@bongos/core 1.24.25 → 1.24.27

package/docs/recipes/ui-look-before-you-ship.md

@@ -21,6 +21,7 @@ SURFACE=hall-ui PREFIX=/builders/ node modules/ui-design/kit/serve.js
 CHILD=1 node modules/ui-design/kit/serve.js                  # the child-instance shape (apex-only regions stripped)
 LIVE=1 node modules/ui-design/kit/serve.js                   # public feeds proxied to the pack's public origin
 FAIL=featured,progress node modules/ui-design/kit/serve.js   # those feeds answer 500
+LATENCY=4000 node modules/ui-design/kit/serve.js             # every /api/ read held 4s, to look at a page's waiting state (the loader; task 1005053)
 STYLE=grove node modules/ui-design/kit/serve.js              # under a look from the style library (modules/ui-design/styles/; task 1003323)
 ```
 

package/modules/autonomy/fence.js

@@ -48,6 +48,7 @@ const REFUSALS = {
   no_allowlist: 'no goal is allowlisted, so there is nothing this runner may work on',
   goal_not_allowlisted: 'that goal is not on the allowlist',
   protected_path: 'the task declares work on a permission, migration, infrastructure or deploy-pipeline surface',
+  self_modification: "the task declares work on the runner's own supervisor, safety checks or kill switch",
   needs_host_access: 'the work needs shell access to a live host (SSH, root, systemd) that the runner machine does not have',
   grader_unavailable: 'the grader is bypassed, and it is the only review between an unattended worker and main',
   not_permitted: 'your rank does not hold autonomy.run, so your runner may not work on this project',
@@ -332,7 +333,13 @@ function needsHostAccess(task) {
 // in core and a module reaches core only through the doorway. Passing the hits in
 // also means the caller decides WHAT to match, which is what lets a future caller
 // run the same decision over a real diff instead of a declaration.
-function decideTask({ task, goals = [], protectedHits = [] } = {}) {
+//
+// `selfHits` is the same idea for the runner's OWN files (task 1004546): the output
+// of modules/lifecycle/runner-self.js matchRunnerSelf over the same touches[]. The
+// owner's rule is that the runner never edits its own supervisor, safety checks or
+// kill switch, and none of those are on the ADR 0043 registry. Declared touches are
+// a claim, so the ship-time check and the server's publish check read the real diff.
+function decideTask({ task, goals = [], protectedHits = [], selfHits = [] } = {}) {
   if (!task || task.id === undefined || task.id === null) {
     return { go: false, code: 'fence_unreadable', reason: 'no task to decide about' };
   }
@@ -351,6 +358,14 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
       globs,
     };
   }
+  if (Array.isArray(selfHits) && selfHits.length) {
+    const files = [...new Set(selfHits.map((h) => h && h.file).filter(Boolean))];
+    return {
+      go: false, code: 'self_modification',
+      reason: `${REFUSALS.self_modification}${files.length ? ` (${files.join(', ')})` : ''}`,
+      files,
+    };
+  }
   const host = needsHostAccess(task);
   if (host.needs) {
     return {

package/modules/government/protected-surfaces.json

@@ -109,6 +109,8 @@
     { "glob": "modules/lifecycle/github-push.js", "group": "pipeline", "why": "BV1.R86: the server-mediated branch publish (ADR 0055)" },
     { "glob": "modules/lifecycle/conflict-resolve.js", "group": "pipeline", "why": "BV1.R86: self-heals generated-file conflicts at land time" },
     { "glob": "modules/lifecycle/publish-reconciler.js", "group": "pipeline", "why": "BV1.R86: lands confirmed merges" },
+    { "glob": "modules/lifecycle/runner-self.js", "group": "pipeline", "why": "task 1004546: the one list of files an Autobongos runner may never change, and the shape of a runner's claim" },
+    { "glob": "modules/lifecycle/runner-self-guard.js", "group": "pipeline", "why": "task 1004546: the server refuses to publish a runner's change to its own supervisor, safety checks or kill switch" },
     { "glob": "migrations/", "group": "schema", "why": "schema migrations are never newcomer work" },
     { "glob": "infra/", "group": "substrate", "why": "the deploy substrate" },
     { "glob": ".github/", "group": "substrate", "why": "CI workflows (deploy-prod.yml, grade gate, secrets-scan) are the pipeline" },

package/modules/hall-ui/public/ai-studio.html

@@ -73,7 +73,7 @@
         <!-- The view, painted by ai-studio.js. The page's one <h1> is each
              view's own question or figure. -->
         <div class="ais-page" id="ais-page">
-          <p class="ais-quiet">Opening…</p>
+          <p class="hall-loading hall-loading--page" role="status">Opening…</p>
         </div>
         <input type="file" id="ais-file" class="ais-file" multiple accept="image/png,image/jpeg,image/gif,image/webp,application/pdf" tabindex="-1" aria-hidden="true">
