@bongos/core 1.24.26 → 1.24.28

package/docs/recipes/ui-look-before-you-ship.md

@@ -21,6 +21,7 @@ SURFACE=hall-ui PREFIX=/builders/ node modules/ui-design/kit/serve.js
 CHILD=1 node modules/ui-design/kit/serve.js                  # the child-instance shape (apex-only regions stripped)
 LIVE=1 node modules/ui-design/kit/serve.js                   # public feeds proxied to the pack's public origin
 FAIL=featured,progress node modules/ui-design/kit/serve.js   # those feeds answer 500
+LATENCY=4000 node modules/ui-design/kit/serve.js             # every /api/ read held 4s, to look at a page's waiting state (the loader; task 1005053)
 STYLE=grove node modules/ui-design/kit/serve.js              # under a look from the style library (modules/ui-design/styles/; task 1003323)
 ```
 

package/modules/autonomy/fence.js

@@ -48,6 +48,7 @@ const REFUSALS = {
   no_allowlist: 'no goal is allowlisted, so there is nothing this runner may work on',
   goal_not_allowlisted: 'that goal is not on the allowlist',
   protected_path: 'the task declares work on a permission, migration, infrastructure or deploy-pipeline surface',
+  self_modification: "the task declares work on the runner's own supervisor, safety checks or kill switch",
   needs_host_access: 'the work needs shell access to a live host (SSH, root, systemd) that the runner machine does not have',
   grader_unavailable: 'the grader is bypassed, and it is the only review between an unattended worker and main',
   not_permitted: 'your rank does not hold autonomy.run, so your runner may not work on this project',
@@ -332,7 +333,13 @@ function needsHostAccess(task) {
 // in core and a module reaches core only through the doorway. Passing the hits in
 // also means the caller decides WHAT to match, which is what lets a future caller
 // run the same decision over a real diff instead of a declaration.
-function decideTask({ task, goals = [], protectedHits = [] } = {}) {
+//
+// `selfHits` is the same idea for the runner's OWN files (task 1004546): the output
+// of modules/lifecycle/runner-self.js matchRunnerSelf over the same touches[]. The
+// owner's rule is that the runner never edits its own supervisor, safety checks or
+// kill switch, and none of those are on the ADR 0043 registry. Declared touches are
+// a claim, so the ship-time check and the server's publish check read the real diff.
+function decideTask({ task, goals = [], protectedHits = [], selfHits = [] } = {}) {
   if (!task || task.id === undefined || task.id === null) {
     return { go: false, code: 'fence_unreadable', reason: 'no task to decide about' };
   }
@@ -351,6 +358,14 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
       globs,
     };
   }
+  if (Array.isArray(selfHits) && selfHits.length) {
+    const files = [...new Set(selfHits.map((h) => h && h.file).filter(Boolean))];
+    return {
+      go: false, code: 'self_modification',
+      reason: `${REFUSALS.self_modification}${files.length ? ` (${files.join(', ')})` : ''}`,
+      files,
+    };
+  }
   const host = needsHostAccess(task);
   if (host.needs) {
     return {

package/modules/government/protected-surfaces.json

@@ -109,6 +109,8 @@
     { "glob": "modules/lifecycle/github-push.js", "group": "pipeline", "why": "BV1.R86: the server-mediated branch publish (ADR 0055)" },
     { "glob": "modules/lifecycle/conflict-resolve.js", "group": "pipeline", "why": "BV1.R86: self-heals generated-file conflicts at land time" },
     { "glob": "modules/lifecycle/publish-reconciler.js", "group": "pipeline", "why": "BV1.R86: lands confirmed merges" },
+    { "glob": "modules/lifecycle/runner-self.js", "group": "pipeline", "why": "task 1004546: the one list of files an Autobongos runner may never change, and the shape of a runner's claim" },
+    { "glob": "modules/lifecycle/runner-self-guard.js", "group": "pipeline", "why": "task 1004546: the server refuses to publish a runner's change to its own supervisor, safety checks or kill switch" },
     { "glob": "migrations/", "group": "schema", "why": "schema migrations are never newcomer work" },
     { "glob": "infra/", "group": "substrate", "why": "the deploy substrate" },
     { "glob": ".github/", "group": "substrate", "why": "CI workflows (deploy-prod.yml, grade gate, secrets-scan) are the pipeline" },

package/modules/hall-ui/public/ai-studio.html

@@ -89,7 +89,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw23"></script>
 <script src="/builders/studio-lib.js?v=2026-10-09-day"></script>

package/modules/hall-ui/public/atlas.html

@@ -92,7 +92,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -61,7 +61,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the branding pack's currency label, loaded BEFORE blockers.js. -->

package/modules/hall-ui/public/board-room.html

@@ -63,7 +63,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/city.html

@@ -108,7 +108,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch" defer></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip" defer></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill" defer></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1" defer></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3" defer></script>

package/modules/hall-ui/public/collab.html

@@ -162,7 +162,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>
 <script src="/builders/collab.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/commands.html

@@ -54,7 +54,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -180,7 +180,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/copy-desk.js?v=2026-09-01-redesign"></script>

package/modules/hall-ui/public/core-move-notice.js

@@ -32,19 +32,22 @@
     }
     var topbar = document.getElementById('app-topbar');
     if (!topbar) return;
+    // A small card in the top-right corner, the Update pill's own (task 1005041): the owner
+    // called the full-width strips "way too obstructing". It still sits after the top bar in
+    // the document, so a screen reader meets it where the strip was.
     var el = document.createElement('div');
-    el.className = 'core-update-notice core-move-notice';
+    el.className = 'upd-card upd-card--note core-move-notice';
     el.id = 'core-move-notice';
     el.setAttribute('role', 'status');
     var entries = Array.isArray(moved.entries) ? moved.entries : [];
     var list = entries.length
-      ? '<ul class="core-move-notice__list">' + entries.map(function (e) { return '<li>' + esc(e && e.text) + '</li>'; }).join('') +
+      ? '<ul class="upd-card__list core-move-notice__list">' + entries.map(function (e) { return '<li>' + esc(e && e.text) + '</li>'; }).join('') +
         (moved.more > 0 ? '<li>…and ' + esc(String(moved.more)) + ' more.</li>' : '') + '</ul>'
       : '';
-    el.innerHTML = '<div class="core-move-notice__body"><span>' + esc(moved.message) +
-      (entries.length ? ' What changed:' : '') + '</span>' + list + '</div>' +
-      '<a class="core-update-notice__action core-move-notice__more" href="' + esc((opts && opts.href) || '/settings#software-update') + '">Update history</a>' +
-      '<button type="button" class="core-update-notice__close core-move-notice__close" aria-label="Dismiss">×</button>';
+    el.innerHTML = '<button type="button" class="upd-card__close core-move-notice__close" aria-label="Dismiss">×</button>' +
+      '<h2 class="upd-card__h">Bongos is updated</h2>' +
+      '<p>' + esc(moved.message) + (entries.length ? ' What changed:' : '') + '</p>' + list +
+      '<div class="upd-card__actions"><a class="upd-btn core-move-notice__more" href="' + esc((opts && opts.href) || '/settings#software-update') + '">Update history</a></div>';
     function markSeen() {
       try {
         if (window.localStorage) window.localStorage.setItem(SEEN_KEY, String(moved.id));

package/modules/hall-ui/public/deploy-handoff.js

@@ -0,0 +1,203 @@
+// deploy-handoff.js — the hub's half of the in-place update (task 1005041).
+//
+// A hosted project's owner presses Update now in their own hall (update-pill.js). The act
+// has to happen HERE, on the hub, with the owner's hub session: the project's own server
+// may never move its own pin (ADR 0293 D1, ADR 0339 D3). So the hall opens this page in a
+// small window as /deploy?project=<slug>&handoff=1, and the two windows say four things:
+//   hub  → hall  { tag, step: 'ready' }              "I am loaded; which version?"
+//   hall → hub   { tag, step: 'go', to }             the version the owner was shown
+//   hub  → hall  { tag, step: 'started', to }        the move is queued; the window closes
+//   hub  → hall  { tag, step: 'refused', message }   the server's own sentence
+//
+// WHAT IS CHECKED BEFORE ANYTHING MOVES (judgeGo). The message must come from the window
+// that opened this one, from that project's own registered address (provisioning's
+// `domain`, which is where its hall is served), and name exactly the version this hub's
+// own preview would move it to. Anything else moves nothing: a page that opens this
+// window from elsewhere is talking to a window that will not listen, and a version this
+// hub would not offer is shown to the owner instead of sent. The move itself is the same
+// POST the deploy door makes, gated server-side exactly as before (owner or core.pin.move).
+//
+// ONE PRESS, NEVER ZERO, WHEN IT CANNOT HEAR. If no word comes from the hall (a browser
+// that cuts the tie between the two windows, or this page opened by hand), it shows one
+// button naming the version, the door's own confirm. It never moves on load by itself.
+//
+// Loaded by deploy.html; deploy.js hands over to run() when ?handoff=1 is present.
+// Node-require-safe, so the tests run judgeGo and projectOrigin without a page.
+(function (root) {
+  'use strict';
+
+  var MSG = 'bongos-update'; // update-pill.js's tag
+  var VERSION_RE = /^\d+\.\d+\.\d+$/;
+  var HOST_RE = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?::\d{1,5})?$/;
+  var API = '/api/bongos';
+  // How long the window waits for the hall to say which version, before it offers the press.
+  var HEAR_MS = typeof root !== 'undefined' && root && typeof root.__handoffHearMs === 'number' ? root.__handoffHearMs : 5000;
+
+  /** Is this page the handoff window? Read defensively, as deploy.js reads its scope. */
+  function wanted(loc) {
+    try { return /[?&]handoff=1(?:&|$)/.test(String((loc && loc.search) || '')); } catch (e) { return false; }
+  }
+
+  /** The one origin allowed to ask for this project's move: its registered address, on the
+   *  scheme this hub is served on (https in production; http only on a local harness). */
+  function projectOrigin(inst, protocol) {
+    var host = inst && typeof inst.domain === 'string' ? inst.domain.trim().toLowerCase() : '';
+    if (!host || !HOST_RE.test(host)) return null;
+    return (protocol === 'http:' ? 'http://' : 'https://') + host;
+  }
+
+  /** Why a message may NOT start the move, or null when it may. Each refusal names itself. */
+  function judgeGo(o) {
+    var data = o && o.data;
+    if (!data || data.tag !== MSG || data.step !== 'go') return 'not_go';
+    if (!o.opener || o.source !== o.opener) return 'not_opener';
+    if (!o.allowed || o.origin !== o.allowed) return 'wrong_origin';
+    var p = o.preview;
+    if (!p || p.reading !== 'ok' || !p.behind || !VERSION_RE.test(String(p.recommended_version || ''))) return 'nothing_to_move';
+    if (p.viewer_may_move === false) return 'not_allowed';
+    if (typeof data.to !== 'string' || data.to !== p.recommended_version) return 'wrong_version';
+    if (p.open_intent) return 'busy';
+    return null;
+  }
+
+  // ---------- the page ----------
+
+  function esc(s) { return root.OTB.escapeHtml(String(s == null ? '' : s)); }
+
+  function run(opts) {
+    var d = root.document;
+    var api = opts.api;
+    var main = d.getElementById('hall-main');
+    if (!main) return;
+    d.documentElement.setAttribute('data-handoff', 'on');
+    main.innerHTML = '<section class="upd-card upd-card--handoff" aria-labelledby="ho-h"><div id="ho-body"><p class="upd-card__note" role="status">Opening this project\'s update…</p></div></section>';
+    var body = d.getElementById('ho-body');
+    var slug = scopeSlug(root.location);
+    var opener = null;
+    try { opener = root.opener || null; } catch (e) { opener = null; }
+    var inst = null;
+    var preview = null;
+    var allowed = null;
+    var heard = false;
+    var moving = false;
+
+    function draw(html) { body.innerHTML = html; }
+    function title(t) { return '<h1 class="upd-card__h" id="ho-h">' + esc(t) + '</h1>'; }
+    function tell(msg) {
+      if (!opener || !allowed) return;
+      try { opener.postMessage(Object.assign({ tag: MSG }, msg), allowed); } catch (e) { /* the hall watches its own version anyway */ }
+    }
+    function refuse(message) {
+      tell({ step: 'refused', message: message });
+      draw(title('The update did not start') + '<p class="upd-card__err" role="alert">' + esc(message) + '</p>' +
+        '<div class="upd-card__actions"><button type="button" class="upd-btn" id="ho-close">Close</button></div>');
+      wireClose();
+    }
+    function wireClose() {
+      var c = d.getElementById('ho-close');
+      if (c) c.addEventListener('click', function () { root.close(); });
+    }
+
+    // The one press, naming the version THIS hub would move to: the door's own confirm.
+    function offerPress(note) {
+      if (moving) return;
+      var to = preview.recommended_version;
+      draw(title('Update ' + (slug || 'this project')) +
+        (note ? '<p class="upd-card__note">' + esc(note) + '</p>' : '') +
+        '<p>Moves it to version <span class="upd-ver">' + esc(to) + '</span>. It restarts once, and goes back to the version it runs now on its own if the new one is not healthy.</p>' +
+        '<div class="upd-card__actions"><button type="button" class="upd-btn upd-btn--go" id="ho-go">Update to ' + esc(to) + '</button>' +
+        '<button type="button" class="upd-btn" id="ho-close">Cancel</button></div>');
+      d.getElementById('ho-go').addEventListener('click', function () { move(to); });
+      wireClose();
+    }
+
+    function move(to) {
+      if (moving) return;
+      moving = true;
+      draw(title('Starting the update') + '<p class="upd-card__note" role="status">Asking the server to move ' + esc(slug) + ' to ' + esc(to) + '…</p>');
+      api.request('POST', API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/core-upgrade', { body: { to: to } }).then(function (res) {
+        if (res && res.status === 401) { signIn(); return; }
+        if (!res || !res.ok) {
+          moving = false;
+          var err = (res && res.data && res.data.error) || {};
+          refuse(err.message && err.message !== err.code ? err.message : 'The server refused the update (' + (res ? res.status : 'no answer') + ').');
+          return;
+        }
+        tell({ step: 'started', to: to });
+        draw(title('The update has started') +
+          '<p role="status">You can close this window. ' + (opener ? 'Your project\'s hall shows how it is going.' : 'Open your project\'s hall to see how it is going.') + '</p>' +
+          '<div class="upd-card__actions"><button type="button" class="upd-btn" id="ho-close">Close</button></div>');
+        wireClose();
+        if (opener) root.setTimeout(function () { root.close(); }, 1200);
+      }, function () { moving = false; refuse('The server did not answer. Nothing was changed.'); });
+    }
+
+    function onMessage(e) {
+      if (!e || !e.data || e.data.tag !== MSG) return;
+      var why = judgeGo({ data: e.data, source: e.source, opener: opener, origin: e.origin, allowed: allowed, preview: preview });
+      if (why === 'not_go' || why === 'not_opener' || why === 'wrong_origin') return; // not ours to answer
+      heard = true;
+      if (!why) { move(e.data.to); return; }
+      if (why === 'wrong_version') { offerPress('A different version is ready than the one your hall showed. Check it before updating.'); return; }
+      if (why === 'busy') { refuse('Another change is already running for this project. Try again once it settles.'); return; }
+      if (why === 'not_allowed') { refuse('Only the project\'s owner can update it.'); return; }
+      refuse('This project already runs the newest version it can take.');
+    }
+
+    function signIn() {
+      var back = String(root.location.pathname || '/deploy') + String(root.location.search || '');
+      root.location.assign(API + '/auth/web/start?return=' + encodeURIComponent(back));
+    }
+
+    function read(path) {
+      return api.request('GET', API + path).then(function (res) {
+        if (res && res.status === 401) { signIn(); throw { kind: '401' }; }
+        if (!res || !res.ok) {
+          var err = (res && res.data && res.data.error) || {};
+          var e = new Error(err.message && err.message !== err.code ? err.message : (err.code || path + ' → ' + (res && res.status)));
+          e.status = res && res.status;
+          throw e;
+        }
+        return res.data;
+      });
+    }
+
+    // The project by name: the whole roster where the viewer may read it, else their own
+    // projects (deploy.js findBySlug's order). A lookup, never a listing.
+    read('/provisioning/fleet').then(function (d) { return d.instances || []; }, function (e) {
+      if (e && e.status === 403) return read('/provisioning/instances').then(function (d) { return d.instances || []; });
+      throw e;
+    }).then(function (rows) {
+      for (var i = 0; i < rows.length; i++) if (rows[i] && String(rows[i].slug) === slug) inst = rows[i];
+      if (!inst) throw new Error('No project called ' + slug + ' is hosted here under your account.');
+      allowed = projectOrigin(inst, root.location.protocol);
+      return read('/provisioning/instances/' + encodeURIComponent(inst.id) + '/core-upgrade');
+    }).then(function (d) {
+      preview = d.preview || null;
+      if (!preview || preview.reading !== 'ok' || !preview.behind) {
+        refuse(preview && preview.reading === 'ok' ? 'This project already runs the newest version it can take.' : 'This project\'s version could not be read just now. Nothing was changed.');
+        return;
+      }
+      if (preview.open_intent) { refuse('Another change is already running for this project. Try again once it settles.'); return; }
+      if (!opener || !allowed) { offerPress(); return; }
+      root.addEventListener('message', onMessage);
+      tell({ step: 'ready' });
+      draw(title('Updating ' + slug) + '<p class="upd-card__note" role="status">Waiting for your hall…</p>');
+      root.setTimeout(function () { if (!heard && !moving) offerPress(); }, HEAR_MS);
+    }).then(null, function (e) {
+      if (e && e.kind === '401') return;
+      refuse(String((e && e.message) || 'This project\'s update could not be opened.'));
+    });
+  }
+
+  function scopeSlug(loc) {
+    try {
+      var m = /[?&]project=([^&#]+)/.exec(String((loc && loc.search) || ''));
+      return m ? decodeURIComponent(m[1]) : null;
+    } catch (e) { return null; }
+  }
+
+  var api = { wanted: wanted, run: run, judgeGo: judgeGo, projectOrigin: projectOrigin, MSG: MSG };
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.OTBDeployHandoff = api;
+})(typeof window !== 'undefined' ? window : null);

package/modules/hall-ui/public/deploy.html

@@ -81,11 +81,13 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- the shared ask card the move is drawn with (task 1004829) -->
 <script src="/builders/hall-ask.js"></script>
-<script src="/builders/deploy.js?v=2026-09-23-changelist1"></script>
+<!-- the in-place update window a hosted project's hall opens (task 1005041) -->
+<script src="/builders/deploy-handoff.js?v=2026-11-03-handoff"></script>
+<script src="/builders/deploy.js?v=2026-11-03-handoff"></script>
 </body>
 </html>

package/modules/hall-ui/public/deploy.js

@@ -906,5 +906,11 @@
     }
   }
 
-  document.addEventListener('DOMContentLoaded', () => { load(); loadModuleSections(); });
+  document.addEventListener('DOMContentLoaded', () => {
+    // task 1005041: the small window a hosted project's hall opens to update in place. It is
+    // this door, asked from the project's own site, and deploy-handoff.js draws it instead.
+    const handoff = window.OTBDeployHandoff;
+    if (handoff && handoff.wanted(window.location)) { handoff.run({ api }); return; }
+    load(); loadModuleSections();
+  });
 })();

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -97,7 +97,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -60,7 +60,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/fleet-costs.js"></script>

package/modules/hall-ui/public/gate.html

@@ -67,7 +67,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/goal-map.html

@@ -140,7 +140,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/goals.html

@@ -244,7 +244,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->

package/modules/hall-ui/public/government.html

@@ -157,7 +157,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/idea.html

@@ -53,7 +53,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref
      written inside an idea's own prose keeps resolving from this page. -->

package/modules/hall-ui/public/ideas.html

@@ -228,7 +228,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>

package/modules/hall-ui/public/index.html

@@ -121,7 +121,7 @@
 <script src="/builders/welcome-boot.js?v=2026-10-23-city1" defer></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch" defer></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip" defer></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/market-watch-item.html

@@ -74,7 +74,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/market-watch-lib.js"></script>

package/modules/hall-ui/public/market-watch-rules.html

@@ -43,7 +43,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/market-watch-settings.html

@@ -107,7 +107,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/market-watch-settings.js"></script>

package/modules/hall-ui/public/market-watch.html

@@ -102,7 +102,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/market-watch-lib.js"></script>

package/modules/hall-ui/public/modules.html

@@ -128,7 +128,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
+<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/brand-apply.js"></script>