@bongos/core 1.24.64 → 1.24.66

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.64",
-  "core_contract": "1.24.64",
-  "source_commit": "3ec2f53ca824f8f5ae9954733449d50e6d771d78",
+  "core_version": "1.24.66",
+  "core_contract": "1.24.66",
+  "source_commit": "c8dd200682525465ab4c31d562c49ede1a515404",
   "source_ref": "HEAD",
-  "built_at": "2026-11-08T11:46:13.511Z",
+  "built_at": "2026-11-09T19:50:40.752Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3902,
+    "functional_verbatim": 3904,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4573,
-  "tree_sha256": "05be327dd13c886de8623f745d2aafc5a44e53b1474621c1d66528fb88bbc306",
+  "file_count": 4575,
+  "tree_sha256": "8863cadeb49c7cd719e61a10cdc6f7fb0e2452e1e6e52089b74b997125377f11",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6f54bb50baf24667d580a0a1800893b4f274ec757b1766230ab2d99f80cf2e21"
+      "sha256": "d9de836d931d1f89f45b5500fc6b7eceed36543deb0dc521decb3b1722074a69"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3262,7 +3262,7 @@
     {
       "path": "docs/recipes/ui-look-before-you-ship.md",
       "mode": "0000644",
-      "sha256": "c5d7971418fca5f6917e0e87e8decb8df2e54d51bdc7eb86ed415e9f7fa74ed3"
+      "sha256": "691bbbf06c9622a91aa8b4f5d40a4be2e7198e9219a6a689bb7dd1ecb1430f94"
     },
     {
       "path": "docs/recipes/upgrading-the-core.md",
@@ -5757,7 +5757,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "d497234932a846f759f35e8f397f3a58284b85cced1a7e19f7419639ca573879"
+      "sha256": "12308c4d0a2f58fe874ef8b3ed4698709869a42c24c08d2b72011bd81c0ff160"
     },
     {
       "path": "modules/government/ranks.js",
@@ -5852,7 +5852,7 @@
     {
       "path": "modules/grading/grader-no-artifact.js",
       "mode": "0000644",
-      "sha256": "4c66cba74d89e7f07f9984c0b846bff6210af7aa8a3a45219139246e4b975a22"
+      "sha256": "21009dcce99c9a18abf5f7e40f68792ff42584eb2af5d0008df7f291487c62b1"
     },
     {
       "path": "modules/grading/grader-prompt.js",
@@ -11357,7 +11357,7 @@
     {
       "path": "modules/ui-design/kit/README.md",
       "mode": "0000644",
-      "sha256": "7e1d32a5383ee545d398dde7fdd142e80601a3458c4e35557958ee7a11a68246"
+      "sha256": "a95397538d363364347d76a875663ffc9b36eb1cba03475f11bc175e2e2787fc"
     },
     {
       "path": "modules/ui-design/kit/check-mock.js",
@@ -11667,7 +11667,7 @@
     {
       "path": "modules/ui-design/kit/lib.js",
       "mode": "0000644",
-      "sha256": "ded9ff3491a264a9b08440874d7b4194b46a2c05b80986f648dabb3e52a8448c"
+      "sha256": "e593169a194cd60838193df799dfb3b19ac72e92e2e6beadb3cd28128305abad"
     },
     {
       "path": "modules/ui-design/kit/png.js",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ebf93f1762d8c434f4be706a146234bc6047b37e2c1ebcca6c961da817a57b24"
+      "sha256": "6404eb74f3c63e5cbd0cc64d9a18d2a860b758a8077199241d508938f556ddb5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f878eabd1e4556e46155b760462e8f433a1472ecc771fed5638011a401844af6"
+      "sha256": "e6fa2b150dfc6c0ebdd2fb524ba028608c04ff5d698ab8ab4be2cbc62a7c2501"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "c56e5afc1883d40326c974209ebfe30d603375a991532ae4775c55f1cda428df"
+      "sha256": "f21fea4a4cb0dd1eceb683e196ac37110931e63de4290b1d99614d747f30fb78"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12197,7 +12197,7 @@
     {
       "path": "scripts/bongos/cli-lib.js",
       "mode": "0000644",
-      "sha256": "572a3d97e451df68412c5a40280ca58c6915e5b79a71d9a013522d51234a52c9"
+      "sha256": "bbfd061637439ce86bd261fd39e243f1701247ea6669c7ae4775d1e59c94a3a9"
     },
     {
       "path": "scripts/bongos/client-baseurl-guard.js",
@@ -13177,7 +13177,7 @@
     {
       "path": "scripts/bongos/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "be2eb571965101b309308d73d2bea556ea7a9ff9550ec24542df61b904646d60"
+      "sha256": "85fc4fb8e3940c71b4f2eac604374b583bca16e6e590847d597cf9e59fbb44f7"
     },
     {
       "path": "scripts/bongos/runner-drift.js",
@@ -13317,7 +13317,7 @@
     {
       "path": "scripts/bongos/ship-grade-steps.js",
       "mode": "0000644",
-      "sha256": "4db93d8031f5912af2d1b4e4507680d6909ff4fa18b9485a451b340918d5cd79"
+      "sha256": "83a0e5ce61257c8435a58cab07accf749570f8fa51db1b9c72aaff846ac10c02"
     },
     {
       "path": "scripts/bongos/ship-grade.js",
@@ -15612,7 +15612,7 @@
     {
       "path": "src/bongos/prelaunch-gate.js",
       "mode": "0000644",
