@bongos/core 1.19.1080 → 1.20.1

package/modules/hall-ui/public/settings.html

@@ -5,6 +5,9 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Settings — {{worldName}}</title>
   <meta name="description" content="Your preferences — connections, access keys, skill voices, and sounds.">
+  <!-- the hub's origin, stamped server-side (task 1004259): the Profile and
+       privacy row links to its account page. Empty on an instance with no hub. -->
+  <meta name="hub-origin" content="{{hubOrigin}}">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -88,37 +91,23 @@
               <p class="section-note">Saves when you press Save; shows everywhere at once.</p>
             </section>
 
-            <!-- Cross-project record (platform-identity module, ADR 0171 / task 1002279).
-                 Revealed only when the module's own endpoint answers; hidden on a
-                 vanilla instance. P04 later moves this into the Profile rail group. -->
-            <section class="scroll" id="cross-project-scroll" aria-labelledby="cross-project-h" data-group="account" hidden>
-              <h2 id="cross-project-h" class="scroll__h">Cross-project record</h2>
+            <!-- PROFILE AND PRIVACY — one link out to the hub's account page
+                 (task 1004259, ADR 0337 D4.3). Handle, bio, links, public/private,
+                 recruiters and the hide-my-numbers switch belong to the platform
+                 account, so they are edited once on the hub; this hall carried the
+                 privacy half as two sections ("Cross-project record", "Profile
+                 privacy") and now only points there. settings.js sets the href from
+                 the hub-origin meta and reveals the row; with no hub (a vanilla
+                 instance) it stays hidden. -->
+            <section class="scroll" id="account-hub-scroll" aria-labelledby="account-hub-h" data-group="account" hidden>
+              <h2 id="account-hub-h" class="scroll__h">Profile and privacy</h2>
               <p class="scroll__lede">
-                Your track record across every project you build on, shown on your
-                public profile. Hiding it takes effect immediately everywhere —
-                your profile, the recruiting directory, and a recruiter's look-up of one builder.
+                Your handle, bio and links, whether your profile page is public,
+                whether recruiters can find you, and whether your record shows are
+                part of your account across every project — so you change them in
+                one place, on your account page.
               </p>
-              <div id="cross-project-rows"></div>
-              <p class="settings-status" id="cross-project-status" role="status" aria-live="polite"></p>
-            </section>
-
-            <!-- Profile privacy (platform-identity module, privacy spec D1 / task
-                 1002966). The same own-scoped GET/PATCH /me/cross-project as the
-                 section above, so it reveals and hides with it; P04 later moves
-                 both into the Profile rail group. -->
-            <section class="scroll" id="privacy-scroll" aria-labelledby="privacy-h" data-group="account" hidden>
-              <h2 id="privacy-h" class="scroll__h">Profile privacy</h2>
-              <p class="scroll__lede">
-                Who can find you. Your profile page can be public or private, and
-                recruiters looking for builders are allowed in separately — so a
-                private profile can still be reachable for work, and a public one
-                can stay out of recruiting entirely.
-              </p>
-              <div id="privacy-rows"></div>
-              <p class="settings-status" id="privacy-status" role="status" aria-live="polite"></p>
-              <p class="section-note">Your profile page setting applies now — private already answers "not found"
-                everywhere your profile is read. Recruiter discoverability applies now too — switching
-                it off removes you from both recruiting surfaces immediately, and back on puts you there again.</p>
+              <div class="row-end"><a class="pbtn" id="account-hub-link" href="/account">Open your account page</a></div>
             </section>
 
             <!-- CRAFT — discipline preferences (GET /me, PATCH /me/disciplines). -->
@@ -407,7 +396,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/settings.js