         <input type="file" id="ais-camera-file" class="ais-file" accept="image/*" capture="environment" tabindex="-1" aria-hidden="true">
@@ -89,7 +89,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw23"></script>
 <script src="/builders/studio-lib.js?v=2026-10-09-day"></script>

package/modules/hall-ui/public/atlas.html

@@ -92,7 +92,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -44,7 +44,7 @@
           <h2 id="blockers-h" class="scroll__h">Requires project owner fix<span class="count-pill" id="blockers-count" hidden></span></h2>
           <div id="blockers-file-area"></div>
           <div id="blockers-body">
-            <p class="profile__placeholder">Loading…</p>
+            <p class="hall-loading hall-loading--page" role="status">Loading…</p>
           </div>
         </section>
       </main>
@@ -61,7 +61,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the branding pack's currency label, loaded BEFORE blockers.js. -->

package/modules/hall-ui/public/blockers.js

@@ -297,7 +297,9 @@
   }
 
   function mountShell() {
-    body.innerHTML = '<ul class="ov-rows" id="blockers-list"></ul>' + kit.pagerBarHtml(pager.prefix, { label: 'blockers' });
+    // The loader holds the list until renderList's first paint replaces it (task 1005043).
+    body.innerHTML = '<ul class="ov-rows" id="blockers-list"><li class="hall-loading hall-loading--page" role="status">Loading…</li></ul>'
+      + kit.pagerBarHtml(pager.prefix, { label: 'blockers' });
     kit.wirePager(pager, function () { fetchPage(); });
   }
 

package/modules/hall-ui/public/board-room.html

@@ -32,6 +32,8 @@
       </div>
 
       <main id="hall-main">
+        <!-- task 1005043: the page loader, shown until any section below is revealed. -->
+        <p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…</p>
         <!-- task 1003469: the sealed state is a panel with a heading, not a bare
              line on the ground. board-room.js writes the floor into the lede from
              the pack's rank label, so the copy cannot drift. Unlike its
@@ -61,7 +63,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/city.html

@@ -108,7 +108,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch" defer></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip" defer></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill" defer></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1" defer></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3" defer></script>

package/modules/hall-ui/public/collab.html

@@ -49,7 +49,7 @@
               <span class="cb-block__age" id="cb-for-me-age" hidden></span>
               <span class="cb-faces" id="cb-for-me-faces" aria-hidden="true"></span>
             </div>
-            <ul class="ov-rows" id="cb-for-me"></ul>
+            <ul class="ov-rows" id="cb-for-me"><li class="hall-loading" role="status">Loading…</li></ul>
             <div class="empty-state cb-empty" id="cb-for-me-empty" hidden>
               <p>Nobody is waiting on you. Requests reach you by role —
               <a href="/builders/settings">set yours in Settings</a>.</p>
@@ -79,7 +79,7 @@
               <h2 class="scroll__h" id="cb-mine-h">Your asks <span class="cb-block__n" id="cb-mine-n"></span></h2>
               <span class="cb-block__age" id="cb-mine-age" hidden></span>
             </div>
-            <ul class="ov-rows" id="cb-mine"></ul>
+            <ul class="ov-rows" id="cb-mine"><li class="hall-loading" role="status">Loading…</li></ul>
             <div class="empty-state cb-empty" id="cb-mine-empty" hidden><p>You have no open asks.</p></div>
             <button class="btn-ghost cb-more" id="cb-mine-more" type="button" aria-expanded="false" aria-controls="cb-mine" hidden></button>
           </section>
@@ -91,7 +91,7 @@
               <span class="cb-block__age" id="cb-all-age" hidden></span>
             <span class="cb-faces" id="cb-all-faces" aria-hidden="true"></span>
           </div>
-          <ul class="ov-rows" id="cb-all"></ul>
+          <ul class="ov-rows" id="cb-all"><li class="hall-loading" role="status">Loading…</li></ul>
           <div class="empty-state cb-empty" id="cb-all-empty" hidden><p>Nobody has an open ask right now.</p></div>
           <button class="btn-ghost cb-more" id="cb-all-more" type="button" aria-expanded="false" aria-controls="cb-all" hidden></button>
         </section>
@@ -162,7 +162,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>
 <script src="/builders/collab.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/collab.js

@@ -843,5 +843,9 @@
     const sub = $('#cb-sub');
     // V6: a message that stops someone points at the next move in the same breath.
