@bongos/core 1.19.1035 → 1.19.1037

package/modules/grading/grader.js

@@ -75,23 +75,28 @@
 //   module (which receives it via dependency injection to avoid a circular
 //   require).
 //
-// ## Legacy v1 (still exported)
+// ## Retired (task 1002842)
 //
-//   gradeDeterministic(...) — v1 deterministic path, kept for
-//   scripts/gds/audit-ships.js (retroactive audit). NOT invoked at ship time.
+//   The v1 deterministic process-audit grader (gradeDeterministic and its nine
+//   per-criterion scorers) and its one caller, scripts/gds/audit-ships.js, are
+//   deleted: the live panel grades every ship at ship time, so a retroactive
+//   heuristic audit has nothing left to cover. aggregateShots / runOneShot moved
+//   to grader-no-artifact.js, the species that depends on them; they are still
+//   re-exported here, and the trivial-diff fast path below still runs one shot.
 
 const path = require('node:path');
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 
-const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, DEFAULT_SHOTS, FALLTHROUGH_CONFIDENCE, RUBRIC, THRESHOLD, V1, V3, VERSION, generatedProvenance, permissionPathPrePass, routeRankPrePass, workers } = require('./grader-config.js');
+const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, FALLTHROUGH_CONFIDENCE, RUBRIC, THRESHOLD, VERSION, generatedProvenance, permissionPathPrePass, routeRankPrePass, workers } = require('./grader-config.js');
 const { clamp, isTrivialDiff, median, r1, selectGraderModel, workerModelFor } = require('./grader-model.js');
 const { buildPrompt, extractJson } = require('./grader-prompt.js');
 // task 1004011: the second grade species — a grade over the CLAIM on an
 // --allow-empty ship, where there is no diff for the panel above to read.
-const { GRADER_KIND: NO_ARTIFACT_GRADER_KIND, buildNoArtifactPrompt, gradeNoArtifact } = require('./grader-no-artifact.js');
-const { aggregateShots, changeMagnitude, hasPanelEvidence, isSubstantiveIssue, serverSideGuards, validateAndScore } = require('./grader-score.js');
-const { buildContextBundle, diffAddedLinesByFile, extractAssistantResult, extractCostUsd, runOneShot, runSubagent, runSubagentCached } = require('./grader-subagent.js');
+// task 1002842: the generalist-shot plumbing now lives there too.
+const { GRADER_KIND: NO_ARTIFACT_GRADER_KIND, aggregateShots, buildNoArtifactPrompt, gradeNoArtifact, runOneShot } = require('./grader-no-artifact.js');
+const { changeMagnitude, hasPanelEvidence, isSubstantiveIssue, serverSideGuards, validateAndScore } = require('./grader-score.js');
+const { buildContextBundle, diffAddedLinesByFile, extractAssistantResult, extractCostUsd, runSubagent, runSubagentCached } = require('./grader-subagent.js');
 // task 1002903: the severity gate's unbacked low scores, named once for the record.
 const { unbackedLowScores } = require('./grader-workers/worker-verdict.js');
 // task 1002839: the central engine the code panel below registers into (ADR 0089 §1).
@@ -478,8 +483,8 @@ function aggregatePanel(workerResults, meta = {}) {
     grader_version: VERSION,
     // #486: the panel's own API spend (USD), for cost_log (source=grader).
     panel_cost_usd: panelCostUsd,
-    // rubric_scores keep the v3 keys so the trend dashboard + audit-ships
-    // legacy v1 entry-points continue to read them. Phase 2.1 added
+    // rubric_scores keep the v3 keys so the trend dashboard and the server's
+    // validateAndScore re-validation continue to read them. Phase 2.1 added
     // security_score; Phase 2.2 adds efficiency_score. Both additive —
     // consumers that don't know about them just ignore the fields.
     rubric_scores: {
@@ -651,12 +656,17 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
   });
 }
 
-// ---------- v3 multi-shot path (kept exported for explicit diagnostics) ----------
+// ---------- the trivial-diff fast path (#513) ----------
 //
-// Same shape as the original v3 gradeSubagent; renamed so the public name
-// (gradeSubagent) points at the v4 panel. Useful for re-running a single
-// generalist prompt N times for diagnostic comparison against the panel.
-async function gradeSubagentV3MultiShot({ task, valueSummary, diff, changedFiles, diffStats, shots = DEFAULT_SHOTS, builderModel, runOpts = {} }) {
+// A small copy/docs-only diff gets ONE generalist shot instead of the four-worker
+// panel — "lighter, not skipped" (ADR 0089 §7 keeps it). The name is historical:
+// the v3 multi-shot GENERATION is retired (task 1002842 removed its 3-shot default
+// and rubric block), and this is what is left of it — the working fast path.
+// Moving it onto a v4 panel needs a reviewer type that reports both
+// functional_fidelity and code_quality, which no v4 worker does; that is a cost
+// and behaviour decision, not a cleanup. `runShot` is a test seam defaulted to
+// the real spawner (the same pattern as gradeNoArtifact); production passes none.
+async function gradeSubagentV3MultiShot({ task, valueSummary, diff, changedFiles, diffStats, shots = 1, builderModel, runOpts = {}, runShot = runOneShot }) {
   const prompt = buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, generatedProvenance: await generatedProvenance.verifyGeneratedProvenanceAsync({ changedFiles, cwd: runOpts.cwd }) }); // task 1002795
   const graderModel = selectGraderModel({ builderModel });
   const N = Math.max(1, Math.trunc(shots));
@@ -664,7 +674,7 @@ async function gradeSubagentV3MultiShot({ task, valueSummary, diff, changedFiles
   const startedAt = Date.now();
   const shotPromises = [];
   for (let i = 0; i < N; i++) {
-    shotPromises.push(runOneShot({ prompt, model: graderModel, shotIndex: i, runOpts }));
+    shotPromises.push(runShot({ prompt, model: graderModel, shotIndex: i, runOpts }));
   }
   const shotResults = await Promise.all(shotPromises);
   const totalMs = Date.now() - startedAt;
@@ -676,189 +686,6 @@ async function gradeSubagentV3MultiShot({ task, valueSummary, diff, changedFiles
   });
 }
 
-// =========================================================================
-// Legacy v1 (deterministic) — kept for scripts/gds/audit-ships.js only.
-// =========================================================================
-
-function scoreEstActualBand(actualMinutes, estMinutes) {
-  if (!Number.isFinite(actualMinutes) || actualMinutes <= 0) return 5;
-  if (!Number.isFinite(estMinutes) || estMinutes <= 0) return 6;
-  const ratio = actualMinutes / estMinutes;
-  if (ratio >= 0.5 && ratio <= 2.0) return 10;
-  if (ratio < 0.5) {
-    if (ratio <= 0.1) return 0;
-    return r1(10 * ((ratio - 0.1) / 0.4));
-  }
-  if (ratio > 2.0) {
-    if (ratio >= 10) return 0;
-    return r1(10 * (1 - (ratio - 2.0) / 8.0));
-  }
-  return 5;
-}
-
-function scoreValueSummary(valueSummary) {
-  const s = (valueSummary || '').trim();
-  if (s.length === 0) return 0;
-  if (s.length < 40) return 5;
-  if (s.length < 120) return 8;
-  return /\b(add|fix|update|remove|refactor|wire|land|migrate|enable|disable|introduce|deprecate|ship|deploy|prevent|capture|gate|allocate|carry|expose|surface)\b/i.test(s)
-    ? 10
-    : 8;
-}
-
-function scoreDiffHygiene(diffStats) {
-  if (!diffStats) return 5;
-  const files = Number(diffStats.files_changed) || 0;
-  const added = Number(diffStats.lines_added) || 0;
-  const removed = Number(diffStats.lines_removed) || 0;
-  if (files === 0 || added + removed === 0) return 0;
-  if (files > 50) return 5;
-  return 10;
-}
-
-function scoreScannerSmoke(verification) {
-  if (!verification) return 5;
-  return verification.scanner_clean && verification.smoke_clean ? 10 : 5;
-}
-
-function scoreScopingSignal(scopingConfidence) {
-  if (scopingConfidence == null) return 6;
-  const c = Number(scopingConfidence);
-  if (c <= 0) return 2;
-  if (c === 1) return 4;
-  if (c === 2) return 6;
-  if (c === 3) return 7;
-  if (c === 4) return 8;
-  return 10;
-}
-
-function scoreLocNetNegative(diffStats) {
-  if (!diffStats) return 5;
-  const added = Number(diffStats.lines_added) || 0;
-  const removed = Number(diffStats.lines_removed) || 0;
-  if (removed > added) return 10;
-  if (removed === added) return 5;
-  return 0;
-}
-
-function scoreLearningRow(learningRow) {
-  if (!learningRow) return 0;
-  const body = (learningRow.body_md || '').trim();
-  if (body.length > 100) return 10;
-  if (body.length > 0) return 5;
-  return 0;
-}
-
-function scoreArtRubricAvg(value) {
-  if (!Number.isFinite(value)) return null;
-  return clamp(r1(value), 0, 10);
-}
-
-function blendWeightsForKind(kind) {
-  const blended = {};
-  for (const [name, def] of Object.entries(V1.weights.common)) {
-    blended[name] = def.weight;
-  }
-  const kindBonus = V1.weights.kind_specific[kind];
-  if (kindBonus) {
-    for (const [name, def] of Object.entries(kindBonus)) {
-      if (name === 'loc_net_negative' && 'diff_hygiene' in blended) delete blended.diff_hygiene;
-      if (name === 'learning_row' && 'diff_hygiene' in blended) delete blended.diff_hygiene;
-      blended[name] = def.weight;
-    }
-  }
-  const total = Object.values(blended).reduce((a, b) => a + b, 0);
-  for (const k of Object.keys(blended)) blended[k] = blended[k] / total;
-  return blended;
-}
-
-// Legacy v1 entry. Renamed from `grade()` in V3.R18 (#209). Now ONLY
-// called from scripts/gds/audit-ships.js (retroactive #204 audit). The
-// runtime ship path uses gradeSubagent (v3 multi-shot).
-function gradeDeterministic({ task, verification, actualMinutes, valueSummary, learningRow }) {
-  const kind = task?.kind || 'unclassified';
-  const weights = blendWeightsForKind(kind);
-  const rubricScores = {};
-  const signals = {
-    kind,
-    est_minutes: task?.est_minutes ?? null,
-    actual_minutes: actualMinutes ?? null,
-    scoping_confidence: task?.scoping_confidence ?? null,
-    scanner_clean: verification?.scanner_clean ?? null,
-    smoke_clean: verification?.smoke_clean ?? null,
-    diff_stats: verification?.diff_stats ?? null,
-    art_rubric_avg: verification?.art_rubric_avg ?? null,
-    value_summary_chars: (valueSummary || '').trim().length,
-  };
-
-  if ('est_actual_band' in weights) {
-    rubricScores.est_actual_band = scoreEstActualBand(actualMinutes, task?.est_minutes);
-  }
-  if ('value_summary' in weights) {
-    rubricScores.value_summary = scoreValueSummary(valueSummary);
-  }
-  if ('diff_hygiene' in weights) {
-    rubricScores.diff_hygiene = scoreDiffHygiene(verification?.diff_stats);
-  }
-  if ('scanner_smoke' in weights) {
-    rubricScores.scanner_smoke = scoreScannerSmoke(verification);
-  }
-  if ('scoping_signal' in weights) {
-    rubricScores.scoping_signal = scoreScopingSignal(task?.scoping_confidence);
-  }
-  if ('loc_net_negative' in weights) {
-    rubricScores.loc_net_negative = scoreLocNetNegative(verification?.diff_stats);
-  }
-  if ('learning_row' in weights) {
-    rubricScores.learning_row = scoreLearningRow(learningRow);
-  }
-  if ('art_rubric_avg' in weights) {
-    const s = scoreArtRubricAvg(verification?.art_rubric_avg);
-    if (s == null) {
-      const w = weights.art_rubric_avg;
-      delete weights.art_rubric_avg;
-      const remaining = Object.values(weights).reduce((a, b) => a + b, 0);
-      if (remaining > 0) {
-        for (const k of Object.keys(weights)) weights[k] = weights[k] / remaining;
-      }
-    } else {
-      rubricScores.art_rubric_avg = s;
-    }
-  }
-
-  let score = 0;
-  for (const [name, w] of Object.entries(weights)) {
-    if (rubricScores[name] != null) score += rubricScores[name] * w;
-  }
-  score = r1(clamp(score, 0, 10));
-
-  const threshold = V1.threshold;
-  const passed = score >= threshold;
-
-  const lines = [];
-  lines.push(`Auto-grader ${V1.version} (deprecated) — task_kind=${kind}.`);
-  lines.push(`Score ${score}/10 vs threshold ${threshold} → ${passed ? 'PASS' : 'FAIL'}.`);
-  lines.push('');
-  lines.push('Per-criterion:');
-  for (const [name, w] of Object.entries(weights)) {
-    const s = rubricScores[name];
-    if (s == null) continue;
-    const contrib = r1(s * w);
-    lines.push(`  - ${name.padEnd(20)} ${String(s).padStart(4)}/10  × ${w.toFixed(2)} = ${contrib}`);
-  }
-
-  return {
-    score,
-    passed,
-    threshold,
-    grader_kind: 'auto',
-    grader_version: V1.version,
-    rubric_scores: rubricScores,
-    signals,
-    notes_md: lines.join('\n'),
-  };
-}
-
 module.exports = {
   // v4 surface (active panel-based gate)
   aggregatePanel,
@@ -888,25 +715,13 @@ module.exports = {
   runSubagent,
   runSubagentCached,              // System 5 (task 1359): opt-in content-addressed cached path
   runOneShot,
-  gradeSubagentV3MultiShot,       // explicit v3 multi-shot diagnostic path
+  gradeSubagentV3MultiShot,       // the trivial-diff fast path (#513) — one generalist shot
   extractJson,
   extractAssistantResult,
   extractCostUsd,                 // #486: parse total_cost_usd from the envelope
   THRESHOLD,
   VERSION,
   DEFAULT_GRADER_MODEL,
-  DEFAULT_SHOTS,
   ASSUMED_BUILDER_MODEL,
-  // legacy v1 (audit-ships.js only)
-  gradeDeterministic,
-  scoreEstActualBand,
-  scoreValueSummary,
-  scoreDiffHygiene,
-  scoreScannerSmoke,
-  scoreScopingSignal,
-  scoreLocNetNegative,
-  scoreLearningRow,
-  scoreArtRubricAvg,
-  blendWeightsForKind,
   RUBRIC,
 };

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goals.html

@@ -235,7 +235,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b" defer></script>
+<script src="/builders/shell.js?v=2026-09-26-own1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -66,7 +66,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -344,7 +344,12 @@
       // The deploy door (task 1003159, ADR 0293). Gated 'archon' here to mirror the
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
-      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon' },
+      //
+      // THE DOOR IS THE PROVISIONING MODULE'S, and a hosted project does not run it, so
+      // there this link opened a page with nothing behind it (task 1004174). It is
+      // dropped where the module is off, and re-pointed at the hub's own door for THIS
+      // project once /core-update names one (pointDeployAtHub, ADR 0339).
+      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
       // Deploy precedent above); dropped where the provisioning module is not enabled.
@@ -622,16 +627,40 @@
     if (!perms || perms['core.pin.move'] !== true) return;
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
-      if (!res || res.status !== 200 || !res.data || !res.data.update) return;
-      renderCoreUpdateBanner(res.data.update);
+      if (!res || res.status !== 200 || !res.data) return;
+      var handoff = hubHandoff(res.data.deploy_url);
+      if (handoff) pointDeployAtHub(handoff);
+      if (res.data.update) renderCoreUpdateBanner(res.data.update, handoff);
     }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
   }
 
+  // task 1004174 (ADR 0339) — where a HOSTED project's owner takes the upgrade: the
+  // hub's own deploy door scoped to this project, which the server names as
+  // `deploy_url` when this project is federated with a hub. Only where this hall has no
+  // door of its own: on the platform the local /deploy is the door, and a link away
+  // from it would be a second road to the same button. An address that is not a plain
+  // http(s) URL is ignored rather than trusted into an href.
+  function hubHandoff(url) {
+    if (moduleOn('provisioning')) return null;
+    if (typeof url !== 'string' || !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return null;
+    return url;
+  }
+
+  // The rail's Deploy item is hidden on a hosted project (its module gate); this gives
+  // it back, aimed at the hub. Its rank gate still applies, exactly as on the platform.
+  function pointDeployAtHub(url) {
+    var item = document.getElementById('nav-deploy');
+    if (!item) return;
+    item.setAttribute('href', url);
+    if (item.dataset) delete item.dataset.module;
+    item.hidden = !gateAllows(item.dataset && item.dataset.gate);
+  }
+
   // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
   // is current AND when the registry could not be read; `reading` separates them,
   // and neither renders. A banner is a claim about being out of date, and a wrong
   // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update) {
+  function renderCoreUpdateBanner(update, handoff) {
     if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
     // A dismissal is remembered PER VERSION, not forever: the next release is new
     // news and must re-announce itself, or the surface is dead after one click.
@@ -659,8 +688,10 @@
     // happen": nothing had, and nothing had been asked for. The control is on that page
     // already, so on it the banner informs and points, and does not pretend to act.
     var onDeploy = window.location && String(window.location.pathname || '').replace(/\/+$/, '') === '/deploy';
+    // A hosted project has no door of its own; it hands its owner to the hub's door for
+    // this project when the server named one (task 1004174), and otherwise only informs.
     var action = !moduleOn('provisioning')
-      ? ''
+      ? (handoff ? '<a class="core-update-notice__action" href="' + esc(handoff) + '">Upgrade</a>' : '')
       : (onDeploy
         ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
         : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>');