@bongos/core 1.19.789 → 1.19.790

package/docs/adr/README.md

@@ -384,3 +384,4 @@ This keeps the decision history honest and traceable.
 | 0290 | [**"Disconnect from Bongos entirely" is the owner-initiated exception to retention** ([task 1003249](https://cloudbongos.com/builders#/task/1003249), owner decision 2026-08-24 + this session). ADR 0181 keeps a torn-down project's database, dumps, port and address so "Take it offline" is reversible; this is the separate true delete. Own-scoped + archon override, with the typed name checked SERVER-side (`confirm_slug`); refused while any other run is open (supersedes nothing). The runner tears down, drops the database and its role, erases the dumps by their EXACT nightly filename, removes env/state/checkout/account, forgets the catalog + membership + client rows (new `project.catalog` verb `forget`, both claim rules), and deletes the provisioning row LAST — releasing name, port and address, and keeping every earlier failure retryable. The GitHub repository and any sign-in App are never touched.](0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md) |
 | 0291 | [**The accessibility dimension scores the transcript, so it lives in the session evaluator, not the grader panel** ([task 1002516](https://cloudbongos.com/builders#/task/1002516), clause 4 of criterion `accessibility-fluency-profile`). The task and its sibling task 1003937 both point at `modules/grading/`, but a v4 worker is handed `{ task, valueSummary, diff, changedFiles, … }` and **no transcript** — it judges the change a session produced, never how the builder was spoken to while producing it. The transcript lives in `session_records`, so the dimension does too: `modules/sessions/accessibility.js`, a pure scorer over the digest's per-turn detail, scored SERVER-SIDE at upload (a score the uploader could supply is a score nobody can read; and the SessionEnd hook's 6-second watchdog rules out a second round trip for the profile). Three signals, exactly the three the criterion names. **Profile-relative, and a sanctioned signal is not scored at all** — `engineer` waives jargon + framing, `comfortable` waives terminal-first, `mixed` widens rather than waives, and an all-waived session scores `null`, not a number, so a profile-sanctioned reply cannot score low even in principle; `verbosity` is not an input and every rate is per-1000-characters, so brevity is arithmetically incapable of lowering it. Advisory, gating nothing (ADR 0241's shape). The profile crosses the module boundary as DATA — the route resolves the `builder-settings` kernel port, never a sibling require (ADR 0083), with a test as the tripwire against a value rename. Detectors deliberately undercount (word-bounded jargon, after a substring match fired `ORM` on "format"; a click-path table of UIs that actually exist), because a metric that punishes correct work is what the task itself calls actively harmful. Does NOT answer task 1003937, whose copy/voice lens judges a DIFF and still needs the owner on cost, gate-or-advisory, and what standard to judge against.](0291-the-accessibility-dimension-scores-the-transcript-not-the-diff.md) | grading / sessions / accessibility |
 | 0292 | [**Both install paths stay, and vendoring turns out to be the production one** ([task 1003879](https://cloudbongos.com/builders#/task/1003879), goal 1000090 — public-npm **gate 6**, the decision row held back from gate 5's mechanical cleanup because both candidates were large deletions that could as easily be mistakes). Gate 6 framed the **vendored-tarball path** (~124 refs across `upgrade.js`/`init.js`/`provision-repo.js`/`package-core.js`) as insurance for hosts that cannot reach npm, to be weighed against the AGPL self-host promise. Read that way it loses. **That is not what the code does with it:** `provision-repo.js` resolves the core for every wizard-created project as "a tarball built from THIS CHECKOUT, file:-pinned", with `--registry-core` as the opt-out — vendoring is the production provisioning path, not the fallback, and deleting it breaks project creation. `resolveVendorableCoreTarball`'s three-rung ladder (reuse the control plane's own pinned tarball → pack the core it has INSTALLED → rebuild from source) exists to answer one question a registry install cannot express: *what is the control plane actually running?