@bongos/core 1.19.1035 → 1.19.1036

package/docs/api/openapi.json

@@ -13915,7 +13915,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/control-plane",
-        "description": "GET /provisioning/control-plane — \"which row is this platform, and where does it stand?\" The deploy page's first call: the self row is created once by hand at install time, so its id is per-install and nobody's to memorise. Same atom again, so the entrance is no wider than the door it leads to.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "description": "GET /provisioning/control-plane — \"which row is this platform, and where does it stand?\" The deploy page's first call: the self row is created once by hand at install time, so its id is per-install and nobody's to memorise. The atom ALONE here, with no owner door: this is the platform's own row (ADR 0339).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
         "x-rank": "archon",
         "x-source": "modules/provisioning/routes/core-upgrade.js",
         "x-permissions": [
@@ -14231,7 +14231,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/instances/:id/core-upgrade",
-        "description": "GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. GATED THE SAME AS THE POST, deliberately. Reading it discloses the instance's exact core version and how far behind it is, which is a vulnerability-window disclosure — precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview anyone could read would also let an attacker time a request against a known-stale window. The read being no cheaper than the write costs the owner nothing: they hold the atom by construction, because they are the only one who can press the button.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "description": "GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. GATED THE SAME AS THE POST, deliberately. Reading it discloses the instance's exact core version and how far behind it is, which is a vulnerability-window disclosure — precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview anyone could read would also let an attacker time a request against a known-stale window. The read being no cheaper than the write costs the owner nothing: whoever may press the button may read what it would do — the same two doors as the POST.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
         "x-rank": "archon",
         "x-source": "modules/provisioning/routes/core-upgrade.js",
         "x-permissions": [
@@ -14277,7 +14277,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/core-upgrade",
-        "description": "POST /provisioning/instances/:id/core-upgrade — move the core pin. rank: `core.pin.move` — archon floor AND system:true, so the catalog's own invariant forbids granting it to metic and no custom rank can be handed it without a deliberate, visible edit. BV1.R105 / ADR 0151 is why this is an atom and not `requireRank`: tests/government_require_permission.mjs fails the build on a new requireRank in a modules/*/routes gate. Body: { to: \"1.19.757\" } — and requiring it IS the second step of the two-step the owner asked for (ADR 0293 D4). A request that cannot fire without naming its target cannot fire from a stray click, and \"move to whatever is newest\", resolved at drain time, would be a different act from the one previewed: main moves between the preview and the confirm. What this does NOT check: whether the version is PUBLISHED, and whether the channel policy admits it. Both need the registry, and the only tool that reads it (update-channel.js `listAvailableVersions`) shells out synchronously — it would block the event loop for every other request on this process. It also lives in scripts/gds/, which a module may not require (ADR 0083). The runner enforces both, where it is a CLI and both are free. See ../core-upgrade.js.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "description": "POST /provisioning/instances/:id/core-upgrade — move the core pin. rank: `core.pin.move` — archon floor AND system:true, so the catalog's own invariant forbids granting it to metic and no custom rank can be handed it without a deliberate, visible edit. BV1.R105 / ADR 0151 is why this is an atom and not `requireRank`: tests/government_require_permission.mjs fails the build on a new requireRank in a modules/*/routes gate. OR THE PROJECT'S OWN OWNER (task 1004174, ADR 0339 — the owner's ruling that only a project's owner upgrades it). Ownership of a TENANT row is asked first; any other caller meets the unmodified `core.pin.move` gate and its unchanged refusal. The platform's own row is not an owner's to move here — it stays on the atom. Body: { to: \"1.19.757\" } — and requiring it IS the second step of the two-step the owner asked for (ADR 0293 D4). A request that cannot fire without naming its target cannot fire from a stray click, and \"move to whatever is newest\", resolved at drain time, would be a different act from the one previewed: main moves between the preview and the confirm. What this does NOT check: whether the version is PUBLISHED, and whether the channel policy admits it. Both need the registry, and the only tool that reads it (update-channel.js `listAvailableVersions`) shells out synchronously — it would block the event loop for every other request on this process. It also lives in scripts/gds/, which a module may not require (ADR 0083). The runner enforces both, where it is a CLI and both are free. See ../core-upgrade.js.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
         "x-rank": "archon",
         "x-source": "modules/provisioning/routes/core-upgrade.js",
         "x-permissions": [
@@ -21091,11 +21091,13 @@
           "ok": {
             "type": "boolean"
           },
-          "update": {}
+          "update": {},
+          "deploy_url": {}
         },
         "required": [
           "ok",
-          "update"
+          "update",
+          "deploy_url"
         ]
       },
       "GetCoreUpgradesResponse": {