     if (sub) sub.textContent = 'Could not load requests — reload to try again.';
+    // task 1005043: the loaders stop, and the same words stand where the asks would have.
+    ['for-me', 'mine', 'all'].forEach((k) => { const host = $(`#cb-${k}`); if (host) host.innerHTML = ''; });
+    const first = $('#cb-for-me');
+    if (first) first.innerHTML = '<li class="empty-state"><p>Could not load requests — reload to try again.</p></li>';
   });
 })();

package/modules/hall-ui/public/commands.html

@@ -33,14 +33,14 @@
             <span><span class="fact-pill fact-pill--info">Shown to Claude</span> Claude can start it when you ask in plain words.</span>
             <span><span class="fact-pill cmd-how--typed">Type it yourself</span> Kept out of Claude's menu to save room; type <code>/name</code> to run it.</span>
           </div>
-          <div id="skills-body" aria-live="polite"><p class="cmd-error">Loading the slash commands…</p></div>
+          <div id="skills-body" aria-live="polite"><p class="hall-loading" role="status">Loading the slash commands…</p></div>
           <p class="cmd-note">Some commands refuse below a certain rank.</p>
         </section>
 
         <section class="scroll" id="cli-scroll" aria-labelledby="cli-h">
           <h2 id="cli-h" class="scroll__h">Terminal commands (bongos)</h2>
           <p class="scroll__lede">The same work from any terminal. <code>bongos help</code> lists them there.</p>
-          <div id="cli-body" aria-live="polite"><p class="cmd-error">Loading the terminal commands…</p></div>
+          <div id="cli-body" aria-live="polite"><p class="hall-loading" role="status">Loading the terminal commands…</p></div>
         </section>
       </main>
 
@@ -54,7 +54,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -46,7 +46,7 @@
           <h2 id="cd-flags-h" class="scroll__h">Flagged</h2>
           <p class="scroll__lede">Copy someone has judged as needing attention, with their reason. Anyone can file one; closing it needs the <span id="cd-close-rank">Metic</span> rank or above, or that it is your own.</p>
           <div id="cd-filters"></div>
-          <div id="cd-flags"><div class="empty-state"><p>Loading…</p></div></div>
+          <div id="cd-flags"><div class="empty-state"><p class="hall-loading" role="status">Loading…</p></div></div>
         </section>
 
         <!-- The one signal a machine can compute with no judgement layer at all
@@ -55,7 +55,7 @@
         <section class="scroll" id="cd-dupes-scroll" aria-labelledby="cd-dupes-h">
           <h2 id="cd-dupes-h" class="scroll__h">Said more than once</h2>
           <p class="scroll__lede">The same sentence, in several places. Sometimes that is right and the answer is to dismiss it; sometimes it is seven copies of an error message that should have been one. Nobody has looked at the ones marked untouched.</p>
-          <div id="cd-dupes"><div class="empty-state"><p>Loading…</p></div></div>
+          <div id="cd-dupes"><div class="empty-state"><p class="hall-loading" role="status">Loading…</p></div></div>
         </section>
 
         <!-- Find any string in the product and flag it. Without this the queue
@@ -180,7 +180,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/copy-desk.js?v=2026-09-01-redesign"></script>

package/modules/hall-ui/public/core-move-notice.js

@@ -32,19 +32,22 @@
     }
     var topbar = document.getElementById('app-topbar');
     if (!topbar) return;
+    // A small card in the top-right corner, the Update pill's own (task 1005041): the owner
+    // called the full-width strips "way too obstructing". It still sits after the top bar in
+    // the document, so a screen reader meets it where the strip was.