* Rungs 1 and 2 each name the bug they fixed — empty new repos when the runner is itself a consumer (task 1002275), and "the frozen-old-tarball births" (task 1002706). The owner's input — a checkout routinely runs ahead of the registry — holds, though not via `main`: since publish-on-merge, 136 of the last 300 `main` commits are release bumps, releases land every 9–51 min, and `main`'s `CORE_VERSION` equalled the registry `latest` (1.19.785) when this was written. Provisioning does not provision from `main`; it provisions from the control plane's own tree, and an unmerged branch or a deliberately-held pin exists on the registry at NO version, ever. **Supersedes ADR 0134's "vendored is the default until the registry path is proven end-to-end" clause:** the condition is MET twice over — with a token 2026-07-08 (task 2118 / blocker 71) and tokenless since [ADR 0283](0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md) (`npm pack @bongos/core` from a clean `HOME` fetches 25.5 MB) — and the default stands anyway, for load-bearing reasons rather than for want of proof. Costs accepted with open eyes: ~124 refs, a second install mode every scaffold/upgrade/provision path must keep straight, a Windows-only test failure ([task 1003839](https://cloudbongos.com/builders#/task/1003839)), `refreshStandaloneCorePin`. **Candidate 2 — `@cloudbongos/cli` — also STAYS, on a NEW justification:** task 1003872 was right that the original reason (reaching the board without a private-registry credential) is gone, so it needs one of its own, and the measurement supplies it — 32 files / 0.5 MB / `undici`, versus the core's 2,611 files / 46.4 MB / `express`+`pg`+`pino`. Collapsing it would make `npx` a 46 MB download dragging in a web server and a Postgres driver to print a task list. **Unpublishing was never on the table** (public at 0.1.3, strangers may have installed it); [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) stands with its *rationale* amended — a deliberately small entry point, no longer a private-core workaround. The one real rot the flip left is rung 2's stale "still-private registry package" clause, a comment. **Gate 6 closes keep/keep, no removal task.** Reopens if provisioning ever stops meaning "match the control plane".](0292-both-install-paths-stay-and-vendoring-is-the-production-one.md) | distribution / provisioning |
+| 0293 | [**The owner's deploy door is an INTENT the control plane drains, not a web tier with a shell** ([task 1003159](https://cloudbongos.com/builders#/task/1003159), goal 1000090). The owner, twice in a month: *"I don't think I can make anything live"*, then *"this is above my paygrade"*. Moving a core pin is gate 3 of the release pipeline and the ONLY act that makes shipped work visible to users — and it was reachable from exactly one place: a shell on the control-plane box holding an ssh key. No route, no hall control. An agent could not close the loop either, because the permission classifier blocks a mutating `sudo -u lars` over ssh BY DESIGN — so the gate had no owner-reachable control AND no agent-reachable one, which is a structural mismatch with a platform whose premise is that agents build and the human holds the gates. Measured cost the day it was written: cloudbongos.com served 1.19.754 while 1.19.757, carrying a shipped fix to the claimable-task feed, sat published and unreachable. **Decision: the door is an INTENT the control-plane runner drains** — the seam [ADR 0111](0111-instance-hosting-provisioning-module.md) already built and that provision/teardown/domain-attach/settings-apply/restart already ride; `enqueueIntent` already carries `requested_by`, so the actor requirement is met by the existing shape rather than bolted on. The web tier gains no sudo, no ssh key, no new capability — it gains the ability to ASK. Rejected: giving the web tier sudo (ADR 0043 makes the control plane a separate privilege domain precisely so compromising the HTTP-reachable process does not hand over the box), and a second bespoke queue (another set of claim/settle/retry semantics to get right, when this one's failure modes are already understood in production). **The control plane is enrolled as a SELF ROW** because `provisioning_intents.instance_id` is NOT NULL and the box has never had one — which is exactly why the door had nothing to point at. That same row puts a teardown button one query away from the platform, so `hosting_shape='control-plane'` is a distinct value every destructive leg can refuse BY NAME, and the rule is an ALLOW-list (`core-upgrade`, `restart`) rather than a deny-list of today's destructive actions: a deny-list would admit tomorrow's by omission, and "permitted by omission" here means the platform deleting itself. A partial unique index makes a second self row impossible. Rejected: a nullable `instance_id` meaning "the control plane" (an implicit encoding that reads as a bug at every later call site and silently widens every query assuming the FK holds). **The target version comes from the published registry, never the request** — not tidiness: the release lane mints a git tag BEFORE the npm publish completes (measured 8–13 minutes on 2026-09-16 against ~100s recorded earlier, learnings 1000263/1000266), so a door trusting "whatever main says" would routinely queue a version that does not exist and die on `npm error notarget`. **Two-step preview-then-confirm**, the owner's own call: auto-rollback already guards the bad-release case, this guards the different one — the wrong button. **Archon-gated server-side, no caching** (ADR 0016), with `core_241` giving the ledger an actor and a source, because a privileged action with an unattributed row is not acceptable and the table carried only a free-text note. **Truth is the BOX's `/version`, not the apex** (the apex sits behind pre-launch basic_auth and its HTML rides a CDN, so an apex read reports a stale answer with total confidence). Self-restart is safe for a stated reason rather than an assumed one: the runner and the web service are DIFFERENT systemd units, and a running process keeps the code it already loaded, so an upgrade rewriting the runner's own files takes effect next tick, never mid-run. Tenant instances ride the same queue and are a filed follow-up. What it does NOT do: make deploys automatic — ADR 0137's three gates stand, and this only gives the third a handle.](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) | deploy / authority / provisioning |

package/docs/api/openapi.json

@@ -12032,6 +12032,40 @@
         ]
       }
     },
+    "/provisioning/control-plane": {
+      "get": {
+        "operationId": "get_provisioning_control_plane",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/control-plane",
+        "description": "GET /provisioning/control-plane — \"which row is this platform, and where does it stand?\" The deploy page's first call: the self row is created once by hand at install time, so its id is per-install and nobody's to memorise. Same atom again, so the entrance is no wider than the door it leads to.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/core-upgrade.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/fleet": {
       "get": {
         "operationId": "get_provisioning_fleet",
@@ -12314,6 +12348,100 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/core-upgrade": {
+      "get": {
+        "operationId": "get_provisioning_instances_id_core_upgrade",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/instances/:id/core-upgrade",
+        "description": "GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. GATED THE SAME AS THE POST, deliberately. Reading it discloses the instance's exact core version and how far behind it is, which is a vulnerability-window disclosure — precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview anyone could read would also let an attacker time a request against a known-stale window. The read being no cheaper than the write costs the owner nothing: they hold the atom by construction, because they are the only one who can press the button.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/core-upgrade.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_provisioning_instances_id_core_upgrade",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/core-upgrade",
+        "description": "POST /provisioning/instances/:id/core-upgrade — move the core pin. rank: `core.pin.move` — archon floor AND system:true, so the catalog's own invariant forbids granting it to metic and no custom rank can be handed it without a deliberate, visible edit. BV1.R105 / ADR 0151 is why this is an atom and not `requireRank`: tests/government_require_permission.mjs fails the build on a new requireRank in a modules/*/routes gate. Body: { to: \"1.19.757\" } — and requiring it IS the second step of the two-step the owner asked for (ADR 0293 D4). A request that cannot fire without naming its target cannot fire from a stray click, and \"move to whatever is newest\", resolved at drain time, would be a different act from the one previewed: main moves between the preview and the confirm. What this does NOT check: whether the version is PUBLISHED, and whether the channel policy admits it. Both need the registry, and the only tool that reads it (update-channel.js `listAvailableVersions`) shells out synchronously — it would block the event loop for every other request on this process. It also lives in scripts/gds/, which a module may not require (ADR 0083). The runner enforces both, where it is a CLI and both are free. See ../core-upgrade.js.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/core-upgrade.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/detail": {
       "patch": {
         "operationId": "patch_provisioning_instances_id_detail",
@@ -23826,7 +23954,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 375,
+  "x-endpoint-count": 378,
   "x-schema-count": 415,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 282,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 375 endpoints across 61 route files.
