@bongos/core 1.21.72 → 1.21.74

package/modules/hall-ui/public/shell.js

@@ -99,6 +99,8 @@
     studio: '<path d="M9 15.5V8.5"/><path d="M9 8.5C9 5.5 6.5 3.5 3.5 3.5c0 3 2.5 5 5.5 5Z"/><path d="M9 10C9 7.5 11.2 5.5 14 5.5c0 2.7-2.2 4.5-5 4.5Z"/>',
     settings: '<circle cx="9" cy="9" r="2.5"/><path d="M9 2.5v2m0 9v2M2.5 9h2m9 0h2M4.4 4.4l1.4 1.4m6.4 6.4 1.4 1.4m0-9.2-1.4 1.4M5.8 12.2l-1.4 1.4"/>',
     admin: '<path d="M9 2.5 15 5v4c0 3.5-2.4 6-6 7-3.6-1-6-3.5-6-7V5l6-2.5Z"/>',
+    // The governor city: a pediment over columns, the Governing mode's own glyph.
+    city: '<path d="M2.5 7 9 3l6.5 4M4 7.5v6.5M7 7.5v6.5M11 7.5v6.5M14 7.5v6.5M2.5 15.5h13"/>',
     signout: '<path d="M7 3.5H4a1 1 0 0 0-1 1v9a1 1 0 0 0 1 1h3M12 12l3-3-3-3M15 9H7"/>',
   };
   function icon(name) {
@@ -210,6 +212,13 @@
       // so the badge counts ballots this viewer can actually cast, never "items
       // open somewhere".
       { id: 'board-room', label: 'Board Room', icon: 'admin', href: '/board-room', gate: 'perm:board.vote.cast', count: 'board_votes' },
+      // The governor city (task 1004524): the owner put it on the sidebar on
+      // 2026-10-08, reversing "leave it off". It is the Governing mode's lead tab
+      // (craft-mode.js folds that mode's other tabs into a dropdown under it).
+      // Gated on the atom its page is (requireBoardVotePage), and it sits in this
+      // head-less group for the reason the Board Room does: the atom floors below
+      // any rank head. Cosmetic only (ADR 0016).
+      { id: 'city', label: 'City', icon: 'city', href: '/city', gate: 'perm:board.vote.cast' },
       // task 1004326 (BV2.TW15 of goal 1000095): the Ideas board (/ideas, task
       // 1002928) and the Copy desk (/copy-desk, task 1003113) are ARCHIVED — off
       // the nav on the owner's call of 2026-09-27, NOT deleted. Both pages and

package/modules/hall-ui/public/street.html

@@ -203,9 +203,9 @@
   </div>
 </div>
 
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/city-draw.js?v=2026-10-04-pins1"></script>
 <script src="/builders/street-draw.js?v=2026-10-04-pins1"></script>

package/modules/hall-ui/public/studio.html

@@ -176,9 +176,9 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -54,9 +54,9 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -138,9 +138,9 @@
   </div>
 </div>
 
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -142,9 +142,9 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -165,9 +165,9 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,9 +171,9 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/lifecycle/routes/project-settings.js

@@ -34,6 +34,29 @@ const goalCategory = require('../goal-category');
 
 const log = api.logger('lifecycle');
 
+// --- ship mode: who starts a ship (task 1004628, ADR 0369) -------------------
+//
+// One row shape, two readers: the settings page (inside GET /project-settings) and
+// any builder's CLI or AI session (GET /project-settings/ship-mode), so the sentence
+// a person reads and the one an agent obeys are the same words.
+function shipModeRow(resolved) {
+  return {
+    key: 'ship_mode',
+    title: 'Ship mode',
+    editable: true,
+    state: 'live',
+    value: { mode: resolved.mode, chosen: resolved.chosen, modes: api.projectSettings.SHIP_MODES },
+    sentence: api.projectSettings.describeShipMode(resolved),
+    choices: [
+      { mode: 'auto', label: 'Auto (recommended)', sentence: 'When the AI finishes a task it ships and lands it. Nobody has to type a command.' },
+      { mode: 'manual', label: 'Manual', sentence: 'The AI stops before each ship and asks a person to approve it.' },
+    ],
+    source: resolved.source,
+    invalid: resolved.invalid,
+    reads: { file: 'project_settings[\'ship.mode\'] (migration core_231)', adr: 'ADR 0369' },
+  };
+}
+
 // --- the three rows that are READ, never written -----------------------------
 //
 // Each names the committed artefact it resolves from, because "you cannot edit this"
@@ -214,12 +237,14 @@ module.exports = function buildProjectSettingsRouter() {
       // Inactive included: the set's SHAPE is what this page edits, and a deactivated
       // category the owner cannot see is one they cannot bring back.
       const categories = await goalCategory.listCategories({ includeInactive: true });
+      const shipMode = await api.projectSettings.resolveShipMode();
 