-      "sha256": "dc9fcb627d1bfdc60e4f275521bab356e76a66202014be9ac9e388cf0a784717"
+      "sha256": "a780f3d0d8b48c4b3c6e9a3fad4296cc31e1f006c5a0e7a0b62c51be793db186"
     },
     {
       "path": "src/bongos/prelaunch-switch.js",
@@ -15877,7 +15877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6937e1a1767458c2da6342b38b7631c63d87752688584ca9b5fa59cd94b9a026"
+      "sha256": "66cdc6ea2874f48cf67645553922f875fb60cfc951e7f075ac58ce2ab9adb660"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16902,7 +16902,7 @@
     {
       "path": "tests/cli_sessions.mjs",
       "mode": "0000644",
-      "sha256": "5b76737b10b28866feb7be9195015e300cbc8cb23ead89ac9fc55dd5b52710dd"
+      "sha256": "55d72cc2926ab8574e290ca16e40702759c8c6b0453a8ebd4aa9f09ae77f880d"
     },
     {
       "path": "tests/cli_surface.mjs",
@@ -16974,6 +16974,11 @@
       "mode": "0000644",
       "sha256": "386bea21404a5921a450adf251bb9cb54694684941a5b3d3b000a266cc9d09f7"
     },
+    {
+      "path": "tests/community_proof_db.mjs",
+      "mode": "0000644",
+      "sha256": "a68d8274db242141006e661f3a5879efd769d1facc25fc5e2c362abe80a4084e"
+    },
     {
       "path": "tests/community_search_route.mjs",
       "mode": "0000644",
@@ -17597,7 +17602,7 @@
     {
       "path": "tests/effective_visibility_predicate.mjs",
       "mode": "0000644",
-      "sha256": "7bd63d2a1f097fdde204803ec8b6fc0ae75843080af6d442c969ed02b7fb41dd"
+      "sha256": "4a7bb44f07a87997830e44636490a4992d862d43b2620a2d583370869f6b477d"
     },
     {
       "path": "tests/env_knobs_neutral_prefix.mjs",
@@ -17769,6 +17774,11 @@
       "mode": "0000644",
       "sha256": "a86b984c420c260c5298b1fd15c48533a27a4ead3ad63543bdfa63ecd6b37949"
     },
+    {
+      "path": "tests/fixtures/privacy-matrix.mjs",
+      "mode": "0000644",
+      "sha256": "a540792ffd23206b4e37b9fca7b8498e55de853211f4714cad791af28029af9c"
+    },
     {
       "path": "tests/fixtures/seed-tasks/bongos-v1-idea-routing.json",
       "mode": "0000644",
@@ -18427,7 +18437,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "3ecd666b5c5227295c04d781cfd554012ce3cabd38167c3947a86379f1b6004b"
+      "sha256": "edbc428d065ead0a9fd9ba02218fa25f72f1646e594d01386f13256b0621490f"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -18562,7 +18572,7 @@
     {
       "path": "tests/grade_unavailable_display.mjs",
       "mode": "0000644",
-      "sha256": "5842055bf9e1871b467ab682b24589f0c9523561090a026021cb898380508524"
+      "sha256": "63135247609c11501f0d7af190343193a5dab334f7186cd05ab02fdbf1ea3644"
     },
     {
       "path": "tests/grader.mjs",
@@ -20687,7 +20697,7 @@
     {
       "path": "tests/prelaunch_gate.mjs",
       "mode": "0000644",
-      "sha256": "01cd4d1aa256c1d44fb2da98a4347aeb3e75e1aeae47f338d37f29ebec03e556"
+      "sha256": "1eea91518ffdf65206d9b0a0094269a426268b0da4abb578a994150f7632ffd7"
     },
     {
       "path": "tests/preview_server.mjs",
@@ -20697,7 +20707,7 @@
     {
       "path": "tests/privacy_matrix.mjs",
       "mode": "0000644",
-      "sha256": "a2592ce72e24d6bb5acee360594ae48b3b6d23ad93467953b4745d3eb552cfd9"
+      "sha256": "7a9aea3dd6db1b8048b35cf64624553fa148a9cd03030fa336eb9453ba5068bb"
     },
     {
       "path": "tests/probe_cache.mjs",
@@ -21347,7 +21357,7 @@
     {
       "path": "tests/recall_hints.mjs",
       "mode": "0000644",
-      "sha256": "0ed0ecffcefe92b2b4db63e2c85858dcc7cb0c991a7453373cb7b54c523978a9"
+      "sha256": "35af628eeda697d97bfaaba5052fc0f4928ae174ef04ec3afc7d3470dfc62dfe"
     },
     {
       "path": "tests/recent_shipped_window.mjs",
@@ -21777,7 +21787,7 @@
     {
       "path": "tests/session_start_freshness.mjs",
       "mode": "0000644",
-      "sha256": "d4c03dfb66690da1d870668e7b68c3bd0a35dc1a8a90986c6aad9586138ed1e1"
+      "sha256": "acdee57f83af053e86d16ce9764647fe750ca33c7f24313a6e60b6ba9180dc49"
     },
     {
       "path": "tests/session_token_hash.mjs",
@@ -22557,12 +22567,12 @@
     {
       "path": "tests/ui_design_kit.mjs",
       "mode": "0000644",
-      "sha256": "74b63327d4042cf3be0f2abf5b0e7298319f6ed69ea488246e88e49923b26bc1"
+      "sha256": "f5160521be5a2edecfe8997275cbbc65b8cf6ac8aac7cca2e90e23378d4e64f3"
     },
     {
       "path": "tests/ui_design_kit_fit.mjs",
       "mode": "0000644",
-      "sha256": "0f07a002d400c4e90ead7206334425bd80647a2cb844bbc9733758eb3f719a12"
+      "sha256": "010a7b1427aa28d4807093f2ff31871058b366c46daafb1818cda2eee4f404cc"
     },
     {
       "path": "tests/ui_design_skills.mjs",

