@bongos/core 1.19.1040 → 1.19.1042

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goals.html

@@ -235,7 +235,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-26-own1" defer></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/palette.js

@@ -62,6 +62,7 @@
       { label: 'Extensions', href: '/settings#extensions' },
       { label: 'Preferences', href: '/settings#preferences' },
       { label: 'Sound', href: '/settings#sound' },
+      { label: 'Software update', href: '/settings#update' },
     ] },
   ];
 

package/modules/hall-ui/public/people.html

@@ -66,7 +66,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings-software-update.js

@@ -0,0 +1,194 @@
+// modules/hall-ui/public/settings-software-update.js — Settings → Software update
+// (task 1004296).
+//
+// The owner, 2026-09-25: "each builders hall settings has a version description where they
+// can pull the latest release. Just like iOS does." So this panel says three things and
+// offers one: the version this project runs; either "up to date" or the newest release its
+// update channel lets it take; what each version in between brings — and, for the people
+// the upgrade door lets through, an Update button.
+//
+// THE BUTTON LEADS TO THE DOOR; IT IS NOT THE DOOR. Taking an update is the deploy door's
+// two steps (see exactly what moves, then confirm that version) with its health check and
+// auto-rollback (ADR 0293), and on a hosted project that door is on the hub (ADR 0339 D3).
+// A second copy of that flow here would be a second place for its safety rules to drift, so
+// the server names where this project's door is (`door`) and the button goes there.
+//
+// THE PAGE KNOWS NOTHING (deploy.js's rule, kept). Every version here is the server's reading
+// with the time it was taken. "Up to date" is drawn only from an ok reading with nothing
+// offered; a reading that failed says so, and release notes that could not be read are
+// reported as unread, never drawn as a version with no changes.
+//
+// READ WHEN ITS GROUP OPENS, not with the page: an update's notes come out of the newer
+// package's download (src/bongos/package-registry.js), and most visits to Settings are for
+// something else. settings.js announces each group switch as a `settings:group` event.
+//
+// Its own file, like the sessions and interaction panels: settings.js is against the
+// 1500-line ratchet, and this panel shares nothing with it but the toolkit globals.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const GROUP = 'update';
+  const { escapeHtml } = window.OTB;
+  const byId = (id) => document.getElementById(id);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  // Versions drawn open before "Show every version": enough to read the recent work
+  // without a project that is a hundred versions behind burying the button.
+  const VERSIONS_OPEN = 5;
+
+  let asked = false;
+
+  function ago(iso) {
+    const then = iso ? new Date(iso).getTime() : NaN;
+    if (!Number.isFinite(then)) return null;
+    const mins = Math.max(0, Math.round((Date.now() - then) / 60000));
+    if (mins < 1) return 'just now';
+    if (mins < 60) return `${mins} minute${mins === 1 ? '' : 's'} ago`;
+    const hours = Math.round(mins / 60);
+    if (hours < 48) return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    const days = Math.round(hours / 24);
+    return `${days} day${days === 1 ? '' : 's'} ago`;
+  }
+
+  const mono = (v) => `<span class="su-ver">${escapeHtml(String(v))}</span>`;
+  // Voice rule V4 (docs/voice.md): a dash is banned in QUOTED data — and a release-note line
+  // is a task's ship summary, handed over by the ledger — so it becomes a comma at render,
