@bongos/core 1.21.70 → 1.21.71

package/clients/bongos-client/index.d.ts

@@ -167,7 +167,7 @@ export interface GetSessionsIdResponse { session: unknown }
 export interface GetSessionsIdTranscriptResponse { transcript: unknown }
 export interface GetSessionsMineResponse { sessions: unknown; count: unknown }
 export interface GetSessionsSearchResponse { sessions: unknown; count: unknown; total: unknown; totals: unknown; limit: unknown; offset: unknown; session_types: unknown }
-export interface GetSoftwareUpdateResponse { ok: boolean; update: unknown; door: unknown; can_update: unknown }
+export interface GetSoftwareUpdateResponse { ok: boolean; update: unknown; door: unknown; can_update: unknown; ask: unknown }
 export interface GetSpecialitiesIdDocumentsResponse { documents: unknown }
 export interface GetSpecialitiesIdResponse { speciality: unknown }
 export interface GetSpecialitiesIdSkillsResponse { speciality: unknown; adopted: boolean; enabled: unknown; skills: unknown }
@@ -354,8 +354,8 @@ export interface PostGoalsIdTransferRequest { builder_id?: StringifiableId }
 export interface PostGoalsIdTransferResponse { ok: boolean; goal: unknown; changed: boolean }
 export interface PostGoalsReorderRequest { version_id: string; ordered_ids: number[] }
 export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
-export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number; admit_reason?: string }
-export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown; admitted: unknown }
+export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number; admit_reason?: string; spec_task?: boolean }
+export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown; admitted: unknown; spec_task: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardCharterRequest { form?: string; franchise?: string; council_rank?: string; pass_rule?: string; rationale_md?: string; acknowledge_self_removal?: boolean }
 export interface PostGovernmentBoardCharterResponse { ok: boolean; amendment: unknown; item: unknown; reads_as: unknown }
@@ -1578,6 +1578,8 @@ export interface BongosClient {
   "softwareUpdate": {
     /** GET /software-update — rank: any-builder */
     getSoftwareUpdate(args?: RequestArgs): Promise<GetSoftwareUpdateResponse>;
+    /** POST /software-update/request — rank: archon */
+    postSoftwareUpdateRequest(args?: RequestArgs): Promise<ApiResponse>;
   };
   "specialities": {
     /** GET /specialities — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1077,6 +1077,8 @@ export function createClient(opts = {}) {
     "softwareUpdate": {
       // GET /software-update — rank: any-builder — GET /software-update
       getSoftwareUpdate: (args) => request("GET", "/software-update", { hasBody: false }, args),
+      // POST /software-update/request — rank: archon — POST /software-update/request
+      postSoftwareUpdateRequest: (args) => request("POST", "/software-update/request", { hasBody: true }, args),
     },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities

package/docs/adr/0368-red-and-blue-teams-practice-on-a-range-never-on-live.md

@@ -0,0 +1,99 @@
+# ADR 0368 — Red and blue teams practise on a range, never on live
+
+- **Status:** proposed
+- **Date:** 2026-10-06
+- **Goal:** goal 1000094 (Working area 10 — Security, BONGOS-V2)
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the server enforces rank), [ADR 0019](0019-red-team-bounty-payout-table.md) (the bounty table), [ADR 0188](0188-patrol-runs-on-ci-not-the-server.md) (the weekly deterministic patrol), [ADR 0292](0292-both-install-paths-stay-and-vendoring-is-the-production-one.md) (a project is built from a release package), [ADR 0346](0346-dev-boxes-are-retired.md) (no staging since the dev boxes went), [ADR 0361](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md) (releases publish as candidates before anyone is offered them)
+- **Decided with:** the owner, in a 2026-10-06 scoping interview. Every decision below is theirs; the D-numbers record the answer, not a recommendation.
+
+## Context
+
+Goal 1000094 states its target as *"Red-teaming is consistent"*, and says the server should not be hackable by Claude's latest model. What exists today is all prevention, and some of it is only partly real:
+
+- **Report inbox.** `/builder-redteam` files to `vulnerability_reports` and the Archon adjudicates. Its SKILL.md promises an auto-repro subagent that does not exist (task 1003431).
+- **Bounty table.** The table is in `modules/security/security.js` (10/50/200/1000, overridable with `GDS_BOUNTY_*`). **No bounty has ever been paid:** confirming a report sets `drachmae_awarded` on the report, but nothing writes to `credit_log`.
+- **Patrol.** The weekly CI run (`scripts/gds/redteam-patrol.js`) checks secrets in git history, dependency drift and action pins. It cannot attack a running server.
+- **Detection.** `audit_log` records every authenticated write, refused ones included. It does not record reads or anonymous requests, and nothing alerts anyone.
+- **Rules.** The only written rules are one line in the `#red-team` Discord channel topic: responsible disclosure, no live exploitation.
+- **Staging.** None. There is also no fixture of fake builders at each rank.
+- **Candidates are frequent.** Every merge publishes a candidate (161 in the week to 2026-10-06, about 23 a day). Only the one the owner presses Release on reaches other projects.
+
+The established professional practice has four parts. Bongos has fragments of the second and none of the rest:
+
+1. a practice copy (a *range*) running the exact release about to go live, on fake data;
+2. rules of engagement;
+3. a blue team that detects as well as defends;
+4. a loop that turns every break into a fix plus a permanent check.
+
+## Decision
+
+**D1 — Outcome.** The first version delivers all four of these: an advisory release check (D7), a scoreboard, sides with points (D8), and live detection (D9).
+
+**D2 — The range is its own small server.**
+- It runs on its own server (~$12/month, about 2 GB), separate from the shared box, so attackers may go after the machine itself.
+- **It tests the candidate about to be released, not every candidate.** On `/deploy` the owner marks a candidate "stage for attack". The range is then rebuilt from scratch from that exact version, using the same vendored package a real project gets (ADR 0292). It rebuilds only when the owner chooses to.
+- There is one range at a time. Staging a new candidate replaces the old one.
+- It holds only fake data: fake builders at every rank, at least two fake tenants, and planted *canary secrets* (fake keys whose appearance anywhere proves a breach).
+- It uses stand-ins for GitHub and Discord, so attacking the ship/deploy pipeline or the bot never touches the real services.
+
+**D3 — The range shares nothing with live.**
+- **Logins are already separate.** A session is a random token looked up in each server's own database (`db-kernel.js` `lookupSession`). A range login is therefore unknown to cloudbongos.com, and the reverse holds too.
+- **The real coupling is the identity hub.** An ordinary project signs builders in through cloudbongos.com and reports activity back to it (ADR 0141, `modules/platform-identity`). The range must do neither. It runs its own stand-in hub, and fake builders sign in there.
+- **No real secret is ever placed on the range.** That covers GitHub app keys, the Discord token, npm tokens and DigitalOcean tokens. The range is also never seeded from a copy of the live database.
+- **A test proves the separation.** The range's configuration must name no live hub address and hold no real secret. Only the planted canaries look like secrets.
+
+**D4 — Rules of engagement.**
+- **In bounds:** everything on the range: rank escalation, cross-tenant reach, credit minting, the ship/deploy pipeline (against the stand-ins), the bot stand-in, and the range server itself.
+- **Always out of bounds:**
+  - cloudbongos.com and the real box;
+  - denial of service, meaning flooding the range until it goes down;
+  - social engineering of real people.
+
+  Breaking these rules is a ban, not a bounty. Real GitHub and Discord are out of reach by construction, because the range only knows the stand-ins.
+
+**D5 — Who plays.**
+- **Red (attack):** AI sessions, plus human builders at Metic or above.
+- **Blue (defend):** any builder may take a fix task, as today. The blue area of the hall shows confirmed-but-unfixed breaks, so seeing it requires Metic or above, the same bar as red.
+- **One side at a time.** A builder may switch sides once every 30 days. When a red builder switches, their unconfirmed attempts stay theirs: they are still adjudicated and still credited to that builder as finder. That builder may never claim the fix for their own finding.
+
+**D6 — AI attacks run on subscriptions, never the metered API.**
+- Attack sessions run in a builder's own Claude Code session or headless through the Claude CLI, including under Autobongos.
+- No Bongos-paid API key is used, so the practice adds no model spend.
+- A finding from a session is credited to the builder who ran it, Autobongos runs included.
+
+**D7 — Release check: advisory now, a gate later.**
+- Each candidate's bar is **at least 3 attack runs, on Claude's newest model, each starting as xenos from a fixed attack brief, with no confirmed high or critical break.**
+- While only our own projects run on Bongos, the bar is **advisory**: the deploy page shows a candidate's result beside its Release button, and releasing is unchanged.
+- It becomes a blocking gate when the first outside tenant goes live; that switch is its own decision. Once it blocks, only the Archon may override, and the override records a typed reason in Bongos.
+
+**D8 — Visibility and rewards.**
+- Red attempts are private to the attacker and the Archon. Blue sees a break only once it is confirmed and turned into a fix task.
+- Red and blue each get **their own area of the hall**, with a shared scoreboard (runs per candidate, breaks by severity, fixes, detections).
+- **Points only, no credits yet.** ADR 0019's table stays as the severity scale. Paying it out, the missing `credit_log` write, is deferred until the range has proven itself. When it pays, the finder is the session owner (D6).
+
+**D9 — Live detection.** On cloudbongos.com, alert on three signals:
+- **repeated refusals:** many `rank_forbidden`/`permission_forbidden` responses from one builder or token in a short window;
+- **odd CLI-token use:** a new origin, or unusual volume. Tokens never expire ([ADR 0294](0294-cli-sessions-do-not-expire.md)), so a leaked token is the largest live risk;
+- **credits without a ship:** a credit appearing with no matching shipped task.
+
+Alerts go to a new private `#security-alerts` Discord channel, visible to Archons only and added through `docs/discord/channels.json`. They do not go to the existing channels:
+- `#red-team` is open to every Metic and is where reports are filed;
+- `#security-ship-feed` announces shipped fixes.
+
+The first two signals can be built from `audit_log`, which already records refused authenticated writes. Mass-read detection is deferred, because reads are not logged today.
+
+**D10 — Blue's starting backlog.**
+- The goal's still-valid open tasks become blue's backlog. On 2026-10-06 it had 48 open tasks (44 ready, 1 blocked, 3 backlog), and an audit that day judged about 40 of them still real.
+- The four most urgent go first: 1004380 (a non-ASCII pre-launch password guess crashes the server), 1003412 (the re-auth skill wrongly says re-issuing a token kills the leaked one), and 1004382 + 1004383 (rank, credit and fitness files missing from `protected-surfaces.json`).
+
+## Consequences
+
+- **Cost** is ~$12/month for the range server, and there is no model spend.
+- **Release speed is unchanged while the check is advisory.** Once it is a gate, releasing becomes two steps: stage the candidate, then wait for three attack runs to finish against it.
+- **"Not hackable by Claude's latest model"** becomes a measured, per-release claim instead of an aspiration.
+- **Deferred, each its own later decision:**
+  - credit payouts;
+  - the blocking gate;
+  - mass-read detection;
+  - outside researchers.
+- **A known gap:** with no API spend, attack runs happen only when a builder or Autobongos picks one up. A candidate can sit with zero runs, and the check will show that plainly rather than pass it.

package/docs/adr/README.md

@@ -486,3 +486,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0365 | [**A guild engages a project through each member's own door** ([task 1002303](https://cloudbongos.com/builders#/task/1002303)). Amends ADR 0336 D7's invite half after ADR 0353. **D1:** the engagement row as D7 specified, plus `guild_id` on the echo (the latest application decides the label). **D2:** a guild applies = each member applies as themselves through the relay, naming the engagement. **D3:** a project invites a guild = the hub records it and returns one hall hand-off link per public-roster member; no hub-written invites, the one-step relay stays deferred. **D4:** a project is named only when on the map and public, for both kinds. **D5:** the label rides the applicant-profile read; the queue is R28's. **D6:** the D4.4 guild cards are their own task.](0365-a-guild-engages-a-project-through-each-members-own-door.md) | guilds / invites / applications |
 | 0366 | [**Hall planning is forms; a goal made there carries its own spec task, and the interviews stay in the CLI** ([task 1003461](https://cloudbongos.com/builders#/task/1003461), goal 1000089). Spike answer. **D1:** form-shaped, build in the hall: create a task under a goal, create a goal (name + subtitle, version, category, no scope field), attach a criterion to a goal you hold; every server refusal rendered as copy. **D2:** interview-shaped, deliberately absent from the hall: version planning, scope inference, drafting criteria and seed tasks, reuse-vs-create judgement, carry-forward. **D3 (owner):** a hall-made goal is created with a "Spec goal N" task (`POST /goals` `spec_task: true`, `source_ref goal-<id>-spec`) and every task in the goal depends on it until it ships; no new permission, no migration. **D4:** an optional "Plan with Claude" hand-off button.](0366-hall-planning-is-forms-and-a-goal-made-there-carries-its-own-spec-task.md) | lifecycle / planning |
 | 0367 | [**The Discord support bot answers from public docs only, under a monthly cap that fails closed** ([task 1002534](https://cloudbongos.com/builders#/task/1002534), goal 1000110). **D1:** one pinned channel, only when @-mentioned; the first gateway reply. **D2:** the corpus is an allowlist (`README.md`, `docs/onboarding/`, `docs/api-reference.md`) served by a new `memory.searchPublicDocs` port whose scope (doc, xenos, no owner, allowlisted ref) is fixed in SQL; the asker is never looked up. **D3:** no writes but the reply and one `audit_log` row per answer, which is also the spend ledger, so no migration. **D4:** a nonce-fenced prompt, no tools, mentions disabled. **D5:** `claude-haiku-4-5`, `DISCORD_SUPPORT_MONTHLY_CAP_USD` default $5, fail closed, with in-flight answers reserved at worst case. **D6:** off by default; its own switch and an env-only, namespaced key. **D7:** the channel's humans review wrong answers; the fix is the doc.](0367-the-support-bot-answers-from-public-docs-only.md) | discord / support / spend |
