@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.20

package/dist/ui/shared/app.js

@@ -8,11 +8,11 @@
 // #1665 first: the host's preferences go into this browser's cache before any module below reads its key.
 import { bootPrefs } from "./app-prefs.js";
 import { html, render } from "./app-html.js";
-import { Shell, handleKey, showDialog, closeDrawer, openDrawer, shellStore, retryable, setNewInstanceOpener } from "./app-shell.js";
+import { Shell, handleKey, handleSearchKey, showDialog, closeDrawer, openDrawer, shellStore, retryable, setNewInstanceOpener } from "./app-shell.js";
 import { installSwipe } from "./app-swipe.js";
 import { startRouter, navStore, navigate } from "./app-nav.js";
 import { createStream } from "./app-stream.js";
-import { appStore, applyStatus, applyActivity } from "./app-store.js";
+import { appStore, applyStatus, applyActivity, guestPage } from "./app-store.js";
 import { chatPath } from "./app-route.js";
 import { startNeedsNotifier } from "./app-needs.js";
 import { toast } from "./ui-toast.js";
@@ -29,6 +29,9 @@ initUsageRail();
 // session-only panel, nothing under /ui/ is ever imported or read (#1408 §3).
 const mode = boot.mode === "view-only" ? "view-only" : "full";
 appStore.set({ viewOnly: mode === "view-only" });
+// #1920 phase 3: a guest's page has its chats and nothing else — no panel, notifier, theme list or owner CSS a guest
+// would be refused.
+const guest = guestPage();
 
 // A failed load can be retried (the panel's Retry): each retry asks for a fresh URL, since a browser may keep a failed
 // module import cached under the first one. boot() runs once, whichever attempt succeeds.
@@ -80,19 +83,24 @@ if (mode === "full") {
   // a boot import that failed before the Outlet first asked would be retried at once, depending on timing.)
   let chatLoads = 0;
   panels.set("chat", { load: () => (chatLoads++ === 0 ? chatBoot : loadChat()).then((m) => m.ChatPanel) });
-  panels.set("fleet", { load: () => loadFleet().then((m) => m.FleetPanel) });
-  panels.set("settings", { load: () => loadSettings().then((m) => m.SettingsPanel) });
-  panels.set("needs", { load: () => loadNeeds().then((m) => m.NeedsPanel) });
-  // #1523 N2: one instance's Details (/ui/fleet/agent/<name>).
-  panels.set("details", { load: () => loadDetails().then((m) => m.DetailsPanel) });
-  // #1218: one instance's Log (/ui/log/<name>).
-  panels.set("log", { load: () => loadLog().then((m) => m.LogPanel) });
-  // #1386 §6.3: desktop notifications for new "Needs you" items, in any panel, while this signed-in page is open.
-  startNeedsNotifier({ open: (instance) => navigate(chatPath(instance)) });
+  if (!guest) {
+    panels.set("fleet", { load: () => loadFleet().then((m) => m.FleetPanel) });
+    panels.set("settings", { load: () => loadSettings().then((m) => m.SettingsPanel) });
+    panels.set("needs", { load: () => loadNeeds().then((m) => m.NeedsPanel) });
+    // #1523 N2: one instance's Details (/ui/fleet/agent/<name>).
+    panels.set("details", { load: () => loadDetails().then((m) => m.DetailsPanel) });
+    // #1218: one instance's Log (/ui/log/<name>).
+    panels.set("log", { load: () => loadLog().then((m) => m.LogPanel) });
+    // #1386 §6.3: desktop notifications for new "Needs you" items, in any panel, while this signed-in page is open.
+    startNeedsNotifier({ open: (instance) => navigate(chatPath(instance)) });
+    // #2233: a backend sign-in running anywhere is shown on every admin page (the module lives behind the session gate).
+    import("/ui/js/backend-signin.js").then((m) => m.installSignIn(), () => {});
+  }
   // #1665: this device's first upload of its own choices (once), then another device's changes at each status frame.
+  // A guest's page only reads them (prefsWritable is false there).
   bootPrefs();
-  // #1629: agents' themes, read when the status frame's themes_rev moves.
-  startThemes();
+  // #1629: agents' themes, read when the status frame's themes_rev moves (a guest's frames never carry it).
+  if (!guest) startThemes();
   onNewInstance = async () => {
     closeDrawer();                                 // on a phone the dialog opens from the drawer: the drawer goes first
     let m;
@@ -103,8 +111,9 @@ if (mode === "full") {
 } else appStore.set({ connection: "none" });
 
 startRouter(window);
-// #1629 r4 §3: the person's owner CSS (full app only; never on Settings, in safe mode or where this device turned it off).
-installOwnerCss();
+// #1629 r4 §3: the person's owner CSS (full app only; never on Settings, in safe mode or where this device turned it off;
+// never a guest's — owner CSS is an admin's).
+if (!guest) installOwnerCss();
 // /ui on its own opens the chat this browser had open last (an unknown name shows the panel's "not found").
 {
   const r = navStore.get().route;
@@ -114,6 +123,8 @@ installOwnerCss();
 }
 
 document.addEventListener("keydown", handleKey);
+// #2293: Ctrl+K / ⌘K (and Ctrl+F in a chat) — an admin's full app only; the server refuses a guest's search anyway.
+if (mode === "full" && !guest) document.addEventListener("keydown", handleSearchKey);
 // #1605: on a phone (the sidebar is a drawer), swipe right in the main area to open it, left to close it — the same
 // open/close as ☰ and the scrim. Nothing that owns a sideways drag (code, tables, the terminal, inputs, dialogs) and
 // never the left edge (iOS: "back").

package/dist/ui/shared/card-strings.js

@@ -11,8 +11,12 @@ register("card", {
     sizeSName: "Small", sizeMName: "Medium", sizeLName: "Large",
     byHuman: "set by a person",
     byAgent: "set by the agent",
+    menu: "Identity card",
     show: "Show card",
     hide: "Hide card",
+    showRow: "Show picture and bio",
+    bannerSafe: "Every screen",
+    bannerPhone: "Phone · M card",
   },
   "zh-TW": {
     label: "{0} 的身分卡",
@@ -22,7 +26,11 @@ register("card", {
     sizeSName: "小", sizeMName: "中", sizeLName: "大",
     byHuman: "由人設定",
     byAgent: "由 agent 設定",
+    menu: "身分卡",
     show: "顯示卡片",
     hide: "隱藏卡片",
+    showRow: "顯示小圖和介紹",
+    bannerSafe: "所有螢幕",
+    bannerPhone: "手機 · 中卡片",
   },
 });

package/dist/ui/shared/effect-app-runtime.js

@@ -1,4 +1,5 @@
 /** #1629: app-owned pool; Chat contributes a lease, never another registry/loader. */
+import { effectPlaybackReason, EFFECT_BLOCK_REASONS } from "./effect-policy.js";
 import { createEffectTrialSource } from "./effect-trial-source.js";
 import { createOwnerEffectSource } from "./effect-owner-source.js";
 import { createEffectRuntimeLoader } from "./effect-runtime-loader.js";
@@ -6,7 +7,7 @@ import { createEffectRegistry } from "./effect-registry.js";
 import { createEffectSafety } from "./effect-safety.js";
 import { stockEffectTrust } from "./effect-stock-trust.js";
 import { createEffectProfileCollector } from "./effect-profiles.js";
-import { chatEffectIdentity, createEffectWriter } from "./effect-chat-runtime.js";
+import { effectPlaybackIdentity, createEffectWriter } from "./effect-chat-runtime.js";
 
 const episodes = new WeakSet();
 
@@ -14,7 +15,8 @@ const episodes = new WeakSet();
 export function createAppEffectRuntime({ window: host, current, observe, onChange = () => {}, onDispose = () => {}, resolveOwnerTarget = null, onOwnerUnavailable = () => {}, factories = {} }) {
   let dead = false, error = null, loader = null, registry = null, writer = null, source = null, personal = null, trial = null, pending = null, lastMetadata = null, serial = 0, revision = 0, stamp = null, syncing = false, queued = false;
   const bindings = new Map(), profiles = new Map();
-  const identity = chatEffectIdentity(host), auth = host?.AgendAuth;
+  let lastContext = null, playbackUnavailable = null;
+  const identity = effectPlaybackIdentity(host), auth = host?.AgendAuth;
   const safe = fn => { try { return fn(); } catch { return null; } };
   const alive = () => { if (dead) return false; const value = safe(() => current() === true && !auth.sessionEnded()); return !dead && value === true; };
   const sourceAlive = s => {
@@ -25,15 +27,49 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
   const placementIdentity = p => JSON.stringify([p.by, p.manifest.layer, p.params]);
   const clock = () => host.performance.now();
   let offAuth = null;
-  const snapshot = s => ({ error: error ?? s?.error ?? null, rows: registry?.snapshot().filter(row => s?.bindings.get(row.id)?.key === row.key) ?? [], effects: s?.metadata?.effects ?? [], loading: !!s && !s.dead && s.metadata === null && !s.error });
+  const snapshot = s => {
+    const effects = s?.metadata?.effects ?? [], known = registry?.snapshot?.() ?? [];
+    const rows = effects.map(p => {
+      const b = s.bindings.get(p.id), row = known.find(r => b && r.key === b.key && r.id === p.id);
+      if (row && !s.error && !playbackUnavailable) return row.reason == null && row.phase == null ? { ...row, phase: "loading" } : row;
+      return { id: p.id, key: b?.key ?? null, verdict: "off", phase: null, quality: null,
+        reason: s.error ?? playbackUnavailable ?? effectPlaybackReason(lastContext) ?? (!p.manifest.regions.includes("chat") ? "region_unavailable" : "runtime_unavailable") };
+    });
+    return { error: error ?? s?.error ?? null, rows, effects, loading: !!s && !s.dead && s.metadata === null && !s.error };
+  };
   function tell() {
     const s = source, value = snapshot(s); if (dead) return;
-    if (sourceAlive(s)) safe(() => s.onChange(value));
+    if (sourceAlive(s)) {
+      const next = JSON.stringify(value);
+      if (next !== s.lastSnapshot) { s.lastSnapshot = next; safe(() => s.onChange(value)); }
+    }
     if (!dead) safe(() => onChange(snapshot(source)));
   }
+  function reportPlayback(s) {
+    if (!sourceAlive(s) || identity.scope !== "owner") return;
+    const now = safe(clock);
+    if (!Number.isFinite(now) || now < 0 || s.reportClock !== null && now < s.reportClock) { s.reporter.dispose(); return; }
+    s.reportClock = now;
+    const value = snapshot(s);
+    for (const id of s.reported.keys()) if (!value.effects.some(p => p.id === id)) s.reported.delete(id);
+    for (const row of value.rows) {
+      if (!sourceAlive(s)) return;
+      const status = row.phase === "running" && row.reason == null ? "playing" : "blocked";
+      const reason = status === "playing" ? null : EFFECT_BLOCK_REASONS.includes(row.reason) ? row.reason : "unknown";
+      const device = lastContext?.constrained === true ? "constrained" : "standard";
+      const next = JSON.stringify([status, reason, device]), last = s.reported.get(row.id);
+      if (last && (now - last.at < 10000 || next === last.value && now - last.at < 60000)) continue;
+      s.reported.set(row.id, { at: now, value: next });
+      void s.reporter.post(`/ui/effects/profile/${row.id}?instance=${encodeURIComponent(s.name)}&ownerEpoch=${identity.epoch}`,
+        { v: 1, kind: "playback", device, status, reason });
+    }
+    // No server polling or unbounded retries: at most one observation per effect / 10s, a 60s heartbeat.
+    if (sourceAlive(s)) s.reportTimer = host.setTimeout(() => reportPlayback(s), 10000);
+  }
   function discard(s) {
     if (!s || s.dead) return;
     s.dead = true; s.generation++; s.metadata = null;
+    safe(() => host.clearTimeout(s.reportTimer)); safe(() => s.reporter?.dispose());
     if (source === s) source = null;
     safe(() => trial?.stopFor(s));
     for (const b of s.bindings.values()) bindings.delete(b.key); s.bindings.clear();
@@ -63,7 +99,7 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
     writer = createEffectWriter(host, alive);
     loader = make("loader", createEffectRuntimeLoader)({ window: host, ownerEpoch: identity.epoch, current: alive, onRevoke: () => fail("runtime_unavailable") });
     if (!loader.ok || typeof loader.placementsSettled !== "function" || typeof loader.resourceSettled !== "function") throw Error("runtime_unavailable");
-    registry = make("registry", createEffectRegistry)({ window: host, origin: host.document.body.dataset.previewOrigin, boot: host.document.body.dataset.previewBoot,
+    registry = make("registry", createEffectRegistry)({ window: host, origin: host.location?.origin, boot: host.document.body.dataset.effectBoot,
       load: async (descriptor, signal) => {
         const b = bindingFor(descriptor.key, descriptor.id);
         if (!bindingAlive(b) || descriptor.id !== b.id || signal.aborted) return null;
@@ -78,7 +114,7 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
       stockSnapshot: ({ frameRoot }) => make("stock", stockEffectTrust)(host, { frameRoot, ownerCss: observe().ownerCss }),
       onChange() { try { tell(); emit(); } catch { fail("runtime_unavailable"); } },
       onMount(owner) {
-        const b = bindingFor(owner.key, owner.id); if (!bindingAlive(b) || b.id !== owner.id || !owner.current()) return;
+        const b = bindingFor(owner.key, owner.id); if (identity.scope !== "owner" || !bindingAlive(b) || b.id !== owner.id || !owner.current()) return;
         const collector = make("collector", createEffectProfileCollector)({ key: owner.key, id: owner.id, device: owner.device, clock });
         const began = safe(clock);
         if (collector.ok && Number.isFinite(began) && began >= 0 && bindingAlive(b) && owner.current()) profiles.set(owner, { binding: b, collector, began, attempted: null }); else collector.dispose?.();
@@ -95,17 +131,23 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
         void writer.post(`/ui/effects/profile/${owner.id}?${query}ownerEpoch=${identity.epoch}`, report.profile);
       }, clock,
     });
-    if (!registry.ok) throw Error("runtime_unavailable");
-    trial = make("trialSource", createEffectTrialSource)({ window: host, current: () => {
+    if (!registry.ok) {
+      // Keep authenticated placement metadata available for explanations. This inert adapter cannot create,
+      // load, resume, send to, or authorize a frame; a failed paint subsystem is never permission.
+      playbackUnavailable = "unsupported_host";
+      safe(() => registry?.dispose?.());
+      registry = { ok: true, frameRoot: null, update() {}, snapshot: () => [], publish() {}, resume: () => false, dispose() {} };
+    }
+    if (identity.scope === "owner") trial = make("trialSource", createEffectTrialSource)({ window: host, current: () => {
       if (!alive()) return false; const v = observe(), c = v.context;
-      return alive() && v.ownerCss === "off" && c.enabled === true && c.show === true && c.previewReady === true && c.optIn === true
-        && c.safe === false && c.publicLink === false && c.reducedMotion === false && c.saveData === false && c.hidden === false;
+      return alive() && c.enabled === true && c.show === true && c.transportReady === true
+        && c.safe === false && c.publicLink === false && c.reducedMotion === false && c.hidden === false;
     }, ownerCurrent: (s, name) => sourceAlive(s) && s.name === name,
       stock: () => registry.frameRoot ? make("stock", stockEffectTrust)(host, { frameRoot: registry.frameRoot, ownerCss: observe().ownerCss }) : null,
       readResource: (spec, signal) => typeof loader.trialResourceSettled === "function" ? loader.trialResourceSettled(spec, signal) : Promise.resolve(null),
       onChange() { revision++; stamp = null; sync(); tell(); },
     });
-    if (typeof resolveOwnerTarget === "function") {
+    if (identity.scope === "owner" && typeof resolveOwnerTarget === "function") {
       if (typeof loader.ownerSettled !== "function") throw Error("runtime_unavailable");
       personal = createOwnerEffectSource({ current: alive,
         readMetadata: signal => loader.ownerSettled(signal), readResource: (spec, signal) => loader.resourceSettled(spec, signal), resolveTarget: resolveOwnerTarget,
@@ -139,7 +181,7 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
   }
   function refuseSource(s) {
     if (!sourceAlive(s)) return;
-    s.error = "resource_unavailable"; s.metadata = null; s.generation++;
+    s.error = "resource_unavailable"; s.generation++;
     for (const b of s.bindings.values()) bindings.delete(b.key); s.bindings.clear(); revision++; stamp = null; sync(); tell();
   }
   function queueSync() {
@@ -156,6 +198,7 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
       if (!alive() || revision !== before || s !== source) { if (alive()) queueSync(); return; }
       const entries = [...(personal?.descriptors() ?? []), ...(trial?.descriptors() ?? []), ...descriptors(s)];
       if (!alive() || revision !== before || s !== source) { stamp = null; if (alive()) queueSync(); return; }
+      lastContext = { ...value.context };
       const next = JSON.stringify([revision, value.context, entries.map(d => [d.key, d.paused])]);
       if (stamp !== next) {
         if (!alive() || revision !== before || s !== source) { stamp = null; if (alive()) queueSync(); return; }
@@ -164,12 +207,15 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
       if (!alive() || revision !== before || s !== source) { stamp = null; if (alive()) queueSync(); return; }
       emit();
       const c = value.context;
-      if (!pending && c.enabled && c.show && c.previewReady && c.optIn && !c.safe && !c.publicLink && !c.reducedMotion && !c.saveData && !c.hidden) {
-        const ownerNeeds = personal?.needsMetadata() === true, chatNeeds = sourceAlive(s) && !s.error && !s.metadata;
+      // Metadata describes placements, not executable resources. Its existing session/epoch/current and
+      // shared settled-lane fences apply even when this viewer has declined playback. No code is fetched here.
+      if (!pending) {
+        const ownerNeeds = identity.scope === "owner" && !c.publicLink && c.enabled && c.show && c.transportReady && !c.safe && !c.reducedMotion && !c.hidden && personal?.needsMetadata() === true, chatNeeds = sourceAlive(s) && !s.error && !s.metadata;
         if (!alive() || revision !== before || s !== source) { if (alive()) queueSync(); return; }
         if (ownerNeeds && (!chatNeeds || lastMetadata !== "owner")) void readPersonal();
         else if (chatNeeds) void read(s);
       }
+      tell();
     } catch { fail("runtime_unavailable"); }
     finally { syncing = false; }
   }
@@ -216,14 +262,17 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
     for (const b of s.bindings.values()) bindings.delete(b.key); s.bindings.clear();
     if (pending?.source === s) safe(() => pending.controller.abort()); revision++; stamp = null; sync(); tell();
   }
-  function publishReply(s, event) { if (sourceAlive(s) && !s.error && event.instance === s.name) registry.publish("reply", {}, s.name); }
+  function publishReply(s, event) { if (host.document.body.dataset.webTransport !== "poll" && sourceAlive(s) && !s.error && event.instance === s.name) registry.publish("reply", {}, s.name); }
   function attachChat(options) {
     discard(source); const expected = revision; sync();
     if (!alive() || revision !== expected || source !== null) return null;
     const { name, element, current: ownCurrent, observe: ownObserve, onChange: ownChange = () => {} } = options ?? {};
     if (!alive() || typeof name !== "string" || name.length < 1 || name.length > 128 || !element || element.isConnected !== true || typeof ownCurrent !== "function" || typeof ownObserve !== "function" || safe(() => ownCurrent() === true) !== true || revision !== expected || source !== null) return null;
     const s = { name, element, current: ownCurrent, observe: ownObserve, onChange: ownChange, serial: ++serial, generation: 0, dead: false, error: null, metadata: null, bindings: new Map(), paused: new Map() };
-    source = s; revision++; stamp = null;
+    source = s;
+    s.reporter = createEffectWriter(host, () => sourceAlive(s)); s.reported = new Map(); s.reportClock = null;
+    s.reportTimer = host.setTimeout(() => reportPlayback(s), 10000);
+    revision++; stamp = null;
     const placement = id => sourceAlive(s) && !s.error ? s.metadata?.effects.find(p => p.id === id) : null;
     const changed = () => changedSource(s);
     const api = { ok: true, sync,
@@ -231,14 +280,14 @@ export function createAppEffectRuntime({ window: host, current, observe, onChang
       reply(event) { publishReply(s, event); },
       pause(id) { const p = placement(id); if (!p) return false; s.paused.set(id, placementIdentity(p)); revision++; sync(); return true; },
       resume(id) { const p = placement(id); if (!p) return false; s.paused.delete(id); revision++; sync(); const b = s.bindings.get(id); return bindingAlive(b) && registry.resume(b.key); },
-      async remove(id) { const p = placement(id); if (!p) return false; const generation = s.generation; const ok = await writer.post("/ui/effects/remove", { instance: s.name, id }); if (!sourceAlive(s) || generation !== s.generation) return false; if (ok) changed(); return ok; },
+      async remove(id) { const p = placement(id); if (identity.scope !== "owner" || !p) return false; const generation = s.generation; const ok = await writer.post("/ui/effects/remove", { instance: s.name, id }); if (!sourceAlive(s) || generation !== s.generation) return false; if (ok) changed(); return ok; },
       snapshot: () => sourceAlive(s) ? snapshot(s) : { error: null, rows: [], effects: [], loading: false },
       dispose() { if (source !== s) return; discard(s); sync(); },
     };
     sync(); tell(); return sourceAlive(s) ? api : null;
   }
-  return { ok: true, sync, attachChat, changedOwner, ownerSnapshot,
-    attachTrial(options) { const s = source; return sourceAlive(s) ? trial.attach(options, s) : null; },
+  return { ok: true, playbackAvailable: playbackUnavailable === null, sync, attachChat, changedOwner, ownerSnapshot,
+    attachTrial(options) { const s = source; return trial && !playbackUnavailable && sourceAlive(s) ? trial.attach(options, s) : null; },
     stopTrial() { trial?.stop(); },
     trialSnapshot() { return { rows: registry?.snapshot().filter(row => trial?.binding(row.key, row.id)) ?? [] }; },
     cursorSelection: () => personal?.cursorSelection() ?? null, cursorImageSettled,

package/dist/ui/shared/effect-chat-runtime.js

@@ -46,10 +46,23 @@ export function createEffectWriter(host, current) {
 export function chatEffectIdentity(host) {
   try {
     const b = host.document.body.dataset, x = JSON.parse(host.document.documentElement.getAttribute("data-prefs") || "null");
-    if (b.mode !== "full" || b.publicLink === "1" || b.webTransport === "poll" || !["person", "operator"].includes(x?.ownerScope) || x.unreadable === true || typeof x.ownerEpoch !== "string" || !/^[a-f0-9]{16}$/.test(x.ownerEpoch)) return null;
+    if (b.mode !== "full" || b.tier === "guest" || b.publicLink === "1" || b.webTransport === "poll" || !["person", "operator"].includes(x?.ownerScope) || x.unreadable === true || typeof x.ownerEpoch !== "string" || !/^[a-f0-9]{16}$/.test(x.ownerEpoch)) return null;
     return Object.freeze({ epoch: x.ownerEpoch, scope: x.ownerScope });
   } catch { return null; }
 }
+/** Chat-only public/guest capability stays separate from personal preferences and management. */
+export function effectPlaybackIdentity(host) {
+  try {
+    const b = host.document.body.dataset;
+    if (b.mode !== "full" || typeof b.effectEpoch !== "string" || !/^[a-f0-9]{16}$/.test(b.effectEpoch)) return null;
+    if (b.effectScope === "owner") {
+      const own = chatEffectIdentity(host);
+      return own?.epoch === b.effectEpoch ? Object.freeze({ epoch: b.effectEpoch, scope: "owner" }) : null;
+    }
+    if (b.effectScope === "chat" && (b.publicLink === "1" && b.webTransport === "poll" || b.tier === "guest")) return Object.freeze({ epoch: b.effectEpoch, scope: "chat" });
+  } catch { /* no session capability */ }
+  return null;
+}
 export function chatEffectState(state, name) {
   const inst = state.instances?.find(i => i.name === name);
   if (!inst) return null;
@@ -81,7 +94,7 @@ export function createChatEffectRuntime({ window: host, name, element, current,
     writer = createEffectWriter(host, alive);
     loader = make("loader", createEffectRuntimeLoader)({ window: host, ownerEpoch: identity.epoch, current: alive });
     if (!loader.ok) throw Error("runtime_unavailable");
-    registry = make("registry", createEffectRegistry)({ window: host, origin: host.document.body.dataset.previewOrigin, boot: host.document.body.dataset.previewBoot,
+    registry = make("registry", createEffectRegistry)({ window: host, origin: host.location?.origin, boot: host.document.body.dataset.effectBoot,
       load: async (d, signal) => {
         const mine = generation, value = await loader.resource({ id: d.id, instance: name }, signal);
         if (!alive() || mine !== generation || signal.aborted) return null;
@@ -125,7 +138,7 @@ export function createChatEffectRuntime({ window: host, name, element, current,
     const stamp = JSON.stringify(ctx);
     if (stamp !== lastContext) { lastContext = stamp; registry.update(descriptors(), ctx); }
     emit();
-    if (!metadata && !active && ctx.enabled && ctx.show && ctx.previewReady && ctx.optIn && !ctx.safe && !ctx.publicLink && !ctx.reducedMotion && !ctx.saveData && !ctx.hidden) void read();
+    if (!metadata && !active && ctx.enabled && ctx.show && ctx.transportReady && !ctx.safe && !ctx.publicLink && !ctx.reducedMotion && !ctx.hidden) void read();
   }
   async function read() {
     if (!alive() || error || active) return;

package/dist/ui/shared/effect-frame.js

@@ -30,16 +30,35 @@ function snapshotRender(raw) {
   return { code: raw.code, params: { ...params }, instance: raw.instance, width: raw.width, height: raw.height, dpr: raw.dpr, assets, wants: [...raw.wants] };
 }
 
+/** Listener transport only; this does not grant HTML-preview or ordinary-effect consent. */
+export function effectTransportReady(host, origin, boot) {
+  try {
+    const target = new URL(origin), page = new URL(host.location.origin);
+    return origin === target.origin && ["http:", "https:"].includes(target.protocol) && ["http:", "https:"].includes(page.protocol)
+      && target.origin !== page.origin && !(page.protocol === "https:" && target.protocol !== "https:") && typeof boot === "string" && /^[0-9a-f]{32}$/.test(boot);
+  } catch { return false; }
+}
+
+/** #2118: same URL origin, opaque realm. This helper does not alter product admission or HTML preview consent. */
+export function effectBootstrapReady(host, origin, boot) {
+  try {
+    const target = new URL(origin), page = new URL(host.location.origin);
+    return origin === target.origin && target.origin === page.origin && ["http:", "https:"].includes(target.protocol)
+      && typeof boot === "string" && /^[0-9a-f]{32}$/.test(boot);
+  } catch { return false; }
+}
+
 /**
  * All options come from the host, never from an agent event or manifest origin. The registry supplies an admitted
  * root and geometry in a later integration. This primitive alone does not implement caps, clipping or profiling.
  */
-export function createEffectFrame({ window: host, root, origin, boot, render, clock = () => performance.now(), onReady = () => {}, onRemove = () => {} } = {}) {
-  let url;
-  try { url = new URL(origin); } catch { return { ok: false, reason: "preview_unknown" }; }
-  if (origin !== url.origin || !["http:", "https:"].includes(url.protocol) || typeof boot !== "string" || !/^[0-9a-f]{32}$/.test(boot)) return { ok: false, reason: "preview_unknown" };
-  let hostOrigin; try { hostOrigin = new URL(host.location.origin); } catch { return { ok: false, reason: "preview_unknown" }; }
-  if (!["http:", "https:"].includes(hostOrigin.protocol) || origin === hostOrigin.origin || hostOrigin.protocol === "https:" && url.protocol !== "https:") return { ok: false, reason: "preview_unknown" };
+export function createEffectFrame(options = {}) { return ownedEffectFrame(options, false); }
+
+/** Product transport: the same-listener trusted document still has an opaque sandboxed realm. */
+export function createOpaqueEffectFrame(options = {}) { return ownedEffectFrame(options, true); }
+
+function ownedEffectFrame({ window: host, root, origin, boot, render, clock = () => performance.now(), onReady = () => {}, onRemove = () => {} } = {}, sameListener) {
+  if (!(sameListener ? effectBootstrapReady : effectTransportReady)(host, origin, boot)) return { ok: false, reason: sameListener ? "bootstrap_unknown" : "preview_unknown" };
   const payload = snapshotRender(render);
   if (!payload || !host || !root || root.ownerDocument !== host.document || typeof root.append !== "function" || typeof host.MessageChannel !== "function" || typeof clock !== "function" || typeof onReady !== "function" || typeof onRemove !== "function") return { ok: false, reason: "unsupported" };
   let mounted;
@@ -117,7 +136,7 @@ export function createEffectFrame({ window: host, root, origin, boot, render, cl
   host.addEventListener("message", hello);
   frame.addEventListener("load", load);
   timer = host.setTimeout(deadline, 10000);
-  try { frame.src = `${origin}/effect`; root.append(frame); } catch { remove("mount_failed"); }
+  try { frame.src = origin + (sameListener ? "/effect-bootstrap" : "/effect"); root.append(frame); } catch { remove("mount_failed"); }
   return { ok: true, element: frame, state, remove,
     send(event) {
       if (!ready || !current() || !maySendEffectEvent(event, { instance: payload.instance, wants: payload.wants })) return false;

package/dist/ui/shared/effect-geometry.js

@@ -70,36 +70,51 @@ export function createEffectGeometry({ window: host } = {}) {
       frame.remove();
       return { ok: false, reason: "geometry_unknown" };
     }
-    let dead = false;
+    let dead = false, shown = false;
     const hide = () => {
+      shown = false;
       try {
         rule.style.setProperty("visibility", "hidden", "important");
-        if (frame.isConnected === true && host.getComputedStyle(frame).visibility !== "hidden") frame.remove();
-      } catch { frame.remove(); }
+        if (frame.isConnected === true && host.getComputedStyle(frame).visibility !== "hidden") { frame.remove(); return false; }
+        return true;
+      } catch { frame.remove(); return false; }
     };
     const handle = { ok: true, hide,
       /** Same-turn host paint snapshot is mandatory, including behind/human placements. No DOM fallback. */
       sync(rect, stock) {
-        hide();
+        const refuse = () => { hide(); return false; };
         const proof = effectStockSnapshot(stock);
-        if (!effectStockAllows(proof, { layer, by })) return false;
-        if (dead || disposed || !hostEffectSpace(host, frame) || !rect || ![rect.x, rect.y, rect.width, rect.height].every(number) || ![rect.x, rect.y, rect.width, rect.height].every(Number.isInteger) || rect.width < 1 || rect.height < 1 || rect.width > 4096 || rect.height > 4096 || rect.width * rect.height > 8388608) { hide(); return false; }
+        if (!effectStockAllows(proof, { layer, by })) return refuse();
+        if (dead || disposed || !hostEffectSpace(host, frame) || !rect || ![rect.x, rect.y, rect.width, rect.height].every(number) || ![rect.x, rect.y, rect.width, rect.height].every(Number.isInteger) || rect.width < 1 || rect.height < 1 || rect.width > 4096 || rect.height > 4096 || rect.width * rect.height > 8388608) return refuse();
         let path = "none";
         if (layer === "front" && by !== "human") {
           const clipped = effectTrustClip(rect, proof.rects);
-          if (!clipped.ok) return false;
+          if (!clipped.ok) return refuse();
           path = clipped.path;
         }
 
         try {
+          const matches = visibility => {
+            const style = host.getComputedStyle(frame), actual = frame.getBoundingClientRect();
+            return style.position === "fixed" && style.pointerEvents === "none" && style.visibility === visibility
+              && style.opacity === (layer === "front" && by !== "human" ? "0.85" : "1") && style.zIndex === (layer === "front" ? "20" : "0")
+              && sameClip(path, rule.style.getPropertyValue("clip-path")) && sameClip(path, style.clipPath)
+              && ["x", "y", "width", "height"].every(key => number(actual[key]) && Math.abs(actual[key] - rect[key]) < 0.02)
+              && frame.isConnected === true && frame.ownerDocument === host.document;
+          };
+          // A fresh proof and actual viewport/clip are still checked every frame. Rewriting an
+          // already verified presentation makes WebKit repeatedly invalidate the iframe's paint.
+          if (shown && matches("visible")) return true;
+          // Changed or unproven geometry is hidden before writes and verified before reveal.
+          if (!hide()) return false;
           for (const key of ["x", "y", "width", "height"]) rule.style.setProperty(key === "x" ? "left" : key === "y" ? "top" : key, `${rect[key]}px`, "important");
           rule.style.setProperty("clip-path", path, "important");
           if (!sameClip(path, rule.style.getPropertyValue("clip-path"))) return false;
           // The stylesheet can lose the cascade to another host rule. Verify the actual viewport and clip
           // before revealing: holes expressed in planned coordinates cannot protect a transformed frame.
-          const style = host.getComputedStyle(frame), actual = frame.getBoundingClientRect();
-          if (style.position !== "fixed" || style.pointerEvents !== "none" || style.visibility !== "hidden" || style.opacity !== (layer === "front" && by !== "human" ? "0.85" : "1") || style.zIndex !== (layer === "front" ? "20" : "0") || !sameClip(path, style.clipPath) || !["x", "y", "width", "height"].every(key => number(actual[key]) && Math.abs(actual[key] - rect[key]) < 0.02)) return false;
+          if (!matches("hidden")) return false;
           rule.style.setProperty("visibility", "visible", "important");
+          shown = true;
           return true;
         } catch { hide(); return false; }
       },

package/dist/ui/shared/effect-owner-source.js

@@ -74,7 +74,14 @@ export function createOwnerEffectSource({ current, readMetadata, readResource, r
     },
     descriptors() {
       if (!alive() || !metadata || error) return [];
-      const body = metadata, gen = generation, proof = safe(() => effectStockSnapshot(stock()));
+      const body = metadata, gen = generation;
+      // #2188: the stock snapshot walks the whole page (thousands of computed styles). With no slot holding an effect
+      // that could play, there is nothing for it to admit: skipped — every page change (a status, a chat switch) ran it.
+      if (!SLOTS.some(slot => body.slots[slot]?.status === "available" && failed.get(slot) !== body.slots[slot].id)) {
+        for (const slot of SLOTS) drop(slot);
+        return [];
+      }
+      const proof = safe(() => effectStockSnapshot(stock()));
       if (!fresh(body, gen)) return [];
       if (!proof) { clear(); return []; }
       const result = [];

package/dist/ui/shared/effect-policy.js

@@ -58,23 +58,35 @@ export function constrainedDevice(signals) {
   return !!signals && (finite(signals.memory) && signals.memory > 0 && signals.memory <= 4 || finite(signals.cores) && signals.cores > 0 && signals.cores <= 4 || signals.coarse === true && finite(signals.width) && signals.width > 0 && signals.width <= 900);
 }
 
+export const EFFECT_BLOCK_REASONS = Object.freeze([
+  "transport_unavailable", "preview_unavailable", "preview_not_consented", "unsupported_host", "safe_mode", "reduced_motion", "save_data", "hidden", "disabled", "public_link",
+  "baseline_unsupported", "baseline_unavailable", "baseline_timeout", "calibrating", "clock_unavailable", "gates_unknown", "owner_css", "stock_overlay", "modal",
+  "safety_off", "safety_unknown", "interrupted", "paused", "host_budget", "frame_limit", "front_limit", "offscreen", "region_unavailable", "resource_unavailable", "resource_timeout", "runtime_unavailable", "unknown",
+]);
+
+/** Diagnostic names only; the admission policy below still validates every required flag. */
+export function effectPlaybackReason(c) {
+  if (!c || ["safe", "publicLink", "reducedMotion", "hidden", "enabled", "show", "transportReady"].some(k => typeof c[k] !== "boolean")) return "gates_unknown";
+  return c.safe ? "safe_mode" : c.reducedMotion ? "reduced_motion"
+    : c.hidden ? "hidden" : !c.enabled ? "unsupported_host" : !c.show ? "disabled" : !c.transportReady ? "transport_unavailable" : null;
+}
+
 const OWNER_ORDER = Object.freeze({ page: 0, header: 1, sidebar: 2, box: 3 });
 /** Recomputed from host descriptors; queued/off/unknown descriptors never get a frame reservation. */
 export function allocateEffectFrames(descriptors, context) {
   if (!Array.isArray(descriptors) || descriptors.length > 128 || !plain(context)) return [];
   const keys = new Set(), duplicate = new Set();
   for (const d of descriptors) if (d && typeof d.key === "string") { if (keys.has(d.key)) duplicate.add(d.key); keys.add(d.key); }
-  const result = descriptors.map(d => ({ key: d?.key, verdict: "off", reason: "unknown", queuePos: null }));
-  const gates = ["safe", "publicLink", "reducedMotion", "saveData", "hidden", "enabled", "show", "previewReady", "optIn", "constrained", "modal"];
-  if (gates.some(k => typeof context[k] !== "boolean") || context.openInstance !== null && !instanceName(context.openInstance)) return result;
+  const result = descriptors.map(d => ({ key: d?.key, verdict: "off", reason: "descriptor_invalid", queuePos: null }));
+  const gates = ["safe", "publicLink", "reducedMotion", "hidden", "enabled", "show", "transportReady", "constrained", "modal"];
+  if (gates.some(k => typeof context[k] !== "boolean") || context.openInstance !== null && !instanceName(context.openInstance)) return result.map(r => ({ ...r, reason: "gates_unknown" }));
   let global = null;
   if (context.safe === true) global = "safe_mode";
-  else if (context.publicLink === true) global = "public_link";
   else if (context.reducedMotion === true) global = "reduced_motion";
-  else if (context.saveData === true) global = "save_data";
   else if (context.hidden === true) global = "hidden";
-  else if (context.enabled !== true || context.show !== true) global = "disabled";
-  else if (context.previewReady !== true || context.optIn !== true) global = "preview_unavailable";
+  else if (context.enabled !== true) global = "unsupported_host";
+  else if (context.show !== true) global = "disabled";
+
   const candidates = [];
   for (let i = 0; i < descriptors.length; i++) {
     const d = descriptors[i], r = result[i];
@@ -87,6 +99,8 @@ export function allocateEffectFrames(descriptors, context) {
     if (!owner && d.region !== "chat") { r.reason = "scope"; continue; }
     if (d.region === "chat" && (!instanceName(d.instance) || d.instance !== context.openInstance)) { r.reason = "closed_chat"; continue; }
     if (global) { r.reason = global; continue; }
+    if (context.publicLink && (d.region !== "chat" || trial)) { r.reason = "public_link"; continue; }
+    if (!context.transportReady) { r.reason = "transport_unavailable"; continue; }
     if (d.paused === true) { r.reason = "paused"; continue; }
     if (d.visible !== true) { r.reason = "offscreen"; continue; }
     if (d.layer === "front" && context.modal === true && !trial) { r.reason = "modal"; continue; }

package/dist/ui/shared/effect-profiler.js

@@ -12,10 +12,14 @@ const id = v => typeof v === "string" && /^[0-9a-f]{32}$/.test(v);
 /** One host-owned mount. The registry must remove the frame when remove is true, never merely hide it. */
 export class EffectBudget {
   constructor({ device, baselineFps, clock = () => performance.now(), longTasksSupported = false } = {}) {
-    if (!deviceClass(device) || !finite(baselineFps) || baselineFps <= 0 || baselineFps > 1000 || typeof clock !== "function" || typeof longTasksSupported !== "boolean") throw new TypeError("effect budget options");
+    if (!deviceClass(device) || baselineFps !== undefined && (!finite(baselineFps) || baselineFps <= 0 || baselineFps > 1000) || typeof clock !== "function" || typeof longTasksSupported !== "boolean") throw new TypeError("effect budget options");
     this.device = device;
-    // Measured by the host while NO effects are mounted; never author-supplied or learned from a running effect.
-    this.fpsFloor = Math.min(EFFECT_BUDGETS[device].fps, baselineFps * 0.9);
+    // Legacy host measurements may still be supplied by pure probes. Product playback starts
+    // immediately and learns cadence concurrently from host rAF, never Worker timing.
+    // Freeze before the first report: a mount's profile floor must remain coherent.
+    this.fpsFloor = baselineFps === undefined ? null : Math.min(EFFECT_BUDGETS[device].fps, baselineFps * 0.9);
+    this.cadence = [];
+    this.cadenceAt = null;
     this.clock = clock;
     this.longTasksSupported = longTasksSupported;
     this.last = null;
@@ -58,7 +62,16 @@ export class EffectBudget {
   frame() {
     const now = this.time();
     if (now === null) return this.stop("clock_unavailable");
-    if (this.verdict === "paused" || this.hiddenAt !== null || now < this.epoch + 1000) return this.snapshot();
+    if (this.verdict === "paused" || this.hiddenAt !== null) return this.snapshot();
+    if (this.fpsFloor === null) {
+      const interval = this.cadenceAt === null ? null : now - this.cadenceAt;
+      this.cadenceAt = now;
+      if (interval !== null && interval >= 1 && interval <= 1000) {
+        if (this.cadence.length === 256) this.cadence.shift();
+        this.cadence.push(interval);
+      }
+    }
+    if (now < this.epoch + 1000) return this.snapshot();
     this.trim(now);
     if (this.frames.at(-1) !== now) {
       if (this.frames.length >= 2048) this.overflow = true;
@@ -88,10 +101,10 @@ export class EffectBudget {
     const now = this.time();
     if (now === null) return this.stop("clock_unavailable");
     if (!plain(raw)) return this.stop("gates_unknown");
-    const { hidden, reducedMotion, saveData, show } = raw;
-    if ([hidden, reducedMotion, saveData, show].some(v => typeof v !== "boolean")) return this.stop("gates_unknown");
+    const { hidden, reducedMotion, show } = raw;
+    if ([hidden, reducedMotion, show].some(v => typeof v !== "boolean")) return this.stop("gates_unknown");
     if (this.verdict === "paused") return this.snapshot();
-    if (reducedMotion || saveData || !show) return this.stop(reducedMotion ? "reduced_motion" : saveData ? "save_data" : "viewer_off");
+    if (reducedMotion || !show) return this.stop(reducedMotion ? "reduced_motion" : "viewer_off");
     if (hidden && this.hiddenAt === null) this.hiddenAt = now;
     if (hidden && now - this.hiddenAt >= 10000) return this.stop("hidden");
     if (!hidden && this.hiddenAt !== null) {
@@ -105,6 +118,7 @@ export class EffectBudget {
       this.overflow = false;
       this.badWindows = 0;
       this.metrics = null;
+      this.cadence = []; this.cadenceAt = null;
     }
     return this.snapshot();
   }
@@ -123,8 +137,16 @@ export class EffectBudget {
     const hostMs = this.longTasksSupported ? sum(null) : null;
     const ownMs = this.longTasksSupported && this.tasks.some(t => t.attributed) ? sum(true) : null;
     const limits = EFFECT_BUDGETS[this.device];
-    const bad = this.overflow || fps < this.fpsFloor || hostMs !== null && hostMs > limits.longTaskMsPerSecond;
-    this.metrics = { at: now, hostFps: fps, hostLongTaskMsPerSecond: hostMs, attributedLongTaskMsPerSecond: ownMs,
+    if (this.fpsFloor === null && this.cadence.length >= 3) {
+      // Faster observed intervals distinguish intermittent jank from a genuinely slower
+      // display. This is a live reference, not an empty-page health certification.
+      const sorted = [...this.cadence].sort((a, b) => a - b);
+      const interval = sorted[Math.ceil(sorted.length * (sorted.length < 8 ? 0.5 : 0.2)) - 1];
+      this.fpsFloor = Math.min(limits.fps, 900 / interval);
+      this.cadence = []; this.cadenceAt = null;
+    }
+    const bad = this.overflow || this.fpsFloor === null || fps < this.fpsFloor || hostMs !== null && hostMs > limits.longTaskMsPerSecond;
+    this.metrics = this.fpsFloor === null ? null : { at: now, hostFps: fps, hostLongTaskMsPerSecond: hostMs, attributedLongTaskMsPerSecond: ownMs,
       attribution: ownMs === null ? "unknown" : "observed", fpsFloor: this.fpsFloor, windowMs: 2000 };
     this.overflow = false;
     if (bad) {