@unoverse-platform/studio 0.1.97 → 0.1.99

package/vendor/base/src/workflow/GetMemoryService.ts

@@ -5,7 +5,7 @@
  *
  * Used by the intrinsic agent memory tools (PlatformMemoryTools — the Memory
  * toggles) and the Universe Copilot harness. NOT used by spatial search —
- * "SpatialSearch serves knowledge tools only" (MEMORY_SPEC.md); the old
+ * "SpatialSearch serves knowledge tools only" (docs/architecture/signal/memory/MEMORY.md); the old
  * includeMemory-in-search path is dead.
  */
 
@@ -16,7 +16,8 @@ const MEMORY_SERVICE_URL = process.env.MEMORY_SERVICE_URL || "http://localhost:4
 
 export interface GetMemoryInput {
   userId: string;
-  workflowId: string;
+  /** The organisation the run works as: the scope of a person's memory (MEMORY.md § 2.10). */
+  org: string;
   query?: string;
   domains?: string[];
   minCertainty?: number;
@@ -39,10 +40,10 @@ export class GetMemoryService {
    * Retrieve composed understanding for a user (uses /compose endpoint)
    */
   static async compose(input: GetMemoryInput): Promise<any> {
-    const { userId, workflowId, query, domains, accessToken } = input;
+    const { userId, org, query, domains, accessToken } = input;
 
     try {
-      const params = new URLSearchParams({ userId, workflowId, mode: "full" });
+      const params = new URLSearchParams({ userId, org, mode: "full" });
       if (domains?.length) params.set("domains", domains.join(","));
       if (query) params.set("context", query);
 
@@ -67,11 +68,11 @@ export class GetMemoryService {
   /**
    * Get recent evidence snapshot (recency-ordered, no query)
    */
-  static async recent(input: { userId: string; workflowId: string; limit?: number; accessToken?: string }): Promise<MemoryEvidence[]> {
-    const { userId, workflowId, limit, accessToken } = input;
+  static async recent(input: { userId: string; org: string; limit?: number; accessToken?: string }): Promise<MemoryEvidence[]> {
+    const { userId, org, limit, accessToken } = input;
 
     try {
-      const params = new URLSearchParams({ userId, workflowId });
+      const params = new URLSearchParams({ userId, org });
       if (limit) params.set("limit", String(limit));
 
       const headers: Record<string, string> = { "Content-Type": "application/json" };
@@ -96,14 +97,14 @@ export class GetMemoryService {
    * Search user evidence by query (uses /evidence/search endpoint)
    */
   static async search(input: GetMemoryInput): Promise<MemoryEvidence[]> {
-    const { userId, workflowId, query, domains, minCertainty, limit, accessToken } = input;
+    const { userId, org, query, domains, minCertainty, limit, accessToken } = input;
 
     if (!query) {
       return this.retrieve(input);
     }
 
     try {
-      const params = new URLSearchParams({ userId, workflowId, query });
+      const params = new URLSearchParams({ userId, org, query });
       if (domains?.length) params.set("domains", domains.join(","));
       if (minCertainty !== undefined) params.set("minCertainty", String(minCertainty));
       if (limit) params.set("limit", String(limit));
@@ -130,10 +131,10 @@ export class GetMemoryService {
    * Retrieve raw evidence (structured, no query needed — uses /evidence endpoint)
    */
   static async retrieve(input: GetMemoryInput): Promise<MemoryEvidence[]> {
-    const { userId, workflowId, domains, minCertainty, limit, accessToken } = input;
+    const { userId, org, domains, minCertainty, limit, accessToken } = input;
 
     try {
-      const params = new URLSearchParams({ userId, workflowId });
+      const params = new URLSearchParams({ userId, org });
       if (domains?.length) params.set("domains", domains.join(","));
       if (minCertainty !== undefined) params.set("minCertainty", String(minCertainty));
       if (limit) params.set("limit", String(limit || 20));

package/vendor/base/src/workflow/PlatformMemoryCore.ts

@@ -38,7 +38,7 @@ const MEMORY_SERVICE_URL = process.env.MEMORY_SERVICE_URL || "http://localhost:4
 // Tool schemas
 // ---------------------------------------------------------------------------
 
-// The ONE user-memory tool (MEMORY_SPEC v3 § Serving). The standing snapshot is no
+// The ONE user-memory tool (docs/architecture/signal/memory/MEMORY.md § Serving). The standing snapshot is no
 // longer a tool at all — the agent HARNESS injects who-the-user-is + current state
 // into the system context at init (zero calls). queryMemory remains as the single
 // depth door: search the user's remembered facts when a topic needs prior context.
@@ -268,6 +268,9 @@ export function mergePlatformMemorySchema(baseSchema: any | null, flags: MemoryF
 interface MemoryCallIdentity {
   userId: string;
   workflowId: string;
+  /** The organisation the run works as: the scope of the person's memory (MEMORY.md § 2.10),
+   *  and the stamp on a goal. Named by the run, else the canvas's default. */
+  org?: string;
   agentId: string;
   agentName?: string;
   accessToken?: string;
@@ -279,6 +282,7 @@ function resolveIdentity(params: any, context: any): MemoryCallIdentity | { erro
   const userId =
     params?.userId || context?.workflow?.variables?.userId || context?.publishingContext?.userId;
   const workflowId = context?.workflowId || context?.workflow?.id;
+  const org: string | undefined = context?.publishingContext?.org ?? context?.workflow?.org ?? undefined;
   if (!userId) return { error: "No user identity in execution context — cannot access memory" };
   if (!workflowId) return { error: "No workflow id in execution context — cannot access memory" };
 
@@ -296,6 +300,7 @@ function resolveIdentity(params: any, context: any): MemoryCallIdentity | { erro
   return {
     userId,
     workflowId,
+    org,
     agentId,
     agentName,
     accessToken: context?.auth?.accessToken,
@@ -328,7 +333,7 @@ async function memoryServerPost(path: string, body: any, accessToken?: string):
 }
 
 /**
- * Serve search results LEAN (MEMORY_SPEC v3): claim + certainty + domain only —
+ * Serve search results LEAN (docs/architecture/signal/memory/MEMORY.md § Serving): claim + certainty + domain only —
  * NO premises, NO content dupe, NO ids/timestamps/reinforcement bookkeeping.
  * Deduped by normalized claim so paraphrase clusters read as one line. The raw
  * retrieval is unchanged; the dashboard still gets full rows.
@@ -360,15 +365,21 @@ export async function executePlatformMemoryMethod(method: string, params: any, c
     logger.warn(`Memory tool ${method} refused`, { error: identity.error });
     return { success: false, method, error: identity.error };
   }
-  const { userId, workflowId, agentId, agentName, accessToken, conversationId, executionId } = identity;
+  const { userId, workflowId, org, agentId, agentName, accessToken, conversationId, executionId } = identity;
 
   try {
     switch (method) {
       // ---- user memory (the ONE depth tool; the standing snapshot is harness-injected) ----
       case "queryMemory": {
+        // A person's memory is scoped by the org the run works as; a run that cannot name
+        // one gets no memory rather than someone else's (MEMORY.md § 2.10).
+        if (!org) {
+          logger.warn("Memory tool queryMemory refused: the run names no org");
+          return { success: false, method, error: "No org in execution context — cannot access memory" };
+        }
         const evidence = await GetMemoryService.search({
           userId,
-          workflowId,
+          org,
           query: params?.query,
           limit: 15,
           accessToken,
@@ -379,7 +390,7 @@ export async function executePlatformMemoryMethod(method: string, params: any, c
 
       // ---- agent memory (goal-scoped) ----
       case "getGoalContext": {
-        return await memoryServerGet("/agent/goal-context", { userId, workflowId, agentId }, accessToken);
+        return await memoryServerGet("/agent/goal-context", { userId, workflowId, agentId, ...(org ? { org } : {}) }, accessToken);
       }
       case "writeNote": {
         return await memoryServerPost(
@@ -387,6 +398,7 @@ export async function executePlatformMemoryMethod(method: string, params: any, c
           {
             userId,
             workflowId,
+            org,
             agentId,
             agentName,
             content: params?.content,
@@ -405,7 +417,8 @@ export async function executePlatformMemoryMethod(method: string, params: any, c
         // because null means CLEAR.
         const { description, acceptanceCriteria, directive, ...stateFields } = params || {};
         const state = Object.keys(stateFields).length > 0 ? stateFields : undefined;
-        const body: Record<string, any> = { userId, workflowId, agentId, agentName, description, acceptanceCriteria, state };
+        // `org` is the stamp on the goal at create (MEMORY.md § 2.10); identity stays the canvas.
+        const body: Record<string, any> = { userId, workflowId, org, agentId, agentName, description, acceptanceCriteria, state };
         if (params && Object.prototype.hasOwnProperty.call(params, "directive")) body.directive = directive ?? null;
         return await memoryServerPost("/agent/state", body, accessToken);
       }
@@ -413,28 +426,28 @@ export async function executePlatformMemoryMethod(method: string, params: any, c
         // The judge's verdict → one ledger row. Platform-only (PLATFORM_MEMORY_METHODS).
         return await memoryServerPost(
           "/agent/attempt",
-          { userId, workflowId, agentId, results: params?.results, deliverables: params?.deliverables || [] },
+          { userId, workflowId, org, agentId, results: params?.results, deliverables: params?.deliverables || [] },
           accessToken,
         );
       }
       case "searchHistory": {
         return await memoryServerGet(
           "/agent/history",
-          { userId, workflowId, limit: String(params?.limit || 10) },
+          { userId, workflowId, ...(org ? { org } : {}), limit: String(params?.limit || 10) },
           accessToken,
         );
       }
       case "resumeGoal": {
         return await memoryServerPost(
           "/agent/resume",
-          { userId, workflowId, agentId, goalId: params?.goalId },
+          { userId, workflowId, org, agentId, goalId: params?.goalId },
           accessToken,
         );
       }
       case "archiveGoal": {
         return await memoryServerPost(
           "/agent/archive",
-          { userId, workflowId, agentId, summary: params?.summary, conversationId },
+          { userId, workflowId, org, agentId, summary: params?.summary, conversationId },
           accessToken,
         );
       }

package/vendor/sdk/appEngine.tsx

@@ -42,7 +42,7 @@ export interface AppConfig {
 }
 
 export function AppEngine(cfg: AppConfig) {
-  const { serverUrl, apiUrl, appId, getAccessToken, userId, conversationId, surface, analyticsDebug } = cfg;
+  const { serverUrl, apiUrl, appId: configuredApp, getAccessToken, userId, conversationId, surface, analyticsDebug } = cfg;
 
   // ONE STORE PER CONVERSATION. The host may reuse this engine (the native-host
   // iframe posts new config on app switch), and a template swap keeps the store by
@@ -63,11 +63,28 @@ export function AppEngine(cfg: AppConfig) {
   // Setting state during render makes React re-render BEFORE the commit, so the
   // connection effect only ever sees either the old app intact or an empty binding —
   // never the cross-app hybrid.
-  const [boundFor, setBoundFor] = useState(appId);
-  if (boundFor !== appId) {
-    setBoundFor(appId);
+  // WHICH APP IS RUNNING, and there are two ways it changes. The host re-posts its
+  // config (the native-host iframe's app switch), and the SERVER can now swap it mid
+  // conversation — an app discovered and called IS the surface, so opening one replaces
+  // what is mounted (owner ruling 2026-09-07). One piece of state either way, so the
+  // stale-binding guard below covers both rather than only the host's.
+  const [appId, setAppId] = useState(configuredApp);
+  const [boundFor, setBoundFor] = useState(configuredApp);
+  // The host's own switch WINS and resets: a new config is a new intent.
+  if (boundFor !== configuredApp) {
+    setBoundFor(configuredApp);
+    setAppId(configuredApp);
     setBinding({});
   }
+  // The server's switch, same reset: a different app is a different workflow and trigger,
+  // and the binding is read async from the incoming app's manifest (the effect below).
+  // Clearing it here is what stops a session opening on the OLD app's trigger against the
+  // new app — the hazard the render-time reset above exists for.
+  const switchApp = (next: string) => {
+    if (next === appId) return;
+    setAppId(next);
+    setBinding({});
+  };
   // STATE-OWNED WIDTH (design data): the layout root's `appWidth` = the core surface's
   // constant width; an occupied panel slot's `appWidth` adds to it (computeAppWidth).
   // No declared width → the host keeps its own default. There is no other path.
@@ -177,11 +194,12 @@ export function AppEngine(cfg: AppConfig) {
       userId: userId ?? "",
       conversationId,
       chatId: conversationId,
+      appId,
     },
     store,
     // Open only once BOTH are ready: the user identity AND the manifest binding (read async).
     // Avoids the transient "connection missing workflowId/userId/conversationId" warning.
-    { enabled: !!userId && !!binding.workflow },
+    { enabled: !!userId && !!binding.workflow, onAppSwitch: switchApp },
   );
 
   // STATUS TO THE HOST. In native-host mode the iframe owns the only real
@@ -294,14 +312,15 @@ export function AppEngine(cfg: AppConfig) {
           store.setDraft(typeof (data as any)?.text === "string" ? (data as any).text : "");
           return;
         }
-        // Any other named server action (submit, selectCourse…): if the server is
-        // ELICITING on this session (the native §3.3 path — an app tool call is
-        // waiting), the submitted state ANSWERS the elicitation; one accept then
-        // completes the waiting node AND the held tool call server-side. Otherwise
-        // fall back to the data-plane `user_action` submit (waiter transport).
+        // THE SPEC'S ANSWERS, AND NOTHING ELSE (UNOVERSE_MCP_COMPLETE_GUIDE.md, "How the SDK
+        // answers an elicitation"): while the server is ELICITING on this session, the
+        // component's `submit` answers `accept` with its slice and its `cancel` answers
+        // `cancel`. Every other action (a state it enters, a step, a tab) is the component's
+        // own and goes to the server as usual. Without a pending elicitation, a submit falls
+        // back to the data-plane `user_action` waiter (a workflow node waiting on a component).
         if (!t) return;
         const state = (meta?.state ?? data) as Record<string, unknown>;
-        if (conn.resolveElicitation(state)) return;
+        if ((t === "submit" || t === "cancel") && conn.resolveElicitation(state, t === "cancel" ? "cancel" : "accept")) return;
         conn.sendAction(t, {
           componentNodeId: meta?.nodeId,
           componentType: meta?.type,

package/vendor/sdk/lib/UnoverseComponent.tsx

@@ -18,6 +18,7 @@ import { dispatchAction, matches, type ComponentStore, type ResolvedTheme, type
 import { renderNode, keyframesCss, type ActionHandler, type SlotResolver } from "./render";
 import { useUnoverseTheme, ensureFontStylesheets } from "./theme";
 import { IsolatedRoot } from "./isolate";
+import { stateOfUri } from "./core/apps";
 
 /** Subscribe to an instance in the store, re-rendering when a merge lands. Snapshots THIS
  *  instance's slice (merge() gives it a fresh identity), so chunks for other components bail
@@ -92,10 +93,13 @@ export function UnoverseComponent({ client, uri, data, store, chatId, nodeId, ex
   // orgs share a name. The rebuild-from-type stays as the fallback for events that
   // carry no componentUrl. (Still the plain URI, never the withdrawn `@refs` form —
   // that suffix broke Studio's local definition route.)
-  const resolvedUri = store
-    ? (live.componentUrl ?? (live.type ? `unoverse://components/${live.type}` : null))
-    : (uri ?? null);
-  const sourceData = store ? (extraData ? { ...(live.data ?? {}), ...extraData } : live.data) : data;
+  // THE HASH NAMES THE STATE (stateOfUri): the address is read without it, and it seeds the
+  // public `state` of a static instance that carries none, so `...#page` opens on the page.
+  const address = store ? (live.componentUrl ?? (live.type ? `unoverse://components/${live.type}` : null)) : (uri ?? null);
+  const { uri: resolvedUri, state: hashState } = address ? stateOfUri(address) : { uri: null as string | null };
+  const sourceData = store
+    ? (extraData ? { ...(live.data ?? {}), ...extraData } : live.data)
+    : (hashState && data?.state == null ? { state: hashState, ...(data ?? {}) } : data);
   // No theme passed → fetch it from the server (the SDK owns zero token values). The
   // theme REF comes from the definition itself: a template's `org` names its client's
   // theme (`<org>/light`); a universal component previews under the default set

package/vendor/sdk/lib/app.tsx

@@ -16,14 +16,15 @@ import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, use
 import {
   collectSurfacedViews,
   cssWidth,
+  placeWidthStyle,
   dispatchAction,
   formatRelative,
   isViewField,
+  mountAliases,
   orderedClaims,
   propDefaults,
   resolveActiveLayout,
   resolveActiveView,
-  resolveLatch,
   selectPointers,
   viewOf,
   type ComponentStore,
@@ -254,6 +255,8 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
   // guest's hand), it happens ONCE per instance (a placed slice has a view), and the
   // component owns the axis from then on: the template never writes it again.
   useEffect(() => {
+    // An app with places is drawn by the screen document: nothing is placed by a scan.
+    if (def?.places?.length) return;
     const order = def?.stateOrder;
     if (!order?.length) return;
     for (const turn of store.getResponses())
@@ -294,6 +297,10 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
       for (const secs of Object.values((tpl as { sections?: Record<string, { face?: string }[]> }).sections ?? {}))
         for (const sec of secs) if (sec?.face) views.add(sec.face);
     }
+    // `inline` IS NEVER A CLAIM: it is the universal fallback face, drawn in the flow. A
+    // streamed template's own `inline` layout (its compact chip) marked it claimed, so the
+    // flow skipped the chip (observed live 2026-09-06).
+    views.delete("inline");
     return views;
   }, [activeRoot, def, mounted]);
 
@@ -306,7 +313,11 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
   // this stays a hook, and off the SAME derivation the render path uses.
   const ladder = def ? resolveActiveView(def, store, surfacedViews) : { view: "", byGuest: false };
   useEffect(() => {
-    if (ladder.view && !ladder.byGuest) store.cancelBelow(ladder.view, orderedClaims(def));
+    if (def?.places?.length) return;
+    if (ladder.view && !ladder.byGuest) {
+      const order = orderedClaims(def);
+      store.cancelBelow(ladder.view, order, mountAliases(def, new Set(order)));
+    }
     // `structureVersion`: EVERY arrival re-runs this, not only the ones that change the
     // winner. A card landing while a higher state is ALREADY active would otherwise keep
     // its claim forever — the walk never re-ran — and closing the higher state dropped
@@ -315,52 +326,6 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
     // only bumps when it changed something, so this settles in one extra pass.
   }, [ladder.view, ladder.byGuest, def, store, structureVersion]);
 
-  /**
-   * THE LATCH, PUBLISHED FOR CHROME (docs/MCP_COMPLETE_GUIDE.md §The Component Latch).
-   *
-   * `resolveLatch` derives WHICH instance the conversation addresses; the composer's pill
-   * is ordinary design chrome, so it needs those facts as template state to bind against. Same
-   * shape as the voice service (§4 "services feed the state"): a producer writes derived
-   * values into the normal bucket, and `core` learns no UI concept — nothing here knows a
-   * pill exists.
-   *
-   * `latchDismissed` is written as bare `true` by the ✕ (chrome cannot name a key it does
-   * not know) and NORMALISED here to the dismissed holder's key. Keyed, so the dismissal
-   * dies with the thing dismissed: a different component taking the latch is a different
-   * key, and its pill comes up as it should rather than being suppressed by a stale flag.
-   */
-  const tstate = store.getAppState() as Record<string, unknown>;
-  const dismissedRaw = tstate.latchDismissed;
-  const held = def ? resolveLatch(def, store, ladder.view, typeof dismissedRaw === "string" ? dismissedRaw : undefined) : null;
-  useEffect(() => {
-    if (dismissedRaw === true) {
-      // Resolve the bare flag against whoever holds it RIGHT NOW, then re-derive.
-      const current = def ? resolveLatch(def, store, ladder.view) : null;
-      store.mergeAppState({ latchDismissed: current ? current.key : "" });
-      return;
-    }
-    const l = held?.latch as { title?: unknown } | undefined;
-    const title = typeof l?.title === "string" ? l.title : "";
-    // `latched` is the DISCRIMINANT chrome branches on, exactly as the voice service
-    // publishes `callState`: ONE field for the axis, never a truthy title plus an inverse
-    // guard on its sibling, which is the boolean soup design/state.md rules out ("a case
-    // never re-guards its own discriminant"). Title and icon are the held case's DATA, not
-    // its condition — which is why they are separate keys and not the condition itself.
-    const latched = held != null;
-    if (tstate.latched !== latched || tstate.latchTitle !== title || tstate.latchKey !== (held?.key ?? ""))
-      store.mergeAppState({ latched, latchTitle: title, latchKey: held?.key ?? "" });
-  }, [
-    held?.key,
-    held?.latch,
-    dismissedRaw,
-    ladder.view,
-    def,
-    store,
-    tstate.latched,
-    tstate.latchTitle,
-    tstate.latchKey,
-    structureVersion,
-  ]);
 
   // Loading/error hints carry NO styling — the SDK owns zero styles.
   if (error) return <div>Unoverse error: {error}</div>;
@@ -434,8 +399,54 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
   // ComponentSlot — filter the timeline to matching component pointers (KeyService).
   // A FACTORY: a mounted template's slots select within a SCOPE (the current
   // delivery — hold: latest, basic form); the app's own slots stay unscoped.
+  // THE STATE THE SCREEN PLACED IT IN (docs/unoverse/design/screen/UNOVERSE_SCREEN.md §2.6): a place draws
+  // each interface in that face, so a guest's tap shows once the screen has placed it, and an open
+  // task can never draw in the conversation.
+  const placed = (p: string): Record<string, unknown> | undefined => {
+    const state = store.placedState(p);
+    return state ? { state } : undefined;
+  };
+  // WHAT A SLOT OR A PLACE HOLDS, drawn: its fallback when empty; else its frame around the
+  // leaves, a single occupant filling the frame; else the leaves as a list.
+  const drawPointers = (node: UnoverseNode, pointers: string[], key: React.Key | undefined, fill: boolean): ReactNode => {
+    if (pointers.length === 0) {
+      return node.fallback ? renderNode(node.fallback, {}, dispatch, theme, key ?? "fallback", undefined, def?.defs) : null;
+    }
+    // `frame` — chrome that exists ONLY because the slot matched (fallback's twin).
+    // The frame subtree renders with a slot resolver that serves the outer slot's
+    // matches to any bare nested ComponentSlot — so a focus overlay is BORN when a
+    // component enters the state and DIES when it leaves (§5b: derived, not stored).
+    if (node.frame) {
+      // A SURFACE'S SINGLE OCCUPANT FILLS THE SURFACE (docs/design/05): a limit-1
+      // surface (detail panel, focus overlay) gives its occupant the frame's full
+      // height — the component's `height: "full"` finally has a definite container,
+      // with zero per-face styling. Multi-occupant surfaces (a rail) stay content-sized.
+      // Multi-occupant surfaces (a rail) animate reorders; a single occupant fills its
+      // frame directly — a measuring wrapper there would break the height chain.
+      const innerSlot: SlotResolver = () =>
+        fill
+          ? pointers.map((p) => leaf(p, placed(p), fill))
+          : <FlipList items={pointers.map((p) => ({ key: store.split(p).nodeId, node: leaf(p, placed(p)) }))} />;
+      // A panel declares its width ONCE (docs/design/05): `appWidth` grows the app
+      // (computeAppWidth) AND sizes the frame box here — the two can never disagree.
+      // Named sizes resolve via theme.appSize like any token; unresolvable → no width.
+      // `flex: 0 0 auto` — a panel is its declared width ALWAYS. A container that
+      // can't fit the sum clips at the edge; panels never compress into garbage.
+      // ONE WIDTH LAW (core/apps placeWidthStyle), the same as a template place and
+      // computeAppWidth. This frame once had its own copy without the `flex` word, and the
+      // task surface rendered in a zero-width frame beside a full-width app the moment the
+      // org's flex token went (SAB's comparison, blank, 2026-09-07).
+      const placeStyle = placeWidthStyle((node as { appWidth?: string }).appWidth, theme.appSize);
+      const frame = placeStyle ? ({ ...node.frame, style: { ...(node.frame.style ?? {}), ...placeStyle } } as UnoverseNode) : node.frame;
+      return renderNode(frame, store.getAppState() as Record<string, unknown>, dispatch, theme, key ?? "frame", innerSlot, def?.defs);
+    }
+    return <FlipList key={key ?? "slot"} items={pointers.map((p) => ({ key: store.split(p).nodeId, node: leaf(p, placed(p)) }))} />;
+  };
+
   const makeResolveSlot = (scope?: Set<string>): SlotResolver => {
   const resolveSlot: SlotResolver = (node: UnoverseNode, key?: React.Key): ReactNode => {
+    // A PLACE draws what the screen document put in it (docs/unoverse/design/screen/UNOVERSE_SCREEN.md).
+    if (node.type === "Place") return drawPointers(node, [...store.placeItems(String((node as { name?: string }).name ?? ""))], key, node.holds === "one");
     // A TEMPLATE PLACE (the container noun folded into templates, 2026-08-28): the
     // layout places it by NAME and owns its width; the manifest's `templates:` block
     // owns what it holds. An entry with `use:` MOUNTS a template definition (its own
@@ -521,24 +532,17 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
               // `flex` is the served "all remaining space" name. Without it the frame's
               // own styles decide (and a width-less frame beside a fixed-width chat
               // collapsed to its padding — observed live 2026-08-28).
-              const declaredW = (node as { appWidth?: string }).appWidth;
-              const placeW = cssWidth(typeof declaredW === "string" ? (theme.appSize?.[declaredW] ?? declaredW) : undefined);
-              // THEME-FREE FALLBACK (same law as computeAppWidth's marker): a theme without
-              // an `appSize.flex` token must still mean "fill the remaining host space" —
-              // an unresolved name collapsed the place to its padding (observed live
-              // 2026-08-28, the light theme's missing `flex`).
-              const flexFallback = !placeW && declaredW === "flex";
+              // ONE WIDTH LAW (core/apps placeWidthStyle): a named size or raw CSS sizes the
+              // place; `flex` with no token is the SDK's own word, fill the remaining host space
+              // (an unresolved name once collapsed the place to its padding, 2026-08-28).
+              const placeStyle = placeWidthStyle((node as { appWidth?: string }).appWidth, theme.appSize);
               const rawFrame = (node as { frame?: UnoverseNode }).frame;
               if (rawFrame) {
-                const frame = placeW
-                  ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), width: placeW, flex: "0 0 auto" } } as UnoverseNode)
-                  : flexFallback
-                    ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), flex: "1 1 0%", minWidth: 0 } } as UnoverseNode)
-                    : rawFrame;
+                const frame = placeStyle ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), ...placeStyle } } as UnoverseNode) : rawFrame;
                 const innerSlot: SlotResolver = () => tree;
                 return renderNode(frame, store.getAppState() as Record<string, unknown>, dispatch, theme, `${String(key ?? cname)}-frame`, innerSlot, def?.defs);
               }
-              return <div style={{ display: "flex", flexDirection: "column", minHeight: 0, ...(placeW ? { width: placeW, flex: "0 0 auto" } : flexFallback ? { flex: "1 1 0%", minWidth: 0 } : {}) }}>{tree}</div>;
+              return <div style={{ display: "flex", flexDirection: "column", minHeight: 0, ...((placeStyle ?? {}) as React.CSSProperties) }}>{tree}</div>;
             }}
           />
         );
@@ -589,39 +593,7 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
     if (isViewField(claim?.field) && typeof claim?.eq === "string" && declaredClaim && claim.eq !== surfacedView) {
       return node.fallback ? renderNode(node.fallback, {}, dispatch, theme, key ?? "fallback", undefined, def?.defs) : null;
     }
-    const pointers = selectPointers(store, node, scope);
-    if (pointers.length === 0) {
-      return node.fallback ? renderNode(node.fallback, {}, dispatch, theme, key ?? "fallback", undefined, def?.defs) : null;
-    }
-    // `frame` — chrome that exists ONLY because the slot matched (fallback's twin).
-    // The frame subtree renders with a slot resolver that serves the outer slot's
-    // matches to any bare nested ComponentSlot — so a focus overlay is BORN when a
-    // component enters the state and DIES when it leaves (§5b: derived, not stored).
-    if (node.frame) {
-      // A SURFACE'S SINGLE OCCUPANT FILLS THE SURFACE (docs/design/05): a limit-1
-      // surface (detail panel, focus overlay) gives its occupant the frame's full
-      // height — the component's `height: "full"` finally has a definite container,
-      // with zero per-face styling. Multi-occupant surfaces (a rail) stay content-sized.
-      const fill = node.select?.limit === 1;
-      // Multi-occupant surfaces (a rail) animate reorders; a single occupant fills its
-      // frame directly — a measuring wrapper there would break the height chain.
-      const innerSlot: SlotResolver = () =>
-        fill
-          ? pointers.map((p) => leaf(p, undefined, fill))
-          : <FlipList items={pointers.map((p) => ({ key: store.split(p).nodeId, node: leaf(p) }))} />;
-      // A panel declares its width ONCE (docs/design/05): `appWidth` grows the app
-      // (computeAppWidth) AND sizes the frame box here — the two can never disagree.
-      // Named sizes resolve via theme.appSize like any token; unresolvable → no width.
-      // `flex: 0 0 auto` — a panel is its declared width ALWAYS. A container that
-      // can't fit the sum clips at the edge; panels never compress into garbage.
-      const declared = (node as { appWidth?: string }).appWidth;
-      const appWidth = cssWidth(typeof declared === "string" ? (theme.appSize?.[declared] ?? declared) : undefined);
-      const frame = appWidth
-        ? ({ ...node.frame, style: { ...(node.frame.style ?? {}), width: appWidth, flex: "0 0 auto" } } as UnoverseNode)
-        : node.frame;
-      return renderNode(frame, store.getAppState() as Record<string, unknown>, dispatch, theme, key ?? "frame", innerSlot, def?.defs);
-    }
-    return <FlipList key={key ?? "slot"} items={pointers.map((p) => ({ key: store.split(p).nodeId, node: leaf(p) }))} />;
+    return drawPointers(node, selectPointers(store, node, scope), key, node.select?.limit === 1);
   };
   return resolveSlot;
   };
@@ -632,6 +604,8 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
   // in those sub-trees (design/templates/chatlayout/*.json). The assistant sub-tree's ComponentSlot
   // is scoped to THAT turn's components.
   const resolveTimeline = (node: UnoverseNode, key?: React.Key): ReactNode => {
+    // An app with places shows in the conversation exactly what the screen put there.
+    const inChat = def.places?.length ? new Set(store.placeItems("chat")) : null;
     return (
       <div key={key} style={styleToCss(node.style, theme)}>
         {store.getTimeline().map((turn) => {
@@ -645,6 +619,7 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
           const shown =
             turn.role === "assistant"
               ? turn.components.filter((p) => {
+                  if (inChat) return inChat.has(p);
                   const { chatId, nodeId } = store.split(p);
                   const view = viewOf(store.get(chatId, nodeId) as Record<string, unknown> | undefined);
                   return !view || !surfacedViews.has(view);
@@ -658,7 +633,7 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
             // Pass the turn's streaming state into each component's scope so a streamed
             // component (e.g. StreamingText) can stop its own loading dots when complete.
             const streaming = turn.role === "assistant" && turn.streamingState === "streaming";
-            return ptrs.map((p) => leaf(p, { streaming }));
+            return ptrs.map((p) => leaf(p, { streaming, ...placed(p) }));
           };
           // Data scope per turn = author's static data (avatarUrl, thinkingText…)
           // + NEUTRAL projections of the timeline model. The SDK exposes facts, never