@bongos/core 1.19.1080 → 1.20.1

package/migrations/core_260_goals_working_area.sql

@@ -0,0 +1,63 @@
+-- core_260_goals_working_area.sql - a working area's number becomes a FIELD on
+-- its goal, not a substring of the goal's title (task 1004057, ADR 0264 + 0308).
+--
+-- WHY. ADR 0264 (and 0308, which added the eleventh) numbers the working areas,
+-- and the board is one goal per area. Until now the number lived only as prose at
+-- the front of goals.title ("Working area 6 - ..."), so anything that wanted to
+-- group, sort or label by area had to regex a human title, and would break the
+-- day an area was retitled (goal 1000095 already was once). Worse, the goal row
+-- carries two integers that LOOK like the area number and are not: goals.id, and
+-- goals.sort_order - the owner's priority order (migration 187), 0-based, which
+-- agrees with the area number for exactly one of the eleven areas (area 6).
+--
+-- NOT sort_order. That column has a stated, different job and the owner reorders
+-- with it. Nothing here reads or writes it.
+--
+-- THE BACKFILL IS BY THE TITLE'S LEADING NUMBER, ONCE. The existing rows were
+-- created by the title convention, so the convention is how they are identified -
+-- exactly once, here - and the column carries the fact from now on. It matches
+-- the leading "Working area N" only and ignores the rest of the title: the ADR
+-- writes some areas with a trailing parenthetical the DB titles do not carry
+-- (area 4 "(staging of updates)", area 6 "(incl. agents)"), so the two strings
+-- are not byte-identical and must not be compared whole. It does NOT key off goal
+-- ids: those are this instance's rows, and on any other instance the same ids are
+-- unrelated goals. A goal with no such title stays NULL - every non-area goal,
+-- which is the overwhelming majority, and every goal on an instance that does not
+-- use working areas.
+--
+-- NO UNIQUE INDEX per version, deliberately (the core_234 lesson): goals has no
+-- unique constraint on (version_id, title), so a database holding two goals
+-- titled for the same area would fail the index and block the deploy. The CHECK
+-- keeps the value a positive number and nothing more, so a twelfth area needs no
+-- schema change.
+--
+-- Forward-safe: one additive nullable column with no default. Old code on the new
+-- schema neither sees nor needs it (every reader SELECTs an explicit column
+-- list); a rollback leaves the column populated and unread.
+
+BEGIN;
+
+ALTER TABLE goals
+  ADD COLUMN IF NOT EXISTS working_area smallint;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'goals_working_area_positive') THEN
+    ALTER TABLE goals
+      ADD CONSTRAINT goals_working_area_positive CHECK (working_area IS NULL OR working_area > 0);
+  END IF;
+END $$;
+
+COMMENT ON COLUMN goals.working_area IS
+  'The ADR 0264 working-area number this goal IS, or NULL for any other goal. Not sort_order (the owner''s priority order) and not the id (task 1004057).';
+
+UPDATE goals
+   SET working_area = substring(title FROM '^Working area ([0-9]{1,3})([^0-9]|$)')::smallint
+ WHERE working_area IS NULL
+   AND title ~ '^Working area [0-9]{1,3}([^0-9]|$)'
+   AND substring(title FROM '^Working area ([0-9]{1,3})([^0-9]|$)')::int > 0;
+
+INSERT INTO schema_migrations (version) VALUES ('core_260_goals_working_area')
+ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/migrations/core_261_grade_attempts_verdicts.sql

@@ -0,0 +1,24 @@
+-- core_261_grade_attempts_verdicts.sql -- task 1004292 (found while building
+-- task 1002843, the grader error-correlation audit).
+--
+-- WHY. Only a task's LATEST grade keeps its per-worker verdicts: task_grades is
+-- one row per task, and grade_attempts (core 064) stores only passed + score per
+-- attempt. So every objection a worker raised in an EARLIER round, the round the
+-- builder then fixed, is gone by the time the audit reads it, and a worker that
+-- mostly objects early looks near-silent.
+--
+-- WHAT. One nullable jsonb column on the append-only attempt log:
+--   [{ "kind": "hacker", "verdict": "concerns", "error": null,
+--      "severities": ["major", "minor"] }, ...]
+-- kind, verdict, error code and the SEVERITIES of the worker's issues, and no
+-- prose: a review's summary is not kept beyond the latest grade. NULL for every
+-- attempt made before this column (and for one whose best-effort write failed);
+-- readers fall back to the task's final grade.
+--
+-- Additive and nullable: no default, no rewrite, safe against a rolled-back
+-- release that never names it. Idempotent.
+BEGIN;
+
+ALTER TABLE grade_attempts ADD COLUMN IF NOT EXISTS worker_verdicts jsonb;
+
+COMMIT;

