@bongos/core 1.25.31 → 1.25.33

package/modules/hall-ui/records/welcome-tower.md

@@ -1,15 +1,21 @@
 # The welcome — Home's first visit of the day (tasks 1004785, 1004818)
 
 The owner's Builders' Hall idea 1001262, second half (the first is [`home-reshuffle.md`](home-reshuffle.md)).
-Files: `public/welcome-boot.js` + `public/welcome-boot.css`, and the owner's two paintings
-`public/welcome-day.webp` / `public/welcome-night.webp`, on Home only.
+Files: `public/welcome-boot.js` + `public/welcome-boot.css`, on Home only. The scene is drawn by
+Home's own city painters (`sky-time.js`, `city-draw.js`, `home-city-draw.js`).
 
 **How the look got here (2026-10-23, one day of owner rounds).** Task 1004785 built v5 "the tower"
 ([`docs/design/mocks/hall/welcome/v5.src.html`](../../../docs/design/mocks/hall/welcome/v5.src.html)),
 drawn live from the Repo Atlas. The owner then asked for day and night and a slow way out, then
 swapped the tower for a glowing module city with a lunch crew on a beam, dropped the crew, and
 finally had Gemini paint the city by day and by night and asked for those to be animated (task
-1004818). The atlas-drawn scene is gone; the painting is the scene.
+1004818). The atlas-drawn scene is gone.
+
+**The painting is retired too (task 1005308, owner 2026-11-14: "retire it everywhere").** The scene
+is now the city in the clouds from task 1005196, the same city Home and the City page draw, in the
+hour's sky. The two WebP paintings and every light that was pinned to their pixels (the circuit
+towers' pulses, the hover cars, the moon and stars) are deleted. The game's start and load screens
+stand on the same scene (`records/start-screen.md`).
 