@@ -485,179 +485,23 @@
     }
   }
 
-  // ---- section: CROSS-PROJECT RECORD (hide flag — ADR 0171 D4, task 1002279)
+  // ---- section: PROFILE AND PRIVACY — a link out to the hub (task 1004259)
   //
-  // GET/PATCH /api/bongos/me/cross-project (platform-identity module — hub only).
-  // One on/off toggle: "show my cross-project record on my public profile".
-  // Enforcement is server-side in the module's read functions, so flipping it
-  // takes effect immediately on the profile and /scouting. The section
-  // reveals ONLY when the module's endpoint answers (404 on a vanilla instance →
-  // stays hidden, no error state). P04 later re-homes this in the Profile rail
-  // group; storage is account-global on the hub (not behavior_prefs).
-  function renderCrossProject(data) {
-    const wrap = $('#cross-project-rows');
-    if (!wrap) return;
-    const hidden = !!(data && data.hide_stats);
-    const on = !hidden; // the toggle reads as "shown"
-    const cp = data && data.cross_project;
-    const totals = cp && cp.totals ? cp.totals : null;
-    const totalsLine = totals
-      ? `Your record: ${totals.projects} project${totals.projects === 1 ? '' : 's'} · ` +
-        `${totals.credits} credits · ${totals.works_shipped} works shipped · ${totals.karma} karma.`
-      : 'No cross-project activity reported yet.';
-    const consentNote = data && data.profile_state !== 'active'
-      ? ' Your profile publishes after your next sign-in at the hub.'
-      : '';
-    wrap.innerHTML =
-      '<div class="sound-row" data-cross-project="hide">' +
-      '<div class="sound-row__text">' +
-      '<div class="sound-row__label">Show my cross-project record</div>' +
-      `<div class="sound-row__desc">${escapeHtml(totalsLine + consentNote)} You always see your own numbers here.</div>` +
-      '</div>' +
-      switchHtml(on, 'Show my cross-project record') +
-      '</div>';
-  }
-
-  // ---- section: PROFILE PRIVACY (account_visibility + recruiter_discoverable
-  // — privacy spec D1/D3, task 1002966)
-  //
-  // Two more rows on the SAME own-scoped GET/PATCH /me/cross-project, because
-  // both flags live on the hub account beside hide_stats (never behavior_prefs).
-  // The recruiter row's copy must name EXACTLY what being discoverable grants —
-  // the spec's D3 sliver — and that grant shrinks to name-only when the
-  // cross-project record is hidden, because the rest of the sliver is derived
-  // from it. `recruiter_discoverable` is tri-state server-side: null means the
-  // answer follows the visibility setting, which the row says out loud. The
-  // toggle is deliberately BINARY (spec D1: "one column, one settings toggle");
-  // resetting back to null stays an API affordance, not a third UI state.
-  //
-  // COPY RULE — a toggle may promise exactly what is enforced, and BOTH rows now
-  // are, one task apart. VISIBILITY went live with task 1002967: every public
-  // read joins the shared effective-visibility predicate, so private really does
-  // 404 — including to the owner, which the row must say out loud: a page that
-  // vanishes for you too is surprising unless you are told where your record went
-  // (here, Settings). DISCOVERABILITY went live in two halves: task 1002290 (the People directory)
-  // and task 1002968 (the D3 pre-accept sliver). BOTH recruiting reads now join
-  // the reach axis — listScoutingRollup via scoutingListableSql, the sliver via
-  // recruiterSliverVisibleSql — so the row may finally name both, which is exactly
-  // what 1002290 narrowed it away from while the second surface was unbuilt. The
-  // wider claim is CHECKABLE rather than open-ended: account_privacy_flags.mjs
-  // pins that the recruiting surface has exactly those two reads and that each one
-  // joins reach, so a third would red the guard before this sentence could quietly
-  // become false.
-  function renderPrivacy(data) {
-    const wrap = $('#privacy-rows');
-    if (!wrap) return;
-    const isPublic = !data || data.account_visibility !== 'private';
-    const discoverable = !!(data && data.recruiter_discoverable_effective);
-    const follows = !data || data.recruiter_discoverable == null;
-    const grant = data && data.hide_stats
-      ? 'Because your cross-project record is hidden, they will see your name and your picture, and nothing else.'
-      : 'They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on.';
-    // The surprising half, and only where it applies: a private profile answers
-    // "not found" to every visitor, and this one switch is the exception.
-    const despitePrivate = isPublic ? ''
-      : ' This is the one thing a recruiter can see while your profile page is private.';
-    wrap.innerHTML =
-      privacyRow('visibility', 'Public profile page', isPublic ? 'Public' : 'Private', isPublic,
-        'Public means anyone can open your profile page and find you by name. Private hides the page from everyone — including you: it answers "not found" to every visitor, and you read your own record here in Settings instead.', '') +
-      privacyRow('discoverable', 'Discoverable by recruiters', discoverable ? 'On' : 'Off', discoverable,
-        `Recruiters looking for builders can find you. ${grant}${despitePrivate} Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter's look-up of one builder — straight away.`,
