@bongos/core 1.21.78 → 1.21.79

package/modules/hall-ui/public/shell.js

@@ -84,27 +84,59 @@
   }
 
   // Small stroke icon set (18px grid, currentColor) — hand-rolled, no framework.
+  //
+  // ONE GLYPH PER TAB (task 1004626). The rail is a 64px icon strip until it
+  // opens, so at rest the icon IS the tab's name — two tabs wearing one glyph
+  // are two tabs a builder cannot tell apart (nine Government tabs once shared a
+  // shield, all eight Docs tabs one page). Every NAV item names its own key here
+  // and no two items share one; tests/hall_nav.mjs fails on a repeat, on a key
+  // missing from this set, and on two keys drawing the same markup.
   var ICONS = {
+    // the project
     home: '<path d="M3 8.5 9 3l6 5.5V15a1 1 0 0 1-1 1h-3.5v-4h-3v4H4a1 1 0 0 1-1-1V8.5Z"/>',
-    work: '<rect x="2.5" y="5.5" width="13" height="9" rx="1.5"/><path d="M6.5 5.5V4a1.5 1.5 0 0 1 1.5-1.5h2A1.5 1.5 0 0 1 11.5 4v1.5M2.5 9.5h13"/>',
-    standing: '<circle cx="9" cy="6" r="3"/><path d="M3.5 15.5c.6-2.9 2.9-4.5 5.5-4.5s4.9 1.6 5.5 4.5"/>',
-    profile: '<rect x="2.5" y="4" width="13" height="10" rx="1.5"/><circle cx="6.3" cy="8" r="1.6"/><path d="M4.1 12c.3-1.1 1.1-1.7 2.2-1.7s1.9.6 2.2 1.7"/><path d="M10.4 7.5h3M10.4 10.3h3"/>',
-    goals: '<circle cx="9" cy="9" r="6.5"/><circle cx="9" cy="9" r="3.5"/><circle cx="9" cy="9" r="0.8" fill="currentColor"/>',
     roadmap: '<path d="M3 15.5V3.5l4 2 4-2 4 2v10l-4-2-4 2-4-2Z"/><path d="M7 3.5v10M11 5.5v10"/>',
-    leaderboard: '<path d="M3.5 15.5v-6M9 15.5V3.5m5.5 12v-9"/>',
-    docs: '<path d="M4 3.5h7l3 3v10H4v-13Z"/><path d="M11 3.5v3h3"/>',
+    goals: '<circle cx="9" cy="9" r="6.5"/><circle cx="9" cy="9" r="3.5"/><circle cx="9" cy="9" r="0.8" fill="currentColor"/>',
+    sky: '<circle cx="3.8" cy="12.5" r="1.3"/><circle cx="8.5" cy="5" r="1.3"/><circle cx="14.2" cy="8.5" r="1.3"/><circle cx="12" cy="14.8" r="1.3"/><path d="M4.5 11.4 7.8 6.1M9.6 5.7l3.5 2.1M13.7 9.8l-1.2 3.7"/>',
+    work: '<rect x="2.5" y="5.5" width="13" height="9" rx="1.5"/><path d="M6.5 5.5V4a1.5 1.5 0 0 1 1.5-1.5h2A1.5 1.5 0 0 1 11.5 4v1.5M2.5 9.5h13"/>',
+    blockers: '<path d="M6.3 2.5h5.4l3.8 3.8v5.4l-3.8 3.8H6.3l-3.8-3.8V6.3Z"/><path d="M6 9h6"/>',
+    boardroom: '<path d="M2.5 9h13v5.5a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1V9Z"/><path d="M5.5 9V2.5h7V9"/><path d="M7.3 5.8l1.2 1.2 2.2-2.3"/>',
+    thinking: '<path d="M9 2.5a4.5 4.5 0 0 0-2.7 8.1c.5 .4 .7 .9 .7 1.4v.5h4V12c0-.5.2-1 .7-1.4A4.5 4.5 0 0 0 9 2.5Z"/><path d="M7 15h4M7.8 16.8h2.4"/>',
     // task 1003117 (R06 of goal 1000074): the Studio (artist mode). A sprout —
     // the zen-garden reading of "a place an artist wants to be", so it does not
     // reuse a glyph that would read as one more docs/goals page.
     studio: '<path d="M9 15.5V8.5"/><path d="M9 8.5C9 5.5 6.5 3.5 3.5 3.5c0 3 2.5 5 5.5 5Z"/><path d="M9 10C9 7.5 11.2 5.5 14 5.5c0 2.7-2.2 4.5-5 4.5Z"/>',
+    // You
+    standing: '<circle cx="9" cy="6" r="3"/><path d="M3.5 15.5c.6-2.9 2.9-4.5 5.5-4.5s4.9 1.6 5.5 4.5"/>',
+    profile: '<rect x="2.5" y="4" width="13" height="10" rx="1.5"/><circle cx="6.3" cy="8" r="1.6"/><path d="M4.1 12c.3-1.1 1.1-1.7 2.2-1.7s1.9.6 2.2 1.7"/><path d="M10.4 7.5h3M10.4 10.3h3"/>',
+    // Community
