@bongos/core 1.24.68 → 1.24.70

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/bongos/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 3133,
-    "unique_ids": 2474,
-    "certain": 3133,
+    "strings": 3137,
+    "unique_ids": 2478,
+    "certain": 3137,
     "heuristic": 0,
     "duplicate_ids": 262
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 171,
-      "strings": 2021
+      "strings": 2025
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -723,7 +723,7 @@
         "modules/hall-ui/public/settings-usage-reports.js:67",
         "modules/hall-ui/public/settings.js:401",
         "modules/hall-ui/public/settings.js:489",
-        "modules/hall-ui/public/settings.js:773"
+        "modules/hall-ui/public/settings.js:817"
       ]
     },
     {
@@ -1462,7 +1462,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:101",
-        "modules/hall-ui/public/settings.js:834"
+        "modules/hall-ui/public/settings.js:878"
       ]
     },
     {
@@ -1472,7 +1472,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:88",
-        "modules/hall-ui/public/settings.js:774"
+        "modules/hall-ui/public/settings.js:818"
       ]
     },
     {
@@ -1752,7 +1752,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:102",
-        "modules/hall-ui/public/settings.js:829"
+        "modules/hall-ui/public/settings.js:873"
       ]
     },
     {
@@ -2042,7 +2042,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:78",
-        "modules/hall-ui/public/settings.js:749"
+        "modules/hall-ui/public/settings.js:793"
       ]
     },
     {
@@ -2222,7 +2222,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings-ai-keys.js:21",
-        "modules/hall-ui/public/settings.js:685"
+        "modules/hall-ui/public/settings.js:729"
       ]
     },
     {
@@ -2552,7 +2552,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/settings.js:483",
-        "modules/hall-ui/public/settings.js:1043"
+        "modules/hall-ui/public/settings.js:1087"
       ]
     },
     {
@@ -4925,7 +4925,7 @@
       "surface": "builders-hall",
       "text": "Checking your key…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 750,
+      "line": 794,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5307,6 +5307,15 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
+    {
+      "id": "0279e7634291",
+      "surface": "builders-hall",
+      "text": "Copy command",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 657,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "12ee050d0180",
       "surface": "builders-hall",
@@ -5469,6 +5478,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8a1c2e87fc2d",
+      "surface": "builders-hall",
+      "text": "Copy token",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 660,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "301afa9a94b9",
       "surface": "builders-hall",
@@ -5564,7 +5582,7 @@
       "surface": "builders-hall",
       "text": "Could not copy automatically — select and copy manually. ({…})",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 629,
+      "line": 670,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5771,7 +5789,7 @@
       "surface": "builders-hall",
       "text": "Could not load your account. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1026,
+      "line": 1070,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5807,7 +5825,7 @@
       "surface": "builders-hall",
       "text": "Could not load your settings.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1029,
+      "line": 1073,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5915,7 +5933,7 @@
       "surface": "builders-hall",
       "text": "Could not remove your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 834,
+      "line": 878,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5924,7 +5942,7 @@
       "surface": "builders-hall",
       "text": "Could not remove. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 833,
+      "line": 877,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5996,7 +6014,7 @@
       "surface": "builders-hall",
       "text": "Could not save your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 774,
+      "line": 818,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6077,7 +6095,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 773,
+      "line": 817,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6113,7 +6131,7 @@
       "surface": "builders-hall",
       "text": "Could not set up key storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 810,
+      "line": 854,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6122,7 +6140,7 @@
       "surface": "builders-hall",
       "text": "Could not set up storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 809,
+      "line": 853,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7090,11 +7108,20 @@
       "confidence": "certain"
     },
     {
-      "id": "36ecb5d3686c",
+      "id": "061f6f62c36a",
       "surface": "builders-hall",
-      "text": "Fresh CLI token issued. Paste this into a terminal in your project folder:",
+      "text": "Fresh CLI token issued. Open PowerShell, cd into your project folder first (the command only runs there), then paste this:",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 609,
+      "line": 626,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
+    {
+      "id": "67ad9b9f11c8",
+      "surface": "builders-hall",