-        follows ? ' <span class="voices__default">· follows your profile setting</span>' : '');
-  }
-
-  // One row of the privacy section, in the same sound-row markup every toggle on
-  // this page uses. `note` is trusted markup (a caller-supplied span), the label
-  // and description are escaped.
-  function privacyRow(key, label, state, on, desc, note) {
-    return `<div class="sound-row" data-privacy="${key}">` +
-      '<div class="sound-row__text">' +
-      `<div class="sound-row__label">${escapeHtml(label)}<span class="prow__tag">${escapeHtml(state)}</span>${note}</div>` +
-      `<div class="sound-row__desc">${escapeHtml(desc)}</div>` +
-      '</div>' +
-      switchHtml(on, `${label}: ${state}`) +
-      '</div>';
-  }
-
-  // The status/toast line for a privacy toggle. Deliberately says only what the
-  // flag itself changed — the exact grant lives in the row's description, which
-  // re-renders from the server right after the save.
-  function privacyMsg(key, on) {
-    if (key === 'visibility') {
-      return on
-        ? 'Saved — your profile page is set to public.'
-        : 'Saved — your profile page is set to private.';
-    }
-    return on
-      ? 'Saved — recruiters can find you.'
-      : 'Saved — you are out of the recruiting surfaces.';
-  }
-
-  // PATCH any own-scoped privacy flag (routes/profile.js): { hide_stats } and/or
-  // { account_visibility, recruiter_discoverable }. Always re-reads afterwards —
-  // the effective recruiter answer is derived server-side, so the server's own
-  // view is the only state worth rendering.
-  async function savePrivacy(body, statusSel, msg, btn) {
-    const status = $(statusSel);
-    if (status) status.textContent = 'Saving…';
-    if (btn) btn.disabled = true;
-    try {
-      const res = await api.request('PATCH', `${API}/me/cross-project`, { body });
-      if (res.status === 401) { toAuth(); return; }
-      if (!res.ok) throw new Error(`cross-project PATCH → ${res.status}`);
-      await loadCrossProject(); // re-render from the server's truth (flags + record)
-      if (status) status.textContent = msg;
-      toast(msg);
-    } catch (err) {
-      console.error('[settings] save privacy failed', err);
-      if (status) status.textContent = 'Could not save. Try again.';
-      toast('Could not save your privacy preference. Try again.');
-      if (btn) btn.disabled = false;
-    }
-  }
-
-  // The hide flag. Body: { hide_stats: <bool> } (routes/profile.js).
-  function saveCrossProject(hide, btn) {
-    return savePrivacy({ hide_stats: hide }, '#cross-project-status', hide
-      ? 'Cross-project record hidden — removed from your profile and directories immediately.'
-      : 'Cross-project record shown on your public profile.', btn);
-  }
-
-  let crossProjectWired = false;
-  async function loadCrossProject() {
-    const section = $('#cross-project-scroll');
-    if (!section) return;
-    try {
-      const res = await api.request('GET', `${API}/me/cross-project`);
-      if (res.status === 401) { toAuth(); return; }
-      if (!res.ok) return; // module off / route absent → the section stays hidden
-      renderCrossProject(res.data);
-      renderPrivacy(res.data);
-      section.hidden = false;
-      const privacy = $('#privacy-scroll');
-      if (privacy) privacy.hidden = false;
-      if (!crossProjectWired) {
-        crossProjectWired = true;
-        $('#cross-project-rows').addEventListener('click', (e) => {
-          const b = e.target.closest('.sound-toggle');
-          if (!b || b.disabled) return;
-          saveCrossProject(b.dataset.on === '1', b); // shown → hide; hidden → show
-        });
-        $('#privacy-rows').addEventListener('click', (e) => {
-          const b = e.target.closest('.sound-toggle');
-          if (!b || b.disabled) return;
-          const row = b.closest('[data-privacy]');
-          const on = b.dataset.on === '1';
-          const body = row && row.dataset.privacy === 'visibility'
-            ? { account_visibility: on ? 'private' : 'public' }
-            : { recruiter_discoverable: !on };
-          savePrivacy(body, '#privacy-status', privacyMsg(row && row.dataset.privacy, !on), b);
-        });
-      }
-    } catch (err) {
-      // Network/parse failure on an optional module section — stay hidden, log only.
-      console.error('[settings] failed to load cross-project', err);
-    }
+  // Handle, bio, links, public/private, recruiters and the hide-my-numbers switch
+  // belong to the PLATFORM account, not to this project (ADR 0337 D4.3), so they
+  // are edited once, on the hub's account page — this hall used to carry the
+  // privacy half as its own two sections, and now carries one row that points
+  // there (the /my-projects precedent: a user-level page that lives on the hub
+  // ships no copy in the hall). The hub's origin comes from OTB.hubOrigin()
+  // (dom-utils.js): a bare https origin, or null on a vanilla instance, which
+  // has no hub and so no row.
+  function loadAccountHub() {
+    const section = $('#account-hub-scroll');
+    const link = $('#account-hub-link');
+    const origin = window.OTB.hubOrigin();
+    if (!section || !link || !origin) return; // no hub → the row stays hidden
+    link.href = `${origin}/account`;
+    section.hidden = false;
   }
 