       // A settings read is a configuration comparison — a cached one is wrong the
       // moment somebody turns a knob (the rot.js precedent).
       res.set('Cache-Control', 'no-store');
       res.json({
         rows: [
+          shipModeRow(shipMode),
           {
             key: 'rot_timer',
             title: 'Stale timer',
@@ -316,7 +341,47 @@ module.exports = function buildProjectSettingsRouter() {
       }
     });
 
+  // GET /project-settings/ship-mode — the ship mode alone, for the CLI and the AI.
+  //
+  // rank: any signed-in builder. Unlike the full settings read this carries no
+  // reward internals or file paths an agent could not already read, and every
+  // builder's AI session must know whether to ship on its own or stop and ask —
+  // gating it Metic+ would leave a newcomer's session guessing.
+  router.get('/project-settings/ship-mode', api.requireBuilder, async (req, res) => {
+    try {
+      const resolved = await api.projectSettings.resolveShipMode();
+      res.set('Cache-Control', 'no-store');
+      const row = shipModeRow(resolved);
+      res.json({ mode: resolved.mode, chosen: resolved.chosen, source: resolved.source, sentence: row.sentence, choices: row.choices });
+    } catch (err) {
+      log.error(`GET /project-settings/ship-mode: ${err && err.message}`);
+      res.fail('project_settings_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // PATCH /project-settings/ship-mode — body { mode: 'auto' | 'manual' }.
+  //
+  // rank: project.settings.manage (metic+, government_010) — the same atom as the
+  // other writes on this page. Validated with the resolver's own parser, so the
+  // page, the CLI and the reader can never disagree about what a mode is.
+  router.patch('/project-settings/ship-mode', api.requireBuilder, api.requirePermission('project.settings.manage'), async (req, res) => {
+    if (api.validateOrRespond(req, res, { mode: { required: true, type: 'string' } })) return;
+    const parsed = api.projectSettings.parseShipMode(req.body.mode);
+    if (!parsed.mode) {
+      return res.fail('bad_ship_mode', { status: 400, message: `mode: ${parsed.reason}` });
+    }
+    try {
+      await api.projectSettings.set(api.projectSettings.KEYS.SHIP_MODE, parsed.mode, req.builder.id);
+      const resolved = await api.projectSettings.resolveShipMode();
+      res.json({ ok: true, mode: resolved.mode, chosen: resolved.chosen, source: resolved.source, sentence: api.projectSettings.describeShipMode(resolved) });
+    } catch (err) {
+      log.error(`PATCH /project-settings/ship-mode: ${err && err.message}`);
+      res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };
 
 module.exports.settingsDeskRows = settingsDeskRows;
+module.exports.shipModeRow = shipModeRow;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.72",
+  "version": "1.21.74",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.72",
+      "version": "1.21.74",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.72",
+  "version": "1.21.74",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9242,5 +9242,17 @@
       "id": "1004578",
       "text": "While a new project is being set up, founders now get a little cloud-hopping game: each cloud is a public project on the platform, in its own planet colour. When the project goes live, clouds and stars fill the screen and fade"
     }
+  ],
+  "1.21.73": [
+    {
+      "id": "1004625",
+      "text": "The governor city now has its own tab, and in Governing mode it leads the sidebar with every other governing page tucked into one dropdown under it."
+    }
+  ],
+  "1.21.74": [
+    {
+      "id": "1004628",
+      "text": "Projects now have a Ship mode setting. Auto, the default, means the AI ships finished work on its own. Manual means it asks first. Owners can switch it on the project settings page."
+    }
   ]
 }