package/docs/module-api-changelog.md

@@ -3382,5 +3382,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.62 with no explicit bump. run 42392141827. (task 1002620)
   1.24.64 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.63 with no explicit bump. run 42477114353. (task 1002620)
+  1.24.65 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.64 with no explicit bump. run 42516347052. (task 1002620)
+  1.24.66 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.65 with no explicit bump. run 42686885661. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/ui-look-before-you-ship.md

@@ -48,6 +48,7 @@ node modules/ui-design/kit/render.js --page / --style expedition        # the sa
 | `horizontal-overflow` | `scrollWidth` wider than the viewport |
 | `text-fit` | a word of text more than 1px past its box (the padding box of its nearest non-inline ancestor), or an SVG `<text>` past the smallest `<rect>` in its own `<g>` that holds its start — a scroller, `text-overflow: ellipsis` and a visually-hidden label are skipped ([ADR 0329](../adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)) |
 | `sibling-overlap` | two in-flow, block-level children of one parent that both carry text overlapping by more than 2px each way — absolute, fixed, sticky and negative-margin layering is deliberate and skipped |
+| `empty-graphic` | a shown `<use>` that paints nothing (its referenced SVG failed to parse, or the id is missing) or an `<img>` that did not decode or renders 0×0 — the logo that silently vanishes; a sprite sheet's own `<symbol>`/`<defs>`, a hidden graphic and a lazy image not yet loaded are skipped (task 1005104) |
 | `one-header-main-h1` | not exactly one *rendered* `<header>`, `<main>` and `<h1>` |
 | `controls-24px` | a visible control under 24px on either side (`ignoreControls` for the skip link and the like) |
 | `top-bar-80px` | a `<header>` taller than 80px |