 - **When.** A signed-in builder's first Home load of the LOCAL day, per builder id
   (`localStorage['hall-welcome-day:<id>']`). Storage that throws is never shown it, because it could not
@@ -20,15 +26,16 @@ finally had Gemini paint the city by day and by night and asked for those to be
   `welcome-boot.js` loads before the `shell-trail.js` / `craft-mode.js` / `shell.js` trio, which
   `tests/craft_mode.mjs` keeps adjacent.
 - **Day and night.** `timeOfDay` makes 06:00 to 17:59 local `day`, the rest `night`; the root wears
-  `.wb--day` or `.wb--night` and shows the matching painting. It opens from a veil (`.wb__veil`),
-  white by day and black by night, that lifts once the painting has loaded (or after 1.5s).
-- **The motion is laid on the painting, in its own pixels.** `.wb__art` covers the screen at the
-  paintings' 1024x572 shape (both share one layout), so the SVG over it (`viewBox 0 0 1024 572`) keeps
-  every light on its mark however the screen crops: `TOWERS` (the circuit towers, where `pulseRuns`
-  climbs), `BEACONS` (mast lights, night), `LANES` (hover cars), the moon and stars (night), plus a
-  slow drift of the whole picture and two clouds. **A new painting must keep that layout, or the
-  coordinates in welcome-boot.js move with it** — `tests/welcome_boot.mjs` checks both files are
-  1024x572 WebP.
+  `.wb--day` or `.wb--night`, which sets the ink. It opens from a veil (`.wb__veil`), white by day
+  and black by night, that lifts two frames after the scene is painted (or after 1.5s). The scene's
+  own colours follow the hour more finely (`sky-time.js`: night, dawn, midday, dusk, blended).
+- **The scene is the city, as a backdrop.** `paintScene(host)` asks `OTBHomeCityDraw.citySvg` for an
+  empty week (the Cloud Bongos core and the museum, standing in cloud) and rewrites it with
+  `sceneShape`: every link becomes a plain group, tooltips and goal hooks are dropped, the faded
+  `hc-quiet` look is lifted so the core leads, and every id is prefixed `cs-` so it never meets the
+  ids of Home's own city on the same page. It covers the screen, standing on the bottom edge
+  (`xMidYMax slice`), over `.cloud-scene`'s sky gradient, with a slow drift and two clouds. The same
+  `paintScene` is handed to the game's start screen as `scene`.
 - **Banner.** "Working on the core of <project>" from `__BRANDING__.identity` (never a hardcoded word),
   with `core <version>` under it when the public `GET /version` reports one.
 - **Sequence.** Veil lifts, the city powers up (pulses brighten), the greeting comes up at ~3.4s.
@@ -40,11 +47,13 @@ finally had Gemini paint the city by day and by night and asked for those to be
   Artisan → stays on Home (the Ideator door, once `/thinking`, folded into Artist). A pick also calls
   `OTBCraftMode.choose()` with patron / artist / artisan. **Patron shows only where
   `OTBCraftMode.offered('patron')`** — the patron craft is a seat — and the list is built when "Start with your role" is pressed, after the seats have settled.
-- **No painting** (a 404) hides the image and leaves the sky gradient; everything else works.
-- **Colours are the paintings'**, in both hall themes: `welcome-boot.css` and `welcome-boot.js` are on
-  `tests/hall_audit.mjs`'s literal exemptions with that reason.
-- **Tests.** `tests/welcome_boot.mjs` (the day rule, the paintings' files and shape, every light inside
-  the painting and every pulse inside its tower, the banner, the role map, the load order);
-  `tests/welcome_boot_browser.mjs` runs Home's markup with the real shell, craft mode, welcome and
-  paintings in a browser: once a day, Skip, Esc, no double picker, the seat rule, no painting, reduced
-  motion, the veil by day and night, the slow exit, and that the old drawn scene is gone.
+- **No city painters** on the page: the root wears `.wb--bare`, the hour's sky gradient stands alone,
+  and everything else works.
+- **The scene's colours are the hour's sky tokens only** (`--sky-now-*`); the welcome's ink, veil and
+  panels keep their fixed day/night literals, on `tests/hall_audit.mjs`'s literal exemptions.
+- **Tests.** `tests/welcome_boot.mjs` (the day rule, that the painting and its lights are gone, the
+  scene's shapes with no door, no unprefixed id and no typed colour, the banner, the role map, the
+  load order); `tests/welcome_boot_browser.mjs` runs Home's markup with the real shell, craft mode,
+  welcome and city painters in a browser: once a day, Skip, Esc, no double picker, the seat rule, no
+  painters, reduced motion, the city in the hour's sky by day and night, the slow exit, and that the
+  painting's lights are gone.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.31",
+  "version": "1.25.33",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.31",
+      "version": "1.25.33",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.31",
+  "version": "1.25.33",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11961,5 +11961,17 @@
       "id": "1005310",
       "text": "The governor's street asks the server for less and gets its answers sooner."
     }
+  ],
+  "1.25.32": [
+    {
+      "id": "1005308",
+      "text": "The old circuit-city painting is gone. The welcome screen and the game's start screens now open on the city in the clouds, coloured for the time of day: deep night with lit windows, a warm dawn, a bright midday."
+    }
+  ],
+  "1.25.33": [
+    {
+      "id": "1005202",
+      "text": "A runner that cannot download new code from GitHub now shows \"Stuck on old code\" on its card, with the fix, instead of looking healthy."
+    }
   ]
 }

