@bongos/core 1.21.53 → 1.21.54

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.53",
-  "core_contract": "1.21.53",
-  "source_commit": "1ad7252c18fc56b532f12ded31dd3e89c51c6f94",
+  "core_version": "1.21.54",
+  "core_contract": "1.21.54",
+  "source_commit": "c52f0a2b10e7ae2f29cb32eb889459f19eeb71a8",
   "source_ref": "HEAD",
-  "built_at": "2026-10-04T23:40:31.852Z",
+  "built_at": "2026-10-04T23:57:08.815Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 582,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2932,
+    "functional_verbatim": 2933,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3543,
-  "tree_sha256": "a1a32ad96ab4c3586708781095ace3503dc06f0eabe6c43bf9b6c58d4d51ae03",
+  "file_count": 3544,
+  "tree_sha256": "9ab491c7b8c60e5aa3da3aa41f3c7cda613870f5eaab54cbeb5dbd4ddad408db",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2822,7 +2822,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "459d6bf111e4644831a95374e9d9c9949568a068e96d9f106fe97a882084feeb"
+      "sha256": "b7de27150a5254d894b854f93b1548edabd5389592896c53e851ceca355199e4"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2832,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0811801e6606e17166a198042daf177ce79905d814281948a219794b13075952"
+      "sha256": "f2adf16278e58aca451f80de5e8b116325519472cebc00742a9e63e057c13918"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "8ef17139f7872a73e971bb1feddf3009db0dd5450c2e2e7ae9edf67d18a77154"
+      "sha256": "1fe6cf551a7fe944c86bbbb3b3906a05be4e67d9aceafd17d0ff9a069dca9b40"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6207,12 +6207,12 @@
     {
       "path": "modules/hall-ui/public/street-card.css",
       "mode": "0000644",
-      "sha256": "ebca29688f443dda588fe1f351131199ba325c959f9e5c3c0a4818c0d74cbe0c"
+      "sha256": "7c635571a875b07630ffa2c8ef0b08e4c6f5797f28da45d6e7d7b4dfe086d515"
     },
     {
       "path": "modules/hall-ui/public/street-card.js",
       "mode": "0000644",
-      "sha256": "0e0645f6c1cfcf793e1850b4f81eaa169e8a9fb3214a8e47dd5a25171c8b6d8c"
+      "sha256": "0e7aff2f6d68ea12c9ba18850cd25fffa2d1180305d10de1ed54c9f4d5abd079"
     },
     {
       "path": "modules/hall-ui/public/street-card.states.json",
@@ -6222,7 +6222,7 @@
     {
       "path": "modules/hall-ui/public/street-desk.js",
       "mode": "0000644",
-      "sha256": "9d4fc788d6866b5daf6ee8b43f20aac3b552851f431743e74f617fd9335540e5"
+      "sha256": "62493777a5d35806429f6d1cff05fc5aa4d2b6cf8b4a6d13d4249b63fc108f82"
     },
     {
       "path": "modules/hall-ui/public/street-draw.js",
@@ -6242,12 +6242,12 @@
     {
       "path": "modules/hall-ui/public/street.html",
       "mode": "0000644",
-      "sha256": "1c3ffcf83915d7ae03054370f63969b2f79875743a984dff23d41406c1fda442"
+      "sha256": "3e08c2f7029a7f93cccc373daf0991cd0bf49287e33d3776d1a14eef066f69e2"
     },
     {
       "path": "modules/hall-ui/public/street.js",
       "mode": "0000644",
-      "sha256": "037c550922daab94b112c2f5756f3102780f2270491d9c6ce44981742585132a"
+      "sha256": "dbe8d0d35e5009bc08c3b93414f7268cb8fa8606872a41708f6ee64dc40e39d4"
     },
     {
       "path": "modules/hall-ui/public/street.states.json",
@@ -6467,7 +6467,7 @@
     {
       "path": "modules/hall-ui/records/governor-street.md",
       "mode": "0000644",
-      "sha256": "0a180c91f0f921fff166bafa1783e37422f1b0ebd61f98dcca6dca75659f1f63"
+      "sha256": "c19e1506210e097dcb6799646ff6199e47bc7cce00e89213bb8771cbbf5d29c1"
     },
     {
       "path": "modules/hall-ui/records/hall-navigation.md",
@@ -9902,12 +9902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8b15e4d781eadc340d97c3560c82041a4aa57cbb58d4eab10f5f59c416322833"
+      "sha256": "ab9eb6c2597791f8f2bd504400664bb8d7644c7efaebb4f1150c23541bbb6fbe"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bb7c8427e09006b6a5b748c21cd7161a968d38ef203fa3dd26b4271373a9d553"
+      "sha256": "3d42b7cd6a62c8664f803818e83429dbaca537189f2c7bfb8c155def16eb25e4"
     },
     {
       "path": "public-docs/index.html",
@@ -9927,7 +9927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "dd93db028c64dbaabd38284309255318dcef2d76ad5544c4a73963173715173c"
+      "sha256": "e125c78d3a8ed71b1b2324630e8f837835a6d744953da21e1fdb23b4f20e398e"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12147,7 +12147,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4d56f69a34c4621f423052b91da4d7310a9c33b3b8473a57053cdc2a6c905ffb"
+      "sha256": "032eda2254b90462ff3327b6751c1e8946a6e03f1eb3e8a476fa0cb240552b6e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14557,7 +14557,7 @@
     {
       "path": "tests/hall_street_desk.mjs",
       "mode": "0000644",
-      "sha256": "aa280239073113623d7eb26f09772daefbb2d1dec72dc4ef760454f3e9ef20b0"
+      "sha256": "11aa6b69b820c18d887d26868af580ee35e136a4803111e28f65510f45e41042"
     },
     {
       "path": "tests/hall_street_inside.mjs",
@@ -15834,6 +15834,11 @@
       "mode": "0000644",
       "sha256": "3c85d28ecc55e375988f3e55aee993c8c84220889678262d8207146c2772f3f5"
     },
+    {
+      "path": "tests/privacy_matrix.mjs",
+      "mode": "0000644",
+      "sha256": "c409bf3f72c33086ccd75e65dc019297e38029c71b5bb6bec9ecc08e4c34d929"
+    },
     {
       "path": "tests/probe_cache.mjs",
       "mode": "0000644",

