@bongos/core 1.19.1041 → 1.19.1043

package/modules/hall-ui/public/settings.html

@@ -395,6 +395,26 @@
               <p class="section-note">Changes save at once. Your new choice plays the next time that event fires.</p>
             </section>
 
+            <!-- ============ group: update ============ -->
+
+            <!-- SOFTWARE UPDATE — this project's version, the newest release its update
+                 channel allows, and what the versions between them carry (task 1004296).
+                 Like a phone's Software Update screen: every builder reads it; the Update
+                 button is drawn only for those the upgrade door lets through, and it LEADS
+                 to that door (the two-step confirm and auto-rollback of ADR 0293) — the
+                 act never happens on this page. Rendered by settings-software-update.js
+                 from GET /api/bongos/software-update, read only when this group opens:
+                 an update's notes come out of a package download. -->
+            <section class="scroll" id="software-update-scroll" aria-labelledby="software-update-h" data-group="update" hidden>
+              <h2 id="software-update-h" class="scroll__h">Software update</h2>
+              <p class="scroll__lede">
+                Which version of Cloud Bongos this project runs, whether a newer one is
+                ready for it, and what each newer version brings.
+              </p>
+              <div id="su-body" aria-live="polite"></div>
+              <p class="section-note" id="su-note"></p>
+            </section>
+
             <!-- ============ group: extensions ============ -->
 
             <!-- Module-contributed panels (BV1.R42, ADR 0083). settings.js appends a
@@ -416,7 +436,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->
@@ -426,7 +446,7 @@
 <!-- shared record overlay (#/idea|blocker/N) — every hall page carries it; this
      page was the one gap (task 2172). -->
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
-<script src="/builders/settings.js?v=2026-09-02-panel"></script>
+<script src="/builders/settings.js?v=2026-09-26-update"></script>
 <!-- task 1003341: the Active sessions panel. Its own file rather than more of
      settings.js, which sits close to the 1500-line size ratchet. -->
 <script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
@@ -439,5 +459,7 @@
      the panel grew from one switch to a rung picker with a derived default, and
      settings.js is against the 1500-line ratchet. -->
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
+<!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
+<script src="/builders/settings-software-update.js?v=2026-09-26-update"></script>
 </body>
 </html>

package/modules/hall-ui/public/settings.js

@@ -1207,6 +1207,8 @@
     ...(window.OTB.moduleOn('dev-box') ? [{ id: 'devbox', label: 'Dev box' }] : []),
     { id: 'preferences', label: 'Preferences' },
     { id: 'sound', label: 'Sound' },
+    // task 1004296 — every project's version and its update; settings-software-update.js.
+    { id: 'update', label: 'Software update' },
   ];
   const RAIL_GROUPS = RAIL_ITEMS.map((i) => i.id).concat('extensions');
   let rail = null;
@@ -1230,6 +1232,7 @@
     'voices': 'voices-scroll',
     'sounds': 'sounds-scroll',
     'event-sounds': 'event-sounds-scroll',
+    'software-update': 'software-update-scroll',
   };
 
   function activateGroup(group, opts) {
@@ -1238,6 +1241,8 @@
     if (!groups) return;
     groups.dataset.active = group;
     rail?.activate(group);
+    // A panel whose read is expensive loads when its group opens, not with the page.
+    if (typeof CustomEvent === 'function') document.dispatchEvent(new CustomEvent('settings:group', { detail: { group } }));
     if (!opts || opts.scroll !== false) window.scrollTo({ top: 0 });
   }
 

package/modules/hall-ui/public/settings.states.json

@@ -10,7 +10,8 @@
     "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips", "#privacy-rows"] } },
     "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },
     "preferences": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900]], "expect": { "visible": ["#wander-rows", "#render-rows"] } },
-    "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } }
+    "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } },
+    "update": { "auth": true, "url": "/settings#software-update", "actions": [["wait", 1200]], "expect": { "visible": ["#software-update-h", "#su-body", "#su-update", ".su-versions"] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 900]] }
 }