package/modules/government/protected-surfaces.json

@@ -39,6 +39,22 @@
     { "glob": "src/bongos/middleware/", "group": "authz", "why": "audit + any auth middleware" },
     { "glob": "src/bongos/routes/", "group": "authz", "why": "routes carry the requireRank gates" },
     { "glob": "modules/lifecycle/routes/", "group": "authz", "why": "BV1.R86: the lifecycle routes carved out of src/bongos/routes/ — the gates follow the routes" },
+    { "glob": "modules/lifecycle/db.js", "group": "authz", "why": "task 1004382. The lifecycle data-layer facade (BV1.R86): claimTask and the claim→ship→grade→credit state machine run through it. Its own header says it carries a duplicate of src/bongos/db.js's in-tx rank change, and src/bongos/db.js is protected for exactly that." },
+    { "glob": "modules/lifecycle/db-analytics.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-claim-reads.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-claims.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-deps-criteria.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-executor.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-goals.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-grade.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-overrides.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-rank-authz.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204): claimPermissionsFor, claimGate, deriveRequiredRank, singleRungPromotionError and _applyRankChangeTx — the claim gate and the rank-change rules. The authz-inventory tripwire in tests/government_protected_surfaces.mjs reds if one of them moves into an unprotected file." },
+    { "glob": "modules/lifecycle/db-relevance-flags.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-shared.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-ship.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-tasks.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/db-versions.js", "group": "authz", "why": "task 1004382. Carved out of lifecycle/db.js (task 1003204), which registering the facade alone would have left unprotected — the 1004024 carve rule: a protected file's <name>-*.js siblings are protected too." },
+    { "glob": "modules/lifecycle/claim-eligibility.js", "group": "authz", "why": "task 1004382. The QUEUE axis of the claim gate (ADR 0151, BV1.R106): permissionAllowsClaim and claimEligibilityAllows decide which tasks a builder's permissions let them claim at all." },
     { "glob": "src/bongos/routes.js", "group": "authz", "why": "the route MOUNT table (a new ungated route lands here)" },
     { "glob": "server.js", "group": "authz", "why": "the Express entrypoint — wires every router + host routing" },
     { "glob": "modules/government/", "group": "authz", "why": "the same authz core under its post-ADR-0174 name (goal 1000068, task 1003003). Listed BEFORE the folder moves, deliberately: `protected` is DERIVED from this registry, so a module key whose globs are absent here computes protected:false — which would silently drop the Archon gate on goal creation AND the pre-push block on these files for the whole window between the key landing and the folder arriving. The prospective-carve precedent is the modules/government/ entry directly above (ADR 0086 §4)." },

package/modules/grading/grader-no-artifact.js

@@ -133,6 +133,8 @@ function aggregateShots(shotResults, meta = {}) {
     shot_index: s.signals?.shot_index ?? null,
     notes_md: s.notes_md,
     issues: s.issues || [],
+    exit_code: s.signals?.exit_code ?? null,
+    stderr_tail: s.signals?.stderr_tail || null,
     error:
       s.signals?.parse_error
         ? 'parse_error'
@@ -186,10 +188,26 @@ function aggregateShots(shotResults, meta = {}) {
   const errorCount = verdicts.filter((v) => v.error).length;
   const allPassed = N > 0 && passCount === N;
 