+      "text": "Fresh CLI token issued. Open a terminal, cd into your project folder first (the command only runs there), then paste this:",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 627,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7193,7 +7220,7 @@
       "surface": "builders-hall",
       "text": "Get a free key ↗",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 653,
+      "line": 697,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7868,7 +7895,7 @@
       "surface": "builders-hall",
       "text": "Image key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 830,
+      "line": 874,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8268,6 +8295,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "e3bbba45305c",
+      "surface": "builders-hall",
+      "text": "Keep the token out of your shell history",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 650,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "08764cf156cc",
       "surface": "builders-hall",
@@ -8309,7 +8345,7 @@
       "surface": "builders-hall",
       "text": "Key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 829,
+      "line": 873,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8327,7 +8363,7 @@
       "surface": "builders-hall",
       "text": "Key storage is being set up by an Archon — check back shortly. {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 704,
+      "line": 748,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8345,7 +8381,7 @@
       "surface": "builders-hall",
       "text": "Key storage isn't set up yet. As an Archon you can turn it on now — the server generates and safely stores the master key (no terminal needed).",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 700,
+      "line": 744,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9641,7 +9677,7 @@
       "surface": "builders-hall",
       "text": "No builder account found for this sign-in.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1034,
+      "line": 1078,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -11184,15 +11220,6 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
-    {
-      "id": "cf68a394cfa5",
-      "surface": "builders-hall",
-      "text": "Paste command copied.",
-      "file": "modules/hall-ui/public/settings.js",
-      "line": 628,
-      "origin": "js-notice",
-      "confidence": "certain"
-    },
     {
       "id": "6036f69e13bd",
       "surface": "builders-hall",
@@ -11216,7 +11243,7 @@
       "surface": "builders-hall",
       "text": "Paste your key first.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 749,
+      "line": 793,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -11837,7 +11864,7 @@
       "surface": "builders-hall",
       "text": "Re-issue failed: {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 633,
+      "line": 677,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -12462,6 +12489,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "4c1e8ab8e1de",
+      "surface": "builders-hall",
+      "text": "Run this command instead (same folder). When it asks for the token, click Copy token and paste it there; nothing is shown as you paste.",
+      "file": "modules/hall-ui/public/settings.js",
+      "line": 652,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "48e5f1d19e90",
       "surface": "builders-hall",
@@ -12530,7 +12566,7 @@
       "surface": "builders-hall",
       "text": "Save key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 685,
+      "line": 729,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12980,7 +13016,7 @@
       "surface": "builders-hall",
       "text": "Set up key storage",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 701,
+      "line": 745,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12989,7 +13025,7 @@
       "surface": "builders-hall",
       "text": "Setting up key storage…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 785,
+      "line": 829,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -17210,7 +17246,7 @@
       "surface": "builders-hall",
       "text": "Your image-generation key settings could not be loaded. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 860,
+      "line": 904,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17219,7 +17255,7 @@
       "surface": "builders-hall",
       "text": "Your key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 681,
+      "line": 725,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17273,7 +17309,7 @@
       "surface": "builders-hall",
       "text": "Your preferences, {…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1043,
+      "line": 1087,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -18884,7 +18920,7 @@
       "surface": "builders-hall",
       "text": "paste command",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 611,
+      "line": 629,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -20648,7 +20684,7 @@
       "surface": "builders-hall",
       "text": "{…} · Stored encrypted; never shown again after saving.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 687,
+      "line": 731,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -20657,7 +20693,7 @@
       "surface": "builders-hall",
       "text": "{…} · revoke it any time under Active sessions.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 619,
+      "line": 637,
       "origin": "js-text-assign",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3390,5 +3390,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.66 with no explicit bump. run 42689728958. (task 1002620)
   1.24.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.67 with no explicit bump. run 42692736161. (task 1002620)
+  1.24.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.68 with no explicit bump. run 42699948615. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -2449,7 +2449,7 @@
       "surface": "builders",
       "title": "Settings",
       "states_read": ["account","access","preferences","install-reports","sound","update"],
-      "files_hash": "6e7b5e2b903cd72c",
+      "files_hash": "ea8de6fa68c456ab",
       "reading_hash": "085bb32894909ee0",
       "counts": {"lines":137,"placed":90,"shared":9,"unplaced":38},
       "omitted": {"data":16},
@@ -2459,7 +2459,7 @@
         {"key":"L0002","section":"top bar","text":"Settings","placement":"shared"},
         {"key":"L0003","section":"top bar","text":"Update","placement":"shared"},
         {"key":"L0004","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":555,"string_id":"eba610d25523"},
-        {"key":"L0005","section":"top bar","text":"⌘K","placement":"shared"},
+        {"key":"L0005","section":"top bar","text":"Ctrl K","placement":"shared"},
         {"key":"L0006","section":"top bar","text":"Building","placement":"shared"},
         {"key":"L0007","section":"top bar","text":"Artistry","placement":"shared"},
         {"key":"L0008","section":"top bar","text":"Ideating","placement":"shared"},
@@ -2531,16 +2531,16 @@
         {"key":"L0074","section":"Your Autobongos runner","text":"The project has not allowed any goals for runners yet, so there is nothing to choose from.","placement":"unplaced","state":"access"},
         {"key":"L0075","section":"Image-generation key","text":"Image-generation key","placement":"placed","file":"modules/hall-ui/public/settings.html","line":244,"string_id":"783853467d52","state":"access","occurrences":2},
         {"key":"L0076","section":"Image-generation key","text":"The art pipeline draws tiles and sprites with Google AI Studio (Gemini). Needed only if you generate art — your key, your bill, paid only for what you make.","placement":"placed","file":"modules/hall-ui/public/settings.html","line":245,"string_id":"600b90074021","state":"access"},
-        {"key":"L0077","section":"Image-generation key","text":"Your key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":681,"string_id":"51fd6f1ecb2f","state":"access"},
+        {"key":"L0077","section":"Image-generation key","text":"Your key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":725,"string_id":"51fd6f1ecb2f","state":"access"},
         {"key":"L0078","section":"Image-generation key","text":"Paste your {…} key","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":21,"string_id":"d7f9662b38fb","attr":"placeholder","state":"access"},
-        {"key":"L0079","section":"Image-generation key","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":685,"string_id":"0c79b504aebe","state":"access"},
-        {"key":"L0080","section":"Image-generation key","text":"Get a free key ↗","placement":"placed","file":"modules/hall-ui/public/settings.js","line":653,"string_id":"2ae2114b61db","state":"access"},
-        {"key":"L0081","section":"Image-generation key","text":"· Stored encrypted; never shown again after saving.","placement":"placed","file":"modules/hall-ui/public/settings.js","line":687,"string_id":"b3757ba3bb46","state":"access"},
+        {"key":"L0079","section":"Image-generation key","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":729,"string_id":"0c79b504aebe","state":"access"},
+        {"key":"L0080","section":"Image-generation key","text":"Get a free key ↗","placement":"placed","file":"modules/hall-ui/public/settings.js","line":697,"string_id":"2ae2114b61db","state":"access"},
+        {"key":"L0081","section":"Image-generation key","text":"· Stored encrypted; never shown again after saving.","placement":"placed","file":"modules/hall-ui/public/settings.js","line":731,"string_id":"b3757ba3bb46","state":"access"},
         {"key":"L0082","section":"Image-generation key","text":"Stored encrypted; never shown again after saving — only its last four digits.","placement":"placed","file":"modules/hall-ui/public/settings.html","line":253,"string_id":"6c6544f5c011","state":"access"},
         {"key":"L0083","section":"Your AI keys","text":"Your AI keys","placement":"placed","file":"modules/hall-ui/public/settings.html","line":261,"string_id":"b22c34b9c30a","state":"access"},
         {"key":"L0084","section":"Your AI keys","text":"Link your own AI account so studio generations run on it and we charge you nothing. Without a key, generations run on ours and come out of your balance.","placement":"placed","file":"modules/hall-ui/public/settings.html","line":262,"string_id":"a0a4aaff6057","state":"access"},
         {"key":"L0085","section":"Your AI keys","text":"Paste your {…} key","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":21,"string_id":"d7f9662b38fb","attr":"placeholder","state":"access"},
-        {"key":"L0086","section":"Your AI keys","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":685,"string_id":"0c79b504aebe","state":"access"},
+        {"key":"L0086","section":"Your AI keys","text":"Save key","placement":"placed","file":"modules/hall-ui/public/settings.js","line":729,"string_id":"0c79b504aebe","state":"access"},
         {"key":"L0087","section":"Your AI keys","text":"Get a key ↗","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":29,"string_id":"ea60662c296c","state":"access"},
         {"key":"L0088","section":"Your AI keys","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","state":"access"},
         {"key":"L0089","section":"Your AI keys","text":"Key on file ending …{…}{…}. Your generations run on it and we charge nothing.","placement":"placed","file":"modules/hall-ui/public/settings-ai-keys.js","line":36,"string_id":"a4e92424b2a4","state":"access"},

package/docs/recipes/core-release-pipeline.md

@@ -4,7 +4,7 @@
 
 | Who | Gets a merged change | How to check |
 |---|---|---|
-| **cloudbongos.com** — the projects hub and the builders hall | only when a **published core release** carries it **and the hub's pin moves** — owner-gated, never automatic on merge | its `/version`; the ship card's **Deploy** row reads it: *"live at `<sha>` (includes this merge \| not yet)"* |
+| **cloudbongos.com** — the projects hub and the builders hall | only when a **published core release** carries it **and the hub's pin moves** — its patch-channel subscription moves the pin to a new patch release on its own (task 1005020); a new minor release waits for the owner | its `/version`; the ship card's **Deploy** row reads it: *"live at `<sha>` (includes this merge \| not yet)"* |
 | **Projects hosted on the platform** | only when a **published core release** carries it (auto-published per merge, [ADR 0161](../adr/0161-publish-on-merge.md)) **and that project's pin moves** — a patch-channel subscription or a core-upgrade | that project's `/version` `coreVersion`; the ship card's **Projects** row states the rule |
 
 So a shipped task is live nowhere until a release carries it, and then only on an instance whose pin has moved — the hub included. The release itself waits on a green integration lane: the publish lane's integration gate refuses while `integration` on `main` is red. Never call work live until that instance's `/version` shows it. (This table used to say the hub redeploys from `main` on every merge, within minutes. It never did; on 2026-10-25 the hub had served one build through 200+ merges — task 1004873.) The wording has one source, [`modules/lifecycle/merge-reach.js`](../../modules/lifecycle/merge-reach.js); the ship card, `deploy-divergence.js` and the SessionStart line all print it (task 1004682). `/recall who sees a merge` finds the same rule as learning 1000292, which corrects learning 1000291 (that one still says the hub redeploys on every merge; the API has no way to edit a learning).
@@ -297,7 +297,7 @@ If live is **at or past** `<VER>`, stop and pick again. On 2026-09-17 a paste pr
 
 What each piece is for — each guards a failure that actually happened:
 
-- **`BONGOS_INSTANCE_ROOT`, not `CLOUDBONGOS_INSTANCE_ROOT`.** The legacy spelling still works but prints a deprecation warning three times per run and stops being read in core 1.21; the new spelling is verified in this exact line (2026-09-17, twice).
+- **`BONGOS_INSTANCE_ROOT`, not `CLOUDBONGOS_INSTANCE_ROOT`.** The legacy spelling still works but prints a deprecation warning three times per run (it is still read, but will stop being read in a future core release); the new spelling is verified in this exact line (2026-09-17, twice).
 - **The token lives in root-only `/etc/cloudbongos/npm.env`, and is handed DOWN to `lars`.** This is the step that used to be documented wrongly, so read it before improvising. `NPM_TOKEN` is **not** in lars’s environment, **not** in the interactive profile, and **not** in `/home/lars/.npmrc` — all three probed empty (2026-08-17). An earlier version of this runbook grepped `~/.npmrc` and therefore aborted on its own `[ -n "$NPM_TOKEN" ]` guard every time. Worse, it could not have worked even if that file were populated: the project `.npmrc` says `_authToken=<redacted>, which **overrides** lars’s user `~/.npmrc`, so the variable is the only channel. Hence the shape above: `set -a; . /etc/cloudbongos/npm.env; set +a` reads it as **root** (mode 600), and `--preserve-env=NPM_TOKEN` hands it to the unprivileged `lars` — exactly what systemd does for the sweep unit (`User=lars` + `EnvironmentFile=`). Without it npm falls back to the **public** registry, 404s on the private `@bongos/core`, and rolls back cleanly having taught you nothing.
 - **Never put the token in the command line — `sudo` logs the full argv (task 1003218).** The shape above is safe *because* the token is read INSIDE the quoted script, so only the `grep` reaches argv. The tempting variant is not:
   ```
@@ -342,7 +342,7 @@ node scripts/bongos/deploy-divergence.js --url https://<instance-host>
 It reports the two gaps **separately**, because they have different fixes:
 
 - **UNRELEASED** — commits on `main` past the last `CORE_VERSION` bump. *No instance, the hub included, can take these at any pin* — no published version contains them yet. The publish lane (ADR 0161) normally carries a merge within minutes; a gap that stays means the lane is disarmed, red, or refused by its integration gate. The SessionStart line also says whether `main`'s latest merge is in a release yet.
-- **UNDEPLOYED** — the live instance's `coreVersion` is behind `main`'s. A release exists it has not picked up: its pin has not moved (gate 3). On the hub that move is owner-gated.
+- **UNDEPLOYED** — the live instance's `coreVersion` is behind `main`'s. A release exists it has not picked up: its pin has not moved (gate 3). On the hub the patch-channel sweep makes that move on its own; a gap that stays means the sweep is held (artist gate, failed health check) or the release is a new minor, which waits for the owner.
 
 Exit codes: `0` aligned, `1` diverged, `2` undetermined.
 

package/modules/hall-ui/public/settings.js

@@ -578,6 +578,19 @@
 
   // ---- section 4: CLI ACCESS (re-issue a CLI bearer, V3.R91 #401) ----------
 
+  // Is this browser on Windows? (task 1005033) There the plain `npx` one-liner fails in
+  // a default PowerShell (npx.ps1 is blocked by the script policy), so the hall shows
+  // the npx.cmd form the server composes alongside it. The browser is the best signal
+  // for the machine the builder will paste into; a wrong guess still leaves a command
+  // that works in cmd, or in a PowerShell that allows scripts.
+  function isWindowsBrowser() {
+    try {
+      const uad = navigator.userAgentData;
+      if (uad && uad.platform) return /windows/i.test(uad.platform);
+      return /windows/i.test(navigator.userAgent || '');
+    } catch (_) { return false; }
+  }
+
   async function issueCliToken() {
     const btn = $('#cli-reissue-btn');
     const result = $('#cli-reissue-result');
@@ -594,7 +607,8 @@
       // plainly. 'unknown' read as a gap in the page's knowledge; the absence of a
       // date is the fact, and the revoke is what replaced the timer.
       const expires = body.expires_at ? `Expires ${new Date(body.expires_at).toLocaleString()}` : 'Never expires';
-      const pasteCommand = body.paste_command || '';
+      const windows = isWindowsBrowser();
+      const pasteCommand = (windows && body.paste_command_windows) || body.paste_command || '';
       // The secret is QUOTED (settings.css `.quote`): a 64-character token cannot
       // be a line of prose, so it sits one tonal step down with its own foot. Same
       // markup as the innerHTML template it replaces (task 1003644) — what changes
@@ -606,7 +620,11 @@
       // three out of the copy registry, blinding the artist's queue to this panel.
       const el = (tag, cls) => Object.assign(document.createElement(tag), { className: cls });
       const say = el('p', 'cli-result__say');
-      say.textContent = 'Fresh CLI token issued. Paste this into a terminal in your project folder:';
+      // Say WHERE it runs (task 1005033): npx finds `bongos` only inside the project
+      // folder, and a new Windows terminal opens in system32, where npm answers "could
+      // not determine executable to run" and nothing points at the cause.
+      if (windows) say.textContent = 'Fresh CLI token issued. Open PowerShell, cd into your project folder first (the command only runs there), then paste this:';
+      else say.textContent = 'Fresh CLI token issued. Open a terminal, cd into your project folder first (the command only runs there), then paste this:';
       const eyebrow = el('p', 'quote__eyebrow');
       eyebrow.textContent = 'paste command';
       const pre = el('pre', 'quote__pre');
@@ -621,13 +639,39 @@
       foot.append(copyBtn, hint);
       const quote = el('div', 'quote');
       quote.append(eyebrow, pre, foot);
+      // THE TOKEN-FREE ROUTE (task 1005033). The one-liner above carries the token, so
+      // it lands in shell history. `paste-token` with no token asks for it without echo;
+      // this offers that: the command without the token, and the token on its own
+      // button. The one-liner stays first because an older CLI in a builder's clone has
+      // no prompt and would stop at "No token given".
+      const promptCommand = `${windows ? 'npx.cmd' : 'npx'} bongos paste-token${body.api_base ? ` --api-base ${body.api_base}` : ''}`;
+      const quiet = el('details', 'cli-result__quiet');
+      const quietSum = el('summary', '');
+      quietSum.textContent = 'Keep the token out of your shell history';
+      const quietSay = el('p', 'settings-card__hint');
+      quietSay.textContent = 'Run this command instead (same folder). When it asks for the token, click Copy token and paste it there; nothing is shown as you paste.';
+      const quietPre = el('pre', 'quote__pre');
+      quietPre.textContent = promptCommand;
+      const copyPromptBtn = el('button', 'settings-btn settings-btn--quiet');
+      copyPromptBtn.type = 'button';
+      copyPromptBtn.textContent = 'Copy command';
+      const copyTokenBtn = el('button', 'settings-btn settings-btn--quiet');
+      copyTokenBtn.type = 'button';
+      copyTokenBtn.textContent = 'Copy token';
+      const quietFoot = el('div', 'quote__foot');
+      quietFoot.append(copyPromptBtn, copyTokenBtn);
+      quiet.append(quietSum, quietSay, quietPre, quietFoot);
       result.textContent = ''; // a re-issue replaces the previous token, as innerHTML did
       result.append(say, quote);
+      if (body.token) result.append(quiet);
       result.hidden = false;
-      copyBtn.addEventListener('click', async () => {
-        try { await navigator.clipboard.writeText(pasteCommand); toast('Paste command copied.'); }
+      const copy = async (text, done) => {
+        try { await navigator.clipboard.writeText(text); toast(done); }
         catch (err) { toast(`Could not copy automatically — select and copy manually. (${err.message})`); }
-      });
+      };
+      copyBtn.addEventListener('click', () => copy(pasteCommand, 'Paste command copied.'));
+      copyPromptBtn.addEventListener('click', () => copy(promptCommand, 'Command copied.'));
+      copyTokenBtn.addEventListener('click', () => copy(body.token, 'Token copied.'));
     } catch (err) {
       console.error('[settings] cli token reissue failed', err);
       toast(`Re-issue failed: ${err.message}`);

package/modules/lifecycle/merge-reach.js

@@ -1,14 +1,16 @@
 // modules/lifecycle/merge-reach.js — who sees a merge, and when. The ONE source of
-// the sentence (task 1004682; corrected by task 1004873).
+// the sentence (task 1004682; corrected by tasks 1004873 and 1005020).
 //
 // One path, for every instance — the hub included:
 //   1. A merge to main is first carried by a PUBLISHED core release. The publish
 //      lane cuts one per merge (ADR 0161), but only while its integration gate is
 //      green; a red integration lane stalls every release behind it.
-//   2. An instance gets that release only when its PIN moves. On the hub
-//      (cloudbongos.com: the projects hub and the builders hall) that is
-//      owner-gated; on a hosted project it is a patch-channel subscription or a
-//      core-upgrade.
+//   2. An instance gets that release only when its PIN moves. The hub
+//      (cloudbongos.com: the projects hub and the builders hall) is subscribed to
+//      the patch channel, so its update sweep moves the pin to a new patch release
+//      on its own — no person needed; only a new MINOR release (which the patch
+//      channel never takes) waits for the owner's Hall → Deploy. On a hosted
+//      project it is a patch-channel subscription or a core-upgrade.
 //
 // History: this file used to say the hub "redeploys from main on every merge,
 // within minutes". It never did — the hub pins a published core like any other
@@ -16,7 +18,9 @@
 // while sessions told the owner that work was live (task 1004873). Before that,
 // deploy-divergence.js printed "Merging to main deploys nothing" (ADR 0137), false
 // in the other direction. The ship card, the divergence report and the SessionStart
-// line all read their wording from here, so they cannot drift apart again.
+// line all read their wording from here, so they cannot drift apart again. Then
+// task 1004873's wording called the hub's pin move "owner-gated", which was false
+// for patches: cloudbongos.com moved to core 1.24.12 with no person (task 1005015).
 //
 // PURE and dependency-free: callers pass an already-sanitised reading (host, short
 // sha, inclusion), never a raw network response — some of this text is injected
@@ -26,8 +30,11 @@
 
 const HOSTED_LINE = 'Hosted projects: only when a published core release carries the change and their pin moves (patch-channel subscription or a core-upgrade).';
 
+// How the hub's pin moves (task 1005020): by itself for a patch release, by the owner for a minor.
+const HUB_PIN = 'its patch-channel subscription moves that pin on its own; a new minor release waits for the owner';
+
 function hubRule(host) {
-  return `${host || 'The hub'} gets a merge only when a published core release carries it and its pin moves (owner-gated)`;
+  return `${host || 'The hub'} gets a merge only when a published core release carries it and its pin moves (${HUB_PIN})`;
 }
 
 // includes: true (the live build carries this merge), false (not yet), null (cannot tell).
@@ -36,7 +43,7 @@ function hubLine({ host = null, liveShort = null, includes = null } = {}) {
   const state = includes === true ? 'includes this merge'
     : includes === false ? 'not yet'
       : 'cannot tell yet whether it includes this merge';
-  return `${host || 'The hub'}: live at ${liveShort} (${state}) — it gets a merge only when a published core release carries it and its pin moves (owner-gated).`;
+  return `${host || 'The hub'}: live at ${liveShort} (${state}) — it gets a merge only when a published core release carries it and its pin moves (${HUB_PIN}).`;
 }
 
 // Is main's latest merge in a published release yet? `tipShort` is a short sha,