package/modules/hall-ui/public/shell.js

@@ -347,8 +347,9 @@
       //
       // THE DOOR IS THE PROVISIONING MODULE'S, and a hosted project does not run it, so
       // there this link opened a page with nothing behind it (task 1004174). It is
-      // dropped where the module is off, and re-pointed at the hub's own door for THIS
-      // project once /core-update names one (pointDeployAtHub, ADR 0339).
+      // dropped where the module is off — and since task 1004296 it STAYS dropped: /deploy
+      // is the platform hall's page alone, and every other hall takes its update from
+      // Settings → Software update, whose Update button carries the hub hand-off.
       { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
@@ -628,39 +629,22 @@
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
       if (!res || res.status !== 200 || !res.data) return;
-      var handoff = hubHandoff(res.data.deploy_url);
-      if (handoff) pointDeployAtHub(handoff);
-      if (res.data.update) renderCoreUpdateBanner(res.data.update, handoff);
+      if (res.data.update) renderCoreUpdateBanner(res.data.update);
     }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
   }
 
-  // task 1004174 (ADR 0339) — where a HOSTED project's owner takes the upgrade: the
-  // hub's own deploy door scoped to this project, which the server names as
-  // `deploy_url` when this project is federated with a hub. Only where this hall has no
-  // door of its own: on the platform the local /deploy is the door, and a link away
-  // from it would be a second road to the same button. An address that is not a plain
-  // http(s) URL is ignored rather than trusted into an href.
-  function hubHandoff(url) {
-    if (moduleOn('provisioning')) return null;
-    if (typeof url !== 'string' || !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return null;
-    return url;
-  }
-
-  // The rail's Deploy item is hidden on a hosted project (its module gate); this gives
-  // it back, aimed at the hub. Its rank gate still applies, exactly as on the platform.
-  function pointDeployAtHub(url) {
-    var item = document.getElementById('nav-deploy');
-    if (!item) return;
-    item.setAttribute('href', url);
-    if (item.dataset) delete item.dataset.module;
-    item.hidden = !gateAllows(item.dataset && item.dataset.gate);
-  }
+  // Where the banner's Upgrade goes (task 1004296). The platform's hall runs the deploy
+  // door itself, so there it is /deploy. Every other hall — a hosted project, a
+  // self-hosted instance — takes its update from Settings → Software update, which says
+  // what the update carries and, on a hosted project, hands the owner to the hub's door
+  // for this project (ADR 0339 D3). The banner no longer links off-site itself.
+  var SOFTWARE_UPDATE_HREF = '/settings#software-update';
 
   // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
   // is current AND when the registry could not be read; `reading` separates them,
   // and neither renders. A banner is a claim about being out of date, and a wrong
   // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update, handoff) {
+  function renderCoreUpdateBanner(update) {
     if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
     // A dismissal is remembered PER VERSION, not forever: the next release is new
     // news and must re-announce itself, or the surface is dead after one click.
@@ -676,25 +660,27 @@
     el.className = 'core-update-notice';
     el.id = 'core-update-notice';
     el.setAttribute('role', 'status');
-    // The action is shown only where it can actually be taken. The deploy door is
-    // the provisioning module's, and a hosted project does NOT run that module
-    // (probed: /api/bongos/provisioning/health is 404 on a tenant, 200 on the
-    // platform) — so on those the banner informs and does not offer a button that
-    // would 404. Task 1004046 is what gives those halls a real action.
+    // The action goes where the update can actually be taken. The deploy door is the
+    // provisioning module's, and a hosted project does NOT run that module (probed:
+    // /api/bongos/provisioning/health is 404 on a tenant, 200 on the platform) — so on
+    // those it goes to Settings → Software update (SOFTWARE_UPDATE_HREF above).
     // NOT A LINK TO THE PAGE YOU ARE ALREADY ON (task 1004145). This reads as the action
     // button — it is labelled with the verb and styled like one — but it is a plain
     // navigation to /deploy. On /deploy itself that is a no-op, and the owner who
     // pressed it there reasonably reported "I clicked update, but I didn't see anything
     // happen": nothing had, and nothing had been asked for. The control is on that page
     // already, so on it the banner informs and points, and does not pretend to act.
-    var onDeploy = window.location && String(window.location.pathname || '').replace(/\/+$/, '') === '/deploy';
-    // A hosted project has no door of its own; it hands its owner to the hub's door for
-    // this project when the server named one (task 1004174), and otherwise only informs.
-    var action = !moduleOn('provisioning')
-      ? (handoff ? '<a class="core-update-notice__action" href="' + esc(handoff) + '">Upgrade</a>' : '')
-      : (onDeploy
+    // The same rule on Settings → Software update: that panel IS the control there.
+    var here = window.location ? String(window.location.pathname || '').replace(/\/+$/, '') : '';
+    var onDeploy = here === '/deploy';
+    var onUpdatePanel = here === '/settings' && String(window.location.hash || '') === '#software-update';
+    var action = moduleOn('provisioning')
+      ? (onDeploy
         ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
-        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>');
+        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>')
+      : (onUpdatePanel
+        ? '<span class="core-update-notice__hint">Its details are below.</span>'
+        : '<a class="core-update-notice__action" href="' + SOFTWARE_UPDATE_HREF + '">Upgrade</a>');
     el.innerHTML =
       '<span>Core <strong>' + esc(update.latest) + '</strong> is available — this project runs ' +
       esc(update.running || 'an unknown version') + '.</span>' +

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/style.css

@@ -3151,6 +3151,10 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   min-width: 0;
   max-width: 100%;
 }
+/* The 24px floor (task 1004301 found it failing): at 13px the base field's padding left a
+   number input 21px tall beside a select that clears it — the task page's "Wait for task"
+   box. Sized to sit level with its select. */
+.td-field input { min-height: 26px; box-sizing: border-box; }
 .td-form .td-actions, .td-form-hint, .td-form .td-action-note { grid-column: 1 / -1; }
 .td-form .td-actions { margin: 4px 0 0; }
 .td-form-hint { font-size: 12.5px; color: var(--ink-soft); margin: 0; }

package/modules/hall-ui/public/task.css

@@ -139,3 +139,9 @@
   .tk-axis:nth-child(3) { border-left: 0; padding-left: 0; }
   .tk-lrow { grid-template-columns: 1fr; gap: 6px; }
 }
+
+/* The module slot under the rail (task 1004301): a module's task-widget.js may write one
+   line of its own here (the npm-release module says which version carries the task).
+   Empty unless a module fills it, and then it takes no room at all. */
+.tk-contrib { margin: var(--sp-md) 0 0; }
+.tk-contrib:empty { display: none; }

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->
@@ -69,6 +69,6 @@
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/md-reader.js" defer></script>
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>
-<script src="/builders/task.js?v=2026-07-03-taskpage1" defer></script>
+<script src="/builders/task.js?v=2026-09-26-taskwhere" defer></script>
 </body>
 </html>

package/modules/hall-ui/public/task.js

@@ -634,6 +634,11 @@
       ['Priority', t.priority == null ? null : 'P' + t.priority],
     ]));
     parts.push(lifecycleRail(t, creditVal));
+    // A slot a MODULE may fill (task 1004301): the module's public/task-widget.js is
+    // injected just before this script and writes into it on `otb:task-shown` below. The
+    // page itself names no module and draws nothing here — with none enabled it stays
+    // empty, and `:empty` in task.css collapses it.
+    parts.push('<div class="tk-contrib" id="task-contrib" aria-live="polite"></div>');
 