package/migrations/core_262_drop_builder_box_blocked.sql

@@ -0,0 +1,33 @@
+-- core_262_drop_builder_box_blocked.sql — drop the four builders.box_blocked* columns,
+-- the last stored piece of the dev box (task 1004360, goal 1000120; ADR 0346).
+--
+-- Migration 104 added them so an Archon could bar one builder from opening a dev box:
+-- box_blocked, box_blocked_reason, box_blocked_at and box_blocked_by (a FK back to
+-- builders). The box is gone — its module (task 1003892), its tables and session
+-- source (core_258, task 1003895) — so nothing sets or honours the block any more.
+--
+-- WHY A RELEASE LATER THAN core_258, not in it. A deploy runs migrations while the
+-- PREVIOUS server is still up, and a failed upgrade rolls the code back but never the
+-- schema. Every core before task 1003895 SELECTs these columns in getBuilderById, so
+-- dropping them in the same release would have broken every builder read for as long
+-- as that code ran. 1003895 removed the read; its first release was 1.19.1074.
+--
+-- forward-unsafe: drops four builders columns. Safe now because no reader is left:
+-- task 1003895 removed the only core read (getBuilderById) and task 1003892 the only
+-- writer (the dev-box module's block route), and on 2026-09-29 every active instance
+-- in provisioning_instances served core 1.19.1076 or later, past the first release
+-- (1.19.1074) without that read. A rollback to such a core never names the columns.
+--
+-- CASCADE is deliberately absent: if a view or anything else still depended on a
+-- column, the DROP fails loudly rather than silently taking it too. Dropping
+-- box_blocked_by drops its foreign key with it. Idempotent: every clause is IF EXISTS.
+
+BEGIN;
+
+ALTER TABLE builders
+  DROP COLUMN IF EXISTS box_blocked,
+  DROP COLUMN IF EXISTS box_blocked_reason,
+  DROP COLUMN IF EXISTS box_blocked_at,
+  DROP COLUMN IF EXISTS box_blocked_by;
+
+COMMIT;

package/modules/agents/lib/validate.js

@@ -141,6 +141,10 @@ function isSafeScopePath(p) {
  *          `null` on any failure — a rejected definition must never hand back a row
  *          something downstream could insert.
  */
+// The fields a definition may carry: exactly the normalized row below. Anything
+// else is refused as unknown_field rather than dropped (task 1004007).
+const DEFINITION_KEYS = ['name', 'title', 'persona', 'trigger_type', 'trigger_spec', 'model_tier', 'scope_modules', 'scope_paths'];
+
 function validateAgentDefinition(obj, opts = {}) {
   const errors = [];
   const E = (code, field, message) => errors.push({ code, field, message });
@@ -172,6 +176,28 @@ function validateAgentDefinition(obj, opts = {}) {
   // why its absence refuses rather than admits.
   const isProtectedPath = safeGet(options, 'isProtectedPath');
 
+  // --- unknown keys, fail-closed (task 1004007) ------------------------------
+  // The normalized row names exactly DEFINITION_KEYS, so anything else would be
+  // accepted and then silently DROPPED, which turned a file's top-level
+  // `touches:` into "fires on every ship" with ok:true and no error. A key this
+  // validator does not know is refused BY NAME instead: a typo is an error, not
+  // a default. The write routes already refuse unknown body keys (strict schema);
+  // this closes the file path, which reaches here with no schema in front.
+  // Enumerated under a guard, like every other read here: a Proxy's ownKeys
+  // trap can throw, and the never-throws contract covers this line too. An
+  // object whose keys cannot be listed cannot be checked, so it is refused.
+  let unknown = [];
+  try {
+    unknown = Object.keys(obj).filter((k) => !DEFINITION_KEYS.includes(k));
+  } catch (err) {
+    E('keys_unreadable', '(root)',
+      `The definition's fields could not be listed (${(err && err.message) || 'enumeration threw'}); it must be plain data. Refused rather than checked partially.`);
+  }
+  if (unknown.length > 0) {
+    E('unknown_field', unknown.join(', '),
+      `${unknown.map((k) => JSON.stringify(k)).join(', ')} ${unknown.length === 1 ? 'is not a field' : 'are not fields'} of an agent definition and would be dropped. Fields: ${DEFINITION_KEYS.join(', ')}. A trigger parameter (event, touches, sink, cadence) belongs inside trigger_spec; in a .claude/agents file write it at the top level and it is folded in.`);
+  }
+
   // --- name ----------------------------------------------------------------
   const name = safeGet(obj, 'name');
   if (!isNonEmptyString(name) || !NAME_RE.test(name) || name.length > NAME_MAX) {
@@ -268,6 +294,23 @@ function validateAgentDefinition(obj, opts = {}) {
     }
   }
 
+  // --- the touches filter, fail-closed (task 1004007) -------------------------
+  // The event router reads a filter that is not a list of non-empty strings as
+  // ABSENT, and an absent filter FIRES ON EVERY SHIP. That is the right runtime
+  // default, and exactly why a malformed one must be refused here: "touches:
+  // docs/**" parses to a string, and storing it would arm the widest possible
+  // agent while its author believes it is narrow.
+  if (spec) {
+    for (const key of ['touches', 'touches_globs']) {
+      const raw = safeGet(spec, key);
+      if (raw === undefined || raw === null) continue;
+      if (!Array.isArray(raw) || raw.length === 0 || !raw.every(isNonEmptyString)) {
+        E('trigger_touches_invalid', `trigger_spec.${key}`,
+          `trigger_spec.${key}: must be a non-empty list of path globs; received ${JSON.stringify(raw)}. The event router treats anything else as NO filter, which fires on every ship. In a .claude/agents file write it as a list (${key}: [docs/**] or one "- glob" per line).`);
+      }
+    }
+  }
+
   // --- model tier -----------------------------------------------------------
   const rawTier = safeGet(obj, 'model_tier');
   const modelTier = rawTier === undefined || rawTier === null ? 'default' : rawTier;

package/modules/autonomy/gauge.js

@@ -36,6 +36,12 @@ const WEEK_SECONDS = 7 * 24 * 60 * 60;
 // number is least trustworthy.
 const DEFAULT_STALE_AFTER_S = 1800;
 
+// WINDOW_PERIOD_S — how long each window lasts, used ONLY to step a retired
+// boundary forward into the present (task 1004376). Never used to decide
+// capacity: these windows roll from first use, so a computed boundary is an
+// estimate and only ever bounds how far back a cap counts.
+const WINDOW_PERIOD_S = { five_hour: 5 * 3600, seven_day: 7 * 24 * 3600 };
+
 // Reserve = capacity deliberately left unspent, in percentage points.
 //
 // It exists for exactly two reasons, and neither is thrift:
@@ -163,8 +169,32 @@ function readGauge(raw, nowEpochS, config = {}) {
       return { used, resetsAt: resets, observedAt, ageS: nowEpochS - observedAt, derived: false };
     }
     // Aged out. Superseded ONLY if its window has actually turned over.
+    //
+    // ADVANCE TO THE CURRENT WINDOW, do not stand on the retired one (task
+    // 1004376). The retired reading's resets_at can be DAYS old — that is the
+    // whole premise of the derived path, since nothing refreshes the gauge on an
+    // unattended host. Reporting it as the baseline handed the caller an ancient
+    // mark, and its cap arrived pre-exhausted by work done days earlier: the
+    // runner derived headroom correctly and then held forever, which is the
+    // state task 1004178 existed to end.
+    //
+    // The exact boundary is unknowable — these windows roll from first use, not
+    // from a fixed clock — but it is BOUNDABLE: step forward whole periods from
+    // a boundary we did observe until we land inside the current one. Wrong by
+    // at most a partial window, and wrong in the direction of a more recent
+    // mark, which is the safe direction for something that bounds recent work.
     if (nowEpochS >= resets) {
-      return { used: 0, resetsAt: resets, observedAt: resets, ageS: nowEpochS - resets, derived: true };
+      const period = WINDOW_PERIOD_S[w];
+      const start = Number.isFinite(period) && period > 0
+        ? resets + Math.floor((nowEpochS - resets) / period) * period
+        : resets;
+      return {
+        used: 0,
+        resetsAt: Number.isFinite(period) && period > 0 ? start + period : resets,
+        observedAt: start,
+        ageS: nowEpochS - start,
+        derived: true,
+      };
     }
     return null;   // old, and its window is still running — no longer evidence
   };
@@ -254,8 +284,14 @@ function decideCapacity({ gauge, now, config = {} } = {}) {
   // cannot stand in for it either: usage only grows, so an under-reported value
   // makes the check MORE permissive, which is the wrong direction to be wrong in.
   // Bounding the work done since `derivedSince` is what replaces that pacing.
+  //
+  // The MOST RECENT boundary, not the oldest (task 1004376). A derived seven-day
+  // window starts up to a week back; counting from there would make the cap a
+  // one-time budget that never refills rather than a per-window bound, and the
+  // runner would hold for days. The five-hour boundary is the one that recurs,
+  // so the cap allows its budget again each window — bounded, and it recovers.
   const derivedSince = derived
-    ? Math.min(...[g.fiveHour, g.sevenDay].filter((w) => w && w.derived).map((w) => w.observedAt))
+    ? Math.max(...[g.fiveHour, g.sevenDay].filter((w) => w && w.derived).map((w) => w.observedAt))
     : null;
   return { go: true, unknown: false, sleepUntil: null, derived, derivedSince, reason: `headroom (${bits.join(', ')}; ${detail})` };
 }

package/modules/grading/grader-subagent.js

@@ -16,6 +16,14 @@ const { DEFAULT_GRADER_MODEL, api } = require('./grader-config.js');
 // through it; the Claude spawn is its default provider.
 const modelProvider = require('./model-provider.js');
 
+// toolsArgForSpawn — pure, exported so tests/grader_subagent_tools_arg.mjs can
+// pin it without a real spawn. See runClaudeCli's WIN32 EMPTY-ARG TRAP comment
+// for the why: only an explicit empty request ('') needs the win32 rewrite —
+// any other value (including the 'Read' default) passes through untouched.
+function toolsArgForSpawn(tools, { shell }) {
+  return tools === '' && shell ? '""' : tools;
+}
+
 // The `claude -p` spawn — the anthropic-cli ModelProvider. Body unchanged by
 // task 1002840; only its name moved, so runSubagent could become the port.
 function runClaudeCli({ prompt, opts = {} }) {
@@ -53,12 +61,38 @@ function runClaudeCli({ prompt, opts = {} }) {
     // 21 extra tools on the owner's Mac, a docs connector that can delete documents
     // among them — inside a session with no permission prompts, reading a diff
     // someone else wrote. Strict mode with no `--mcp-config` loads zero servers.
+    //
+    // `opts.tools` (task 1001691): every caller so far needed exactly `Read` (a
+    // panel worker judges a diff bundle it must be able to open), so that stayed
+    // the hardcoded default — but a caller with NOTHING to read (the ADR 0101
+    // relevance judge classifies one self-contained prompt string) can request
+    // `''`, which the CLI documents (`--help`, verified against the installed
+    // binary) as disabling every built-in tool outright — a stronger guarantee
+    // than any cwd/permission-mode narrowing: with no tool at all, a jailbroken
+    // reply has no channel to read a file back through, on this host or any
+    // other, absolute path or not.
+    //
+    // WIN32's EMPTY-ARG TRAP (round-4 hacker finding, empirically reproduced):
+    // this spawn runs `shell: true` on win32 (below, for the claude.cmd shim),
+    // and Node's shell path joins argv with spaces before handing the line to
+    // cmd.exe — an empty-string element is silently DROPPED in that join, so a
+    // bare `''` here would shift every arg after it, and the CLI would read
+    // `--strict-mcp-config` as `--tools`'s value: the exact opposite of "no
+    // tools", reopening this very hole. The two-character string `'""'` (an
+    // explicit empty-quoted token) survives the cmd.exe → CRT argv parse as a
+    // genuine empty string — the standard Windows shell workaround, verified
+    // with a real spawn (`node -e` reading back its own argv) before landing
+    // this fix. On POSIX, `shell: false` means these args reach `execve()`
+    // directly with no shell in between, so the quoting would NOT be
+    // interpreted — a plain `''` there stays a plain empty string.
+    const usesShell = process.platform === 'win32';
+    const tools = toolsArgForSpawn(opts.tools ?? 'Read', { shell: usesShell });
     const args = [
       '-p',
       '--print',
       '--model', model,
       '--output-format', 'json',
-      '--tools', 'Read',
+      '--tools', tools,
       '--strict-mcp-config',
       '--disable-slash-commands',
       '--permission-mode', permissionMode,
@@ -74,7 +108,7 @@ function runClaudeCli({ prompt, opts = {} }) {
       // shell:false (the default, and the proven-working path). args carry no
       // user input (the prompt goes in via stdin), so shell injection is a
       // non-issue. windowsHide suppresses the transient console window.
-      shell: process.platform === 'win32',
+      shell: usesShell,
       windowsHide: true,
       // MAS Phase 3 (#427): mark this child as a subagent so the Conductor
       // UserPromptSubmit hook (.claude/hooks/conductor.js) bails instead of
@@ -318,4 +352,5 @@ module.exports = {
   extractCostUsd,
   runSubagent,
   runSubagentCached,
+  toolsArgForSpawn,
 };

package/modules/grading/grader-workers/reader.js

@@ -26,12 +26,68 @@
 //
 // THE STANDARD IS WRITTEN DOWN. docs/voice.md (task 1003976) is the rubric, and
 // its own rule is that a finding citing no rule id is not a finding. The guide
-// splits HARD rules (V1-V5, checkable — a lens may assert a break) from
-// JUDGEMENT rules (V6-V11, recognisable but not provable — a lens may only FLAG
+// splits HARD rules (Part A, checkable — a lens may assert a break) from
+// JUDGEMENT rules (Part B, recognisable but not provable — a lens may only FLAG
 // a candidate and must quote the line). That split is reproduced in the prompt
 // below, because it is what keeps an advisory lens from recording taste as fact.
-
+//
+// THE SPLIT IS READ FROM THE GUIDE, not restated (task 1004075). The prompt used
+// to carry the ranges as literals (V1-V5 / V6-V11), so a twelfth rule, or
+// splitting V4, fell outside both ranges in the only automated consumer and the
+// lens was silently handed the wrong contract: the guide's own Part D says it
+// grows by adding rules, and it could not without editing this file.
+// voiceRuleClasses() reads the ids under "# Part A" and "# Part B" at load; if
+// the guide cannot be read, the prompt names the two Parts instead of numbers,
+// which is still true. tests/grader_reader_lens.mjs fails when a rule id in the
+// guide sits under neither Part.
+
+const fs = require('fs');
+const path = require('path');
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
+
+const VOICE_GUIDE = path.join(__dirname, '..', '..', '..', 'docs', 'voice.md');
+
+// The rule ids under each Part of the guide, in file order. A rule heading is
+// "## V<n> — ...". Anything under neither Part A nor Part B is returned as
+// unclassified, which the test refuses: every rule must be one or the other.
+function voiceRuleClasses(text) {
+  const out = { hard: [], judgement: [], unclassified: [] };
+  let part = null;
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const top = /^# Part ([A-Z])\b/.exec(line);
+    if (top) { part = top[1]; continue; }
+    if (/^# /.test(line)) { part = null; continue; }
+    const rule = /^## (V\d+)\b/.exec(line);
+    if (!rule) continue;
+    (part === 'A' ? out.hard : part === 'B' ? out.judgement : out.unclassified).push(rule[1]);
+  }
+  return out;
+}
+
+// "V1-V5", "V6-V11, V13": contiguous runs collapse so the prompt reads as it did.
+function formatRuleIds(ids) {
+  const nums = [...new Set(ids.map((id) => Number(String(id).slice(1))))].filter(Number.isInteger).sort((a, b) => a - b);
+  const runs = [];
+  for (const n of nums) {
+    const last = runs[runs.length - 1];
+    if (last && n === last[1] + 1) last[1] = n; else runs.push([n, n]);
+  }
+  return runs.map(([a, b]) => (a === b ? `V${a}` : `V${a}-V${b}`)).join(', ');
+}
+
+// What the prompt says in the brackets for each class. Falls back to naming the
+// Part when the guide is unreadable or a Part is empty: never a stale number.
+function ruleIdsText(classes) {
+  const hard = classes && classes.hard.length ? formatRuleIds(classes.hard) : 'every rule under "Part A — Hard rules"';
+  const judgement = classes && classes.judgement.length ? formatRuleIds(classes.judgement) : 'every rule under "Part B — Judgement rules"';
+  return { hard, judgement };
+}
+
+function readVoiceClasses() {
+  try { return voiceRuleClasses(fs.readFileSync(VOICE_GUIDE, 'utf8')); } catch { return null; }
+}
+
+const RULE_IDS = ruleIdsText(readVoiceClasses());
 const { parseCommon } = require('./worker-verdict');
 const { extractJson } = require('./extract-json');
 