package/scripts/bongos/autobongos-host.js

@@ -308,18 +308,28 @@ function git(args, opts = {}) {
 }
 
 // refreshCheckout — the .cmd's fetch + reset, on the runner's own copy only.
-function refreshCheckout(log = () => {}) {
-  assertRunnerCopy();
-  const f = git(['fetch', '--quiet', 'origin', 'main']);
-  if (f.status !== 0) {
-    // The log is the ONLY place this is said (the card reads check-ins, not fetches), so it
-    // carries the remedy too — a fetch that fails for a credential reason fails every loop,
-    // and the runner then works forever on the code it happens to have (task 1005096).
+//
+// Straight fetch failures are counted in `counter` and handed to the supervisor
+// through `env` (AUTOBONGOS_FETCH_FAILURES), which seeds its own count, so its
+// check-in can say `cannot_fetch` and the device's card stops reading healthy
+// (task 1005202). The collaborators are injectable for the test only.
+function refreshCheckout(log = () => {}, {
+  git: gitFn = git, assert = assertRunnerCopy, remedy = githubRemedy, counter = null, env = null,
+} = {}) {
+  assert();
+  const f = gitFn(['fetch', '--quiet', 'origin', 'main']);
+  const fetched = f.status === 0;
+  if (counter) counter.fetchFailures = fetched ? 0 : (counter.fetchFailures || 0) + 1;
+  if (counter && env) env.AUTOBONGOS_FETCH_FAILURES = String(counter.fetchFailures);
+  if (!fetched) {
+    // A fetch that fails for a credential reason fails every loop, and the runner then
+    // works forever on the code it happens to have (task 1005096), so the log carries
+    // the remedy, and the count above carries the fact to the card.
     log(`git fetch failed — running the code already here (${String(f.stderr || '').trim().slice(0, 200)})`);
-    log(`  if that keeps happening, it is not transient: ${githubRemedy()}`);
+    log(`  if that keeps happening, it is not transient: ${remedy()}`);
     return false;
   }
-  const r = git(['reset', '--quiet', '--hard', 'origin/main']);
+  const r = gitFn(['reset', '--quiet', '--hard', 'origin/main']);
   if (r.status !== 0) { log(`git reset failed (${String(r.stderr || '').trim().slice(0, 200)})`); return false; }
   return true;
 }
@@ -821,6 +831,7 @@ async function runCommand({ paths = hostPaths() } = {}) {
   const log = makeLogger(paths, { echo: !!process.stdout.isTTY });
   const env = supervisorEnv(process.env, paths, dirName);
   const state = { child: null, stopping: false };
+  const fetchCounter = { fetchFailures: 0 };   // straight failed fetches, handed to the supervisor (task 1005202)
   const keepAwake = makeKeepAwake();
   const selfSha = fileSha(__filename);
   writeLock(paths);
@@ -836,7 +847,7 @@ async function runCommand({ paths = hostPaths() } = {}) {
   rotateLog(paths);
   const out = await runLoop({}, {
     log, shouldStop: () => state.stopping,
-    refresh: () => refreshCheckout(log),
+    refresh: () => refreshCheckout(log, { counter: fetchCounter, env }),
     ensureDeps: () => ensureDeps(paths, log),
     spawnSupervisor: () => spawnSupervisorReal({ paths, env, log, keepAwake, state }),
     selfChanged: () => fileSha(__filename) !== selfSha,
@@ -924,5 +935,5 @@ module.exports = {
   windowsRunArgv, windowsRunCommand, windowsStartSpawn, legacyBootTaskInstalled, launchdPlist,
   stopRunner, stopReport, exchangeCode, claudeState, waitForCheckIn,
   signIn, cleanBase, install, removeStartEntry, installedState, status, digestArgv,
-  githubRemedy, GITHUB_REMEDY_GENERIC,
+  githubRemedy, GITHUB_REMEDY_GENERIC, refreshCheckout,
 };

package/scripts/bongos/autobongos-run.js

@@ -511,8 +511,19 @@ const MAX_CLAIM_ATTEMPTS = 5;
 // guess that is wrong costs one wasted spawn per half hour, not one per wake.
 const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
+// How many straight failures to reach origin before the check-in says
+// `cannot_fetch` (task 1005202). A blip fails once or twice and clears; a
+// credential fault (the active GitHub account cannot see the project) fails
+// every time, forever, and the runner then works on whatever code it has. The
+// polls inside a wait are a minute apart, so this is a few minutes of failing.
+const CANNOT_FETCH_AFTER = 3;
+
+// fetchFailures starts from the host wrapper's own count (AUTOBONGOS_FETCH_FAILURES,
+// set by autobongos-host.js), so a restart does not reset the card to healthy.
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null, landSweepAt: null };
+  const seeded = Number.parseInt(process.env.AUTOBONGOS_FETCH_FAILURES, 10);
+  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null, landSweepAt: null,
+    fetchFailures: Number.isInteger(seeded) && seeded > 0 ? seeded : 0 };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -920,9 +931,23 @@ function heartbeatIdentity(deps = {}) {
   return out;
 }
 