     // Claim history (task 751). The most recent holder leads; since task 1003437
     // the read also carries the FULL claim ledger (?include=claims), so a task
@@ -806,6 +811,7 @@
 
     const body = $('#task-body');
     if (body) body.innerHTML = parts.join('');
+    announceShown(t);
 
     const copyBtn = $('#copy-prompt-btn');
     if (copyBtn) {
@@ -958,6 +964,17 @@
   // The two honest failures. Both keep the <h1> — the empty and error renders are
   // renders like any other, and a page whose only heading lives on the happy path
   // has none in the states a reader is most likely to hit.
+  // Tell any module widget which task is on screen (task 1004301). Fired after EVERY
+  // render, because render() rebuilds #task-body wholesale and the slot a widget filled a
+  // moment ago is gone. The last task shown is also left on window.OTBTaskShown for a
+  // widget that loads after the first announcement. Only the id and the status travel:
+  // a widget that needs more asks its own module's route, which applies its own gate.
+  function announceShown(t) {
+    const detail = { id: String(t.id), status: t.status || null };
+    window.OTBTaskShown = detail;
+    if (typeof CustomEvent === 'function') document.dispatchEvent(new CustomEvent('otb:task-shown', { detail }));
+  }
+
   function renderNotFound(id) {
     const body = $('#task-body');
     if (body) body.innerHTML = `

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/panel-family.md

@@ -17,3 +17,12 @@ Also fixed here, as the board task handed forward: the two sub-24px links on Hom
 - **Honest empties, one line each.** Signed out (or a 401 mid-way) the grid is the same permission sentence the activity ledgers use; an empty record is "No works shipped yet"; a failed read says so. Never three empty cards.
 - **The Works key, and its public fallback.** Works is the full server-paged ledger from `/builders/:id/activity?section=tasks` (any signed-in viewer, any builder); signed out, the page's PUBLIC `recent_ships` stand in with a sign-in line, so a stranger still sees the last few. The Overview no longer carries a works strip — that removes the duplicate the DONE-WHEN named.
 - **A lookback control (owner request, task 1003489) scopes every chart** — 30 days / 90 days / 1 year / All time, one segmented row above the grid (the dataviz date-range-first rule). The cumulative charts clip their axis to the window and ENTER it at the running total, not at zero (`clipToWindow`); the craft mix counts within it; the pace chart passes the window to `/analytics/builder/:id?days=`. Remembered per viewer; changing it re-draws from the rows already in hand — no re-fetch. (A chart LIBRARY was floated by the owner and deliberately NOT taken here — the hall ships none, the hand-drawn charts satisfy the ask, and the swap is its own idea to weigh CSP/weight/theming/table-twin against.)
+
+**Settings gained a sixth group, Software update (task 1004296)** — every project's running core, the newest release its update channel lets it take, and what each version in between brings, like a phone's Software Update screen. `settings-software-update.js` renders it from `GET /api/bongos/software-update`; the reading is `src/bongos/software-update.js` over the core's registry reader.
+
+- **It is read when its group opens, not with the page.** An update's notes come out of the newer package's download, and most visits to Settings are for something else, so `activateGroup` in `settings.js` announces each switch as a `settings:group` event and the panel loads on its own group, once.
+- **The Update button leads to the door; it is not the door.** The act is the deploy door's two steps and auto-rollback (ADR 0293): `/deploy` in the platform's hall, the hub's `/deploy?project=` for a hosted project (ADR 0339 D3), and a `bongos upgrade` sentence where there is no door at all. A second copy of that flow here would be a second place for its safety rules to drift. The button is drawn only when the server says the viewer holds `core.pin.move` — cosmetic, the door re-checks.
+- **Everyone reads it.** The version and what's new are for every builder (the owner's ask); the route discloses nothing the public `/version` and npm do not already publish.
+- **"Up to date" is said only from an answer.** A failed registry read, an unnamed running version and unread release notes each render as what they are; unread notes are never drawn as a version with no changes.
+- **The notes are the soft ink, underlined, on the platform.** There every entry links to its task, and a list of accent-coloured sentences read as a warning. Elsewhere the ids belong to another project's ledger, so the entries are plain text.
+- **Kit:** `settings.states.json` `update`, ALL CLEAN at 1440/390/320 × dark/light against the harness with the fixture `software-update.json` (a live reading for 1.19.1033). Tests: `tests/software_update.mjs`.

package/modules/hall-ui/records/record-family.md

@@ -11,3 +11,5 @@
 **The task record's grade panel, session log and claim ledger (task 1003437).** Two net-new regions the owner approved at the composition round (direction doc §6 decision 4) sit between Shipped and Actions on `task.html`. Four rules carry them: all three ride the ONE task read as opt-in siblings — `GET /tasks/:id?include=last_claim,grade,session_logs,claims`; the two new reads (`getTaskSessionLogs`, `getTaskClaims` in `modules/lifecycle/db-claim-reads.js`) are keyed by `task_id`, newest first, **rank never returned**; absent → **NOTHING** (the ship-visual precedent), except a grade row whose panel was `unavailable`, which is data and says so in one line; and verdicts and outcomes wear the fixed verification vocabulary through `.rec-pill--ok/warn/danger`, **never the accent**. Pinned in `tests/hall_record_world.mjs` (page) and `tests/task_detail_includes.mjs` (route + reads).
 
 **The way into and out of a task record (task 1003468, ADR 0229).** Since 1759/1869 a to-do card's BODY toggles selection so a builder can bulk-claim — which is why the owner could not open a card, the only door being a 26px ⤢ glyph nobody found. Now **the title is the door**: `.task__link` on both surfaces that render the card (`work.js`, `goals-render.js`), bought up to the 24px floor with the `.scroll__lede a` recipe; both click handlers let it through; the glyph is gone. **The link carries where it was opened from** — `OTBTaskDetail.href(id)` appends `?from=<path+query+hash>` (a query param so the origin survives a reload and keeps a goal's `#/goal/N`, which a referrer drops) — and `task.js` resolves the exit once (`?from=` → same-origin referrer → the work board), points the crumb **before** the fetch so the way back exists in every state, and refuses anything that is not a path on this host. **Never write a bare `/task/N` link from a list again — call `OTBTaskDetail.href(id)`.** Pinned by §10 of `tests/hall_record_world.mjs` and §7 of `tests/hall_board_world.mjs`.
+
+**The task page carries a module slot (task 1004301).** Under the lifecycle rail sits `#task-contrib`, empty and collapsed (`.tk-contrib:empty`) unless a module fills it, and `task.js` announces every render as `otb:task-shown` with `{ id, status }` (also left on `window.OTBTaskShown` for a late widget). The page names no module: the server injects each enabled module's `public/task-widget.js` just before `task.js` (the loader's uiSections seam, `hallWidgetScripts({ file: 'task-widget.js' })`), so both run deferred in order and the listener exists before the first announcement. Render rebuilds `#task-body` wholesale, which is why the announcement is per render, not per load. The first filler is npm-release's line — "In 1.19.1036 · running here · not released to other projects yet", or "Done, but not merged" for a stranded ship. Tests: `tests/hall_record_world.mjs` (slot + announcement), `tests/npm_release_where.mjs` (the widget and the seam).

package/modules/npm-release/module.json

@@ -1,7 +1,7 @@
 {
   "key": "npm-release",
   "title": "npm release",
-  "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
+  "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622) — and the same line on a task's own page (task 1004301). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
   "coreVersion": "^1.19.0",
   "default": false,
   "author": "Cloud Bongos",
@@ -12,7 +12,13 @@
     "status": "core-maintained"
   },
   "contributes": {
-    "routes": ["work"]
+    "routes": [
+      "work",
+      "task-where"
+    ],
+    "uiSections": [
+      "task-where"
+    ]
   },
   "provides": [],
   "consumes": []