+> **Generated from the live route files** — the route file is authoritative. 378 endpoints across 62 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -489,10 +489,11 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/projects/featured` | `public` | — | the public map of projects; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: invite a builder into a project (ADR 0141 §5, task #1002115), called by a `project.curate` holder OR the project'… |
 
-## `provisioning` (23)
+## `provisioning` (26)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/provisioning/control-plane` | `archon` | — | GET /provisioning/control-plane — "which row is this platform, and where does it stand?" The deploy page's first call: the self row is cr… |
 | GET | `/api/bongos/provisioning/fleet` | `metic+archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
 | GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. |
 | GET | `/api/bongos/provisioning/github-app/callback` | `public` | — | GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task … |
@@ -501,6 +502,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/provisioning/instances` | `any-builder` | — | GET /provisioning/instances — the caller's own instances + each open intent. |
 | POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `no_address`, `tier`, `onboard_mode`, `type`, `description`, `detail`, `modules` | POST /provisioning/instances — request a new instance. |
 | GET | `/api/bongos/provisioning/instances/:id` | `any-builder` | — | GET /provisioning/instances/:id — read one instance (the manage page's read). |
+| GET | `/api/bongos/provisioning/instances/:id/core-upgrade` | `archon` | — | GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. |
+| POST | `/api/bongos/provisioning/instances/:id/core-upgrade` | `archon` | — | POST /provisioning/instances/:id/core-upgrade — move the core pin. |
 | PATCH | `/api/bongos/provisioning/instances/:id/detail` | `any-builder` | `description`, `detail`, `modules`, `type` | ── The optional project detail (task 1002334, goal 1000046) ────────────── PATCH /provisioning/instances/:id/detail — answer (or re-answe… |
 | POST | `/api/bongos/provisioning/instances/:id/disconnect` | `any-builder` | `confirm_slug` | POST /provisioning/instances/:id/disconnect — rank: any authenticated builder (own resource); an archon may disconnect any project. |
 | POST | `/api/bongos/provisioning/instances/:id/domain` | `any-builder` | `domain` | POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domai… |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1776 strings** across 3 surfaces · 1535 distinct pieces of copy · 1776 certain, 0 heuristic · 167 shown in more than one place.
+**1793 strings** across 3 surfaces · 1549 distinct pieces of copy · 1793 certain, 0 heuristic · 169 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 82 | 1286 |
+| `builders-hall` | `modules/hall-ui/public` | 84 | 1303 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 390 |
 
@@ -39,12 +39,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0fbe47b01d2c` | 9x | Reading the project… | modules/public-landing/public/projects.html:706, modules/public-landing/public/projects.html:743, modules/public-landing/public/projects.html:757 |
 | `8c234d5c8bd4` | 8x | Could not save. Try again. | modules/hall-ui/public/settings-interaction.js:96, modules/hall-ui/public/settings-render.js:108, modules/hall-ui/public/settings.js:103 |
 | `eeda19200aeb` | 7x | Cloud Bongos | modules/public-landing/public/projects.html:399, modules/public-landing/public/projects.html:501, modules/public-landing/public/projects.html:546 |
+| `9a685b01e2c6` | 6x | This page opens at a higher rank. | modules/hall-ui/public/deploy.html:31, modules/hall-ui/public/gate.html:37, modules/hall-ui/public/government.html:37 |
 | `5df2baabf82e` | 6x | ← Back | modules/public-landing/public/projects.html:1067, modules/public-landing/public/projects.html:1098, modules/public-landing/public/projects.html:1137 |
 | `afe83bbbd0d4` | 5x | A non-profit, capture-resistant commons. | modules/public-landing/public/contact.html:71, modules/public-landing/public/index.html:900, modules/public-landing/public/privacy.html:80 |
 | `c661548d5140` | 5x | Next → | modules/public-landing/public/projects.html:1068, modules/public-landing/public/projects.html:1101, modules/public-landing/public/projects.html:1140 |
 | `cbfdd6ac4ec8` | 5x | Open source (AGPL-3.0) | modules/public-landing/public/contact.html:71, modules/public-landing/public/index.html:900, modules/public-landing/public/privacy.html:80 |
 | `0887725744f2` | 5x | Restricted. | modules/hall-ui/public/board-room.js:433, modules/hall-ui/public/gate.js:219, modules/hall-ui/public/government.js:879 |
-| `9a685b01e2c6` | 5x | This page opens at a higher rank. | modules/hall-ui/public/gate.html:37, modules/hall-ui/public/government.html:37, modules/hall-ui/public/harbor.html:37 |
 | `4d8ee7d68974` | 5x | task {…} | modules/hall-ui/public/gate.js:142, modules/hall-ui/public/hall-render.js:623, modules/hall-ui/public/idea.js:207 |
