npm - fenix-claude-plugin - Versions diffs - 0.1.2 → 0.2.0 - Mend

fenix-claude-plugin 0.1.2 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (48) hide show

package/.claude-plugin/plugin.json +13 -13
package/.mcp.json +11 -11
package/README.md +33 -40
package/artifacts/collections.html +149 -0
package/artifacts/fenix-workspace.html +1285 -0
package/artifacts/oa-editor.html +210 -0
package/artifacts/patent-editor.html +325 -0
package/artifacts/review-workspace.html +1135 -0
package/commands/fenix-install.md +19 -11
package/commands/fenix-setup.md +18 -13
package/package.json +16 -16
package/skills/fenix-application/SKILL.md +38 -11
package/skills/fenix-application/VERSION +1 -1
package/skills/fenix-application/references/claim1-method-drafting.md +1 -1
package/skills/fenix-application/references/claims.md +4 -5
package/skills/fenix-application/references/disclosure.md +116 -10
package/skills/fenix-application/references/editors.md +228 -39
package/skills/fenix-application/references/figure-description.md +1 -1
package/skills/fenix-application/references/figure-strategy.md +166 -0
package/skills/fenix-application/references/figures-guidance.md +1 -1
package/skills/fenix-application/references/figures.md +60 -9
package/skills/fenix-application/references/patent-review-checklist.md +3 -1
package/skills/fenix-application/references/patent-review.md +6 -2
package/skills/fenix-application/references/patent-safe.md +1 -1
package/skills/fenix-application/references/patent.md +11 -10
package/skills/fenix-application/references/spec-guidance.md +1 -1
package/skills/fenix-application/references/spec.md +17 -7
package/skills/fenix-application/scripts/figure_strategy_server.py +136 -0
package/skills/fenix-diagram/SKILL.md +54 -0
package/skills/fenix-diagram/VERSION +1 -0
package/skills/fenix-diagram/references/diagram-svg-guide.md +271 -0
package/skills/fenix-office-action/SKILL.md +9 -7
package/skills/fenix-office-action/VERSION +1 -1
package/skills/fenix-office-action/references/oa-analysis.md +14 -4
package/skills/fenix-office-action/references/oa-drafting.md +144 -50
package/skills/fenix-office-action/references/oa-response.md +31 -18
package/skills/fenix-project/SKILL.md +4 -3
package/skills/fenix-project/VERSION +1 -1
package/skills/fenix-project/references/create-project.md +11 -1
package/artifacts/practice-dashboard.html +0 -469
package/artifacts/project-overview.html +0 -481
package/artifacts/user-dashboard.html +0 -368
package/skills/fenix-application/CUSTOMIZE.md +0 -1
package/skills/fenix-application/assets/claims_editor.html +0 -86
package/skills/fenix-application/assets/figures_editor.html +0 -86
package/skills/fenix-application/assets/spec_editor.html +0 -86
package/skills/fenix-office-action/CUSTOMIZE.md +0 -1
package/skills/fenix-project/CUSTOMIZE.md +0 -1

package/artifacts/fenix-workspace.html ADDED Viewed

@@ -0,0 +1,1285 @@
+<!DOCTYPE html><script type="application/json" id="cowork-artifact-meta">
+{
+  "name": "Fenix",
+  "schemaVersion": 1,
+  "description": "The Fenix workspace wrapper. Knows nothing about Fenix except two tool names. Pages arrive as full HTML via read {resource:\"page\"}, fill the frame, and make every call through the wrapper's bridge.",
+  "mcpTools": [
+    "mcp__21ddcdf7-4f7b-45f7-ad0e-35afe7c1c96a__read",
+    "mcp__21ddcdf7-4f7b-45f7-ad0e-35afe7c1c96a__write"
+  ],
+  "mcpServerNames": [
+    "Fenix",
+    "Fenix"
+  ]
+}
+</script>
+<script type="application/json" id="fenix-install-manifest">
+{
+  "server": "Fenix",
+  "tools": [
+    "read",
+    "write"
+  ],
+  "note": "Register every listed tool fully-qualified at install. This artifact calls all of them, and a partial grant fails at the first missing one."
+}
+</script>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Fenix</title>
+<style>
+  * { box-sizing: border-box; }
+  html, body { height: 100%; }
+  /* No fill on the body, and none on the iframe either: a page carries its own
+     background, and the status line carries its own, so every region the
+     workspace itself owns is transparent and shows the HOST's surface rather
+     than a black band of our own. Before a page loads there is nothing of ours
+     to see — no dark flash — and the floating nav icons sit over the host too. */
+  body { margin:0; background:transparent; color:hsl(220 10% 92%);
+         font-family:-apple-system,"Segoe UI",system-ui,sans-serif;
+         display:grid; grid-template-rows:1fr 24px; }
+  /* content — the page owns everything above the line. There is no nav STRIP
+     any more: the category icons float in the page's top-right corner (see
+     #navCats) rather than in a band of their own, so the page reaches the very
+     top and the workspace shows one less line of its own chrome. #main is the
+     positioning context for that overlay. */
+  #main { min-height:0; display:flex; position:relative; }
+  iframe { flex:1; border:0; background:transparent; }
+  /* THE ONE LINE — and it should be easy to forget.
+     It is chrome under someone else's page, so it sits at the SAME lightness as
+     the body rather than a shade above it: a lighter strip reads as a panel and
+     draws the eye all day for information that is almost always "fine". Nothing
+     here carries colour while things are normal. Colour is reserved for the
+     states that are not — a warn/bad light, an error badge, an offered move —
+     so that when something IS coloured, it means something. Everything else
+     comes up to legibility on hover, when you have gone looking for it. */
+  #foot { display:flex; align-items:center; gap:10px; padding:0 12px;
+          background:hsl(220 10% 6%); border-top:1px solid hsl(220 8% 11%);
+          font-size:11px; color:hsl(220 4% 34%); }
+  #foot .led { width:6px; height:6px; border-radius:50%; background:hsl(220 5% 24%); flex:0 0 auto; }
+  /* Healthy is deliberately dim: a bright green light every second of every day
+     trains you to ignore the light, which is the one thing it must not do. */
+  #foot .led.ok { background:hsl(142 22% 32%); }
+  #foot .led.warn { background:hsl(45 90% 60%); }
+  #foot .led.bad { background:hsl(0 85% 68%); }
+  #foot .mono { font-family:ui-monospace,Consolas,monospace; }
+  #ctxSeg { color:hsl(220 5% 44%); cursor:pointer; max-width:260px; white-space:nowrap;
+            overflow:hidden; text-overflow:ellipsis; }
+  #ctxSeg:hover { color:hsl(220 10% 82%); }
+  /* the context URL — the only thing on the line that says where this page IS.
+     direction:rtl truncates from the LEFT, keeping the distinguishing tail.
+     Grey until hovered: it is a long string and a full-time blue link in the
+     corner of the eye is exactly the conspicuousness this bar should not have. */
+  #ctxUrl { color:hsl(220 4% 34%); text-decoration:none; max-width:340px; white-space:nowrap;
+            overflow:hidden; text-overflow:ellipsis; direction:rtl; text-align:left; }
+  #ctxUrl:hover { color:hsl(205 50% 60%); text-decoration:underline; }
+  #ctxUrl:empty { display:none; }
+  /* The category icons: tool / collections / dashboards.
+     They FLOAT in the page's top-right corner rather than sitting in a strip of
+     their own — the wrapper still owns them (same three destinations from every
+     page), but they read as part of the page instead of a band above it.
+     The group NEVER changes width and the icons never move — the one you are
+     already in stays in place, highlighted and inert, rather than disappearing.
+     A group that reflows as you navigate is one you cannot aim at without
+     looking, which for a control used this often is most of its value.
