@bongos/core 1.24.79 → 1.24.81

package/modules/hall-ui/public/watch-repo-invite.js

@@ -0,0 +1,159 @@
+/* watch-repo-invite.js — the GitHub repository half of an invite, for the Gate on /watch.
+ *
+ * A hall invite admits someone to THIS hall. It never puts the project's repository on
+ * their GitHub: that is a separate invite, sent with the owner's own GitHub account and
+ * accepted by the person on GitHub. This file holds the pieces of that second door so
+ * watch.js (at its line cap) only wires them:
+ *   • formFieldsHtml() / explainerHtml() / readForm() — the "also invite to the
+ *                         repository" tick in the invite box, and the words under it
+ *   • inviteToRepo()    — POST /github/repo-invite; the form runs it AFTER the hall invite
+ *                         landed, so a GitHub refusal never undoes the admission
+ *   • showRepoNote()    — the form's result, kept where the owner can read it after the
+ *                         queue redraws
+ *   • rowButtonHtml() / gateGithubStep() — one admitted row's GitHub status, in place:
+ *                         on the repository, waiting for them to accept, or not on it
+ *
+ * Access is always read-only (owner decision, 2026-11-04): a builder ships through the
+ * server's own publish and needs no write access, so there is no access choice at all.
+ * The server holds the same line (POST /github/repo-invite allows only 'pull').
+ *
+ * It is a factory over the page's own helpers, so it makes no request of its own that the
+ * page's sign-in bounce and error envelope do not already cover.
+ */
+(function () {
+  'use strict';
+
+  // A real GitHub username (the rule the server applies), so the repository button never
+  // shows for a Google-only member's stand-in name.
+  const GH_LOGIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+
+  // The one word for this access level, so every sentence says it the same way.
+  const READ_ONLY = 'read-only';
+
+  function make({ api, API, postJson, $ }) {
+    function formFieldsHtml() {
+      return (
+        '<div class="ov-field">' +
+        `<label class="ov-field__l"><input type="checkbox" id="gate-invite-repo" checked> Also invite them to the project’s GitHub repository (${READ_ONLY} — they can see the code, not change it)</label>` +
+        '</div>'
+      );
+    }
+
+    // The sentences under the form: what each invite does, and where the result lands.
+    function explainerHtml() {
+      return (
+        '<p class="ov-form__why">The hall invite lets them sign in here. The GitHub invite is separate: GitHub emails them, and the repository only shows on their GitHub after they accept it (github.com/notifications). Neither changes their rank.</p>' +
+        '<p class="ov-form__why" id="gate-invite-note" role="status"></p>'
+      );
+    }
+
+    // Reads the form's tick: { want }. There is no access choice; it is always read-only.
+    function readForm(form) {
+      const tick = form.querySelector('#gate-invite-repo');
+      return { want: !!(tick && tick.checked) };
+    }
+
+    // Resolves { ok, text, signin } and never throws except for a signed-out 401, which
+    // postJson has already bounced to sign-in. The words say nothing about the hall
+    // invite: this runs from the form (after one) and from a row (with none).
+    async function inviteToRepo(login) {
+      try {
+        // No access level is sent: the server offers read-only and nothing else.
+        const out = await postJson('/github/repo-invite', { github_login: login });
+        if (out.state === 'already_collaborator') {
+          return { ok: true, text: `@${login} already has access to the GitHub repository.` };
+        }
+        return { ok: true, text: `GitHub repository invite sent to @${login} (${READ_ONLY}). They must accept it: GitHub emails them, or they can open github.com/notifications.` };
+      } catch (err) {
+        if (err && err.kind === '401') throw err;
+        return {
+          ok: false,
+          signin: !!(err && err.code === 'repo_scope_required'),
+          text: `The GitHub repository invite did not go through: ${(err && err.message) || err}`,
+        };
+      }
+    }
+
+    // Writes a result into an element. A sign-in link is added only when GitHub access is
+    // what is missing; it opens the same GitHub sign-in with the repository permission asked
+    // for. Used by the form's note and by a row's status line alike.
+    function paint(el, res) {
+      if (!el) return;
+      el.textContent = res.text;
+      if (res.signin) {
+        const a = document.createElement('a');
+        a.href = `${API}/auth/web/start?return=${encodeURIComponent('/watch')}&repos=1`;
+        a.textContent = ' Reconnect GitHub with repository access, then try again.';
+        el.appendChild(a);
+      }
+    }
+
+    // The form's result. When the repository step failed, the owner is told the hall
+    // invite still stands, because the form sent that one first.
+    function showRepoNote(res) {
+      paint($('#gate-invite-note'), res.ok ? res : { ...res, text: `The hall invite went through. ${res.text}` });
+    }
+
+    // The button an admitted row offers, and the span its answer is written into.
+    function rowButtonHtml(r, ghost) {
+      return GH_LOGIN_RE.test(String(r.github_login || ''))
+        ? ghost(`data-gate-gh data-gh-mode="check" data-login="${String(r.github_login).replace(/[^A-Za-z0-9-]/g, '')}"`, 'GitHub repository')
+        : '';
+    }
+    // The span a row's answer is written into: drawn only where the button is.
+    function rowStateHtml(r) {
+      return r.status === 'invited' && !r.expired && GH_LOGIN_RE.test(String(r.github_login || ''))
+        ? '<span class="ov-row__when" data-gh-state role="status"></span>'
+        : '';
+    }
+
+    // One row's GitHub status, in place; and a button to send (or send again) read-only access.
+    async function gateGithubStep(btn) {
+      const login = btn.getAttribute('data-login');
+      const mode = btn.getAttribute('data-gh-mode') || 'check';
+      const row = btn.closest('.ov-row');
+      const out = row && row.querySelector('[data-gh-state]');
+      const say = (t) => paint(out, { ok: true, text: t });
+      try {
+        if (mode === 'send') {
+          const sent = await inviteToRepo(login);
+          paint(out, sent);
+          if (sent.ok) { // a failed send stays a send, so the retry is one click
+            btn.textContent = 'Check GitHub again';
+            btn.setAttribute('data-gh-mode', 'check');
+          }
+          return;
+        }
+        const res = await api.request('GET', `${API}/github/repo-invite?github_login=${encodeURIComponent(login)}`);
+        if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw { kind: '401' }; }
+        const s = res.data || {};
+        if (!res.ok) {
+          const env = s.error && typeof s.error === 'object' ? s.error : null;
+          paint(out, { ok: false, signin: !!(env && env.code === 'repo_scope_required'), text: (env && env.message) || 'Could not read the GitHub repository. Try again in a moment.' });
+          return;
+        }
+        if (s.state === 'collaborator') {
+          say('On the GitHub repository.');
+          btn.textContent = 'Check GitHub again';
+        } else if (s.state === 'pending') {
+          say('GitHub invite sent, waiting for them to accept it.');
+          btn.textContent = 'Send the invite again';
+          btn.setAttribute('data-gh-mode', 'send');
+        } else {
+          say('Not on the GitHub repository.');
+          btn.textContent = `Send ${READ_ONLY} repository invite`;
+          btn.setAttribute('data-gh-mode', 'send');
+        }
+      } catch (err) {
+        if (err && err.kind === '401') throw err;
+        say((err && err.message) || 'Could not reach GitHub. Try again in a moment.');
+      } finally {
+        btn.disabled = false;
+      }
+    }
+
+    return { formFieldsHtml, explainerHtml, readForm, inviteToRepo, showRepoNote, rowButtonHtml, rowStateHtml, gateGithubStep };
+  }
+
+  window.OTBWatchRepoInvite = { make };
+})();

package/modules/hall-ui/public/watch.html

@@ -11,7 +11,7 @@
   <link rel="icon" href="/modules/ui-design/public/brand/favicon.svg" type="image/svg+xml">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <link rel="stylesheet" href="/builders/style.css?v=2026-11-11-helm">
   <!-- The oversight family's sheet (task 1003469): the figure band, the group
        head, the row, the form. Then the page's own: severities, the report
        reader, the grade trend. The attention tiles + tabs come from style.css's
@@ -269,20 +269,21 @@
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
 <script src="/builders/dom-utils.js?v=2026-11-05-numbers"></script>
-<script src="/builders/shell-game.js?v=2026-11-09-game-mode"></script>
+<script src="/builders/shell-game.js?v=2026-11-11-helm"></script>
 <script src="/builders/shell-trail.js?v=2026-11-05-numbers"></script>
-<script src="/builders/craft-mode.js?v=2026-11-05-goals"></script>
-<script src="/builders/shell.js?v=2026-11-09-game-mode"></script>
+<script src="/builders/craft-mode.js?v=2026-11-10-visor"></script>
+<script src="/builders/shell.js?v=2026-11-11-helm"></script>
 <script src="/builders/hall-dialog.js"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared component kit (window.OTBKit) — tabs, ledger, pager (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
+<script src="/builders/task-detail.js?v=2026-11-10-options"></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56"></script>
 <!-- task 1005049: the two tabs' scripts, booted by watch.js when their tab first opens. -->
 <script src="/builders/sessions.js?v=2026-11-05-tab"></script>
 <script src="/builders/gate.js?v=2026-11-05-tab"></script>
+<script src="/builders/watch-repo-invite.js?v=2026-11-04-repoinvite"></script>
 <script src="/builders/watch.js?v=2026-11-05-tabs"></script>
 </body>
 </html>

package/modules/hall-ui/public/watch.js

@@ -142,7 +142,9 @@
     if (!res.ok) {
       // the envelope (ADR 0116) nests the sentence under `error`; older handlers answer flat
       const env = data.error && typeof data.error === 'object' ? data.error : null;
-      throw new Error((env && env.message) || data.message || (typeof data.error === 'string' ? data.error : '') || `${path} → ${res.status}`);
+      const e = new Error((env && env.message) || data.message || (typeof data.error === 'string' ? data.error : '') || `${path} → ${res.status}`);
+      if (env && env.code) e.code = env.code; // the repo invite branches on repo_scope_required
+      throw e;
     }
     return data;
   }
@@ -276,6 +278,10 @@
   const ghost = (attrs, label, danger = false) =>
     `<button type="button" class="btn-ghost${danger ? ' btn-ghost--danger' : ''}" ${attrs}>${label}</button>`;
 
+  // The GitHub repository half of an invite (watch-repo-invite.js): a separate door from
+  // the hall invite, and always read-only.
+  const repoInvite = window.OTBWatchRepoInvite.make({ api, API, postJson, $ });
+
   // =========================================================================
   // 1. GATE — access requests (pending)
   // =========================================================================
@@ -299,8 +305,10 @@
       '<label class="ov-field__l" for="gate-invite-login">Invite by GitHub username</label>' +
       '<input type="text" id="gate-invite-login" name="github_login" autocomplete="off" placeholder="e.g. octocat" maxlength="40">' +
       '</div>' +
+      repoInvite.formFieldsHtml() + // the GitHub repository is a separate door
       '<button type="submit" class="btn-accent">Invite</button>' +
       `<p class="ov-form__why">${escapeHtml(why)}</p>` +
+      repoInvite.explainerHtml() +
       '</form>'
     );
   }
@@ -337,11 +345,14 @@
       const login = ((input && input.value) || '').trim().replace(/^@/, '');
       if (!login) { toast('A GitHub username is needed.'); return; }
       const btn = form.querySelector('button[type="submit"]');
+      const repo = repoInvite.readForm(form);
       if (btn) btn.disabled = true;
       try {
         const r = await postJson('/access-requests/invite', { github_login: login });
         toast(r.already_invited ? `@${login} is already invited.` : `@${login} invited — their sign-in gets in.`);
+        const repoResult = repo.want ? await repoInvite.inviteToRepo(login) : null;
         await loadGate();
+        if (repoResult) repoInvite.showRepoNote(repoResult);
       } catch (err) {
         if (err && err.kind === '401') return;
         if (btn) btn.disabled = false;
@@ -493,7 +504,9 @@
     // the only move, so the row offers none.
     if (r.expired) return '';
     if (r.status === 'invited') {
-      return ghost(`data-gate-action="dismissed" data-gate-from="invited" data-id="${id}"`, 'Rescind', true);
+      // The GitHub repository is its own door: check where this person stands on it, and
+      // send (or re-send) a read-only invite. A Google-only member has no GitHub name.
+      return repoInvite.rowButtonHtml(r, ghost) + ghost(`data-gate-action="dismissed" data-gate-from="invited" data-id="${id}"`, 'Rescind', true);
     }
     if (r.status === 'dismissed') return '';
     return ghost(`data-gate-action="invited" data-id="${id}"`, 'Invite')
@@ -533,6 +546,7 @@
       vouchedHandleHtml(r, !!profile) +
       `<span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span>` +
       decided +
+      repoInvite.rowStateHtml(r) +
       '</div>' +
       '</div>' +
       (actions ? `<div class="ov-row__right"><div class="ov-row__actions">${actions}</div></div>` : '') +
@@ -638,6 +652,7 @@
     if (requests.length) {
       wireActions(target, '[data-gate-bulk]', (btn) =>
         inviteAll(String(btn.getAttribute('data-ids') || '').split(',').filter(Boolean)), 'Could not invite');
+      wireActions(target, '[data-gate-gh]', repoInvite.gateGithubStep, 'Could not check GitHub');
       wireActions(target, '[data-gate-action]', async (btn) => {
         const id = btn.getAttribute('data-id');
         const status = btn.getAttribute('data-gate-action');