+  // task 1005101: EVERY shot errored → nothing was judged. This is the
+  // single-shot twin of the panel's #943 total outage (aggregatePanel), and it
+  // carries the same `panel_outcome: 'unavailable'` tag so ship.js prints the
+  // outage card instead of "the reviewers found problems in your work" — which
+  // is what a spend-limit or expired-sign-in exit printed before. passed stays
+  // false: an outage parks at completed for a re-grade or manual-confirm.
+  const allErrored = N > 0 && errorCount === N;
+
   let verdict;
   let passed;
   let aggregationKind;
-  if (errorCount > 0) {
+  if (allErrored) {
+    passed = false;
+    const codes = [...new Set(verdicts.map((v) => v.exit_code).filter((c) => c != null))];
+    const tail = verdicts.map((v) => v.stderr_tail).find(Boolean);
+    const cause = [codes.length ? `exit ${codes.join('/')}` : null, tail ? `subprocess said: ${tail.trim().split('\n')[0]}` : null]
+      .filter(Boolean).join('; ');
+    verdict = `GRADER UNAVAILABLE — all ${N}/${N} shot(s) failed to run; no quality signal was produced. This is an infra/outage condition, NOT a quality rejection — manual-confirm available.${cause ? ` Diagnostic — ${cause}` : ''}`;
+    aggregationKind = 'unavailable';
+  } else if (errorCount > 0) {
     passed = false;
     verdict = `FAIL — ${errorCount}/${N} shot(s) errored`;
     aggregationKind = 'errored';
@@ -272,6 +290,15 @@ function aggregateShots(shotResults, meta = {}) {
       fail_count: failCount,
       error_count: errorCount,
       shot_aggregation: aggregationKind,
+      // task 1005101: the outage tag + the per-shot exit codes ship.js's outage
+      // card prints. Absent on any judged grade, so those keep their exact shape.
+      ...(allErrored ? {
+        panel_outcome: 'unavailable',
+        grader_unavailable_reason: 'all_shots_errored',
+        outage_shots: verdicts.map((v, i) => ({
+          kind: `shot ${v.shot_index ?? i}`, error: v.error, exit_code: v.exit_code, stderr_tail: v.stderr_tail,
+        })),
+      } : {}),
       ...meta,
     },
     notes_md: lines.join('\n'),

package/modules/ui-design/kit/README.md

@@ -12,7 +12,7 @@ node modules/ui-design/kit/contrast.js --pack [look] | --url <url> [--glyphs sel
 
 A **look** is a branding pack from the module's style library (`modules/ui-design/styles/<name>/`, task 1003323): `STYLE=<name>` lays it over the instance's own pack through `GDS_BRANDING_FILE`, so any surface renders under any look with no page edit.
 
-Two of the floors are about fit ([task 1004203](https://cloudbongos.com/builders#/task/1004203), [ADR 0329](../../../docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)): `text-fit` (text past its box, SVG text past its card) and `sibling-overlap` (text-bearing siblings on top of each other). `scripts/bongos/render-check.js` runs just those two over the pages a branch changed, and `/ship-check` shows them as an advisory row.
+Two of the floors are about fit ([task 1004203](https://cloudbongos.com/builders#/task/1004203), [ADR 0329](../../../docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md)): `text-fit` (text past its box, SVG text past its card) and `sibling-overlap` (text-bearing siblings on top of each other). `scripts/bongos/render-check.js` runs just those two over the pages a branch changed, and `/ship-check` shows them as an advisory row. A third in-page floor, `empty-graphic` ([task 1005104](https://cloudbongos.com/builders#/task/1005104)), reports a shown `<use>` or `<img>` that paints nothing — a referenced SVG that failed to parse leaves no console error and no failed request, so the logo vanished under ALL CLEAN.
 
 A surface describes itself in two JSON files beside it — `<page>.states.json` and `<page>.probes.json` — in the vocabularies `lib.js` defines and validates. A page served at the surface root (the hall's Home, `/builders/`) reads `index.states.json`. A file (or one state) may carry `"storage": { "session": {…}, "local": {…} }`, written into the browser before the page's own scripts run, so a first-visit question renders as a returning visitor sees it: every hall file seeds `hall-craft-asked` so the mode picker stays out of the shots ([task 1005080](https://cloudbongos.com/builders#/task/1005080)). A hall state that needs real data (a goal's detail, the Settings sections) passes against the hall-preview harness with `--base-in`/`--base-out`, one render at a time. The full loop, the file shapes and the failure table: [`docs/recipes/ui-look-before-you-ship.md`](../../../docs/recipes/ui-look-before-you-ship.md). Exit codes everywhere: 0 clean · 1 problems · 2 a broken file or usage · 3 no browser.
 