+  // the way goal-inbox.js and the public feed's cleanTitle() do. Never by editing the data.
+  const unDash = (raw) => String(raw == null ? '' : raw).replace(/\s*[—–]\s*/g, ', ').replace(/,\s*,/g, ',').trim();
+
+  function row(label, desc, ctl) {
+    return `<div class="prow">
+      <div class="prow__main"><span class="prow__label">${label}</span>${desc ? `<span class="prow__desc">${desc}</span>` : ''}</div>
+      ${ctl ? `<div class="prow__ctl">${ctl}</div>` : ''}
+    </div>`;
+  }
+
+  // Where the Update button goes, and what it says it will do. Only a plain same-origin path
+  // or an http(s) URL is ever put in an href; anything else draws no button.
+  function doorHtml(data, offered) {
+    const door = data.door || {};
+    if (!data.can_update) {
+      return '<p class="panel-hint su-door">Only the people allowed to upgrade this project see an Update button here.</p>';
+    }
+    if (door.kind === 'cli') {
+      return '<p class="panel-hint su-door">This project is upgraded on the server that runs it: <code>bongos upgrade</code> there takes this version, with the same health check and rollback.</p>';
+    }
+    const url = String(door.url || '');
+    const sameOrigin = /^\/[a-z0-9/_-]*$/i.test(url);
+    if (!sameOrigin && !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return '';
+    let where = '';
+    if (!sameOrigin) {
+      try { where = ` on ${new URL(url).host}`; } catch (e) { return ''; }
+    }
+    return `<div class="row-end su-door">
+      <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}${sameOrigin ? '' : ' ↗'}</a>
+      <span class="panel-hint">Opens this project's upgrade${escapeHtml(where)}: you see what would move, confirm it, and it installs, checks itself, and rolls back if the project does not come back healthy.</span>
+    </div>`;
+  }
+
+  // One entry: its text, and — only in the hall whose ledger the ids belong to, which is
+  // the one that runs the door itself — a link to that task.
+  function entryHtml(e, linkTasks) {
+    const text = escapeHtml(unDash(e.text));
+    return linkTasks && e.id ? `<li><a href="/task/${escapeHtml(e.id)}">${text}</a></li>` : `<li>${text}</li>`;
+  }
+
+  function versionHtml(v, linkTasks, notesRead) {
+    const when = ago(v.published_at);
+    let body;
+    if (!notesRead) body = '<p class="prow__desc">Its notes could not be read.</p>';
+    else if (v.entries === null) body = '<p class="prow__desc">No notes were packed for this version.</p>';
+    else if (!v.entries.length) body = '<p class="prow__desc">No changes are listed for this version.</p>';
+    else body = `<ul class="su-entries">${v.entries.map((e) => entryHtml(e, linkTasks)).join('')}</ul>`;
+    return `<li class="su-version">
+      <span class="prow__label">${mono(v.version)}${when ? `<span class="prow__tag">published ${escapeHtml(when)}</span>` : ''}</span>
+      ${body}
+    </li>`;
+  }
+
+  function whatsNewHtml(w, linkTasks) {
+    if (!w) return '';
+    const n = w.count;
+    const head = `<h3 class="su-h" id="su-new-h">What's new in ${n === 1 ? 'this version' : `these ${escapeHtml(String(n))} versions`}</h3>`;
+    const warn = w.ok ? '' : `<p class="panel-status panel-status--danger" role="status">The release notes could not be read: ${escapeHtml(w.error || 'unknown error')}. The versions are still listed.</p>`;
+    const items = w.versions.map((v, i) => versionHtml(v, linkTasks, w.ok).replace('<li class="su-version">',
+      i < VERSIONS_OPEN ? '<li class="su-version">' : '<li class="su-version" hidden>'));
+    const hiddenCount = Math.max(0, w.versions.length - VERSIONS_OPEN);
+    const more = hiddenCount ? `<button type="button" class="pbtn pbtn--quiet" id="su-more">Show ${escapeHtml(String(hiddenCount))} more version${hiddenCount === 1 ? '' : 's'}</button>` : '';
+    const beyond = w.more ? `<p class="panel-hint">…and ${escapeHtml(String(w.more))} older version${w.more === 1 ? '' : 's'}, also in this update.</p>` : '';
+    return `${head}${warn}<ol class="su-versions" aria-labelledby="su-new-h">${items.join('')}</ol>${more ? `<div class="row-end">${more}</div>` : ''}${beyond}`;
+  }
+
+  function render(data) {
+    const body = byId('su-body');
+    const note = byId('su-note');
+    if (!body) return;
+    const u = (data && data.update) || {};
+    const checked = ago(u.checked_at);
+    const notes = [];
+    if (checked) notes.push(`Checked ${checked}.`);
+
+    if (u.reading !== 'ok') {
+      body.innerHTML = row('This project runs', u.running ? mono(u.running) : 'a version it could not name')
+        + `<p class="panel-status panel-status--danger" role="status">Could not check for a newer version: ${escapeHtml(u.error || 'no answer')}.</p>`;
+      if (note) note.textContent = notes.join(' ');
+      return;
+    }
+
+    let html = row('This project runs', mono(u.running));
+    if (!u.offered) {
+      html += row('Newest for this project', `${mono(u.running)} — this project is up to date.`, '<span class="su-pill su-pill--ok">Up to date</span>');
+    } else {
+      const when = ago(u.offered_published_at);
+      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, '<span class="su-pill">Update ready</span>');
+      html += doorHtml(data, u.offered);
+      html += whatsNewHtml(u.whats_new, (data.door || {}).kind === 'local');
+    }
+    // A newer line this project's channel does not take is a fact worth one sentence — it
+    // explains why the newest number on the registry is not the one offered.
+    if (u.newest && u.newest !== (u.offered || u.running) && String(u.newest).split('.')[1] !== String(u.running).split('.')[1]) {
+      notes.push(`${u.newest} is also published; it starts a new line, and this project takes updates within ${String(u.running).split('.').slice(0, 2).join('.')} on its own.`);
+    }
+    body.innerHTML = html;
+    if (note) note.textContent = notes.join(' ');
+
+    const more = byId('su-more');
+    if (more) {
+      more.addEventListener('click', () => {
+        for (const li of body.querySelectorAll('.su-version[hidden]')) li.hidden = false;
+        more.parentNode.remove();
+      });
+    }
+  }
+
+  async function load() {
+    if (asked) return;
+    asked = true;
+    const body = byId('su-body');
+    if (body) body.innerHTML = '<p class="panel-hint">Checking for a newer version…</p>';
+    try {
+      const res = await api.request('GET', `${API}/software-update`);
+      if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+      if (!res.ok || !res.data) throw new Error((res.data && res.data.error && res.data.error.message) || `HTTP ${res.status}`);
+      render(res.data);
+    } catch (err) {
+      // Its own failure, like every section here: this panel says it could not check, and
+      // the rest of Settings is untouched. Asking again is allowed.
+      asked = false;
+      if (body) body.innerHTML = `<p class="panel-status panel-status--danger" role="status">Could not check for updates: ${escapeHtml(err.message || 'unknown error')}.</p>`;
+    }
+  }
+
+  function boot() {
+    const section = byId('software-update-scroll');
+    if (!section) return;
+    section.hidden = false;
+    const groups = byId('settings-groups');
+    if (groups && groups.dataset && groups.dataset.active === GROUP) load();
+    document.addEventListener('settings:group', (e) => { if (e && e.detail && e.detail.group === GROUP) load(); });
+  }
+
+  boot();
+})();