+    collab: '<path d="M2.5 4a1 1 0 0 1 1-1h7a1 1 0 0 1 1 1v4.5a1 1 0 0 1-1 1H6.5L4 11.5v-2h-.5a1 1 0 0 1-1-1V4Z"/><path d="M11.5 6.5h3a1 1 0 0 1 1 1V12a1 1 0 0 1-1 1H14v2l-2.5-2H8.5a1 1 0 0 1-1-1V9.5"/>',
+    roster: '<circle cx="6.5" cy="6.3" r="2.3"/><path d="M2.5 15c.4-2.3 1.9-3.7 4-3.7s3.6 1.4 4 3.7"/><circle cx="12.5" cy="5.8" r="2"/><path d="M11.4 10.5c.4-.1.7-.2 1.1-.2 1.9 0 3.3 1.3 3.7 3.5"/>',
+    // Docs
+    primer: '<path d="M9 5C7.5 3.9 5.5 3.5 2.5 3.5v10c3 0 5 .4 6.5 1.5 1.5-1.1 3.5-1.5 6.5-1.5v-10c-3 0-5 .4-6.5 1.5Z"/><path d="M9 5v10"/>',
+    ranks: '<path d="M4 7.5 9 4l5 3.5M4 11 9 7.5l5 3.5M4 14.5 9 11l5 3.5"/>',
+    economy: '<circle cx="9" cy="9" r="6.5"/><path d="M11 6.7c-.4-.6-1.1-.9-2-.9-1.2 0-2 .6-2 1.5 0 2 4 1 4 3.1 0 .9-.9 1.5-2.1 1.5-.9 0-1.7-.4-2.1-1M9 4.7v1.1M9 12.2v1.1"/>',
+    commands: '<rect x="2.5" y="3.5" width="13" height="11" rx="1.5"/><path d="M5.5 7.3 7.7 9l-2.2 1.7M9.5 11.2h3"/>',
+    diagrams: '<rect x="2.5" y="2.5" width="5.5" height="4" rx="1"/><rect x="10" y="11.5" width="5.5" height="4" rx="1"/><path d="M5.2 6.5v4a1.5 1.5 0 0 0 1.5 1.5H10"/>',
+    atlas: '<circle cx="9" cy="9" r="6.5"/><path d="M2.5 9h13M9 2.5c1.7 1.8 2.6 4 2.6 6.5s-.9 4.7-2.6 6.5c-1.7-1.8-2.6-4-2.6-6.5S7.3 4.3 9 2.5Z"/>',
+    modules: '<rect x="2.5" y="2.5" width="5.5" height="5.5" rx="1"/><rect x="10" y="2.5" width="5.5" height="5.5" rx="1"/><rect x="2.5" y="10" width="5.5" height="5.5" rx="1"/><path d="M12.75 10.5v4.5M10.5 12.75h4.5"/>',
+    apidocs: '<path d="M6.5 3C5 3 4.5 3.7 4.5 5v2c0 1-.6 2-1.5 2 .9 0 1.5 1 1.5 2v2c0 1.3.5 2 2 2M11.5 3c1.5 0 2 .7 2 2v2c0 1 .6 2 1.5 2-.9 0-1.5 1-1.5 2v2c0 1.3-.5 2-2 2"/>',
+    // Government
+    watch: '<path d="M1.8 9S4.5 4 9 4s7.2 5 7.2 5-2.7 5-7.2 5S1.8 9 1.8 9Z"/><circle cx="9" cy="9" r="2.2"/>',
+    gate: '<path d="M9 2.5 15 5v4c0 3.5-2.4 6-6 7-3.6-1-6-3.5-6-7V5l6-2.5Z"/><path d="M6.5 9l1.8 1.8 3.4-3.6"/>',
+    sessions: '<path d="M7 5h8M7 9h8M7 13h8"/><circle cx="3.8" cy="5" r=".7" fill="currentColor"/><circle cx="3.8" cy="9" r=".7" fill="currentColor"/><circle cx="3.8" cy="13" r=".7" fill="currentColor"/>',
     settings: '<circle cx="9" cy="9" r="2.5"/><path d="M9 2.5v2m0 9v2M2.5 9h2m9 0h2M4.4 4.4l1.4 1.4m6.4 6.4 1.4 1.4m0-9.2-1.4 1.4M5.8 12.2l-1.4 1.4"/>',
-    admin: '<path d="M9 2.5 15 5v4c0 3.5-2.4 6-6 7-3.6-1-6-3.5-6-7V5l6-2.5Z"/>',
+    deploy: '<path d="M9 12V3M5.5 6.5 9 3l3.5 3.5M3 12.5v2a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1v-2"/>',
+    fleet: '<path d="M4 2.5h10v13l-1.7-1-1.6 1-1.7-1-1.7 1-1.6-1-1.7 1v-13Z"/><path d="M6.5 6h5M6.5 9h5M6.5 12h3"/>',
+    permissions: '<circle cx="6" cy="12" r="3.5"/><path d="M8.5 9.5 15 3M12.5 5.5l2 2M10.5 7.5l1.5 1.5"/>',
     // The governor city: a pediment over columns, the Governing mode's own glyph.
     city: '<path d="M2.5 7 9 3l6.5 4M4 7.5v6.5M7 7.5v6.5M11 7.5v6.5M14 7.5v6.5M2.5 15.5h13"/>',
+    // the foot
     signout: '<path d="M7 3.5H4a1 1 0 0 0-1 1v9a1 1 0 0 0 1 1h3M12 12l3-3-3-3M15 9H7"/>',
   };
+  // An unknown name draws an EMPTY frame rather than borrowing another tab's
+  // glyph: a silent fallback is how a typo becomes a duplicate icon.
   function icon(name) {
-    return '<svg class="nav-icon" viewBox="0 0 18 18" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + (ICONS[name] || ICONS.docs) + '</svg>';
+    return '<svg class="nav-icon" viewBox="0 0 18 18" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + (ICONS[name] || '') + '</svg>';
   }
   function chevronIcon() {
     return '<svg class="nav-group__chevron" viewBox="0 0 18 18" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 7l4 4 4-4"/></svg>';
@@ -166,7 +198,7 @@
       // (requireBuilderPage, the tier the map sat on). The id stays 'goal-map'
       // because the href does: Goals' own "see which goals wait on each other"
       // link and every bookmark land here unchanged.
-      { id: 'goal-map', label: 'Sky', icon: 'goals', href: '/goal-map', gate: 'member' },
+      { id: 'goal-map', label: 'Sky', icon: 'sky', href: '/goal-map', gate: 'member' },
       // task 1966: Tasks (the board formerly labelled "Work") is visible to ANY
       // signed-in builder (incl. newcomer Xenos). Claimability is controlled
       // per-task, not by hiding the page — every row carries a rank tag and the
@@ -185,7 +217,7 @@
       // page can still gate cosmetically wider in the sidebar than the API it
       // fronts, showing the link to signed-in builders while a stranger who
       // already has the URL can still open it.
-      { id: 'blockers', label: 'Blockers', icon: 'admin', href: '/blockers', gate: 'signed' },
+      { id: 'blockers', label: 'Blockers', icon: 'blockers', href: '/blockers', gate: 'signed' },
       // task 1003744 (goal 1000111): the Board Room lives HERE, in the project's
       // own group, and gates on the atom its page gates on.
       //
@@ -211,7 +243,7 @@
       // /me (boardVotesNeed), pre-filtered to what the vote route would accept —
       // so the badge counts ballots this viewer can actually cast, never "items
       // open somewhere".
-      { id: 'board-room', label: 'Board Room', icon: 'admin', href: '/board-room', gate: 'perm:board.vote.cast', count: 'board_votes' },
+      { id: 'board-room', label: 'Board Room', icon: 'boardroom', href: '/board-room', gate: 'perm:board.vote.cast', count: 'board_votes' },
       // The governor city (task 1004524): the owner put it on the sidebar on
       // 2026-10-08, reversing "leave it off". It is the Governing mode's lead tab
       // (craft-mode.js folds that mode's other tabs into a dropdown under it).
@@ -239,7 +271,7 @@
       // that caused it. gate 'signed' — there is no permission gate on having a
       // thought, and the route reads the VIEWER's own trail, so there is
       // nothing here a rank could protect.
-      { id: 'thinking', label: 'Your thinking', icon: 'goals', href: '/thinking', gate: 'signed' },
+      { id: 'thinking', label: 'Your thinking', icon: 'thinking', href: '/thinking', gate: 'signed' },
       // task 1003117 (R06 of goal 1000074): the Studio — artist mode, "a place an
       // artist wants to be, not a form". Here and not in Docs (a place you ACT,
       // not reference) or You (its subject is the product, not a person).
@@ -286,12 +318,12 @@
       // other builders reaching you — not your own numbers (that is You).
       // task 1003942: the second consumer of the count badge. `help_requests` is
       // the need id builder-needs.js emits with a `count`; applyCounts reads it.
-      { id: 'collab', label: 'Collab', icon: 'leaderboard', href: '/collab', gate: 'signed', count: 'help_requests' },
+      { id: 'collab', label: 'Collab', icon: 'collab', href: '/collab', gate: 'signed', count: 'help_requests' },
       // task 1003441: was the #leaderboard hash view on the home page, which is
       // why this group read as one real page plus a link into index.html. Now a
       // page, so no `view` key. Labelled Builders — 'roster' is the word
       // modules/hall-ui/CLAUDE.md uses, but Builders is what a reader scans for.
-      { id: 'roster', label: 'Builders', icon: 'leaderboard', href: '/roster', gate: 'signed' },
+      { id: 'roster', label: 'Builders', icon: 'roster', href: '/roster', gate: 'signed' },
       // task 1003444: 'People', the cross-project directory, was deleted (owner
       // call 2026-09-25, ADR 0337 D5). Cross-project discovery is the hub's, and
       // /people redirects to /roster.
@@ -302,8 +334,8 @@
       // are for the first-session newcomer above all — so the links follow it
       // down to 'signed'. Leaving them at 'member' would have ungated the pages
       // while still hiding them from the only readers the change was for.
-      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'signed' },
-      { id: 'ranks', label: 'Ranks', icon: 'docs', href: '/ranks', gate: 'signed' },
+      { id: 'primer', label: 'Primer', icon: 'primer', href: '/primer', gate: 'signed' },
+      { id: 'ranks', label: 'Ranks', icon: 'ranks', href: '/ranks', gate: 'signed' },
       // task 2175: /drachmae had no nav entry at all — reachable only from prose
       // links since task 2174 moved the bounty rate card onto it. It is reference
       // material (the reward schedule + how karma differs), so it belongs in Docs,
@@ -311,16 +343,16 @@
       // currency: the page covers karma too, which is not currency, and "Economy"
       // stays right whatever `branding.currency.label` is set to. Page is public
       // like /ranks — 'signed' is the same cosmetic "show it once you're in".
-      { id: 'economy', label: 'Economy', icon: 'docs', href: '/drachmae', gate: 'signed' },
+      { id: 'economy', label: 'Economy', icon: 'economy', href: '/drachmae', gate: 'signed' },
       // task 1004473: every skill and every bongos CLI verb, read live. Its page and
       // both reads behind it are sign-in gated, so 'signed' is the real floor here.
-      { id: 'commands', label: 'Commands', icon: 'docs', href: '/commands', gate: 'signed' },
-      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'signed' },
-      { id: 'atlas', label: 'Repo Atlas', icon: 'docs', href: '/atlas', gate: 'member' },
-      { id: 'modules', label: 'Modules', icon: 'docs', href: '/modules', gate: 'member' },
+      { id: 'commands', label: 'Commands', icon: 'commands', href: '/commands', gate: 'signed' },
+      { id: 'diagrams', label: 'Diagrams', icon: 'diagrams', href: '/diagrams', gate: 'signed' },
+      { id: 'atlas', label: 'Repo Atlas', icon: 'atlas', href: '/atlas', gate: 'member' },
+      { id: 'modules', label: 'Modules', icon: 'modules', href: '/modules', gate: 'member' },
       // The rendered OpenAPI reference lives on the APEX (/docs), not this builders
       // subdomain — external so the rewrite shim doesn't turn it into /builders/docs.
-      { id: 'apidocs', label: 'API docs', icon: 'docs', href: '/docs', gate: 'signed', external: true },
+      { id: 'apidocs', label: 'API docs', icon: 'apidocs', href: '/docs', gate: 'signed', external: true },
     ] },
     // Relabeled 'Archon' → 'Governance' in ADR 0157, then → 'Government' by ADR 0174: these pages are no longer
     // Archon-only, so a group header reading "Archon" over items a Metic can open
@@ -331,12 +363,12 @@
       // xenos floor) rather than this group's rank, and a group whose audience is
       // Metic+ oversight could not honestly hold it. Everything below IS a rank
       // surface, so this group's gate and audience are unchanged.
-      { id: 'watch', label: 'Watch', icon: 'admin', href: '/watch', gate: 'government' },
-      { id: 'gate', label: 'Gate', icon: 'admin', href: '/gate', gate: 'government' },
-      { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'government' },
+      { id: 'watch', label: 'Watch', icon: 'watch', href: '/watch', gate: 'government' },
+      { id: 'gate', label: 'Gate', icon: 'gate', href: '/gate', gate: 'government' },
+      { id: 'sessions', label: 'Sessions', icon: 'sessions', href: '/sessions', gate: 'government' },
       // The project's own fundamentals (task 1003280, goal 1000072). Mirrors the
       // server's requireGovernmentPage floor; cosmetic only, as every item here is.
-      { id: 'project-settings', label: 'Project settings', icon: 'admin', href: '/project-settings', gate: 'government' },
+      { id: 'project-settings', label: 'Project settings', icon: 'settings', href: '/project-settings', gate: 'government' },
       // The deploy door (task 1003159, ADR 0293). Gated 'archon' here to mirror the
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
@@ -346,18 +378,18 @@
       // dropped where the module is off — and since task 1004296 it STAYS dropped: /deploy
       // is the platform hall's page alone, and every other hall takes its update from
       // Settings → Software update, whose Update button carries the hub hand-off.
-      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning render-deploy' },
+      { id: 'deploy', label: 'Deploy', icon: 'deploy', href: '/deploy', gate: 'archon', module: 'provisioning render-deploy' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
       // Deploy precedent above); dropped where the provisioning module is not enabled.
-      { id: 'fleet', label: 'Fleet costs', icon: 'admin', href: '/fleet', gate: 'government', module: 'provisioning' },
+      { id: 'fleet', label: 'Fleet costs', icon: 'fleet', href: '/fleet', gate: 'government', module: 'provisioning' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'government' gate comment anticipated — cosmetic
       // only. The wall is the `government.manage` atom checked on each of the
       // tab's nine data routes (route-rank-check.js); the page SHELL itself is
       // metic+, because R16 made /government three rooms and only this one is
       // the archon surface.
-      { id: 'government', label: 'Permissions', icon: 'admin', href: '/government', gate: 'archon' }  // NOT 'Ranks': /ranks is the signed-in ladder explainer and two nav items
+      { id: 'government', label: 'Permissions', icon: 'permissions', href: '/government', gate: 'archon' }  // NOT 'Ranks': /ranks is the signed-in ladder explainer and two nav items
       //   reading 'Ranks' is the confusion this rename exists to remove. This tab
       //   is where a rank's permissions are granted, so it says what it does.,
     ] },

package/modules/hall-ui/public/street.html

@@ -205,7 +205,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/city-draw.js?v=2026-10-04-pins1"></script>
 <script src="/builders/street-draw.js?v=2026-10-04-pins1"></script>

package/modules/hall-ui/public/studio.html

@@ -184,7 +184,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -56,7 +56,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -140,7 +140,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -144,7 +144,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -167,7 +167,7 @@
      chrome exists before the page script runs. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -173,7 +173,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.78",
+  "version": "1.21.79",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.78",
+      "version": "1.21.79",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.78",
+  "version": "1.21.79",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9278,5 +9278,23 @@
       "id": "1004587",
       "text": "Goal pages now have a Plan with Claude button that copies a ready-made planning prompt."
     }
+  ],
+  "1.21.79": [
+    {
+      "id": "1004618",
+      "text": "Dry-ran the hall-goal spec flow end to end; it works. The skill now documents the two rough edges found."
+    },
+    {
+      "id": "1004639",
+      "text": "The hall's new sidebar icons were stuck: one picture's drawing contained a run of numbers that looked like an internet address, so the release safety scan refused to package the update. The picture is redrawn identically witho"
+    },
+    {
+      "id": "1003793",
+      "text": "Store modules now get an Install score from real installs: each install or update quietly reports whether it worked (just yes/no and a short reason, nothing personal). Module authors can't pad their own score, and anyone can s"
+    },
+    {
+      "id": "1004626",
+      "text": "Every tab in the hall sidebar now has its own icon. Before, nineteen tabs shared just four pictures - all nine Government pages wore the same shield and every Docs page the same sheet of paper - so the collapsed sidebar was ha"
+    }
   ]
 }

package/scripts/gds/module-assess-installs.js

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-installs.js — the Install and Reliability parts of a
+// module's assessment, worked out from what real installs report (task 1003793,
+// ADR 0343 D1; reports from core_273, signal rows into core_265).
+//
+// WHY these two parts. Tests and Docs are things an author writes; Install and
+// Reliability are what happens when OTHER people run the module, which is the
+// one signal an author cannot fake. So two rules keep it honest:
+//   - the module's own author is never counted, and
+//   - each holder counts once per version for Install (core_273 keeps only their
+//     latest attempt), so one account retrying cannot outweigh many — and neither part is scored at
+//     all until MIN_HOLDERS different holders have reported (`pending` before,
+//     never a number resting on one friend's install).
+//
+//   Install      = round(100 × holders whose latest install worked / holders).
+//   Reliability  = round(100 × holder-days with zero runtime errors / holder-days
+//                  reported), over the last ERROR_DAY_WINDOW days.
+// No reports → no_data (ADR 0343 D3: left out of the average, never a zero).
+//
+// What the reports may contain is fixed by the owner's privacy posture and
+// enforced at intake (src/bongos/module-usage-reports.js): counts and short codes
+// only, and nothing from a holder who switched reporting off.
+//
+// A new signal row is appended only when a part's result actually moves, so the
+// append-only history (core_265) is not one row per report.
+//
+//   node scripts/gds/module-assess-installs.js <store_module_versions.id>   re-score + print
+
+const { ERROR_DAY_WINDOW } = require('../../src/bongos/module-usage-reports');
+
+const MIN_HOLDERS = 3;
+
+// The not-yet-scored outcomes, shared by both parts. Pure.
+function notYet(holders, what) {
+  if (!holders) return { outcome: 'no_data', score: null, sample_size: 0, reason: `no ${what} reported yet` };
+  return {
+    outcome: 'pending', score: null, sample_size: holders,
+    reason: `${holders} of the ${MIN_HOLDERS} installs needed have reported ${what}`,
+  };
+}
+
+// Install from each holder's LATEST attempt ({ ok, error_code } per holder). Pure.
+function assessInstall(latest = []) {
+  const n = latest.length;
+  const failedCodes = {};
+  for (const r of latest) if (!r.ok) failedCodes[r.error_code] = (failedCodes[r.error_code] || 0) + 1;
+  const worked = n - Object.values(failedCodes).reduce((a, b) => a + b, 0);
+  const detail = { holders: n, worked, failed: n - worked, failed_codes: failedCodes };
+  if (n < MIN_HOLDERS) return { ...notYet(n, 'an install'), detail };
+  return {
+    outcome: 'scored', score: Math.round((100 * worked) / n), sample_size: n,
+    reason: `${worked} of ${n} installs worked`, detail,
+  };
+}
+
+// Reliability from daily counts ({ holder_kind, holder_ref, error_count } per
+// holder-day). sample_size is distinct holders, the same unit as Install. Pure.
+function assessReliability(days = []) {
+  const holders = new Set(days.map((d) => `${d.holder_kind}:${d.holder_ref}`)).size;
+  const clean = days.filter((d) => Number(d.error_count) === 0).length;
+  const errors = days.reduce((sum, d) => sum + Number(d.error_count), 0);
+  const detail = { holders, days: days.length, clean_days: clean, errors, window_days: ERROR_DAY_WINDOW };
+  if (holders < MIN_HOLDERS) return { ...notYet(holders, 'runtime errors'), detail };
+  return {
+    outcome: 'scored', score: Math.round((100 * clean) / days.length), sample_size: holders,
+    reason: `${clean} of ${days.length} days ran with no errors, across ${holders} installs`, detail,
+  };
+}
+
+// The author's own reports never count. Shared by both reads.
+const NOT_AUTHOR = `NOT (r.holder_kind = 'builder' AND r.holder_ref = m.author_id::text)`;
+
+async function readReports(versionId, pool) {
+  const { rows: latest } = await pool.query(
+    `SELECT r.ok, r.error_code
+       FROM module_install_reports r
+       JOIN store_module_versions v ON v.id = r.version_id
+       JOIN store_modules m ON m.module_key = v.module_key
+      WHERE r.version_id = $1 AND ${NOT_AUTHOR}`, [versionId]);
+  const { rows: days } = await pool.query(
+    `SELECT r.holder_kind, r.holder_ref, r.error_count
+       FROM module_runtime_error_counts r
+       JOIN store_module_versions v ON v.id = r.version_id
+       JOIN store_modules m ON m.module_key = v.module_key
+      WHERE r.version_id = $1 AND r.day >= current_date - $2::int AND ${NOT_AUTHOR}`,
+    [versionId, ERROR_DAY_WINDOW]);
+  return { latest, days };
+}
+
+const sameResult = (cur, s) => !!cur && cur.outcome === s.outcome
+  && (cur.score == null ? null : Number(cur.score)) === s.score
+  && Number(cur.sample_size) === s.sample_size;
+
+// Re-score Install and Reliability for one version from its reports, append a
+// signal row for each part whose result moved, then re-compose the overall score
+// (module-assess-score.js). Resolves { ok, written: [part…], score }.
+async function recordInstallSignals(versionId, { db } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { latest, days } = await readReports(versionId, pool);
+  const next = { install: assessInstall(latest), reliability: assessReliability(days) };
+
+  const { rows: current } = await pool.query(
+    `SELECT DISTINCT ON (part) part, outcome, score, sample_size
+       FROM module_assessment_signals WHERE version_id = $1 AND part IN ('install', 'reliability')
+      ORDER BY part, measured_at DESC, id DESC`, [versionId]);
+  const byPart = Object.fromEntries(current.map((r) => [r.part, r]));
+
+  const written = [];
+  for (const part of ['install', 'reliability']) {
+    const s = next[part];
+    if (sameResult(byPart[part], s)) continue;
+    await pool.query(
+      `INSERT INTO module_assessment_signals (version_id, part, outcome, score, sample_size, reason, detail)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [versionId, part, s.outcome, s.score, s.sample_size, s.reason, JSON.stringify(s.detail)]);
+    written.push(part);
+  }
+  const { score } = written.length
+    ? await require('./module-assess-score').recomposeScore(versionId, { db: pool })
+    : { score: null };
+  return { ok: true, written, signals: next, score };
+}
+
+async function main(argv) {
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-installs.js <store_module_versions.id>');
+    return 2;
+  }
+  const res = await recordInstallSignals(id);
+  for (const part of ['install', 'reliability']) {
+    const s = res.signals[part];
+    console.log(`${part}: ${s.outcome}${s.score != null ? ` ${s.score}/100` : ''} — ${s.reason}${res.written.includes(part) ? '' : ' (unchanged)'}`);
+  }
+  await require('./module-assess-score').printRecomposed(id);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => { process.exitCode = code; }, (e) => { console.error(e.stack || e.message); process.exitCode = 1; });
+}
+
+module.exports = { MIN_HOLDERS, assessInstall, assessReliability, recordInstallSignals };

package/scripts/gds/module.js

@@ -1138,14 +1138,34 @@ async function fetchVerified(key, { wanted, call, core, log, errlog, verb, shoul
 
   const artifact = require('./module-artifact');
   const verified = await artifact.verifyModuleArtifact(dl.buf, { key, includeFiles: true });
-  if (!verified.ok) return fail(1, `REFUSING: the downloaded tarball failed verification (${verified.code}): ${verified.message}`);
+  if (!verified.ok) {
+    await reportInstall(call, key, described.version, 'verify_failed');
+    return fail(1, `REFUSING: the downloaded tarball failed verification (${verified.code}): ${verified.message}`);
+  }
   if (verified.version !== described.version || verified.tarballSha256 !== described.tarball_sha256 || verified.treeSha256 !== described.tree_sha256) {
+    await reportInstall(call, key, described.version, 'hash_mismatch');
     return fail(1, `REFUSING: the download is not the ${described.version} the store described (version or hash differs).`);
   }
   log(`  ✓ verified ${verified.files.length} file(s), ${verified.bytes} bytes — tree ${verified.treeSha256.slice(0, 12)}…`);
   return { ok: true, described, verified };
 }
 
+// Tell the store whether an install or update of this exact version worked (task
+// 1003793): it feeds the module's Install score, the part an author cannot fake.
+// Counts only — yes, or a short code saying where it failed; never a message, a
+// path or anything about this machine (owner's privacy posture, 2026-10-01). The
+// store drops it if the caller switched reporting off in Settings, so there is no
+// client-side switch to keep in step. Best-effort and silent: a report that does
+// not arrive changes nothing about the install. Only failures that are the
+// module's own count: a refused or unreachable store, or a core the module does
+// not support, says nothing about the module and is not reported.
+async function reportInstall(call, key, version, errorCode = null) {
+  const body = errorCode ? { ok: false, error_code: errorCode } : { ok: true };
+  try {
+    await call('POST', `/store/modules/${encodeURIComponent(key)}/versions/${encodeURIComponent(version)}/install-report`, { json: body });
+  } catch { /* best-effort */ }
+}
+
 // Tell the store which exact version was placed. A failure here never undoes the
 // placement: the files are good, and the next install or update records it.
 async function recordPlaced(key, version, { call, errlog, verb }) {
@@ -1190,10 +1210,12 @@ async function cmdInstall(args, {
   if (!got.ok) return got.code;
 
   try { placeModule(got.verified.files, target); }
-  catch (e) { errlog(`bongos module install: could not place the module — ${e.message}`); return 1; }
+  catch (e) { await reportInstall(call, key, got.described.version, 'place_failed'); errlog(`bongos module install: could not place the module — ${e.message}`); return 1; }
   log(`  ✓ placed at ${target}`);
 
-  if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'install' }))) return 1;
+  const recorded = await recordPlaced(key, got.described.version, { call, errlog, verb: 'install' });
+  await reportInstall(call, key, got.described.version);
+  if (!recorded) return 1;
   log(`\n✓ Installed "${key}" ${got.described.version}. It is not switched on: enable it from the hall's Modules tab when you want it.`);
   const howto = howtoLink(key, got.described.version, got.verified.files, call.apiBase);
   if (howto) log(`  How to use it: ${howto}`);
@@ -1276,10 +1298,12 @@ async function cmdUpdate(args, {
   if (!got.ok) return got.code;
 
   try { replaceModule(got.verified.files, target); }
-  catch (e) { errlog(`bongos module update: could not replace the module, ${installed} is still in place — ${e.message}`); return 1; }
+  catch (e) { await reportInstall(call, key, got.described.version, 'place_failed'); errlog(`bongos module update: could not replace the module, ${installed} is still in place — ${e.message}`); return 1; }
   log(`  ✓ replaced ${installed} with ${got.described.version} at ${target}`);
 
-  if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'update' }))) return 1;
+  const recorded = await recordPlaced(key, got.described.version, { call, errlog, verb: 'update' });
+  await reportInstall(call, key, got.described.version);
+  if (!recorded) return 1;
   log(`\n✓ Updated "${key}" ${installed} → ${got.described.version}. Its on/off switch is unchanged.`);
   return 0;
 }

package/scripts/hall-preview/live-identity.js

@@ -34,6 +34,7 @@ const ME_SCOPED_PATHS = [
   'me/sound-prefs',
   'me/event-sound-prefs',
   'me/art-key/own',
+  'store/usage-reporting',
   'builders/:id/profile',
   'builders/:id/active-claims',
   'builders/:id/activity?section=tasks',