   // ---- section 2: CRAFT (discipline preferences) ---------------------------
@@ -1215,8 +1059,11 @@
   const PANEL_ANCHORS = {
     'connections': 'connections-scroll',
     'display-name': 'display-name-scroll',
-    'cross-project': 'cross-project-scroll',
-    'privacy': 'privacy-scroll',
+    // task 1004259: the two privacy panels became one link-out row; their old
+    // anchors still land on it (the hall profile links /settings#cross-project).
+    'profile-privacy': 'account-hub-scroll',
+    'cross-project': 'account-hub-scroll',
+    'privacy': 'account-hub-scroll',
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
     'art-key': 'art-key',
@@ -1363,9 +1210,9 @@
     // (Rendering — the card-richness ladder — is settings-render.js, on the same
     // precedent: it became a four-rung picker in task 1002518 and this file is
     // against the 1500-line ratchet.)
-    // Cross-project record (hide flag) — reveals only where the platform-identity
-    // module answers (the hub); silent no-op elsewhere (task 1002279).
-    await loadCrossProject();
+    // Profile and privacy — one row linking out to the hub's account page
+    // (task 1004259); hidden where the page carries no hub origin.
+    loadAccountHub();
     // Image key (per-builder Gemini key, task 1013) — own try/catch; `me` carries
     // the `needs` art_key item that drives the covered/action-needed banner.
     await loadArtKey(me);

package/modules/hall-ui/public/settings.states.json

@@ -7,7 +7,7 @@
   "ignoreRequests": ["/api/(gds|bongos)/"],
   "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed", "Password field"],
   "states": {
-    "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips", "#privacy-rows"] } },
+    "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips"] } },
     "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },
     "preferences": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900]], "expect": { "visible": ["#wander-rows", "#render-rows"] } },
     "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } },

package/modules/hall-ui/public/shell.js

@@ -334,7 +334,7 @@
       // dropped where the module is off — and since task 1004296 it STAYS dropped: /deploy
       // is the platform hall's page alone, and every other hall takes its update from
       // Settings → Software update, whose Update button carries the hub hand-off.
-      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning' },
+      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning render-deploy' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
       // Deploy precedent above); dropped where the provisioning module is not enabled.
@@ -918,7 +918,9 @@
     }
     document.querySelectorAll('#app-sidebar [data-gate]').forEach(function (el) {
       var ok = gateAllows(el.dataset.gate);
-      if (ok && el.dataset.module && !moduleOn(el.dataset.module)) ok = false;
+      // A space-separated list is any-of: the Deploy item is the provisioning door's on the
+      // platform hall and the render-deploy module's on a Render project's hall (task 1004270).
+      if (ok && el.dataset.module && !el.dataset.module.split(' ').some(moduleOn)) ok = false;
       el.hidden = !ok;
     });
     // AFTER the gate loop: applyCounts reads el.hidden, which the loop above is