+// cannotFetchEvent — what a beat says once the runner has failed to reach the
+// project CANNOT_FETCH_AFTER times in a row (task 1005202). It replaces the idle
+// words ("waiting", "loop", nothing), which would otherwise read as healthy. It
+// never hides a restart, a setting holding the runner, or the task in its hands:
+// each of those is its own truth about this minute.
+function cannotFetchEvent(fields = {}, state = RUNNER_STATE) {
+  if (!state || !((state.fetchFailures || 0) >= CANNOT_FETCH_AFTER)) return fields.last_event;
+  if (fields.working_task_id) return fields.last_event;
+  const ev = fields.last_event;
+  if (ev === 'upgrade_exit' || (typeof ev === 'string' && ev.startsWith('config_idle:'))) return ev;
+  return 'cannot_fetch';
+}
+
 async function postHeartbeat(fields = {}, deps = {}) {
   try {
     const api = deps.api || await (require('./cli-lib').cliClient)();
+    const lastEvent = cannotFetchEvent(fields, deps.state || RUNNER_STATE);
     await api.autonomy.postAutonomyHeartbeat({
       body: {
         host: os.hostname(),
@@ -930,6 +955,7 @@ async function postHeartbeat(fields = {}, deps = {}) {
         started_at: RUNNER_STARTED_AT,
         ...heartbeatIdentity(deps),
         ...fields,
+        ...(lastEvent ? { last_event: lastEvent } : {}),
       },
     });
     return true;
@@ -1165,11 +1191,17 @@ async function refreshCheckout(deps = {}) {
 // The head of origin/main, or null. `git ls-remote` rather than `fetch`: it moves
 // no refs and writes nothing, so polling it every few minutes cannot interfere
 // with a worker building in a tree beside it.
+//
+// Every call also counts toward `fetchFailures` (task 1005202): a success clears
+// it, anything else adds one, so the heartbeat can say the runner cannot reach
+// the project instead of reading healthy on code it can never update.
 async function runFetchHead(deps = {}) {
   const runCmd = deps.run || run;
-  const r = await runCmd('git', ['ls-remote', 'origin', 'refs/heads/main']);
-  if (!r.ok) return null;
-  const m = /^([0-9a-f]{40})/.exec(String(r.stdout).trim());
+  const st = deps.state || RUNNER_STATE;
+  let r = null;
+  try { r = await runCmd('git', ['ls-remote', 'origin', 'refs/heads/main']); } catch (_) { r = null; }
+  const m = r && r.ok ? /^([0-9a-f]{40})/.exec(String(r.stdout).trim()) : null;
+  st.fetchFailures = m ? 0 : (st.fetchFailures || 0) + 1;
   return m ? m[1] : null;
 }
 
@@ -1395,6 +1427,6 @@ module.exports = {
   worktreeName, readFence, gradeLedgerPath, gradeCapReader, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, claudeAccountLabel, RUNNER_STARTED_AT, failureReason,
-  newRunnerState, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
+  newRunnerState, runFetchHead, cannotFetchEvent, CANNOT_FETCH_AFTER, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
   readRunLogRows, recheckPendingLands, LAND_SWEEP_MS,
 };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.31'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.33'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_cannot_fetch.mjs