package/modules/npm-release/public/task-widget.js

@@ -0,0 +1,79 @@
+// modules/npm-release/public/task-widget.js — the line a task's own page shows about where
+// its code is (task 1004301): "In 1.19.1036 · running here · not released yet", or that a
+// task marked done never reached main — which is how a stranded ship becomes visible to the
+// person who shipped it.
+//
+// HOW IT GETS THERE. The core's task page names no module. It renders an empty slot
+// (#task-contrib) and announces each render as `otb:task-shown`; the server injects this file
+// just before task.js because the module declares a uiSection and ships task-widget.js
+// (src/module-loader/loader.js hallWidgetScripts, file: 'task-widget.js'). Module off: this
+// file is never injected, its asset 404s, and the slot stays empty.
+//
+// THE PAGE KNOWS NOTHING (deploy.js's rule, kept). The stage and version are the server's
+// reading; a partial reading says so; any failure draws no line rather than a wrong one.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const client = window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const DONE = ['completed', 'confirmed', 'shipped'];
+
+  // One reading per task per page load: the page re-renders on every action, and each
+  // render re-announces, but where the code is does not change between clicks. Bounded —
+  // a page shows one task, and the overlay can walk to a few more; nothing needs more than
+  // the last handful.
+  const cache = new Map();
+  const CACHE_MAX = 8;
+
+  // The line for each stage, in the deploy page's own words (its stage names), shortened to
+  // read as one sentence under a task's lifecycle rail.
+  const REST = {
+    unversioned: () => 'Merged, waiting for the next published version.',
+    not_live: (w) => `published, not running here yet${w.offered ? ' · already offered to other projects' : ''}.`,
+    live_unreleased: () => 'running here · not released to other projects yet.',
+    released: (w) => `${w.live ? 'running here · ' : ''}released to other projects.`,
+    // Said with the reason a builder would recognise, the way "Done, but not merged" is: this
+    // is most often work that changed no code, and only sometimes a merge that lost its name.
+    no_version: () => 'Shipped, though no published version lists it — usually a change that needed no code, like a scope edit or a check, and now and then a merge whose note did not name this task.',
+  };
+
+  function lineHtml(w) {
+    if (w.stage === 'not_merged') {
+      return '<p class="rec-meta nr-where nr-where--stranded"><b>Done, but not merged.</b> The ledger marks this task done, and its code is not on main yet — a ship that has not landed.</p>';
+    }
+    const rest = REST[w.stage];
+    if (!rest) return '';
+    const lead = w.version ? `In <b>${esc(w.version)}</b> · ` : '';
+    const partial = w.partial ? ' (a partial reading: the registry or the release notes could not be read)' : '';
+    return `<p class="rec-meta nr-where">${lead}${esc(rest(w) + partial)}</p>`;
+  }
+
+  async function reading(id) {
+    if (cache.has(id)) return cache.get(id);
+    const p = (async () => {
+      if (!client) return null;
+      const res = await client.request('GET', `${API}/npm-release/task/${encodeURIComponent(id)}`);
+      return res && res.status === 200 && res.data ? res.data : null;
+    })().catch(() => null);
+    cache.set(id, p);
+    while (cache.size > CACHE_MAX) cache.delete(cache.keys().next().value);
+    return p;
+  }
+
+  async function show(detail) {
+    if (!detail || !/^\d{1,12}$/.test(String(detail.id || ''))) return;
+    if (!DONE.includes(detail.status)) return;           // nothing to place until it is done
+    const w = await reading(String(detail.id));
+    // The page may have re-rendered while the read was in flight: write into the slot that
+    // exists NOW, and only for the task it is still showing.
+    const slot = document.getElementById('task-contrib');
+    const shown = window.OTBTaskShown;
+    if (!slot || !w || (shown && String(shown.id) !== String(detail.id))) return;
+    slot.innerHTML = lineHtml(w);
+  }
+
+  document.addEventListener('otb:task-shown', (e) => { show(e && e.detail); });
+  if (window.OTBTaskShown) show(window.OTBTaskShown);
+})();