+| 0368 | [**Red and blue teams practise on a range, never on live** (goal 1000094 — *Working area 10, Security*; proposed). **D2:** the range is its own small server, rebuilt from the candidate the owner marks "stage for attack". **D3:** it shares no identity hub, secret or data with live. **D5:** red is AI plus Metic+, with one side at a time and a 30-day switch. **D6:** attacks run on subscriptions, never the metered API. **D7:** 3 runs on the newest model with 0 high+ breaks, advisory until an outside tenant exists. **D8:** points only, no credits yet. **D9:** three live signals to `#security-alerts`.](0368-red-and-blue-teams-practice-on-a-range-never-on-live.md) | security / red-team / range |

package/docs/api/openapi.json

@@ -20153,6 +20153,40 @@
         ]
       }
     },
+    "/software-update/request": {
+      "post": {
+        "operationId": "post_software_update_request",
+        "tags": [
+          "software-update"
+        ],
+        "summary": "POST /software-update/request",
+        "description": "POST /software-update/request — \"Ask for this upgrade\" (task 1004595). On a project the hub's operator runs, sends one request for the version this project is offered to the operator, through the direct feedback door, and remembers it so the page can say it is pending. The version is the server's own reading, never the caller's. Idempotent per version; a different version waits out a 24h cooldown (429). rank: core.pin.move — the same atom as the Update button the panel draws.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/core-update.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/specialities": {
       "get": {
         "operationId": "get_specialities",
@@ -26700,13 +26734,15 @@
           },
           "update": {},
           "door": {},
-          "can_update": {}
+          "can_update": {},
+          "ask": {}
         },
         "required": [
           "ok",
           "update",
           "door",
-          "can_update"
+          "can_update",
+          "ask"
         ]
       },
       "GetSpecialitiesIdDocumentsResponse": {
@@ -29690,6 +29726,9 @@
             "type": "string",
             "minLength": 8,
             "maxLength": 500
+          },
+          "spec_task": {
+            "type": "boolean"
           }
         },
         "required": [
@@ -29707,14 +29746,16 @@
           "goal": {},
           "succeeds_goal_id": {},
           "category_advisory": {},
-          "admitted": {}
+          "admitted": {},
+          "spec_task": {}
         },
         "required": [
           "ok",
           "goal",
           "succeeds_goal_id",
           "category_advisory",
-          "admitted"
+          "admitted",
+          "spec_task"
         ]
       },
       "PostGovernmentAssignmentsRequest": {
@@ -33570,7 +33611,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 522,
+  "x-endpoint-count": 523,
   "x-schema-count": 564,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 374,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 522 endpoints across 93 route files.
+> **Generated from the live route files** — the route file is authoritative. 523 endpoints across 93 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -307,7 +307,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/goals` | `any-builder` | — | GET /goals?version=&status= — list goals (read); each row carries `viewer_is_member` for the reader. |
-| POST | `/api/bongos/goals` | `metic+archon` | `version_id`, `title`, `subtitle`, `description`, `scope_modules`, `succeeds_goal_id`, `category_id`, `admit_reason` | POST /goals — create a goal. |
+| POST | `/api/bongos/goals` | `metic+archon` | `version_id`, `title`, `subtitle`, `description`, `scope_modules`, `succeeds_goal_id`, `category_id`, `admit_reason`, `spec_task` | POST /goals — create a goal. |
 | GET | `/api/bongos/goals/:id` | `any-builder` | — | GET /goals/:id — one goal with its members + linked criteria (read). |
 | PATCH | `/api/bongos/goals/:id` | `any-builder` | — | PATCH /goals/:id — correct a goal's own title/subtitle/description (tasks 1003102, 1003224). |
 | PATCH | `/api/bongos/goals/:id/accepting-requests` | `any-builder` | — | PATCH /goals/:id/accepting-requests { accepting_requests } — a private goal's lead closes or re-opens it to join-requests (task 1002971, … |
@@ -768,11 +768,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sky` | `any-builder` | — | GET /sky, the whole project sky (task 1004230, ADR 0331). |
 | GET | `/api/bongos/sky/mine` | `any-builder` | — | GET /sky/mine, every thought the SIGNED-IN builder filed with its state, size and descent, capped at 1000 (task 1004230). |
 
-## `software-update` (1)
+## `software-update` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/software-update` | `any-builder` | — | GET /software-update — Settings → Software update (task 1004296): this project's core, the newest release its channel allows, what the ve… |
+| POST | `/api/bongos/software-update/request` | `archon` | — | POST /software-update/request — "Ask for this upgrade" (task 1004595). |
 
 ## `specialities` (15)
 

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2589 strings** across 3 surfaces · 2199 distinct pieces of copy · 2589 certain, 0 heuristic · 228 shown in more than one place.