+     A frosted translucent pill (blur, no solid fill) carries them: the icons
+     sit over arbitrary page content that may be light OR dark, and a blur keeps
+     them legible on either without painting a block of colour. There is NO dark
+     fill anywhere here — the old active state used a near-black square, which
+     over the now-light host surface read as exactly the black box we were told
+     was too much. Selection is a light translucent highlight instead. */
+  #navCats { position:absolute; top:8px; right:10px; z-index:6;
+             display:flex; align-items:center; gap:2px; padding:3px;
+             border-radius:9px; background:hsl(220 14% 55% / .10);
+             -webkit-backdrop-filter:blur(10px) saturate(1.25);
+             backdrop-filter:blur(10px) saturate(1.25); }
+  #navCats:empty { display:none; }
+  #navCats button { background:none; border:0; border-radius:6px;
+                    padding:2px 6px; font-size:15px; line-height:1; cursor:pointer;
+                    filter:grayscale(.4) opacity(.55);
+                    transition:filter .12s ease, background .12s ease; }
+  #navCats button:hover:not(:disabled) { filter:none; background:hsl(220 16% 62% / .20); }
+  /* Active: full colour and a light highlight. Disabled too, so it cannot be
+     clicked and reads as "you are here" to a screen reader as well. */
+  #navCats button.active { filter:none; background:hsl(220 18% 66% / .26); cursor:default; }
+  /* Nothing to open — no matter bound, so the tool icon has no destination.
+     Shown rather than hidden, so the group keeps its shape. */
+  #navCats button.empty { cursor:not-allowed; filter:grayscale(1) opacity(.25); }
+  /* auto-switch toggle + the manual "go" it degrades to when switched off */
+  #followWrap { display:flex; align-items:center; gap:4px; cursor:pointer; user-select:none;
+                color:hsl(220 4% 34%); flex:0 0 auto; }
+  #followWrap:hover { color:hsl(220 10% 82%); }
+  #followWrap input { margin:0; cursor:pointer; width:11px; height:11px;
+                      accent-color:hsl(142 22% 38%); }
+  /* Stays visible: this one is an OFFER, and an offer nobody notices is a bug.
+     Toned down from the original amber, not switched off. */
+  #ctxGo { background:hsl(45 70% 55% / .10); border:1px solid hsl(45 70% 55% / .35);
+           color:hsl(45 55% 62%); border-radius:5px; padding:1px 8px; font-size:11px;
+           cursor:pointer; flex:0 0 auto; }
+  #ctxGo:hover { background:hsl(45 80% 58% / .22); color:hsl(45 85% 72%); }
+  #stMsg { white-space:nowrap; overflow:hidden; text-overflow:ellipsis; min-width:0; }
+  #foot .spacer { flex:1; }
+  #diagBtn { background:none; border:none; color:hsl(220 4% 30%); font-size:11px;
+             cursor:pointer; padding:0; }
+  #diagBtn:hover { color:hsl(220 10% 82%); }
+  /* diagnostics drawer (opens from the line, on demand) */
+  #diag { position:fixed; left:0; right:0; bottom:24px; height:0; overflow:hidden;
+          background:hsl(220 9% 9%); border-top:1px solid hsl(220 8% 16%);
+          transition:height .15s ease; display:flex; flex-direction:column; z-index:20; }
+  #diag.open { height:250px; }
+  #diag .bar { display:flex; gap:8px; align-items:center; padding:8px 12px;
+               border-bottom:1px solid hsl(220 8% 16%); flex:0 0 auto; }
+  #diag button { background:hsl(220 8% 12%); color:hsl(220 10% 92%);
+                 border:1px solid hsl(220 8% 16%); border-radius:6px; padding:5px 11px;
+                 font-size:11.5px; cursor:pointer; }
+  #diag button:hover { background:hsl(220 8% 15%); }
+  #diag .stats { font:11px ui-monospace,Consolas,monospace; color:hsl(220 5% 45%);
+                 margin-left:auto; }
+  #log { flex:1; overflow-y:auto; padding:8px 12px;
+         font:11px ui-monospace,Consolas,monospace; color:hsl(220 6% 62%); }
+  #log .ok { color:hsl(142 60% 45%); }
+  #log .err { color:hsl(0 85% 68%); }
+  #log .cache { color:hsl(200 70% 60%); }
+  /* THE ERROR PANEL — it lives in the drawer, not over the page.
+     This was a full-screen modal, and it was wrong twice over. It covered the
+     page it was complaining about (so you could not see the thing that failed,
+     or keep working around it), and it was hard to get rid of — a retrying
+     failure reopened it as fast as you dismissed it. An artifact is a PANE in
+     someone else's window; nothing in it has the standing to take the whole
+     screen away.
+     So the failure lands where the rest of this bar's information lands: the
+     drawer, expanded. The line keeps a red badge that says an error is there and
+     opens straight to it, which is what "on the screen, not folded into one
+     status word" actually required — the modal was never the point. */
+  #diagErr { flex:0 0 auto; max-height:150px; overflow-y:auto; padding:10px 12px;
+             border-bottom:1px solid hsl(220 8% 16%); background:hsl(0 30% 8%);
+             font-size:12px; line-height:1.5; color:hsl(220 8% 78%); display:none; }
+  #diagErr.on { display:block; }
+  #diagErr h2 { margin:0 0 6px; font-size:12.5px; color:hsl(0 80% 74%); }
+  #diagErr .msg { white-space:pre-wrap; word-break:break-word;
+                  font:11.5px ui-monospace,Consolas,monospace;
+                  background:hsl(220 10% 6%); border:1px solid hsl(220 8% 16%);
+                  border-radius:6px; padding:8px 10px; color:hsl(0 75% 76%); }
+  /* Repeats collapse into a count. A retrying failure otherwise writes the same
+     paragraph a hundred times and buries the one that is different. */
+  #diagErr .rep { color:hsl(0 50% 62%); font-size:11px; margin-left:6px; }
+  #diagErr h3 { font-size:11.5px; color:hsl(220 10% 92%); margin:10px 0 4px; }
+  #diagErr ul { margin:0; padding-left:18px; font:11.5px ui-monospace,Consolas,monospace; }
+  #diagErr li.no { color:hsl(0 80% 74%); }
+  #diagErr li.yes { color:hsl(142 50% 60%); }
+  #diagErr p { margin:5px 0; }
+  #diagErr .dim { color:hsl(220 5% 52%); }
+  #diagErr details { margin-top:8px; }
+  #diagErr summary { cursor:pointer; color:hsl(220 6% 58%); font-size:11.5px; }
+  #diagErr .acts { display:flex; gap:8px; margin-top:9px; }
+  #diagErr button { background:hsl(220 8% 12%); color:hsl(220 10% 92%);
+                    border:1px solid hsl(220 8% 16%); border-radius:6px; padding:4px 10px;
+                    font-size:11.5px; cursor:pointer; }
+  #diagErr button:hover { background:hsl(220 8% 15%); }
+  #errBadge { background:none; border:1px solid hsl(0 60% 34%); border-radius:5px;
+              background:hsl(0 60% 34% / .14); color:hsl(0 80% 74%); font-size:11px;
+              cursor:pointer; padding:1px 8px; }
+  #errBadge:hover { background:hsl(0 65% 40% / .26); color:hsl(0 85% 82%); }
+</style>
+</head>
+<body>
+<!-- The page fills #main; #navCats floats over its top-right corner. navCats is
+     the FIRST child so it is never wiped when a page mounts — mountPage swaps
+     only the <iframe>, leaving its siblings in place. -->
+<div id="main">
+  <span id="navCats" role="navigation" aria-label="Workspace"></span>
+</div>
+<div id="foot">
+  <span class="led" id="led"></span>
+  <span id="stConnT" class="mono">…</span>
+  <span id="ctxSeg" class="mono" title="Current context — click to refresh">—</span>
+  <label id="followWrap" title="Auto-switch: when chat or the website moves to another matter, open it here automatically. Turn off to stay put — you will be offered the move instead of taken there, which is what you want mid-edit."><input type="checkbox" id="follow"><span>auto-switch</span></label>
+  <button id="ctxGo" style="display:none">open →</button>
+  <!-- The URL comes last of the context group: it is the longest item and the
+       only one that truncates, so anything after it would sit at a position that
+       shifts with the address. The control keeps a fixed home. -->
+  <a id="ctxUrl" class="mono" target="_blank" rel="noreferrer"></a>
+  <span id="stCacheT" class="mono"></span>
+  <span id="stMsg"></span>
+  <span class="spacer"></span>
+  <button id="errBadge" style="display:none">show error</button>
+  <button id="diagBtn">⋯</button>
+</div>
+<div id="diag">
+  <div class="bar">
+    <button id="btnReload">Reload page</button>
+    <button id="btnClear">Clear page cache</button>
+    <button id="btnCopy">Copy details</button>
+    <span class="stats" id="diagStats"></span>
+  </div>
+  <!-- Above the log, because it is the thing you opened the drawer for. Not a
+       dialog: it steals no focus and blocks nothing. -->
+  <div id="diagErr" role="status" aria-live="polite">
+    <h2><span id="errTitle"></span><span class="rep" id="errRepeat"></span></h2>
+    <div class="msg" id="errMsg"></div>
+    <div id="errGrantWrap">
+      <h3>Tool authorization</h3>
+      <div id="errGrant"></div>
+    </div>
+    <!-- Collapsed. This explains the single most common install failure, but it
+         is four paragraphs, and on a server-side page error it is noise. Opened
+         automatically when the grant is the actual problem. -->
+    <details id="errInstall">
+      <summary>Where you install this from decides whether it works</summary>
+      <p>
+        <strong>💻 Local session (laptop icon)</strong> — a conversation running on this
+        computer. Installing from there registers the tool grant, and the artifact can call
+        Fenix. This is the only install that works.
+      </p>
+      <p>
+        <strong>☁️ Cloud session (cloud icon)</strong> — a conversation running on Anthropic's
+        servers. It <em>can</em> create the artifact, and the artifact will open and render —
+        but the grant is stripped in transit, by design: a remote session must not be able to
+        hand out access to tools on your machine. The result is a page that looks installed and
+        can never load data.
+      </p>
+      <p class="dim">
+        So reinstalling from the same cloud conversation produces the identical failure. Open a
+        local conversation — the one with the laptop icon — and install it there. There is no
+        permission prompt to find: with no grant, there is nothing to approve.
+      </p>
+    </details>
+    <div class="acts">
+      <button id="errCopy">Copy error</button>
+      <button id="errReload">Retry page</button>
+      <button id="errClose" style="margin-left:auto">Clear</button>
+    </div>
+  </div>
+  <div id="log"></div>
+</div>
+<script>
+(function () {
+  'use strict';
+  var $ = function (id) { return document.getElementById(id); };
+  var ART_ID = 'fenix-workspace';
+  var VERSION = 'v13';
+  var CACHE_NS = 'fx.pagecache.';
+  var CACHE_FMT = 1;
+  // The context poll. 3s, because the point of following context is that it
+  // feels immediate — a workspace that lags 20s behind the conversation is one
+  // you stop trusting and start refreshing by hand.
+  //
+  // Affordable because of what the poll actually SENDS: `haveRev`, the revision
+  // last seen. An unchanged context comes back {notModified:true, rev} — no
+  // payload, and on the server no query beyond the user-document read that
+  // authentication already had to do. See get_context in mcp.ts.
+  //
+  // The TTL is now SHORTER than the interval on purpose. It used to be longer
+  // (15s TTL against a 20s poll), which guaranteed every scheduled poll missed
+  // its own cache; the cache existed only to absorb the page's own reads. It
+  // still does that, and now never stands between the poll and a change.
+  var CTX_TTL_MS = 2000;
+  var CTX_POLL_MS = 3000;
+  /** Backs off to this while the workspace is hidden — nobody is watching. */
+  var CTX_POLL_IDLE_MS = 30000;
+  /** localStorage key: does this workspace follow the context, or stay put? */
+  var FOLLOW_KEY = 'fx.followContext';
+  var details = { kind: null, rpc: [], errors: [] };
+  var currentPage = null;      // {name, version}
+  // ---- meta / manifest / grant -------------------------------------------
+  function readJsonBlock(id) {
+    try { var el = document.getElementById(id); return el ? JSON.parse(el.textContent) : null; }
+    catch (e) { return null; }
+  }
+  var manifest = readJsonBlock('fenix-install-manifest') || { tools: [] };
+  var meta = readJsonBlock('cowork-artifact-meta') || {};
+  var grantedFq = meta.mcpTools || [];
+  function bare(n) {
+    n = String(n);
+    if (n.indexOf('mcp__') === 0) { var i = n.lastIndexOf('__'); return n.slice(i + 2); }
+    return n;
+  }
+  var grantedBare = {};
+  for (var i = 0; i < grantedFq.length; i++) grantedBare[bare(grantedFq[i])] = true;
+  var PREFIX = '';
+  if (grantedFq.length) {
+    var f0 = grantedFq[0];
+    PREFIX = f0.slice(0, f0.lastIndexOf('__') + 2);
+    try { localStorage.setItem('fenix.mcp.prefix', PREFIX); } catch (e) {}
+  } else {
+    try { PREFIX = localStorage.getItem('fenix.mcp.prefix') || ''; } catch (e) {}
+  }
+  // ---- status (the one line) ---------------------------------------------
+  var LIVE = !!(window.cowork && typeof window.cowork.callMcpTool === 'function');
+  function setConn(cls, text, msg) {
+    $('led').className = 'led ' + cls;
+    $('stConnT').textContent = text;
+    $('stMsg').textContent = msg || '';
+  }
+  // Deferred so the modal opens AFTER the whole script has run — selfCheck sits
+  // above the modal's own section, and its result is the single most common
+  // reason this page never loads, so it must be shown, not just summarised.
+  (function selfCheck() {
+    if (!LIVE) {
+      details.kind = 'no-bridge';
+      setConn('bad', 'offline', 'No connection to Fenix from this surface — open the installed copy from the Cowork sidebar.');
+      setTimeout(function () {
+        showErr('No connection to Fenix',
+          'This surface has no MCP bridge, so no tool call can be made from it at all.\n\n' +
+          'This is what a file preview looks like. Open the INSTALLED copy from the Cowork ' +
+          'sidebar rather than the generated file.', true);
+      }, 0);
+      return;
+    }
+    var missing = missingTools();
+    if (grantedFq.length === 0) {
+      details.kind = 'no-access';
+      setConn('bad', 'no access', 'No tool grant on this copy. Ask a desktop conversation to reinstall it with its Fenix permissions.');
+      setTimeout(function () {
+        showErr('This copy has no tool grant',
+          'The installed artifact registered zero tools, so every call fails before it reaches ' +
+          'Fenix.\n\nThe overwhelmingly common cause is below: it was installed from a cloud ' +
+          'session, where the grant is stripped in transit.', true);
+      }, 0);
+    } else if (missing.length) {
+      details.kind = 'partial-access';
+      setConn('warn', grantedFq.length + '/' + manifest.tools.length, 'Missing: ' + missing.join(', ') + '. Ask a desktop conversation to reinstall with all Fenix permissions.');
+      setTimeout(function () {
+        showErr('This copy is missing tool permissions',
+          'Granted ' + grantedFq.length + ' of ' + manifest.tools.length + ' tools. Missing: ' +
+          missing.join(', ') + '.\n\nA partial grant fails at the first missing tool, so pages ' +
+          'will load partway and then stop.', true);
+      }, 0);
+    } else {
+      details.kind = 'ready';
+      setConn('ok', 'fenix', '');
+    }
+  })();
+  // ---- the error panel ----------------------------------------------------
+  //
+  // An error once reached the user as one word on the status line ("page error")
+  // plus a log line behind a ⋯ drawer nobody opens. That is not enough to act on
+  // and not enough to relay: failures arrived in chat as "it isn't working". The
+  // answer to that was a full-screen modal, and it overshot — it covered the
+  // page that had failed and fought you when you tried to close it.
+  //
+  // What was actually needed is that the failure be VISIBLE and ADDRESSABLE, not
+  // that it be blocking. So: the line always carries a red badge while an error
+  // stands, and the badge opens the drawer with the full text, the grant list and
+  // a copy button. The drawer opens BY ITSELF only when the artifact can never
+  // work at all (no bridge, no grant, partial grant) — those are not events to
+  // acknowledge, they are the state of the thing, and no page is going to render
+  // behind them anyway. A page-level error stays an offer to look.
+  var lastError = null;
+  var errRepeats = 0;
+  /** Identity of the displayed error, so a retry loop increments instead of shouting. */
+  var errKey = null;
+  function missingTools() {
+    return manifest.tools.filter(function (t) { return !grantedBare[t]; });
+  }
+  function renderGrant() {
+    var el = $('errGrant');
+    el.innerHTML = '';
+    if (!manifest.tools.length && !grantedFq.length) {
+      var p = document.createElement('p');
+      p.className = 'dim';
+      p.textContent = 'This copy declares no tools at all — it is not an installed artifact.';
+      el.appendChild(p);
+      return;
+    }
+    var ul = document.createElement('ul');
+    manifest.tools.forEach(function (t) {
+      var ok = !!grantedBare[t];
+      var li = document.createElement('li');
+      li.className = ok ? 'yes' : 'no';
+      li.textContent = (ok ? '✓ ' : '✗ ') + t + (ok ? '' : ' — not granted');
+      ul.appendChild(li);
+    });
+    el.appendChild(ul);
+    var note = document.createElement('p');
+    if (!grantedFq.length) {
+      note.className = 'no';
+      note.textContent = 'No tools are granted, so nothing on this page can reach Fenix. ' +
+        'This is not a prompt someone dismissed — there is nothing to approve.';
+    } else if (missingTools().length) {
+      note.className = 'no';
+      note.textContent = 'A partial grant fails at the first missing tool. Reinstall with all of them.';
+    } else {
+      note.className = 'dim';
+      note.textContent = 'The grant is complete, so this is a server-side error rather than a permission problem.';
+    }
+    el.appendChild(note);
+  }
+  /**
+   * Show an error in the drawer.
+   *
+   * `fatal` means the artifact cannot work at all — the drawer opens itself.
+   * Everything else badges the line and waits to be asked.
+   */
+  function showErr(title, text, fatal) {
+    // ESCAPE, not a literal control character. This was a raw NUL byte, which
+    // JavaScript accepts happily -- and which made this whole file register as
+    // BINARY: grep found nothing in it, diffs went opaque, and a \u0000 shipped
+    // inside artifacts.generated.json. A separator that cannot occur in a title
+    // or a server message is the right idea; writing it as an escape keeps the
+    // source itself plain text.
+    var key = title + ' \u0001 ' + text;
+    errRepeats = (key === errKey) ? errRepeats + 1 : 0;
+    errKey = key;
+    lastError = { title: title, text: text, at: new Date().toISOString(),
+                  repeats: errRepeats };
+    $('errTitle').textContent = title;
+    $('errMsg').textContent = text;
+    $('errRepeat').textContent = errRepeats ? '(×' + (errRepeats + 1) + ')' : '';
+    renderGrant();
+    // The install essay is only the answer when the grant is the problem.
+    var grantProblem = !grantedFq.length || missingTools().length > 0;
+    $('errInstall').open = grantProblem;
+    $('errGrantWrap').style.display = grantProblem || !LIVE ? '' : 'none';
+    $('diagErr').classList.add('on');
+    $('errBadge').style.display = '';
+    if (fatal) $('diag').classList.add('open');
+  }
+  function clearErr() {
+    errKey = null; errRepeats = 0;
+    $('diagErr').classList.remove('on');
+    $('errBadge').style.display = 'none';
+  }
+  $('errClose').addEventListener('click', clearErr);
+  $('errBadge').addEventListener('click', function () {
+    $('diag').classList.add('open');
+    $('diagErr').scrollTop = 0;
+  });
+  $('errCopy').addEventListener('click', function () {
+    copyTo($('errCopy'), JSON.stringify({ error: lastError, report: buildReport() }, null, 2));
+  });
+  $('errReload').addEventListener('click', function () {
+    // An explicit retry is consent to try the unreachable address again.
+    undrawn = {};
+    openPage(currentPage ? (currentPage.address || currentPage.name) : null);
+  });
+  // ---- log ----------------------------------------------------------------
+  function log(msg, cls) {
+    var d = document.createElement('div');
+    if (cls) d.className = cls;
+    d.textContent = msg;
+    $('log').appendChild(d);
+    if ($('log').childNodes.length > 400) $('log').removeChild($('log').firstChild);
+    $('log').scrollTop = 1e9;
+  }
+  $('diagBtn').addEventListener('click', function () { $('diag').classList.toggle('open'); });
+  // ---- page cache ---------------------------------------------------------
+  /**
+   * THE SHARED EDITOR RUNTIME — Tiptap/ProseMirror + Preact.
+   *
+   * Both editors are built WITHOUT it and read it from a `__FXV` global instead,
+   * so it ships once rather than ~419 KB inside each. This wrapper is what
+   * provides it: fetched by name through the same page channel, cached PINNED, and
+   * spliced into an editor's frame ahead of the editor's own script.
+   *
+   * Held in memory for the session as well as in the cache, because every editor
+   * open needs it and the frame is rebuilt each time. The version is verified ONCE
+   * per session (a cheap notModified poll); a Tiptap upgrade lands on the next
+   * load, which is soon enough for something that changes a few times a year.
+   */
+  var VENDOR_NAME = 'tiptap-vendor';
+  var vendorJs = null;       // the runtime source for this session, once resolved
+  var vendorChecked = false; // version verified against the server this session
+  /** Pages that need the shared runtime: the editors, which are all under tools/. */
+  function needsVendor(name) { return String(name || '').indexOf('tools/') === 0; }
+  function cacheKey(name) { return CACHE_NS + 'page.' + name; }
+  // WHAT SURVIVES EVICTION when localStorage fills. Higher stays.
+  //
+  // The editors are the biggest pages by far AND the ones you return to across a
+  // session, so a dashboard you glanced at once must not push out the editor you
+  // keep opening. Two tiers do that: editors sit above every other page. A future
+  // PINNED tier is reserved for a shared vendor bundle (the Tiptap runtime split),
+  // which must never be evicted — re-fetching it would defeat the whole point —
+  // so it is named here even though nothing writes it yet.
+  var CACHE_PRI = { pinned: 3, editor: 2, page: 1 };
+  function cachePriority(name) {
+    // The shared editor runtime is PINNED: both editors reference it instead of
+    // carrying their own copy, so evicting it would mean re-downloading half a
+    // megabyte the next time either one opens — the exact cost the split removed.
+    if (name === VENDOR_NAME) return CACHE_PRI.pinned;
+    return String(name || '').indexOf('tools/') === 0 ? CACHE_PRI.editor : CACHE_PRI.page;
+  }
+  function cacheGet(name) {
+    try {
+      var rec = JSON.parse(localStorage.getItem(cacheKey(name)) || 'null');
+      if (!rec || rec.fmt !== CACHE_FMT || typeof rec.html !== 'string') return null;
+      // READING A PAGE IS USING IT. Bump its access time so eviction is LRU by
+      // USE, not by write. The old logic ordered by savedAt, which a cache HIT
+      // never touched — so an editor opened fifty times but fetched once looked
+      // older than a dashboard fetched a moment ago, and got evicted first. This
+      // is the whole bug. Best-effort and same-size (only usedAt changes on an
+      // existing key), so it cannot exceed quota; a failed write just leaves the
+      // previous time, which is harmless.
+      rec.usedAt = Date.now();
+      try { localStorage.setItem(cacheKey(name), JSON.stringify(rec)); } catch (e2) {}
+      return rec;
+    } catch (e) { return null; }
+  }
+  function ownKeys() {
+    var keys = [];
+    try {
+      for (var i = 0; i < localStorage.length; i++) {
+        var k = localStorage.key(i);
+        if (k && k.indexOf(CACHE_NS) === 0) keys.push(k);
+      }
+    } catch (e) {}
+    return keys;
+  }
+  function cacheSet(name, version, html) {
+    var now = Date.now();
+    var priority = cachePriority(name);
+    var rec = JSON.stringify({ fmt: CACHE_FMT, version: version, savedAt: now, usedAt: now, priority: priority, html: html });
+    try { localStorage.setItem(cacheKey(name), rec); return true; }
+    catch (e) {
+      // Make room by evicting the LEAST VALUABLE resident first — lowest priority,
+      // and within a priority the least recently USED. Crucially, never evict a
+      // page MORE important than the one being stored: a cheap page runs uncached
+      // rather than displacing an editor. `self` is excluded — a stale copy of
+      // THIS page is replaced by the setItem above (a same-key overwrite), not
+      // evicted, so removing it here would just churn.
+      var self = cacheKey(name);
+      var victims = ownKeys()
+        .filter(function (k) { return k.indexOf(CACHE_NS + 'page.') === 0 && k !== self; })
+        .map(function (k) {
+          var r = {}; try { r = JSON.parse(localStorage.getItem(k)) || {}; } catch (e2) {}
+          var pri = typeof r.priority === 'number' ? r.priority : CACHE_PRI.page;
+          return { k: k, pri: pri, at: r.usedAt || r.savedAt || 0 };
+        })
+        .filter(function (v) { return v.pri <= priority; })
+        .sort(function (a, b) { return a.pri - b.pri || a.at - b.at; });
+      for (var i = 0; i < victims.length; i++) {
+        try { localStorage.removeItem(victims[i].k); } catch (e2) {}
+        try { localStorage.setItem(cacheKey(name), rec); log('cache: evicted ' + victims[i].k, 'cache'); return true; } catch (e3) {}
+      }
+      log('cache: quota — running uncached', 'err');
+      return false;
+    }
+  }
+  function haveVersions() {
+    var v = {};
+    ownKeys().forEach(function (k) {
+      if (k.indexOf(CACHE_NS + 'page.') !== 0) return;
+      try {
+        var rec = JSON.parse(localStorage.getItem(k));
+        if (rec && rec.fmt === CACHE_FMT) v[k.slice((CACHE_NS + 'page.').length)] = rec.version;
+      } catch (e) {}
+    });
+    return v;
+  }
+  function cacheSummary() {
+    var n = 0, chars = 0;
+    ownKeys().forEach(function (k) { n++; try { chars += (localStorage.getItem(k) || '').length; } catch (e) {} });
+    $('stCacheT').textContent = n ? (n + '·' + Math.round(chars / 1024) + 'KB') : '';
+  }
+  $('btnClear').addEventListener('click', function () {
+    ownKeys().forEach(function (k) { try { localStorage.removeItem(k); } catch (e) {} });
+    log('cache: cleared own keys', 'cache');
+    cacheSummary();
+  });
+  // ---- context cache ------------------------------------------------------
+  var ctxCache = { payload: null, at: 0 };
+  var ctxStats = { hits: 0, misses: 0, invalidations: 0 };
+  function ctxFresh() { return !!(ctxCache.payload && (Date.now() - ctxCache.at) < CTX_TTL_MS); }
+  function ctxInvalidate(why) {
+    if (ctxCache.payload) {
+      ctxCache.payload = null; ctxCache.at = 0; ctxStats.invalidations++;
+      log('ctx: invalidated (' + why + ')', 'cache');
+      setTimeout(updateCtxSeg, 600);
+    }
+  }
+  // ---- tool calls (the one choke point) -----------------------------------
+  function isErr(text) { return { isError: true, content: [{ type: 'text', text: text }] }; }
+  function firstText(r) {
+    if (!r) return '';
+    if (Array.isArray(r.content))
+      return r.content.map(function (c) { return (c && c.text) || ''; }).join('');
+    return typeof r === 'string' ? r : JSON.stringify(r);
+  }
+  function shellCall(name, args) {
+    var b = bare(name);
+    var t0 = Date.now();
+    if (!LIVE) return Promise.resolve(isErr('FX: no bridge on this surface.'));
+    if (!grantedBare[b]) {
+      log('✗ ' + b + ' — not in grant', 'err');
+      details.rpc.push({ tool: b, ok: false, ms: 0, error: 'not-in-grant' });
+      return Promise.resolve(isErr('FX: tool "' + b + '" is not in this artifact’s grant (' +
+        Object.keys(grantedBare).join(', ') + '). Ask a desktop conversation to reinstall it with its Fenix permissions.'));
+    }
+    var isCtxRead = (b === 'read' && args && args.resource === 'context');
+    if (isCtxRead && ctxFresh()) {
+      ctxStats.hits++;
+      details.rpc.push({ tool: 'read:context', ok: true, ms: 0, cached: true });
+      return Promise.resolve(ctxCache.payload);
+    }
+    var label = b + (args && args.resource ? ':' + args.resource : '');
+    return window.cowork.callMcpTool(PREFIX + b, args || {}).then(function (r) {
+      var ms = Date.now() - t0;
+      var bad = r && r.isError;
+      log((bad ? '✗ ' : '✓ ') + label + ' — ' + ms + 'ms', bad ? 'err' : 'ok');
+      details.rpc.push({ tool: label, ok: !bad, ms: ms, error: bad ? firstText(r).slice(0, 200) : undefined });
+      if (!bad) {
+        try { localStorage.setItem('fx.installed.' + ART_ID, '1'); } catch (e) {}
+        if (isCtxRead) { ctxCache.payload = r; ctxCache.at = Date.now(); ctxStats.misses++; }
+        else if (b === 'write') ctxInvalidate('write:' + ((args && args.resource) || '?'));
+        // any write may move context (writes update context by default);
+        // the wrapper needs no knowledge of which resources are matter-scoped.
+      }
+      return r;
+    }, function (e) {
+      var ms = Date.now() - t0;
+      log('✗ ' + label + ' — threw (' + ms + 'ms)', 'err');
+      details.rpc.push({ tool: label, ok: false, ms: ms, error: ('threw: ' + ((e && e.message) || e)).slice(0, 200) });
+      return isErr('FX: call threw: ' + ((e && e.message) || String(e)));
+    });
+  }
+  // ---- RPC bridge + shim --------------------------------------------------
+  var frame = null;
+  window.addEventListener('message', function (e) {
+    var d = e.data;
+    if (!d) return;
+    if (d.__fx === 'call') {
+      shellCall(d.tool, d.args).then(function (r) {
+        if (frame && frame.contentWindow)
+          frame.contentWindow.postMessage({ __fx: 'result', seq: d.seq, payload: r }, '*');
+      });
+    } else if (d.__fx === 'open' && d.page) {
+      openPage(String(d.page));      // navigation is content-driven
+    } else if (d.__fx === 'showing' && d.address) {
+      // The mounted page navigated INSIDE itself. Nothing to fetch; just record
+      // where it is, so the context poll recognises the address as current.
+      if (currentPage) currentPage.address = String(d.address);
+      updateDraftBtn();
+    } else if (d.__fx === 'pageError') {
+      // A page that died while its modules were still evaluating. It reports
+      // itself through the prelude that build-nodes.mjs puts at the head of every
+      // node bundle — the shell cannot see inside the frame, and until this
+      // existed such a failure was invisible from out here: the page fetch had
+      // SUCCEEDED, so the status line stayed green and `errors: []` was the
+      // honest-looking lie in every copied diagnostic.
+      var pe = String(d.text || 'The page failed to start.');
+      details.errors.push('page runtime: ' + pe.slice(0, 300));
+      setConn('bad', 'page failed', 'The page failed to start.');
+      showErr('The page failed to start', pe);
+    }
+  });
+  /**
+   * The shim, built per mount so it can carry the ADDRESS this page was opened at.
+   *
+   * A page is cached and served by TEMPLATE — every matter shares one copy of
+   * `tools/patent/claims` — so the html itself cannot say which matter or which
+   * subview was asked for. The editor was left to guess, and it guessed "claims"
+   * every time: opening `tools/patent/figures/<id>` landed on Claims. Harmless
+   * while nothing produced subview addresses; not harmless now that the Draft
+   * button and auto-switch both do.
+   *
+   * The wrapper is the only thing that knows, because it is what asked. So it
+   * tells the page, here, rather than the page inferring it from a context whose
+   * navPath is set by the WEBSITE and says nothing about what this frame opened.
+   */
+  function shimFor(address, name) {
+    // JSON.stringify, then neutralise every "<" as \u003c. The result is
+    // embedded in an inline script, and a closing script tag appearing inside a
+    // value would end the block early. (Note this comment carefully does not
+    // write that tag out either — the same rule applies to comments, and one
+    // spelled out here as an example is what a parse check caught.)
+    var page = JSON.stringify({ address: address || null, name: name || null }).replace(/</g, '\\u003c');
+    return '<script>(function(){' +
+      'var seq=0,pending={};' +
+      'window.addEventListener("message",function(e){var d=e.data;if(!d||d.__fx!=="result")return;' +
+      'var p=pending[d.seq];if(!p)return;delete pending[d.seq];p(d.payload);});' +
+      'function call(name,args){return new Promise(function(res){' +
+      'var s=++seq;pending[s]=res;' +
+      'setTimeout(function(){if(pending[s]){delete pending[s];' +
+      'res({isError:true,content:[{type:"text",text:"FX: call timed out after 30s"}]});}},30000);' +
+      'parent.postMessage({__fx:"call",seq:s,tool:String(name),args:args||{}},"*");});}' +
+      'function open(page){parent.postMessage({__fx:"open",page:String(page)},"*");}' +
+      // A page that serves several addresses (collections is one bundle for all
+      // its lists) can move between them WITHOUT a fetch. It tells the wrapper
+      // where it went, so the wrapper does not later "correct" it by re-opening
+      // an address it is already showing.
+      'function showing(addr){parent.postMessage({__fx:"showing",address:String(addr)},"*");}' +
+      'window.cowork={callMcpTool:call,openPage:open,setPage:showing,__fxShim:true,page:' + page + '};' +
+      '})();<\/script>';
+  }
+  /**
+   * The runtime as a <script> for splicing into a frame.
+   *
+   * A closing script tag anywhere in the bundle would end the block early and
+   * leave the rest as page text, so neutralise it — the same rule shimFor follows
+   * for its JSON. Written `<\/script` here so this file's OWN script block is not
+   * terminated by the pattern that describes it.
+   */
+  function vendorScript() {
+    if (!vendorJs) return '';
+    return '<script>' + vendorJs.replace(/<\/script/gi, '<\\/script') + '<\/script>';
+  }
+  /**
+   * Make sure the shared runtime is in hand, then continue.
+   *
+   * One version check per session: pass the cached version and an unchanged
+   * runtime answers notModified with no payload. Every failure path still calls
+   * back — a page that cannot get the runtime should mount and let the editor
+   * report a missing runtime itself, which it does clearly, rather than hang on a
+   * blank frame.
+   */
+  function ensureVendor(done) {
+    if (vendorChecked) return done();
+    var cached = cacheGet(VENDOR_NAME);
+    var args = { resource: 'page', name: VENDOR_NAME };
+    if (cached) { args.haveVersions = {}; args.haveVersions[VENDOR_NAME] = cached.version; }
+    shellCall('read', args).then(function (r) {
+      vendorChecked = true;
+      try {
+        if (r && !r.isError) {
+          var p = JSON.parse(firstText(r));
+          if (p.notModified) {
+            if (cached) vendorJs = cached.html;
+          } else if (typeof p.html === 'string' && p.html) {
+            vendorJs = p.html;
+            cacheSet(VENDOR_NAME, p.version, p.html);
+            log('runtime: ' + VENDOR_NAME + ' v' + p.version + ' (' + Math.round(p.html.length / 1024) + 'KB)', 'cache');
+          }
+        } else if (r && r.isError) {
+          details.errors.push('runtime: ' + firstText(r).slice(0, 200));
+        }
+      } catch (e) {}
+      if (!vendorJs && cached) vendorJs = cached.html; // last resort: whatever we held
+      if (!vendorJs) log('runtime unavailable — the editor will ask for a workspace update', 'err');
+      done();
+    }, function () {
+      vendorChecked = true;
+      if (cached) vendorJs = cached.html;
+      done();
+    });
+  }
+  function injectShim(html, address, name) {
+    var head = shimFor(address, name);
+    // The runtime goes in FIRST: it must define __FXV before the page's own
+    // bundle runs, and that bundle is a later <script> in the body.
+    if (needsVendor(name) && vendorJs) head = vendorScript() + head;
+    var m = html.match(/<head[^>]*>/i);
+    if (m) return html.slice(0, m.index + m[0].length) + head + html.slice(m.index + m[0].length);
+    m = html.match(/<html[^>]*>/i);
+    if (m) return html.slice(0, m.index + m[0].length) + head + html.slice(m.index + m[0].length);
+    return head + html;
+  }
+  /**
+   * `address` is the FULL path asked for (id and all); `name` is its template,
+   * which is the cache key. The page needs the address — it is the only thing
+   * carrying which subview and which matter — while the wrapper tracks by
+   * template so two matters share one cached copy.
+   */
+  function mountPage(html, name, version, how, address) {
+    // An editor cannot start without the shared runtime, so fetch it first and
+    // mount in the callback. ensureVendor short-circuits once it has resolved, so
+    // this costs one call per session, not one per open.
+    if (needsVendor(name) && !vendorJs) {
+      return ensureVendor(function () { mountPageNow(html, name, version, how, address); });
+    }
+    mountPageNow(html, name, version, how, address);
+  }
+  function mountPageNow(html, name, version, how, address) {
+    var main = $('main');
+    if (frame) { main.removeChild(frame); frame = null; }
+    frame = document.createElement('iframe');
+    main.appendChild(frame);
+    frame.srcdoc = injectShim(html, address || name, name);
+    currentPage = { name: name, version: version, address: address || name };
+    // Visibility depends on where we now ARE, not only on what the context says.
+    updateDraftBtn();
+    log('page: ' + name + ' v' + version + ' (' + how + ', ' + Math.round(html.length / 1024) + 'KB)');
+  }
+  // ---- page delivery via the read tool ------------------------------------
+  // read {resource:'page'}                → server-chosen entry page
+  // read {resource:'page', name:<n>}      → that page
+  // both accept haveVersions:{name:ver}   → server may answer notModified
+  // response: {name, version, html} | {name, version, notModified:true}
+  /**
+   * NAVIGATION BEATS THE POLL.
+   *
+   * A page read carrying an id also SETS the working context — that is the
+   * server's rule, arriving at an address is navigating. So between asking for a
+   * page and that call returning, the context on the server is still the OLD
+   * one. A poll landing in that window reads the old context, decides the
+   * workspace is in the wrong place, and (with auto-switch on) navigates back —
+   * undoing the click that was still in flight.
+   *
+   * So polling is suspended for the whole of a navigation and resumes only once
+   * the call that moves the context has ANSWERED. The counter rather than a
+   * boolean because a navigation can nest: notModified refetches the page a
+   * second time before it mounts.
+   */
+  var navPending = 0;
+  // Bumped every time a navigation BEGINS. The poll snapshots it before issuing
+  // its context read and re-checks it when the read returns: if a navigation
+  // started in that window, the reply describes where we WERE, and acting on it
+  // (openPage of the old target, under auto-switch) would undo the move just
+  // made. navPending alone cannot catch this — it is 0 when the poll starts and
+  // only goes up mid-flight, so the guard at the top of updateCtxSeg passes and
+  // the stale reply is processed anyway. The generation counter closes that gap.
+  var navGen = 0;
+  function beginNav() { navPending++; navGen++; }
+  function endNav() {
+    navPending = Math.max(0, navPending - 1);
+    if (navPending === 0) {
+      // The context has moved and the server has confirmed it. Drop the cached
+      // rev so the next poll takes the full reply rather than a notModified
+      // computed against what we knew before we moved.
+      ctxRev = null;
+      setTimeout(updateCtxSeg, 0);
+    }
+  }
+  /**
+   * Addresses the server has told us no artifact draws, as {address: message}.
+   *
+   * THIS IS A LOOP BREAKER, and the loop was real. A failed openPage still calls
+   * endNav(), which drops ctxRev so the next poll takes a FULL context reply
+   * rather than a notModified. That reply names the same unreachable target, the
+   * follow logic opens it, it fails, and round again — one fetch every three
+   * seconds, forever, each one re-raising the same error. (Observed against
+   * `dashboards/project/<id>`, which the context URL points at and which nothing
+   * draws.) Latched only for the server's deterministic "real page, nothing
+   * draws it" answer: a transient failure must stay retryable, and this one will
+   * never come out differently until the artifact ships.
+   */
+  var undrawn = {};
+  var UNDRAWN_RE = /no artifact draws it yet/i;
+  function openPage(name) {
+    // The address requested, kept for the mount below: the server answers with a
+    // TEMPLATE name (the id stripped), so by the time the html arrives the
+    // subview and matter are no longer in the reply.
+    var requested = name || null;
+    if (name && undrawn[name]) return;      // already answered, definitively
+    var args = { resource: 'page', haveVersions: haveVersions() };
+    if (name) args.name = name;
+    beginNav();
+    shellCall('read', args).then(function (r) {
+      if (r && r.isError) {
+        var msg = firstText(r);
+        details.errors.push('page ' + (name || '(entry)') + ': ' + msg.slice(0, 300));
+        setConn(details.kind === 'ready' ? 'warn' : 'bad', 'page error', 'Fenix answered with an error.');
+        if (name && UNDRAWN_RE.test(msg)) {
+          undrawn[name] = msg;
+          // Not a malfunction — a place the workspace does not go yet, and the
+          // page you were on is still there and still usable. Say it on the
+          // line and leave the page alone; the badge carries the detail.
+          pendingTarget = null;
+          $('ctxGo').style.display = 'none';
+          setConn(details.kind === 'ready' ? 'warn' : 'bad', 'not here',
+                  name + ' opens on the website — nothing draws it here yet.');
+        }
+        showErr('Fenix could not open ' + (name || 'the entry page'), msg);
+        endNav();
+        return;
+      }
+      var p;
+      try { p = JSON.parse(firstText(r)); } catch (e) {
+        log('✗ page parse: ' + e.message, 'err');
+        showErr('Fenix sent a page this shell could not read',
+                e.message + '\n\n--- response ---\n' + firstText(r).slice(0, 4000));
+        endNav();
+        return;
+      }
+      if (p.notModified) {
+        var c = cacheGet(p.name);
+        if (c && c.version === p.version) { mountPage(c.html, p.name, p.version, 'cache', requested); cacheSummary(); endNav(); return; }
+        // By ADDRESS, not by the template the server answered with. A page read
+        // publishes where you are (see recordPageArrival), so re-requesting
+        // `tools/patent` instead of `tools/patent/claims/<id>` would drop the
+        // matter out of the address every other surface follows.
+        shellCall('read', { resource: 'page', name: requested || p.name }).then(function (r2) {
+          if (r2 && r2.isError) { details.errors.push('page refetch: ' + firstText(r2).slice(0, 300)); endNav(); return; }
+          var p2; try { p2 = JSON.parse(firstText(r2)); } catch (e) { endNav(); return; }
+          if (typeof p2.html === 'string') {
+            if (p2.cache !== false) cacheSet(p2.name, p2.version, p2.html);
+            mountPage(p2.html, p2.name, p2.version, 'fetched', requested);
+            cacheSummary();
+          }
+          endNav();
+        });
+        return;
+      }
+      if (typeof p.html === 'string' && p.html) {
+        // cache:false means the HTML has live data baked into it — a builder
+        // page rendered server-side. Storing it would pin the numbers as they
+        // were at fetch time and show them again on the next open.
+        if (p.cache === false) {
+          try { localStorage.removeItem(cacheKey(p.name)); } catch (e) {}
+          mountPage(p.html, p.name, p.version, 'fetched', requested);
+          cacheSummary();
+          endNav();
+          return;
+        }
+        var cc = cacheGet(p.name);
+        if (!cc || cc.version !== p.version) cacheSet(p.name, p.version, p.html);
+        mountPage(p.html, p.name, p.version, (cc && cc.version === p.version) ? 'refreshed' : 'fetched', requested);
+        cacheSummary();
+      } else {
+        log('✗ page response had no html', 'err');
+      }
+      endNav();
+    }, function () {
+      // The call itself never rejects (shellCall converts throws into error
+      // envelopes), but releasing here too means no future change to that can
+      // strand the guard and freeze the poll permanently.
+      endNav();
+    });
+  }
+  $('btnReload').addEventListener('click', function () {
+    if (currentPage) {
+      try { localStorage.removeItem(cacheKey(currentPage.name)); } catch (e) {}
+      // Reopen the ADDRESS, not the template — reloading must not silently drop
+      // the matter and subview you were on.
+      openPage(currentPage.address || currentPage.name);
+    } else openPage(null);
+  });
+  // ---- context segment ----------------------------------------------------
+  /**
+   * The context, as a label and — when the server can name one — a URL.
+   *
+   * `url` is derived server-side in get_context from the session's navPath (else
+   * its bound matter), because only the server knows the tenant's subdomain. The
+   * shell never builds it: a guessed address is worse than no address.
+   */
+  var ctxUrlValue = null;
+  function parseCtx(r) {
+    var t = firstText(r);
+    try {
+      var j = JSON.parse(t);
+      var o = j.session || j.context || j;
+      var id = o.label || o.matterNumber || o.docket || o.projectNumber || o.title || o.name ||
+               (o.ids && o.ids.projectId) || o.projectId || null;
+      var src = o.source ? (' · ' + o.source) : '';
+      var url = typeof o.url === 'string' && o.url ? o.url : null;
+      // The ADDRESS the context points at — what the workspace would open if it
+      // were following. navPath first (it names a specific view), the bound
+      // matter as the fallback. Never derived from the url: that is absolute and
+      // tenant-specific, while pages are addressed by nav path.
