@bongos/core 1.24.45 → 1.24.46

package/migrations/core_295_runner_logins.sql

@@ -0,0 +1,50 @@
+-- core_295_runner_logins.sql — an Autobongos runner signs in with its OWN login, and the
+-- server marks every claim that login makes as autonomous (task 1004547, goal 1000139).
+--
+-- WHY. A runner used to run under its builder's own CLI session, so the server could
+-- tell a runner's claim from a person's only by the worktree name the runner chose
+-- (runner-self.js RUNNER_TREE_RE). A worker that claimed under another name was
+-- treated as a person, and the runner-only walls (the self-modification refusal at
+-- publish) did not apply. Worse, the worker carried the installer's full authority,
+-- so it could move a live core pin (task 1004974).
+--
+-- Three additive changes, all in core because every table here is core's:
+--   1. builder_sessions.source admits 'runner': a session minted by exchanging a
+--      one-time code from Settings (src/bongos/runner-login.js). The session-scope
+--      registry declares it; auth.js drops system permissions for it.
+--   2. runner_enrollment_codes: the one-time codes. The plaintext is never stored
+--      (sha256, like builder_sessions.token_hash); a code works once and expires.
+--   3. claims.autonomous: set by the SERVER from the claiming session's source,
+--      never from the request body, so a worker cannot claim its way out of it.
+--      Default false, so every existing claim reads exactly as before.
+
+BEGIN;
+
+-- 1. The session source. Rebuilt by name, as core_258 did when it dropped 'box'.
+ALTER TABLE builder_sessions
+  DROP CONSTRAINT IF EXISTS builder_sessions_source_check;
+ALTER TABLE builder_sessions
+  ADD CONSTRAINT builder_sessions_source_check CHECK (source IN ('cli', 'web', 'runner'));
+
+-- 2. One-time codes. `label` is the PC's name as the builder typed it in Settings.
+CREATE TABLE IF NOT EXISTS runner_enrollment_codes (
+  id              bigserial PRIMARY KEY,
+  builder_id      bigint NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  code_hash       text NOT NULL UNIQUE,
+  label           text,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  expires_at      timestamptz NOT NULL,
+  used_at         timestamptz,
+  used_session_id bigint REFERENCES builder_sessions(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS runner_enrollment_codes_builder
+  ON runner_enrollment_codes (builder_id, created_at DESC);
+
+-- 3. The autonomous mark on a claim.
+ALTER TABLE claims
+  ADD COLUMN IF NOT EXISTS autonomous boolean NOT NULL DEFAULT false;
+
+INSERT INTO schema_migrations (version) VALUES ('core_295_runner_logins')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;

package/modules/government/session-scopes.json

@@ -19,6 +19,11 @@
       "label": "web session",
       "note": "Hall browser cookie — same authority as the CLI session."
     },
+    {
+      "source": "runner",
+      "label": "Autobongos runner",
+      "note": "An Autobongos PC's own login, minted from a one-time code issued in Settings (src/bongos/runner-login.js, task 1004547). It acts for its builder, with two server-side limits the kernel applies, not this registry: its rank is capped at Metic and it holds no system permission (src/bongos/auth.js). Every claim it makes is marked autonomous."
+    },
     {
       "source": null,
       "label": "legacy session",

package/modules/hall-ui/public/ai-studio.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The studio's AI pages (task 1004921, goal 1000136), built 1:1 on option C of the AI Studio options canvas plus the owner's addition (change the request on the result and make it again). Against the kit's own stub the page renders its could-not-read states (no ai-studio feeds). TO SEE IT POPULATED, point the kit at the hall-preview harness with the module on: `node scripts/hall-preview/server.js --port 4637 --fixture-me --modules-on ai-studio` then `render.js --base-in http://builders.localhost:4637 --base-out http://builders.localhost:4637`. The harness answers keys, balance, the top-up quote and the request list from the ai-studio__*.json fixtures; a request by id (1002 running, 1003 failed, 1004 own Gemini key, any other the finished result on the balance); an upload, a request and a top-up from its CANNED WRITES; and every file as a stand-in picture. ?from=1001 opens the steps on that request's files and words, which is how the populated steps render without an upload.",
   "page": "/builders/ai-studio",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/atlas.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Repo atlas — the self-drawing module map. Its SEMANTIC node palette is fixed by ADR 0094 and is not the token tier's business; everything around it (the panel, the view switch, the caption, the detail card, the legend, the island index) is chrome and rides the world. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once; the redesign (task 1003472) added the `truth`, `detail` and `index` states. Populated look: the hall-preview harness serves modules/hall-ui/public/atlas.json when scripts/bongos/gen-atlas.js has written it (the file is generated on deploy and gitignored, so run the generator first).",
   "page": "/builders/atlas",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/board-room.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Board Room — the sittings, the ballot and the vote form, carved out of the /government tab strip onto its own page by ADR 0266. Unlike its neighbours in the Government group this page is gated on the `board.vote.cast` atom (xenos floor) rather than page.view.government, so the sealed state here means the permission was withheld, not that the reader stands below a rung.",
   "page": "/builders/board-room",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/city.states.json

