0054","section":"Types of projects","text":"Types of projects","placement":"placed","file":"modules/public-landing/public/index.html","line":908,"string_id":"a165999f36a9"},
-        {"key":"L0055","section":"Types of projects","text":"Open source.","placement":"placed","file":"modules/public-landing/public/index.html","line":910,"string_id":"275ca0d5ce65"},
-        {"key":"L0056","section":"Types of projects","text":"Download our core code and protocols, and build instantly with your team.","placement":"placed","file":"modules/public-landing/public/index.html","line":910,"string_id":"d919980d2ca5"},
-        {"key":"L0057","section":"Types of projects","text":"Bongos Managed.","placement":"placed","file":"modules/public-landing/public/index.html","line":912,"string_id":"4782de01c86b"},
-        {"key":"L0058","section":"Types of projects","text":"Buy microtransaction packages of code modules on our marketplace.","placement":"placed","file":"modules/public-landing/public/index.html","line":914,"string_id":"101339c676b4"},
-        {"key":"L0059","section":"Types of projects","text":"Have us handle your hosting.","placement":"placed","file":"modules/public-landing/public/index.html","line":915,"string_id":"41778f67b4c9"},
-        {"key":"L0060","section":"Types of projects","text":"Get access to our advanced project presets and module packages.","placement":"placed","file":"modules/public-landing/public/index.html","line":916,"string_id":"8bb1f00b1558"},
-        {"key":"L0061","section":"Types of projects","text":"Equity issuance, business filing, and builder compensation.","placement":"placed","file":"modules/public-landing/public/index.html","line":917,"string_id":"af5ca714d375"},
-        {"key":"L0062","section":"Types of projects","text":"For builders","placement":"placed","file":"modules/public-landing/public/index.html","line":923,"string_id":"f510ba460300"},
-        {"key":"L0063","section":"Ways to get paid/rewarded","text":"Ways to get paid/rewarded","placement":"placed","file":"modules/public-landing/public/index.html","line":924,"string_id":"3597d73ce7f9"},
-        {"key":"L0064","section":"Ways to get paid/rewarded","text":"Build equity in multiple projects.","placement":"placed","file":"modules/public-landing/public/index.html","line":926,"string_id":"0f1ec6cf9dfa"},
-        {"key":"L0065","section":"Ways to get paid/rewarded","text":"Work as a paid contractor for companies big, medium and small.","placement":"placed","file":"modules/public-landing/public/index.html","line":927,"string_id":"a581f96fb2c8"},
-        {"key":"L0066","section":"Ways to get paid/rewarded","text":"Play as a: game or learning experience.","placement":"placed","file":"modules/public-landing/public/index.html","line":928,"string_id":"384c5b38f500"},
+        {"key":"L0053","section":"A project as a codebase, regardless of function.","text":"For founders","placement":"placed","file":"modules/public-landing/public/index.html","line":908,"string_id":"dbced351ca0d"},
+        {"key":"L0054","section":"Types of projects","text":"Types of projects","placement":"placed","file":"modules/public-landing/public/index.html","line":909,"string_id":"a165999f36a9"},
+        {"key":"L0055","section":"Types of projects","text":"Open source.","placement":"placed","file":"modules/public-landing/public/index.html","line":911,"string_id":"275ca0d5ce65"},
+        {"key":"L0056","section":"Types of projects","text":"Download our core code and protocols, and build instantly with your team.","placement":"placed","file":"modules/public-landing/public/index.html","line":911,"string_id":"d919980d2ca5"},
+        {"key":"L0057","section":"Types of projects","text":"Bongos Managed.","placement":"placed","file":"modules/public-landing/public/index.html","line":913,"string_id":"4782de01c86b"},
+        {"key":"L0058","section":"Types of projects","text":"Buy microtransaction packages of code modules on our marketplace.","placement":"placed","file":"modules/public-landing/public/index.html","line":915,"string_id":"101339c676b4"},
+        {"key":"L0059","section":"Types of projects","text":"Have us handle your hosting.","placement":"placed","file":"modules/public-landing/public/index.html","line":916,"string_id":"41778f67b4c9"},
+        {"key":"L0060","section":"Types of projects","text":"Get access to our advanced project presets and module packages.","placement":"placed","file":"modules/public-landing/public/index.html","line":917,"string_id":"8bb1f00b1558"},
+        {"key":"L0061","section":"Types of projects","text":"Equity issuance, business filing, and builder compensation.","placement":"placed","file":"modules/public-landing/public/index.html","line":918,"string_id":"af5ca714d375"},
+        {"key":"L0062","section":"Types of projects","text":"For builders","placement":"placed","file":"modules/public-landing/public/index.html","line":924,"string_id":"f510ba460300"},
+        {"key":"L0063","section":"Ways to get paid/rewarded","text":"Ways to get paid/rewarded","placement":"placed","file":"modules/public-landing/public/index.html","line":925,"string_id":"3597d73ce7f9"},
+        {"key":"L0064","section":"Ways to get paid/rewarded","text":"Build equity in multiple projects.","placement":"placed","file":"modules/public-landing/public/index.html","line":927,"string_id":"0f1ec6cf9dfa"},
+        {"key":"L0065","section":"Ways to get paid/rewarded","text":"Work as a paid contractor for companies big, medium and small.","placement":"placed","file":"modules/public-landing/public/index.html","line":928,"string_id":"a581f96fb2c8"},
+        {"key":"L0066","section":"Ways to get paid/rewarded","text":"Play as a: game or learning experience.","placement":"placed","file":"modules/public-landing/public/index.html","line":929,"string_id":"384c5b38f500"},
         {"key":"L0067","section":"Ways to get paid/rewarded","text":"Start a project","placement":"placed","file":"modules/public-landing/public/index.html","line":774,"string_id":"2ae36be1c531"},
-        {"key":"L0068","section":"Ways to get paid/rewarded","text":"Find a project","placement":"placed","file":"modules/public-landing/public/index.html","line":940,"string_id":"0208e4bbba9c"},
-        {"key":"L0069","section":"Ways to get paid/rewarded","text":"Download the CLI","placement":"placed","file":"modules/public-landing/public/index.html","line":943,"string_id":"41c49e22002d","state":"cli-out"},
+        {"key":"L0068","section":"Ways to get paid/rewarded","text":"Find a project","placement":"placed","file":"modules/public-landing/public/index.html","line":941,"string_id":"0208e4bbba9c"},
+        {"key":"L0069","section":"Ways to get paid/rewarded","text":"Download the CLI","placement":"placed","file":"modules/public-landing/public/index.html","line":944,"string_id":"41c49e22002d","state":"cli-out"},
         {"key":"L0070","section":"Ways to get paid/rewarded","text":"macOS, Apple silicon · v0.4.2","placement":"unplaced","state":"cli-out"},
         {"key":"L0071","section":"Ways to get paid/rewarded","text":"Also for","placement":"unplaced","state":"cli-out"},
         {"key":"L0072","section":"Ways to get paid/rewarded","text":"macOS, Intel","placement":"unplaced","state":"cli-out"},
         {"key":"L0073","section":"Ways to get paid/rewarded","text":"Linux, x64","placement":"unplaced","state":"cli-out"},
         {"key":"L0074","section":"Ways to get paid/rewarded","text":"Linux, ARM64","placement":"unplaced","state":"cli-out"},
         {"key":"L0075","section":"Ways to get paid/rewarded","text":"Windows","placement":"unplaced","state":"cli-out"},
-        {"key":"L0076","section":"footer","text":"A non-profit, capture-resistant commons.","placement":"shared","file":"modules/public-landing/public/index.html","line":953,"string_id":"afe83bbbd0d4"},
-        {"key":"L0077","section":"footer","text":"Built by agents, on Cloud Bongos.","placement":"shared","file":"modules/public-landing/public/index.html","line":953,"string_id":"bd315dd71ea7"},
-        {"key":"L0078","section":"footer","text":"Open source","placement":"shared","file":"modules/public-landing/public/index.html","line":953,"string_id":"d6314ddcc1d0"},
+        {"key":"L0076","section":"footer","text":"A non-profit, capture-resistant commons.","placement":"shared","file":"modules/public-landing/public/index.html","line":954,"string_id":"afe83bbbd0d4"},
+        {"key":"L0077","section":"footer","text":"Built by agents, on Cloud Bongos.","placement":"shared","file":"modules/public-landing/public/index.html","line":954,"string_id":"bd315dd71ea7"},
+        {"key":"L0078","section":"footer","text":"Open source","placement":"shared","file":"modules/public-landing/public/index.html","line":954,"string_id":"d6314ddcc1d0"},
         {"key":"L0079","section":"footer","text":"AGPL-3.0","placement":"shared"},
         {"key":"L0080","section":"footer","text":"About","placement":"shared"},
         {"key":"L0081","section":"footer","text":"Docs","placement":"shared"},
         {"key":"L0082","section":"footer","text":"Privacy","placement":"shared"},
         {"key":"L0083","section":"footer","text":"Terms","placement":"shared"},
         {"key":"L0084","section":"footer","text":"Contact","placement":"shared"},
-        {"key":"L0085","section":"footer","text":"Builders' hall","placement":"shared","file":"modules/public-landing/public/index.html","line":959,"string_id":"90a128c97eae"}
+        {"key":"L0085","section":"footer","text":"Builders' hall","placement":"shared","file":"modules/public-landing/public/index.html","line":960,"string_id":"90a128c97eae"}
       ]
     },
     {

package/modules/public-landing/public/index.html

@@ -887,11 +887,12 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 <!--apex-only:start-->
   <!-- The maker's band (task 1005091): the company is the pack's (identity.company), never
        a name written into the portable landing, and the band drops whole when the pack
-       names none. The medallion is the hub's own asset. -->
+       names none. Its mark is the pack's too (identity.company.mark, task 1005139): no
+       mark in the pack, no image, so another company never wears the hub's medallion. -->
   <!--brand-if:companyName--><section class="band">
     <div class="wrap verro">
-      <img src="/assets/verro-medallion.png" width="384" height="384" loading="lazy" decoding="async"
-           alt="The {{companyName}} mark">
+      <!--brand-if:companyMark--><img src="{{companyMark}}" width="384" height="384" loading="lazy" decoding="async"
+           alt="The {{companyName}} mark"><!--/brand-if:companyMark-->
       <div>
         <p class="wordmark">{{companyName}}</p>
         <p class="body">Built by {{companyName}}, {{productName}} is our way of making AI co-building usable by entire project groups, whether that's a 5,000-person company, a 100-person department, a college research project, or a solo dev.</p>

package/modules/status-ui/public/README.md

@@ -17,7 +17,7 @@ The mirror is a port of these files with three changes:
 
 1. **Availability banner (always truthful):** a top strip reads the external prober's `status.json` from the off-box `status-data` branch (`raw.githubusercontent.com`) — so it shows the *real* up/down even when the droplet (and its API) are down.
 2. **Dev panels (degrade gracefully):** `status.js`'s `API` base points at the absolute droplet origin (`https://example.com`); `/api/bongos/public/*` now sends `<redacted>: *` (see `src/bongos/routes/public.js`) so the panels load cross-origin. Each fetch already `.catch(() => null)`, so when the droplet is down the panels show their empty state instead of breaking the page.
-3. **Assets are relative** so the page works at both the GitHub Pages URL and the custom domain.
+3. **Assets are root-absolute** (`/style.css`, `/status.js`, `/modules/ui-design/public/tokens.css`, `/modules/ui-design/public/brand/…`, `/modules/hall-ui/public/controls.css`): `scripts/status-mirror-sync.js` publishes the shared files at the same paths, so the links resolve on the custom domain (served from the host root). They do not resolve under a GitHub Pages project sub-path (`<owner>.github.io/<repo>/`), so the mirror must be served from a domain root.
 
 ## Probing & alerting
 

package/modules/ui-design/docs/design-contract.md

@@ -248,7 +248,9 @@ Adapters are discovered by the design subsystem at runtime. No static registry
 
 ## 5. CSS variable injection at runtime
 
-The design system renders as CSS custom properties injected into the document at boot, consistent with the existing `themeMarkup` pattern in `src/branding.js`. The naming convention:
+> **What is live (task 1005139).** No served page reads a `--dt-*` variable today. The live surfaces read the fifteen pack tokens that `themeMarkup` (`src/theme-markup.js`) splices into every page, and the `--ds-*` scales of the shared token sheet `modules/ui-design/public/tokens.css`. The `--dt-*` names below are emitted only by the adapters' token-preview bundle (`adapters/claude-design/index.js`, `adapters/figma/index.js`), for a surface authored through an adapter under `src/ui/` — and none exists yet (`config/design-sources.json` is empty). [Task 1005092](https://cloudbongos.com/builders#/task/1005092) will publish the generated `/brand` reference as a Claude Design System; until a surface is authored through an adapter, read this section as the contract that output must follow, not as a description of the served pages.
+
+The design system renders as CSS custom properties injected into the document at boot, consistent with the existing `themeMarkup` pattern in `src/theme-markup.js`. The naming convention:
 
 ```css
 --dt-color-bg:          /* tokens.colors.bg */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.59",
+  "version": "1.24.61",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.59",
+      "version": "1.24.61",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.59",
+  "version": "1.24.61",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11329,5 +11329,17 @@
       "id": "1005133",
       "text": "The logo files and the link-preview pictures are now checked automatically, so a logo change can no longer ship with out-of-date copies; the docs now say plainly that the off-site status page is updated by hand."
     }
+  ],
+  "1.24.60": [
+    {
+      "id": "1005134",
+      "text": "The automatic check that stops pages from typing in their own colours and sizes now also catches colours given a custom name and styles written directly inside a page, so those shortcuts can no longer slip new colours past it."
+    }
+  ],
+  "1.24.61": [
+    {
+      "id": "1005139",
+      "text": "The design docs now describe what is actually live, and the landing page shows a company's logo only when that company's settings provide one, so other projects no longer show the Verro Labs medallion."
+    }
   ]
 }

package/scripts/bongos/css-literal-scan.js

@@ -21,16 +21,28 @@
 //                 tokens; the count stops the set of breakpoints sprawling).
 // Sizes, radii, shadows and breakpoints are counted per DECLARATION / RULE.
 //
-// WHAT IT DOES NOT COUNT. A custom-property declaration (`--x: #123`) is a token
-// DEFINITION — tokens.css and the hall's token block are exactly where literals
-// belong — so its value is skipped. Page-private palettes are guarded separately
-// (tests/hall_private_palettes.mjs). Custom-property NAMES are removed from a
-// value before it is read (so --ds-space-12 is not a "12"), and url(...) bodies
-// are emptied (a data URI is not a colour). A literal inside a var() fallback
-// DOES count: a fallback is a typed-in value.
+// CUSTOM PROPERTIES (task 1005134). A colour typed into a custom-property
+// declaration (`:root{--mine:#123456}`, `body{--x:rgb(…)}`) COUNTS as a colour,
+// so a new sheet cannot dodge its zero start by naming its colours. Only the
+// shared token definitions are exempt, because they are exactly where literals
+// belong: the whole of the shared token sheet and the hall's token block (its
+// :root and the two byte-identical dark twins) — TOKEN_SHEETS. The pack splice
+// (serve-internal.js themeMarkup) is built in JavaScript at serve time and is
+// never scanned. A custom property's sizes/radii/shadows are not counted — those
+// kinds are read off the property that SPENDS a value, and a --x is not one.
+// Page-private palettes are also guarded by tests/hall_private_palettes.mjs.
+//
+// WHAT IT DOES NOT COUNT. Custom-property NAMES are removed from a value before
+// it is read (so --ds-space-12 is not a "12"), and url(...) bodies are emptied (a
+// data URI is not a colour). A literal inside a var() fallback DOES count: a
+// fallback is a typed-in value.
 //
 // Scope: every tracked *.css outside docs/ (the design mocks there are not
-// served), node_modules and vendor/.
