@bongos/core 1.24.25 → 1.24.27

package/modules/hall-ui/public/settings-software-update.js

@@ -7,11 +7,12 @@
 // update channel lets it take; what each version in between brings — and, for the people
 // the upgrade door lets through, an Update button.
 //
-// THE BUTTON LEADS TO THE DOOR; IT IS NOT THE DOOR. Taking an update is the deploy door's
-// two steps (see exactly what moves, then confirm that version) with its health check and
-// auto-rollback (ADR 0293), and on a hosted project that door is on the hub (ADR 0339 D3).
-// A second copy of that flow here would be a second place for its safety rules to drift, so
-// the server names where this project's door is (`door`) and the button goes there.
+// THE BUTTON RUNS THE PILL'S FLOW; IT IS NOT A SECOND DOOR. Taking an update is the deploy
+// door's act, with its health check and auto-rollback (ADR 0293), and on a hosted project that
+// door is on the hub (ADR 0339 D3). Since task 1005041 the button hands this panel's reading to
+// update-pill.js, which takes the update in place (this page names the version; the door moves
+// it), so there is one copy of that flow, not two. The server still names the door (`door`),
+// and the button's href is that door, for a page whose pill script did not load.
 //
 // THE PAGE KNOWS NOTHING (deploy.js's rule, kept). Every version here is the server's reading
 // with the time it was taken. "Up to date" is drawn only from an ok reading with nothing
@@ -125,11 +126,14 @@
     if (!sameOrigin && !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return '';
     let where = '';
     if (!sameOrigin) {
-      try { where = ` on ${new URL(url).host}`; } catch (e) { return ''; }
+      try { where = new URL(url).host; } catch (e) { return ''; }
     }
+    // IN PLACE (task 1005041): the button runs the Update pill's flow (update-pill.js) and the
+    // page stays put; the pill in the top bar shows the progress. The href stays the door's,
+    // so a page whose pill script did not load still reaches the update the old way.
     return `<div class="row-end su-door">
-      <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}${sameOrigin ? '' : ' ↗'}</a>
-      <span class="panel-hint">Opens this project's upgrade${escapeHtml(where)}: you see what would move, confirm it, and it installs, checks itself, and rolls back if the project does not come back healthy.</span>
+      <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}</a>
+      <span class="panel-hint">Takes a few minutes. The project restarts once, checks itself, and goes back to the version it runs now if it does not come back healthy.${where ? ` A small window from ${escapeHtml(where)} opens for a moment to start it.` : ''}</span>
     </div>${door.kind === 'hub' && ask.available ? askHtml(ask, offered, { lead: false }) : ''}`;
   }
 
@@ -236,6 +240,16 @@
     const askBtn = byId('su-ask');
     if (askBtn) askBtn.addEventListener('click', () => askForUpgrade(data, askBtn));
 
+    // The same press as the pill's Update now; only when it took the update in place is the
+    // link's own navigation stopped.
+    const updateBtn = byId('su-update');
+    if (updateBtn) {
+      updateBtn.addEventListener('click', (e) => {
+        const pill = window.OTBUpdatePill;
+        if (pill && pill.updateNow(data, { api })) e.preventDefault();
+      });
+    }
+
     const more = byId('su-more');
     if (more) {
       more.addEventListener('click', () => {
@@ -275,7 +289,7 @@
     if (asked) return;
     asked = true;
     const body = byId('su-body');
-    if (body) body.innerHTML = '<p class="panel-hint">Checking for a newer version…</p>';
+    if (body) body.innerHTML = '<p class="hall-loading hall-loading--inline" role="status">Checking for a newer version…</p>';
     try {
       const res = await api.request('GET', `${API}/software-update`);
       if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }

package/modules/hall-ui/public/settings-specialities.js

@@ -276,7 +276,7 @@
     return `
       <form class="speciality-offer" data-id="${escapeHtml(String(s.id))}">
         <h4 class="speciality-create__h">What ${escapeHtml(s.name)} offers</h4>
-        <div class="speciality-offer__choices">${state.offerChoices || '<p class="prow__hint">Loading this project’s skills…</p>'}</div>
+        <div class="speciality-offer__choices">${state.offerChoices || '<p class="hall-loading hall-loading--inline" role="status">Loading this project’s skills…</p>'}</div>
         <div class="speciality-actions">
           <button type="submit" class="btn" ${state.offerChoices ? '' : 'disabled'}>Save what it offers</button>
         </div>

package/modules/hall-ui/public/settings.html

@@ -54,6 +54,8 @@
           <nav class="section-rail" id="settings-rail" aria-label="Settings sections"></nav>
 