@@ -1,6 +1,8 @@
 {
   "_": "THE GOVERNOR CITY's home (task 1004524, goal 1000125) through modules/ui-design/kit/render.js. The page draws GET /government/docket, GET /goals and GET /goals/rollups; against the kit's own stub none exists, so every state renders the city with no districts and no pins and the line saying the docket could not be read: a real state the floors must hold in. To look at the populated city, run it against the hall-preview harness, whose government__docket.json fixture carries the reference design's seven sample matters (3 need you, 2 moving, 2 settled) and whose goals fixtures carry the open goals:\n\n  node scripts/hall-preview/server.js --port 4624 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/city.states.json --base-in http://localhost:4624 --base-out http://localhost:4624\n\nThe page follows the OS mode until the switch is pressed (then the hall's own 'hall-theme' preference), so the kit's dark/light emulation renders both modes.",
   "page": "/builders/city",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/collab.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Collab — the two-sided ask board. ASKED OF YOU comes first because it is the half where someone is waiting, and the empty state of that half is the page's most common render. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once; the redesign (task 1003471) put four asks and two of the viewer's own in the harness so the rows can be looked at.",
   "page": "/builders/collab",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/commands.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The Commands page (task 1004473): every skill and every bongos CLI verb as two grouped ledgers, filled from GET /specialities/installed-skills and GET /cli/commands. Against the kit's stub both reads 404, so the page renders its 'not available' state, which the floors must hold too. The populated look was verified against a real local server (bongos dev), since both lists are read from disk.",
   "page": "/builders/commands",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/copy-desk.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Copy desk — the one-voice review queue. Its three dialogs are real <dialog>s, so their ::backdrop is the sheet's single sanctioned literal (black with alpha as a scrim). Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once; the redesign (task 1003471) put a queue, ten duplicates and a search's hits in the harness so the rows and the dialogs can be looked at; task 1003114 (R03) added the proposal composer and the `proposer` state that opens it.",
   "page": "/builders/copy-desk",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/deploy.states.json

@@ -1,6 +1,8 @@
 {
   "_": "DEPLOY (task 1003159, ADR 0293; the npm-release module's sections, task 1002622) through modules/ui-design/kit/render.js. The page reads authenticated routes gated on core.pin.move, so against the kit's own stub it renders its restricted or failed-read state. To look at the populated page — the deploy door AND the module's 'where the work is' + version history, from a fixture taken off the live registry and ledger — run the hall-preview harness with the module on:\n\n  BONGOS_MODULE_NPM_RELEASE=1 node scripts/hall-preview/server.js --port 4602 --rank archon --fixture-me --modules-on npm-release,provisioning\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/deploy.states.json --base-in http://localhost:4602 --base-out http://localhost:4602",
   "page": "/builders/deploy",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/goal-map.states.json

@@ -1,6 +1,8 @@
 {
   "_": "THE PROJECT SKY (task 1004232 / sky part 4 of 5, goal 1000095; ADR 0331, ADR 0227 §11) through modules/ui-design/kit/render.js — the same renderer as /thinking (thinking.states.json), but its own sky: its only lens is 'the whole project', and it carries no switcher (task 1004328). The page draws GET /sky + GET /sky/mine; against the kit's own stub neither exists, so every state below renders the EMPTY sky — a real state the floors must hold in (the tools, the ledger drawer and the tour all exist with no goal read). To look at the populated sky — the wells sized by credits, the routes, the shuttle menu, explore's 'where do you begin' — run it against the hall-preview harness, whose sky.json + sky__mine.json fixtures carry the wells and the routes:\n\n  node scripts/hall-preview/server.js --port 4620 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/goal-map.states.json --base-in http://localhost:4620 --base-out http://localhost:4620\n\nThe tour opens by itself on a first visit (sky-map-tour-seen — its own key, since the two tours differ), so states that want the bare sky skip it first; explore is on by default and asks where you begin the first time (sky-seen), so the 'sky' state renders that prompt on purpose.",
   "page": "/builders/goal-map",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modes": ["dark"],