package/modules/ui-design/kit/lib.js

@@ -28,6 +28,7 @@ const FLOORS = Object.freeze([
   'horizontal-overflow',  // documentElement.scrollWidth fits the viewport
   'text-fit',             // no text runs past its box (HTML) or its card rect (SVG)
   'sibling-overlap',      // no two in-flow, block-level, text-bearing siblings overlap
+  'empty-graphic',        // no shown <use> or <img> that paints nothing (a referenced SVG that failed to parse)
   'one-header-main-h1',  // exactly one <header>, one <main>, one <h1>
   'controls-24px',        // every visible control clears 24px on both sides
   'top-bar-80px',         // the page's <header> is at most 80px tall
@@ -287,6 +288,25 @@ function factsInPage(spec) {
     }
   });
   out.textFit = textFit; out.overlaps = overlaps;
+  // The empty-graphic floor (task 1005104): a referenced SVG that fails to parse leaves its <use> empty, or its
+  // <img> with no natural size, and the logo vanishes with no console error and no failed request. A sprite's own
+  // <symbol>/<defs>, a 0x0 sprite sheet, a hidden graphic and a lazy image not yet loaded are not judged.
+  const ref = (el) => quote(String(el.getAttribute('href') || el.getAttribute('xlink:href') || el.getAttribute('src') || '').replace(/^data:([^,;]{0,24})[^]*?(#[\w-]*)?$/, 'data:$1…$2'));
+  const emptyGraphics = [];
+  qa('svg use').forEach((u) => {
+    if (u.closest('symbol, defs, mask, clipPath, pattern, marker') || !vis(u)) return;
+    const svg = u.ownerSVGElement; if (!svg) return;
+    const s = svg.getBoundingClientRect(); if (s.width < 1 || s.height < 1) return;
+    const r = u.getBoundingClientRect();
+    if (r.width < 1 || r.height < 1) emptyGraphics.push(`${where(u)} → "${ref(u)}" paints nothing`);
+  });
+  qa('img').forEach((im) => {
+    if (!vis(im) || (!im.complete && im.loading === 'lazy')) return;
+    const r = im.getBoundingClientRect();
+    if (im.complete && !im.naturalWidth) emptyGraphics.push(`${where(im)} → "${ref(im)}" did not decode`);
+    else if (r.width < 1 || r.height < 1) emptyGraphics.push(`${where(im)} → "${ref(im)}" renders ${Math.round(r.width)}x${Math.round(r.height)}`);
+  });
+  out.emptyGraphics = emptyGraphics;
   return out;
 }
 // Pure: compare collected facts against an expectation. Returns problem strings.
@@ -324,6 +344,7 @@ function auditFloors(facts, { width, mode } = {}) {
   const some = (list) => list.slice(0, 5).join(' | ') + (list.length > 5 ? ` (+${list.length - 5} more)` : '');
   if (facts.textFit && facts.textFit.length) p.push(`text-fit: ${some(facts.textFit)}`);
   if (facts.overlaps && facts.overlaps.length) p.push(`sibling-overlap: ${some(facts.overlaps)}`);
+  if (facts.emptyGraphics && facts.emptyGraphics.length) p.push(`empty-graphic: ${some(facts.emptyGraphics)}`);
   if (facts.headers !== 1 || facts.mains !== 1 || facts.h1s !== 1) p.push(`one-header-main-h1: header ${facts.headers} main ${facts.mains} h1 ${facts.h1s}`);
   if (facts.smallControls && facts.smallControls.length) p.push(`controls-24px: ${facts.smallControls.join(' | ')}`);
   if (facts.bar && facts.bar.h > 80) p.push(`top-bar-80px: header is ${facts.bar.h}px`);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.64",
+  "version": "1.24.66",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.64",
+      "version": "1.24.66",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.64",
+  "version": "1.24.66",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11359,5 +11359,45 @@
       "id": "1005177",
       "text": "The next version is scoped. The builders' hall becomes a game you are inside rather than a website you navigate: three characters to play as, a city that grows as the project grows, and work claimed as quest chains instead of"
     }
+  ],
+  "1.24.65": [
+    {
+      "id": "1002985",
+      "text": "The community page now has one test proving, on a real database, that hidden, private and new accounts never show on any leaderboard, search, crown or mover card, and that every week, month and year total is exact."
+    }
+  ],
+  "1.24.66": [
+    {
+      "id": "1004382",
+      "text": "The files that decide who may claim a task and how ranks change are now protected again: a builder below Metic can no longer edit them without review, and a new test fails if a future file split moves those rules somewhere unp"
+    },
+    {
+      "id": "1005117",
+      "text": "Signing in to a second Bongos site no longer signs you out of the first: each command now uses the sign-in for the site it is talking to."
+    },
+    {
+      "id": "1005014",
+      "text": "A worktree session now gets told its own branch and how far behind it is, instead of the main folder's — even when hooks fall back to running from the main folder."
+    },
+    {
+      "id": "1005007",
+      "text": "The privacy check that stops private accounts leaking now also catches database reads written in ordinary quotes, which it used to miss entirely."
+    },
+    {
+      "id": "1004380",
+      "text": "The pre-launch password page can no longer be used to crash the server: a wrong password with an accented letter used to take the whole site down; now it is just refused like any other wrong guess."
+    },
+    {
+      "id": "1005104",
+      "text": "The design checker now flags a logo or image that silently fails to show, instead of reporting everything clean."
+    },
+    {
+      "id": "1005101",
+      "text": "When the automatic reviewers could not run at all on a small change, Bongos now says it was an outage and names the cause, instead of telling the builder their work had problems."
+    },
+    {
+      "id": "1004384",
+      "text": "Sessions that start on a claimed task no longer receive raw idea titles from Discord: hint titles are now cleaned and boxed off as data, and outside ideas are left out, so a planted instruction can't steer the agent. The hints"
+    }
   ]
 }