package/modules/hall-ui/public/studio.css

@@ -109,12 +109,17 @@ html[data-fullscreen="on"] body[data-page="studio"] .fullscreen-toggle {
   inset: 0;
   pointer-events: none;
   z-index: 0;
+  /* On a screen taller than the ~900px artboard the whole scene drops by half
+     the extra height, so it stays centred instead of sitting in the top 700px
+     over a strip of bare floor (task 1004344). Zero at or below the artboard, so
+     the design of record is unchanged there. % is of the room's own height. */
+  --room-drop: max(0px, calc((100% - 900px) / 2));
 }
 .st-room > *,
 .st-window > * { position: absolute; }
 .st-window {
   left: max(calc(50% + 60px), 680px);
-  top: 86px;
+  top: calc(86px + var(--room-drop));
   width: 560px;
   height: 560px;
   box-sizing: border-box;
@@ -151,22 +156,22 @@ html[data-fullscreen="on"] body[data-page="studio"] .fullscreen-toggle {
 .st-light--7 { left: 250px; bottom: 120px; opacity: .5; }
 .st-mullion { left: 264px; top: 0; width: 0; height: 100%; border-left: 12px solid var(--st-frame); }
 .st-floor {
-  left: 0; right: 0; top: 700px; bottom: 0;
+  left: 0; right: 0; top: calc(700px + var(--room-drop)); bottom: 0;
   min-height: 200px;
   background: var(--st-floor);
   border-top: 1px solid var(--st-floor-edge);
 }
 .st-glow {
-  left: calc(50% + 440px); top: 470px; width: 300px; height: 300px;
+  left: calc(50% + 440px); top: calc(470px + var(--room-drop)); width: 300px; height: 300px;
   border-radius: 50%;
   background: radial-gradient(circle, var(--st-glow) 0%, var(--st-glow-out) 65%);
 }
-.st-lamp-stem { left: calc(50% + 570px); top: 560px; width: 6px; height: 140px; background: var(--st-stem); }
-.st-lamp-shade { left: calc(50% + 526px); top: 540px; width: 94px; height: 46px; border-radius: 48px 48px 6px 6px; background: var(--st-shade); }
-.st-mug { left: calc(50% + 340px); top: 650px; width: 46px; height: 52px; border-radius: 0 0 10px 10px; background: var(--st-mug); }
+.st-lamp-stem { left: calc(50% + 570px); top: calc(560px + var(--room-drop)); width: 6px; height: 140px; background: var(--st-stem); }
+.st-lamp-shade { left: calc(50% + 526px); top: calc(540px + var(--room-drop)); width: 94px; height: 46px; border-radius: 48px 48px 6px 6px; background: var(--st-shade); }
+.st-mug { left: calc(50% + 340px); top: calc(650px + var(--room-drop)); width: 46px; height: 52px; border-radius: 0 0 10px 10px; background: var(--st-mug); }
 .st-leaf { border-radius: 50% 50% 0 0; }
-.st-leaf--1 { left: calc(50% + 180px); top: 610px; width: 64px; height: 90px; background: var(--st-leaf-1); }
-.st-leaf--2 { left: calc(50% + 220px); top: 590px; width: 50px; height: 110px; background: var(--st-leaf-2); }
+.st-leaf--1 { left: calc(50% + 180px); top: calc(610px + var(--room-drop)); width: 64px; height: 90px; background: var(--st-leaf-1); }
+.st-leaf--2 { left: calc(50% + 220px); top: calc(590px + var(--room-drop)); width: 50px; height: 110px; background: var(--st-leaf-2); }
 
 /* Everything the artist reads or presses sits above the room. */
 .st-top,
@@ -503,6 +508,7 @@ html.st-open { overflow: hidden; }
    --------------------------------------------------------------------------- */
 @media (max-width: 760px) {
   .studio { padding: 20px 16px 140px; }
+  .st-room { --room-drop: 0px; }
   .st-top { gap: 12px; }
   .st-tally {
     margin-left: 0;

