@bongos/core 1.24.26 → 1.24.27

package/modules/hall-ui/public/project-settings.html

@@ -87,7 +87,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/ranks.html

@@ -74,7 +74,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/founding-mark.js?v=2026-09-30-founding"></script>

package/modules/hall-ui/public/roadmap.html

@@ -44,7 +44,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- The chart kit and the timeline's series builders (task 1003447). Both MUST

package/modules/hall-ui/public/roster.html

@@ -56,7 +56,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the branding pack's currency label, loaded BEFORE roster.js. -->

package/modules/hall-ui/public/sessions.html

@@ -114,7 +114,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>

package/modules/hall-ui/public/settings-software-update.js

@@ -7,11 +7,12 @@
 // update channel lets it take; what each version in between brings — and, for the people
 // the upgrade door lets through, an Update button.
 //
-// THE BUTTON LEADS TO THE DOOR; IT IS NOT THE DOOR. Taking an update is the deploy door's
-// two steps (see exactly what moves, then confirm that version) with its health check and
-// auto-rollback (ADR 0293), and on a hosted project that door is on the hub (ADR 0339 D3).
-// A second copy of that flow here would be a second place for its safety rules to drift, so
-// the server names where this project's door is (`door`) and the button goes there.
+// THE BUTTON RUNS THE PILL'S FLOW; IT IS NOT A SECOND DOOR. Taking an update is the deploy
+// door's act, with its health check and auto-rollback (ADR 0293), and on a hosted project that
+// door is on the hub (ADR 0339 D3). Since task 1005041 the button hands this panel's reading to
+// update-pill.js, which takes the update in place (this page names the version; the door moves
+// it), so there is one copy of that flow, not two. The server still names the door (`door`),
+// and the button's href is that door, for a page whose pill script did not load.
 //
 // THE PAGE KNOWS NOTHING (deploy.js's rule, kept). Every version here is the server's reading
 // with the time it was taken. "Up to date" is drawn only from an ok reading with nothing
@@ -125,11 +126,14 @@
     if (!sameOrigin && !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return '';
     let where = '';
     if (!sameOrigin) {
-      try { where = ` on ${new URL(url).host}`; } catch (e) { return ''; }
+      try { where = new URL(url).host; } catch (e) { return ''; }
     }
+    // IN PLACE (task 1005041): the button runs the Update pill's flow (update-pill.js) and the
+    // page stays put; the pill in the top bar shows the progress. The href stays the door's,
+    // so a page whose pill script did not load still reaches the update the old way.
     return `<div class="row-end su-door">
-      <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}${sameOrigin ? '' : ' ↗'}</a>
-      <span class="panel-hint">Opens this project's upgrade${escapeHtml(where)}: you see what would move, confirm it, and it installs, checks itself, and rolls back if the project does not come back healthy.</span>
+      <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}</a>
+      <span class="panel-hint">Takes a few minutes. The project restarts once, checks itself, and goes back to the version it runs now if it does not come back healthy.${where ? ` A small window from ${escapeHtml(where)} opens for a moment to start it.` : ''}</span>
     </div>${door.kind === 'hub' && ask.available ? askHtml(ask, offered, { lead: false }) : ''}`;
   }
 
@@ -236,6 +240,16 @@
     const askBtn = byId('su-ask');
     if (askBtn) askBtn.addEventListener('click', () => askForUpgrade(data, askBtn));
 
+    // The same press as the pill's Update now; only when it took the update in place is the
+    // link's own navigation stopped.
+    const updateBtn = byId('su-update');
+    if (updateBtn) {
+      updateBtn.addEventListener('click', (e) => {
+        const pill = window.OTBUpdatePill;
+        if (pill && pill.updateNow(data, { api })) e.preventDefault();
+      });
+    }
+
     const more = byId('su-more');
     if (more) {
       more.addEventListener('click', () => {

package/modules/hall-ui/public/settings.html

@@ -475,9 +475,9 @@
             <!-- SOFTWARE UPDATE — this project's version, the newest release its update
                  channel allows, and what the versions between them carry (task 1004296).
                  Like a phone's Software Update screen: every builder reads it; the Update
-                 button is drawn only for those the upgrade door lets through, and it LEADS
-                 to that door (the two-step confirm and auto-rollback of ADR 0293) — the
-                 act never happens on this page. Rendered by settings-software-update.js
+                 button is drawn only for those the upgrade door lets through, and it runs
+                 the Update pill's in-place flow (update-pill.js, task 1005041): the act is
+                 still the door's, with its auto-rollback (ADR 0293). Rendered by settings-software-update.js
                  from GET /api/bongos/software-update, read only when this group opens:
                  an update's notes come out of a package download. -->
             <section class="scroll" id="software-update-scroll" aria-labelledby="software-update-h" data-group="update" hidden>
@@ -514,7 +514,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared component kit (window.OTBKit) — section rail (task 2166). -->
@@ -540,7 +540,9 @@
      settings.js is against the 1500-line ratchet. -->
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
 <!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
-<script src="/builders/settings-software-update.js?v=2026-10-18-history"></script>
+<!-- the Update pill's flow, which the panel's Update button runs in place (task 1005041) -->
+<script src="/builders/update-pill.js?v=2026-11-03-pill"></script>
+<script src="/builders/settings-software-update.js?v=2026-11-03-pill"></script>
 <!-- task 1004501: Settings → Your Autobongos runner. Own file on the same precedent. -->
 <script src="/builders/settings-autobongos.js?v=2026-10-01-autobongos"></script>
 <!-- task 1003793: Settings → Module install reports. Own file on the same precedent. -->

package/modules/hall-ui/public/shell.js

@@ -751,8 +751,11 @@
     history.replaceState(null, '', window.location.pathname + rest + window.location.hash);
   }
 
-  // task 1004045 — the core-update banner. The owner's ask: "a popup banner at the
-  // top of every owners builders hall that a core update has been released".
+  // task 1004045 → task 1005041 — the Update pill. The owner's first ask was a banner at the top
+  // of every owner's hall when a core update is released; the second (2026-11-03) was that it
+  // was "way too obstructing and not obvious what to do", and should feel like the Claude
+  // app's "restart to update". So the news is a quiet pill in the top bar now, and the
+  // update is taken in place from it: update-pill.js owns all of it, this only asks.
   //
   // WHY THE SERVER IS ASKED RATHER THAN TOLD. The version this box runs is known
   // here, but what is PUBLISHED is not, and the fact lives behind an outbound
@@ -764,6 +767,11 @@
   // ASKED ONCE PER PAGE LOAD. applyAccess runs on every settle (the /me probe, a
   // page's own report), and re-firing a network call on each would be a request per
   // nav interaction for a fact with a six-hour life on the server.
+  //
+  // SAID FROM AN ANSWER, OR FROM AN UPDATE ALREADY UNDER WAY. The pill script loads only
+  // when the answer has something to say (behind, held, or just moved), or when this
+  // browser remembers an update it started: mid-restart the read itself may fail, and the
+  // pill must still follow the owner from page to page.
   var coreUpdateAsked = false;
   function maybeRenderCoreUpdate() {
     if (coreUpdateAsked) return;
@@ -771,10 +779,20 @@
     if (!perms || perms['core.pin.move'] !== true) return;
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
-      if (!res || res.status !== 200 || !res.data) return;
-      if (res.data.update) renderCoreUpdateBanner(res.data.update, res.data.held);
-      if (res.data.moved) renderCoreMoveNotice(res.data.moved); // task 1004731: loads core-move-notice.js, which draws it
-    }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
+      mountUpdatePill(res && res.status === 200 && res.data ? res.data : null);
+    }, function () { mountUpdatePill(null); });
+  }
+  function updateUnderWay() {
+    try { return !!(window.localStorage && window.localStorage.getItem('bongos.update.run')); } catch (e) { return false; }
+  }
+  function mountUpdatePill(data) {
+    var u = data && data.update;
+    var news = !!(u && u.reading === 'ok' && u.behind) || !!(data && data.held);
+    if (news || updateUnderWay()) {
+      var go = function () { if (window.OTBUpdatePill) window.OTBUpdatePill.mount(data, { api: api }); };
+      if (window.OTBUpdatePill) go(); else loadHallScript('update-pill.js', go);
+    }
+    if (data && data.moved) renderCoreMoveNotice(data.moved); // task 1004731: loads core-move-notice.js, which draws it
   }
   // One hall script on demand, stamped with the shell's own ?v= (task 1004996 made it one helper).
   function loadHallScript(file, onload, onerror) {
@@ -785,7 +803,7 @@
     head.appendChild(tag);
   }
   function renderCoreMoveNotice(moved) {
-    loadHallScript('core-move-notice.js', function () { if (window.CoreMoveNotice) window.CoreMoveNotice.render(moved, { api: api, href: SOFTWARE_UPDATE_HREF }); });
+    loadHallScript('core-move-notice.js', function () { if (window.CoreMoveNotice) window.CoreMoveNotice.render(moved, { api: api, href: '/settings#software-update' }); });
   }
   var githubChipAsked = false; // task 1004996: the Link GitHub chip (github-chip.js), asked once a page
   function loadGithubChip(builder) {
@@ -795,72 +813,6 @@
     loadHallScript('github-chip.js', function () { if (window.OTBGithubChip) window.OTBGithubChip.mount({ api: api, builder: builder, hub: hub }); });
   }
 
-  // Where the banner's Upgrade goes (task 1004296). The platform's hall runs the deploy
-  // door itself, so there it is /deploy. Every other hall — a hosted project, a
-  // self-hosted instance — takes its update from Settings → Software update, which says
-  // what the update carries and, on a hosted project, hands the owner to the hub's door
-  // for this project (ADR 0339 D3). The banner no longer links off-site itself.
-  var SOFTWARE_UPDATE_HREF = '/settings#software-update';
-
-  // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
-  // is current AND when the registry could not be read; `reading` separates them,
-  // and neither renders. A banner is a claim about being out of date, and a wrong
-  // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update, held) {
-    if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
-    // A dismissal is remembered PER VERSION, not forever: the next release is new
-    // news and must re-announce itself, or the surface is dead after one click.
-    // localStorage throws in a private window and is absent in the unit tests' bare
-    // vm context, so every touch is guarded and its loss only costs the memory.
-    try {
-      var seen = window.localStorage && window.localStorage.getItem('bongos.coreUpdate.dismissed');
-      if (seen && seen === update.latest) return;
-    } catch (e) { /* no storage: always show */ }
-    var topbar = document.getElementById('app-topbar');
-    if (!topbar) return;
-    var el = document.createElement('div');
-    el.className = 'core-update-notice';
-    el.id = 'core-update-notice';
-    el.setAttribute('role', 'status');
-    // The action goes where the update can actually be taken. The deploy door is the
-    // provisioning module's, and a hosted project does NOT run that module (probed:
-    // /api/bongos/provisioning/health is 404 on a tenant, 200 on the platform) — so on
-    // those it goes to Settings → Software update (SOFTWARE_UPDATE_HREF above).
-    // NOT A LINK TO THE PAGE YOU ARE ALREADY ON (task 1004145). This reads as the action
-    // button — it is labelled with the verb and styled like one — but it is a plain
-    // navigation to /deploy. On /deploy itself that is a no-op, and the owner who
-    // pressed it there reasonably reported "I clicked update, but I didn't see anything
-    // happen": nothing had, and nothing had been asked for. The control is on that page
-    // already, so on it the banner informs and points, and does not pretend to act.
-    // The same rule on Settings → Software update: that panel IS the control there.
-    var here = window.location ? String(window.location.pathname || '').replace(/\/+$/, '') : '';
-    var onDeploy = here === '/deploy';
-    var onUpdatePanel = here === '/settings' && String(window.location.hash || '') === '#software-update';
-    var action = moduleOn('provisioning')
-      ? (onDeploy
-        ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
-        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>')
-      : (onUpdatePanel
-        ? '<span class="core-update-notice__hint">Its details are below.</span>'
-        : '<a class="core-update-notice__action" href="' + SOFTWARE_UPDATE_HREF + '">Upgrade</a>');
-    // task 1004730: the newest version already failed here and was rolled back. Say so, never
-    // "available" with a button to take it again; Software update carries the full sentence.
-    var hold = held && held.version === update.latest ? held : null;
-    el.innerHTML = (hold
-      ? '<span>Core <strong>' + esc(hold.version) + '</strong> was tried on this project and rolled back. It is still on ' +
-        esc(hold.still_on) + ' and working.</span><a class="core-update-notice__action" href="' + SOFTWARE_UPDATE_HREF + '">Details</a>'
-      : '<span>Core <strong>' + esc(update.latest) + '</strong> is available — this project runs ' +
-        esc(update.running || 'an unknown version') + '.</span>' + action) +
-      '<button type="button" class="core-update-notice__close" aria-label="Dismiss">×</button>';
-    el.querySelector('.core-update-notice__close').addEventListener('click', function () {
-      try {
-        if (window.localStorage) window.localStorage.setItem('bongos.coreUpdate.dismissed', update.latest);
-      } catch (e) { /* dismissal is best-effort */ }
-      el.remove();
-    });
-    topbar.insertAdjacentElement('afterend', el);
-  }
-
   // task 1003303: the skip link, rendered once here rather than pasted into 27
   // heads. The hall had none, which is a platform floor (DESIGN.md
   // §Accessibility Floors) and, with the sidebar first in the DOM, meant a

package/modules/hall-ui/public/street.html

@@ -231,7 +231,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/studio.html

@@ -219,7 +219,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure
      (task 1003829), which the older reviews still show. -->

package/modules/hall-ui/public/style.css

@@ -1038,54 +1038,134 @@ html[data-theme="dark"] .gplate__light { display: none; }
   line-height: 1;
   cursor: pointer;
 }
-/* Core-update banner (task 1004045) — rendered by shell.js when this instance is
-   behind the newest published core. Deliberately the accent, not the warning
-   colour the denial notice uses: being a release behind is news, not a fault. */
-.core-update-notice {
-  display: flex;
-  align-items: baseline;
-  gap: 12px;
-  padding: 10px 22px;
-  font-size: 13px;
-  color: var(--accent);
-  background: var(--accent-weak, var(--warn-weak));
-  border-bottom: 1px solid var(--rule-soft);
+/* ---------- the Update pill and its card (task 1005041, update-pill.js) ----------
+   The owner: the full-width update banners were "way too obstructing"; it should feel
+   like the Claude app's "restart to update". So the news is a quiet pill in the top bar
+   (the Link GitHub chip's shape, one step louder: the accent dot), and everything else
+   lives in a small card under it. The same card carries the one-time "Bongos is updated"
+   note (core-move-notice.js), pinned to the same corner. */
+.upd-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  min-height: 28px;
+  min-width: 28px;
+  padding: 0 11px 0 9px;
+  border: 1px solid var(--rule);
+  border-radius: var(--radius-pill);
+  background: var(--bg-card);
+  color: var(--ink);
+  font: inherit;
+  font-size: 12px;
+  font-weight: 500;
+  line-height: 1;
+  white-space: nowrap;
+  flex-shrink: 0;
+  cursor: pointer;
 }
-.core-update-notice__action {
-  margin-left: auto;
-  font-weight: 600;
-  color: inherit;
+.upd-pill:hover { border-color: var(--ink-faint); }
+.upd-pill:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.upd-pill__dot { width: 7px; height: 7px; border-radius: 50%; background: var(--accent); flex-shrink: 0; }
+.upd-pill[data-face="held"] .upd-pill__dot { background: var(--ink-faint); }
+.upd-pill[data-face="done"] { background: var(--accent); border-color: var(--accent); color: var(--accent-on); }
+.upd-pill[data-face="done"] .upd-pill__dot { background: var(--accent-on); }
+.upd-pill[data-face="done"]:hover { background: var(--accent-lift); border-color: var(--accent-lift); }
+/* The running face turns a ring. The Kill Switch stops it, and the label still says
+   "Updating…", so the rest frame is the whole message. */
+.upd-pill__spin {
+  width: 10px; height: 10px;
+  border: 1.5px solid var(--rule);
+  border-top-color: var(--accent);
+  border-radius: 50%;
+  flex-shrink: 0;
+  animation: upd-turn 0.9s linear infinite;
 }
-/* The banner on /deploy itself: it still announces the release, but points at the
-   control instead of linking to the page the reader is already on (task 1004145). */
-.core-update-notice__hint {
-  margin-left: auto;
-  color: var(--ink-soft);
+@keyframes upd-turn { to { transform: rotate(360deg); } }
+
+.upd-card {
+  position: fixed;
+  top: 64px;
+  right: 16px;
+  z-index: calc(var(--z-sidebar) + 5);
+  width: min(360px, calc(100vw - 32px));
+  max-height: calc(100vh - 96px);
+  overflow-y: auto;
+  padding: 16px 18px 18px;
+  border: 1px solid var(--rule-soft);
+  border-radius: var(--radius);
+  background: var(--bg-card);
+  color: var(--ink);
+  box-shadow: var(--shadow-pop);
+  font-size: 13px;
+  line-height: 1.5;
 }
-.core-update-notice__close {
-  min-width: 24px;
-  min-height: 24px;
+.upd-card[hidden] { display: none; }
+.upd-card p { margin: 0 0 8px; }
+.upd-card__h { margin: 0 32px 8px 0; font-size: 15px; font-weight: 600; line-height: 1.3; }
+.upd-card__close {
+  position: absolute;
+  top: 10px; right: 10px;
+  width: 28px; height: 28px;
   border: 0;
+  border-radius: var(--radius-pill);
   background: none;
-  color: inherit;
-  font-size: 16px;
+  color: var(--ink-soft);
+  font-size: 18px;
   line-height: 1;
   cursor: pointer;
 }
-/* With no action link the close button still sits hard right. */
-.core-update-notice__action + .core-update-notice__close { margin-left: 0; }
-.core-update-notice > span + .core-update-notice__close { margin-left: auto; }
-/* "Upgraded to core X on <date>" and what changed (task 1004731): the same strip, with the
-   release-note lines under the sentence in the body ink; it wraps on a phone. */
-.core-move-notice { flex-wrap: wrap; }
-.core-move-notice__body { flex: 1 1 20rem; min-width: 0; }
-.core-move-notice__list {
-  margin: 4px 0 0;
-  padding-left: 1.15rem;
-  max-width: var(--measure, 68ch);
-  color: var(--ink-soft);
+.upd-card__close:hover { background: var(--glass-strong); color: var(--ink); }
+.upd-card__list { margin: 0 0 10px; padding-left: 1.1rem; color: var(--ink-soft); }
+.upd-card__list li + li { margin-top: 4px; }
+.upd-card__note { color: var(--ink-soft); }
+.upd-card__ver { color: var(--ink-faint); font-size: 12px; }
+.upd-card__err { color: var(--danger); }
+.upd-ver { font-family: var(--font-mono); font-size: 12px; }
+.upd-card__actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 12px; }
+.upd-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 36px;
+  padding: 0 14px;
+  border: 1px solid var(--glass-edge);
+  border-radius: var(--radius-pill);
+  background: transparent;
+  color: var(--ink);
+  font: inherit;
+  font-size: 13px;
+  text-decoration: none;
+  cursor: pointer;
 }
-.core-move-notice__list li + li { margin-top: 2px; }
+.upd-btn:hover { background: var(--glass-strong); text-decoration: none; }
+.upd-btn:focus-visible, .upd-card__close:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.upd-btn--go { background: var(--accent); border-color: var(--accent); color: var(--accent-on); font-weight: 500; }
+.upd-btn--go:hover { background: var(--accent-lift); border-color: var(--accent-lift); }
+.upd-btn:disabled { opacity: 1; color: var(--ink-faint); background: var(--glass); border-color: var(--glass-edge); cursor: default; }
+/* An indeterminate bar: how long an upgrade takes is not known here, so it never fills. */
+.upd-track { position: relative; height: 4px; margin: 4px 0 10px; border-radius: 2px; background: var(--glass-strong); overflow: hidden; }
+.upd-track span {
+  position: absolute; top: 0; bottom: 0; left: 0;
+  width: 40%;
+  border-radius: 2px;
+  background: var(--accent);
+  animation: upd-slide 1.6s ease-in-out infinite;
+}
+@keyframes upd-slide { 0% { transform: translateX(-100%); } 100% { transform: translateX(250%); } }
+/* The one-time note sits under the top bar's right end too, on every page that loads it. */
+.upd-card--note { top: 64px; }
+@media (max-width: 640px) {
+  .upd-card { right: 16px; left: 16px; width: auto; }
+}
+/* The hub's handoff window (deploy-handoff.js): a small popup with nothing in it but the card.
+   The shell still runs (it signs the viewer in), so its chrome is hidden, not removed. */
+html[data-handoff="on"] .app-sidebar,
+html[data-handoff="on"] .app-topbar,
+html[data-handoff="on"] .app-foot,
+html[data-handoff="on"] .upd-pill,
+html[data-handoff="on"] .core-move-notice { display: none; }
+html[data-handoff="on"] .app-content { padding: 0; }
+.upd-card--handoff { position: static; width: auto; max-width: 420px; max-height: none; margin: 24px auto; box-shadow: none; }
 .topbar-menu {
   display: none;
   align-items: center;

package/modules/hall-ui/public/task.html

@@ -59,7 +59,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N deep-link overlay

package/modules/hall-ui/public/thinking.html

@@ -141,7 +141,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -145,7 +145,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>
 <script src="/builders/tweak-editor-lib.js?v=2026-09-29-tw27"></script>