package/modules/hall-ui/public/settings.css

@@ -26,6 +26,7 @@
 .settings-groups[data-active="access"] > [data-group="access"],
 .settings-groups[data-active="preferences"] > [data-group="preferences"],
 .settings-groups[data-active="sound"] > [data-group="sound"],
+.settings-groups[data-active="update"] > [data-group="update"],
 .settings-groups[data-active="extensions"] > [data-group="extensions"] { display: block; }
 .settings-groups > [data-group][hidden] { display: none !important; }
 .settings-groups .scroll { margin: 0 0 var(--sp-sm); }
@@ -212,3 +213,41 @@ select.voices__select { min-width: 140px; }
   font-family: inherit;
   opacity: 0.92;
 }
+
+/* ---- Software update (task 1004296) -------------------------------------- */
+/* A version is read digit by digit and compared against another, so it takes the mono
+   face. The state pill borrows project-settings' shape: a word in its own colour with a
+   hairline of the same, so "up to date" and "update ready" differ by more than hue. */
+.su-ver { font-family: var(--font-mono); font-size: 13.5px; color: var(--ink); }
+.su-pill {
+  display: inline-block;
+  padding: 1px 8px;
+  border: var(--line) solid currentColor;
+  border-radius: var(--radius-pill);
+  font-size: 11.5px;
+  font-weight: 600;
+  white-space: nowrap;
+  color: var(--accent-ink);
+}
+.su-pill--ok { color: var(--ok); }
+.su-door { margin-top: var(--sp-sm); }
+.su-door .panel-hint { flex: 1 1 18rem; min-width: 0; }
+.su-h { margin: var(--sp-md) 0 0; font-size: 14.5px; font-weight: 600; color: var(--ink); }
+.su-versions { list-style: none; margin: var(--sp-xs) 0 0; padding: 0; }
+.su-version { padding: var(--sp-sm) 0; border-top: var(--line) solid var(--rule-soft); }
+.su-version > .prow__label { display: flex; flex-wrap: wrap; align-items: baseline; gap: 4px; }
+.su-entries { margin: var(--sp-hair) 0 0; padding-left: 1.15rem; max-width: var(--measure); font-size: 13.5px; color: var(--ink-soft); }
+.su-entries li + li { margin-top: 2px; }
+/* a task title is a link, and a link owes the 24px floor. Block, so a two-line note keeps
+   its bullet on its first line; the soft ink with an underline, because on the platform
+   every note is a link and a list of accent-coloured sentences reads as a warning. */
+.su-entries a {
+  display: block;
+  min-height: 24px;
+  padding: 2px 0;
+  color: var(--ink-soft);
+  text-decoration: underline;
+  text-decoration-color: color-mix(in srgb, var(--ink-soft) 45%, transparent);
+  text-underline-offset: 3px;
+}
+.su-entries a:hover { color: var(--ink); text-decoration-color: currentColor; }

package/modules/hall-ui/public/settings.html

@@ -395,6 +395,26 @@
               <p class="section-note">Changes save at once. Your new choice plays the next time that event fires.</p>
             </section>
 
+            <!-- ============ group: update ============ -->
+
+            <!-- SOFTWARE UPDATE — this project's version, the newest release its update
+                 channel allows, and what the versions between them carry (task 1004296).
+                 Like a phone's Software Update screen: every builder reads it; the Update
+                 button is drawn only for those the upgrade door lets through, and it LEADS
+                 to that door (the two-step confirm and auto-rollback of ADR 0293) — the
+                 act never happens on this page. Rendered by settings-software-update.js
+                 from GET /api/bongos/software-update, read only when this group opens:
+                 an update's notes come out of a package download. -->
+            <section class="scroll" id="software-update-scroll" aria-labelledby="software-update-h" data-group="update" hidden>
+              <h2 id="software-update-h" class="scroll__h">Software update</h2>
+              <p class="scroll__lede">
+                Which version of Cloud Bongos this project runs, whether a newer one is
+                ready for it, and what each newer version brings.
+              </p>
+              <div id="su-body" aria-live="polite"></div>
+              <p class="section-note" id="su-note"></p>
+            </section>
+
             <!-- ============ group: extensions ============ -->
 