+// served), node_modules and vendor/; the inline <style> blocks of every served
+// .html (one under a public/, public-docs/, views/ or content/ folder); and the
+// <style> blocks a server file writes as a string (STYLE_STRING_SOURCES: the
+// branded error page). Task 1005134: a page could otherwise type its colours into
+// a <style> tag and never be counted.
 //
 // Print the counts:  node scripts/bongos/css-literal-scan.js [--all]
 
@@ -42,6 +54,18 @@ const ROOT = path.resolve(__dirname, '..', '..');
 const KINDS = ['colours', 'font_sizes', 'radii', 'shadows', 'breakpoints'];
 
 const EXCLUDE_RE = /^docs\/|(^|\/)(node_modules|vendor)\//;
+// A served page: an .html under a folder the server serves or renders from.
+const SERVED_HTML_RE = /(^|\/)(public|public-docs|views|content)\/.*\.html$/;
+// Server files that write a page's <style> block as a string.
+const STYLE_STRING_SOURCES = ['src/error-page.js'];
+const STYLE_BLOCK_RE = /<style\b[^>]*>([\s\S]*?)<\/style>/gi;
+// The shared token definitions, where a typed-in colour belongs: `true` exempts
+// every custom property in the sheet; a RegExp exempts those in a rule whose
+// selector matches it (the hall's token block: :root and the two dark twins).
+const TOKEN_SHEETS = {
+  'modules/ui-design/public/tokens.css': true,
+  'modules/hall-ui/public/style.css': /^(?::root|html\[data-theme="dark"\]|html:not\(\[data-theme\]\))$/,
+};
 const COMMENT_RE = /\/\*[\s\S]*?\*\//g;
 const URL_RE = /url\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\)/gi;
 const VAR_NAME_RE = /--[\w-]+/g;
@@ -84,17 +108,43 @@ function hasLength(value) {
   return false;
 }
 
-/** The five counts for one stylesheet's text. */
-function countSheet(text) {
+// The selector of the innermost rule around a position, read by walking the text
+// forward (positions must be asked in increasing order). '' at the top level.
+function selectorWalker(css) {
+  const stack = [];
+  let pos = 0;
+  let segStart = 0;
+  return (idx) => {
+    for (; pos < idx; pos += 1) {
+      const ch = css[pos];
+      if (ch === '{') { stack.push(css.slice(segStart, pos).replace(/\s+/g, ' ').trim()); segStart = pos + 1; }
+      else if (ch === '}') { stack.pop(); segStart = pos + 1; }
+      else if (ch === ';') segStart = pos + 1;
+    }
+    return stack.length ? stack[stack.length - 1] : '';
+  };
+}
+
+/**
+ * The five counts for one stylesheet's text. `tokens` marks the shared token
+ * definitions: true (the whole sheet) or a RegExp over a rule's selector.
+ */
+function countSheet(text, { tokens = false } = {}) {
   const counts = Object.fromEntries(KINDS.map((k) => [k, 0]));
   const css = String(text).replace(COMMENT_RE, ' ').replace(URL_RE, 'url()');
   AT_RULE_RE.lastIndex = 0;
   let m;
   while ((m = AT_RULE_RE.exec(css))) if (MEDIA_LENGTH_RE.test(m[2])) counts.breakpoints += 1;
+  const selectorAt = selectorWalker(css);
   DECL_RE.lastIndex = 0;
   while ((m = DECL_RE.exec(css))) {
     const prop = m[1].toLowerCase();
-    if (prop.startsWith('--')) continue; // a token definition
+    if (prop.startsWith('--')) {
+      // A custom property: its colours count unless it is a shared token definition.