@@ -0,0 +1,123 @@
+// tests/autobongos_cannot_fetch.mjs — a runner that can never fetch says so on
+// its card (task 1005202).
+//
+// Found on a real Mac: two GitHub accounts were signed in, the active one could
+// not see the private project, and every `git fetch` 404'd. The runner checked in
+// as healthy and worked on the code it happened to clone, forever; only its own
+// log said otherwise. These pin the signal end to end: the host and the
+// supervisor count straight fetch failures, past CANNOT_FETCH_AFTER the check-in
+// says `cannot_fetch`, the verdict is not ok and carries the remedy, and the
+// device's button and checklist stop reading healthy. One good fetch clears it.
+//
+// DB-free, no network. Run:  node --test tests/autobongos_cannot_fetch.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const runner = req(path.join(ROOT, 'scripts/bongos/autobongos-run.js'));
+const host = req(path.join(ROOT, 'scripts/bongos/autobongos-host.js'));
+const health = req(path.join(ROOT, 'modules/autonomy/runner-health.js'));
+const RB = req(path.join(ROOT, 'modules/hall-ui/public/runner-button.js'));
+
+const A = 'a'.repeat(40);
+const NOW = Date.parse('2026-11-14T12:00:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+
+const failing = async () => ({ ok: false, stdout: '', stderr: 'remote: Repository not found.' });
+const working = async () => ({ ok: true, stdout: `${A}\trefs/heads/main\n` });
+
+function recorder() {
+  const bodies = [];
+  const api = { autonomy: { postAutonomyHeartbeat: async ({ body }) => { bodies.push(body); return { ok: true }; } } };
+  return { bodies, api };
+}
+
+test('the supervisor counts straight failures to reach main, and one success clears the count', async () => {
+  const state = runner.newRunnerState();
+  assert.equal(state.fetchFailures, 0);
+  for (let i = 1; i <= 3; i++) {
+    assert.equal(await runner.runFetchHead({ run: failing, state }), null);
+    assert.equal(state.fetchFailures, i);
+  }
+  await runner.runFetchHead({ run: async () => { throw new Error('spawn git ENOENT'); }, state });
+  assert.equal(state.fetchFailures, 4, 'a git that cannot even start is a failure too');
+  assert.equal(await runner.runFetchHead({ run: working, state }), A);
+  assert.equal(state.fetchFailures, 0);
+});
+
+test('past the threshold the check-in says cannot_fetch instead of a healthy idle', async () => {
+  const { bodies, api } = recorder();
+  const state = runner.newRunnerState();
+  const deps = { api, state, claudeAccountLabel: () => null };
+  for (let i = 0; i < runner.CANNOT_FETCH_AFTER - 1; i++) await runner.runFetchHead({ run: failing, state });
+  await runner.postHeartbeat({ last_event: 'waiting' }, deps);
+  assert.equal(bodies.at(-1).last_event, 'waiting', 'a blip below the threshold is not an alarm');
+
+  await runner.runFetchHead({ run: failing, state });
+  for (const ev of ['waiting', 'loop', 'nothing_claimable', undefined]) {
+    await runner.postHeartbeat(ev ? { last_event: ev } : {}, deps);
+    assert.equal(bodies.at(-1).last_event, 'cannot_fetch', String(ev));
+  }
+  // What it must never hide: a restart, a setting holding it, or the task in its hands.
+  await runner.postHeartbeat({ last_event: 'upgrade_exit' }, deps);
+  assert.equal(bodies.at(-1).last_event, 'upgrade_exit');
+  await runner.postHeartbeat({ last_event: 'config_idle:no_goals' }, deps);
+  assert.equal(bodies.at(-1).last_event, 'config_idle:no_goals');
+  await runner.postHeartbeat({ last_event: 'claimed', working_task_id: 7 }, deps);
+  assert.equal(bodies.at(-1).last_event, 'claimed');
+
+  await runner.runFetchHead({ run: working, state });
+  await runner.postHeartbeat({ last_event: 'waiting' }, deps);
+  assert.equal(bodies.at(-1).last_event, 'waiting', 'one good fetch and the card reads healthy again');
+});
+
+test('the host counts its own failed fetches and hands the count to the supervisor it starts', () => {
+  const env = {};
+  const counter = { fetchFailures: 0 };
+  const bad = () => ({ status: 128, stdout: '', stderr: 'fatal: repository not found' });
+  const good = () => ({ status: 0, stdout: '', stderr: '' });
+  const opts = { git: bad, assert: () => {}, remedy: () => 'switch account', counter, env };
+  assert.equal(host.refreshCheckout(() => {}, opts), false);
+  assert.equal(host.refreshCheckout(() => {}, opts), false);
+  assert.equal(counter.fetchFailures, 2);
+  assert.equal(env.AUTOBONGOS_FETCH_FAILURES, '2');
+  // The supervisor it starts begins from that count, so the card does not wait
+  // for a fresh run of failures after every restart.
+  const saved = process.env.AUTOBONGOS_FETCH_FAILURES;
+  process.env.AUTOBONGOS_FETCH_FAILURES = env.AUTOBONGOS_FETCH_FAILURES;
+  try { assert.equal(runner.newRunnerState().fetchFailures, 2); } finally {
+    if (saved === undefined) delete process.env.AUTOBONGOS_FETCH_FAILURES; else process.env.AUTOBONGOS_FETCH_FAILURES = saved;
+  }
+  assert.equal(host.refreshCheckout(() => {}, { ...opts, git: good }), true);
+  assert.equal(counter.fetchFailures, 0);
+  assert.equal(env.AUTOBONGOS_FETCH_FAILURES, '0');
+});
+
+test('the verdict is cannot_fetch: not ok, and it carries the remedy', () => {
+  const d = health.describeRunner({ host: 'mac-mini', mode: 'full', last_event: 'cannot_fetch', last_seen_at: agoS(30) }, { nowMs: NOW });
+  assert.equal(d.state, 'cannot_fetch');
+  assert.equal(d.ok, false, 'a runner pinned to old code is not healthy');
+  assert.match(d.detail, /mac-mini/);
+  assert.match(d.remedy, /gh auth switch/);
+  // Silence still wins: a runner nobody has heard from cannot vouch for anything.
+  assert.equal(health.describeRunner({ host: 'mac-mini', last_event: 'cannot_fetch', last_seen_at: agoS(3 * 3600) }, { nowMs: NOW }).state, 'dead');
+});
+
+test("the device's button says it is stuck on old code, and names the fix", () => {
+  const fence = { enabled: true, scope: { goals: [1] }, project: { enabled: true, goals: [{ goal_id: 1 }] } };
+  const runnerRow = {
+    host: 'mac-mini', run_requested: true, run_changed_at: agoS(3600), last_seen_at: agoS(30),
+    health: { state: 'cannot_fetch', host: 'mac-mini', age: '30s', remedy: 'Run gh auth switch on it.' },
+  };
+  const b = RB.buttonState({ runner: runnerRow, fence, nowMs: NOW });
+  assert.equal(b.status, 'Stuck on old code');
+  assert.equal(b.tone, 'warn');
+  assert.equal(b.act, 'stop');
+  assert.match(b.sub, /cannot fetch new code/);
+  assert.match(b.sub, /gh auth switch/);
+});