           <div class="settings-groups" id="settings-groups" data-active="account">
+            <!-- task 1005043: the panel loader, until settings.js has read who is viewing (hideLayout). -->
+            <p class="hall-loading hall-loading--page" id="settings-loading" role="status">Loading…</p>
 
             <!-- ============ group: account ============ -->
 
@@ -344,7 +346,7 @@
                 </label>
                 <details id="speciality-create-offer" class="speciality-offer-box">
                   <summary>Skills it offers <small>(optional)</small></summary>
-                  <div id="speciality-create-skills"><p class="prow__hint">Loading this project’s skills…</p></div>
+                  <div id="speciality-create-skills"><p class="hall-loading hall-loading--inline" role="status">Loading this project’s skills…</p></div>
                 </details>
                 <div class="speciality-actions">
                   <button type="submit" class="btn">Create speciality</button>
@@ -473,9 +475,9 @@
             <!-- SOFTWARE UPDATE — this project's version, the newest release its update
                  channel allows, and what the versions between them carry (task 1004296).
                  Like a phone's Software Update screen: every builder reads it; the Update
-                 button is drawn only for those the upgrade door lets through, and it LEADS
-                 to that door (the two-step confirm and auto-rollback of ADR 0293) — the
-                 act never happens on this page. Rendered by settings-software-update.js
+                 button is drawn only for those the upgrade door lets through, and it runs
+                 the Update pill's in-place flow (update-pill.js, task 1005041): the act is
+                 still the door's, with its auto-rollback (ADR 0293). Rendered by settings-software-update.js
                  from GET /api/bongos/software-update, read only when this group opens:
                  an update's notes come out of a package download. -->
             <section class="scroll" id="software-update-scroll" aria-labelledby="software-update-h" data-group="update" hidden>
@@ -512,7 +514,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared component kit (window.OTBKit) — section rail (task 2166). -->
@@ -538,7 +540,9 @@
      settings.js is against the 1500-line ratchet. -->
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
 <!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
-<script src="/builders/settings-software-update.js?v=2026-10-18-history"></script>
+<!-- the Update pill's flow, which the panel's Update button runs in place (task 1005041) -->
+<script src="/builders/update-pill.js?v=2026-11-03-pill"></script>
+<script src="/builders/settings-software-update.js?v=2026-11-03-pill"></script>
 <!-- task 1004501: Settings → Your Autobongos runner. Own file on the same precedent. -->
 <script src="/builders/settings-autobongos.js?v=2026-10-01-autobongos"></script>
 <!-- task 1003793: Settings → Module install reports. Own file on the same precedent. -->

package/modules/hall-ui/public/settings.js

@@ -1186,6 +1186,9 @@
   function hideLayout(hide) {
     const layout = document.getElementById('settings-layout');
     if (layout) layout.hidden = !!hide;
+    // Every path past /me decides the layout here, so the page loader stops here too (task 1005043).
+    const loading = document.getElementById('settings-loading');
+    if (loading) loading.hidden = true;
   }
 
   // ---- bootstrap -----------------------------------------------------------

package/modules/hall-ui/public/shell.js

@@ -751,8 +751,11 @@
     history.replaceState(null, '', window.location.pathname + rest + window.location.hash);
   }
 