package/docs/copy-inventory.md

@@ -594,8 +594,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:226` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:81` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/thinking.html:80` |
-| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:495` |
-| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:497` |
+| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:500` |
+| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:502` |
 | `bc779353aa0c` | certain | Karma — peer recognition and approvals, a separate counter from {…}. | `modules/hall-ui/public/profile.js:94` |
 | `de0e1590667f` | certain | Keep all {…} {…} — they are the values the code drops in, and the change cannot land without them. | `modules/hall-ui/public/copy-desk.js:442` |
 | `fbe40b5818a3` | certain | Key removed. | `modules/hall-ui/public/settings.js:1128` |
@@ -776,7 +776,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `261d123970e8` | certain | Open goal #{…} | `modules/hall-ui/public/roadmap.js:112` |
 | `5f3e0b179839` | certain | Open in Sessions | `modules/hall-ui/public/task.js:483` |
 | `9f55e4674ebb` | certain | Open in the copy desk | `modules/hall-ui/public/studio.js:219` |
-| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:486` |
+| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:491` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/goals-render.js:415` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/work.js:1124` |
 | `99c630009152` | certain | Open tasks whose declared files overlap — sequence these before two builders collide. | `modules/hall-ui/public/goals.html:125` |
@@ -984,12 +984,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:367` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:391` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:461` |
-| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:456` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:474` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:707` |
+| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:461` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:479` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:738` |
 | `8ad669ab2565` | certain | Sign out everywhere | `modules/hall-ui/public/settings.html:171` |
 | `ecc12c1dd4de` | certain | Skill voices | `modules/hall-ui/public/settings.html:350` |
-| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:698` |
+| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:729` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:294` |
 | `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:296` |
@@ -1016,7 +1016,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5831de503015` | certain | Studio — {{worldName}} | `modules/hall-ui/public/studio.html:10` |
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:84` |
 | `a1482eff4ead` | certain | Suggested for you | `modules/hall-ui/public/settings-specialities.js:137` |
-| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:501` |
+| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:506` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
 | `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1335` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:139` |
@@ -1037,7 +1037,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fc66e722e33` | certain | Tasks open once you have read the builder primer. | `modules/hall-ui/public/work.html:43` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
-| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:500` |
+| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:505` |
 | `f420429f942e` | certain | That builder no longer exists. | `modules/hall-ui/public/goals-render.js:1305` |
 | `545c59c1deb7` | certain | That is the session you are using right now. Ending it signs you out of this page. | `modules/hall-ui/public/settings-sessions.js:74` |
 | `282c3fa2d456` | certain | That is the wording it already has. Change something, or file a flag instead if you only want to mark it. | `modules/hall-ui/public/copy-desk.js:438` |
@@ -1169,7 +1169,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2c1c20785a6e` | certain | Unclear — a person would not know what to do | `modules/hall-ui/public/copy-desk.html:91` |
 | `aa445f06cc5e` | certain | Unlink failed: {…} | `modules/hall-ui/public/settings.js:856` |
 | `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:777` |
-| `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:665` |
+| `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:696` |
 | `e7e2a99a2bea` | certain | Use this | `modules/hall-ui/public/settings-specialities.js:148` |
 | `e1ecd543a2ca` | certain | Using this speciality. | `modules/hall-ui/public/settings-specialities.js:199` |
 | `6200bac6bdca` | certain | View all sessions | `modules/hall-ui/public/watch.html:99` |