package/modules/npm-release/public/work.js

@@ -64,8 +64,13 @@
 
   // The title IS the link, the hall's own row idiom (oversight.css `a.ov-row__title`),
   // which is what buys it the 24px floor and the row's ink rather than link colour.
+  // Voice rule V4 (docs/voice.md): a dash is banned in QUOTED data — and a task title and a
+  // release-note line are both handed over by the ledger — so it becomes a comma at render,
+  // the way goal-inbox.js and the public feed's cleanTitle() do. Never by editing the data.
+  const unDash = (raw) => String(raw == null ? '' : raw).replace(/\s*[—–]\s*/g, ', ').replace(/,\s*,/g, ',').trim();
+
   function taskTitle(id, title) {
-    return `<a class="ov-row__title" href="/task/${encodeURIComponent(id)}">${escapeHtml(title || `Task ${id}`)}</a>`;
+    return `<a class="ov-row__title" href="/task/${encodeURIComponent(id)}">${escapeHtml(unDash(title) || `Task ${id}`)}</a>`;
   }
 
   function taskRow(t, { offeredInNote = false } = {}) {
@@ -151,8 +156,8 @@
       const shown = expanded.has(key) ? v.entries : v.entries.slice(0, ENTRIES_SHOWN);
       body = `<ul class="ov-rows">${shown.map((e) => `<li class="ov-row ov-row--dense">
           <div class="ov-row__main">
-            ${e.id ? taskTitle(e.id, e.title) : `<span class="ov-row__title">${escapeHtml(e.text)}</span>`}
-            ${e.id ? `<p class="ov-row__sub">${escapeHtml(e.text)}</p>` : ''}
+            ${e.id ? taskTitle(e.id, e.title) : `<span class="ov-row__title">${escapeHtml(unDash(e.text))}</span>`}
+            ${e.id ? `<p class="ov-row__sub">${escapeHtml(unDash(e.text))}</p>` : ''}
           </div>
         </li>`).join('')}</ul>${moreButton(key, v.entries.length, shown.length)}`;
     }

package/modules/npm-release/routes/task-where.js

@@ -0,0 +1,48 @@
+'use strict';
+
+// modules/npm-release/routes/task-where.js — GET /npm-release/task/:id, the one line a
+// task's own page shows about where its code is (task 1004301): which version carries it,
+// whether this hall runs that version, whether it is released — or that a task marked done
+// never reached main. See readTaskWhere in ../work.js for the reading.
+//
+// ANY SIGNED-IN BUILDER, NOT THE DEPLOY PAGE'S ATOM. Every builder can open a task page, so
+// the question the task asked was what this line may show them. It shows nothing that is
+// not already public: the version naming the task is in the package's own release notes on
+// npm, the core this hall runs is what the public GET /version reports, and "released" is
+// the registry's `latest` label. The deploy page stays on `core.pin.move` for what it adds
+// beyond that — the ledger of upgrades, the door. requireBuilder rather than nothing, like
+// the task page's own read, so the line is never a signed-out probe.
+//
+// READ-ONLY.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { readTaskWhere } = require('../work');
+
+const log = api.logger('npm-release');
+
+module.exports = function buildNpmReleaseTaskWhereRouter({ read = readTaskWhere } = {}) {
+  const router = express.Router();
+
+  router.get(
+    '/npm-release/task/:id',
+    api.requireBuilder,
+    async (req, res) => {
+      const id = String((req.params && req.params.id) || '');
+      if (!/^\d{1,12}$/.test(id)) {
+        res.status(400).json({ error: { code: 'bad_task_id', message: 'A task id is a number.' } });
+        return;
+      }
+      try {
+        const where = await read({ pool: api.pool, id });
+        if (!where) { res.status(404).json({ error: { code: 'task_not_found', message: `No task ${id}.` } }); return; }
+        res.json(where);
+      } catch (e) {
+        log.error(`npm-release task-where read failed: ${e && e.message}`);
+        res.status(500).json({ error: { code: 'task_where_failed', message: 'Could not read where this task\'s code is right now.' } });
+      }
+    },
+  );
+
+  return router;
+};