-  // task 1004045 — the core-update banner. The owner's ask: "a popup banner at the
-  // top of every owners builders hall that a core update has been released".
+  // task 1004045 → task 1005041 — the Update pill. The owner's first ask was a banner at the top
+  // of every owner's hall when a core update is released; the second (2026-11-03) was that it
+  // was "way too obstructing and not obvious what to do", and should feel like the Claude
+  // app's "restart to update". So the news is a quiet pill in the top bar now, and the
+  // update is taken in place from it: update-pill.js owns all of it, this only asks.
   //
   // WHY THE SERVER IS ASKED RATHER THAN TOLD. The version this box runs is known
   // here, but what is PUBLISHED is not, and the fact lives behind an outbound
@@ -764,6 +767,11 @@
   // ASKED ONCE PER PAGE LOAD. applyAccess runs on every settle (the /me probe, a
   // page's own report), and re-firing a network call on each would be a request per
   // nav interaction for a fact with a six-hour life on the server.
+  //
+  // SAID FROM AN ANSWER, OR FROM AN UPDATE ALREADY UNDER WAY. The pill script loads only
+  // when the answer has something to say (behind, held, or just moved), or when this
+  // browser remembers an update it started: mid-restart the read itself may fail, and the
+  // pill must still follow the owner from page to page.
   var coreUpdateAsked = false;
   function maybeRenderCoreUpdate() {
     if (coreUpdateAsked) return;
@@ -771,10 +779,20 @@
     if (!perms || perms['core.pin.move'] !== true) return;
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
-      if (!res || res.status !== 200 || !res.data) return;
-      if (res.data.update) renderCoreUpdateBanner(res.data.update, res.data.held);
-      if (res.data.moved) renderCoreMoveNotice(res.data.moved); // task 1004731: loads core-move-notice.js, which draws it
-    }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
+      mountUpdatePill(res && res.status === 200 && res.data ? res.data : null);
+    }, function () { mountUpdatePill(null); });
+  }
+  function updateUnderWay() {
+    try { return !!(window.localStorage && window.localStorage.getItem('bongos.update.run')); } catch (e) { return false; }
+  }
+  function mountUpdatePill(data) {
+    var u = data && data.update;
+    var news = !!(u && u.reading === 'ok' && u.behind) || !!(data && data.held);
+    if (news || updateUnderWay()) {
+      var go = function () { if (window.OTBUpdatePill) window.OTBUpdatePill.mount(data, { api: api }); };
+      if (window.OTBUpdatePill) go(); else loadHallScript('update-pill.js', go);
+    }
+    if (data && data.moved) renderCoreMoveNotice(data.moved); // task 1004731: loads core-move-notice.js, which draws it
   }
   // One hall script on demand, stamped with the shell's own ?v= (task 1004996 made it one helper).
   function loadHallScript(file, onload, onerror) {
@@ -785,7 +803,7 @@
     head.appendChild(tag);
   }
   function renderCoreMoveNotice(moved) {
-    loadHallScript('core-move-notice.js', function () { if (window.CoreMoveNotice) window.CoreMoveNotice.render(moved, { api: api, href: SOFTWARE_UPDATE_HREF }); });
+    loadHallScript('core-move-notice.js', function () { if (window.CoreMoveNotice) window.CoreMoveNotice.render(moved, { api: api, href: '/settings#software-update' }); });
   }
   var githubChipAsked = false; // task 1004996: the Link GitHub chip (github-chip.js), asked once a page
   function loadGithubChip(builder) {
@@ -795,72 +813,6 @@
     loadHallScript('github-chip.js', function () { if (window.OTBGithubChip) window.OTBGithubChip.mount({ api: api, builder: builder, hub: hub }); });
   }
 
-  // Where the banner's Upgrade goes (task 1004296). The platform's hall runs the deploy
-  // door itself, so there it is /deploy. Every other hall — a hosted project, a
-  // self-hosted instance — takes its update from Settings → Software update, which says
-  // what the update carries and, on a hosted project, hands the owner to the hub's door
-  // for this project (ADR 0339 D3). The banner no longer links off-site itself.
-  var SOFTWARE_UPDATE_HREF = '/settings#software-update';
-
-  // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
-  // is current AND when the registry could not be read; `reading` separates them,
-  // and neither renders. A banner is a claim about being out of date, and a wrong
-  // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update, held) {
-    if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
-    // A dismissal is remembered PER VERSION, not forever: the next release is new
-    // news and must re-announce itself, or the surface is dead after one click.
-    // localStorage throws in a private window and is absent in the unit tests' bare
-    // vm context, so every touch is guarded and its loss only costs the memory.
-    try {
-      var seen = window.localStorage && window.localStorage.getItem('bongos.coreUpdate.dismissed');
-      if (seen && seen === update.latest) return;
-    } catch (e) { /* no storage: always show */ }
-    var topbar = document.getElementById('app-topbar');
-    if (!topbar) return;
-    var el = document.createElement('div');
-    el.className = 'core-update-notice';
-    el.id = 'core-update-notice';
-    el.setAttribute('role', 'status');
-    // The action goes where the update can actually be taken. The deploy door is the
-    // provisioning module's, and a hosted project does NOT run that module (probed:
-    // /api/bongos/provisioning/health is 404 on a tenant, 200 on the platform) — so on
-    // those it goes to Settings → Software update (SOFTWARE_UPDATE_HREF above).
-    // NOT A LINK TO THE PAGE YOU ARE ALREADY ON (task 1004145). This reads as the action
-    // button — it is labelled with the verb and styled like one — but it is a plain
-    // navigation to /deploy. On /deploy itself that is a no-op, and the owner who
-    // pressed it there reasonably reported "I clicked update, but I didn't see anything
-    // happen": nothing had, and nothing had been asked for. The control is on that page
-    // already, so on it the banner informs and points, and does not pretend to act.
-    // The same rule on Settings → Software update: that panel IS the control there.
-    var here = window.location ? String(window.location.pathname || '').replace(/\/+$/, '') : '';
-    var onDeploy = here === '/deploy';
-    var onUpdatePanel = here === '/settings' && String(window.location.hash || '') === '#software-update';
-    var action = moduleOn('provisioning')
-      ? (onDeploy
-        ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
-        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>')
-      : (onUpdatePanel
-        ? '<span class="core-update-notice__hint">Its details are below.</span>'
-        : '<a class="core-update-notice__action" href="' + SOFTWARE_UPDATE_HREF + '">Upgrade</a>');
-    // task 1004730: the newest version already failed here and was rolled back. Say so, never
-    // "available" with a button to take it again; Software update carries the full sentence.
-    var hold = held && held.version === update.latest ? held : null;
-    el.innerHTML = (hold
-      ? '<span>Core <strong>' + esc(hold.version) + '</strong> was tried on this project and rolled back. It is still on ' +
-        esc(hold.still_on) + ' and working.</span><a class="core-update-notice__action" href="' + SOFTWARE_UPDATE_HREF + '">Details</a>'
-      : '<span>Core <strong>' + esc(update.latest) + '</strong> is available — this project runs ' +
-        esc(update.running || 'an unknown version') + '.</span>' + action) +
-      '<button type="button" class="core-update-notice__close" aria-label="Dismiss">×</button>';
-    el.querySelector('.core-update-notice__close').addEventListener('click', function () {
-      try {
-        if (window.localStorage) window.localStorage.setItem('bongos.coreUpdate.dismissed', update.latest);
-      } catch (e) { /* dismissal is best-effort */ }
-      el.remove();
-    });
-    topbar.insertAdjacentElement('afterend', el);
-  }
-
   // task 1003303: the skip link, rendered once here rather than pasted into 27
   // heads. The hall had none, which is a platform floor (DESIGN.md
   // §Accessibility Floors) and, with the sidebar first in the DOM, meant a

package/modules/hall-ui/public/street.html

@@ -231,7 +231,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/studio.html

@@ -219,7 +219,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure
      (task 1003829), which the older reviews still show. -->

package/modules/hall-ui/public/studio.js

@@ -755,7 +755,7 @@
 
   function statusHtml() {
     if (!home.pages) {
-      return `<p class="st-panel__line">${home.pagesFailed ? 'The pages could not be read just now. Try again in a moment.' : 'Reading the pages…'}</p>`;
+      return home.pagesFailed ? '<p class="st-panel__line">The pages could not be read just now. Try again in a moment.</p>' : '<p class="hall-loading" role="status">Reading the pages…</p>';
     }
     const rows = lib.surfaceRows(home.pages, lib.landingHost(byId('hall-main') && byId('hall-main').getAttribute('data-apex'), window.location && window.location.host)).map((s) => `
       <li class="st-surface">
@@ -804,7 +804,7 @@
 
   function siteHtml() {
     if (!home.site) {
-      return `<p class="st-panel__line">${home.siteFailed ? SITE_FAILED : 'Reading the reviews…'}</p>`;
+      return home.siteFailed ? `<p class="st-panel__line">${SITE_FAILED}</p>` : '<p class="hall-loading" role="status">Reading the reviews…</p>';
     }
     if (!home.site.length) return `<p class="st-panel__line">${SITE_NONE}</p>`;
     const rows = home.site.map((r) => `
@@ -1178,7 +1178,7 @@
   }
 
   function siteListPage() {
-    if (!home.site) return `<p class="st-panel__line">${home.siteFailed ? SITE_FAILED : 'Reading the reviews…'}</p>`;
+    if (!home.site) return home.siteFailed ? `<p class="st-panel__line">${SITE_FAILED}</p>` : '<p class="hall-loading" role="status">Reading the reviews…</p>';
     if (!home.site.length) return `<p class="st-panel__line">${SITE_NONE}</p>`;
     return `<ul class="st-doc-list">${home.site.map((r) => `<li><a class="st-doc-list__row" href="${escapeHtml(siteHref(r.link))}">
         <span class="st-doc-list__page">${escapeHtml(r.page_title || r.page_path || r.page_id)}</span>

package/modules/hall-ui/public/style.css

@@ -1038,54 +1038,134 @@ html[data-theme="dark"] .gplate__light { display: none; }
   line-height: 1;
   cursor: pointer;
 }
-/* Core-update banner (task 1004045) — rendered by shell.js when this instance is
-   behind the newest published core. Deliberately the accent, not the warning
-   colour the denial notice uses: being a release behind is news, not a fault. */
-.core-update-notice {
-  display: flex;
-  align-items: baseline;
-  gap: 12px;
-  padding: 10px 22px;
-  font-size: 13px;
-  color: var(--accent);
-  background: var(--accent-weak, var(--warn-weak));
-  border-bottom: 1px solid var(--rule-soft);
+/* ---------- the Update pill and its card (task 1005041, update-pill.js) ----------
+   The owner: the full-width update banners were "way too obstructing"; it should feel
+   like the Claude app's "restart to update". So the news is a quiet pill in the top bar
+   (the Link GitHub chip's shape, one step louder: the accent dot), and everything else
+   lives in a small card under it. The same card carries the one-time "Bongos is updated"
+   note (core-move-notice.js), pinned to the same corner. */
+.upd-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  min-height: 28px;
+  min-width: 28px;
+  padding: 0 11px 0 9px;
+  border: 1px solid var(--rule);
+  border-radius: var(--radius-pill);
+  background: var(--bg-card);
+  color: var(--ink);
+  font: inherit;
+  font-size: 12px;
+  font-weight: 500;
+  line-height: 1;
+  white-space: nowrap;
+  flex-shrink: 0;
+  cursor: pointer;
 }
-.core-update-notice__action {
-  margin-left: auto;
-  font-weight: 600;
-  color: inherit;
+.upd-pill:hover { border-color: var(--ink-faint); }
+.upd-pill:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.upd-pill__dot { width: 7px; height: 7px; border-radius: 50%; background: var(--accent); flex-shrink: 0; }
+.upd-pill[data-face="held"] .upd-pill__dot { background: var(--ink-faint); }
+.upd-pill[data-face="done"] { background: var(--accent); border-color: var(--accent); color: var(--accent-on); }
+.upd-pill[data-face="done"] .upd-pill__dot { background: var(--accent-on); }
+.upd-pill[data-face="done"]:hover { background: var(--accent-lift); border-color: var(--accent-lift); }
+/* The running face turns a ring. The Kill Switch stops it, and the label still says
+   "Updating…", so the rest frame is the whole message. */
+.upd-pill__spin {
+  width: 10px; height: 10px;
+  border: 1.5px solid var(--rule);
+  border-top-color: var(--accent);
+  border-radius: 50%;
+  flex-shrink: 0;
+  animation: upd-turn 0.9s linear infinite;
 }
-/* The banner on /deploy itself: it still announces the release, but points at the
-   control instead of linking to the page the reader is already on (task 1004145). */
-.core-update-notice__hint {
-  margin-left: auto;
-  color: var(--ink-soft);
+@keyframes upd-turn { to { transform: rotate(360deg); } }
+
+.upd-card {
+  position: fixed;
+  top: 64px;
+  right: 16px;
+  z-index: calc(var(--z-sidebar) + 5);
+  width: min(360px, calc(100vw - 32px));
+  max-height: calc(100vh - 96px);
+  overflow-y: auto;
+  padding: 16px 18px 18px;
+  border: 1px solid var(--rule-soft);