package/docs/copy-registry.json

@@ -192,7 +192,7 @@
         "modules/hall-ui/public/hall-render.js:367",
         "modules/hall-ui/public/hall-render.js:391",
         "modules/hall-ui/public/hall-render.js:461",
-        "modules/hall-ui/public/shell.js:456"
+        "modules/hall-ui/public/shell.js:461"
       ]
     },
     {
@@ -1581,8 +1581,8 @@
       "text": "Sign out",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/shell.js:474",
-        "modules/hall-ui/public/shell.js:707"
+        "modules/hall-ui/public/shell.js:479",
+        "modules/hall-ui/public/shell.js:738"
       ]
     },
     {
@@ -6850,7 +6850,7 @@
       "surface": "builders-hall",
       "text": "Jump to a page or record",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 495,
+      "line": 500,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6859,7 +6859,7 @@
       "surface": "builders-hall",
       "text": "Jump to…",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 497,
+      "line": 502,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8488,7 +8488,7 @@
       "surface": "builders-hall",
       "text": "Open navigation",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 486,
+      "line": 491,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10360,7 +10360,7 @@
       "surface": "builders-hall",
       "text": "Sign in with GitHub",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 456,
+      "line": 461,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10369,7 +10369,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 474,
+      "line": 479,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10378,7 +10378,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 707,
+      "line": 738,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10405,7 +10405,7 @@
       "surface": "builders-hall",
       "text": "Skip to content",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 698,
+      "line": 729,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10648,7 +10648,7 @@
       "surface": "builders-hall",
       "text": "Switch theme",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 501,
+      "line": 506,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10837,7 +10837,7 @@
       "surface": "builders-hall",
       "text": "Text size",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 500,
+      "line": 505,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12025,7 +12025,7 @@
       "surface": "builders-hall",
       "text": "Use the control below to take it.",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 665,
+      "line": 696,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2549,5 +2549,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1033 with no explicit bump. run 36215757254. (task 1002620)
   1.19.1035 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1034 with no explicit bump. run 36226356336. (task 1002620)
+  1.19.1036 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1035 with no explicit bump. run 36226955285. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goals.html

@@ -235,7 +235,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b" defer></script>
+<script src="/builders/shell.js?v=2026-09-26-own1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -66,7 +66,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -344,7 +344,12 @@
       // The deploy door (task 1003159, ADR 0293). Gated 'archon' here to mirror the
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
-      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon' },
+      //
+      // THE DOOR IS THE PROVISIONING MODULE'S, and a hosted project does not run it, so
+      // there this link opened a page with nothing behind it (task 1004174). It is
+      // dropped where the module is off, and re-pointed at the hub's own door for THIS
+      // project once /core-update names one (pointDeployAtHub, ADR 0339).
+      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
       // Deploy precedent above); dropped where the provisioning module is not enabled.
@@ -622,16 +627,40 @@
     if (!perms || perms['core.pin.move'] !== true) return;
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
-      if (!res || res.status !== 200 || !res.data || !res.data.update) return;
-      renderCoreUpdateBanner(res.data.update);
+      if (!res || res.status !== 200 || !res.data) return;
+      var handoff = hubHandoff(res.data.deploy_url);
+      if (handoff) pointDeployAtHub(handoff);
+      if (res.data.update) renderCoreUpdateBanner(res.data.update, handoff);
     }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
   }
 
+  // task 1004174 (ADR 0339) — where a HOSTED project's owner takes the upgrade: the
+  // hub's own deploy door scoped to this project, which the server names as
+  // `deploy_url` when this project is federated with a hub. Only where this hall has no
+  // door of its own: on the platform the local /deploy is the door, and a link away
+  // from it would be a second road to the same button. An address that is not a plain
+  // http(s) URL is ignored rather than trusted into an href.
+  function hubHandoff(url) {
+    if (moduleOn('provisioning')) return null;
+    if (typeof url !== 'string' || !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return null;
+    return url;
+  }
+
+  // The rail's Deploy item is hidden on a hosted project (its module gate); this gives
+  // it back, aimed at the hub. Its rank gate still applies, exactly as on the platform.
+  function pointDeployAtHub(url) {
+    var item = document.getElementById('nav-deploy');
+    if (!item) return;
+    item.setAttribute('href', url);
+    if (item.dataset) delete item.dataset.module;
+    item.hidden = !gateAllows(item.dataset && item.dataset.gate);
+  }
+
   // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
   // is current AND when the registry could not be read; `reading` separates them,
   // and neither renders. A banner is a claim about being out of date, and a wrong
   // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update) {
+  function renderCoreUpdateBanner(update, handoff) {
     if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
     // A dismissal is remembered PER VERSION, not forever: the next release is new
     // news and must re-announce itself, or the surface is dead after one click.
@@ -659,8 +688,10 @@
     // happen": nothing had, and nothing had been asked for. The control is on that page
     // already, so on it the banner informs and points, and does not pretend to act.
     var onDeploy = window.location && String(window.location.pathname || '').replace(/\/+$/, '') === '/deploy';
+    // A hosted project has no door of its own; it hands its owner to the hub's door for
+    // this project when the server named one (task 1004174), and otherwise only informs.
     var action = !moduleOn('provisioning')
-      ? ''
+      ? (handoff ? '<a class="core-update-notice__action" href="' + esc(handoff) + '">Upgrade</a>' : '')
       : (onDeploy
         ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
         : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>');

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->