+**2593 strings** across 3 surfaces · 2202 distinct pieces of copy · 2593 certain, 0 heuristic · 229 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 133 | 1828 |
+| `builders-hall` | `modules/hall-ui/public` | 133 | 1832 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 8 | 661 |
 
@@ -76,9 +76,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9c728558d6e7` | 3x | Drachmae & karma | modules/hall-ui/public/drachmae.html:22, modules/hall-ui/public/drachmae.html:22, modules/hall-ui/public/drachmae.html:37 |
 | `e0e2606e1104` | 3x | Fleet costs | modules/hall-ui/public/fleet.html:15, modules/hall-ui/public/fleet.html:15, modules/hall-ui/public/fleet.html:24 |
 | `f6f68ba322be` | 3x | Open {…} | modules/hall-ui/public/goal-inbox.js:53, modules/hall-ui/public/goal-inbox.js:69, modules/hall-ui/public/goals.js:67 |
-| … | | _188 more in the JSON registry_ | |
+| … | | _189 more in the JSON registry_ | |
 
-## `builders-hall` — 1828 strings
+## `builders-hall` — 1832 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -187,6 +187,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4a9385eeab33` | certain | Artists start on Artistry. | `modules/hall-ui/public/craft-mode.js:358` |
 | `5fcfdf8975cf` | certain | As configuration: | `modules/hall-ui/public/government.js:960` |
 | `01a0f29ff406` | certain | As first filed | `modules/hall-ui/public/idea.js:467` |
+| `1ac8ed08e067` | certain | Ask for this upgrade | `modules/hall-ui/public/settings-software-update.js:102` |
+| `1ac8ed08e067` | certain | Ask for this upgrade | `modules/hall-ui/public/settings-software-update.js:236` |
 | `fa86bf403775` | certain | Ask me again next session | `modules/hall-ui/public/craft-mode.js:357` |
 | `9b02ba5e6d23` | certain | Asked of others | `modules/hall-ui/public/collab.html:131` |
 | `688cc6dd38ee` | certain | Asked of you | `modules/hall-ui/public/collab.html:48` |
@@ -262,7 +264,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `98e16fff6561` | certain | Check this {…} line | `modules/hall-ui/public/tweak-editor.js:226` |
 | `f66f5cdaa732` | certain | Checked against {…} — nothing blocks this move.{…} | `modules/hall-ui/public/deploy.js:463` |
 | `f8725cf3ba62` | certain | Checking dependency order… | `modules/hall-ui/public/bulk-toolbar.js:217` |
-| `5f8b267e47e5` | certain | Checking for a newer version… | `modules/hall-ui/public/settings-software-update.js:170` |
+| `5f8b267e47e5` | certain | Checking for a newer version… | `modules/hall-ui/public/settings-software-update.js:245` |
 | `7a41b18c0de8` | certain | Checking for conflicts… | `modules/hall-ui/public/bulk-toolbar.js:196` |
 | `ac7cf27bd7de` | certain | Checking what this would do, and what it would bring in. The answer comes from the machine itself, so it can t | `modules/hall-ui/public/deploy.js:452` |
 | `aa3ba7d28a76` | certain | Checking your key… | `modules/hall-ui/public/settings.js:936` |
@@ -334,8 +336,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:975` |
 | `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:1001` |
 | `1ef1efc15b6c` | certain | Could not change that just now. | `modules/hall-ui/public/goals-render.js:1387` |
-| `6214998a5ebe` | certain | Could not check for a newer version: {…}. | `modules/hall-ui/public/settings-software-update.js:135` |
-| `9ab613a308d6` | certain | Could not check for updates: {…}. | `modules/hall-ui/public/settings-software-update.js:180` |
+| `6214998a5ebe` | certain | Could not check for a newer version: {…}. | `modules/hall-ui/public/settings-software-update.js:180` |
+| `9ab613a308d6` | certain | Could not check for updates: {…}. | `modules/hall-ui/public/settings-software-update.js:255` |
 | `c3f99e7c6e6b` | certain | Could not copy automatically — select and copy manually. ({…}) | `modules/hall-ui/public/settings.js:815` |
 | `e3fd1febf63d` | certain | Could not copy to the clipboard. Try again. | `modules/hall-ui/public/goals-page.js:423` |
 | `e3fd1febf63d` | certain | Could not copy to the clipboard. Try again. | `modules/hall-ui/public/work.js:649` |
@@ -397,6 +399,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5ef90fe7a6c2` | certain | Could not save: {…} | `modules/hall-ui/public/settings-autobongos.js:149` |
 | `007b134d9366` | certain | Could not send that invitation just now. | `modules/hall-ui/public/goals-render.js:1319` |
 | `31c6e3fd754b` | certain | Could not send the request just now. | `modules/hall-ui/public/goals-render.js:1402` |
+| `5d2e5fb4c8b5` | certain | Could not send the request: {…}. | `modules/hall-ui/public/settings-software-update.js:237` |
 | `1f4d9a989606` | certain | Could not set up key storage. Try again. | `modules/hall-ui/public/settings.js:996` |
 | `e65b392144ac` | certain | Could not set up storage. Try again. | `modules/hall-ui/public/settings.js:995` |
 | `d4601887a058` | certain | Could not sign out everywhere: {…} | `modules/hall-ui/public/settings-sessions.js:102` |
@@ -615,6 +618,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
 | `9e9f8a44276b` | certain | Identity vouched | `modules/hall-ui/public/watch.js:396` |
+| `3c24eedc9f2d` | certain | If that page does not let you in, ask {…} to install it for you.{…} | `modules/hall-ui/public/settings-software-update.js:101` |
 | `7d6a7de7a69e` | certain | If the {…} has invited you, sign in with GitHub and you're in. If not, ask them for an invite — this project d | `modules/hall-ui/public/hall-render.js:289` |
 | `4ef9f2a4df3b` | certain | If you own this project, | `modules/hall-ui/public/deploy.js:419` |
 | `b6c47d4ee42c` | certain | Image key removed. | `modules/hall-ui/public/settings.js:1012` |
@@ -641,7 +645,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `680491549e47` | certain | Its author recommends this becomes | `modules/hall-ui/public/board-room.js:308` |
 | `680491549e47` | certain | Its author recommends this becomes | `modules/hall-ui/public/idea.js:166` |
 | `5e62ee5addf1` | certain | Its details are below. | `modules/hall-ui/public/shell.js:778` |
-| `d42a078838bf` | certain | Its notes could not be read. | `modules/hall-ui/public/settings-software-update.js:101` |
+| `d42a078838bf` | certain | Its notes could not be read. | `modules/hall-ui/public/settings-software-update.js:146` |
 | `1e81d59d6955` | certain | Its work has shipped; someone who did not build it needs to try it on the live site | `modules/hall-ui/public/criterion-uat-ui.js:77` |
 | `b7719e855009` | certain | Join goal | `modules/hall-ui/public/goals-render.js:980` |
 | `9f9424a5100b` | certain | Join our Discord | `modules/hall-ui/public/hall-render.js:808` |
@@ -757,7 +761,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `479c1a45f39d` | certain | No backlog tasks match these filters. Try widening them. | `modules/hall-ui/public/work.js:831` |
 | `83f62fc94271` | certain | No builder account found for this sign-in. | `modules/hall-ui/public/settings.js:1204` |
 | `2e9c154c09cd` | certain | No builder selected. Open a builder from the | `modules/hall-ui/public/profile.js:977` |
-| `449db2ead464` | certain | No changes are listed for this version. | `modules/hall-ui/public/settings-software-update.js:103` |
+| `449db2ead464` | certain | No changes are listed for this version. | `modules/hall-ui/public/settings-software-update.js:148` |
 | `6d6fd2314248` | certain | No cross-project activity reported yet. | `modules/hall-ui/public/profile.js:402` |
 | `b1ada579483c` | certain | No custom ranks yet | `modules/hall-ui/public/government.js:358` |
 | `6e2d2e11f84a` | certain | No description. | `modules/hall-ui/public/idea.js:122` |
@@ -770,7 +774,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `139ec3636c22` | certain | No introductions right now. One appears here when a pairing round runs. | `modules/hall-ui/public/collab.html:99` |
 | `3b9823dd4579` | certain | No maintenance declared — nobody is on the hook for this module as the core advances. | `modules/hall-ui/public/modules.js:92` |
 | `64a4281934d1` | certain | No match. Try a page name, or an id like | `modules/hall-ui/public/palette.js:307` |
-| `f52552a6afcd` | certain | No notes were packed for this version. | `modules/hall-ui/public/settings-software-update.js:102` |
+| `f52552a6afcd` | certain | No notes were packed for this version. | `modules/hall-ui/public/settings-software-update.js:147` |
 | `4f89817b92e5` | certain | No onboarding steps recorded yet. | `modules/hall-ui/public/hall-render.js:886` |
 | `421ae031594e` | certain | No open goals in this version | `modules/hall-ui/public/task.js:561` |
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
@@ -849,7 +853,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f9f2a3af318a` | certain | Only mine | `modules/hall-ui/public/work.html:70` |
 | `ab48bab11b70` | certain | Only the artist who wrote this page, or another artist, can approve it or send it back. | `modules/hall-ui/public/approval-queue.js:168` |
 | `e11eae1d0a92` | certain | Only the goals your thoughts touched — everything else fades. | `modules/hall-ui/public/thinking.html:83` |
-| `f74ec527907f` | certain | Only the people allowed to upgrade this project see an Update button here. | `modules/hall-ui/public/settings-software-update.js:73` |
+| `f74ec527907f` | certain | Only the people allowed to upgrade this project see an Update button here. | `modules/hall-ui/public/settings-software-update.js:116` |
 | `f28917ca859e` | certain | Only the thoughts of the last thirty days. | `modules/hall-ui/public/thinking.html:81` |
 | `3468d58eb1fd` | certain | Only this goal's owner or a manager (or an Archon) may add members. | `modules/hall-ui/public/goals-render.js:1339` |
 | `fa818ee444b4` | certain | Only this goal's owner or a manager (or an Archon) may do this. | `modules/hall-ui/public/goals-render.js:1369` |
@@ -881,7 +885,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `62e75a9d0af4` | certain | Opening the reviews… | `modules/hall-ui/public/studio.html:159` |
 | `94f3d9f46098` | certain | Opening your doc… | `modules/hall-ui/public/page-notes.js:89` |
 | `94f3d9f46098` | certain | Opening your doc… | `modules/hall-ui/public/page-notes.js:273` |
-| `a2bd76ae030d` | certain | Opens this project's upgrade{…}: you see what would move, confirm it, and it installs, checks itself, and roll | `modules/hall-ui/public/settings-software-update.js:85` |
+| `a2bd76ae030d` | certain | Opens this project's upgrade{…}: you see what would move, confirm it, and it installs, checks itself, and roll | `modules/hall-ui/public/settings-software-update.js:130` |
 | `569980a263ae` | certain | Optional. This is the ledger link — a copy change ships as a task like every other change. | `modules/hall-ui/public/copy-desk.html:130` |
 | `f2e9e8f21e8e` | certain | Or add someone without asking… | `modules/hall-ui/public/goals-render.js:1264` |
 | `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1274` |
@@ -1088,7 +1092,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `dc0f9fe50a65` | certain | Show the setup guide again | `modules/hall-ui/public/index.html:68` |
 | `df16bd23e58e` | certain | Show the thoughts a session filed under your name. Off by default: only what a person filed. | `modules/hall-ui/public/thinking.html:82` |
 | `a81ec73539ef` | certain | Show {…} more | `modules/hall-ui/public/profile.js:793` |
-| `44945da22716` | certain | Show {…} more version{…} | `modules/hall-ui/public/settings-software-update.js:119` |
+| `44945da22716` | certain | Show {…} more version{…} | `modules/hall-ui/public/settings-software-update.js:164` |
 | `2af4c0f2b4b9` | certain | Showing {…} of {…}. | `modules/hall-ui/public/ideas.js:867` |
 | `2af4c0f2b4b9` | certain | Showing {…} of {…}. | `modules/hall-ui/public/profile.js:793` |
 | `838b17fa8d93` | certain | Shown on your public profile — it helps others know what you work on. | `modules/hall-ui/public/profile-nudge.js:86` |
@@ -1242,7 +1246,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3bc5ec5f35ec` | certain | The ranks, lowest to highest | `modules/hall-ui/public/ranks.html:55` |
 | `c0034db3281c` | certain | The reason is recorded in the audit log. This is recoverable: a retired task can be restored to the backlog wi | `modules/hall-ui/public/task.js:788` |
 | `1ce78006fe00` | certain | The reference did not load | `modules/hall-ui/public/drachmae.html:85` |
-| `c43812b59e97` | certain | The release notes could not be read: {…}. The versions are still listed. | `modules/hall-ui/public/settings-software-update.js:115` |
+| `c43812b59e97` | certain | The release notes could not be read: {…}. The versions are still listed. | `modules/hall-ui/public/settings-software-update.js:160` |
 | `8040b1d05ff2` | certain | The renders could not be read just now. Close the queue and open it again. | `modules/hall-ui/public/approval-queue.js:130` |
 | `3b5260b8780a` | certain | The reserved 16-rank ladder, which ranks are live today (archon, metic, thetes, xenos), and what each may do. | `modules/hall-ui/public/diagrams.html:60` |
 | `cfa55899240b` | certain | The roadmap could not be loaded right now. Reload to try again. | `modules/hall-ui/public/roadmap.js:494` |
@@ -1322,7 +1326,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d4b3b5556986` | certain | This page's reference docs | `modules/hall-ui/public/page-notes.js:113` |
 | `5bdcbec770dd` | certain | This project has no slash commands yet. | `modules/hall-ui/public/commands.js:38` |
 | `e97b2d549f10` | certain | This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this pr | `modules/hall-ui/public/project-settings.js:259` |
-| `fcd43f045614` | certain | This project is upgraded on the server that runs it: | `modules/hall-ui/public/settings-software-update.js:76` |
+| `fcd43f045614` | certain | This project is upgraded on the server that runs it: | `modules/hall-ui/public/settings-software-update.js:121` |
+| `53e287924841` | certain | This project runs on a server that {…} looks after, so they install its updates. Ask them for this one and the | `modules/hall-ui/public/settings-software-update.js:100` |
 | `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:582` |
 | `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:564` |
 | `b9ed9a5f38dd` | certain | This round changed no lines. | `modules/hall-ui/public/approval-queue.js:149` |
@@ -1361,10 +1366,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6516cc82021a` | certain | UI design | `modules/hall-ui/public/settings.html:261` |
 | `2c1c20785a6e` | certain | Unclear — a person would not know what to do | `modules/hall-ui/public/copy-desk.html:91` |
 | `aa445f06cc5e` | certain | Unlink failed: {…} | `modules/hall-ui/public/settings.js:739` |
-| `4a716d7d8d46` | certain | Up to date | `modules/hall-ui/public/settings-software-update.js:142` |
-| `13ced9b2fa12` | certain | Update ready | `modules/hall-ui/public/settings-software-update.js:145` |
+| `4a716d7d8d46` | certain | Up to date | `modules/hall-ui/public/settings-software-update.js:187` |
 | `1e091df06692` | certain | Update rule: {…} | `modules/hall-ui/public/deploy.js:297` |
-| `55fde21d907b` | certain | Update to {…}{…} | `modules/hall-ui/public/settings-software-update.js:85` |
+| `55fde21d907b` | certain | Update to {…}{…} | `modules/hall-ui/public/settings-software-update.js:130` |
 | `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:777` |
 | `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:775` |
 | `e7e2a99a2bea` | certain | Use this | `modules/hall-ui/public/settings-specialities.js:395` |
@@ -1540,7 +1544,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `daad412fa988` | certain | back to the street | `modules/hall-ui/public/street.html:123` |
 | `24a2c1d958da` | certain | back to the studio | `modules/hall-ui/public/tweak-editor.html:108` |
 | `e81d92078af1` | certain | bongos help | `modules/hall-ui/public/commands.html:45` |
-| `9193bf136fed` | certain | bongos upgrade | `modules/hall-ui/public/settings-software-update.js:76` |
+| `9193bf136fed` | certain | bongos upgrade | `modules/hall-ui/public/settings-software-update.js:121` |
 | `552e00198649` | certain | builders, on the People tab | `modules/hall-ui/public/watch.html:51` |
 | `c36033fdd528` | certain | built & enforced today | `modules/hall-ui/public/diagrams.html:42` |
 | `a87a3c30b1b5` | certain | built here | `modules/hall-ui/public/modules.js:53` |
@@ -1745,7 +1749,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5e1eda03fa73` | certain | the sky | `modules/hall-ui/public/goal-map.html:69` |
 | `22fc2137739d` | certain | the street | `modules/hall-ui/public/street.html:67` |
 | `911e948a33ae` | certain | the task | `modules/hall-ui/public/sky-panel.js:103` |
-| `2e5539862eb0` | certain | there takes this version, with the same health check and rollback. | `modules/hall-ui/public/settings-software-update.js:76` |
+| `2e5539862eb0` | certain | there takes this version, with the same health check and rollback. | `modules/hall-ui/public/settings-software-update.js:121` |
 | `632527db5bca` | certain | this session | `modules/hall-ui/public/settings-sessions.js:44` |
 | `130c3731ad83` | certain | this week | `modules/hall-ui/public/studio.html:85` |
 | `4b6321a50a2d` | certain | thoughts · | `modules/hall-ui/public/sky-interaction.js:128` |
@@ -1885,7 +1889,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a1cef2da08d` | certain | …and {…} more goals — | `modules/hall-ui/public/goal-inbox.js:127` |
 | `5b9fa7cb4fb0` | certain | …and {…} more waiting — | `modules/hall-ui/public/goal-inbox.js:158` |
 | `b797996b2e4f` | certain | …and {…} more, not listed. | `modules/hall-ui/public/deploy.js:551` |
-| `9132930284c4` | certain | …and {…} older version{…}, also in this update. | `modules/hall-ui/public/settings-software-update.js:120` |
+| `9132930284c4` | certain | …and {…} older version{…}, also in this update. | `modules/hall-ui/public/settings-software-update.js:165` |
 | `b2a04abfead0` | certain | …{…} more awaiting a nod. | `modules/hall-ui/public/goal-inbox.js:316` |
 | `f16717b3e122` | certain | …{…} more awaiting an answer. | `modules/hall-ui/public/goal-inbox.js:396` |
 | `616fb9adf3cf` | certain | …{…} more going quiet. | `modules/hall-ui/public/goal-inbox.js:485` |