package/tests/hall_sky_time.mjs

@@ -112,8 +112,9 @@ test('the sky tokens are art: no control, no text and no chrome spends one', ()
       const sel = m[1].trim();
       if (f === 'style.css' && /(^|\n):root$/.test(sel)) continue; // the token block itself
       // only the two scenes spend them: the City page's frame, stage and cloud; Home's scene, its
-      // stage, and (in game mode) the ground of the Home view
-      if (!/^(\.city-frame|\.city-stage|\.city-cloud|\.city-stars|\.hc-svg|\.hc-cloud|\.hc-stage|html\[data-game="on"\] body\[data-page="home"\]$)/.test(sel)) { hits.push(`${f}: ${sel}`); continue; }
+      // stage, and (in game mode) the ground of the Home view; and the cloud scene behind the welcome
+      // and the game's start screens (task 1005308)
+      if (!/^(\.city-frame|\.city-stage|\.city-cloud|\.city-stars|\.hc-svg|\.hc-cloud|\.hc-stage|\.cloud-scene|html\[data-game="on"\] body\[data-page="home"\]$)/.test(sel)) { hits.push(`${f}: ${sel}`); continue; }
       for (const d of m[2].split(';')) {
         const prop = d.split(':')[0].trim();
         if (/--sky-/.test(d) && (prop === 'color' || /^border|^outline|^caret|^text-/.test(prop))) hits.push(`${f}: ${sel} { ${prop} }`);

package/tests/hall_start_screen.mjs

@@ -95,13 +95,14 @@ test('the load screen fills one segment per week, up to the week it is showing (
   assert.equal(G.segsDone(0, 0), 0);
 });
 