package/modules/hall-ui/public/studio.html

@@ -14,7 +14,7 @@
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
   <link rel="stylesheet" href="/builders/studio.css?v=2026-09-28-tw16">
-  <link rel="stylesheet" href="/builders/approval-queue.css">
+  <link rel="stylesheet" href="/builders/approval-queue.css?v=2026-09-29-aqfix">
 </head>
 <!-- THE STUDIO HOME (task 1003971 / BV2.TW16, goal 1000095; ADR 0341 D2, D5,
      D8 and D11). docs/design/mocks/tweak-mode/Main.dc.html is the master design:
@@ -176,7 +176,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure
@@ -185,8 +185,9 @@
 <script src="/builders/hall-kit.js"></script>
 <!-- The Approval queue panel (task 1004323): its pure rules, then the panel.
      studio.js mounts it with its own WRITE_ROUTES. -->
-<script src="/builders/approval-queue-lib.js"></script>
-<script src="/builders/approval-queue.js"></script>
+<script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>
+<script src="/builders/approval-queue-lib.js?v=2026-09-29-aqfix"></script>
+<script src="/builders/approval-queue.js?v=2026-09-29-aqfix"></script>
 <!-- The page names and the draft body (the tweak editor's pure rules), then
      the studio's own. -->
 <script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw23"></script>

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.css

@@ -30,8 +30,11 @@ body[data-page="goal-map"], body[data-page="thinking"] .sky-stage {
   --face: Manrope, "Segoe UI", system-ui, -apple-system, sans-serif;
 }
 html, body { height: 100%; }
-body[data-page="goal-map"], body[data-page="thinking"] .sky-stage { margin: 0; background: var(--void); color: var(--ink); font-family: var(--face); font-size: 15px; line-height: 1.5; overflow: hidden; -webkit-font-smoothing: antialiased; }
-body[data-page="thinking"] { overflow: hidden; }
+body[data-page="goal-map"], body[data-page="thinking"] .sky-stage { margin: 0; background: var(--void); color: var(--ink); font-family: var(--face); font-size: 15px; line-height: 1.5; overflow: hidden; overflow: clip; -webkit-font-smoothing: antialiased; }
+/* clip, not just hidden (task 1004342): a hidden-overflow box is still scrollable, so
+   focus scrolled the stage sideways to show the footer hint and the whole sky slid
+   left. clip cuts the same pixels and cannot be scrolled; hidden stays as the fallback. */
+body[data-page="thinking"] { overflow: hidden; overflow: clip; }
 :where(body[data-page="goal-map"], .sky-stage) button { font-family: inherit; }
 :where(body[data-page="goal-map"], .sky-stage) a { color: var(--accent); }
 :where(body[data-page="goal-map"], .sky-stage) .lbl { font: var(--label); letter-spacing: .14em; text-transform: uppercase; color: var(--ink-faint); }
@@ -196,7 +199,7 @@ html[data-fullscreen="on"] .sky-stage .top { padding-right: 64px; }
 .obj { display: inline-flex; align-items: center; gap: 9px; border: 0; background: transparent; color: var(--ink-faint); font: var(--label); letter-spacing: .14em; text-transform: uppercase; cursor: pointer; padding: 6px 0; }
 .obj:hover { color: var(--ink); }
 .obj .g { width: 20px; height: 18px; display: grid; place-items: center; }
-.alt { margin-left: auto; text-align: right; color: var(--ink-dim); font: var(--mono); font-variant-numeric: tabular-nums; white-space: nowrap; }
+.alt { margin-left: auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; text-align: right; color: var(--ink-dim); font: var(--mono); font-variant-numeric: tabular-nums; white-space: nowrap; }
 .alt b { color: var(--ink-soft); font-weight: 400; }
 .hint { color: var(--ink-ghost); }
 .time { display: flex; align-items: center; gap: 8px; width: min(360px, 100%); align-self: center; padding: 3px 4px 3px 4px; border-radius: 999px; background: rgba(0,0,0,.45); box-shadow: inset 0 0 0 1px var(--rule-soft); opacity: .8; }

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-09-28-archive"></script>
+<script src="/builders/shell.js?v=2026-09-29-renderdeploy"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor-lib.js

@@ -148,7 +148,88 @@
     return PAGE_ID_RE.test(id) ? id : null;
   }
 
-  const api = { NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
+  // THE CHECK (task 1004385). A line the artist has read and is happy with,
+  // rewritten or not, carries a green check. It is the artist's own place-keeper
+  // and never leaves the browser: the server has no such field. Shift+Enter is
+  // the fast way through a page: check this line, land in the next.
+  const HINT = 'Shift + Enter checks a line and jumps to the next one. It is the quickest way through a page.';
+
+  function nextLineKey(lines, key) {
+    const list = lines || [];
+    const i = list.findIndex((l) => l.key === key);
+    return i >= 0 && i + 1 < list.length ? list[i + 1].key : null;
+  }
+
+  // Only lines still on the page count, so a reading that moved cannot inflate it.
+  function confirmedCount(lines, confirmed) {
+    let n = 0;
+    for (const l of lines || []) if (confirmed && confirmed.has(l.key)) n += 1;
+    return n;
+  }
+
+  function hintText(checked, total) {
+    return `${HINT} ${checked} of ${total} checked.`;
+  }
+
+  // Remembered per page AND reading: a page that changed under the artist has
+  // new lines, and a stale check on L0007 would tick the wrong words.
+  function confirmStoreKey(pageId, readingHash) {
+    return `hall-tweak-checked:${pageId}:${readingHash}`;
+  }
+
+  function parseConfirmed(raw, lines) {
+    const known = new Set((lines || []).map((l) => l.key));
+    let arr = [];
+    try { arr = JSON.parse(raw || '[]'); } catch (_) { arr = []; }
+    return new Set(Array.isArray(arr) ? arr.filter((k) => known.has(k)) : []);
+  }
+
+  // SPLIT VIEW (task 1004386). The live site answers X-Frame-Options: SAMEORIGIN
+  // (set at the proxy in front of the app, not in this repo), so a page on
+  // another host than the editor's cannot be framed: a hall page can, a landing
+  // or status page cannot. For those the split view is a second window docked to
+  // the bottom half of the screen.
+  function canFrame(url, loc) {
+    try { return new URL(url, loc.href || loc.origin).origin === (loc.origin || new URL(loc.href).origin); } catch (_) { return false; }
+  }
+  function splitWindowFeatures(scr) {
+    const s = scr || {};
+    const w = s.availWidth || 1280;
+    const h = s.availHeight || 800;
+    const left = s.availLeft || 0;
+    const top = (s.availTop || 0) + Math.floor(h / 2);
+    return `popup=yes,width=${w},height=${Math.floor(h / 2)},left=${left},top=${top}`;
+  }
+
+  // THE SPLIT BUTTON AND THE DIVIDER (task 1004386, owner-amended). "open the
+  // page" repeats the artist's last choice; the arrow beside it offers both. The
+  // split's size is the share of the window the live page takes, kept between
+  // 20% and 80% so neither half can vanish.
+  const OPEN_WORDS = Object.freeze({ tab: 'open the page ↗', split: 'open in split view' });
+  function openChoice(raw) { return raw === 'split' ? 'split' : 'tab'; }
+  const SPLIT_MIN = 0.2;
+  const SPLIT_MAX = 0.8;
+  const SPLIT_STEP = 0.05;
+  function clampSplit(f) {
+    const n = Number(f);
+    if (f === null || f === undefined || f === '' || !Number.isFinite(n)) return 0.5;
+    return Math.min(SPLIT_MAX, Math.max(SPLIT_MIN, Math.round(n * 100) / 100));
+  }
+  // The divider sits on the frame's top edge, so the page's share is what lies below the pointer.
+  function splitFromPointer(clientY, innerHeight) {
+    if (!(innerHeight > 0)) return 0.5;
+    return clampSplit((innerHeight - clientY) / innerHeight);
+  }
+  // Up grows the live page, down shrinks it: the divider moves with the arrow.
+  function splitFromKey(current, key) {
+    if (key === 'ArrowUp') return clampSplit(clampSplit(current) + SPLIT_STEP);
+    if (key === 'ArrowDown') return clampSplit(clampSplit(current) - SPLIT_STEP);
+    if (key === 'Home') return SPLIT_MIN;
+    if (key === 'End') return SPLIT_MAX;
+    return null;
+  }
+
+  const api = { OPEN_WORDS, openChoice, clampSplit, splitFromPointer, splitFromKey, canFrame, splitWindowFeatures, HINT, nextLineKey, confirmedCount, hintText, confirmStoreKey, parseConfirmed, NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
   if (typeof window !== 'undefined') window.OTBTweakEditor = api;
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
 })();