package/scripts/gds/shipping-mode.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// scripts/gds/shipping-mode.js — read or set the project's ship mode (task 1004628, ADR 0369).
+//
+// WHY. Ship mode says WHO starts a ship: in `auto` the AI finishes a task and ships
+// it with no commands from the person; in `manual` it stops and asks first. An AI
+// session has to know which before it ships, and a person has to be able to change
+// it without opening the settings page — so the mode is one command away.
+//
+// Usage:
+//   node scripts/gds/shipping-mode.js                 print the mode (any builder)
+//   node scripts/gds/shipping-mode.js auto|manual     set it (needs project.settings.manage)
+//   node scripts/gds/shipping-mode.js --json          print the mode as JSON
+//
+// Also `bongos ship-mode [auto|manual]`.
+
+'use strict';
+
+const { apiCall, requireSession, errCode, cliExit } = require('./cli-lib');
+
+const USAGE = 'usage: node scripts/gds/shipping-mode.js [auto|manual] [--json]';
+
+// What a person sees. One sentence from the server, plus how to change it.
+function describe(data) {
+  const lines = [`Ship mode: ${data.mode}${data.chosen ? '' : ' (default — not chosen yet)'}`];
+  if (data.sentence) lines.push(data.sentence);
+  lines.push(data.mode === 'manual'
+    ? 'Change it: node scripts/gds/shipping-mode.js auto'
+    : 'Change it: node scripts/gds/shipping-mode.js manual');
+  return lines.join('\n');
+}
+
+async function main(argv) {
+  const args = argv.filter((a) => a !== '--json');
+  const json = argv.includes('--json');
+  if (args.includes('--help') || args.includes('-h')) { console.log(USAGE); return 0; }
+  if (args.length > 1) { console.error(USAGE); return 2; }
+
+  await requireSession();
+
+  if (args.length === 0) {
+    const r = await apiCall('GET', '/api/bongos/project-settings/ship-mode');
+    if (!r.ok) {
+      console.error(`Could not read the ship mode (${r.status}${errCode(r.data) ? `: ${errCode(r.data)}` : ''}).`);
+      return 1;
+    }
+    console.log(json ? JSON.stringify(r.data) : describe(r.data));
+    return 0;
+  }
+
+  const mode = String(args[0]).trim().toLowerCase();
+  if (mode !== 'auto' && mode !== 'manual') { console.error(USAGE); return 2; }
+  const r = await apiCall('PATCH', '/api/bongos/project-settings/ship-mode', { mode });
+  if (!r.ok) {
+    if (r.status === 403) {
+      console.error('Only the project owner (or someone with project settings access) can change the ship mode.');
+    } else {
+      console.error(`Could not set the ship mode (${r.status}${errCode(r.data) ? `: ${errCode(r.data)}` : ''}).`);
+    }
+    return 1;
+  }
+  console.log(json ? JSON.stringify(r.data) : `Saved. ${describe(r.data)}`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2))
+    .then((code) => cliExit(code))
+    .catch((err) => { console.error('fatal:', err && err.message ? err.message : err); cliExit(1); });
+}
+
+module.exports = { describe, main };

package/src/bongos/project-settings.js

@@ -49,8 +49,20 @@ const { logger } = require('./logger');
 const SETTING_KEYS = {
   ROT_DAYS: 'attention.rot_days',
   FOCUS_VERSION: 'roadmap.focus_version',
+  SHIP_MODE: 'ship.mode',
 };
 
+// SHIP MODE (task 1004628, ADR 0369) — WHO starts a ship, never HOW it lands.
+//   auto   — the AI finishes a task, then ships and lands it with no commands from
+//            the person. The default, because a new owner who is handed terminal
+//            commands at every ship reads the project as broken (owner feedback,
+//            2026-10-08).
+//   manual — the AI stops before shipping and the person approves each ship.
+// It is NOT the deploy mode (config/deploy.json, ci|laptop): that one decides the
+// mechanics of landing once a ship starts, is committed config, and is unchanged.
+const SHIP_MODES = Object.freeze(['auto', 'manual']);
+const DEFAULT_SHIP_MODE = 'auto';
+
 // The last-resort rot timer, in days. 30 because that is the shortest window in
 // which "nobody has touched this" is evidence of rot rather than evidence of a
 // normal week — a fortnight would fire on every ordinary holiday, and a quarter is
@@ -202,6 +214,56 @@ async function setFocusVersionId(versionId, builderId = null) {
   return String(versionId);
 }
 
+// parseShipMode(raw) — one candidate as a ship mode, or why it is unusable. Pure,
+// never throws, case-insensitive and trimmed so a hand-typed "Manual " still reads.
+function parseShipMode(raw) {
+  if (raw == null || String(raw).trim() === '') return { reason: 'empty' };
+  const v = String(raw).trim().toLowerCase();
+  if (!SHIP_MODES.includes(v)) return { reason: `must be one of ${SHIP_MODES.join(' | ')}` };
+  return { mode: v };
+}
+
+// resolveShipMode() — the project's ship mode and where it came from.
+// Returns { mode, source, chosen, invalid }:
+//   mode    — always 'auto' or 'manual'
+//   source  — 'project_settings' | 'default'
+//   chosen  — true only when someone actually SET a usable value. "Never chosen" is
+//             a real answer the first-ship prompt (task 1004630) asks about, so it
+//             must not be confused with "chose the default".
+//   invalid — null, or { where, raw, reason } for a stored value that is unusable.
+// A database that cannot be read answers the default rather than failing a ship —
+// the same reporting posture as resolveRotDays.
+async function resolveShipMode() {
+  let row = null;
+  try {
+    row = await getSetting(SETTING_KEYS.SHIP_MODE);
+  } catch (err) {
+    logger.error(`project_settings read failed; falling back to the default ship mode: ${err && err.message}`);
+    return { mode: DEFAULT_SHIP_MODE, source: 'default', chosen: false, invalid: null };
+  }
+  if (row && row.value != null && row.value !== '') {
+    const got = parseShipMode(row.value);
+    if (got.mode) return { mode: got.mode, source: 'project_settings', chosen: true, invalid: null };
+    return {
+      mode: DEFAULT_SHIP_MODE,
+      source: 'default',
+      chosen: false,
+      invalid: { where: `project_settings['${SETTING_KEYS.SHIP_MODE}']`, raw: String(row.value), reason: got.reason },
+    };
+  }
+  return { mode: DEFAULT_SHIP_MODE, source: 'default', chosen: false, invalid: null };
+}
+
+// describeShipMode(resolved) — one plain sentence for a person or an AI session.
+function describeShipMode(resolved) {
+  const r = resolved || {};
+  const what = r.mode === 'manual'
+    ? 'Manual: the AI stops before each ship and waits for a person to approve it.'
+    : 'Auto: when the AI finishes a task it ships and lands it with no commands from a person.';
+  const how = r.chosen ? '' : ' (the default — nobody has chosen yet)';
+  return `${what}${how}`;
+}
+
 // parseDays is exported for the tests only — the range check and the default are
 // asserted against the SAME constants the resolver reads, because a test that
 // re-typed 30 or 365 would be the second copy of the number this file exists to
@@ -218,4 +280,9 @@ module.exports = {
   describeRotTimer,
   getFocusVersionId,
   setFocusVersionId,
+  SHIP_MODES,
+  DEFAULT_SHIP_MODE,
+  parseShipMode,
+  resolveShipMode,
+  describeShipMode,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.72'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.74'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -462,6 +462,12 @@ module.exports = {
     // page's own anti-drift rule forbids, caught one layer up on task 1003280's grade.
     get MIN_ROT_DAYS() { return require('./bongos/project-settings').MIN_ROT_DAYS; },
     get MAX_ROT_DAYS() { return require('./bongos/project-settings').MAX_ROT_DAYS; },
+    // Ship mode (task 1004628, ADR 0369): who starts a ship — the AI (auto) or a
+    // person (manual). The settings page writes it; the CLI and the AI read it.
+    get SHIP_MODES() { return require('./bongos/project-settings').SHIP_MODES; },
+    get parseShipMode() { return require('./bongos/project-settings').parseShipMode; },
+    get resolveShipMode() { return require('./bongos/project-settings').resolveShipMode; },
+    get describeShipMode() { return require('./bongos/project-settings').describeShipMode; },
   },
   readConfigFileSync: instanceConfig.readConfigFileSync,
   configHome: instanceConfig.configHome,

package/tests/craft_mode_nav.mjs

@@ -187,7 +187,7 @@ test('a mode never shows a tab the gate hid, and a later gate pass keeps the mod
   p.signIn('thetes');
   assert.ok(!p.showing().includes('watch'), 'a thetes in Governing does not get the metic-floored Watch tab');
   assert.ok(!p.headShowing('government'), 'nor its group head');
-  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'profile', 'collab', 'roster'], 'what a thetes board member in Governing sees');
+  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'city', 'profile', 'collab', 'roster'], 'what a thetes board member in Governing sees');
   p.signIn('archon');
   assert.ok(p.showing().includes('watch'), 'promoted, the gate lets it through and the mode keeps it');
   assert.ok(p.headShowing('government'), 'and its group head comes back with it, which only a mode pass after the gate can know');
@@ -202,3 +202,119 @@ test('shell.js applies the mode AFTER its gate loop, and style.css hides what th
   assert.match(read('style.css'), /#app-sidebar \[data-craft-off\] \{ display: none !important; \}/);
   assert.doesNotMatch(CRAFT, /\.hidden\s*=/, 'the mode never writes `hidden`, which the gate owns');
 });
+
+// ---------- the Governing fold (owner, 2026-10-08) ----------
+// Governing leads with the City and folds its other own tabs into one dropdown
+// under it. The fold MOVES nodes, which the parsed sidebar above cannot model, so
+// these cases run the real craft-mode.js against a small working tree: nodes with
+// parents, insertBefore and comments, laid out as shell.js's NAV groups are.
+function treeNode(tag, nodeType = 1) {
+  const attrs = {};
+  const n = {
+    tagName: tag, nodeType, id: '', className: '', dataset: {}, hidden: false, childNodes: [], parentNode: null, _html: '', type: '',
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    get classList() {
+      const self = this;
+      const list = () => self.className.split(/\s+/).filter(Boolean);
+      return {
+        contains: (c) => list().includes(c),
+        add: (c) => { if (!list().includes(c)) self.className = list().concat(c).join(' '); },
+        remove: (c) => { self.className = list().filter((x) => x !== c).join(' '); },
+        toggle(c, on) { if (on === undefined) on = !this.contains(c); if (on) this.add(c); else this.remove(c); return on; },
+      };
+    },
+    get nextSibling() { const p = this.parentNode; return p ? p.childNodes[p.childNodes.indexOf(this) + 1] || null : null; },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+    appendChild(c) { return this.insertBefore(c, null); },
+    insertBefore(c, ref) {
+      if (c.parentNode) c.parentNode.removeChild(c);
+      const i = ref ? this.childNodes.indexOf(ref) : -1;
+      if (i === -1) this.childNodes.push(c); else this.childNodes.splice(i, 0, c);
+      c.parentNode = this;
+      return c;
+    },
+    removeChild(c) { this.childNodes.splice(this.childNodes.indexOf(c), 1); c.parentNode = null; return c; },
+    walk(fn) { for (const c of this.childNodes) { if (c.nodeType === 1) { fn(c); c.walk(fn); } } },
+    querySelectorAll(sel) { const out = []; this.walk((c) => { if (sel.startsWith('.') && c.classList.contains(sel.slice(1))) out.push(c); }); return out; },
+    querySelector(sel) { return this.querySelectorAll(sel)[0] || null; },
+    addEventListener() {}, focus() {},
+  };
+  return n;
+}
+function bootTree({ mode = null, activeId = null } = {}) {
+  const el = (tag, cls, id) => { const n = treeNode(tag); n.className = cls || ''; n.id = id || ''; return n; };
+  const sidebar = el('NAV', '', 'app-sidebar');
+  // shell.js's NAV, group by group: the unlabeled one holds its items directly,
+  // a labeled one a head and a .nav-items wrapper (renderSidebar's shape).
+  for (const block of SHELL.slice(SHELL.indexOf('var NAV = ['), SHELL.indexOf('// ---------- nav group collapse')).split('{ group: ').slice(1)) {
+    const label = /^'([^']*)'/.exec(block)[1];
+    const group = el('DIV', 'nav-group' + (label ? ' nav-group--collapsible' : ''));
+    let into = group;
+    if (label) {
+      const head = el('BUTTON', 'nav-group__head');
+      head.dataset.group = label.toLowerCase();
+      group.appendChild(head);
+      into = group.appendChild(el('DIV', 'nav-items', 'nav-items-' + label.toLowerCase()));
+    }
+    for (const m of block.matchAll(/\{ id: '([a-z-]+)', label:/g)) {
+      into.appendChild(el('A', 'nav-item' + (m[1] === activeId ? ' nav-item--active' : ''), 'nav-' + m[1]));
+    }
+    sidebar.appendChild(group);
+  }
+  const root = treeNode('HTML');
+  const byId = (id) => { if (sidebar.id === id) return sidebar; let hit = null; sidebar.walk((c) => { if (!hit && c.id === id) hit = c; }); return hit; };
+  const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
+  const documentObj = {
+    body: treeNode('BODY'), documentElement: root, activeElement: null,
+    getElementById: byId, querySelector: () => null, querySelectorAll: () => [],
+    createElement: (t) => treeNode(t.toUpperCase()), createComment: (t) => Object.assign(treeNode('#comment', 8), { data: t }),
+    addEventListener() {}, removeEventListener() {},
+  };
+  const windowObj = {
+    location: { search: '' }, matchMedia: () => ({ matches: false }),
+    localStorage: mk({}), sessionStorage: mk(mode ? { 'hall-craft': mode } : {}),
+  };
+  const sandbox = { window: windowObj, document: documentObj, console, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  const craft = windowObj.OTBCraftMode;
+  craft.mount();
+  const fold = () => byId('craft-fold');
+  const ids = (n) => n.querySelectorAll('.nav-item').map((a) => a.id.slice(4));
+  const order = () => ids(sidebar);
+  return { craft, sidebar, fold, ids, order, byId };
+}
+
+test('GOVERNING LEADS WITH THE CITY: its other tabs fold into one dropdown right under it', () => {
+  const before = bootTree().order();
+  const p = bootTree({ mode: 'governing' });
+  const fold = p.fold();
+  assert.ok(fold, 'the dropdown exists in Governing');
+  assert.equal(p.byId('nav-city').nextSibling, fold, 'directly under the City tab');
+  const own = p.craft.tabsFor('governing').filter((id) => !p.craft.ALWAYS_TABS.includes(id) && id !== 'city');
+  assert.deepEqual(JSON.parse(JSON.stringify(p.ids(fold))), JSON.parse(JSON.stringify(own)), 'every other Governing tab is in it, in the mode\'s order');
+  assert.ok(fold.classList.contains('nav-group--collapsed'), 'a dropdown starts closed');
+  const head = fold.querySelector('.nav-group__head');
+  assert.equal(head.getAttribute('aria-expanded'), 'false');
+  assert.equal(head.getAttribute('aria-controls'), 'nav-items-craft-fold', 'the head names the region it opens');
+  assert.match(head.innerHTML, /More governing/);
+  assert.ok(head.hasAttribute('data-craft-off') === false, 'its head shows while a tab inside does');
+  assert.ok(p.sidebar.querySelectorAll('.nav-group__head').find((h) => h.dataset.group === 'government').hasAttribute('data-craft-off'),
+    'the emptied Government head hides, so no label sits over nothing');
+  p.craft.choose('building');
+  assert.equal(p.fold(), null, 'leaving Governing removes the dropdown');
+  assert.deepEqual(p.order(), before, 'and puts every tab back exactly where it was');
+  p.craft.choose('governing');
+  p.craft.choose('governing');
+  assert.equal(p.sidebar.querySelectorAll('.craft-fold').length, 1, 'choosing it again builds no second dropdown');
+});
+
+test('the dropdown opens on its own when the page you are on is inside it', () => {
+  const p = bootTree({ mode: 'governing', activeId: 'watch' });
+  assert.ok(!p.fold().classList.contains('nav-group--collapsed'), 'on Watch, the dropdown is open');
+  assert.equal(p.fold().querySelector('.nav-group__head').getAttribute('aria-expanded'), 'true');
+  assert.equal(bootTree({ mode: 'artistry' }).fold(), null, 'no other mode folds anything');
+  assert.equal(bootTree().fold(), null, 'nor does no mode');
+});

package/tests/hall_city.mjs

@@ -271,8 +271,9 @@ test('the page holds only the wordmark, the switch, the city, one button and one
 });
 
 // task 1004544 (owner decision 2026-10-02): the city sits in the hall chrome
-// behind the shell's full-screen switch, the sky's mechanism (task 1004327),
-// and still has no sidebar link.
+// behind the shell's full-screen switch, the sky's mechanism (task 1004327).
+// The owner put the CITY on the sidebar on 2026-10-08 (the Governing mode's
+// lead tab); the street still has no link of its own.
 test('the city sits in the hall chrome, behind the shell\'s full-screen switch', () => {
   const html = read('city.html').replace(/<!--[\s\S]*?-->/g, '');
   assert.match(html, /<body data-page="city"[^>]*\sdata-fullscreen-switch>/, 'the bare attribute: the page lays itself out for full screen');
@@ -285,7 +286,8 @@ test('the city sits in the hall chrome, behind the shell\'s full-screen switch',
   assert.match(css, /html\[data-fullscreen="on"\] \.city-main \{ top: 0; left: 0; \}/);
   assert.match(css, /html\[data-fullscreen="on"\] \.city-top \{ right: 184px; \}/, 'the strip steps clear of the corner exit');
   const shell = read('shell.js');
-  assert.doesNotMatch(shell, /href:\s*'(\/builders)?\/(city|street)'/, 'no sidebar link (owner: leave it off the sidebar)');
+  assert.match(shell, /\{ id: 'city', label: 'City', icon: 'city', href: '\/city', gate: 'perm:board\.vote\.cast' \}/, 'the city is a tab, gated on its page\'s atom');
+  assert.doesNotMatch(shell, /href:\s*'(\/builders)?\/street'/, 'the street has no sidebar link: the way in is the city');
 });
 
 test('motion is CSS only and dies under reduced motion; no page :root; no innerHTML', () => {

package/tests/hall_nav.mjs

@@ -267,7 +267,9 @@ test('sidebar groups read by audience, in order', () => {
   // purpose (task 1003479, and tests/goal_map_page.mjs pinned it); the owner
   // granted the sky that slot on 2026-09-24 (ADR 0227 §11), under Goals because
   // it is the goals seen as one picture.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'thinking', 'studio'],
+  // 2026-10-08: 'city' — the governor city — joins after the Board Room, on the
+  // same atom and for the same reason (owner call; it leads the Governing mode).
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'city', 'thinking', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // task 1003444: 'people' LEFT the group — the owner deleted the hall's

package/tests/hall_street.mjs

@@ -504,7 +504,8 @@ test('the street sits in the hall chrome, behind the shell\'s full-screen switch
   assert.match(css, /\.street-stage \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
   assert.match(css, /html\[data-fullscreen="on"\] \.street-stage \{ top: 0; left: 0; \}/);
   assert.match(css, /html\[data-fullscreen="on"\] \.street-top \{ padding-right: 184px; \}/, 'the strip steps clear of the corner exit');
-  assert.doesNotMatch(read('shell.js'), /href:\s*'(\/builders)?\/(city|street)'/, 'no sidebar link (owner: leave it off the sidebar)');
+  // The city became a tab on 2026-10-08 (owner); the street is still reached through it.
+  assert.doesNotMatch(read('shell.js'), /href:\s*'(\/builders)?\/street'/, 'no sidebar link (owner: leave it off the sidebar)');
 });
 
 test('motion is CSS only and dies under reduced motion; no page :root; no innerHTML', () => {

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-04-lightbulb/);
+    assert.match(HTML, /shell\.js\?v=2026-10-08-city-tab/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);