             <!-- Module-contributed panels (BV1.R42, ADR 0083). settings.js appends a
@@ -416,7 +436,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->
@@ -426,7 +446,7 @@
 <!-- shared record overlay (#/idea|blocker/N) — every hall page carries it; this
      page was the one gap (task 2172). -->
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
-<script src="/builders/settings.js?v=2026-09-02-panel"></script>
+<script src="/builders/settings.js?v=2026-09-26-update"></script>
 <!-- task 1003341: the Active sessions panel. Its own file rather than more of
      settings.js, which sits close to the 1500-line size ratchet. -->
 <script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
@@ -439,5 +459,7 @@
      the panel grew from one switch to a rung picker with a derived default, and
      settings.js is against the 1500-line ratchet. -->
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
+<!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
+<script src="/builders/settings-software-update.js?v=2026-09-26-update"></script>
 </body>
 </html>

package/modules/hall-ui/public/settings.js

@@ -1207,6 +1207,8 @@
     ...(window.OTB.moduleOn('dev-box') ? [{ id: 'devbox', label: 'Dev box' }] : []),
     { id: 'preferences', label: 'Preferences' },
     { id: 'sound', label: 'Sound' },
+    // task 1004296 — every project's version and its update; settings-software-update.js.
+    { id: 'update', label: 'Software update' },
   ];
   const RAIL_GROUPS = RAIL_ITEMS.map((i) => i.id).concat('extensions');
   let rail = null;
@@ -1230,6 +1232,7 @@
     'voices': 'voices-scroll',
     'sounds': 'sounds-scroll',
     'event-sounds': 'event-sounds-scroll',
+    'software-update': 'software-update-scroll',
   };
 
   function activateGroup(group, opts) {
@@ -1238,6 +1241,8 @@
     if (!groups) return;
     groups.dataset.active = group;
     rail?.activate(group);
+    // A panel whose read is expensive loads when its group opens, not with the page.
+    if (typeof CustomEvent === 'function') document.dispatchEvent(new CustomEvent('settings:group', { detail: { group } }));
     if (!opts || opts.scroll !== false) window.scrollTo({ top: 0 });
   }
 

package/modules/hall-ui/public/settings.states.json

@@ -10,7 +10,8 @@
     "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips", "#privacy-rows"] } },
     "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },
     "preferences": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900]], "expect": { "visible": ["#wander-rows", "#render-rows"] } },
-    "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } }
+    "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } },
+    "update": { "auth": true, "url": "/settings#software-update", "actions": [["wait", 1200]], "expect": { "visible": ["#software-update-h", "#su-body", "#su-update", ".su-versions"] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 900]] }
 }

package/modules/hall-ui/public/shell.js

@@ -347,8 +347,9 @@
       //
       // THE DOOR IS THE PROVISIONING MODULE'S, and a hosted project does not run it, so
       // there this link opened a page with nothing behind it (task 1004174). It is
-      // dropped where the module is off, and re-pointed at the hub's own door for THIS
-      // project once /core-update names one (pointDeployAtHub, ADR 0339).
+      // dropped where the module is off — and since task 1004296 it STAYS dropped: /deploy
+      // is the platform hall's page alone, and every other hall takes its update from
+      // Settings → Software update, whose Update button carries the hub hand-off.
       { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
@@ -628,39 +629,22 @@
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
       if (!res || res.status !== 200 || !res.data) return;
-      var handoff = hubHandoff(res.data.deploy_url);
-      if (handoff) pointDeployAtHub(handoff);
-      if (res.data.update) renderCoreUpdateBanner(res.data.update, handoff);
+      if (res.data.update) renderCoreUpdateBanner(res.data.update);
     }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
   }
 