 | `90a128c97eae` | 4x | Builders' hall | modules/public-landing/public/index.html:906, modules/public-landing/public/projects.html:550, modules/public-landing/public/projects.html:550 |
 | `bd315dd71ea7` | 4x | Built by agents, on Cloud Bongos. | modules/public-landing/public/contact.html:71, modules/public-landing/public/index.html:900, modules/public-landing/public/privacy.html:80 |
@@ -76,9 +76,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `22825067f4c5` | 2x | 1 builder | modules/public-landing/public/index.html:747, modules/public-landing/public/index.html:752 |
 | `3e5a62bc4887` | 2x | A GitHub username is needed. | modules/hall-ui/public/hall-render.js:377, modules/hall-ui/public/watch.js:311 |
 | `996edffc1966` | 2x | Access requests | modules/hall-ui/public/watch.html:46, modules/hall-ui/public/watch.html:61 |
-| … | | _127 more in the JSON registry_ | |
+| … | | _129 more in the JSON registry_ | |
 
-## `builders-hall` — 1286 strings
+## `builders-hall` — 1303 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -368,6 +368,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `24013a074724` | certain | Custom rank | `modules/hall-ui/public/government.html:113` |
 | `6744aed3d15e` | certain | Dated exploit-detail engagement reports — kept out of the repo (threat-model §6.3) and served only to Archons. | `modules/hall-ui/public/watch.html:138` |
 | `7c6891813679` | certain | Default ({…}) | `modules/hall-ui/public/settings.js:65` |
+| `7ec7dc1adaa6` | certain | Deploy — {{worldName}} | `modules/hall-ui/public/deploy.html:6` |
+| `7ec7dc1adaa6` | certain | Deploy — {{worldName}} | `modules/hall-ui/public/deploy.html:6` |
 | `8cac6be8afdf` | certain | Dev box app | `modules/hall-ui/public/settings.html:216` |
 | `d784d7a258ec` | certain | Dev boxes | `modules/hall-ui/public/harbor.html:47` |
 | `9c37356c3a04` | certain | Dev-box costs | `modules/hall-ui/public/watch.html:94` |
@@ -538,8 +540,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7ee76a958445` | certain | Join requests | `modules/hall-ui/public/goals-render.js:1289` |
 | `b7ab5922126b` | certain | Join-requests to approve | `modules/hall-ui/public/goal-inbox.js:117` |
 | `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:226` |
-| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:457` |
-| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:459` |
+| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:461` |
+| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:463` |
 | `bc779353aa0c` | certain | Karma — peer recognition and approvals, a separate counter from {…}. | `modules/hall-ui/public/profile.js:94` |
 | `de0e1590667f` | certain | Keep all {…} {…} — they are the values the code drops in, and the change cannot land without them. | `modules/hall-ui/public/copy-desk.js:442` |
 | `32d25ef2182d` | certain | Keep box | `modules/hall-ui/public/box-panel.js:164` |
@@ -589,10 +591,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `73677b6839d7` | certain | Looks good | `modules/hall-ui/public/studio.js:161` |
 | `a93ca2841b96` | certain | Mac (Intel) | `modules/hall-ui/public/hall-render.js:779` |
 | `06b4ede3fb58` | certain | Machine principals | `modules/hall-ui/public/government.html:122` |
+| `c4b39de1e478` | certain | Make it live | `modules/hall-ui/public/deploy.js:128` |
 | `6b3d660e0e31` | certain | Map view | `modules/hall-ui/public/atlas.html:46` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/hall-render.js:517` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/profile.js:94` |
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:406` |
+| `6bd456635167` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this instance onto a new | `modules/hall-ui/public/deploy.html:39` |
 | `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:743` |
 | `d3fa05c5e3fe` | certain | Mingle pairs you with someone from another craft. Saying no costs nothing. | `modules/hall-ui/public/collab.html:80` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
@@ -606,6 +610,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1ae18e58fead` | certain | Most recent first. Each load of this page is itself recorded in the audit log. | `modules/hall-ui/public/sessions.js:228` |
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:510` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:103` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:161` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:763` |
 | `31e91ee6ce03` | certain | Name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:768` |
 | `5e8199266a8a` | certain | Name unvouched | `modules/hall-ui/public/watch.js:374` |
@@ -667,6 +673,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:1106` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1006` |
 | `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:543` |
+| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:126` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:242` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:1067` |