package/docs/file-map.md

@@ -358,6 +358,7 @@ tests/
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 ├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.
+├── privacy_matrix.mjs            ← (task 1002973, goal 1000110, privacy spec D2/D3/D4): THE PRIVACY MATRIX as one table — a fixture account per D2 row (provisional, public shown, public hidden, private, private+discoverable, private+discoverable+hidden, opted out of recruiting) × every viewer (Anon, Builder, Recruiter, Self) × every cross-project surface that exists (`/profiles/:handle`, `/me/cross-project`, `/community/search`, `/community/leaderboard`, `/scouting`, `/scouting/:handle`), asserted against a literal transcription of the spec's cells; then the rules swept across EVERY recorded response (hidden numbers reach nobody but Self, private/provisional are absent, private+discoverable is named only by the sliver), the D3 key lists pinned, and an expired invite refused by the real `hasInvitedAccessRequest`. Real routers + real HTTP over in-memory tables filtered by each statement's own WHERE (boolean structure read, calibrated against the JS twins). The declined-invite row is task 1004444's. DB-free `unit` lane, asserted in the file itself.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```
 

package/docs/module-api-changelog.md

@@ -2933,5 +2933,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.51 with no explicit bump. run 37243572142. (task 1002620)
   1.21.53 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.52 with no explicit bump. run 37244559329. (task 1002620)
+  1.21.54 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.53 with no explicit bump. run 37245549793. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -3078,7 +3078,7 @@
       "surface": "builders",
       "title": "The street",
       "states_read": ["street","fullscreen","card","switched","focus","here","inside-rules","inside-disputes","inside-people","inside-planning","inside-automation","inside-review","inside-release","inside-treasury","floor","amend","district","desk","desk-facts","desk-quiet","desk-people-builders","desk-people-tier","desk-disputes","desk-automation-goals","desk-release-core","desk-rules","desk-planning-priorities","desk-planning-ideas","desk-planning-blockers","pins","pins-pager","sitting","object","voted","admission","settled","blocker","blocker-more","report","report-more","core","core-more","recheck","recheck-more","idea","idea-more","queue","queue-more","automation","automation-more"],
-      "files_hash": "809fbe1ef71633aa",
+      "files_hash": "0c488b1bac292b13",
       "reading_hash": "f78d4b381fddc311",
       "counts": {"lines":429,"placed":79,"shared":8,"unplaced":342},
       "omitted": {"data":448},

package/modules/hall-ui/public/street-card.css

@@ -82,6 +82,24 @@ body[data-page="street"] {
 .mcard-chip[disabled] { opacity: .55; cursor: progress; }
 .mcard-chips__field { flex: 1 1 140px; min-width: 0; height: 32px; box-sizing: border-box; padding: 0 10px; font-family: var(--font-body); font-size: 14px; color: var(--ink); background: var(--bg); border: 1px solid var(--street-rule-strong); border-radius: 8px; }
 