     var el = document.createElement('div');
-    el.className = 'core-update-notice core-move-notice';
+    el.className = 'upd-card upd-card--note core-move-notice';
     el.id = 'core-move-notice';
     el.setAttribute('role', 'status');
     var entries = Array.isArray(moved.entries) ? moved.entries : [];
     var list = entries.length
-      ? '<ul class="core-move-notice__list">' + entries.map(function (e) { return '<li>' + esc(e && e.text) + '</li>'; }).join('') +
+      ? '<ul class="upd-card__list core-move-notice__list">' + entries.map(function (e) { return '<li>' + esc(e && e.text) + '</li>'; }).join('') +
         (moved.more > 0 ? '<li>…and ' + esc(String(moved.more)) + ' more.</li>' : '') + '</ul>'
       : '';
-    el.innerHTML = '<div class="core-move-notice__body"><span>' + esc(moved.message) +
-      (entries.length ? ' What changed:' : '') + '</span>' + list + '</div>' +
-      '<a class="core-update-notice__action core-move-notice__more" href="' + esc((opts && opts.href) || '/settings#software-update') + '">Update history</a>' +
-      '<button type="button" class="core-update-notice__close core-move-notice__close" aria-label="Dismiss">×</button>';
+    el.innerHTML = '<button type="button" class="upd-card__close core-move-notice__close" aria-label="Dismiss">×</button>' +
+      '<h2 class="upd-card__h">Bongos is updated</h2>' +
+      '<p>' + esc(moved.message) + (entries.length ? ' What changed:' : '') + '</p>' + list +
+      '<div class="upd-card__actions"><a class="upd-btn core-move-notice__more" href="' + esc((opts && opts.href) || '/settings#software-update') + '">Update history</a></div>';
     function markSeen() {
       try {
         if (window.localStorage) window.localStorage.setItem(SEEN_KEY, String(moved.id));

package/modules/hall-ui/public/criterion-uat-ui.js

@@ -195,7 +195,7 @@
       if (existing) { existing.remove(); btn.setAttribute('aria-expanded', 'false'); return; }
       const panel = document.createElement('div');
       panel.className = 'uat-panel';
-      panel.textContent = 'Loading…';
+      panel.innerHTML = '<p class="hall-loading hall-loading--inline" role="status">Loading…</p>';
       row.appendChild(panel);
       btn.setAttribute('aria-expanded', 'true');
       try {

package/modules/hall-ui/public/deploy-handoff.js

@@ -0,0 +1,203 @@
+// deploy-handoff.js — the hub's half of the in-place update (task 1005041).
+//
+// A hosted project's owner presses Update now in their own hall (update-pill.js). The act
+// has to happen HERE, on the hub, with the owner's hub session: the project's own server
+// may never move its own pin (ADR 0293 D1, ADR 0339 D3). So the hall opens this page in a
+// small window as /deploy?project=<slug>&handoff=1, and the two windows say four things:
+//   hub  → hall  { tag, step: 'ready' }              "I am loaded; which version?"
+//   hall → hub   { tag, step: 'go', to }             the version the owner was shown
+//   hub  → hall  { tag, step: 'started', to }        the move is queued; the window closes
+//   hub  → hall  { tag, step: 'refused', message }   the server's own sentence
+//
+// WHAT IS CHECKED BEFORE ANYTHING MOVES (judgeGo). The message must come from the window
+// that opened this one, from that project's own registered address (provisioning's
+// `domain`, which is where its hall is served), and name exactly the version this hub's
+// own preview would move it to. Anything else moves nothing: a page that opens this
+// window from elsewhere is talking to a window that will not listen, and a version this
+// hub would not offer is shown to the owner instead of sent. The move itself is the same
+// POST the deploy door makes, gated server-side exactly as before (owner or core.pin.move).
+//
+// ONE PRESS, NEVER ZERO, WHEN IT CANNOT HEAR. If no word comes from the hall (a browser
+// that cuts the tie between the two windows, or this page opened by hand), it shows one
+// button naming the version, the door's own confirm. It never moves on load by itself.
+//
+// Loaded by deploy.html; deploy.js hands over to run() when ?handoff=1 is present.
+// Node-require-safe, so the tests run judgeGo and projectOrigin without a page.
+(function (root) {
+  'use strict';
+
+  var MSG = 'bongos-update'; // update-pill.js's tag
+  var VERSION_RE = /^\d+\.\d+\.\d+$/;
+  var HOST_RE = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?::\d{1,5})?$/;
+  var API = '/api/bongos';
+  // How long the window waits for the hall to say which version, before it offers the press.
+  var HEAR_MS = typeof root !== 'undefined' && root && typeof root.__handoffHearMs === 'number' ? root.__handoffHearMs : 5000;
+
+  /** Is this page the handoff window? Read defensively, as deploy.js reads its scope. */
+  function wanted(loc) {
+    try { return /[?&]handoff=1(?:&|$)/.test(String((loc && loc.search) || '')); } catch (e) { return false; }
+  }
+
+  /** The one origin allowed to ask for this project's move: its registered address, on the
+   *  scheme this hub is served on (https in production; http only on a local harness). */
+  function projectOrigin(inst, protocol) {
+    var host = inst && typeof inst.domain === 'string' ? inst.domain.trim().toLowerCase() : '';
+    if (!host || !HOST_RE.test(host)) return null;
+    return (protocol === 'http:' ? 'http://' : 'https://') + host;
+  }
+
+  /** Why a message may NOT start the move, or null when it may. Each refusal names itself. */
+  function judgeGo(o) {
+    var data = o && o.data;
+    if (!data || data.tag !== MSG || data.step !== 'go') return 'not_go';
+    if (!o.opener || o.source !== o.opener) return 'not_opener';
+    if (!o.allowed || o.origin !== o.allowed) return 'wrong_origin';
+    var p = o.preview;
+    if (!p || p.reading !== 'ok' || !p.behind || !VERSION_RE.test(String(p.recommended_version || ''))) return 'nothing_to_move';
+    if (p.viewer_may_move === false) return 'not_allowed';
+    if (typeof data.to !== 'string' || data.to !== p.recommended_version) return 'wrong_version';
+    if (p.open_intent) return 'busy';
+    return null;
+  }
+
+  // ---------- the page ----------
+
+  function esc(s) { return root.OTB.escapeHtml(String(s == null ? '' : s)); }
+
+  function run(opts) {
+    var d = root.document;
+    var api = opts.api;
+    var main = d.getElementById('hall-main');
+    if (!main) return;
+    d.documentElement.setAttribute('data-handoff', 'on');
+    main.innerHTML = '<section class="upd-card upd-card--handoff" aria-labelledby="ho-h"><div id="ho-body"><p class="upd-card__note" role="status">Opening this project\'s update…</p></div></section>';
+    var body = d.getElementById('ho-body');
+    var slug = scopeSlug(root.location);
+    var opener = null;
+    try { opener = root.opener || null; } catch (e) { opener = null; }
+    var inst = null;
+    var preview = null;
+    var allowed = null;
+    var heard = false;
+    var moving = false;
+
+    function draw(html) { body.innerHTML = html; }
+    function title(t) { return '<h1 class="upd-card__h" id="ho-h">' + esc(t) + '</h1>'; }
+    function tell(msg) {
+      if (!opener || !allowed) return;
+      try { opener.postMessage(Object.assign({ tag: MSG }, msg), allowed); } catch (e) { /* the hall watches its own version anyway */ }
+    }
+    function refuse(message) {
+      tell({ step: 'refused', message: message });
+      draw(title('The update did not start') + '<p class="upd-card__err" role="alert">' + esc(message) + '</p>' +
+        '<div class="upd-card__actions"><button type="button" class="upd-btn" id="ho-close">Close</button></div>');
+      wireClose();
+    }
+    function wireClose() {
+      var c = d.getElementById('ho-close');
+      if (c) c.addEventListener('click', function () { root.close(); });
+    }
+
+    // The one press, naming the version THIS hub would move to: the door's own confirm.
+    function offerPress(note) {
+      if (moving) return;
+      var to = preview.recommended_version;
+      draw(title('Update ' + (slug || 'this project')) +
+        (note ? '<p class="upd-card__note">' + esc(note) + '</p>' : '') +
+        '<p>Moves it to version <span class="upd-ver">' + esc(to) + '</span>. It restarts once, and goes back to the version it runs now on its own if the new one is not healthy.</p>' +
+        '<div class="upd-card__actions"><button type="button" class="upd-btn upd-btn--go" id="ho-go">Update to ' + esc(to) + '</button>' +
+        '<button type="button" class="upd-btn" id="ho-close">Cancel</button></div>');
+      d.getElementById('ho-go').addEventListener('click', function () { move(to); });
+      wireClose();
+    }
+
+    function move(to) {
+      if (moving) return;
+      moving = true;
+      draw(title('Starting the update') + '<p class="upd-card__note" role="status">Asking the server to move ' + esc(slug) + ' to ' + esc(to) + '…</p>');
+      api.request('POST', API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/core-upgrade', { body: { to: to } }).then(function (res) {
+        if (res && res.status === 401) { signIn(); return; }
+        if (!res || !res.ok) {
+          moving = false;
+          var err = (res && res.data && res.data.error) || {};
+          refuse(err.message && err.message !== err.code ? err.message : 'The server refused the update (' + (res ? res.status : 'no answer') + ').');
+          return;
+        }
+        tell({ step: 'started', to: to });
+        draw(title('The update has started') +
+          '<p role="status">You can close this window. ' + (opener ? 'Your project\'s hall shows how it is going.' : 'Open your project\'s hall to see how it is going.') + '</p>' +
+          '<div class="upd-card__actions"><button type="button" class="upd-btn" id="ho-close">Close</button></div>');
+        wireClose();
+        if (opener) root.setTimeout(function () { root.close(); }, 1200);
+      }, function () { moving = false; refuse('The server did not answer. Nothing was changed.'); });
+    }
+
+    function onMessage(e) {
+      if (!e || !e.data || e.data.tag !== MSG) return;
+      var why = judgeGo({ data: e.data, source: e.source, opener: opener, origin: e.origin, allowed: allowed, preview: preview });
+      if (why === 'not_go' || why === 'not_opener' || why === 'wrong_origin') return; // not ours to answer
+      heard = true;
+      if (!why) { move(e.data.to); return; }
+      if (why === 'wrong_version') { offerPress('A different version is ready than the one your hall showed. Check it before updating.'); return; }
+      if (why === 'busy') { refuse('Another change is already running for this project. Try again once it settles.'); return; }
+      if (why === 'not_allowed') { refuse('Only the project\'s owner can update it.'); return; }
+      refuse('This project already runs the newest version it can take.');
+    }
+
+    function signIn() {
+      var back = String(root.location.pathname || '/deploy') + String(root.location.search || '');
+      root.location.assign(API + '/auth/web/start?return=' + encodeURIComponent(back));
+    }
+
+    function read(path) {
+      return api.request('GET', API + path).then(function (res) {
+        if (res && res.status === 401) { signIn(); throw { kind: '401' }; }
+        if (!res || !res.ok) {
+          var err = (res && res.data && res.data.error) || {};
+          var e = new Error(err.message && err.message !== err.code ? err.message : (err.code || path + ' → ' + (res && res.status)));
+          e.status = res && res.status;
+          throw e;
+        }
+        return res.data;
+      });
+    }
+
+    // The project by name: the whole roster where the viewer may read it, else their own
+    // projects (deploy.js findBySlug's order). A lookup, never a listing.