 | `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:258` |
@@ -686,7 +693,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `261d123970e8` | certain | Open goal #{…} | `modules/hall-ui/public/roadmap.js:119` |
 | `5f3e0b179839` | certain | Open in Sessions | `modules/hall-ui/public/task.js:443` |
 | `9f55e4674ebb` | certain | Open in the copy desk | `modules/hall-ui/public/studio.js:218` |
-| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:448` |
+| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:452` |
 | `0f0b1e62148d` | certain | Open online environment | `modules/hall-ui/public/box-panel.js:421` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/goals-render.js:401` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/work.js:1143` |
@@ -833,12 +840,14 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `324af64c8b6e` | certain | See all {…} goals {…} | `modules/hall-ui/public/roadmap.js:214` |
 | `a9c398651862` | certain | See the cross-project record | `modules/hall-ui/public/profile-canonical.js:114` |
 | `17d5b5739f46` | certain | See the work board → | `modules/hall-ui/public/hall-render.js:973` |
+| `55cde0774831` | certain | See what would change | `modules/hall-ui/public/deploy.js:91` |
 | `75dc5463facc` | certain | Select at least 2 waiting tasks to copy a parallel-session prompt. | `modules/hall-ui/public/work.js:817` |
 | `a98882faa482` | certain | Select at least 2 waiting tasks to copy a sequential prompt. | `modules/hall-ui/public/work.js:842` |
 | `582bdd9435eb` | certain | Select task {…} for bulk actions | `modules/hall-ui/public/work.js:453` |
 | `d91c8e9be76c` | certain | Select task {…} for bulk claim | `modules/hall-ui/public/goals-render.js:339` |
 | `7e1d54119e08` | certain | Select task {…} for bulk release | `modules/hall-ui/public/work.js:242` |
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:799` |
+| `fcd68c6a21fd` | certain | Serving now | `modules/hall-ui/public/deploy.js:115` |
 | `64a1f055129e` | certain | Session card richness | `modules/hall-ui/public/settings-render.js:83` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:447` |
@@ -869,12 +878,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:275` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:346` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:415` |
-| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:418` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:436` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:593` |
+| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:422` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:440` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:597` |
 | `8ad669ab2565` | certain | Sign out everywhere | `modules/hall-ui/public/settings.html:171` |
 | `ecc12c1dd4de` | certain | Skill voices | `modules/hall-ui/public/settings.html:312` |
-| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:584` |
+| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:588` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:294` |
 | `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:161` |
@@ -894,7 +903,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5831de503015` | certain | Studio — {{worldName}} | `modules/hall-ui/public/studio.html:10` |
 | `5831de503015` | certain | Studio — {{worldName}} | `modules/hall-ui/public/studio.html:10` |
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:88` |
-| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:463` |
+| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:467` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:74` |
 | `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1370` |
 | `dfc967a63d57` | certain | Task lifecycle from backlog to shipped, showing states and transitions and the edge where credits are awarded. | `modules/hall-ui/public/diagrams.html:51` |
@@ -912,7 +921,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fc66e722e33` | certain | Tasks open once you have read the builder primer. | `modules/hall-ui/public/work.html:43` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
-| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:462` |
+| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:466` |
 | `545c59c1deb7` | certain | That is the session you are using right now. Ending it signs you out of this page. | `modules/hall-ui/public/settings-sessions.js:74` |
 | `282c3fa2d456` | certain | That is the wording it already has. Change something, or file a flag instead if you only want to mark it. | `modules/hall-ui/public/copy-desk.js:438` |
 | `c0e28f30524d` | certain | That project's own standing, as reported by that project. | `modules/hall-ui/public/profile.js:314` |
@@ -995,11 +1004,13 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c4a7e427e82c` | certain | This one | `modules/hall-ui/public/settings.html:227` |
 | `c4a7e427e82c` | certain | This one | `modules/hall-ui/public/settings.html:228` |