@@ -59,8 +115,8 @@ Your ONLY job is user-facing copy. You do NOT score whether the description was
 
 The guide splits its rules in two, and the split governs what you may say:
 
-- **Hard rules (V1-V5)** can be checked. A line either breaks one or it does not. You MAY assert a break.
-- **Judgement rules (V6-V11)** name a failure a person can recognise but a checker cannot prove. You may **flag a candidate** and must quote the line and the rule id. You may NEVER assert that the line is wrong. The artist decides.
+- **Hard rules (${RULE_IDS.hard})** can be checked. A line either breaks one or it does not. You MAY assert a break.
+- **Judgement rules (${RULE_IDS.judgement})** name a failure a person can recognise but a checker cannot prove. You may **flag a candidate** and must quote the line and the rule id. You may NEVER assert that the line is wrong. The artist decides.
 
 Set \`kind\` on every issue to \`"break"\` (hard rule, asserted) or \`"flag"\` (judgement rule, offered). A judgement-rule issue filed as a break is the single most damaging thing you can do here, because it records taste as fact.
 
@@ -213,6 +269,10 @@ module.exports = {
   ADVISORY_VERDICT,
   PROMPT_HEADER,
   buildPrompt,
+  voiceRuleClasses,
+  formatRuleIds,
+  ruleIdsText,
+  VOICE_GUIDE,
   extractJson,
   computeVerdict,
 };

package/modules/hall-ui/public/approval-queue.css

@@ -63,9 +63,16 @@ html[data-theme="dark"] .aq-overlay { --aq-scrim: rgba(4, 5, 9, .42); }
 .aq-overlay[hidden] { display: none; }
 html.aq-open { overflow: hidden; }
 
+/* FITS THE SCREEN (task 1004381). The artboard's 1180 by 820 is a ceiling, never
+   a floor: the dialog is also capped by the VIEWPORT (less the 24px gutters), not
+   only by its overlay, so no ancestor that becomes the fixed overlay's containing
+   block can make it wider or taller than the screen. Inside, the rendered page
+   shrinks first; the words column only narrows once the page is small. */
 .aq-dialog {
-  width: min(1180px, 100%);
-  height: min(820px, 100%);
+  width: min(1180px, 100%, calc(100vw - 48px));
+  height: min(820px, 100%, calc(100vh - 48px));
+  height: min(820px, 100%, calc(100dvh - 48px));
+  min-width: 0;
   box-sizing: border-box;
   padding: 26px 30px;
   border-radius: 30px;
@@ -86,8 +93,9 @@ html.aq-open { overflow: hidden; }
 /* The header row. */
 .aq-head {
   display: flex;
+  flex-wrap: wrap;
   align-items: center;
-  gap: 14px;
+  gap: 10px 14px;
   min-width: 0;
 }
 .aq-eyebrow {
@@ -104,7 +112,9 @@ html.aq-open { overflow: hidden; }
   font-weight: 300;
   line-height: 1.3;
   color: var(--aq-ink);
+  flex: 0 1 auto;
   min-width: 0;
+  overflow-wrap: anywhere;
 }
 .aq-title__sub { font-size: 14px; color: var(--aq-ink-dim); }
 .aq-head__gap { margin-left: auto; }
@@ -143,6 +153,7 @@ html.aq-open { overflow: hidden; }
 .aq-body {
   flex-grow: 1;
   min-height: 0;
+  min-width: 0;
   display: flex;
   gap: 16px;
 }
@@ -172,8 +183,10 @@ html.aq-open { overflow: hidden; }
   color: var(--aq-paper-ink);
 }
 .aq-lines {
-  width: 300px;
+  /* 300px, the artboard's, until the page beside it has shrunk; then down to 240. */
+  width: clamp(240px, 32%, 300px);
   flex: none;
+  min-width: 0;
   min-height: 0;
   overflow-y: auto;
   display: flex;
@@ -197,15 +210,28 @@ html.aq-open { overflow: hidden; }
   text-transform: uppercase;
   color: var(--aq-ink-faint);
 }
-.aq-line__text { font-size: 15px; line-height: 1.5; color: var(--aq-ink); }
+.aq-line__text { font-size: 15px; line-height: 1.5; color: var(--aq-ink); overflow-wrap: anywhere; }
 .aq-mark { background: var(--aq-mark); color: var(--aq-ink); border-radius: 4px; padding: 0 3px; }
-.aq-line__aside { font-size: 13px; line-height: 1.45; color: var(--aq-ink-faint); }
+/* A brand hole ({{productName}}) shown as the name it stands for: a fixed name
+   the artist did not write and cannot rewrite, so a quiet chip (task 1004381). */
+.aq-hole {
+  display: inline-block;
+  padding: 0 6px;
+  border-radius: 6px;
+  border: 1px solid var(--aq-glass-edge);
+  background: var(--aq-pill-on);
+  color: inherit;
+  line-height: 1.35;
+  white-space: nowrap;
+}
+.aq-line__aside { font-size: 13px; line-height: 1.45; color: var(--aq-ink-faint); overflow-wrap: anywhere; }
 .aq-line--refused .aq-line__aside { color: var(--aq-link); }
 .aq-lines__none { margin: 0; font-size: 14px; color: var(--aq-ink-faint); }
 