+    read('/provisioning/fleet').then(function (d) { return d.instances || []; }, function (e) {
+      if (e && e.status === 403) return read('/provisioning/instances').then(function (d) { return d.instances || []; });
+      throw e;
+    }).then(function (rows) {
+      for (var i = 0; i < rows.length; i++) if (rows[i] && String(rows[i].slug) === slug) inst = rows[i];
+      if (!inst) throw new Error('No project called ' + slug + ' is hosted here under your account.');
+      allowed = projectOrigin(inst, root.location.protocol);
+      return read('/provisioning/instances/' + encodeURIComponent(inst.id) + '/core-upgrade');
+    }).then(function (d) {
+      preview = d.preview || null;
+      if (!preview || preview.reading !== 'ok' || !preview.behind) {
+        refuse(preview && preview.reading === 'ok' ? 'This project already runs the newest version it can take.' : 'This project\'s version could not be read just now. Nothing was changed.');
+        return;
+      }
+      if (preview.open_intent) { refuse('Another change is already running for this project. Try again once it settles.'); return; }
+      if (!opener || !allowed) { offerPress(); return; }
+      root.addEventListener('message', onMessage);
+      tell({ step: 'ready' });
+      draw(title('Updating ' + slug) + '<p class="upd-card__note" role="status">Waiting for your hall…</p>');
+      root.setTimeout(function () { if (!heard && !moving) offerPress(); }, HEAR_MS);
+    }).then(null, function (e) {
+      if (e && e.kind === '401') return;
+      refuse(String((e && e.message) || 'This project\'s update could not be opened.'));
+    });
+  }
+
+  function scopeSlug(loc) {
+    try {
+      var m = /[?&]project=([^&#]+)/.exec(String((loc && loc.search) || ''));
+      return m ? decodeURIComponent(m[1]) : null;
+    } catch (e) { return null; }
+  }
+
+  var api = { wanted: wanted, run: run, judgeGo: judgeGo, projectOrigin: projectOrigin, MSG: MSG };
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.OTBDeployHandoff = api;
+})(typeof window !== 'undefined' ? window : null);

package/modules/hall-ui/public/deploy.html

@@ -28,6 +28,8 @@
       </div>
 
       <main id="hall-main">
+        <!-- task 1005043: the page loader, shown until any section below is revealed. -->
+        <p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…</p>
         <section class="scroll" id="dp-sealed" aria-labelledby="dp-sealed-h" hidden>
           <h2 class="scroll__h" id="dp-sealed-h">Restricted</h2>
           <p class="scroll__lede" id="dp-sealed-body">This page opens at a higher rank.</p>
@@ -79,11 +81,13 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- the shared ask card the move is drawn with (task 1004829) -->
 <script src="/builders/hall-ask.js"></script>
-<script src="/builders/deploy.js?v=2026-09-23-changelist1"></script>
+<!-- the in-place update window a hosted project's hall opens (task 1005041) -->
+<script src="/builders/deploy-handoff.js?v=2026-11-03-handoff"></script>
+<script src="/builders/deploy.js?v=2026-11-03-handoff"></script>
 </body>
 </html>

package/modules/hall-ui/public/deploy.js

@@ -906,5 +906,11 @@
     }
   }
 
-  document.addEventListener('DOMContentLoaded', () => { load(); loadModuleSections(); });
+  document.addEventListener('DOMContentLoaded', () => {
+    // task 1005041: the small window a hosted project's hall opens to update in place. It is
+    // this door, asked from the project's own site, and deploy-handoff.js draws it instead.
+    const handoff = window.OTBDeployHandoff;
+    if (handoff && handoff.wanted(window.location)) { handoff.run({ api }); return; }
+    load(); loadModuleSections();
+  });
 })();

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -51,7 +51,7 @@
             <nav class="primer-toc__inner">
               <p class="primer-toc__heading" id="primer-toc-heading">On this page</p>
               <ol class="primer-toc__list" id="primer-toc-list" aria-labelledby="primer-toc-heading">
-                <li class="primer-toc__placeholder">Loading…</li>
+                <li class="hall-loading hall-loading--inline" role="status">Loading…</li>
               </ol>
             </nav>
           </aside>
@@ -97,7 +97,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -27,6 +27,8 @@
       </div>
 
       <main id="hall-main">
+        <!-- task 1005043: the page loader, shown until any section below is revealed. -->
+        <p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…</p>
         <section class="scroll" id="fl-sealed" aria-labelledby="fl-sealed-h" hidden>
           <h2 class="scroll__h" id="fl-sealed-h">Restricted</h2>
           <p class="scroll__lede">This page opens at a higher rank.</p>
@@ -58,7 +60,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/fleet-costs.js"></script>

package/modules/hall-ui/public/gate.html

@@ -27,6 +27,8 @@
       </div>
 
       <main id="hall-main">
+        <!-- task 1005043: the page loader, shown until any section below is revealed. -->
+        <p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…</p>
         <!-- task 1003469: the sealed state is a panel with a heading, not a bare
              line on the ground. gate.js writes the real floor into the lede from
              the pack's rank label, so the copy cannot drift from ADR 0157. -->
@@ -65,7 +67,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>