-test('a fresh sign-in is handed to the start screen with the still, and the craft picker waits for the world', () => {
+test('a fresh sign-in is handed to the start screen with the city in the clouds, and the craft picker waits for the world', () => {
   const s = sandbox({ store: { 'hall-welcome-signin': '1' } });
   const access = { authed: true }, builder = { id: 7, display_name: 'Ada' };
   assert.equal(s.window.OTBWelcome.onAccess(access, builder), true, 'the shell is told a screen is up, so it asks no picker');
   assert.equal(s.started.length, 1);
   assert.equal(s.started[0].name, 'Harbor');
-  assert.match(s.started[0].art, /^\/builders\/welcome-(day|night)\.webp$/);
+  assert.equal(typeof s.started[0].scene, 'function', 'the scene is painted, not a picture (task 1005308)');
+  assert.equal(s.started[0].art, undefined, 'the circuit-city painting is retired');
   assert.equal(s.store['hall-welcome-signin'], undefined, 'the flag is spent');
   assert.deepEqual(s.asked, [], 'nothing is asked while the start screen is up');
   s.started[0].done();

package/tests/welcome_boot.mjs

@@ -1,8 +1,8 @@
 // tests/welcome_boot.mjs — the welcome's pure parts (tasks 1004785, 1004818).
 //
 // WHY. The welcome decides things a reader would only notice going wrong over days: whether today
-// is the first visit, whether it is day or night (and so which painting), what the banner names,
-// where each role goes, and whether the motion still sits on the painting. Those are pure, so this
+// is the first visit, whether it is day or night, what the banner names, where each role goes,
+// and that the scene is the city in the clouds with its doors taken out (task 1005308). Those are pure, so this
 // runs the REAL welcome-boot.js (it is Node-require-safe). The overlay itself is
 // tests/welcome_boot_browser.mjs.
 import assert from 'node:assert/strict';
@@ -39,40 +39,48 @@ test('the greeting follows the local hour, and the name falls back sensibly', ()
   assert.equal(W.nameOf({}), 'builder');
 });
 
-test('day is 06:00 to 17:59 local, night the rest, and each has its painting (task 1004818)', () => {
+test('day is 06:00 to 17:59 local, night the rest (the ink and the veil follow it)', () => {
   const at = (h, m = 0) => W.timeOfDay(new Date(2026, 9, 23, h, m));
   assert.deepEqual([at(5, 59), at(6), at(12), at(17, 59), at(18), at(23, 30), at(0)],
     ['night', 'day', 'day', 'day', 'night', 'night', 'night']);
-  assert.equal(W.artFor('day'), '/builders/welcome-day.webp');
-  assert.equal(W.artFor('night'), '/builders/welcome-night.webp');
 });
 
-test('both paintings ship, as WebP, in the one shape the motion is laid out for', () => {
-  for (const url of Object.values(W.ART)) {
-    const file = path.join(HALL, url.replace(/^\/builders\//, ''));
-    const buf = fs.readFileSync(file);
-    assert.equal(buf.toString('latin1', 0, 4) + buf.toString('latin1', 8, 12), 'RIFFWEBP', url + ' is a WebP');
-    assert.ok(buf.length < 400 * 1024, url + ' stays small enough for a first paint');
-    // The VP8X header carries the canvas size (24-bit, minus one) at bytes 24..29.
-    assert.equal(buf.toString('latin1', 12, 16), 'VP8X', url + ' carries its size');
-    const w = 1 + buf.readUIntLE(24, 3), h = 1 + buf.readUIntLE(27, 3);
-    assert.deepEqual([w, h], [W.AW, W.AH], url + ' is the painting the lights were placed on');
+// Task 1005308 (owner, 2026-11-14): the circuit-city painting is retired everywhere; the scene is the
+// city in the clouds Home's own painters draw (task 1005196), as a backdrop.
+test('the circuit-city painting is retired: no picture file, no lights pinned to its pixels', () => {
+  for (const name of ['welcome-day.webp', 'welcome-night.webp']) assert.equal(fs.existsSync(path.join(HALL, name)), false, name + ' is gone');
+  for (const gone of ['ART', 'artFor', 'TOWERS', 'LANES', 'AW', 'AH', 'pulseRuns', 'BEACONS']) assert.equal(W[gone], undefined, gone + ' went with the painting');
+  for (const file of ['welcome-boot.js', 'welcome-boot.css', 'shell-game.js', 'shell-game.css', 'index.html']) {
+    assert.doesNotMatch(fs.readFileSync(path.join(HALL, file), 'utf8'), /welcome-(day|night)\.webp|wb__img|gs__img|wb-motion/, file + ' names no part of the painting');
   }
 });
 
-test('every light sits inside the painting, and every pulse climbs inside its tower', () => {
-  const inside = ([x, y]) => x >= 0 && x <= W.AW && y >= 0 && y <= W.AH;
-  assert.equal(W.BEACONS, undefined, 'the blinking mast lights are gone (task 1005087)');
-  for (const t of W.TOWERS) assert.ok(inside([t.x, t.y]) && inside([t.x + t.w, t.y + t.h]), 'tower inside the painting');
-  const runs = W.pulseRuns(W.TOWERS, 3, 7);
-  assert.equal(runs.length, W.TOWERS.length * 3);
-  for (const r of runs) {
-    const t = W.TOWERS[r.tower];
-    assert.ok(r.x >= t.x && r.x <= t.x + t.w, 'a pulse runs up its own tower');
-    assert.ok(r.y1 > r.y0 && r.y0 >= t.y && r.y1 <= t.y + t.h, 'bottom to top, within the tower');
-    assert.ok(r.dur > 0 && r.delay >= 0);
+test("the scene is the city in the clouds, drawn by Home's own painters, with every door taken out", async () => {
+  const vm = await import('node:vm');
+  const ctx = { window: {}, console };
+  vm.createContext(ctx);
+  vm.runInContext(fs.readFileSync(path.join(HALL, 'city-draw.js'), 'utf8'), ctx);
+  const Gov = ctx.window.GovCity;
+  const Draw = require(path.join(HALL, 'home-city-draw.js'));
+  assert.ok(Gov && Draw, 'the painters load');
+  const s = W.sceneShapes(Draw, Gov);
+  assert.match(s.viewBox, /^0 0 1000 \d+$/);
+  const all = [];
+  (function walk(n) { all.push(n); n.kids.forEach(walk); })({ tag: 'root', attrs: {}, kids: s.nodes });
+  assert.ok(all.some((n) => /hc-cloud/.test(n.attrs.class || '')), 'it stands in cloud');
+  assert.ok(all.filter((n) => n.tag === 'path').length > 50, 'the core and the museum are drawn');
+  assert.equal(all.filter((n) => n.tag === 'a').length, 0, 'no link: it is a backdrop');
+  for (const n of all) {
+    for (const k of ['href', 'tabindex', 'aria-label', 'data-tip', 'data-tip-body', 'data-goal']) assert.equal(n.attrs[k], undefined, k + ' is taken out');
+    if (n.attrs.id) assert.ok(n.attrs.id.startsWith(W.SCENE_ID), "its ids never meet Home's own city's");
+    for (const v of Object.values(n.attrs)) assert.doesNotMatch(String(v), /url\(#(?!cs-)/, 'every reference points at its own prefixed id');
+    assert.doesNotMatch(n.attrs.class || '', /hc-quiet/, 'nothing is faded: the core leads');
   }
-  assert.deepEqual(W.pulseRuns(W.TOWERS, 3, 7), runs, 'seeded: every visit draws the same picture');
+  const json = JSON.stringify(s);
+  assert.doesNotMatch(json, /#[0-9a-f]{6}\b/i, "no typed colour: the hour's sky tokens only");
+  assert.match(json, /--sky-now-/, "it paints in the hour's sky");
+  assert.equal(W.sceneShapes(null, Gov), null, 'no painters: no city, and the sky stands alone');
+  assert.equal(W.paintScene(null), false);
 });
 
 test('the banner is the logo, named from the branding pack, never a hardcoded word (task 1004953)', () => {