+  border-radius: var(--radius);
+  background: var(--bg-card);
+  color: var(--ink);
+  box-shadow: var(--shadow-pop);
+  font-size: 13px;
+  line-height: 1.5;
 }
-.core-update-notice__close {
-  min-width: 24px;
-  min-height: 24px;
+.upd-card[hidden] { display: none; }
+.upd-card p { margin: 0 0 8px; }
+.upd-card__h { margin: 0 32px 8px 0; font-size: 15px; font-weight: 600; line-height: 1.3; }
+.upd-card__close {
+  position: absolute;
+  top: 10px; right: 10px;
+  width: 28px; height: 28px;
   border: 0;
+  border-radius: var(--radius-pill);
   background: none;
-  color: inherit;
-  font-size: 16px;
+  color: var(--ink-soft);
+  font-size: 18px;
   line-height: 1;
   cursor: pointer;
 }
-/* With no action link the close button still sits hard right. */
-.core-update-notice__action + .core-update-notice__close { margin-left: 0; }
-.core-update-notice > span + .core-update-notice__close { margin-left: auto; }
-/* "Upgraded to core X on <date>" and what changed (task 1004731): the same strip, with the
-   release-note lines under the sentence in the body ink; it wraps on a phone. */
-.core-move-notice { flex-wrap: wrap; }
-.core-move-notice__body { flex: 1 1 20rem; min-width: 0; }
-.core-move-notice__list {
-  margin: 4px 0 0;
-  padding-left: 1.15rem;
-  max-width: var(--measure, 68ch);
-  color: var(--ink-soft);
+.upd-card__close:hover { background: var(--glass-strong); color: var(--ink); }
+.upd-card__list { margin: 0 0 10px; padding-left: 1.1rem; color: var(--ink-soft); }
+.upd-card__list li + li { margin-top: 4px; }
+.upd-card__note { color: var(--ink-soft); }
+.upd-card__ver { color: var(--ink-faint); font-size: 12px; }
+.upd-card__err { color: var(--danger); }
+.upd-ver { font-family: var(--font-mono); font-size: 12px; }
+.upd-card__actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 12px; }
+.upd-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 36px;
+  padding: 0 14px;
+  border: 1px solid var(--glass-edge);
+  border-radius: var(--radius-pill);
+  background: transparent;
+  color: var(--ink);
+  font: inherit;
+  font-size: 13px;
+  text-decoration: none;
+  cursor: pointer;
 }
-.core-move-notice__list li + li { margin-top: 2px; }
+.upd-btn:hover { background: var(--glass-strong); text-decoration: none; }
+.upd-btn:focus-visible, .upd-card__close:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.upd-btn--go { background: var(--accent); border-color: var(--accent); color: var(--accent-on); font-weight: 500; }
+.upd-btn--go:hover { background: var(--accent-lift); border-color: var(--accent-lift); }
+.upd-btn:disabled { opacity: 1; color: var(--ink-faint); background: var(--glass); border-color: var(--glass-edge); cursor: default; }
+/* An indeterminate bar: how long an upgrade takes is not known here, so it never fills. */
+.upd-track { position: relative; height: 4px; margin: 4px 0 10px; border-radius: 2px; background: var(--glass-strong); overflow: hidden; }
+.upd-track span {
+  position: absolute; top: 0; bottom: 0; left: 0;
+  width: 40%;
+  border-radius: 2px;
+  background: var(--accent);
+  animation: upd-slide 1.6s ease-in-out infinite;
+}
+@keyframes upd-slide { 0% { transform: translateX(-100%); } 100% { transform: translateX(250%); } }
+/* The one-time note sits under the top bar's right end too, on every page that loads it. */
+.upd-card--note { top: 64px; }
+@media (max-width: 640px) {
+  .upd-card { right: 16px; left: 16px; width: auto; }
+}
+/* The hub's handoff window (deploy-handoff.js): a small popup with nothing in it but the card.
+   The shell still runs (it signs the viewer in), so its chrome is hidden, not removed. */
+html[data-handoff="on"] .app-sidebar,
+html[data-handoff="on"] .app-topbar,
+html[data-handoff="on"] .app-foot,
+html[data-handoff="on"] .upd-pill,
+html[data-handoff="on"] .core-move-notice { display: none; }
+html[data-handoff="on"] .app-content { padding: 0; }
+.upd-card--handoff { position: static; width: auto; max-width: 420px; max-height: none; margin: 24px auto; box-shadow: none; }
 .topbar-menu {
   display: none;
   align-items: center;
@@ -4317,7 +4397,8 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .empty-state__action { display: inline-block; margin-top: 6px; font-size: 13px; }
 
 /* skeleton shimmer — standard-height placeholder rows while data loads, so
-   cards don't jump; derives from the ink/bg tokens like everything else */
+   cards don't jump; derives from the ink/bg tokens like everything else. It
+   breathes in the loader's beat (task 1005043; the keyframes sit with it). */
 .kit-skel {
   display: inline-block;
   width: 60%;
@@ -4325,9 +4406,97 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   height: 12px;
   border-radius: 2px;
   background: var(--skeleton);
+  animation: hall-loading-breathe .8s ease-in-out infinite alternate-reverse;
 }
 .kit-skel-row td { border-bottom: 1px solid var(--rule-soft); }
 
+/* ---- the loader (task 1005043) ----------------------------------------------
+   One loader for everything a hall page waits on, drawn from the Bongos mark
+   (shell.js's brand-mark SVG: the ring, the core and the accent dot). A page
+   opts in by giving its existing placeholder the class; its own words stay as
+   the caption, so no page gains markup. The ring and the dot turn together round
+   the still core and the ink breathes, after the Vibe skeleton the owner pointed
+   at (vibe.monday.com: 0.4 to 1 and back, 0.8s). Three sizes: the default for a
+   panel, --page for a page's main area, --inline for a line in a list or card.
+
+   DESIGN.md holds it: CSS only, transform and filter only (the breath and the
+   arrival are filter: opacity(), not opacity), every colour a var() or a mix of
+   one; the black in the two masks is alpha, not paint. The 20s floor is for the
+   ambient plates: a loader is the live thing on the page, so it keeps a loader's
+   tempo and the dot spends the accent. Each turn eases out of and back into the
+   logo's own pose, so the mark lands on the logo once per beat. It arrives after
+   240ms, so a read that answers faster never shows it. Under the Kill Switch
+   nothing moves and the rest frame is the logo itself. ---- */
+.hall-loading {
+  --hl-size: 40px;
+  --hl-pad: 28px;
+  --hl-beat: 1.6s;
+  position: relative;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 12px;
+  margin: 0;
+  padding: var(--hl-pad) 0;
+  font-size: 13.5px;
+  color: var(--ink-faint);
+  text-align: center;
+  animation: hall-loading-arrive 500ms cubic-bezier(.16, 1, .3, 1) 240ms both;
+}
+.hall-loading::before,
+.hall-loading::after {
+  content: "";
+  display: block;
+  flex: none;
+  width: var(--hl-size);
+  height: var(--hl-size);
+  -webkit-mask: var(--hl-shape) center / contain no-repeat;
+  mask: var(--hl-shape) center / contain no-repeat;
+  animation: hall-loading-turn var(--hl-beat) cubic-bezier(.45, .05, .55, .95) infinite;
+}
+/* the ring and the core: one ink, breathing */
+.hall-loading::before {
+  --hl-shape: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'%3E%3Cpath d='M137 31 A78 78 0 1 0 170 66' fill='none' stroke='black' stroke-width='15' stroke-linecap='round'/%3E%3Ccircle cx='100' cy='100' r='55'/%3E%3C/svg%3E");
+  background: color-mix(in srgb, var(--ink) 30%, var(--bg-card));
+  animation:
+    hall-loading-turn var(--hl-beat) cubic-bezier(.45, .05, .55, .95) infinite,
+    hall-loading-breathe calc(var(--hl-beat) / 2) ease-in-out infinite alternate-reverse;
+}
+/* the dot: the accent, laid exactly over the mark and turning with it */
+.hall-loading::after {
+  --hl-shape: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'%3E%3Ccircle cx='156' cy='46' r='12'/%3E%3C/svg%3E");
+  position: absolute;
+  top: var(--hl-pad);
+  left: calc(50% - var(--hl-size) / 2);
+  background: var(--accent);
+}
+.hall-loading--page { --hl-size: 64px; --hl-pad: 72px; gap: 16px; }
+.hall-loading--inline {
+  --hl-size: 16px;
+  --hl-pad: 0px;
+  display: inline-flex;
+  flex-direction: row;
+  gap: 8px;
+  text-align: left;
+}
+.hall-loading--inline::after { top: calc(50% - var(--hl-size) / 2); left: 0; }
+/* --wait: a page whose every section stays [hidden] until it knows who is
+   reading (the sealed/body pairs) puts one loader FIRST in its <main>. It shows
+   only while nothing after it is showing, and steps aside the moment the page
+   reveals anything (the body, the sealed notice, an error), so no page script
+   has to remember to hide it. Without :has() it never shows: today's page. */
+/* --zones: the same, for a view made of always-present, empty zones that cards
+   mount into (Home, Watch's panes): it shows while no showing zone after it
+   holds a showing child. */
+.hall-loading--wait, .hall-loading--zones { display: none; }
+@supports selector(:has(a)) {
+  .hall-loading--wait:not(:has(~ :not([hidden], script, template, style))) { display: flex; }
+  .hall-loading--zones:not(:has(~ :not([hidden]) > :not([hidden], script, template, style))) { display: flex; }
+}
+@keyframes hall-loading-arrive { from { filter: opacity(0); transform: translateY(6px); } }
+@keyframes hall-loading-turn { to { transform: rotate(1turn); } }
+@keyframes hall-loading-breathe { from { filter: opacity(.45); } }
+
 /* collapsible card body — the Work-backlog <details> idiom, generalized */
 .kit-collapse__summary {
   cursor: pointer;

package/modules/hall-ui/public/task-detail.js

@@ -413,7 +413,7 @@
     }
 
     async function renderPromote() {
-      box.innerHTML = '<p class="deeplink-card__note">Loading versions…</p>';
+      box.innerHTML = '<p class="hall-loading hall-loading--inline" role="status">Loading versions…</p>';
       // Both dead ends offer the way back through the same delegated [data-go]
       // handler the forms use — a builder must never be stranded mid-panel.
       function bail(message) {
@@ -658,7 +658,7 @@
   function bodyFor(state) {
     var nodes = [];
     var label = '#' + state.id;
-    if (state.loading) { nodes.push(h('p', 'deeplink-card__title', 'Loading ' + label + '…')); return nodes; }
+    if (state.loading) { nodes.push(h('p', 'hall-loading', 'Loading ' + label + '…')); return nodes; }
     if (state.needsAuth) {
       nodes.push(h('p', 'deeplink-card__title', label));
       nodes.push(h('p', 'deeplink-card__note', 'Sign in to the Builders’ Hall to view this record.'));

package/modules/hall-ui/public/task.html

@@ -59,7 +59,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N deep-link overlay