package/modules/hall-ui/public/goals.css

@@ -585,5 +585,6 @@
 .goals-line__map { display: inline-flex; align-items: center; min-height: 26px; padding: 0 4px; font-size: 13px; color: var(--ink-soft); }
 .goals-line .goal-author { flex: 1 1 100%; order: 9; margin: 6px 0 0; }
 .goal-detail__back { margin: 0 0 10px; font-size: 13px; }
+.goal-detail__back a { display: inline-flex; align-items: center; min-height: 24px; } /* the 24px target floor (task 1005080) */
 /* Join requests are the shared ask card (task 1004823): no ledger rules between cards. */
 .pending-list--ask { gap: 10px; }

package/modules/hall-ui/public/goals.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's Goals list + goal detail through modules/ui-design/kit/render.js (task 1003307; redesigned in task 1003470). Goals is the LIST ARCHETYPE the governance-and-lists re-skin applies across thirteen pages, so its floors are measured first and the rest are held against them. Populated look: node scripts/hall-preview/server.js --port 4620 --fixture-me, then --base-in/--base-out at that origin (the harness carries goals, goals/rollups and work-categories since task 1003470). `filters` opens the kit's Filters disclosure (the five lenses that left the open bar); `cards` flips the rows|cards toggle on the count line.",
   "page": "/builders/goals",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/government.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Government — the constitution, ranks, permissions and assignments, behind requireGovernmentPage (metic+). The tabbed panels are the state vocabulary here: one render per tab is what proves the panel switch does not reflow the column. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once.",
   "page": "/builders/government",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/idea.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's IDEA RECORD through modules/ui-design/kit/render.js (task 1003305). Same harness note as task.states.json: the idea's five answers, its completeness bar and its author-only mark control need a LOADED idea, so run it against the hall-preview harness:\n\n  node scripts/hall-preview/server.js --port 4612 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/idea.states.json --base-in http://builders.localhost:4612 --base-out http://builders.localhost:4612",
   "page": "/idea/12",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/ideas.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's IDEA COMPOSER through modules/ui-design/kit/render.js (task 1003305). The five questions are rendered from GET /inbox/template and the spark queue from GET /inbox/sparks, so the populated form needs the hall-preview harness; the kit's own stub answers neither and renders the honest `could not load the idea template` line instead, which is the `no-template` state below.\n\n  node scripts/hall-preview/server.js --port 4612 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/ideas.states.json --base-in http://builders.localhost:4612 --base-out http://builders.localhost:4612\n\nTHE FOLD (task 1004087 / spec R04) is why there are now three states rather than two. `compose` is what a builder actually lands on — the one-line composer at the top, the Full Idea form folded away behind one press, and NO rail reserve, which is the whole reason that state is rendered at 1440 as well as at 390/320. `full` is the same page one press later: the five questions, the meter, and the rail. Rendering only one of them would measure half the page, and the half that is measured on every arrival is the first.",
   "page": "/ideas",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/index-founding.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The founding wall on Home (task 1004424): the home-founding widget a founded project shows, from the kit fixture founding-builders-sample.json. The page itself is index.states.json's; only the founding read differs. The never-founded case is index.states.json, where the wall stays hidden. Run it with --states (Home has no last path segment).",
   "page": "/builders/",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/", "fixtures": { "founding-builders": "founding-builders-sample" } },
   "modeQuery": false,

package/modules/hall-ui/public/index-genesis-decide.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The genesis home on Home (task 1004423) while the founder decides the plan: each stage's length and done-when line, the starting government by its real name with its plain explanation (the recommended one picked, from government-constitution-sample.json), passes and advisors, every default pre-picked so a solo founder needs one click. /founding/genesis answers founding-genesis-decide.json, built from the real server shaper.",
   "page": "/builders/",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/", "fixtures": { "me": "me-founding", "founding-genesis": "founding-genesis-decide", "government-constitution": "government-constitution-sample" } },
   "modeQuery": false,

package/modules/hall-ui/public/index-genesis-demo.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The genesis home of a DEMO, born into genesis (task 1004506): 3 people, 4 hours each. The plan was settled at birth from the demo's picks, so there is no decide form: one line names the plan, and each stage reads in minutes (scope in progress, due at a time). /me says founding at scope (kit fixture me-founding-demo.json) and /founding/genesis answers founding-genesis-demo.json, built from the real server shaper. A real project's genesis is index-genesis.states.json and index-genesis-decide.states.json; a hall that is not founding is index.states.json.",
   "page": "/builders/",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/", "fixtures": { "me": "me-founding-demo", "founding-genesis": "founding-genesis-demo" } },
   "modeQuery": false,

package/modules/hall-ui/public/index-genesis.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The genesis home on Home (task 1004423), mid-genesis: scope passed, strategize in progress. /me says founding (kit fixture me-founding.json) and /founding/genesis answers founding-genesis-stage.json, built from the real server shaper. The deciding step is index-genesis-decide.states.json; a hall that is not founding is index.states.json, where the card never renders and never asks. Run it with --states (Home has no last path segment).",
   "page": "/builders/",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/", "fixtures": { "me": "me-founding", "founding-genesis": "founding-genesis-stage" } },
   "modeQuery": false,

package/modules/hall-ui/public/index.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's HOME page through modules/ui-design/kit/render.js (task 1003304). Home is served at the surface root, so its page path has no last segment to name the file — run it with `--states modules/hall-ui/public/index.states.json`, not `--page`.",
   "page": "/builders/",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"
@@ -8,6 +10,9 @@
   "modeQuery": false,
   "_feeds": "As work.states.json: the kit's stub is not the hall's feed set, so Home renders its skeletons and empty states here. The populated dashboard is the hall-preview harness.",
   "ignoreRequests": [
+    "/version$",
+    "/api/(gds|bongos)/removal-proposals",
+    "/api/(gds|bongos)/blockers",
     "/api/(gds|bongos)/me$",
     "/api/(gds|bongos)/me/",
     "/api/(gds|bongos)/tasks",

package/modules/hall-ui/public/market-watch-item.states.json

@@ -1,6 +1,8 @@
 {
   "_": "MARKET WATCH ITEM, the dossier (task 1004939; design of record docs/design/mocks/market-watch/item.html, option B). One read, GET /market-watch/items/:id. Against the kit's own stub it 404s with no item code, which the page reads as the module being off. The populated card and case file need the hall-preview harness with the module reported on; its market-watch__items__4.json (GitHub Copilot coding agent) and market-watch__items__37.json (NLnet Foundation) fixtures were built from the committed 2026-10-28 seed through the real shapes:\n\n  node scripts/hall-preview/server.js --port 4639 --fixture-me --modules-on market-watch\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/market-watch-item.states.json --base-in http://localhost:4639 --base-out http://localhost:4639",
   "page": "/builders/market-watch-item?id=4",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/market-watch-rules.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The Market Watch rules page (task 1004941), built to docs/design/mocks/market-watch/rules.html, option C (the pipeline map). One read, GET /market-watch/rules. Against the kit's own stub it 404s, so the page renders its 'Market Watch is off' state, which the floors must hold too. TO SEE IT POPULATED, point the kit at the hall-preview harness: `node scripts/hall-preview/server.js --port 4641 --fixture-me`, then `render.js --page /builders/market-watch-rules --base-in http://builders.localhost:4641 --base-out http://builders.localhost:4641`. The harness answers from fixtures/market-watch__rules.json, built by the real composers (rules-view.buildView over the seed's rules and 60 items, two approved changes and four open proposals). Steps are opened with clickIfVisible because against the stub the nodes do not exist.",
   "page": "/builders/market-watch-rules",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/market-watch.states.json

@@ -1,6 +1,8 @@
 {
   "_": "MARKET WATCH HOME, the watchtower desk (task 1004939; design of record docs/design/mocks/market-watch/home.html, option D). One read, GET /market-watch/home. Against the kit's own stub it 404s, which the page reads as the module being off, so the stub render is the quiet off state. The populated desk needs the hall-preview harness with the module reported on; its market-watch__home.json fixture was built from the committed 2026-10-28 seed through the real shapes (tests/fixtures/market-watch-seed-rows.cjs):\n\n  node scripts/hall-preview/server.js --port 4639 --fixture-me --modules-on market-watch --rank archon\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/market-watch.states.json --base-in http://localhost:4639 --base-out http://localhost:4639\n\nThe 'settings' state is the owner's Settings tab (task 1005045; task 1004938's page before it), drawn from GET /market-watch/settings (the harness's market-watch__settings.json, the mockup's month). Only an archon viewer gets the tab, so the harness needs --rank archon; for anyone else the state renders the desk with no tab strip.",
   "page": "/builders/market-watch",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/modules.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Modules — the catalog as ONE panel of oversight rows (task 1003472): the kit filter bar, the figure band, two groups under heads. The empty state matters more than the populated one: a filter that matches nothing is the state a browse page spends real time in. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once; the redesign added the `lens` and `details` states. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/modules.json carries eighteen modules, one built by the project).",
   "page": "/builders/modules",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/money.states.json

@@ -1,6 +1,8 @@
 {
   "_": "MONEY (task 1005047; once FLEET COSTS, task 1001949, ADR 0327) through modules/ui-design/kit/render.js. The page reads three authenticated routes — GET /project-account/outflow (payout.approve), GET /public/cost-summary and GET /provisioning/fleet/cost-ledger (provisioning.fleet.manage) — each section hidden until its own read answers. Against the kit's own stub every read fails, so the page shows its one 'Nothing to show yet' line, a state the floors must hold in. To look at the populated page run it against the hall-preview harness, whose fixtures answer all three (the ledger's two cloud hosts carry no recorded plan, the state live is in today):\n\n  node scripts/hall-preview/server.js --port 4620 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/money.states.json --base-in http://localhost:4620 --base-out http://localhost:4620",
   "page": "/builders/money",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/my-agents.states.json

@@ -1,6 +1,8 @@
 {
   "_": "MY AGENTS (task 1004685, the living-city prototype) through modules/ui-design/kit/render.js. Every row is filled from GET /me and its prefs, so the floors run against the hall-preview harness, which serves those reads and records the pref writes (scripts/hall-preview/pref-writes.js):\n\n  node scripts/hall-preview/server.js --port 4614 --fixture-me --rank archon\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/my-agents.states.json --base-in http://builders.localhost:4614 --base-out http://builders.localhost:4614\n\nAgainst the kit's own stub the reads 404 and the page shows its sign-in line. The 'nobody' state is the same page as a builder who holds no seat (?as=nobody, a stand-in that can only take away, gov-positions.js).",
   "page": "/my-agents",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/notes-panel.css

@@ -11,7 +11,7 @@
 .np-note__body { margin: 0; white-space: pre-wrap; overflow-wrap: anywhere; }
 .np-note__meta { margin: var(--sp-xs) 0 0; font-size: 12px; color: var(--ink-soft); display: flex; gap: var(--sp-md); flex-wrap: wrap; align-items: center; }
 .np-move select { font-size: 12px; }
-.np-link { background: none; border: 0; padding: 0; color: var(--accent); cursor: pointer; font: inherit; font-size: 12px; text-decoration: underline; }
+.np-link { background: none; border: 0; padding: 0; color: var(--accent); cursor: pointer; font: inherit; font-size: 12px; text-decoration: underline; min-height: 24px; min-width: 24px; display: inline-flex; align-items: center; } /* the 24px target floor (task 1005080) */
 .np-empty { color: var(--ink-soft); }
 .np-form { margin: var(--sp-lg) 0 0; display: grid; gap: var(--sp-sm); }
 .np-field { display: grid; gap: var(--sp-xs); font-size: 13px; }

package/modules/hall-ui/public/primer.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's primer through modules/ui-design/kit/render.js (task 1003306). Written with the reading-room re-skin so the room's failure state and its table of contents are MEASURED at 1440/390/320 in both modes, not just looked at.",
   "page": "/builders/primer",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/profile.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's PROFILE page through modules/ui-design/kit/render.js (task 1003308; four screens behind the section rail since task 1003489 — overview, works, activity, connections). The identity band, the charts, the works ledger and the activity ledgers only exist once a profile has LOADED, so the floors run against the hall-preview harness (see settings.states.json for the two commands; pass --base-in/--base-out at it). One rail key renders at a time, so each key is its own state. `out` is a real state here rather than a redirect: a signed-out visitor with no ?id= gets the empty state, not a bounce — under the harness's --fixture-me the /me read still answers, so `out` renders the own profile there and the empty state only under the kit's own stub.",
   "page": "/profile",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/roster.states.json

@@ -1,6 +1,8 @@
 {
   "_": "Builders — this project's OWN roster, ranked by credits earned (task 1003441, goal 1000075). Was the #leaderboard hash view on index.html; /#leaderboard now redirects here. Deliberately UNGATED, because its one data source (GET /leaderboard) is deliberately unauthenticated and mirrors the public status surface — so unlike a gated page's states file the `out` state below renders the real page rather than a seal. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/public__leaderboard.json, since task 1004437 the list the page reads: fifteen builders with avatars, ranks, karma, tokens and each one's roles, including an artist and an ideator with no AI sessions).",
   "page": "/builders/roster",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/settings.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's SETTINGS page through modules/ui-design/kit/render.js (task 1003308). Every panel on it is a form the page script fills from a dozen /me/* reads, so the floors run against the hall-preview harness rather than the kit's own stub:\n\n  node scripts/hall-preview/server.js --port 4621 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/settings.states.json --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621\n\nOne group renders at a time behind the section rail, so each rail group is its own state. There is no `out` state on purpose: settings.js answers a 401 by navigating to the sign-in flow, and a state whose page navigates away measures the destination, not this page (the not-signed-in gate panel is the non-401 failure render, pinned statically in tests/hall_settings_world.mjs).",
   "page": "/settings",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/street-card.states.json

@@ -1,6 +1,8 @@
 {
   "_": "THE MATTER CARD THAT ACTS (task 1004528, goal 1000125) on the street page, through modules/ui-design/kit/render.js. Kept beside street.states.json rather than inside it, so the street and its interiors (task 1004526) and the card each own their states. The populated card needs the hall-preview harness, whose government__docket.json puts the review-seat amendment on the board source (board:47) and whose government__board__items.json carries its ballot (item 47), with a canned answer for a vote:\n\n  node scripts/hall-preview/server.js --port 4625 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/street-card.states.json --base-in http://localhost:4625 --base-out http://localhost:4625\n\nTask 1004566 adds a card per kind the docket carries (blocker, red-team report, core update, module re-check, a Full Idea and the review queue), each compact and with \"more\" open; the harness fixture carries them. Against the kit stub there is no docket and no pin, so these states are for the harness.",
   "page": "/builders/street",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/street.states.json

@@ -1,6 +1,8 @@
 {
   "_": "THE STREET (task 1004525, goal 1000125) and inside every building and district (task 1004526) through modules/ui-design/kit/render.js. The page draws GET /government/docket, GET /goals, GET /goals/rollups and the viewer's GET /builders/:id/earnings; against the kit's own stub none exists, so every state renders the bare street (the nine civic buildings, no districts, no pins) with the readings saying the docket could not be read: a real state the floors must hold in. To look at the populated street, run it against the hall-preview harness, whose government__docket.json fixture carries the reference design's seven sample matters (3 need you, 2 moving, 2 settled) and whose goals fixtures carry the open goals:\n\n  node scripts/hall-preview/server.js --port 4625 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/street.states.json --base-in http://localhost:4625 --base-out http://localhost:4625\n\nThe page follows the OS mode until the switch is pressed (then the hall's own 'hall-theme' preference), so the kit's dark/light emulation renders both modes.",
   "page": "/builders/street",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/",

package/modules/hall-ui/public/studio.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The studio home (task 1003971 / BV2.TW16), built 1:1 on docs/design/mocks/tweak-mode/Main.dc.html: the night room, the greeting and its sub-line (editable in place as a tweak of builders:studio), the tally, Resume, and three quick actions opening glass panels (the Tweak/CopyWrite Flow, the Approval queue, Artist Review Status). Behind a quiet door, the older reviews (R06 of goal 1000074, task 1003117; retired in TW14) still answer the reviews filed before Tweak Mode. Against the kit's own stub the page renders its unread states (no copy-desk feeds). TO SEE IT POPULATED, point the kit at the hall-preview harness: `node scripts/hall-preview/server.js --port 4636 --fixture-me` then `render.js --base-in http://builders.localhost:4636 --base-out http://builders.localhost:4636`. The harness answers the tally, the pages and the next page from copy-desk__tally.json, copy-desk__pages.json and copy-desk__next.json (built by the real composers), Resume's counter from copy-desk__pages__draft.json, the studio's own lines from copy-desk__pages__draft-studio.json, the claim and the draft save from its CANNED WRITES, and the older reviews from tasks.json (whose first row IS a cascade artist review).",
   "page": "/builders/studio",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"

package/modules/hall-ui/public/style.css

@@ -56,6 +56,10 @@
    here. It lives on the shell rules below and on a page's own body, because a
    body declaration beats an inherited :root value at every width and a token
    tier that carries a breakpoint silently defeats its own media query. */
+/* The shared token sheet (task 1005081): the scales — type, spacing, corners,
+   shadows, motion, stacking — every surface loads. Imported FIRST so this
+   sheet's own rules follow it; the hall's scale names below are aliases of it. */
+@import url("/modules/ui-design/public/tokens.css");
 @import url("page-notes.css");
 @import url("craft-review.css");
 
@@ -158,7 +162,7 @@
           thin on black, so light takes the mono and dark takes the body face.
           Take the token, never the family. ---- */
   --label-face:  var(--font-mono);
-  --label-size:  11px;
+  --label-size:  var(--ds-text-2xs);
   --label-space: .12em;
   --label-case:  uppercase;
 
@@ -166,11 +170,12 @@
           there is nothing behind it. Never a coloured glow. ---- */
   --type-halo: none;
 
-  /* ---- structure. --line is a WIDTH (note c). ---- */
-  --line:        1px;
-  --radius:      16px;
-  --radius-sm:   10px;
-  --radius-pill: 999px;
+  /* ---- structure. --line is a WIDTH (note c). The values live in the shared
+          token sheet (task 1005081); these names are the hall's aliases. ---- */
+  --line:        var(--ds-line);
+  --radius:      var(--ds-radius-panel);
+  --radius-sm:   var(--ds-radius-tile);
+  --radius-pill: var(--ds-radius-pill);
 
   /* ---- the shell's metrics. --topbar-h stays under the kit's 80px top-bar
           floor; --sidebar-w IS the rail, because v3 pins the rail at every
@@ -195,12 +200,12 @@
   /* ---- spacing: DESIGN.md's rhythm (6/10/14/22/34/52). The four-step
           --space-* scale task 2179 named aliases onto it, so no ported rule
           breaks; hairlines separate, padding does not. ---- */
-  --sp-hair: 6px;
-  --sp-xs:   10px;
-  --sp-sm:   14px;
-  --sp-md:   22px;
-  --sp-lg:   34px;
-  --sp-xl:   52px;
+  --sp-hair: var(--ds-space-hair);
+  --sp-xs:   var(--ds-space-xs);
+  --sp-sm:   var(--ds-space-sm);
+  --sp-md:   var(--ds-space-md);
+  --sp-lg:   var(--ds-space-lg);
+  --sp-xl:   var(--ds-space-xl);
   --space-1: var(--sp-hair);
   --space-2: var(--sp-xs);
   --space-3: var(--sp-sm);
@@ -216,7 +221,7 @@
   /* The world has no shadow vocabulary for UI, so this is spent only where an
      element floats over a scrim (the phone drawer, the deep-link card). Pure
      black with alpha is the one literal the Fifteen Rule allows, as a scrim. */
-  --shadow-pop: 0 18px 40px rgba(0, 0, 0, .28);
+  --shadow-pop: var(--ds-shadow-pop);
 
   /* ---- z ladder — content overlays (rank tips z-50, modals z-50, toast z-100,
      copy-toast z-1000, deeplink z-2000) must beat the chrome; the mobile drawer
@@ -225,17 +230,17 @@
      reading hairline sits UNDER the topbar so it reads as the article's
      progress and not as app chrome, and the diagram's fullscreen canvas is the
      top of the whole ladder because it covers the shell entirely. ---- */
-  --z-progress: 25;
-  --z-topbar: 30;
-  --z-sidebar: 40;
-  --z-scrim: 140;
-  --z-drawer: 150;
+  --z-progress: var(--ds-z-progress);
+  --z-topbar: var(--ds-z-topbar);
+  --z-sidebar: var(--ds-z-sidebar);
+  --z-scrim: var(--ds-z-scrim);
+  --z-drawer: var(--ds-z-drawer);
   /* A confirm dialog is the one thing that must sit above the drawer: it is
      asking a question the drawer's content cannot answer. Added by task 1003307
      because two pages had each guessed a bare number for exactly this
      (200 and 50), which is what a missing layer looks like. */
-  --z-modal: 160;
-  --z-diagram-full: 9999;
+  --z-modal: var(--ds-z-modal);
+  --z-diagram-full: var(--ds-z-diagram-full);
 
   /* ---- the hall's own plate: the declared seam, deferred by the owner
           ("decide after the shell lands", 2026-08-30). The hall's plate was
@@ -286,11 +291,10 @@ html[data-theme="dark"] {
   --info-weak:   color-mix(in srgb, var(--info) 14%, var(--bg-card));
   --focus:       var(--accent);
   --label-face:  var(--font-body);
-  --label-size:  11.5px;
+  --label-size:  var(--ds-text-2xs-plus);
   --label-space: .1em;
   --type-halo:   0 2px 18px rgba(0, 0, 0, .94), 0 0 54px rgba(0, 0, 0, .72);
   --surface-2:   color-mix(in srgb, var(--ink) 6%, var(--bg-card));
-  --shadow-pop:  0 18px 40px rgba(0, 0, 0, .62);
   --plate-veil:  linear-gradient(to bottom, rgba(0, 0, 0, .82), rgba(0, 0, 0, .93));
 }
 html[data-theme="dark"] body { background: var(--bg); }
@@ -327,11 +331,10 @@ html[data-theme="dark"] body { background: var(--bg); }
     --info-weak:   color-mix(in srgb, var(--info) 14%, var(--bg-card));
     --focus:       var(--accent);
     --label-face:  var(--font-body);
-    --label-size:  11.5px;
+    --label-size:  var(--ds-text-2xs-plus);
     --label-space: .1em;
     --type-halo:   0 2px 18px rgba(0, 0, 0, .94), 0 0 54px rgba(0, 0, 0, .72);
     --surface-2:   color-mix(in srgb, var(--ink) 6%, var(--bg-card));
-    --shadow-pop:  0 18px 40px rgba(0, 0, 0, .62);
     --plate-veil:  linear-gradient(to bottom, rgba(0, 0, 0, .82), rgba(0, 0, 0, .93));
   }
   html:not([data-theme]) body { background: var(--bg); }

package/modules/hall-ui/public/task.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The hall's TASK RECORD through modules/ui-design/kit/render.js (task 1003305). The record's own controls — the dependency links, the lifecycle buttons, the figure band, the way back — only exist once a task has LOADED, so the floors here are run against the hall-preview harness rather than the kit's own stub, which carries the public-landing feeds and not the hall's:\n\n  node scripts/hall-preview/server.js --port 4612 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/task.states.json --base-in http://builders.localhost:4612 --base-out http://builders.localhost:4612\n\nRun against the kit's own stubs instead and every state renders `no such task`, which is a real state and is the `missing` one below — just not the one the re-skin changed.",
   "page": "/task/2166",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/thinking.states.json

@@ -1,6 +1,8 @@
 {
   "_": "THE SKY (task 1004231 / sky part 3 of 5, goal 1000095; ADR 0331) through modules/ui-design/kit/render.js. The page draws GET /sky + GET /sky/mine; against the kit's own stub neither exists, so every state below renders the EMPTY sky — a real state the floors must hold in (the composer, the tour, the list drawer and the lenses all exist with no thought filed). To look at the populated sky, run it against the hall-preview harness, whose sky.json + sky__mine.json fixtures carry the wells and one of each of the five objects:\n\n  node scripts/hall-preview/server.js --port 4615 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/thinking.states.json --base-in http://localhost:4615 --base-out http://localhost:4615\n\nThe tour opens by itself on a first visit (sky-tour-seen), so states that want the bare sky skip it first.\n\nIN THE HALL (task 1004327): the page sits in the hall chrome, so it renders in BOTH modes — the chrome follows the hall theme and the sky's stage stays the void in both. The full-* states press the shell's full-screen switch: the sidebar and the top bar leave, and the one button that brings them back floats top right.",
   "page": "/builders/thinking",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,

package/modules/hall-ui/public/tweak-editor.states.json

@@ -1,6 +1,8 @@
 {
   "_": "The tweak editor (task 1004321 / BV2.TW10), built 1:1 on docs/design/mocks/tweak-mode/Editor.dc.html. Against the kit's own stub the page renders its could-not-read state (no /copy-desk feed), a state the floors must hold in. TO SEE IT POPULATED, point the kit at the hall-preview harness: `node scripts/hall-preview/server.js --port 4631 --fixture-me`, then `render.js --page '/builders/tweak-editor?page=landing:index' --base-in http://builders.localhost:4631 --base-out http://builders.localhost:4631`. The harness answers the read from fixtures/copy-desk__pages__draft.json (the real landing:index reading with the artboard's two rewrites as the saved draft), next up from copy-desk__next.json, and the autosave, the submit and the claim from its canned writes.",
   "page": "/builders/tweak-editor?page=landing:index",
+  "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
+  "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",
   "stub": {
     "prefix": "/builders/"