+/* the recorded sign-off's one line (task 1004579), on the card and the desk row
+   alike: the file or the why, a hairline bar that fills while it is sent, and
+   the chips. The file input sits inside its chip, out of sight but focusable. */
+.rec { position: relative; flex: 1 1 auto; min-width: 0; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; padding-bottom: 8px; }
+.rec__line { flex: 1 1 160px; min-width: 0; font-size: 13.5px; color: var(--ink-soft); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; font-variant-numeric: tabular-nums; }
+.rec--busy .rec__line { color: var(--ink); }
+.rec--error .rec__line { color: var(--street-accent-text); white-space: normal; }
+.rec__bar { position: absolute; left: 0; right: 0; bottom: 0; height: 3px; border-radius: 2px; background: var(--street-rule); overflow: hidden; }
+.rec__bar[hidden] { display: none; }
+.rec__fill { display: block; width: 0; height: 100%; border-radius: 2px; background: var(--accent); transition: width 200ms linear; }
+.rec__pick { position: relative; display: inline-flex; align-items: center; box-sizing: border-box; }
+.rec__file { position: absolute; inset: 0; width: 100%; height: 100%; opacity: 0; cursor: pointer; font-size: 0; }
+.rec__file[disabled] { cursor: progress; }
+.rec__pick:focus-within { outline: 2px solid var(--accent); outline-offset: 3px; }
+.rec--over { outline: 1px dashed var(--accent); outline-offset: 4px; border-radius: 8px; }
+.mcard-chip.rec__go { background: var(--accent); color: var(--accent-on); border-color: transparent; }
+.desk-chip.rec__go { background: var(--ink); color: var(--bg); border-color: var(--ink); }
+
 /* more: the detail, in place */
 .mcard-more__toggle { margin-top: -2px; }
 /* the pager: "1 of N" with previous and next, when a pin holds more than one matter (task 1004569) */

package/modules/hall-ui/public/street-card.js

@@ -49,8 +49,16 @@
 // the model as `row`, and render() draws row.actions and row.choices, sending
 // each act through request() with the row's own card. "more" opens the detail
 // in place (moreOf): the full text, who and when, and the record. Nothing on
-// the card links to an older page to decide; the one link left is a sign-off
-// that needs a recording ('record it'), which only the goal's page can take.
+// the card links to an older page to decide.
+//
+// THE RECORDED SIGN-OFF (task 1004579). A promise that needs a recording is
+// signed off here too: 'record it' opens one line where the recording is picked
+// or dropped, sent with its progress on that line, then signed off, through the
+// SAME two routes the goal page uses (POST /done-when/:id/uat/recording, then
+// POST /done-when/:id/uat). recordLine() says what the line shows in each
+// phase, recordRun() runs the two steps, recordStrip() draws the line for the
+// desk row and the card alike. A refused or failed upload says why on that
+// line, in one sentence, and offers to try again.
 
 (function (root) {
   'use strict';
@@ -779,6 +787,10 @@
     if (key === 'release') return { toast: cv && cv.source === 'gate_approvals' ? 'Released from the gate. It merges and goes live.' : 'Released. It goes live.', building: b, kind: 'rise', close: true };
     if (key === 'fine') return { toast: cv && cv.source === 'goal_join_requests' ? 'Noted. ' + who + ' joins the team.' : 'Noted. ' + who + ' is invited in.', building: b, kind: 'rise', close: false };
     if (key === 'refuse') return { toast: 'Noted. ' + who + ' is not let in.', building: b, kind: 'settle', close: false };
+    if (key === 'record') {
+      var goal = Array.isArray(r.achieved_goals) && r.achieved_goals.length;
+      return { toast: goal ? 'Signed off with the recording. That was the last promise: the goal is achieved.' : 'Signed off with the recording. The promise counts as kept.', building: b, kind: 'rise', close: true };
+    }
     if (key === 'take' && cv && cv.subject && cv.subject.kind === 'core_pin') return { toast: ACT_TOASTS.take_core, building: b, kind: 'rise', close: false };
     if (key === 'invite') return { toast: ACT_TOASTS.invite.replace('{who}', r.github_login || 'They'), building: b, kind: 'light', close: false };
     if (ACT_TOASTS[key]) return { toast: ACT_TOASTS[key].replace('{who}', who), building: b, kind: ACT_KINDS[key] || 'light', close: false };
@@ -822,7 +834,7 @@
     bad_github_login: 'That does not look like a GitHub name.',
     backup_already_running: 'A backup is already running.',
     intent_conflict: 'Another core run is going. Try again when it settles.',
-    criterion_needs_recording: 'This one needs a recording. Sign it off on its goal page.',
+    criterion_needs_recording: 'This one needs a recording: record it here.',
     not_proposer: 'Only the person who put it up may withdraw it.',
     votes_cast: 'Someone has voted on it, so it is the sitting\'s to decide now.',
     item_changed: 'Someone voted just now, so it stays with the sitting.',
@@ -835,6 +847,185 @@
     return e.message && e.message !== code ? String(e.message) : 'It could not be done just now.';
   }
 
+  // ---------- the recorded sign-off (task 1004579) ----------
+  // The goal page's own limits (criterion-uat-ui.js; the server screens again).
+  var RECORD_TYPES = ['video/mp4', 'video/webm'];
+  var RECORD_MAX = 100 * 1024 * 1024;
+  // Why an upload or a sign-off was refused, in one short sentence a person can
+  // act on. The server's own sentence stands in for a code not named here.
+  var RECORD_WHY = {
+    bad_type: 'Only an mp4 or webm video can go.',
+    empty: 'That file is empty.',
+    too_big: 'Over the 100 MB cap. Record a shorter pass.',
+    sniff_mismatch: 'That file is not the video it says it is.',
+    recording_not_found: 'The upload was lost on the way. Send it again.',
+    signer_shipped_this_work: 'You built this, so someone else signs it off.',
+    work_not_live: 'It is not on the live site yet. Sign off once it is.',
+    criterion_already_satisfied: 'Someone has already signed this off.',
+    criterion_not_awaiting_uat: 'Some of its work is still open.',
+    criterion_is_backend_only: 'This one is signed off without a recording.',
+    live_attestation_required: 'Say that you tried it on the live site.',
+    preview_readonly: 'This preview records nothing.',
+  };
+  // A refusal no new file can fix is not offered again ("try again" would only
+  // be refused the same way); a file the server refused asks for another file.
+  var RECORD_FINAL = { signer_shipped_this_work: 1, criterion_already_satisfied: 1, criterion_not_awaiting_uat: 1, criterion_is_backend_only: 1, preview_readonly: 1 };
+  var RECORD_FILE = { bad_type: 1, empty: 1, too_big: 1, sniff_mismatch: 1 };
+  function recordCheck(file) {
+    if (!file) return 'Pick the recording first.';
+    if (RECORD_TYPES.indexOf(str(file.type)) < 0) return RECORD_WHY.bad_type;
+    if (!(Number(file.size) > 0)) return RECORD_WHY.empty;
+    if (Number(file.size) > RECORD_MAX) return RECORD_WHY.too_big;
+    return null;
+  }
+  function firstSentence(s) {
+    var t = norm(s);
+    var hit = /^.*?[.!?](\s|$)/.exec(t);
+    return clip(hit ? hit[0] : t, 72);
+  }
+  function recordWhy(status, body) {
+    var e = body && body.error ? body.error : {};
+    var code = str(e.code || (body && body.code));
+    if (RECORD_WHY[code]) return RECORD_WHY[code];
+    if (status === 413) return RECORD_WHY.too_big;
+    if (!status) return 'The upload broke off. Try again.';
+    if (e.message && e.message !== code) return firstSentence(e.message);
+    if (status === 403) return 'Only a reviewer who did not build it may sign off.';
+    return 'It did not go through. Try again.';
+  }
+  // The two routes, the goal page's own: the raw video, then the sign-off with
+  // the stored name. live_attested is what the "tested it live" chip says.
+  function recordRoutes(id) {
+    var e = encodeURIComponent(str(id));
+    return {
+      upload: API + '/done-when/' + e + '/uat/recording',
+      signoff: function (recording) { return post('/done-when/' + e + '/uat', { kind: 'uat', recording: str(recording), live_attested: true }); },
+    };
+  }
+  function sizeWords(n) {
+    var b = Number(n) || 0;
+    if (b >= 1024 * 1024) return (Math.round(b / 1024 / 102.4) / 10) + ' MB';
+    return Math.max(1, Math.round(b / 1024)) + ' KB';
+  }
+  function fileWords(f) { return f ? clip(str(f.name) || 'the recording', 28) : ''; }
+  // The line in each phase: { text, pct (while sending), busy, error, chips }.
+  // st { file, phase: 'empty'|'picked'|'uploading'|'signing'|'failed', pct, why, retry }
+  function recordLine(state) {
+    var st = state || {};
+    var name = fileWords(st.file);
+    var pick = { key: 'pick', label: st.file ? 'pick another' : 'pick or drop it' };
+    if (st.phase === 'uploading') return { text: name + ' · ' + Math.max(0, Math.min(100, Math.floor(Number(st.pct) || 0))) + '% sent', pct: Math.floor(Number(st.pct) || 0), busy: true, error: false, chips: [] };
+    if (st.phase === 'signing') return { text: name + ' · sent, signing off…', pct: 100, busy: true, error: false, chips: [] };
+    if (st.phase === 'failed') return { text: str(st.why) || 'It did not go through.', pct: null, busy: false, error: true, chips: (st.retry && st.file ? [{ key: 'send', label: 'try again' }] : []).concat(st.final ? [] : [pick]) };
+    if (st.file) return { text: name + ' · ' + sizeWords(st.file.size), pct: null, busy: false, error: false, chips: [pick, { key: 'send', label: 'tested it live' }] };
+    return { text: 'mp4 or webm, up to 100 MB', pct: null, busy: false, error: false, chips: [pick] };
+  }
+  // A file picked or dropped: checked at once, so a wrong one says why before
+  // anything is sent.
+  function recordPick(state, file) {
+    var st = state || {};
+    st.file = file || null;
+    st.recording = null; st.pct = 0;
+    var bad = recordCheck(file);
+    if (bad) { st.phase = 'failed'; st.why = bad; st.retry = false; st.final = false; } else { st.phase = 'picked'; st.why = ''; }
+    return st;
+  }
+  // Send it, then sign off. deps { upload(url, file, onPct) → {ok,status,body},
+  // send(req) → {ok,status,body}, change(st), progress(st) }. An upload that
+  // went through is kept, so trying again after a refused sign-off does not send
+  // the video twice. Resolves to the sign-off's answer, or the refusal.
+  function recordRun(id, state, deps) {
+    var st = state || {};
+    var d = deps || {};
+    var tell = function () { if (d.change) d.change(st); };
+    var fail = function (out) {
+      var code = str(out && out.body && out.body.error && out.body.error.code);
+      // a file the server refused (or one too big for the body parser) needs another file
+      var badFile = !!RECORD_FILE[code] || (out && out.status) === 413;
+      st.phase = 'failed';
+      st.why = recordWhy(out && out.status, out && out.body);
+      st.final = !!RECORD_FINAL[code];
+      st.retry = !st.final && !badFile;
+      if (code === 'recording_not_found' || badFile) st.recording = null;
+      tell();
+      return { ok: false, status: out && out.status || 0, body: out && out.body || {} };
+    };
+    var bad = recordCheck(st.file);
+    if (bad) { st.phase = 'failed'; st.why = bad; st.retry = false; st.final = false; tell(); return Promise.resolve({ ok: false, status: 0, body: {} }); }
+    var routes = recordRoutes(id);
+    var sent;
+    if (st.recording) sent = Promise.resolve({ ok: true, status: 201, body: { recording: st.recording } });
+    else {
+      st.phase = 'uploading'; st.pct = 0; st.why = '';
+      tell();
+      sent = Promise.resolve(d.upload(routes.upload, st.file, function (p) { st.pct = p; if (d.progress) d.progress(st); }));
+    }
+    return sent.then(function (up) {
+      if (!up || !up.ok) return fail(up);
+      var name = up.body && up.body.recording;
+      if (!name) return fail({ status: up.status, body: {} });
+      st.recording = str(name);
+      st.phase = 'signing'; st.pct = 100;
+      tell();
+      return Promise.resolve(d.send(routes.signoff(st.recording))).then(function (out) {
+        if (!out || !out.ok) return fail(out);
+        st.phase = 'done';
+        return out;
+      });
+    });
+  }
+  // The raw upload with its progress (fetch cannot report an upload's progress).
+  function uploadXhr(X, url, file, onPct) {
+    return new Promise(function (res) {
+      var x;
+      try { x = new X(); } catch (e) { res({ ok: false, status: 0, body: {} }); return; }
+      x.open('POST', url, true);
+      x.withCredentials = true;
+      x.setRequestHeader('Content-Type', str(file && file.type));
+      x.setRequestHeader('Accept', 'application/json');
+      if (x.upload) x.upload.onprogress = function (e) { if (e && e.lengthComputable && e.total) onPct(Math.min(99, Math.floor(e.loaded * 100 / e.total))); };
+      x.onload = function () {
+        var b = {};
+        try { b = JSON.parse(x.responseText || '{}') || {}; } catch (e) { b = {}; }
+        res({ ok: x.status >= 200 && x.status < 300, status: x.status, body: b });
+      };
+      x.onerror = function () { res({ ok: false, status: 0, body: {} }); };
+      x.onabort = x.onerror;
+      x.send(file);
+    });
+  }
+  // What the goal page showed above its form, from GET /done-when/:id/uat:
+  // the three checks, short. { facts: up to three, for the desk row; lines: for
+  // the card's "more" }.
+  function uatChecks(view) {
+    var v = view || {};
+    var c = v.checks || {};
+    var facts = [], lines = [];
+    facts.push(c.code ? 'code done' : 'code still open');
+    lines.push(c.code ? 'code · every linked task is done' : 'code · some linked work is still open');
+    var live = c.live;
+    if (live) {
+      if (!live.available) { facts.push('live: your word'); lines.push('live · this site cannot tell, so the sign-off says you tried it live'); }
+      else if (live.live) { facts.push('running live'); lines.push('live · running on the live site'); }
+      else { facts.push('not live yet'); lines.push('live · shipped but not on the live site yet'); }
+    }
+    var s = c.uat || null;
+    var who = function (x) { return str(x.signed_off_by_login || 'someone') + (dayOf(x.created_at) ? ' on ' + dayOf(x.created_at) : ''); };
+    if (s) { facts.push('signed off'); lines.push('sign-off · by ' + who(s)); }
+    else if (c.stale_uat) { facts.push('old sign-off lapsed'); lines.push('sign-off · an earlier one by ' + who(c.stale_uat) + ' no longer counts: more work shipped after it'); }
+    else { facts.push('not signed off yet'); lines.push('sign-off · not yet'); }
+    return { facts: facts.slice(0, 3), lines: lines };
+  }
+  // The checks under the card's "more", once read (or "reading…" until then).
+  function withChecks(cv, view, failed) {
+    if (!cv) return cv;
+    var mo = cv.more || { text: [], who: '', when: '', history: [] };
+    var words = view ? uatChecks(view).lines : [failed ? 'the checks could not be read just now' : 'reading the checks…'];
+    mo.text = mo.text.filter(function (x) { return !x.checks; }).concat(words.map(function (w, i) { return { label: i ? '' : 'the checks', words: w, checks: true }; }));
+    cv.more = mo;
+    return cv;
+  }
+
   // ---------- the DOM ----------
   function el(doc, tag, cls, text) {
     var n = doc.createElement(tag);
@@ -995,7 +1186,11 @@
     var box = el(doc, 'div', 'mcard-chips');
     box.setAttribute('data-chips', open);
     box.appendChild(el(doc, 'span', 'mcard-chips__ask', ch.ask));
-    if (ch.field) {
+    if (ch.file && on.record) {
+      var strip = recordStrip(doc, on.record.state(), on.record, 'card', u.busy);
+      if (on.record.painted) on.record.painted(strip);
+      box.appendChild(strip.node);
+    } else if (ch.field) {
       var input = el(doc, 'input', 'mcard-chips__field');
       input.setAttribute('id', 'mcardField');
       input.setAttribute('type', 'text');
@@ -1011,6 +1206,63 @@
     host.appendChild(box);
   }
 
+  // The recording's one line (task 1004579), for the desk row ('desk') and the
+  // card ('card'): what the line says, a thin bar while it is sent, and its
+  // chips. 'pick' is a label wrapping the file input, so a tap opens the file
+  // chooser and the keyboard reaches it; a drop on the line takes the file too.
+  // on { pick(file), send() }. Returns { node, paint(st) }: paint() moves the
+  // line and the bar in place, so progress never redraws the desk.
+  function recordStrip(doc, state, on, kind, busy) {
+    var desk = kind === 'desk';
+    var chipCls = desk ? 'desk-chip desk-chip--choice' : 'mcard-chip';
+    var ln = recordLine(state);
+    var box = el(doc, 'span', 'rec' + (ln.busy ? ' rec--busy' : '') + (ln.error ? ' rec--error' : ''));
+    box.setAttribute('data-record', ln.error ? 'failed' : (state && state.phase) || 'empty');
+    var line = el(doc, 'span', 'rec__line', ln.text);
+    line.setAttribute('role', ln.error ? 'alert' : 'status');
+    box.appendChild(line);
+    var bar = el(doc, 'span', 'rec__bar');
+    var fill = el(doc, 'span', 'rec__fill');
+    bar.setAttribute('aria-hidden', 'true');
+    bar.appendChild(fill);
+    if (ln.pct == null) bar.hidden = true;
+    else fill.style.setProperty('width', ln.pct + '%');
+    box.appendChild(bar);
+    ln.chips.forEach(function (c) {
+      if (c.key === 'pick') {
+        var lab = el(doc, 'label', chipCls + ' rec__pick');
+        lab.setAttribute('data-act', 'record-pick');
+        lab.appendChild(el(doc, 'span', '', c.label));
+        var input = el(doc, 'input', 'rec__file');
+        input.setAttribute('type', 'file');
+        input.setAttribute('accept', RECORD_TYPES.join(','));
+        input.setAttribute('aria-label', c.label + ': the recording, mp4 or webm');
+        if (busy) input.setAttribute('disabled', '');
+        input.addEventListener('change', function () { var f = input.files && input.files[0]; if (f) on.pick(f); });
+        lab.appendChild(input);
+        box.appendChild(lab);
+      } else {
+        box.appendChild(button(doc, chipCls + (c.key === 'send' && !ln.error ? ' rec__go' : ''), c.label, 'record-' + c.key, function () { on.send(); }, busy));
+      }
+    });
+    var stop = function (e) { if (e && e.preventDefault) e.preventDefault(); if (e && e.stopPropagation) e.stopPropagation(); };
+    box.addEventListener('dragover', function (e) { stop(e); box.className += /\brec--over\b/.test(box.className) ? '' : ' rec--over'; });
+    box.addEventListener('dragleave', function () { box.className = box.className.replace(/\s*rec--over\b/g, ''); });
+    box.addEventListener('drop', function (e) {
+      stop(e);
+      var f = e && e.dataTransfer && e.dataTransfer.files ? e.dataTransfer.files[0] : null;
+      if (f && !busy) on.pick(f);
+    });
+    return {
+      node: box,
+      paint: function (st) {
+        var now = recordLine(st);
+        line.textContent = now.text;
+        if (now.pct != null) { bar.hidden = false; fill.style.setProperty('width', now.pct + '%'); }
+      },
+    };
+  }
+
   // "more": the card grows in place with the detail (task 1004566). The toggle
   // says whether it is open (aria-expanded); the queue's other pieces of work
   // are listed there, each opening in this same card.
@@ -1078,6 +1330,9 @@
     API: API, SECTIONS: SECTIONS, needsRoom: needsRoom, itemIdOf: itemIdOf, subjectKind: subjectKind,
     model: model, actsCard: actsCard, moreOf: moreOf, request: request, orderRequest: orderRequest, check: check, answer: answer, refusal: refusal, render: render, pager: pager,
     memberWords: memberWords, windowWords: windowWords, LINE: LINE, compact: compact,
+    // the recorded sign-off from the card (task 1004579)
+    RECORD_TYPES: RECORD_TYPES, RECORD_MAX: RECORD_MAX, recordCheck: recordCheck, recordWhy: recordWhy, recordRoutes: recordRoutes,
+    recordLine: recordLine, recordPick: recordPick, recordRun: recordRun, recordStrip: recordStrip, uploadXhr: uploadXhr, uatChecks: uatChecks, withChecks: withChecks,
     // the wording change, for a drafted amendment's struck and inserted text (task 1004530)
     change: changeOf,
   };

package/modules/hall-ui/public/street-desk.js

@@ -173,7 +173,7 @@
     recheck: 'check again',
   });
   // What a row's chips ask, per act (a reason or an option is one tap, never text).
-  const ASKS = Object.freeze({ recheck: 'why', budget: 'monthly limit', unsign: 'why', decide: 'pick one', ratify_goal: 'which version', check: 'check', take_core: 'move to', rot: 'stale after', module_off: 'sure', invite: 'their GitHub name', object: 'why', force: 'why', switch_off: 'why', pause: 'why', deactivate: 'why', signoff: 'confirm', allow: 'which goal', tier: 'which tier', give: 'to whom', take: 'from whom' });
+  const ASKS = Object.freeze({ recheck: 'why', budget: 'monthly limit', unsign: 'why', decide: 'pick one', ratify_goal: 'which version', check: 'check', take_core: 'move to', rot: 'stale after', module_off: 'sure', invite: 'their GitHub name', object: 'why', force: 'why', switch_off: 'why', pause: 'why', deactivate: 'why', signoff: 'confirm', record: 'the recording', allow: 'which goal', tier: 'which tier', give: 'to whom', take: 'from whom' });
   // How a floor counts rows nobody is waiting on (desk rows), by its desk.
   const DESK_NOUNS = Object.freeze({
     'people.builders': 'builders', 'people.ranks': 'ranks', 'disputes.confirmed': 'to fix',
@@ -287,7 +287,9 @@
   // 1004559). An act with options asks first, with its options as one-tap chips;
   // `pick: 'open_goals'` offers the open goals the street already reads; an act
   // whose chips come out empty is left off rather than drawn dead. 'record'
-  // goes to the matter's own page (a sign-off that needs a recording).
+  // (a sign-off that needs a recording) asks for the recording in place: its
+  // choice is the file line (`file: true`), drawn by GovMatterCard.recordStrip
+  // (task 1004579), never a link to the goal's page.
   function actedRow(acts, card, ctx) {
     const titles = new Map((ctx.goals || []).map((g) => [str(g.id), str(g.title || 'goal ' + g.id)]));
     // an act at a building a sitting decides is filed as its matter (task 1004561)
@@ -297,7 +299,7 @@
     // 'open' leaves for an older page: a row that can act here keeps its detail
     // in place (tap the name) and drops the link; only a row with no act of its
     // own may link out (owner standard, task 1004562)
-    const inPlace = acts.some((a) => a && a.key !== 'open' && a.key !== 'record');
+    const inPlace = acts.some((a) => a && a.key !== 'open');
     acts.forEach((a) => {
       if (a.key === 'open' && inPlace) return;
       // the core's 'take' is its own word ('take it'), not the rank's 'take back'
@@ -311,11 +313,13 @@
         if (!options.length) return;
       }
       options = options.slice(0, LIMITS.chips);
-      const goes = a.key === 'record' || a.key === 'open';
+      const goes = a.key === 'open';
       if (goes && !card.href) return;
       const field = a.field || null;
-      const ask = options.length > 0 || !!field;
-      if (ask) choices[a.key] = field ? { for: a.key, ask: ASKS[word] || 'which', field: field, options: [] } : { for: a.key, ask: ASKS[word] || 'which', options: options };
+      const file = a.key === 'record';
+      const ask = options.length > 0 || !!field || file;
+      if (file) choices[a.key] = { for: a.key, ask: ASKS[word], file: true, options: [] };
+      else if (ask) choices[a.key] = field ? { for: a.key, ask: ASKS[word] || 'which', field: field, options: [] } : { for: a.key, ask: ASKS[word] || 'which', options: options };
       actions.push({ key: a.key, label: ACT_WORDS[word], tone: actions.length ? 'quiet' : 'primary', go: goes ? card.href : null, ask: ask });
     });
     const first = actions.find((a) => a.ask);
@@ -568,7 +572,7 @@
       if (r.actions.some((a) => a.ask) && !r.chips) bad('a reason without chips', r.name);
       Object.keys(r.choices || {}).forEach((k) => {
         const c = r.choices[k];
-        if ((!c.field && !c.options.length) || c.options.length > LIMITS.chips || c.options.some((x) => !x.label || x.label.length > LIMITS.chip)) bad('chips', c.options.map((x) => x.label));
+        if ((!c.field && !c.file && !c.options.length) || c.options.length > LIMITS.chips || c.options.some((x) => !x.label || x.label.length > LIMITS.chip)) bad('chips', c.options.map((x) => x.label));
       });
       if (r.actions.some((a) => a.ask && !(r.choices || {})[a.key])) bad('an ask without its own chips', r.name);
       if (r.pips && r.pips.length > LIMITS.pips) bad('more than twelve pips', r.pips.length);

package/modules/hall-ui/public/street.html

@@ -12,7 +12,7 @@
        (tests/hall_tokens.mjs: no hall page hardcodes a web-font stylesheet). -->
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
   <link rel="stylesheet" href="/builders/street.css?v=2026-10-04-pins1">
-  <link rel="stylesheet" href="/builders/street-card.css?v=2026-10-04-pins1">
+  <link rel="stylesheet" href="/builders/street-card.css?v=2026-10-04-record1">
 </head>
 <!-- THE STREET (task 1004525, goal 1000125, R03). The street view of
      docs/design/mocks/governor-city/Street.dc.html (renderVals' street branch,
@@ -210,10 +210,10 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/city-draw.js?v=2026-10-04-pins1"></script>
 <script src="/builders/street-draw.js?v=2026-10-04-pins1"></script>
-<script src="/builders/street-card.js?v=2026-10-04-pins1"></script>
+<script src="/builders/street-card.js?v=2026-10-04-record1"></script>
 <script src="/builders/street-inside.js?v=2026-10-03-desk1"></script>
-<script src="/builders/street-desk.js?v=2026-10-03-desk1"></script>
+<script src="/builders/street-desk.js?v=2026-10-04-record1"></script>
 <script src="/builders/street-amend.js?v=2026-10-02-amend1"></script>
-<script src="/builders/street.js?v=2026-10-04-pins1"></script>
+<script src="/builders/street.js?v=2026-10-04-record1"></script>
 </body>
 </html>