+      const exempt = tokens === true || (tokens instanceof RegExp && tokens.test(selectorAt(m.index + m[0].indexOf(m[1]))));
+      if (!exempt) counts.colours += colourCount(m[2].replace(VAR_NAME_RE, ' '));
+      continue;
+    }
     const value = m[2].replace(VAR_NAME_RE, ' ');
     counts.colours += colourCount(value);
     if ((prop === 'font-size' || prop === 'font') && hasLength(value)) counts.font_sizes += 1;
@@ -106,8 +156,16 @@ function countSheet(text) {
 }
 
 function trackedStylesheets(root = ROOT) {
-  const out = execFileSync('git', ['ls-files', '-z', '--', '*.css'], { cwd: root, encoding: 'utf8' });
-  return out.split('\0').filter((f) => f && !EXCLUDE_RE.test(f)).sort();
+  const out = execFileSync('git', ['ls-files', '-z', '--', '*.css', '*.html', ...STYLE_STRING_SOURCES], { cwd: root, encoding: 'utf8' });
+  return out.split('\0').filter((f) => f && !EXCLUDE_RE.test(f)
+    && (f.endsWith('.css') || SERVED_HTML_RE.test(f) || STYLE_STRING_SOURCES.includes(f))).sort();
+}
+
+// The CSS a file carries: a stylesheet is all CSS; a page or a server file
+// carries only what sits inside its <style> blocks.
+function cssOf(file, text) {
+  if (file.endsWith('.css')) return text;
+  return [...String(text).matchAll(STYLE_BLOCK_RE)].map((b) => b[1]).join('\n');
 }
 
 /**
@@ -123,7 +181,7 @@ function scanCssLiterals({ root = ROOT, files = null, read = null } = {}) {
     let text;
     try { text = reader(f); } catch { continue; }
     scanned += 1;
-    const c = countSheet(text);
+    const c = countSheet(cssOf(f, text), { tokens: TOKEN_SHEETS[f] || false });
     if (KINDS.some((k) => c[k] > 0)) sheets[f] = c;
   }
   return { sheets, scanned };

package/src/bongos/serve-internal.js

@@ -146,8 +146,9 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // served page can carry a correct cross-host href or canonical/og: URL: a client
 // fill cannot reach them, and a baked one would make every instance advertise
 // whichever instance happened to author the file (task 1002748, direction C5/C6).
-// {{companyName}} {{companySite}} {{companyTagline}} are optional, so a page wraps
-// each clause in a brand-if region that drops whole when its field is empty (task 1002853).
+// {{companyName}} {{companySite}} {{companyTagline}} {{companyMark}} (the company's mark
+// image URL, task 1005139) are optional, so a page wraps each clause in a brand-if region
+// that drops whole when its field is empty (task 1002853).
 // Pure + exported for the test; both origins are injectable so it drives with zero I/O.
 function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase(), hubOrigin = safeHubOrigin()) {
   const world = (brand.identity && brand.identity.worldName) || '';
@@ -157,7 +158,7 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
   const hall = hallOrigin || origin || '';
   const company = (brand.identity && brand.identity.company) || {};
-  const conditioned = applyBrandConditionals(html == null ? '' : html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline });
+  const conditioned = applyBrandConditionals(html == null ? '' : html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline, companyMark: company.mark });
   return dropEmptyHrefLinks(conditioned, { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
@@ -167,6 +168,7 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
     .split('{{companyName}}').join(esc(company.name))
     .split('{{companySite}}').join(esc(company.site))
     .split('{{companyTagline}}').join(esc(company.tagline))
+    .split('{{companyMark}}').join(esc(company.mark || ''))
     .split('{{publicOrigin}}').join(esc(origin || ''))
     // a pack that names no hall of its own resolves to its OWN apex — never to
     // whichever instance authored the file

package/src/branding.js

@@ -254,6 +254,8 @@ function clientBranding(b = branding()) {
         name: b.identity?.company?.name || '',
         site: b.identity?.company?.site || '',
         tagline: b.identity?.company?.tagline || '',
+        // the company's mark, an image URL; '' shows none (task 1005139)
+        mark: b.identity?.company?.mark || '',
       },
     },
     currency: {

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.59'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.61'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/brand_surfaces.mjs

@@ -214,3 +214,17 @@ test('the landing names its maker only from the pack, and drops the band when th
   const none = stamp('');
   assert.doesNotMatch(none, /class="wrap verro"|held by|Built by ,/, 'the band and the line drop whole');
 });
+
+// task 1005139: the band's image is the pack's (identity.company.mark). A pack that names a
+// company but no mark shows the name without an image — never the hub's medallion.
+test('the maker band shows the company mark only from the pack', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'index.html'), 'utf8');
+  assert.doesNotMatch(src.replace(/<!--(?!\/?brand-if)[\s\S]*?-->/g, '').replace(/\/\*[\s\S]*?\*\//g, ''), /medallion/, 'no maker\'s image written into the portable page');
+  const stamp = (company) => applyBrandTokens(src, { identity: { productName: 'Acme', worldName: 'Acme', company: { site: '', tagline: '', ...company } } }, '', '', '', '', '');
+  const bare = stamp({ name: 'Rocket Labs', mark: '' });
+  assert.ok(bare.includes('<p class="wordmark">Rocket Labs</p>'), 'the band still shows the name');
+  assert.doesNotMatch(bare, /<img[^>]*alt="The Rocket Labs mark"/, 'no mark in the pack, no image');
+  const marked = stamp({ name: 'Rocket Labs', mark: '/assets/rocket.png' });
+  assert.match(marked, /<img src="\/assets\/rocket\.png"[^>]*alt="The Rocket Labs mark">/, 'the pack\'s mark is the image');
+  assert.equal(clientBranding({ identity: { company: { name: 'R', mark: '/m.png' } } }).identity.company.mark, '/m.png');
+});

package/tests/design_counts_ratchet.mjs

@@ -28,7 +28,7 @@ const readReal = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
 
 test('the detector counts typed-in values and leaves tokens alone', () => {
   const c = scan.countSheet(`
-    :root { --ds-x: 14px; --tone: #123456; }            /* token definitions: not counted */
+    :root { --ds-x: 14px; --tone: #123456; }            /* a token sheet's definitions: not counted */
     .a { font-size: 13px; border-radius: 6px; color: #abc; }
     .b { font-size: var(--ds-text-sm); border-radius: var(--ds-radius-tile); color: var(--ink); }
     .c { box-shadow: 0 2px 4px rgba(0, 0, 0, .2); }      /* a shadow; the black scrim is allowed */
@@ -36,7 +36,7 @@ test('the detector counts typed-in values and leaves tokens alone', () => {
     .e { background: color-mix(in srgb, var(--ink) 40%, rgb(12 34 56)); padding: 0; }
     @media (max-width: 720px) { .f { border-radius: 0; } }
     @media (prefers-reduced-motion: reduce) { .g { transition: none; } }
-  `);
+  `, { tokens: true });
   assert.deepEqual(c, { colours: 2, font_sizes: 1, radii: 1, shadows: 1, breakpoints: 1 });
 });
 
@@ -170,3 +170,60 @@ test('the freshness gate covers the logo set: mark.svg, the pack and both PNGs',
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+// task 1005134: two loopholes closed. (1) A sheet that names its colours as custom
+// properties used to count zero, so a new sheet could bypass its zero start; now
+// only the shared token definitions are exempt. (2) A page's inline <style> and the
+// error page's CSS string were never scanned; now they are, with baselines.
+const HALL_TOKENS = /^(?::root|html\[data-theme="dark"\]|html:not\(\[data-theme\]\))$/;
+
+test('a colour typed into a custom property counts, outside the shared token definitions', () => {
+  assert.equal(scan.countSheet(':root { --mine: #123456; }').colours, 1, ':root{--mine:#123456}');
+  assert.equal(scan.countSheet('body { --x: rgb(10, 20, 30); --y: hsl(1 2% 3%); }').colours, 2, 'body{--x:rgb(...)}');
+  assert.equal(scan.countSheet('.v { --veil: rgba(0, 0, 0, .4); --tone: var(--ink); }').colours, 0, 'a scrim and a reference are not typed-in colours');
+  assert.equal(scan.countSheet(':root { --mine: #123456; } .x { --y: #654321; }', { tokens: true }).colours, 0, 'the shared token sheet is exempt');
+  const hall = ':root { --a: #111111; } html[data-theme="dark"] { --a: #222222; } '
+    + '@media (prefers-color-scheme: dark) { html:not([data-theme]) { --a: #222222; } } '
+    + '.brand { --mark-ink: #333333; } @media (max-width: 1px) { .y { --z: #444444; } }';
+  assert.equal(scan.countSheet(hall, { tokens: HALL_TOKENS }).colours, 2, 'the hall token block is exempt; its other rules are not');
+});
+
+test('a NEW sheet that names its colours as custom properties fails fitness', () => {
+  const NEW = 'modules/x/public/new.css';
+  const { sheets } = scan.scanCssLiterals({ files: [NEW], read: () => ':root { --mine: #123456; } body { --x: rgb(1, 2, 3); }' });
+  const d = ratchets.compareDesignCounts(sheets, { _comment: 'note' });
+  assert.ok(d.violations.some((v) => v.includes(`colours in ${NEW} regressed: 2 > baseline 0`)), d.violations.join('\n'));
+  // …while a definition planted in the shared token sheet, or the hall's :root, stays exempt.