package/modules/hall-ui/public/watch.states.json

@@ -1,6 +1,7 @@
 {
   "_": "Watch — the attention board behind requireGovernmentPage. The SEALED state (a viewer below the gate) is a real render, not an error page, so it is a state here. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once.",
   "page": "/builders/watch",
+  "modes": ["dark"],
   "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
   "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",

package/modules/hall-ui/public/welcome-boot.js

@@ -10,8 +10,9 @@
 // hall underneath.
 //
 // Rules:
-//   - A signed-in builder sees it once per LOCAL day, and again after every fresh sign-in (the
-//     sign-in click leaves a flag in localStorage that the return visit consumes). Storage that
+//   - A signed-in builder sees it once per LOCAL day. A fresh sign-in (the sign-in click leaves a
+//     flag in localStorage that the return visit consumes) opens on the game's start screen
+//     instead (task 1005143, shell-game.js); without that file it is greeted here as before. Storage that
 //     throws cannot remember, so such a browser is never shown it (it would replay on every visit).
 //   - A visitor who is not signed in sees the Welcome on Home, every visit, with a "Sign in with
 //     GitHub" button in place of the role choices. Only on Home, never over a deep link (#/task/N, #/idea/N).
@@ -73,11 +74,12 @@
 
   // ---------- the roles (the owner's mapping) ----------
   // `mode` is the craft mode the pick sets; `href` null means stay on Home.
+  // The game's three characters (task 1005141): Owner became Patron, and the
+  // ideator's and the artist's doors are one Artist door (the studio).
   var ROLES = [
-    { id: 'owner', label: 'Owner', room: 'City', href: '/city', mode: 'governing', dot: 'var(--accent)' },
-    { id: 'ideator', label: 'Ideator', room: 'Your thinking', href: '/thinking', mode: 'ideating', dot: 'var(--warn)' },
-    { id: 'artist', label: 'Artist', room: 'Studio', href: '/studio', mode: 'artistry', dot: '#f472b6' },
-    { id: 'engineer', label: 'Engineer', room: 'Home', href: null, mode: 'building', dot: '#60a5fa' },
+    { id: 'patron', label: 'Patron', room: 'City', href: '/city', mode: 'patron', dot: 'var(--accent)' },
+    { id: 'artist', label: 'Artist', room: 'Studio', href: '/studio', mode: 'artist', dot: '#f472b6' },
+    { id: 'artisan', label: 'Artisan', room: 'Home', href: null, mode: 'artisan', dot: '#60a5fa' },
   ];
   function rolesFor(craft) {
     return ROLES.filter(function (r) { return !craft || typeof craft.offered !== 'function' || craft.offered(r.mode); });
@@ -382,6 +384,13 @@
     } catch (_) { return false; }
     shown = true;
     var c = craft();
+    // A fresh sign-in opens on the game's start screen instead (task 1005143, shell-game.js): the
+    // same still behind it, and the craft picker asked once the world is showing.
+    var game = window.OTBShellGame;
+    if (fresh && game && typeof game.start === 'function' && game.start({
+      name: projectName(window.__BRANDING__), art: artFor(timeOfDay(now)),
+      done: function () { if (c && typeof c.onAccess === 'function') c.onAccess(access, builder); },
+    })) return true;
     if (c && typeof c.markAsked === 'function') c.markAsked();
     show(builder);
     return true;

package/modules/hall-ui/public/work-founding.states.json

@@ -1,6 +1,7 @@
 {
   "_": "Project founding mode (task 1004422) on an ordinary hall page: the founding band above the topbar and today's nav items asleep, rendered from a /me that says founding (kit fixture me-founding.json, the real server shaper's output at stage strategize). The page itself is work.states.json's; only the identity differs. The no-founding case is every other hall states file.",
   "page": "/builders/work",
+  "modes": ["dark"],
   "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
   "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",

package/modules/hall-ui/public/work.html

@@ -8,7 +8,7 @@
   <link rel="icon" href="/modules/ui-design/public/brand/favicon.svg" type="image/svg+xml">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <link rel="stylesheet" href="/builders/style.css?v=2026-11-11-helm">
   <!-- Page-local styles (task 2170) — extracted from the old inline <style>
        block per the hall placement rules; shared pager/count-pill styles now
        live in style.css's hall-kit section. -->
@@ -172,10 +172,10 @@
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/dom-utils.js?v=2026-11-05-numbers"></script>
-<script src="/builders/shell-game.js?v=2026-11-09-game-mode"></script>
+<script src="/builders/shell-game.js?v=2026-11-11-helm"></script>
 <script src="/builders/shell-trail.js?v=2026-11-05-numbers"></script>
-<script src="/builders/craft-mode.js?v=2026-11-05-goals"></script>
-<script src="/builders/shell.js?v=2026-11-09-game-mode"></script>
+<script src="/builders/craft-mode.js?v=2026-11-10-visor"></script>
+<script src="/builders/shell.js?v=2026-11-11-helm"></script>
 <script src="/builders/hall-dialog.js"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
@@ -192,7 +192,7 @@
 <script src="/builders/mine-lens.js" defer></script>
 <!-- the Completed tab's project-wide momentum card (window.OTBWorkSummary), carved out of work.js. -->
 <script src="/builders/work-summary.js" defer></script>
-<script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
+<script src="/builders/task-detail.js?v=2026-11-10-options" defer></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/bulk-toolbar.js" defer></script>
 <script src="/builders/work.js?v=2026-09-30-bulktoolbar" defer></script>