package/scripts/bongos/cli-lib.js

@@ -54,7 +54,8 @@ const SESSION_READ_PATHS = SESSION_FILENAMES.flatMap((n) => ic.configReadPaths(n
 // default, so module-level consumers (reauth's Settings URL, the hall links
 // hallBase() prints) named the checkout's own instance instead of the one the
 // builder is signed into.
-const API_BASE = ic.resolveApiBase();
+// Resolved from the session for the TARGET instance (task 1005117), not the bare active pointer.
+const API_BASE = ic.resolveApiBase({ session: loadSessionSync() });
 
 // User-Agent for the GDS CLI's HTTP calls — the branding-derived neutral platform UA
 // from the single source, src/branding.js userAgent() (`<repo.name|envPrefix>-gds/1.0`,
@@ -251,7 +252,9 @@ async function migrateSessionFile(session) {
   }
 }
 
-async function loadSession() {
+// The raw ACTIVE pointer — the single file every pre-store reader looked at, whatever instance it
+// belongs to. saveSession archives THIS (it is what an outgoing sign-in would otherwise lose).
+async function loadActiveSession() {
   // Try each read path in priority order (configured dir's bongos-session.json,
   // legacy otb dir, then each superseded filename across the same dirs). A hit on
   // anything OTHER than SESSION_PATH is migrated forward — SESSION_READ_PATHS[0]
@@ -267,6 +270,50 @@ async function loadSession() {
   return null;
 }
 
+// The host this run TARGETS, or null when it names none (task 1005117). An explicit
+// <PREFIX>_API_BASE wins (the operator is steering the base); otherwise a BRANDED checkout targets
+// its own publicOrigin. A neutral checkout with no override targets nothing in particular, so it
+// keeps reading the active pointer exactly as before.
+// The env lookup honours an injected brand's own prefix, so a test can drive this in isolation.
+function sessionTargetBase({ env = process.env, brand, hasInstanceConfig = defaultHasInstanceConfig } = {}) {
+  const b = brand || safeBranding();
+  const fromEnv = ic.resolveEnv('API_BASE', { env, prefix: ic.envPrefix(b) });
+  if (fromEnv) return fromEnv;
+  return brandedInstanceOrigin({ brand: b, hasInstanceConfig });
+}
+
+// Pick the session for the TARGET instance (task 1005117). The active pointer is ONE slot, so
+// signing in to a second instance mid-run (toast.cloudbongos.com) rewrote it, and a run steered at
+// the first then sent the second instance's token there — every claim and ship 401'd. When the
+// target's host differs from the active session's and the per-instance store (below) holds a
+// session for the target, that one wins. Otherwise the active session is returned unchanged —
+// the backward compatibility with the single file, including a session from before the store.
+//
+// Split in two so the async path reads with fsp and the sync path with fs: targetStorePath() says
+// WHICH store file to try (null = keep the active session), chooseSession() decides with what it read.
+function targetStorePath(active, opts) {
+  const targetKey = sessionHostKey(sessionTargetBase(opts));
+  if (!targetKey) return null;
+  if (active && sessionHostKey(active.api_base) === targetKey) return null;
+  return path.join(sessionStoreDir(), `${targetKey}.json`);
+}
+
+function chooseSession(active, stored) {
+  return stored && stored.token ? stored : active;
+}
+
+function readJsonSync(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
+}
+
+async function loadSession(opts) {
+  const active = await loadActiveSession();
+  const p = targetStorePath(active, opts);
+  if (!p) return active;
+  const stored = await readSessionFile(p).catch(() => null);
+  return chooseSession(active, stored);
+}
+
 // ---- the shared session store (task 1003741, ADR 0269) ---------------------
 // ONE FILE PER INSTANCE, at a FIXED anchor — deliberately NOT configHome().
 //
@@ -336,7 +383,7 @@ async function saveSession(session) {
   await fsp.mkdir(dir, { recursive: true });
 
   try {
-    const prev = await loadSession();
+    const prev = await loadActiveSession();
     const prevKey = prev && prev.token ? sessionHostKey(prev.api_base) : null;
     const nextKey = sessionHostKey(session && session.api_base);
     if (prevKey && prevKey !== nextKey) await writeSessionToStore(prev);
@@ -379,7 +426,7 @@ function listStoredSessions() {
   return out.sort((a, b) => a.host.localeCompare(b.host));
 }
 
-function loadSessionSync() {
+function loadActiveSessionSync() {
   for (const p of SESSION_READ_PATHS) {
     if (!fs.existsSync(p)) continue;
     try {
@@ -391,6 +438,13 @@ function loadSessionSync() {
   return null;
 }
 
+// Synchronous twin of loadSession — the session for the TARGET instance (task 1005117).
+function loadSessionSync(opts) {
+  const active = loadActiveSessionSync();
+  const p = targetStorePath(active, opts);
+  return p ? chooseSession(active, readJsonSync(p)) : active;
+}
+
 // ---- argv helpers (C11) ---------------------------------------------------
 // One home for the flag parsing every GDS CLI rolled by hand. Two contracts:
 //   arg(name)     → the flag's VALUE ('--out x' or '--out=x'), else null
@@ -564,6 +618,14 @@ function defaultHasInstanceConfig() {
   } catch { return false; }
 }
 
+// THIS checkout's declared instance origin, or null for a neutral checkout / no publicOrigin. The
+// one place both the session picker (sessionTargetBase) and the wrong-instance guard
+// (detectInstanceMismatch) read it, so the two cannot drift (task 1005117).
+function brandedInstanceOrigin({ brand = safeBranding(), hasInstanceConfig = defaultHasInstanceConfig } = {}) {
+  if (!hasInstanceConfig()) return null;
+  return (brand && brand.domains && brand.domains.publicOrigin) || null;
+}
+
 // Host of an origin string, or null if unparseable. Comparing HOSTS (not full
 // origins) tolerates scheme / trailing-slash noise between branding + session.
 function instanceOriginHost(origin) {
@@ -586,8 +648,7 @@ function instanceOriginHost(origin) {
 function detectInstanceMismatch({ session, brand = safeBranding(), env = process.env, hasInstanceConfig = defaultHasInstanceConfig } = {}) {
   if (ic.resolveEnv('API_BASE', { env })) return { mismatch: false };
   if (!session || !session.api_base) return { mismatch: false };
-  if (!hasInstanceConfig()) return { mismatch: false };
-  const expected = brand && brand.domains && brand.domains.publicOrigin;
+  const expected = brandedInstanceOrigin({ brand, hasInstanceConfig });
   if (!expected) return { mismatch: false };
   const expectedHost = instanceOriginHost(expected);
   const actualHost = instanceOriginHost(session.api_base);
@@ -1184,6 +1245,8 @@ module.exports = {
   SESSION_READ_PATHS,
   loadSession,
   loadSessionSync,
+  sessionTargetBase,
+  targetStorePath,
   saveSession,
   sessionStoreDir,
   sessionHostKey,

package/scripts/bongos/run-unit-tests.js

@@ -88,6 +88,10 @@ const INTEGRATION = new Set([
   // year's baseline over 30 days, a quiet row's live total, hidden and private left out.
   // The DB-free sibling is community_movers.
   'community_movers_db',
+  // task 1002985: the community proof — one fixture per privacy-matrix row and one snapshot
+  // history through every community route on real SQL. Its DB-free sibling is the
+  // privacy-matrix proof, which must stay unnamed here (it asserts that it is).
+  'community_proof_db',
   // task 1004936: the Market Watch tables, hub seed and read queries against real SQL. The
   // CHECKs, partial unique indexes and ON CONFLICT targets are what make the seed
   // idempotent and a resumed run unable to record an item twice. DB-free sibling: