@bongos/core 1.21.78 → 1.21.80

package/modules/hall-ui/public/shell.js

@@ -84,27 +84,59 @@
   }
 
   // Small stroke icon set (18px grid, currentColor) — hand-rolled, no framework.
+  //
+  // ONE GLYPH PER TAB (task 1004626). The rail is a 64px icon strip until it
+  // opens, so at rest the icon IS the tab's name — two tabs wearing one glyph
+  // are two tabs a builder cannot tell apart (nine Government tabs once shared a
+  // shield, all eight Docs tabs one page). Every NAV item names its own key here
+  // and no two items share one; tests/hall_nav.mjs fails on a repeat, on a key
+  // missing from this set, and on two keys drawing the same markup.
   var ICONS = {
+    // the project
     home: '<path d="M3 8.5 9 3l6 5.5V15a1 1 0 0 1-1 1h-3.5v-4h-3v4H4a1 1 0 0 1-1-1V8.5Z"/>',
-    work: '<rect x="2.5" y="5.5" width="13" height="9" rx="1.5"/><path d="M6.5 5.5V4a1.5 1.5 0 0 1 1.5-1.5h2A1.5 1.5 0 0 1 11.5 4v1.5M2.5 9.5h13"/>',
-    standing: '<circle cx="9" cy="6" r="3"/><path d="M3.5 15.5c.6-2.9 2.9-4.5 5.5-4.5s4.9 1.6 5.5 4.5"/>',
-    profile: '<rect x="2.5" y="4" width="13" height="10" rx="1.5"/><circle cx="6.3" cy="8" r="1.6"/><path d="M4.1 12c.3-1.1 1.1-1.7 2.2-1.7s1.9.6 2.2 1.7"/><path d="M10.4 7.5h3M10.4 10.3h3"/>',
-    goals: '<circle cx="9" cy="9" r="6.5"/><circle cx="9" cy="9" r="3.5"/><circle cx="9" cy="9" r="0.8" fill="currentColor"/>',
     roadmap: '<path d="M3 15.5V3.5l4 2 4-2 4 2v10l-4-2-4 2-4-2Z"/><path d="M7 3.5v10M11 5.5v10"/>',
-    leaderboard: '<path d="M3.5 15.5v-6M9 15.5V3.5m5.5 12v-9"/>',
-    docs: '<path d="M4 3.5h7l3 3v10H4v-13Z"/><path d="M11 3.5v3h3"/>',
+    goals: '<circle cx="9" cy="9" r="6.5"/><circle cx="9" cy="9" r="3.5"/><circle cx="9" cy="9" r="0.8" fill="currentColor"/>',
+    sky: '<circle cx="3.8" cy="12.5" r="1.3"/><circle cx="8.5" cy="5" r="1.3"/><circle cx="14.2" cy="8.5" r="1.3"/><circle cx="12" cy="14.8" r="1.3"/><path d="M4.5 11.4 7.8 6.1M9.6 5.7l3.5 2.1M13.7 9.8l-1.2 3.7"/>',
+    work: '<rect x="2.5" y="5.5" width="13" height="9" rx="1.5"/><path d="M6.5 5.5V4a1.5 1.5 0 0 1 1.5-1.5h2A1.5 1.5 0 0 1 11.5 4v1.5M2.5 9.5h13"/>',
+    blockers: '<path d="M6.3 2.5h5.4l3.8 3.8v5.4l-3.8 3.8H6.3l-3.8-3.8V6.3Z"/><path d="M6 9h6"/>',
+    boardroom: '<path d="M2.5 9h13v5.5a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1V9Z"/><path d="M5.5 9V2.5h7V9"/><path d="M7.3 5.8l1.2 1.2 2.2-2.3"/>',
+    thinking: '<path d="M9 2.5a4.5 4.5 0 0 0-2.7 8.1c.5 .4 .7 .9 .7 1.4v.5h4V12c0-.5.2-1 .7-1.4A4.5 4.5 0 0 0 9 2.5Z"/><path d="M7 15h4M7.8 16.8h2.4"/>',
     // task 1003117 (R06 of goal 1000074): the Studio (artist mode). A sprout —
     // the zen-garden reading of "a place an artist wants to be", so it does not
     // reuse a glyph that would read as one more docs/goals page.
     studio: '<path d="M9 15.5V8.5"/><path d="M9 8.5C9 5.5 6.5 3.5 3.5 3.5c0 3 2.5 5 5.5 5Z"/><path d="M9 10C9 7.5 11.2 5.5 14 5.5c0 2.7-2.2 4.5-5 4.5Z"/>',
+    // You
+    standing: '<circle cx="9" cy="6" r="3"/><path d="M3.5 15.5c.6-2.9 2.9-4.5 5.5-4.5s4.9 1.6 5.5 4.5"/>',
+    profile: '<rect x="2.5" y="4" width="13" height="10" rx="1.5"/><circle cx="6.3" cy="8" r="1.6"/><path d="M4.1 12c.3-1.1 1.1-1.7 2.2-1.7s1.9.6 2.2 1.7"/><path d="M10.4 7.5h3M10.4 10.3h3"/>',
+    // Community
+    collab: '<path d="M2.5 4a1 1 0 0 1 1-1h7a1 1 0 0 1 1 1v4.5a1 1 0 0 1-1 1H6.5L4 11.5v-2h-.5a1 1 0 0 1-1-1V4Z"/><path d="M11.5 6.5h3a1 1 0 0 1 1 1V12a1 1 0 0 1-1 1H14v2l-2.5-2H8.5a1 1 0 0 1-1-1V9.5"/>',
+    roster: '<circle cx="6.5" cy="6.3" r="2.3"/><path d="M2.5 15c.4-2.3 1.9-3.7 4-3.7s3.6 1.4 4 3.7"/><circle cx="12.5" cy="5.8" r="2"/><path d="M11.4 10.5c.4-.1.7-.2 1.1-.2 1.9 0 3.3 1.3 3.7 3.5"/>',
+    // Docs
+    primer: '<path d="M9 5C7.5 3.9 5.5 3.5 2.5 3.5v10c3 0 5 .4 6.5 1.5 1.5-1.1 3.5-1.5 6.5-1.5v-10c-3 0-5 .4-6.5 1.5Z"/><path d="M9 5v10"/>',
+    ranks: '<path d="M4 7.5 9 4l5 3.5M4 11 9 7.5l5 3.5M4 14.5 9 11l5 3.5"/>',
+    economy: '<circle cx="9" cy="9" r="6.5"/><path d="M11 6.7c-.4-.6-1.1-.9-2-.9-1.2 0-2 .6-2 1.5 0 2 4 1 4 3.1 0 .9-.9 1.5-2.1 1.5-.9 0-1.7-.4-2.1-1M9 4.7v1.1M9 12.2v1.1"/>',
+    commands: '<rect x="2.5" y="3.5" width="13" height="11" rx="1.5"/><path d="M5.5 7.3 7.7 9l-2.2 1.7M9.5 11.2h3"/>',
+    diagrams: '<rect x="2.5" y="2.5" width="5.5" height="4" rx="1"/><rect x="10" y="11.5" width="5.5" height="4" rx="1"/><path d="M5.2 6.5v4a1.5 1.5 0 0 0 1.5 1.5H10"/>',
+    atlas: '<circle cx="9" cy="9" r="6.5"/><path d="M2.5 9h13M9 2.5c1.7 1.8 2.6 4 2.6 6.5s-.9 4.7-2.6 6.5c-1.7-1.8-2.6-4-2.6-6.5S7.3 4.3 9 2.5Z"/>',
+    modules: '<rect x="2.5" y="2.5" width="5.5" height="5.5" rx="1"/><rect x="10" y="2.5" width="5.5" height="5.5" rx="1"/><rect x="2.5" y="10" width="5.5" height="5.5" rx="1"/><path d="M12.75 10.5v4.5M10.5 12.75h4.5"/>',
+    apidocs: '<path d="M6.5 3C5 3 4.5 3.7 4.5 5v2c0 1-.6 2-1.5 2 .9 0 1.5 1 1.5 2v2c0 1.3.5 2 2 2M11.5 3c1.5 0 2 .7 2 2v2c0 1 .6 2 1.5 2-.9 0-1.5 1-1.5 2v2c0 1.3-.5 2-2 2"/>',
+    // Government
+    watch: '<path d="M1.8 9S4.5 4 9 4s7.2 5 7.2 5-2.7 5-7.2 5S1.8 9 1.8 9Z"/><circle cx="9" cy="9" r="2.2"/>',
+    gate: '<path d="M9 2.5 15 5v4c0 3.5-2.4 6-6 7-3.6-1-6-3.5-6-7V5l6-2.5Z"/><path d="M6.5 9l1.8 1.8 3.4-3.6"/>',
+    sessions: '<path d="M7 5h8M7 9h8M7 13h8"/><circle cx="3.8" cy="5" r=".7" fill="currentColor"/><circle cx="3.8" cy="9" r=".7" fill="currentColor"/><circle cx="3.8" cy="13" r=".7" fill="currentColor"/>',
     settings: '<circle cx="9" cy="9" r="2.5"/><path d="M9 2.5v2m0 9v2M2.5 9h2m9 0h2M4.4 4.4l1.4 1.4m6.4 6.4 1.4 1.4m0-9.2-1.4 1.4M5.8 12.2l-1.4 1.4"/>',
-    admin: '<path d="M9 2.5 15 5v4c0 3.5-2.4 6-6 7-3.6-1-6-3.5-6-7V5l6-2.5Z"/>',
+    deploy: '<path d="M9 12V3M5.5 6.5 9 3l3.5 3.5M3 12.5v2a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1v-2"/>',
+    fleet: '<path d="M4 2.5h10v13l-1.7-1-1.6 1-1.7-1-1.7 1-1.6-1-1.7 1v-13Z"/><path d="M6.5 6h5M6.5 9h5M6.5 12h3"/>',
+    permissions: '<circle cx="6" cy="12" r="3.5"/><path d="M8.5 9.5 15 3M12.5 5.5l2 2M10.5 7.5l1.5 1.5"/>',
     // The governor city: a pediment over columns, the Governing mode's own glyph.
     city: '<path d="M2.5 7 9 3l6.5 4M4 7.5v6.5M7 7.5v6.5M11 7.5v6.5M14 7.5v6.5M2.5 15.5h13"/>',
+    // the foot
     signout: '<path d="M7 3.5H4a1 1 0 0 0-1 1v9a1 1 0 0 0 1 1h3M12 12l3-3-3-3M15 9H7"/>',
   };
+  // An unknown name draws an EMPTY frame rather than borrowing another tab's
+  // glyph: a silent fallback is how a typo becomes a duplicate icon.
   function icon(name) {
-    return '<svg class="nav-icon" viewBox="0 0 18 18" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + (ICONS[name] || ICONS.docs) + '</svg>';
+    return '<svg class="nav-icon" viewBox="0 0 18 18" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + (ICONS[name] || '') + '</svg>';
   }
   function chevronIcon() {
     return '<svg class="nav-group__chevron" viewBox="0 0 18 18" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 7l4 4 4-4"/></svg>';
@@ -166,7 +198,7 @@
       // (requireBuilderPage, the tier the map sat on). The id stays 'goal-map'
       // because the href does: Goals' own "see which goals wait on each other"
       // link and every bookmark land here unchanged.
-      { id: 'goal-map', label: 'Sky', icon: 'goals', href: '/goal-map', gate: 'member' },
+      { id: 'goal-map', label: 'Sky', icon: 'sky', href: '/goal-map', gate: 'member' },
       // task 1966: Tasks (the board formerly labelled "Work") is visible to ANY
       // signed-in builder (incl. newcomer Xenos). Claimability is controlled
       // per-task, not by hiding the page — every row carries a rank tag and the
@@ -185,7 +217,7 @@
       // page can still gate cosmetically wider in the sidebar than the API it
       // fronts, showing the link to signed-in builders while a stranger who
       // already has the URL can still open it.
-      { id: 'blockers', label: 'Blockers', icon: 'admin', href: '/blockers', gate: 'signed' },
+      { id: 'blockers', label: 'Blockers', icon: 'blockers', href: '/blockers', gate: 'signed' },
       // task 1003744 (goal 1000111): the Board Room lives HERE, in the project's
       // own group, and gates on the atom its page gates on.
       //
@@ -211,7 +243,7 @@
       // /me (boardVotesNeed), pre-filtered to what the vote route would accept —
       // so the badge counts ballots this viewer can actually cast, never "items
       // open somewhere".
-      { id: 'board-room', label: 'Board Room', icon: 'admin', href: '/board-room', gate: 'perm:board.vote.cast', count: 'board_votes' },
+      { id: 'board-room', label: 'Board Room', icon: 'boardroom', href: '/board-room', gate: 'perm:board.vote.cast', count: 'board_votes' },
       // The governor city (task 1004524): the owner put it on the sidebar on
       // 2026-10-08, reversing "leave it off". It is the Governing mode's lead tab
       // (craft-mode.js folds that mode's other tabs into a dropdown under it).
@@ -239,7 +271,7 @@
       // that caused it. gate 'signed' — there is no permission gate on having a
       // thought, and the route reads the VIEWER's own trail, so there is
       // nothing here a rank could protect.
-      { id: 'thinking', label: 'Your thinking', icon: 'goals', href: '/thinking', gate: 'signed' },
+      { id: 'thinking', label: 'Your thinking', icon: 'thinking', href: '/thinking', gate: 'signed' },
       // task 1003117 (R06 of goal 1000074): the Studio — artist mode, "a place an
       // artist wants to be, not a form". Here and not in Docs (a place you ACT,
       // not reference) or You (its subject is the product, not a person).
@@ -286,12 +318,12 @@
       // other builders reaching you — not your own numbers (that is You).
       // task 1003942: the second consumer of the count badge. `help_requests` is
       // the need id builder-needs.js emits with a `count`; applyCounts reads it.
-      { id: 'collab', label: 'Collab', icon: 'leaderboard', href: '/collab', gate: 'signed', count: 'help_requests' },
+      { id: 'collab', label: 'Collab', icon: 'collab', href: '/collab', gate: 'signed', count: 'help_requests' },
       // task 1003441: was the #leaderboard hash view on the home page, which is
       // why this group read as one real page plus a link into index.html. Now a
       // page, so no `view` key. Labelled Builders — 'roster' is the word
       // modules/hall-ui/CLAUDE.md uses, but Builders is what a reader scans for.
-      { id: 'roster', label: 'Builders', icon: 'leaderboard', href: '/roster', gate: 'signed' },
+      { id: 'roster', label: 'Builders', icon: 'roster', href: '/roster', gate: 'signed' },
       // task 1003444: 'People', the cross-project directory, was deleted (owner
       // call 2026-09-25, ADR 0337 D5). Cross-project discovery is the hub's, and
       // /people redirects to /roster.
@@ -302,8 +334,8 @@
       // are for the first-session newcomer above all — so the links follow it
       // down to 'signed'. Leaving them at 'member' would have ungated the pages
       // while still hiding them from the only readers the change was for.
-      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'signed' },
-      { id: 'ranks', label: 'Ranks', icon: 'docs', href: '/ranks', gate: 'signed' },
+      { id: 'primer', label: 'Primer', icon: 'primer', href: '/primer', gate: 'signed' },
+      { id: 'ranks', label: 'Ranks', icon: 'ranks', href: '/ranks', gate: 'signed' },
       // task 2175: /drachmae had no nav entry at all — reachable only from prose
       // links since task 2174 moved the bounty rate card onto it. It is reference
       // material (the reward schedule + how karma differs), so it belongs in Docs,
@@ -311,16 +343,16 @@
       // currency: the page covers karma too, which is not currency, and "Economy"
       // stays right whatever `branding.currency.label` is set to. Page is public
       // like /ranks — 'signed' is the same cosmetic "show it once you're in".
-      { id: 'economy', label: 'Economy', icon: 'docs', href: '/drachmae', gate: 'signed' },
+      { id: 'economy', label: 'Economy', icon: 'economy', href: '/drachmae', gate: 'signed' },
       // task 1004473: every skill and every bongos CLI verb, read live. Its page and
       // both reads behind it are sign-in gated, so 'signed' is the real floor here.
-      { id: 'commands', label: 'Commands', icon: 'docs', href: '/commands', gate: 'signed' },
-      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'signed' },
-      { id: 'atlas', label: 'Repo Atlas', icon: 'docs', href: '/atlas', gate: 'member' },
-      { id: 'modules', label: 'Modules', icon: 'docs', href: '/modules', gate: 'member' },
+      { id: 'commands', label: 'Commands', icon: 'commands', href: '/commands', gate: 'signed' },
+      { id: 'diagrams', label: 'Diagrams', icon: 'diagrams', href: '/diagrams', gate: 'signed' },
+      { id: 'atlas', label: 'Repo Atlas', icon: 'atlas', href: '/atlas', gate: 'member' },
+      { id: 'modules', label: 'Modules', icon: 'modules', href: '/modules', gate: 'member' },
       // The rendered OpenAPI reference lives on the APEX (/docs), not this builders
       // subdomain — external so the rewrite shim doesn't turn it into /builders/docs.
-      { id: 'apidocs', label: 'API docs', icon: 'docs', href: '/docs', gate: 'signed', external: true },
+      { id: 'apidocs', label: 'API docs', icon: 'apidocs', href: '/docs', gate: 'signed', external: true },
     ] },
     // Relabeled 'Archon' → 'Governance' in ADR 0157, then → 'Government' by ADR 0174: these pages are no longer
     // Archon-only, so a group header reading "Archon" over items a Metic can open
@@ -331,12 +363,12 @@
       // xenos floor) rather than this group's rank, and a group whose audience is
       // Metic+ oversight could not honestly hold it. Everything below IS a rank
       // surface, so this group's gate and audience are unchanged.
-      { id: 'watch', label: 'Watch', icon: 'admin', href: '/watch', gate: 'government' },
-      { id: 'gate', label: 'Gate', icon: 'admin', href: '/gate', gate: 'government' },
-      { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'government' },
+      { id: 'watch', label: 'Watch', icon: 'watch', href: '/watch', gate: 'government' },
+      { id: 'gate', label: 'Gate', icon: 'gate', href: '/gate', gate: 'government' },
+      { id: 'sessions', label: 'Sessions', icon: 'sessions', href: '/sessions', gate: 'government' },
       // The project's own fundamentals (task 1003280, goal 1000072). Mirrors the
       // server's requireGovernmentPage floor; cosmetic only, as every item here is.
-      { id: 'project-settings', label: 'Project settings', icon: 'admin', href: '/project-settings', gate: 'government' },
+      { id: 'project-settings', label: 'Project settings', icon: 'settings', href: '/project-settings', gate: 'government' },
       // The deploy door (task 1003159, ADR 0293). Gated 'archon' here to mirror the
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
@@ -346,18 +378,18 @@
       // dropped where the module is off — and since task 1004296 it STAYS dropped: /deploy
       // is the platform hall's page alone, and every other hall takes its update from
       // Settings → Software update, whose Update button carries the hub hand-off.
-      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning render-deploy' },
+      { id: 'deploy', label: 'Deploy', icon: 'deploy', href: '/deploy', gate: 'archon', module: 'provisioning render-deploy' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
       // Deploy precedent above); dropped where the provisioning module is not enabled.
-      { id: 'fleet', label: 'Fleet costs', icon: 'admin', href: '/fleet', gate: 'government', module: 'provisioning' },
+      { id: 'fleet', label: 'Fleet costs', icon: 'fleet', href: '/fleet', gate: 'government', module: 'provisioning' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'government' gate comment anticipated — cosmetic
       // only. The wall is the `government.manage` atom checked on each of the
       // tab's nine data routes (route-rank-check.js); the page SHELL itself is
       // metic+, because R16 made /government three rooms and only this one is
       // the archon surface.
-      { id: 'government', label: 'Permissions', icon: 'admin', href: '/government', gate: 'archon' }  // NOT 'Ranks': /ranks is the signed-in ladder explainer and two nav items
+      { id: 'government', label: 'Permissions', icon: 'permissions', href: '/government', gate: 'archon' }  // NOT 'Ranks': /ranks is the signed-in ladder explainer and two nav items
       //   reading 'Ranks' is the confusion this rename exists to remove. This tab
       //   is where a rank's permissions are granted, so it says what it does.,
     ] },

package/modules/hall-ui/public/street.html

@@ -205,7 +205,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/city-draw.js?v=2026-10-04-pins1"></script>
 <script src="/builders/street-draw.js?v=2026-10-04-pins1"></script>

package/modules/hall-ui/public/studio.html

@@ -184,7 +184,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -56,7 +56,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -140,7 +140,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor-lib.js

@@ -189,8 +189,27 @@
   // another host than the editor's cannot be framed: a hall page can, a landing
   // or status page cannot. For those the split view is a second window docked to
   // the bottom half of the screen.
-  function canFrame(url, loc) {
-    try { return new URL(url, loc.href || loc.origin).origin === (loc.origin || new URL(loc.href).origin); } catch (_) { return false; }
+  //
+  // The SIBLINGS (task 1004393): once the proxy answers the apex and status hosts
+  // with `frame-ancestors 'self' https://builders.<apex>` instead of SAMEORIGIN,
+  // those two pages may split in place too. Until then framing them shows the
+  // browser's refusal page, so FRAME_SIBLINGS stays false and flipping it is the
+  // step after the proxy change (the owner's steps are on task 1004393). Only the
+  // apex and status.<apex> are siblings, never another subdomain: the proxy keeps
+  // every other host unframeable, sign-in and settings included.
+  const FRAME_SIBLINGS = false;
+  function siblingOrigins(loc) {
+    const here = new URL(loc.href || loc.origin);
+    if (!/^builders\./.test(here.hostname)) return [];
+    const apex = here.host.replace(/^builders\./, '');
+    return [`${here.protocol}//${apex}`, `${here.protocol}//status.${apex}`];
+  }
+  function canFrame(url, loc, siblings = FRAME_SIBLINGS) {
+    try {
+      const origin = new URL(url, loc.href || loc.origin).origin;
+      if (origin === (loc.origin || new URL(loc.href).origin)) return true;
+      return siblings === true && siblingOrigins(loc).includes(origin);
+    } catch (_) { return false; }
   }
   function splitWindowFeatures(scr) {
     const s = scr || {};
@@ -229,7 +248,7 @@
     return null;
   }
 
-  const api = { OPEN_WORDS, openChoice, clampSplit, splitFromPointer, splitFromKey, canFrame, splitWindowFeatures, HINT, nextLineKey, confirmedCount, hintText, confirmStoreKey, parseConfirmed, NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
+  const api = { OPEN_WORDS, openChoice, clampSplit, splitFromPointer, splitFromKey, canFrame, FRAME_SIBLINGS, splitWindowFeatures, HINT, nextLineKey, confirmedCount, hintText, confirmStoreKey, parseConfirmed, NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
   if (typeof window !== 'undefined') window.OTBTweakEditor = api;
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
 })();

package/modules/hall-ui/public/tweak-editor.html

@@ -144,7 +144,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -167,7 +167,7 @@
      chrome exists before the page script runs. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -173,7 +173,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-glyph-fix"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/tweak-editor.md

@@ -27,7 +27,7 @@ The paper is paper and the room is the room whatever the hall's theme: the stage
 - **Boxes grow to their words** rather than the artboard's rows 1 or 2.
 - **A refused upload opens a panel** (task 1004354, `#tw-refused`): the "is in" panel's glass and scrim over the whole window, a headline per refusal (`lib.uploadRefusal`), the server's words, the lines it names, "what to do", and "download this page again" or close (Escape too). An artist uploads from the bar, often far down the page, where the paper's notice was off screen. The notice stays on the paper after the panel closes. The kit has no file-upload action, so the panel is proven in `tests/hall_tweak_editor.mjs` and by shots of a real browser at 1440 and 390, not by a states.json state.
 - **The check, the restore and Shift + Enter (task 1004385, owner-asked).** Beside each line a round restore button (only on a changed line: it puts the page's words back and takes the check off) and a round green check. A checked line takes a light green wash; the owner picked the check over a tint alone. **Shift + Enter** in a line checks it and lands in the next, and a green hint above the words says so (with "N of M checked"), because it is the quickest way through a page. Enter alone is unchanged. The checks are the artist's place-keeper and stay in the browser (`localStorage`, keyed by page and reading hash, so a page that moved never ticks the wrong words); the server has no such field and `WRITES` is unchanged. A page the caller cannot write has none of it. Rules in `tweak-editor-lib.js` (`nextLineKey`, `confirmedCount`, `parseConfirmed`, `confirmStoreKey`, `hintText`).
-- **No page title or sub text at the top of the paper, and "open the page" is a menu (task 1004386, owner-asked).** The bar already names the page, so the paper opens on its first section; the h1 stays, visually hidden, for the one-h1 floor. "open the page" is a **split button** (owner-amended mid-build): the main half repeats the artist's last choice ("open the page ↗" for a new tab, "open in split view"), and the ▾ beside it opens **open in new tab** and **open in split view**. Click, keyboard and touch; hover alone opens nothing, because a hover menu closes when the pointer wanders and does not exist on touch. Split view has a **draggable divider** (mouse, touch, or the arrow keys and Home/End on the focused divider; the live page takes 20% to 80% of the window, `lib.clampSplit`), and the frame stops taking the pointer while it is dragged. The choice, the size and whether split view was open are remembered (`hall-tweak-open-as`, `hall-tweak-split-size`, `hall-tweak-split`), so the next page opens the same way; a split that would be a second window never reopens on load, because a browser blocks a popup nobody clicked. At phone width the live page takes at most half the screen, whatever the saved size, because the two-row bar is tall there. Split view pins the live page under the words (words above, page below, both scroll; "close split view" unloads it; the frame loads only when opened). **The live site answers `X-Frame-Options: SAMEORIGIN`** (set at the proxy in front of the app, not in this repo), so only a page on the editor's own host can be framed. A landing or status page is on another host, so its split view opens the page in a second window docked to the bottom half of the screen (`lib.canFrame`, `lib.splitWindowFeatures`). Allowing framing from the builders host (a `frame-ancestors` rule at the proxy) would let those pages split in place too.
+- **No page title or sub text at the top of the paper, and "open the page" is a menu (task 1004386, owner-asked).** The bar already names the page, so the paper opens on its first section; the h1 stays, visually hidden, for the one-h1 floor. "open the page" is a **split button** (owner-amended mid-build): the main half repeats the artist's last choice ("open the page ↗" for a new tab, "open in split view"), and the ▾ beside it opens **open in new tab** and **open in split view**. Click, keyboard and touch; hover alone opens nothing, because a hover menu closes when the pointer wanders and does not exist on touch. Split view has a **draggable divider** (mouse, touch, or the arrow keys and Home/End on the focused divider; the live page takes 20% to 80% of the window, `lib.clampSplit`), and the frame stops taking the pointer while it is dragged. The choice, the size and whether split view was open are remembered (`hall-tweak-open-as`, `hall-tweak-split-size`, `hall-tweak-split`), so the next page opens the same way; a split that would be a second window never reopens on load, because a browser blocks a popup nobody clicked. At phone width the live page takes at most half the screen, whatever the saved size, because the two-row bar is tall there. Split view pins the live page under the words (words above, page below, both scroll; "close split view" unloads it; the frame loads only when opened). **The live site answers `X-Frame-Options: SAMEORIGIN`** (set at the proxy in front of the app, not in this repo), so only a page on the editor's own host can be framed. A landing or status page is on another host, so its split view opens the page in a second window docked to the bottom half of the screen (`lib.canFrame`, `lib.splitWindowFeatures`). **Letting them split in place (task 1004393)** is two steps, in this order. First the proxy answers the apex and `status.<apex>` with `<redacted>: frame-ancestors 'self' https://builders.<apex>` in place of `X-Frame-Options: SAMEORIGIN`, and every other host keeps SAMEORIGIN (sign-in and settings stay unframeable). Then `FRAME_SIBLINGS` in `tweak-editor-lib.js` flips to `true`. `lib.canFrame` then also admits exactly those two origins, same scheme and port, and only from the builders host; never another subdomain or a lookalike. Flipping it before the proxy changes would put the browser's refusal page in the split, which is why it ships off.
 - **Not on the artboard at all:** the phone layout (the bar becomes a two-row glass card, notes drop under their lines), the shell's full-screen button top right, the read-only and refusal notices on the paper, the chrome view (the switch off), and light mode.
 
 ## The proof

package/modules/public-landing/public/projects.html

@@ -1696,7 +1696,7 @@ summary{min-height:24px;padding:3px 0;}
                       <div class="choices" role="group" aria-label="Starting point">
                         <button type="button" class="choice" id="c-green" aria-pressed="true">
                           <b>A new repo</b>
-                          <p>Public, set up for you</p>
+                          <p>Private, set up for you</p>
                         </button>
                         <button type="button" class="choice" id="c-adopt" aria-pressed="false">
                           <b>A repo I have</b>
@@ -1726,7 +1726,7 @@ summary{min-height:24px;padding:3px 0;}
                         <input type="text" id="ghNewName" placeholder="moonbase" autocomplete="off" maxlength="100" aria-label="New repository name">
                         <!-- visibility is stated on EVERY repo path (task 1002721); updateFreshPreview()
                              replaces this floor with the same claim plus the resolved repo URL -->
-                        <div class="hint" id="ghFreshHint">A new <strong>public</strong> repo. For private code, pick “A repo I have”.</div>
+                        <div class="hint" id="ghFreshHint">A new <strong>private</strong> repo. You can make it public later.</div>
                       </div>
                       <div class="row2" id="manualHome">
                         <label class="wizField"><span>GitHub owner <small>(user or org)</small></span>
@@ -5291,9 +5291,9 @@ summary{min-height:24px;padding:3px 0;}
         hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
       } else {
         /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
-           public by design (github-repos.js — open-source, capture-resistant); the
-           private path is adopting a private repo the owner makes themselves. */
-        hint.className = 'hint'; hint.innerHTML = 'A new <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>. For private code, make the repo on GitHub and pick “A repo I have”.';
+           private by default (github-repos.js, ADR 0370); the owner can make one
+           public later from the project's manage page. */
+        hint.className = 'hint'; hint.innerHTML = 'A new <strong>private</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>. You can make it public later.';
       }
     }
     $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.78",
+  "version": "1.21.80",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.78",
+      "version": "1.21.80",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.78",
+  "version": "1.21.80",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9278,5 +9278,33 @@
       "id": "1004587",
       "text": "Goal pages now have a Plan with Claude button that copies a ready-made planning prompt."
     }
+  ],
+  "1.21.79": [
+    {
+      "id": "1004618",
+      "text": "Dry-ran the hall-goal spec flow end to end; it works. The skill now documents the two rough edges found."
+    },
+    {
+      "id": "1004639",
+      "text": "The hall's new sidebar icons were stuck: one picture's drawing contained a run of numbers that looked like an internet address, so the release safety scan refused to package the update. The picture is redrawn identically witho"
+    },
+    {
+      "id": "1003793",
+      "text": "Store modules now get an Install score from real installs: each install or update quietly reports whether it worked (just yes/no and a short reason, nothing personal). Module authors can't pad their own score, and anyone can s"
+    },
+    {
+      "id": "1004626",
+      "text": "Every tab in the hall sidebar now has its own icon. Before, nineteen tabs shared just four pictures - all nine Government pages wore the same shield and every Docs page the same sheet of paper - so the collapsed sidebar was ha"
+    }
+  ],
+  "1.21.80": [
+    {
+      "id": "1004645",
+      "text": "New projects now get a private GitHub repository by default. Before, the code of every new project was public on the internet from the first save. Owners can still make their repo public later from the project page, and existi"
+    },
+    {
+      "id": "1004393",
+      "text": "The tweak editor is ready to show landing and status pages side by side with the words, instead of in a separate window. It stays off until a small web-server change is made on the host; those steps are waiting in the owner's"
+    }
   ]
 }

package/scripts/gds/module-assess-installs.js

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-installs.js — the Install and Reliability parts of a
+// module's assessment, worked out from what real installs report (task 1003793,
+// ADR 0343 D1; reports from core_273, signal rows into core_265).
+//
+// WHY these two parts. Tests and Docs are things an author writes; Install and
+// Reliability are what happens when OTHER people run the module, which is the
+// one signal an author cannot fake. So two rules keep it honest:
+//   - the module's own author is never counted, and
+//   - each holder counts once per version for Install (core_273 keeps only their
+//     latest attempt), so one account retrying cannot outweigh many — and neither part is scored at
+//     all until MIN_HOLDERS different holders have reported (`pending` before,
+//     never a number resting on one friend's install).
+//
+//   Install      = round(100 × holders whose latest install worked / holders).
+//   Reliability  = round(100 × holder-days with zero runtime errors / holder-days
+//                  reported), over the last ERROR_DAY_WINDOW days.
+// No reports → no_data (ADR 0343 D3: left out of the average, never a zero).
+//
+// What the reports may contain is fixed by the owner's privacy posture and
+// enforced at intake (src/bongos/module-usage-reports.js): counts and short codes
+// only, and nothing from a holder who switched reporting off.
+//
+// A new signal row is appended only when a part's result actually moves, so the
+// append-only history (core_265) is not one row per report.
+//
+//   node scripts/gds/module-assess-installs.js <store_module_versions.id>   re-score + print
+
+const { ERROR_DAY_WINDOW } = require('../../src/bongos/module-usage-reports');
+
+const MIN_HOLDERS = 3;
+
+// The not-yet-scored outcomes, shared by both parts. Pure.
+function notYet(holders, what) {
+  if (!holders) return { outcome: 'no_data', score: null, sample_size: 0, reason: `no ${what} reported yet` };
+  return {
+    outcome: 'pending', score: null, sample_size: holders,
+    reason: `${holders} of the ${MIN_HOLDERS} installs needed have reported ${what}`,
+  };
+}
+
+// Install from each holder's LATEST attempt ({ ok, error_code } per holder). Pure.
+function assessInstall(latest = []) {
+  const n = latest.length;
+  const failedCodes = {};
+  for (const r of latest) if (!r.ok) failedCodes[r.error_code] = (failedCodes[r.error_code] || 0) + 1;
+  const worked = n - Object.values(failedCodes).reduce((a, b) => a + b, 0);
+  const detail = { holders: n, worked, failed: n - worked, failed_codes: failedCodes };
+  if (n < MIN_HOLDERS) return { ...notYet(n, 'an install'), detail };
+  return {
+    outcome: 'scored', score: Math.round((100 * worked) / n), sample_size: n,
+    reason: `${worked} of ${n} installs worked`, detail,
+  };
+}
+
+// Reliability from daily counts ({ holder_kind, holder_ref, error_count } per
+// holder-day). sample_size is distinct holders, the same unit as Install. Pure.
+function assessReliability(days = []) {
+  const holders = new Set(days.map((d) => `${d.holder_kind}:${d.holder_ref}`)).size;
+  const clean = days.filter((d) => Number(d.error_count) === 0).length;
+  const errors = days.reduce((sum, d) => sum + Number(d.error_count), 0);
+  const detail = { holders, days: days.length, clean_days: clean, errors, window_days: ERROR_DAY_WINDOW };
+  if (holders < MIN_HOLDERS) return { ...notYet(holders, 'runtime errors'), detail };
+  return {
+    outcome: 'scored', score: Math.round((100 * clean) / days.length), sample_size: holders,
+    reason: `${clean} of ${days.length} days ran with no errors, across ${holders} installs`, detail,
+  };
+}
+
+// The author's own reports never count. Shared by both reads.
+const NOT_AUTHOR = `NOT (r.holder_kind = 'builder' AND r.holder_ref = m.author_id::text)`;
+
+async function readReports(versionId, pool) {
+  const { rows: latest } = await pool.query(
+    `SELECT r.ok, r.error_code
+       FROM module_install_reports r
+       JOIN store_module_versions v ON v.id = r.version_id
+       JOIN store_modules m ON m.module_key = v.module_key
+      WHERE r.version_id = $1 AND ${NOT_AUTHOR}`, [versionId]);
+  const { rows: days } = await pool.query(
+    `SELECT r.holder_kind, r.holder_ref, r.error_count
+       FROM module_runtime_error_counts r
+       JOIN store_module_versions v ON v.id = r.version_id
+       JOIN store_modules m ON m.module_key = v.module_key
+      WHERE r.version_id = $1 AND r.day >= current_date - $2::int AND ${NOT_AUTHOR}`,
+    [versionId, ERROR_DAY_WINDOW]);
+  return { latest, days };
+}
+
+const sameResult = (cur, s) => !!cur && cur.outcome === s.outcome
+  && (cur.score == null ? null : Number(cur.score)) === s.score
+  && Number(cur.sample_size) === s.sample_size;
+
+// Re-score Install and Reliability for one version from its reports, append a
+// signal row for each part whose result moved, then re-compose the overall score
+// (module-assess-score.js). Resolves { ok, written: [part…], score }.
+async function recordInstallSignals(versionId, { db } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { latest, days } = await readReports(versionId, pool);
+  const next = { install: assessInstall(latest), reliability: assessReliability(days) };
+
+  const { rows: current } = await pool.query(
+    `SELECT DISTINCT ON (part) part, outcome, score, sample_size
+       FROM module_assessment_signals WHERE version_id = $1 AND part IN ('install', 'reliability')
+      ORDER BY part, measured_at DESC, id DESC`, [versionId]);
+  const byPart = Object.fromEntries(current.map((r) => [r.part, r]));
+
+  const written = [];
+  for (const part of ['install', 'reliability']) {
+    const s = next[part];
+    if (sameResult(byPart[part], s)) continue;
+    await pool.query(
+      `INSERT INTO module_assessment_signals (version_id, part, outcome, score, sample_size, reason, detail)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [versionId, part, s.outcome, s.score, s.sample_size, s.reason, JSON.stringify(s.detail)]);
+    written.push(part);
+  }
+  const { score } = written.length
+    ? await require('./module-assess-score').recomposeScore(versionId, { db: pool })
+    : { score: null };
+  return { ok: true, written, signals: next, score };
+}
+
+async function main(argv) {
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-installs.js <store_module_versions.id>');
+    return 2;
+  }
+  const res = await recordInstallSignals(id);
+  for (const part of ['install', 'reliability']) {
+    const s = res.signals[part];
+    console.log(`${part}: ${s.outcome}${s.score != null ? ` ${s.score}/100` : ''} — ${s.reason}${res.written.includes(part) ? '' : ' (unchanged)'}`);
+  }
+  await require('./module-assess-score').printRecomposed(id);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => { process.exitCode = code; }, (e) => { console.error(e.stack || e.message); process.exitCode = 1; });
+}
+
+module.exports = { MIN_HOLDERS, assessInstall, assessReliability, recordInstallSignals };