 /* The decision row. */
 .aq-foot {
   display: flex;
+  flex-wrap: wrap;
   align-items: center;
   gap: 12px;
   min-height: 48px;
@@ -267,7 +293,7 @@ html.aq-open { overflow: hidden; }
   .aq-overlay { padding: 8px; align-items: stretch; --aq-scrim: rgba(4, 5, 9, .88); }
   html[data-theme] .aq-overlay,
   html:not([data-theme]) .aq-overlay { --aq-scrim: rgba(4, 5, 9, .88); }
-  .aq-dialog { height: 100%; padding: 18px 16px; border-radius: 22px; overflow-y: auto; gap: 14px; }
+  .aq-dialog { width: min(100%, calc(100vw - 16px)); height: min(100%, calc(100dvh - 16px)); padding: 18px 16px; border-radius: 22px; overflow-y: auto; gap: 14px; }
   .aq-dialog > * { flex-shrink: 0; }
   .aq-head { flex-wrap: wrap; row-gap: 10px; }
   .aq-eyebrow { order: 1; flex: 1 1 auto; }

package/modules/hall-ui/public/approval-queue.js

@@ -28,6 +28,9 @@
   'use strict';
 
   const L = window.OTBApprovalQueueLib;
+  // A page's brand holes ({{productName}}) read as the name they stand for, in a
+  // chip (brand-holes.js, task 1004381). Escaped text when it is not loaded.
+  const H = window.OTBBrandHoles || null;
 
   function esc(s) {
     return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
@@ -137,14 +140,18 @@
       return `${moved}<img class="aq-render aq-render--${esc(pick.device)}" src="${esc(pick.url)}" alt="${esc(alt)}">`;
     }
 
+    function words(text) {
+      return H ? H.holesHtml(text, { cls: 'aq-hole' }) : esc(text);
+    }
+
     function linesHtml(item) {
       const rows = (item.lines || []).map((l) => L.lineRow(l, state.view.phase));
       if (!rows.length) return '<p class="aq-lines__none">This round changed no lines.</p>';
       return `<ol class="aq-lines__list">${rows.map((r) => `
         <li class="aq-line${r.refused ? ' aq-line--refused' : ''}">
           ${r.section ? `<span class="aq-line__section">${esc(r.section)}</span>` : ''}
-          <span class="aq-line__text">${r.marked ? `<mark class="aq-mark">${esc(r.text)}</mark>` : esc(r.text)}</span>
-          <span class="aq-line__aside">${esc(r.aside)}</span>
+          <span class="aq-line__text">${r.marked ? `<mark class="aq-mark">${words(r.text)}</mark>` : words(r.text)}</span>
+          <span class="aq-line__aside">${words(r.aside)}</span>
         </li>`).join('')}</ol>`;
     }
 

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>