package/modules/hall-ui/public/work.states.json

@@ -1,6 +1,7 @@
 {
   "_": "The hall's Work Board through modules/ui-design/kit/render.js (task 1003304). Written with the re-skin so the board's four tabs and its selection state are measured at 1440/390/320 in both modes, not just looked at. The populated look is the hall-preview harness (scripts/hall-preview/server.js); this file is the FLOORS.",
   "page": "/builders/work",
+  "modes": ["dark"],
   "_storage": "The hall asks a first-visit question (the session mode picker, craft-mode.js) over every page; seeding \"already asked\" renders the page a returning builder sees (task 1005080).",
   "storage": { "session": { "hall-craft-asked": "1" } },
   "surface": "hall-ui",

package/modules/hall-ui/records/builders-roster.md

@@ -11,12 +11,12 @@ Pinned by `tests/hall_nav.mjs` (the Community group's middle id is `roster`) and
 
 ## The roles (task 1004437, WA6.RP07)
 
-Owner decision (b), 2026-09-30: the leaderboard gets BOTH a column naming each builder's roles and the Everyone / Engineers / Artists / Ideators toggle above it. The approved mock is `docs/design/mocks/profile-roles/` (`?state=board`, `?state=board-artists`).
+Owner decision (b), 2026-09-30: the leaderboard gets BOTH a column naming each builder's roles and the Everyone / Engineers / Artists / Ideators toggle above it (Everyone / Artisans / Artists since task 1005141, `roster.js` `ROLE_CHIPS`). The approved mock is `docs/design/mocks/profile-roles/` (`?state=board`, `?state=board-artists`).
 
 - **The roster now reads `GET /public/leaderboard`,** the list the status page reads, which carries each row's `roles` (`src/bongos/role-stats.js` `readRolesForBuilders`: the profile's own main/shown rules, two reads for the whole page) and, since this task, `karma`. The hall and the public page cannot rank a role differently. The authed `/leaderboard` is unchanged and no longer read by the hall.
 - **Roles column:** one pill per role in `roles.shown`, the main one a step stronger. `shown` is the main role plus every craft the builder has EARNED in, so it is evidence of work, not only a declared preference.
 - **The toggle** keeps the builders a craft is shown for and ranks them by the credits that craft earned (`roles.credits_by_craft`, in the row: ADR 0255). The place column becomes the place inside that craft, the credits header says "Credits as artist", and the karma/rank/tokens lenses still apply on top.
-- **Tokens only where they apply.** A builder with no recorded AI session (an artist in the studio, an ideator in the room) reads a dash, and the cell's tooltip says no AI sessions were recorded, instead of a 0 and a "0 tokens per credit" figure that read as "did nothing".
+- **Tokens only where they apply.** A builder with no recorded AI session (an artist in the studio or in the room) reads a dash, and the cell's tooltip says no AI sessions were recorded, instead of a 0 and a "0 tokens per credit" figure that read as "did nothing".
 - **Home's Standing card** reads the same list and adds "#N as an artist" beside "#N on the leaderboard" when the place inside the builder's main role differs from the overall one (`hall-render.js` `rolePlaceText`).
 - **The status page** names each builder's roles under their name, on that page's own palette (`status.js` `renderRoles`).
 

package/modules/hall-ui/records/craft-mode.md

@@ -4,10 +4,12 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 
 ## What it is
 
-- On entering the hall, once per browser session, a signed-in builder is asked **"What are you doing now?"**: Building, Artistry, Ideating or Governing. A fifth choice, **Legacy mode** (2026-10-01: the hall exactly as it was), was removed in task 1004567 (owner, 2026-10-04: "builder has all those tabs anyways"); a browser that still has `legacy` stored reads it as no mode, because `valid()` ignores any id that is not a mode. The approved prototype is the design canvas linked on the task; the doors carry its four scenes (the work desk, the night room, the sky, the governor city).
-- The answer is ONE attribute, `html[data-craft="building|artistry|ideating|governing"]`, readable by every hall page. Every change also fires `otb:craft` on `document` with `{ detail: { mode } }`, so a page can react without polling.
-- The top bar carries a switch with all four; pressing one changes the mode without a reload. Under 1180px it drops the words; at phone width only the current mode shows (or a "Choose your mode" button when there is none), and tapping it opens the picker.
-- Artistry is pre-selected for a builder whose `main_discipline` is `artist` (or, with no main role, whose first craft is).
+> **Renamed by task 1005141.** The four modes are three now: Building is **Artisan** (`artisan`), Artistry and Ideating are one **Artist** (`artist`), Governing is **Patron** (`patron`). A mode stored under an old id is read as the new one (`LEGACY_MODES`). Lines below that name the old modes are the record of what was built.
+
+- On entering the hall, once per browser session, a signed-in builder is asked **"What are you doing now?"**: Artisan, Artist or Patron (Building, Artistry, Ideating or Governing until task 1005141). A fifth choice, **Legacy mode** (2026-10-01: the hall exactly as it was), was removed in task 1004567 (owner, 2026-10-04: "builder has all those tabs anyways"); a browser that still has `legacy` stored reads it as no mode, because `valid()` ignores any id that is not a mode. The approved prototype is the design canvas linked on the task; the doors carry its four scenes (the work desk, the night room, the sky, the governor city).
+- The answer is ONE attribute, `html[data-craft="artisan|artist|patron"]`, readable by every hall page. Every change also fires `otb:craft` on `document` with `{ detail: { mode } }`, so a page can react without polling.
+- The top bar carries a switch with all three; pressing one changes the mode without a reload. Under 1180px it drops the words; at phone width only the current mode shows (or a "Choose your mode" button when there is none), and tapping it opens the picker.
+- Artist is pre-selected for a builder whose `main_discipline` is `artist` (or, with no main role, whose first craft is).
 
 ## The rules an edit here must keep
 
@@ -24,13 +26,13 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 ## The nav follows the mode (task 1004493)
 
 - **Each craft has a named tab list**, `MODE_TABS` in `craft-mode.js`, by NAV id. `ALWAYS_TABS` is the owner's list of tabs no mode may hide (2026-10-01: Builders, NAV id `roster`, first), and every mode's list is `ALWAYS_TABS` plus its own. No mode has no entry, so it shows every tab, as before.
-- **Government shows only in Governing**, and outside that group Governing is the shortest list (Blockers, Board Room). Building is every tab except Government and the Board Room; Artistry is Studio, Goals, Your thinking; Ideating is Sky, Your thinking, Goals. The prototype names rooms that do not exist yet (Store, Page reviews, Treasury); a list names only real NAV items, and `tests/craft_mode_nav.mjs` requires every NAV item to sit in some mode.
+- **Government shows only in Patron**, which leads with City and folds its other tabs under More (`MODE_LEAD`). Artisan is Goals, Goal map, Work, Blockers, Your thinking, Studio, Market Watch; Artist is Studio, Goals, Your thinking, Goal map, Market Watch (`MODE_TABS`). The prototype names rooms that do not exist yet (Store, Page reviews, Treasury); a list names only real NAV items, and `tests/craft_mode_nav.mjs` requires every NAV item to sit in some mode.
 - **The mode only ever takes away, and never through `hidden`.** The access gate owns `hidden`; `applyNav()` marks what the mode leaves out with `[data-craft-off]`, which `style.css` hides. So a mode can never show a tab the gate hid, and switching mode just moves the attribute. A group head goes too once nothing under it shows.
 - **Two callers.** `apply()` runs it on every mode change (live, no reload), and `shell.js` `applyAccess` runs it right after its gate loop, so a later `/me` answer (a promotion, a permission) brings a head back with its tabs. Hidden tabs still open by their URL; nothing is enforced (ADR 0016).
 
 ## Each mode's look (task 1004495)
 
-- **Three modes wear a look; Building and no mode wear none.** Artistry, Ideating and Governing each set `--craft` (where you are) and `--craft-on` (text on it) on `html[data-craft="<mode>"]`, with a dark twin on `html[data-theme="dark"][data-craft="<mode>"]` that also darkens the ground and tints the glass (Artistry, Ideating). Values and contrast are the direction's, `docs/design/craft-mode-direction.md`. No rule in `style.css` names `building`, and none matches any mode at all; `tests/craft_mode_looks.mjs` pins both, and re-measures every colour pair.
+- **Two modes wear a look; Artisan and no mode wear none.** Artist and Patron each set `--craft` (where you are) and `--craft-on` (text on it) on `html[data-craft="<mode>"]`, with a dark twin on `html[data-theme="dark"][data-craft="<mode>"]` that also darkens the ground and tints the glass. Values and contrast are the direction's, `docs/design/craft-mode-direction.md`. No rule in `style.css` names `artisan`, and none matches any mode at all; `tests/craft_mode_looks.mjs` pins both, and re-measures every colour pair.
 - **The accent stays the action colour.** `--craft` paints only the switch's current pill, the current tab (tint, icon, label, marker) and the top bar's hairline.
 - **Two pieces are drawn by `craft-mode.js` `applyLook()`, on every mode change:** the eyebrow beside `#topbar-title` (`LOOKS`: "the studio · night", "the sky", "the city"; hidden at <=640px, where it overflowed phones) and the scene plate under `.app-sidebar__brand` (40px closed rail, 64px open). The plate's markup IS `artHtml(mode)`, the picker's door art, exported rather than copied; light mode recolours it to each scene's day (the city is the dark one through `invert(1) hue-rotate(180deg)`). It does not animate.
 - **Always-present tabs widened** (owner, 2026-10-03): `ALWAYS_TABS` is Builders, Collab and Profile, so every mode keeps the You and Community groups.
@@ -38,7 +40,7 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 
 ## The paintbrush (task 1004497)
 
-- **Artistry carries two tools**: the palette (a feedback doc, `page-notes.js`, record `page-notes.md`) and the paintbrush (`paintbrush.js`). Both are `TOOLS` entries in `craft-mode.js` and load their own script on first press.
+- **Artist carries the palette and the paintbrush** (and the lightbulb, below): the palette (a feedback doc, `page-notes.js`, record `page-notes.md`) and the paintbrush (`paintbrush.js`). Both are `TOOLS` entries in `craft-mode.js` and load their own script on first press.
 - **The paintbrush edits the page's own words where they stand, as a REAL wording change** (owner, 2026-10-04): it is the copy desk's page round, the same one the tweak editor and the studio's own words write (ADR 0341). Pressing it reads `GET /copy-desk/pages/builders:<page>/draft`; a page nobody holds is OFFERED, never taken silently (taking it is the copy desk's artists-only claim, and the page shows as being tweaked while held). Typing saves the whole draft; "Review" lists every change as was/now; "Send for approval" submits the round. It never writes `page-notes` (owner: kept separate from the feedback docs).
 - **Only a leaf element inside `<main>` whose words are one reading line becomes editable.** Shared chrome, a line with a `{…}` hole, controls (`button`, form fields, `code`), and anything hidden stay as they are; the bar counts the lines it cannot reach and links to the tweak editor for them. A click on edited words inside a link does not navigate.
 - **Nobody else's view changes, and neither does yours once editing ends**: "Stop editing" and "Send" both put the page's own words back. The draft stays on the round.
@@ -47,20 +49,20 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 
 ### Removing a line, and the artist review alongside (task 1004696)
 
-- **An artist can recommend removing a line** (owner, 2026-10-09: pages carry superfluous subtitles and text). The line the artist is in shows in the bar with **Remove this line**; emptying a line's words and leaving it does the same. A removed line shows the page's own words struck through and faded, is no longer typed into but stays focusable, and **Keep this line** puts it back. Review lists it as its own "Remove" row and says it goes to an engineer. It is saved as `{ key, remove: true }` (the copy desk's rule, `modules/copy-desk/CLAUDE.md`), so the send files an engineer task to take it out.
+- **An artist can recommend removing a line** (owner, 2026-10-09: pages carry superfluous subtitles and text). The line the artist is in shows in the bar with **Remove this line**; emptying a line's words and leaving it does the same. A removed line shows the page's own words struck through and faded, is no longer typed into but stays focusable, and **Keep this line** puts it back. Review lists it as its own "Remove" row and says it goes to an engineer. It is saved as `{ key, remove: true }` (the copy desk's rule, `modules/copy-desk/CLAUDE.md`), so the send files an artisan task to take it out.
 - **The artist review is one press away**: **Artist review** in the editing bar saves the words and opens the palette's sheet (`page-notes.js`, loaded on demand like a tool) over the page; editing carries on when it closes. Once the words are sent, the bar asks "Review how this page looks too?" with **Start an artist review** (closes the bar, opens the sheet) and **Not now**. The paintbrush still writes no feedback doc itself: `tests/paintbrush.mjs` allows `page-notes.js` as the only page-notes name in the file.
 
 ## The lightbulb (task 1004498)
 
-- **Ideating carries one tool, the lightbulb** (`lightbulb.js`, a `TOOLS` entry loaded on first press). Its button wears its own note glyph, not the mode's lightbulb, so it is never read as the Ideating pill beside it (owner, 2026-10-04). It is a watered-down palette: the same side sheet and `.pn` styles, text only, no uploads.
-- **Only the ideas remain** (owner, 2026-10-04). `POST /page-notes/ideas` splits the notes with the palette's AI split (ideator wording, one idea if the split cannot run) and files each idea under the ideator, its body ending in a link to the page. Nothing else is stored: no doc row, no reference doc. The split answers inside the request, so it gives up after 45 seconds and files the notes whole.
+- **The lightbulb** (`lightbulb.js`, a `TOOLS` entry loaded on first press) was Ideating's one tool and is the Artist's third since task 1005141. Its button wears its own note glyph, not the mode's lightbulb, so it is never read as the Ideating pill beside it (owner, 2026-10-04). It is a watered-down palette: the same side sheet and `.pn` styles, text only, no uploads.
+- **Only the ideas remain** (owner, 2026-10-04). `POST /page-notes/ideas` splits the notes with the palette's AI split (the notes wording, once the ideator's; one idea if the split cannot run) and files each idea under its author, its body ending in a link to the page. Nothing else is stored: no doc row, no reference doc. The split answers inside the request, so it gives up after 45 seconds and files the notes whole.
 - **The panel lists the ideas already filed from this page** (`GET /page-notes/ideas?page_path=`): open and promoted ideas whose body carries the page's link, from the lightbulb (`](/page)`) or the palette (`](/page?note=`). That link is the only record of where an idea came from, so `notes.pageLinks` and the two idea bodies are pinned together in `tests/lightbulb.mjs`.
 - **Unsent text waits in this browser only**, per page (`localStorage 'hall-lightbulb:<path>'`), and is forgotten once it files.
 - `tests/lightbulb.mjs` runs the real routes and the real script over a small DOM.
 
 ## Artist review mode (task 1004686)
 
-- **Review is a split pill** (owner, 2026-10-09): pressing Review still opens the feedback doc; hovering it with a mouse, or pressing its chevron, opens a menu: "Write feedback on this page", then the four experiences in the owner's order and words (Ideator, Governing, Building, Artistry experience), then "Stop reviewing" while a review is on. Hover is asked of the pointer (`pointerType === 'mouse'`), never `(hover: hover)`: a touch laptop can report no hover at all. On a phone (<=640px) the chevron folds away and a tap on Review opens the menu.
+- **Review is a split pill** (owner, 2026-10-09): pressing Review still opens the feedback doc; hovering it with a mouse, or pressing its chevron, opens a menu: "Write feedback on this page", then the experiences in the owner's order (Ideator, Governing, Building, Artistry experience when written; since task 1005141 three: Patron, Artisan, Artist experience), then "Stop reviewing" while a review is on. Hover is asked of the pointer (`pointerType === 'mouse'`), never `(hover: hover)`: a touch laptop can report no hover at all. On a phone (<=640px) the chevron folds away and a tap on Review opens the menu.
 - **Picking one makes the hall wear that mode** (`html[data-craft]`, so its tabs, look, eyebrow and tallies follow) and stamps `html[data-craft-review]`. The artist's own mode stays Artistry: `sessionStorage['hall-craft-review']` holds the experience for the session only, and is ignored unless the mode is Artistry. Choosing any mode from the switch or the picker ends it. The artist keeps Review and Edit words; the experience's own tools follow them, marked `craft-tool--guest` so a phone under 360px can fold them away (three tools pushed 320px 36px sideways; Artistry alone overflows 4px there today, before and after).
 - **The scribble wall** (`craft-review.js`, loaded on demand; `craft-review.css`, imported by `style.css`): a flexible box in the top bar's empty space where a pen tip scribbles six small doodles in the sky's hand (thinking.css: hairlines, stars, a dashed orbit, a constellation, a crescent, a shooting star, a looped scribble, sparks), each at its own spot and height, a new one every 5s of a 30s round and each up about 10s, so two or three show at once. **Ink alone** (owner, 2026-10-09, after a first cut of big painted colour tags: "small black white graffiti scribbling"): every mark is `--ink`, black on the light bar and white on the dark, with the sky's fainter ladder for trails and orbits; the test holds the wall section to that one token. No doodle is wider than 56px or taller than 24px; the two widest fold away on a wall under 58px (Governing at 1440px keeps about 60), all of them under 34px and on a phone. The wipe is two opposite `translateX` moves, so every motion is transform or opacity in CSS, and the kill switch leaves three doodles standing, finished, with no pen. A doodle not yet begun keeps its pen unseen (`gx-track` starts at opacity 0), or each waiting tip shows as a stray dot.
 - **An @import lands before style.css's own rules**, so a rule in `craft-review.css` that restyles `.craft-tool` needs two classes, or `.craft-tool` silently wins (it did, for the reviewing wash and the guest fold, until measured).

package/modules/hall-ui/records/game-mode.md

@@ -7,7 +7,7 @@ Covers: every shelled hall page (`shell-game.js`, `shell.js`). Spec: `docs/specs
 - **Game mode is the existing full-screen switch, made hall-wide. There is no second full-screen mode.** The switch was already on every page (task 1004430) but remembered per page, so a reader had to turn it on 33 times. Game mode is one `localStorage` key, `hall-game`; while it is `on`, `shell.js` `storedFullscreen()` answers yes for every page, whatever that page remembers. What hides, the corner button and the Escape hand-off are the shell's, unchanged.
 - **`shell-game.js` holds the mode and nothing else**: `window.OTBShellGame` = `on()`, `set(bool)`, `hint()`. It stamps `html[data-game="on"]` for a sheet or script that wants to read the mode. `shell.js` reads it through a fallback object, so a page without the file is never in game mode. It is its own file because `shell.js` sits on the 1,500-line ratchet; the start screen and options menu (R03, R04) are expected to grow here, not in `shell.js`.
 - **Load order**: `shell-game.js` before `shell-trail.js` / `craft-mode.js` / `shell.js`, loaded the same way (deferred or not) as the shell on that page. Test-pinned.
-- **Leaving is for this page load only.** In game mode the corner button and Escape bring the bars back, and nothing is written: the next page opens without them again, and a page's own `hall-fullscreen:<page>` memory is never overwritten. Turning game mode off (`set(false)`) hands each page back what it remembered. `OTBShell.setFullscreen(null)` is the "re-read what should show" call `set()` uses.
+- **Leaving is for this page load only.** In game mode the corner button brings the bars back (Escape did too until task 1005144; it opens the options menu now), and nothing is written: the next page opens without them again, and a page's own `hall-fullscreen:<page>` memory is never overwritten. Turning game mode off (`set(false)`) hands each page back what it remembered. `OTBShell.setFullscreen(null)` is the "re-read what should show" call `set()` uses.
 - **No page may opt out.** `<body data-fullscreen-switch="off">` would keep that page's sidebar in game mode; the test fails on one. A new hall page needs `#app-topbar` and the `shell-game.js` tag, like the rest.
 - **The "how to leave" line shows once per tab in game mode** (`sessionStorage 'hall-game-hint'`), not on every page load. Outside game mode the shell's rule is unchanged.
 - **How it is turned on today**: `?game=on` / `?game=off` on any hall URL, or `OTBShellGame.set()`. Nothing in the hall's interface sets it yet; the start screen (R03) is where that lands.
@@ -15,6 +15,6 @@ Covers: every shelled hall page (`shell-game.js`, `shell.js`). Spec: `docs/specs
 ## For the tasks after this one
 
 - A HUD or options menu that wants Escape must call `preventDefault()` on the press. `shell.js` `onFullscreenKey` waits one tick before leaving so a listener added after it still wins.
-- Until the options menu exists, Escape is the only way to reach navigation in game mode. Do not remove it before R04 lands.
+- Since R04 (task 1005144, ADR 0401) the last Escape in game mode opens the options menu (`shell-game.js` `onEscape`), and on the menu it closes it again. The corner button is still the way back to the bars.
 
 Tests: `tests/hall_fullscreen.mjs` (the eight `game mode:` cases run the real `shell-game.js` + `shell.js`), and the script lists in `tests/hall_city.mjs`, `tests/hall_street.mjs`, `tests/hall_my_agents.mjs`, `tests/goal_map_page.mjs`.

package/modules/hall-ui/records/governor-street.md

@@ -29,7 +29,7 @@ Files: `street-inside.js` (`window.GovInside`, node-require-safe, pure): the pro
 - **The lift and the flip.** The lift is one node kept across draws, so picking a floor slides it by a CSS transform transition; the chosen floor's block is two blocks that take turns (`flipA` / `flipB`), so it re-enters on every pick. Both are dead under reduced motion.
 - **Change how this works** is present and honest: pressed, it says drafting an amendment from here is not built yet (task 1004530 wires it).
 - **No "on the table here" list.** The prototype's list of the building's open matters was removed on the owner's direction (task 1004565): the floor desks carry every matter as an actionable row, so the list was duplication. Inside a building a matter is its desk row; the short card opens from the street's pins.
-- **Districts.** The goal's tasks (`GET /tasks?goal_id=N`, read once per goal): shape from the discipline (tower engineer, studio artist, glass front UI, pavilion ideator; none is a tower), stage from the status (backlog and blocked a staked plot, ready a slab, active a scaffold, completed and confirmed built with a flag, shipped lit), label the kind; height from the estimate. Up to ten stand on the road, work in flight first; the rest are counted with a link to the goal. Each one opens its task.
+- **Districts.** The goal's tasks (`GET /tasks?goal_id=N`, read once per goal): shape from the discipline (tower artisan, studio artist, glass front UI; none or any other is a tower; the ideator's pavilion went with task 1005141), stage from the status (backlog and blocked a staked plot, ready a slab, active a scaffold, completed and confirmed built with a flag, shipped lit), label the kind; height from the estimate. Up to ten stand on the road, work in flight first; the rest are counted with a link to the goal. Each one opens its task.
 - **Narrow.** Under 900 px the board becomes a column: the drawing in its own sideways strip (never scaled under 0.6, so a floor stays a 24 px target), then the panel.
 
 Tests: `tests/hall_street_inside.mjs` runs the prototype's own `Component` beside `street-inside.js` on the prototype's sample floors and holds every building's section, panel bindings and every district equal to it in both modes, then the docket rules (no invented numbers) and the page in a vm (the persistent lift, the flip, the drawers, the amendment note, the card from a table row, back to the street, a district's tasks). The states file renders every building, a floor pick, the amendment note and a district.

package/modules/hall-ui/records/home-city.md

@@ -87,6 +87,8 @@ the builder's Home. Steps 2–4 (the ideator's sky, the artist's gallery, the st
 
 ## v16 step 2 — the ideator's sky (task 1005059)
 
+> **Not drawn since task 1005141.** The Ideating mode folded into Artist, so `home-city.js` `craft()` never answers `ideating` and every craft lands in the city; the sky is a door away (Your thinking). The branch and `skySvg` are kept so the sky can come back as its own view. What follows is the record of what step 2 built.
+
 The mock is [`v16-ideating.html`](../../../docs/design/mocks/hall/home/v16-ideating.html). While the craft is
 **Ideating** (`OTBCraftMode.current()`, redrawn on `otb:craft`) the same widget, from the same one read, draws
 `home-city-draw.js` `skySvg` instead of the city. Every other craft keeps the builder's city untouched.
@@ -108,7 +110,7 @@ The mock is [`v16-ideating.html`](../../../docs/design/mocks/hall/home/v16-ideat
   new idea (these two weeks) that is open, in no area, not the viewer's, and not yet voted on by them. In the
   week an idea became work it falls into its tower; after that it lights a window there. The moon is the
   version, its phase what the areas have shipped over every task under them (`version.tasks`).
-- **The ladder** ranks the week's ideators: ideas filed, idea votes cast, and ideas of theirs that became work.
+- **The ladder** (in the dormant sky view) ranked the week's ideators: ideas filed, idea votes cast, and ideas of theirs that became work.
 - **The read stays one and bounded.** `GET /home/city` adds these fields to the ideas list it already sent
   (still newest first, at most 120 rows), plus idea votes per builder per week and a per-area task count.
   The `ideas_votes` table is probed first, so a project with the ideas module off answers without votes.

package/modules/hall-ui/records/market-watch-settings.md

@@ -1,5 +1,7 @@
 # Market Watch settings, the owner's Settings tab on /market-watch (task 1004938; a tab since task 1005045)
 
+**Since task 1005144 (ADR 0401) the settings are an options menu entry, not a tab.** The menu opens `/market-watch?embed=1#settings` in its frame and the page shows `#mw-panel-settings` alone; a plain visit is the watch with no tab strip and no settings read, an old `/market-watch#settings` link `location.replace`s to `/settings?open=market-watch`, and `/market-watch-settings` 302s to the same entry (`RETIRED_TO_OPTIONS`). The owner check moved with it: the menu lists the entry for an archon, and the four routes stay the wall. The tab-era notes below are history; see `records/options-menu.md`.
+
 **Since task 1005045 (owner decision 2026-11-03, idea 1001310) this is a tab, not a page.** The sidebar showed "Market Watch" twice — the page and these settings — so the settings page is gone and its markup is the `#mw-panel-settings` panel in `market-watch.html`. What that move settled:
 
 - **Only the owner gets the strip.** `market-watch.js` adopts the shell's one `/me` read (`window.__hallReads`, no second request); for an archon it builds two kit tabs (`watch`, `settings`, `hash: true`) and calls `OTBMarketWatchSettings.load()`. Anyone else gets no tab strip at all, and their page never asks for the settings. An unreadable `/me` is not an owner. Cosmetic only: the four routes below are still the wall (ADR 0016).

package/modules/hall-ui/records/options-menu.md

@@ -0,0 +1,15 @@
+# The options menu — Settings, and the six screens it opens (task 1005144, BONGOS-V3 R04; ADR 0401)
+
+Every setting and configuration is reached from one vertical, grouped menu with a search box at the top. The menu IS `/settings`; the profile chip opens it and says "Options".
+
+- **Two kinds of entry** (`options-menu.js` `MENU`). *Native* entries are Settings' own groups (`data-group` in `settings.html`): Account, Access and keys, Preferences, Sound, Software update, Extensions (only when a module contributed a panel). *Embedded* entries open an old page in an `<iframe>` of its address with `?embed=1`: Your agents (`/my-agents`), Project settings, Modules, Permissions and constitution (`/government`), Market Watch settings (`/market-watch#settings`) and Market Watch rules. A frame is created the first time its entry opens, never at boot.
+- **Who sees an entry** is the rank key the old sidebar item used (`signed`, `member`, `government`, `archon`), plus a module gate (`market-watch`). Cosmetic: each framed page keeps its server page gate and its routes.
+- **The search** (`search()`, pure) matches every typed word against a line's label, its `words`, its entry and its group. Each entry can list `anchors` (CLI access, How Claude talks to you, …) so a search lands on the exact place; Enter opens the first line, so the ranking puts a label hit first, then the exact place above the group that merely holds it.
+- **Addresses.** `/settings#<entry>` or `/settings?open=<entry>#<anchor>`; a panel anchor (`#cli`, `#art-key`) still lands as before. The address follows what is open (`replaceState`), and `?from=` survives switches so closing returns.
+- **Embedded pages** (`shell-game.js`, only inside a frame): `html[data-embed="on"]` hides the sidebar, scrim, foot and top bar; the full-screen switch is off; an unused Escape goes to the menu; a link to another page opens in the whole window. A link on the menu's own panels to an old page (Settings' "these moved to My agents" lines) opens that entry in place instead.
+- **Old addresses** 302 to the menu (`serve-internal.js` `RETIRED_TO_OPTIONS`, the twin of `options-menu.js` `RETIRED`); `?embed=1` passes through, except for `/market-watch-settings`, which has no page left.
+- **Game mode.** The last Escape on any page opens the menu (`/settings?from=…`); on the menu or in a frame it closes it. Outside game mode the menu is a page like any other.
+- **Layout.** The rail is sticky beside the open screen and scrolls itself; a frame fills the column to the window's foot. Below 860px the menu stacks above the screen, and choosing an entry scrolls the screen up clear of the top bar.
+- **Left the sidebar:** My agents, Project settings, Permissions, Modules (and their glyphs). The palette's agent rows open the menu; its Government rows are gone.
+- **Tests:** `tests/hall_options_menu.mjs` (the catalogue, gates, search, addresses, both redirect maps, the embedded page, game-mode Escape); `tests/hall_fullscreen.mjs` (Escape in game mode); `tests/market_watch_pages.mjs` (the settings panel in the frame).
+- **Known:** sounds are switched off (task 1004554), so the Sound entry shows its note, not a toggle.