 | `e54578188187` | certain | This page is for members of the board. | `modules/hall-ui/public/board-room.html:44` |
+| `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/deploy.html:31` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/gate.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/government.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/harbor.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/project-settings.html:36` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:40` |
+| `77e3b8f5318b` | certain | This restarts the platform onto core | `modules/hall-ui/public/deploy.js:103` |
 | `69e8beced2ff` | certain | This sends the idea back to its author. Say why, and which section. | `modules/hall-ui/public/board-room.js:276` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
 | `c9e50a67988a` | certain | This task has shipped and its credits have landed. Neither Ship it nor Confirm is available. | `modules/hall-ui/public/task.js:612` |
@@ -1043,6 +1054,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2dd116d2d817` | certain | What the current wording gets wrong, and what yours does about it. | `modules/hall-ui/public/copy-desk.html:166` |
 | `5f2b989bbf6a` | certain | What this builder has done, seen one craft at a time. | `modules/hall-ui/public/profile.html:134` |
 | `32d675a2b022` | certain | What this rank is for (optional) | `modules/hall-ui/public/government.html:90` |
+| `04b3ff4c4f4c` | certain | What users can see | `modules/hall-ui/public/deploy.html:35` |
 | `1d5bfd09068c` | certain | What you saw | `modules/hall-ui/public/studio.js:161` |
 | `3dade88f0584` | certain | What your box would cost: | `modules/hall-ui/public/box-panel.js:235` |
 | `b8743d16eab8` | certain | What {…} unlocks | `modules/hall-ui/public/hall-render.js:82` |
@@ -1185,6 +1197,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `77ad318bb546` | certain | invited — awaiting their response | `modules/hall-ui/public/goals-render.js:1281` |
 | `af0777cd098b` | certain | is hardcoded back inside this | `modules/hall-ui/public/index.html:56` |
 | `c767b3e07826` | certain | is only the screen; the | `modules/hall-ui/public/diagrams.html:74` |
+| `d0e722302840` | certain | is published and this box is not on it yet. | `modules/hall-ui/public/deploy.js:91` |
 | `aa530bd15088` | certain | itself). The registry stays the single source of truth for what the hall shows; a fitness check (scripts/gds/f | `modules/hall-ui/public/index.html:53` |
 | `9018bf6e99eb` | certain | last used {…} · signed in {…} | `modules/hall-ui/public/settings-sessions.js:46` |
 | `2ce7738b1eb0` | certain | loading goals… | `modules/hall-ui/public/task-detail.js:394` |
@@ -1200,6 +1213,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `86f235ddfe01` | certain | new thread | `modules/hall-ui/public/settings.html:278` |
 | `b9f2e0d43c94` | certain | no clock | `modules/hall-ui/public/government.js:607` |
 | `e02979266baf` | certain | no data | `modules/hall-ui/public/hall-kit.js:761` |
+| `9e194a57d054` | certain | no reading | `modules/hall-ui/public/deploy.js:74` |
 | `33ca71bef112` | certain | no tasks yet | `modules/hall-ui/public/goals-render.js:163` |
 | `739a4bd6bd83` | certain | node scripts/setup-builder.js | `modules/hall-ui/public/hall-render.js:846` |
 | `61f0f4b2f4ab` | certain | not categorised yet | `modules/hall-ui/public/goals-page.js:277` |
@@ -1227,6 +1241,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fb1dad96280` | certain | pending, on the People tab | `modules/hall-ui/public/watch.html:46` |
 | `3b22c5af029b` | certain | rank or above, or that it is your own. | `modules/hall-ui/public/copy-desk.html:47` |
 | `80ddf28baee7` | certain | rank-key (kebab-case) | `modules/hall-ui/public/government.html:82` |
+| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:132` |
 | `f83f0a9d6b6a` | certain | recorded, on the Operations tab | `modules/hall-ui/public/watch.html:49` |
 | `26da1df6fd4a` | certain | reflects it. | `modules/hall-ui/public/settings.html:136` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:84` |
@@ -1323,7 +1338,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `94445e6ed5e8` | certain | {…} · code | `modules/hall-ui/public/pair.js:53` |
 | `d73256fbc395` | certain | {…} · who votes, and how it {…} | `modules/hall-ui/public/board-room.js:357` |
 | `cab2a4296aec` | certain | {…} · {…} · {…}{…} | `modules/hall-ui/public/goal-inbox.js:326` |
+| `d9b4ae2db0f4` | certain | {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:115` |
 | `085f93f3f775` | certain | {…} — see all standings | `modules/hall-ui/public/hall-render.js:80` |
+| `b814cb35ce2f` | certain | {…} — the box this platform runs on | `modules/hall-ui/public/deploy.js:168` |
 | `f75ee96a7511` | certain | {…} — total payout from shipped work. | `modules/hall-ui/public/profile.js:94` |
 | `2a2728a4ec4f` | certain | {…}% of tasks complete | `modules/hall-ui/public/roadmap.js:70` |
 | `15e545eb3ce2` | certain | {…}, no such task | `modules/hall-ui/public/task.js:691` |