+  const planted = scan.scanCssLiterals({
+    read: (f) => readReal(f) + (f === 'modules/ui-design/public/tokens.css' || f === HALL_SHEET ? '\n:root { --mine: #123456; }\n' : ''),
+  });
+  assert.deepEqual(ratchets.checkQualityRatchets({ metrics: {}, designCounts: planted.sheets }).violations, []);
+  const leak = scan.scanCssLiterals({ read: (f) => readReal(f) + (f === HALL_SHEET ? '\n.planted { --mine: #123456; }\n' : '') });
+  const r = ratchets.checkQualityRatchets({ metrics: {}, designCounts: leak.sheets });
+  assert.ok(r.violations.some((v) => v.includes(`colours in ${HALL_SHEET} regressed`)), r.violations.join('\n'));
+});
+
+test('inline <style> blocks in served pages and the error page CSS are scanned', () => {
+  const PAGE = 'modules/public-landing/public/terms.html';
+  const ERR = 'src/error-page.js';
+  const { sheets } = scan.scanCssLiterals();
+  assert.ok(sheets[ERR], `${ERR} is scanned`);
+  assert.ok(sheets[PAGE], `${PAGE} is scanned`);
+  assert.ok(!Object.keys(sheets).some((f) => /\/styles\/[^/]+\/mock\.html$|\/specimens\/.*\.html$/.test(f)), 'unserved mocks and specimens are not');
+  assert.equal(scan.countSheet('').colours, 0);
+  const planted = scan.scanCssLiterals({
+    read: (f) => {
+      const t = readReal(f);
+      if (f === PAGE || f === ERR) return t.replace('</style>', '.planted { color: #123456; font-size: 13px; }\n</style>');
+      return t;
+    },
+  });
+  const r = ratchets.checkQualityRatchets({ metrics: {}, designCounts: planted.sheets });
+  for (const f of [PAGE, ERR]) {
+    assert.ok(r.violations.some((v) => v.includes(`colours in ${f} regressed`)), `${f} colours: ${r.violations.join('\n')}`);
+    assert.ok(r.violations.some((v) => v.includes(`font_sizes in ${f} regressed`)), `${f} sizes: ${r.violations.join('\n')}`);
+  }
+  // Text outside a <style> block is not CSS: a hex in a page's prose is not counted.
+  const prose = scan.scanCssLiterals({ read: (f) => readReal(f) + (f === PAGE ? '\n<p>color: #123456;</p>\n' : '') });
+  assert.deepEqual(prose.sheets[PAGE], sheets[PAGE]);
+});

package/tests/status_company_attribution.mjs

@@ -55,6 +55,6 @@ test('the off-box mirror stamps the footer exactly as the served page does (KEEP
 
 test('clientBranding exposes the company site and tagline the footer stamps from', () => {
   const c = clientBranding({ identity: { company: { name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works' } } });
-  assert.deepEqual(c.identity.company, { name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works' });
-  assert.deepEqual(clientBranding({}).identity.company, { name: '', site: '', tagline: '' });
+  assert.deepEqual(c.identity.company, { name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works', mark: '' });
+  assert.deepEqual(clientBranding({}).identity.company, { name: '', site: '', tagline: '', mark: '' });
 });