-  // task 1004174 (ADR 0339) — where a HOSTED project's owner takes the upgrade: the
-  // hub's own deploy door scoped to this project, which the server names as
-  // `deploy_url` when this project is federated with a hub. Only where this hall has no
-  // door of its own: on the platform the local /deploy is the door, and a link away
-  // from it would be a second road to the same button. An address that is not a plain
-  // http(s) URL is ignored rather than trusted into an href.
-  function hubHandoff(url) {
-    if (moduleOn('provisioning')) return null;
-    if (typeof url !== 'string' || !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return null;
-    return url;
-  }
-
-  // The rail's Deploy item is hidden on a hosted project (its module gate); this gives
-  // it back, aimed at the hub. Its rank gate still applies, exactly as on the platform.
-  function pointDeployAtHub(url) {
-    var item = document.getElementById('nav-deploy');
-    if (!item) return;
-    item.setAttribute('href', url);
-    if (item.dataset) delete item.dataset.module;
-    item.hidden = !gateAllows(item.dataset && item.dataset.gate);
-  }
+  // Where the banner's Upgrade goes (task 1004296). The platform's hall runs the deploy
+  // door itself, so there it is /deploy. Every other hall — a hosted project, a
+  // self-hosted instance — takes its update from Settings → Software update, which says
+  // what the update carries and, on a hosted project, hands the owner to the hub's door
+  // for this project (ADR 0339 D3). The banner no longer links off-site itself.
+  var SOFTWARE_UPDATE_HREF = '/settings#software-update';
 
   // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
   // is current AND when the registry could not be read; `reading` separates them,
   // and neither renders. A banner is a claim about being out of date, and a wrong
   // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update, handoff) {
+  function renderCoreUpdateBanner(update) {
     if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
     // A dismissal is remembered PER VERSION, not forever: the next release is new
     // news and must re-announce itself, or the surface is dead after one click.
@@ -676,25 +660,27 @@
     el.className = 'core-update-notice';
     el.id = 'core-update-notice';
     el.setAttribute('role', 'status');
-    // The action is shown only where it can actually be taken. The deploy door is
-    // the provisioning module's, and a hosted project does NOT run that module
-    // (probed: /api/bongos/provisioning/health is 404 on a tenant, 200 on the
-    // platform) — so on those the banner informs and does not offer a button that
-    // would 404. Task 1004046 is what gives those halls a real action.
+    // The action goes where the update can actually be taken. The deploy door is the
+    // provisioning module's, and a hosted project does NOT run that module (probed:
+    // /api/bongos/provisioning/health is 404 on a tenant, 200 on the platform) — so on
+    // those it goes to Settings → Software update (SOFTWARE_UPDATE_HREF above).
     // NOT A LINK TO THE PAGE YOU ARE ALREADY ON (task 1004145). This reads as the action
     // button — it is labelled with the verb and styled like one — but it is a plain
     // navigation to /deploy. On /deploy itself that is a no-op, and the owner who
     // pressed it there reasonably reported "I clicked update, but I didn't see anything
     // happen": nothing had, and nothing had been asked for. The control is on that page
     // already, so on it the banner informs and points, and does not pretend to act.
-    var onDeploy = window.location && String(window.location.pathname || '').replace(/\/+$/, '') === '/deploy';
-    // A hosted project has no door of its own; it hands its owner to the hub's door for
-    // this project when the server named one (task 1004174), and otherwise only informs.
-    var action = !moduleOn('provisioning')
-      ? (handoff ? '<a class="core-update-notice__action" href="' + esc(handoff) + '">Upgrade</a>' : '')
-      : (onDeploy
+    // The same rule on Settings → Software update: that panel IS the control there.
+    var here = window.location ? String(window.location.pathname || '').replace(/\/+$/, '') : '';
+    var onDeploy = here === '/deploy';
+    var onUpdatePanel = here === '/settings' && String(window.location.hash || '') === '#software-update';
+    var action = moduleOn('provisioning')
+      ? (onDeploy
         ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
-        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>');
+        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>')
+      : (onUpdatePanel
+        ? '<span class="core-update-notice__hint">Its details are below.</span>'
+        : '<a class="core-update-notice__action" href="' + SOFTWARE_UPDATE_HREF + '">Upgrade</a>');
     el.innerHTML =
       '<span>Core <strong>' + esc(update.latest) + '</strong> is available — this project runs ' +
       esc(update.running || 'an unknown version') + '.</span>' +

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure