@bongos/core 1.21.59 → 1.21.61

package/modules/builder-settings/filter-views.js

@@ -0,0 +1,136 @@
+'use strict';
+
+// modules/builder-settings/filter-views.js — a builder's SAVED FILTER VIEWS
+// (task 1004553). A view is a named set of filter values for one hall page
+// (Goals, Tasks, …) that the builder can come back to, on any device.
+//
+// PERSONAL BY CONSTRUCTION (owner decision, 2026-10-02). Views live on the
+// builder's own row, so there is no "whose view is this" check to get wrong: the
+// routes only ever read and write req.builder.id's prefs, and another builder's
+// views are simply not reachable. The project-wide default is the Roadmap's
+// focus version (task 1004551), not a shared view.
+//
+// Storage: one reserved key ('filter_views') inside the `behavior_prefs` jsonb on
+// `builders` (migration 119 — the blob the wandering/render/interaction knobs
+// share), so this adds NO migration. Shape:
+//
+//   { "<page>": [ { id, name, values: { "<control id>": "<value>" }, is_default } ] }
+//
+// Every helper below is pure: it takes the stored prefs and returns the next
+// prefs (siblings untouched), or { ok:false, errors } — the route does the I/O.
+//
+// Opening order on a page (enforced by the hall filter bar, not here):
+//   URL filter > my default view > project focus version > any.
+
+const RESERVED_KEY = 'filter_views';
+
+// Bounds that keep one builder's blob small. A page key is the page's own short
+// slug ('goals', 'work'); a value is whatever the filter control holds.
+const PAGE_RE = /^[a-z][a-z0-9-]{0,39}$/;
+const CONTROL_RE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const MAX_NAME = 60;
+const MAX_VIEWS_PER_PAGE = 20;
+const MAX_VALUES = 30;
+const MAX_VALUE_LEN = 200;
+
+function pageViews(prefs, page) {
+  const all = prefs && prefs[RESERVED_KEY];
+  const list = all && typeof all === 'object' && !Array.isArray(all) ? all[page] : null;
+  return Array.isArray(list) ? list : [];
+}
+
+function withPage(prefs, page, list) {
+  const next = { ...(prefs || {}) };
+  const all = { ...((next[RESERVED_KEY] && typeof next[RESERVED_KEY] === 'object') ? next[RESERVED_KEY] : {}) };
+  if (list.length) all[page] = list; else delete all[page];
+  if (Object.keys(all).length) next[RESERVED_KEY] = all; else delete next[RESERVED_KEY];
+  return next;
+}
+
+function checkPage(page) {
+  return typeof page === 'string' && PAGE_RE.test(page) ? null : 'page must be a short lowercase page key, e.g. "goals"';
+}
+
+function cleanName(name) {
+  if (typeof name !== 'string') return { error: 'name is required' };
+  const n = name.trim().replace(/\s+/g, ' ');
+  if (!n) return { error: 'name is required' };
+  if (n.length > MAX_NAME) return { error: `name must be ${MAX_NAME} characters or fewer` };
+  return { name: n };
+}
+
+function cleanValues(values) {
+  if (!values || typeof values !== 'object' || Array.isArray(values)) return { error: 'values must be an object of filter id → value' };
+  const entries = Object.entries(values);
+  if (entries.length > MAX_VALUES) return { error: `a view holds at most ${MAX_VALUES} filters` };
+  const out = {};
+  for (const [k, v] of entries) {
+    if (!CONTROL_RE.test(k)) return { error: `"${String(k).slice(0, 40)}" is not a filter id` };
+    if (typeof v !== 'string') return { error: `filter "${k}" must be a string` };
+    if (v.length > MAX_VALUE_LEN) return { error: `filter "${k}" is too long` };
+    out[k] = v;
+  }
+  return { values: out };
+}
+
+const fail = (...errors) => ({ ok: false, errors });
+
+// The views for one page, as the API returns them.
+function listViews(prefs, page) {
+  return pageViews(prefs, page).map((v) => ({ id: v.id, name: v.name, values: { ...v.values }, is_default: v.is_default === true }));
+}
+
+// Save the current filters under a name. Saving under a name that already exists
+// on this page REPLACES that view's filters (the natural "update my view"), so
+// names stay unique per page. is_default:true makes it the only default.
+function saveView(prefs, page, body = {}) {
+  const pe = checkPage(page); if (pe) return fail(pe);
+  const n = cleanName(body.name); if (n.error) return fail(n.error);
+  const vals = cleanValues(body.values); if (vals.error) return fail(vals.error);
+  const makeDefault = body.is_default === true;
+  let list = pageViews(prefs, page).map((v) => ({ ...v }));
+  let view = list.find((v) => v.name.toLowerCase() === n.name.toLowerCase());
+  if (view) {
+    view.name = n.name;
+    view.values = vals.values;
+    if (makeDefault) view.is_default = true;
+  } else {
+    if (list.length >= MAX_VIEWS_PER_PAGE) return fail(`you can keep at most ${MAX_VIEWS_PER_PAGE} views on one page — delete one first`);
+    const id = list.reduce((m, v) => Math.max(m, Number(v.id) || 0), 0) + 1;
+    view = { id, name: n.name, values: vals.values, is_default: makeDefault };
+    list.push(view);
+  }
+  if (makeDefault) list = list.map((v) => ({ ...v, is_default: v.id === view.id }));
+  return { ok: true, prefs: withPage(prefs, page, list), view: listViews(withPage(prefs, page, list), page).find((v) => v.id === view.id) };
+}
+
+// Rename and/or set or clear the default flag on one of my views.
+function updateView(prefs, page, id, body = {}) {
+  const pe = checkPage(page); if (pe) return fail(pe);
+  let list = pageViews(prefs, page).map((v) => ({ ...v }));
+  const view = list.find((v) => v.id === Number(id));
+  if (!view) return { ok: false, notFound: true, errors: ['no such view'] };
+  if (body.name !== undefined) {
+    const n = cleanName(body.name); if (n.error) return fail(n.error);
+    if (list.some((v) => v.id !== view.id && v.name.toLowerCase() === n.name.toLowerCase())) return fail(`you already have a view called "${n.name}" here`);
+    view.name = n.name;
+  }
+  if (body.is_default !== undefined) {
+    if (typeof body.is_default !== 'boolean') return fail('is_default must be true or false');
+    list = list.map((v) => ({ ...v, is_default: body.is_default ? v.id === view.id : (v.id === view.id ? false : v.is_default === true) }));
+  }
+  const next = withPage(prefs, page, list);
+  return { ok: true, prefs: next, view: listViews(next, page).find((v) => v.id === view.id) };
+}
+
+function deleteView(prefs, page, id) {
+  const pe = checkPage(page); if (pe) return fail(pe);
+  const list = pageViews(prefs, page);
+  if (!list.some((v) => v.id === Number(id))) return { ok: false, notFound: true, errors: ['no such view'] };
+  return { ok: true, prefs: withPage(prefs, page, list.filter((v) => v.id !== Number(id))) };
+}
+
+module.exports = {
+  RESERVED_KEY, MAX_VIEWS_PER_PAGE, checkPage,
+  listViews, saveView, updateView, deleteView,
+};

package/modules/builder-settings/routes/settings.js

@@ -30,6 +30,7 @@ const modelAllocPrefs = require('../model-alloc-prefs');
 const renderPrefs = require('../render-prefs');
 const profileNudgePrefs = require('../profile-nudge-prefs');
 const displayName = require('../display-name');
+const filterViews = require('../filter-views');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('builder-settings');
 
@@ -434,6 +435,95 @@ module.exports = function buildBuilderSettingsRouter() {
     }
   });
 
+  // Per-builder SAVED FILTER VIEWS (task 1004553; shares the behavior_prefs jsonb /
+  // migration 119). A view is a named set of filter values for one hall page. They
+  // are PERSONAL: every route reads and writes only req.builder.id's own prefs, so
+  // another builder's views are unreachable — not hidden, absent. The page is a
+  // short key ('goals', 'work'): a query param on GET/DELETE, a body field on
+  // POST/PATCH. Shapes + bounds live in filter-views.js.
+  //
+  // rank: any-builder — own filter config; same posture as /me/render.
+  router.get('/me/filter-views', api.requireBuilder, async (req, res) => {
+    try {
+      const page = req.query && req.query.page;
+      const pe = filterViews.checkPage(page);
+      if (pe) return res.fail('invalid_page', { status: 400, message: pe });
+      const stored = await db.getBuilderBehaviorPrefs(req.builder.id);
+      res.json({ page, views: filterViews.listViews(stored, page) });
+    } catch (err) {
+      log.error('GET /me/filter-views', err);
+      res.fail('read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // Save the current filters as a view. Body: { page, name, values, is_default? }.
+  // An existing name on the same page is overwritten (that is "update my view").
+  // rank: any-builder — own filter config.
+  router.post('/me/filter-views', api.requireBuilder, async (req, res) => {
+    // Field shapes here; the per-value bounds (page key, name length, filter ids)
+    // are filter-views.js's, so the refusal names the actual problem.
+    if (api.validateOrRespond(req, res, {
+      page: { required: true, type: 'string', maxLength: 40 },
+      name: { required: true, type: 'string', maxLength: 200 },
+      values: { required: true, type: 'object' },
+      is_default: { type: 'boolean' },
+    }, { strict: true })) return undefined;
+    try {
+      const body = req.body || {};
+      const existing = await db.getBuilderBehaviorPrefs(req.builder.id);
+      const r = filterViews.saveView(existing, body.page, body);
+      if (!r.ok) return res.fail('invalid_view', { status: 422, message: r.errors[0], details: { errors: r.errors } });
+      const saved = await db.setBuilderBehaviorPrefs(req.builder.id, r.prefs);
+      res.status(201).json({ page: body.page, view: r.view, views: filterViews.listViews(saved, body.page) });
+    } catch (err) {
+      log.error('POST /me/filter-views', err);
+      res.fail('write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // Rename a view and/or make it (or stop it being) my default for that page.
+  // Body: { page, name?, is_default? }.
+  // rank: any-builder — own filter config.
+  router.patch('/me/filter-views/:id', api.requireBuilder, async (req, res) => {
+    if (api.validateOrRespond(req, res, {
+      page: { required: true, type: 'string', maxLength: 40 },
+      name: { type: 'string', maxLength: 200 },
+      is_default: { type: 'boolean' },
+    }, { strict: true })) return undefined;
+    try {
+      const body = req.body || {};
+      const existing = await db.getBuilderBehaviorPrefs(req.builder.id);
+      const r = filterViews.updateView(existing, body.page, req.params.id, body);
+      if (!r.ok) {
+        if (r.notFound) return res.fail('view_not_found', { status: 404, message: 'That view no longer exists. Reload and try again.' });
+        return res.fail('invalid_view', { status: 422, message: r.errors[0], details: { errors: r.errors } });
+      }
+      const saved = await db.setBuilderBehaviorPrefs(req.builder.id, r.prefs);
+      res.json({ page: body.page, view: r.view, views: filterViews.listViews(saved, body.page) });
+    } catch (err) {
+      log.error('PATCH /me/filter-views/:id', err);
+      res.fail('write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — own filter config. ?page=<key> names the page.
+  router.delete('/me/filter-views/:id', api.requireBuilder, async (req, res) => {
+    try {
+      const page = req.query && req.query.page;
+      const existing = await db.getBuilderBehaviorPrefs(req.builder.id);
+      const r = filterViews.deleteView(existing, page, req.params.id);
+      if (!r.ok) {
+        if (r.notFound) return res.fail('view_not_found', { status: 404, message: 'That view no longer exists. Reload and try again.' });
+        return res.fail('invalid_page', { status: 400, message: r.errors[0] });
+      }
+      const saved = await db.setBuilderBehaviorPrefs(req.builder.id, r.prefs);
+      res.json({ page, views: filterViews.listViews(saved, page) });
+    } catch (err) {
+      log.error('DELETE /me/filter-views/:id', err);
+      res.fail('write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // Per-builder DISPLAY NAME (task 1669). The free label shown next to a
   // builder's work in the hall (header, leaderboard, work feed — all already read
   // display_name, so a DB update propagates). Seeded once from GitHub at account

package/modules/hall-ui/public/goals-page.js

@@ -857,7 +857,10 @@
       ]);
       state.goals = gres.goals || [];
       populateVersionFilter();
-      applyFocusVersion(focusResp);
+      // task 1004553 — the opening order: my default view > the focus version > any
+      // (this page keeps no URL filter state). Rendering follows in route().
+      const views = listFilterBar && listFilterBar.views;
+      if (!(views && await views.applyDefault({ fire: false }))) applyFocusVersion(focusResp);
       // task 1003135 — fire-and-forget: the Owner options fill when the (cached)
       // directory resolves; boot never waits on a label lookup.
       populateOwnerFilter().catch(() => {});
@@ -906,6 +909,7 @@
   // task 1002965 adds Sort (f-goal-order — NOT f-goal-sort, which is already
   // taken by the goal-detail To-do bar further down this file).
   let savedGoalSort = null;
+  let listFilterBar = null;
   let savedGoalView = null;
   try {
     savedGoalSort = window.localStorage.getItem(GOAL_SORT_PREF);
@@ -923,8 +927,10 @@
   // two rows were the loudest thing on the page; they sit behind the kit's
   // Filters disclosure, which counts and chips whatever is active so a hidden
   // filter can never narrow the board silently. Control ids are unchanged.
-  makeFilterBar({
+  listFilterBar = makeFilterBar({
     mount: $('#goals-filters'),
+    // task 1004553 — the builder's own saved views (Views menu), stored server-side.
+    views: { page: 'goals', client: api, base: `${API}/me/filter-views` },
     search: { id: 'f-goals-search', label: 'Search', placeholder: 'goal # or name…' },
     primary: [
       { id: 'f-goal-version', label: 'Version', options: [{ value: '', label: '— any —' }] },

package/modules/hall-ui/public/hall-kit.js

@@ -239,7 +239,7 @@
   //     value?, default? }   (default falls back to the first option / '')
   // `url: true` round-trips non-default values through the query string
   // (history.replaceState — shareable filtered views, hash untouched).
-  function makeFilterBar({ mount, search = null, primary = [], overflow = [], url = false, onChange = null }) {
+  function makeFilterBar({ mount, search = null, primary = [], overflow = [], url = false, onChange = null, views = null }) {
     if (!mount) throw new Error('makeFilterBar requires mount');
     const controls = [...(search ? [{ type: 'search', ...search }] : []), ...primary, ...overflow]
       .map((c) => ({ type: 'select', ...c, default: c.default ?? (c.type === 'search' || !c.options?.length ? '' : optVal(c.options[0])) }));
@@ -272,6 +272,8 @@
         ${(search ? [controls[0]] : []).map(controlHtml).join('')}
         ${primary.map((c) => controlHtml(byId.get(c.id))).join('')}
         ${overflow.length ? `<button type="button" class="btn-ghost filters__more" aria-expanded="false">Filters<span class="count-pill filters__more-count" hidden></span></button>` : ''}
+        ${views ? `<span class="filter-views"><button type="button" class="btn-ghost filter-views__btn" aria-expanded="false" hidden>Views</button>
+          <div class="filter-views__menu" role="group" aria-label="Saved views" hidden></div></span>` : ''}
       </div>
       ${overflow.length ? `<div class="filters filters--overflow" hidden>
         ${overflow.map((c) => controlHtml(byId.get(c.id))).join('')}
@@ -349,7 +351,131 @@
     });
 
     paintBadges();
-    return { el: mount, values, get, set };
+    const viewsApi = views ? wireViews() : null;
+    return { el: mount, values, get, set, views: viewsApi };
+
+    // ---- saved views (task 1004553) ----------------------------------------
+    // views: { page, client, base } — page is the page's short key ('goals',
+    // 'work'); client is the page's BongosClient; base is the /me/filter-views
+    // URL. Views are the builder's own, stored server-side so they follow them
+    // across devices. Opening order: URL filter > my default view > the page's
+    // own default (the focus version) > any — the page asks applyDefault() once
+    // its option lists are filled and falls back to its own default on false.
+    function wireViews() {
+      const btn = mount.querySelector('.filter-views__btn');
+      const menu = mount.querySelector('.filter-views__menu');
+      const pageQ = `page=${encodeURIComponent(views.page)}`;
+      const urlHasFilter = url && controls.some((c) => new URLSearchParams(window.location.search).has(c.id));
+      const st = { list: [], note: '' };
+
+      async function call(method, sub, body) {
+        const res = await views.client.request(method, `${views.base}${sub}`, body ? { body } : undefined);
+        if (res && res.ok) return res.data;
+        const e = res && res.data && res.data.error;
+        const err = new Error((e && e.message) || 'Could not save the view. Try again.');
+        err.status = res && res.status;
+        throw err;
+      }
+
+      // Only what differs from the defaults is saved, so applying a view puts
+      // every other filter back to its default.
+      function currentValues() {
+        const out = {};
+        controls.forEach((c) => { const v = get(c.id); if (String(v) !== String(c.default)) out[c.id] = String(v); });
+        return out;
+      }
+
+      // A value with no matching option yet is skipped rather than selected as a
+      // blank (the restoreUrlFilter rule); every other control returns to default.
+      function applyView(view, { fire = true } = {}) {
+        controls.forEach((c) => {
+          const el = mount.querySelector(`#${CSS.escape(c.id)}`);
+          if (!el) return;
+          const has = Object.prototype.hasOwnProperty.call(view.values || {}, c.id);
+          const want = String(has ? view.values[c.id] : c.default);
+          if (el.tagName === 'SELECT' && !Array.from(el.options || []).some((o) => o.value === want)) return;
+          el.value = want;
+        });
+        if (fire) changed(); else { paintBadges(); syncUrl(); }
+      }
+
+      function paint() {
+        if (!menu) return;
+        const rows = st.list.map((v) => `<li class="filter-views__row">
+            <button type="button" class="filter-views__apply" data-apply="${esc(v.id)}">${esc(v.name)}${v.is_default ? ' <span class="filter-views__tag">default</span>' : ''}</button>
+            <button type="button" class="btn-ghost" data-default="${esc(v.id)}" title="${v.is_default ? 'Stop opening this page with this view' : 'Open this page with this view'}">${v.is_default ? 'Unset default' : 'Make default'}</button>
+            <button type="button" class="btn-ghost" data-rename="${esc(v.id)}">Rename</button>
+            <button type="button" class="btn-ghost" data-delete="${esc(v.id)}">Delete</button>
+          </li>`).join('');
+        menu.innerHTML = `
+          ${st.list.length ? `<ul class="filter-views__list">${rows}</ul>` : '<p class="filter-views__empty">No saved views yet. Set the filters you want, then save them here.</p>'}
+          <form class="filter-views__save">
+            <label class="filter">Save current filters as
+              <input type="text" name="name" maxlength="60" placeholder="e.g. My open goals" required></label>
+            <button type="submit" class="btn-ghost">Save view</button>
+          </form>
+          <p class="filter-views__note" role="status">${esc(st.note)}</p>`;
+      }
+
+      function setList(list, note = '') { st.list = Array.isArray(list) ? list : []; st.note = note; paint(); }
+
+      async function act(fn, okNote) {
+        try { const data = await fn(); setList(data.views, okNote); } catch (err) { st.note = err.message; paint(); }
+      }
+
+      btn?.addEventListener('click', () => {
+        const open = menu.hidden;
+        menu.hidden = !open;
+        btn.setAttribute('aria-expanded', String(open));
+      });
+      menu?.addEventListener('click', (e) => {
+        const t = e.target.closest('button');
+        if (!t) return;
+        const pick = (attr) => st.list.find((v) => String(v.id) === t.getAttribute(attr));
+        if (t.hasAttribute('data-apply')) {
+          const v = pick('data-apply');
+          if (v) { applyView(v); st.note = `Showing “${v.name}”.`; paint(); }
+        } else if (t.hasAttribute('data-default')) {
+          const v = pick('data-default');
+          if (v) act(() => call('PATCH', `/${v.id}`, { page: views.page, is_default: !v.is_default }),
+            v.is_default ? `“${v.name}” is no longer your default.` : `This page now opens with “${v.name}”.`);
+        } else if (t.hasAttribute('data-rename')) {
+          const v = pick('data-rename');
+          const name = v && window.prompt('New name for this view', v.name);
+          if (name && name.trim() && name.trim() !== v.name) act(() => call('PATCH', `/${v.id}`, { page: views.page, name }), 'Renamed.');
+        } else if (t.hasAttribute('data-delete')) {
+          const v = pick('data-delete');
+          if (v && window.confirm(`Delete the view “${v.name}”?`)) act(() => call('DELETE', `/${v.id}?${pageQ}`), 'Deleted.');
+        }
+      });
+      menu?.addEventListener('submit', (e) => {
+        e.preventDefault();
+        const input = e.target.querySelector('input[name="name"]');
+        const name = input && input.value.trim();
+        if (!name) return;
+        act(() => call('POST', '', { page: views.page, name, values: currentValues() }), `Saved “${name}”.`);
+      });
+
+      // Signed-out or an older server: the button stays hidden and nothing else changes.
+      const ready = call('GET', `?${pageQ}`)
+        .then((data) => { setList(data.views); if (btn) btn.hidden = false; return true; })
+        .catch(() => false);
+
+      return {
+        ready,
+        list: () => st.list.slice(),
+        apply: applyView,
+        // Apply my default view unless the URL already carries a filter. Resolves
+        // true when it applied one, so the page skips its own default.
+        async applyDefault({ fire = false } = {}) {
+          if (!(await ready) || urlHasFilter) return false;
+          const v = st.list.find((x) => x.is_default);
+          if (!v) return false;
+          applyView(v, { fire });
+          return true;
+        },
+      };
+    }
   }
 
   // ---- tabs ------------------------------------------------------------------

package/modules/hall-ui/public/project-settings.css

@@ -214,3 +214,8 @@
    the 24px floor: the prose-link recipe buys the height with padding and hands it back
    with an equal negative margin, so the line does not re-space. */
 .dp-settled .ov-row__sub a { display: inline-block; min-height: 24px; padding: 3px 0; margin: -3px 0; }
+
+/* The danger zone (task 1004570) — two links out to the hosting platform, each with
+   one sentence saying what it does. Plain list, the lede's measure. */
+.ps-danger__list { margin: 10px 0 0; padding-left: 18px; line-height: 1.6; max-width: var(--measure); }
+.ps-danger__list li + li { margin-top: 8px; }

package/modules/hall-ui/public/project-settings.html

@@ -49,6 +49,18 @@
                thing this page exists to end. -->
           <div id="ps-rows"><span class="kit-skel"></span></div>
         </section>
+        <!-- Danger zone (task 1004570): where this project's OWNER takes it offline or
+             disconnects it. Both controls live on the platform that hosts the project,
+             so this only links there. Hidden unless GET /project/manage-link answers
+             with a link — an Archon on a hosted project; never on a self-hosted one. -->
+        <section class="scroll" id="ps-danger" aria-labelledby="ps-danger-h" hidden>
+          <h2 class="scroll__h" id="ps-danger-h">Danger zone</h2>
+          <p class="scroll__lede"><span id="ps-danger-lede"></span> <a id="ps-danger-manage" href="#"></a></p>
+          <ul class="ps-danger__list">
+            <li><a id="ps-danger-offline" href="#">Take it offline</a> — stops the project and its nightly backups but keeps everything: its database, its backups and your repository on GitHub. You can bring it back.</li>
+            <li><a id="ps-danger-disconnect" href="#">Disconnect from Bongos entirely</a> — erases the project’s server, its database and every backup, and releases its name and web address. Your repository on GitHub is kept. This cannot be undone.</li>
+          </ul>
+        </section>
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>

package/modules/hall-ui/public/project-settings.js

@@ -245,5 +245,25 @@
     }
   }
 
+  // The danger zone (task 1004570). The server answers only an Archon — on a hosted
+  // project, its owner — and answers { link: null } where there is no hosting platform
+  // to link to, so every other outcome (refused, failed, self-hosted) leaves the section
+  // hidden: a missing link, never a dead one. The act itself stays on the platform.
+  async function loadDanger() {
+    let link = null;
+    try {
+      const res = await api.request('GET', `${API}/project/manage-link`);
+      link = res.ok && res.data ? res.data.link : null;
+    } catch (_) { link = null; }
+    if (!link || !link.offline_url || !link.disconnect_url) return;
+    $('ps-danger-lede').textContent = `This project is hosted on ${link.hub_host}, and that is where it is taken offline or removed. Both links below open this project’s page there.`;
+    $('ps-danger-manage').textContent = `Manage this project on ${link.hub_host}`;
+    $('ps-danger-manage').href = link.manage_url;
+    $('ps-danger-offline').href = link.offline_url;
+    $('ps-danger-disconnect').href = link.disconnect_url;
+    $('ps-danger').hidden = false;
+  }
+
   load();
+  loadDanger();
 })();

package/modules/hall-ui/public/style.css

@@ -4261,6 +4261,38 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   margin-bottom: 14px;
 }
 .filter-chips { display: flex; flex-wrap: wrap; gap: 6px; margin: 0 0 12px; }
+/* saved views (task 1004553) — the builder's own named filter sets. The menu is
+   a panel under the button, the overflow row's tone; it never widens the page. */
+.filter-views { position: relative; align-self: flex-end; }
+.filter-views__menu {
+  position: absolute; z-index: 20; top: calc(100% + 6px); right: 0;
+  width: min(360px, calc(100vw - 32px));
+  padding: 12px 14px;
+  border-radius: var(--radius-sm);
+  background: var(--surface-2);
+  box-shadow: var(--shadow-pop);
+}
+.filter-views__list { list-style: none; margin: 0 0 10px; padding: 0; }
+.filter-views__row { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; padding: 6px 0; border-top: var(--line) solid var(--rule-soft); }
+.filter-views__row:first-child { border-top: 0; padding-top: 0; }
+.filter-views__apply {
+  flex: 1 1 100%; min-height: 24px; padding: 0; text-align: left;
+  background: none; border: 0; color: var(--ink); font: inherit; cursor: pointer;
+}
+.filter-views__apply:hover { text-decoration: underline; }
+.filter-views__tag { font-size: 11px; color: var(--ink-faint); margin-left: 6px; }
+.filter-views__empty, .filter-views__note { font-size: 12.5px; color: var(--ink-soft); margin: 0 0 10px; }
+.filter-views__note:empty { display: none; }
+.filter-views__row .btn-ghost { min-height: 24px; padding: 0 8px; font-size: 12px; }
+.filter-views__save { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 8px; }
+.filter-views__save .filter { flex: 1 1 180px; }
+/* On a phone the button can sit anywhere in a wrapped row, so the menu spans the
+   whole filter row instead of hanging off the button (it would leave the screen). */
+@media (max-width: 640px) {
+  .filters:has(> .filter-views) { position: relative; }
+  .filter-views { position: static; }
+  .filter-views__menu { left: 0; right: 0; width: auto; }
+}
 /* An active filter IS live, so the chip is the one place in a filter bar the
    accent belongs. */
 .chip {

package/modules/hall-ui/public/work.js

@@ -210,7 +210,7 @@
 
   // task 2170: the four sections are hash-synced tabs (Ready default). Built in
   // wireEvents; renders feed the tab count pills via setTabCount.
-  let workTabs = null, mine = null;   // mine: the Only-mine lens (mine-lens.js)
+  let workTabs = null, mine = null, workFilterBar = null; // workFilterBar: its .views is the saved-views menu (task 1004553)   // mine: the Only-mine lens (mine-lens.js)
   function setTabCount(id, n) { if (workTabs) workTabs.setCount(id, n); }
 
   // A section-header count pill: reveal it and set its number once data lands.
@@ -999,7 +999,6 @@
       taskState.versions = versionsResp.versions || [];
       populateVersionFilter(taskState.versions);
       restoreUrlFilter('f-version');
-      if (applyFocusVersion(focusResp)) renderBacklog();
       renderInFlight(claimResp.active_claims || []);
       taskState.all = claimResp.claimable || [];
       renderClaimable();
@@ -1008,6 +1007,13 @@
       // task 2170: a shared URL's goal filter can only apply once the options
       // exist — restore it now and re-render if it changed anything.
       if (restoreUrlFilter('f-goal')) renderClaimable();
+      // task 1004553 — the opening order: URL filter > my default view > the focus
+      // version > any. Runs once the Version/Goal options exist, so a view's values
+      // have something to select; its change event re-fetches or re-renders.
+      const views = workFilterBar && workFilterBar.views;
+      (views ? views.applyDefault({ fire: true }) : Promise.resolve(false)).then((applied) => {
+        if (!applied && applyFocusVersion(focusResp)) { renderClaimable(); renderBacklog(); }
+      });
       pruneSelection();
       renderBulkToolbar();
     } catch (err) {
@@ -1057,8 +1063,10 @@
     // the kit's "Filters" disclosure; state rides the URL query (shareable).
     // Control ids are unchanged so renderClaimable's reads + the dynamic
     // version/goal option fills keep working untouched.
-    makeFilterBar({
+    workFilterBar = makeFilterBar({
       mount: $('#work-filters'),
+      // task 1004553 — the builder's own saved views (Views menu), stored server-side.
+      views: { page: 'work', client: api, base: `${API}/me/filter-views` },
       search: { id: 'f-search', label: 'Search', placeholder: 'task #, title, or goal…' },
       primary: [
         {

package/modules/hall-ui/records/filter-views.md

@@ -0,0 +1,11 @@
+# Saved filter views — the Views menu in the kit filter bar, on /goals and /work (task 1004553)
+
+A builder saves the current filters under a name and comes back to them, on any device. What this settled:
+
+- **Personal, and stored on the builder's own row.** The views live under the `filter_views` key of `builders.behavior_prefs` (the blob the other personal knobs share, so no migration). `/me/filter-views` only ever reads and writes `req.builder.id`'s prefs, so another builder's views are not hidden, they are unreachable. The project-wide default is the Roadmap's focus version (task 1004551), not a shared view.
+- **It is a kit option, not page code.** `makeFilterBar({ views: { page, client, base } })` adds the Views button and menu; a page opts in with its short page key. A signed-out viewer or an older server gets no button and nothing else changes.
+- **The opening order is URL filter > my default view > the focus version > any.** The page calls `bar.views.applyDefault()` once its option lists are filled and falls back to its focus default on `false`. A view saves only the filters that differ from their defaults, so applying one returns every other filter to its default. A saved value with no matching option yet is skipped, not selected as a blank (the `restoreUrlFilter` rule).
+- **The default never rides the URL.** It is applied without writing the query, so a copied link carries exactly what the builder chose, and a link with a filter in it always beats the default.
+- **Phone width.** The menu hangs off the button on desktop; at 640px and below it spans the whole filter row, because a wrapped row can put the button anywhere and the menu would leave the screen.
+
+Tests: `tests/filter_views.mjs` (storage rules, own-scoping, both pages opting in). The preview harness serves `me__filter-views.json`.

package/modules/hall-ui/records/project-danger-zone.md

@@ -0,0 +1,10 @@
+# The danger zone on /project-settings — a hosted project's owner reaches Take-offline and Delete (task 1004570)
+
+The owner of a hosted project could not find how to delete it: both controls live on the hub's Projects page, and nothing in the project's own hall pointed there. What this settled:
+
+- **Link-out only.** The section links to the hub's page for this project, scrolled to the `#mDelete` / `#mDisconnect` cards. The typed-name confirm and the intent queue stay on the hub (ADR 0290); the hall gains no second delete path.
+- **The server decides who sees it.** `GET /project/manage-link` is Archon-only (on a hosted project the owner is its Archon), and answers `{ link: null }` when the instance has no hub to link to — a self-hosted instance, or the hub itself. The section is `hidden` in the markup and shown only for a real link, so every other outcome is a missing section, never a dead link.
+- **The link names the project by slug.** The hall knows its hub origin and client id (which is its slug, ADR 0246) from its sign-in configuration, never a hardcoded domain. The hub's Projects page resolves `?view=manage&project=<slug>` against the visitor's OWN projects; a slug that is not theirs opens their list, not someone else's project. The slug survives a sign-in detour.
+- **The two sentences track the hub's folds.** `tests/project_manage_link.mjs` holds the hall's claims (repository kept, cannot be undone, can bring it back) against the hub's own fold copy.
+
+Tests: `tests/project_manage_link.mjs` (C1 owner link, C2 non-owner refused by the real gate, C3 self-hosted answers none). Harness fixture: `project__manage-link.json`.