+      var target = typeof o.navPath === 'string' && o.navPath
+        ? o.navPath.replace(/^\/+/, '')
+        : (o.ids && o.ids.projectId ? 'collections/projects/' + o.ids.projectId : null);
+      if (id || url) return { label: id ? String(id) + src : '—', url: url, target: target, full: t };
+    } catch (e) {}
+    t = (t || '').replace(/\s+/g, ' ').trim();
+    return { label: t ? t.slice(0, 40) : '—', url: null, target: null, full: t };
+  }
+  // ---- following the context ----------------------------------------------
+  //
+  // WHY THIS IS A CHOICE AND NOT A BEHAVIOUR. Chasing the context automatically
+  // is right when the workspace is a window onto whatever the conversation is
+  // doing, and WRONG when someone is mid-edit: the patent editor deliberately
+  // reads context once and PINS it, precisely so a matter cannot be swapped out
+  // from under an open editor. Both are legitimate; only the person knows which
+  // they are doing. So the wrapper follows by default and the toggle turns it
+  // off, and with it off a move becomes an offer ("open →") instead of a jump.
+  var ctxRev = null;             // last rev seen; sent as haveRev so the poll is cheap
+  var pendingTarget = null;      // where the context points, when we have not gone there
+  function following() {
+    try { return localStorage.getItem(FOLLOW_KEY) !== '0'; } catch (e) { return true; }
+  }
+  function setFollowing(on) {
+    try { localStorage.setItem(FOLLOW_KEY, on ? '1' : '0'); } catch (e) {}
+    $('follow').checked = on;
+    // Turning it back on adopts whatever was waiting, which is what someone
+    // ticking the box is asking for.
+    if (on && pendingTarget) openPage(pendingTarget);
+  }
+  $('follow').addEventListener('change', function () { setFollowing($('follow').checked); });
+  $('ctxGo').addEventListener('click', function () { if (pendingTarget) openPage(pendingTarget); });
+  /**
+   * The "Draft" control: open the current matter in its editor.
+   *
+   * The ADDRESS comes from the server (`draft` on the context reply), not from
+   * here. Choosing between the application editor and the OA editor means
+   * knowing project types, and this wrapper deliberately knows nothing about
+   * Fenix beyond two tool names — a copy of that rule living here is a copy that
+   * will disagree with the editor's own classifier, and the failure mode is
+   * silent: the OA tool opened on a drafting matter, minus its figures,
+   * specification and disclosure tabs.
+   *
+   * Hidden on the editors themselves. A button whose only effect is to reload
+   * the page you are already on is noise, and worse, it reads as though it does
+   * something.
+   */
+  var draftTarget = null;
+  var navTargets = null;   // {category: address|null}, named by the server
+  /**
+   * The category icons, drawn from whatever the server named.
+   *
+   * The LIST comes from the server's `nav` object, not from a list here: adding
+   * a category is then a server change, and an installed wrapper picks it up
+   * without a reinstall — the one kind of change this architecture exists to
+   * avoid. The icons and labels below are presentation, so they do live here;
+   * an unknown category still renders, with its name as the label, rather than
+   * silently vanishing.
+   */
+  // No `admin` — not a destination the workspace offers. It is still a real
+  // CATEGORY (admin/logs is a page, and lands here as "no icon active"), just
+  // not somewhere this bar navigates to. Adding it later is a server change:
+  // the server names the destinations and anything it names renders.
+  var CAT_ICON = { tools: '🔧', collections: '📚', dashboards: '▦' };
+  var CAT_LABEL = { tools: 'Editor', collections: 'Collections', dashboards: 'Dashboards' };
+  var CAT_ORDER = ['tools', 'collections', 'dashboards'];
+  /** The category of the page currently mounted — the first path segment. */
+  function currentCategory() {
+    if (!currentPage || !currentPage.name) return null;
+    return String(currentPage.name).split('/')[0] || null;
+  }
+  function renderNavCats() {
+    var host = $('navCats');
+    if (!navTargets) { host.innerHTML = ''; return; }
+    var here = currentCategory();
+    var keys = CAT_ORDER.filter(function (k) { return k in navTargets; })
+      .concat(Object.keys(navTargets).filter(function (k) { return CAT_ORDER.indexOf(k) < 0; }));
+    host.innerHTML = '';
+    keys.forEach(function (cat) {
+      var target = navTargets[cat];
+      var active = cat === here;
+      var b = document.createElement('button');
+      b.type = 'button';
+      b.textContent = CAT_ICON[cat] || '•';
+      var label = CAT_LABEL[cat] || cat;
+      if (active) {
+        b.className = 'active';
+        b.disabled = true;
+        b.title = label + ' — you are here';
+        b.setAttribute('aria-current', 'page');
+      } else if (!target) {
+        // Only reachable for `tools`, which needs a bound matter.
+        b.className = 'empty';
+        b.disabled = true;
+        b.title = label + ' — no matter is open, so there is nothing to draft';
+      } else {
+        b.title = 'Go to ' + label +
+          (cat === 'tools' && draftTarget
+            ? (draftTarget.kind === 'oa' ? ' (OA response)' : ' (application)')
+            : '') + ' — ' + target;
+        b.onclick = function () { openPage(target); };
+      }
+      b.setAttribute('aria-label', label);
+      host.appendChild(b);
+    });
+  }
+  /**
+   * THE MATTER SELECTOR LIVES IN THE PAGE, not here.
+   *
+   * It was briefly in this bar, and that was wrong for a reason worth writing
+   * down: a matter is not relevant to every page. A collections list, a
+   * dashboard — most of what the workspace shows is not ABOUT one matter, and a
+   * control that is meaningless on most pages still has to be explained on all
+   * of them. It also cost the wrapper knowledge it otherwise does not need
+   * (what a matter is, how they are listed and labelled) inside an INSTALLED
+   * artifact, where changes cost a reinstall.
+   *
+   * The editor owns it again, because that is the page where the matter IS the
+   * subject. The wrapper still names the current one in its status line, which
+   * is the part that genuinely belongs to every page.
+   */
+  /** Kept as the old name so the mount/context call sites read the same. */
+  function updateDraftBtn() { renderNavCats(); }
+  /**
+   * The context moved. Decide what the workspace does about it.
+   *
+   * `target` is the address the context points at — navPath, else the bound
+   * matter. Compared against the TEMPLATE of what is mounted, because
+   * currentPage.name is the address with its id stripped: two matters share one
+   * page, so comparing raw addresses would re-navigate on every matter change
+   * even when the page is identical.
+   */
+  function onContextTarget(target) {
+    if (!target) { pendingTarget = null; $('ctxGo').style.display = 'none'; return; }
+    /*
+     * Already showing it?
+     *
+     * Three ways that can be true, and the third is the one that matters now
+     * that pages write context when they navigate internally:
+     *
+     *   - the target IS the mounted template;
+     *   - it is an address UNDER that template (same page, another matter);
+     *   - it is the exact address the page last reported showing. A bundle that
+     *     serves several addresses moves between them without a fetch, so the
+     *     mounted TEMPLATE stops being the whole truth about where we are.
+     *
+     * Without the third, clicking a tab inside collections wrote the context,
+     * the next poll saw an address that did not match the template, and the
+     * wrapper re-fetched and remounted the bundle already on screen — throwing
+     * away the tab that had just been chosen.
+     */
+    var showing = currentPage && (target === currentPage.name ||
+                                  target.indexOf(currentPage.name + '/') === 0 ||
+                                  target === currentPage.address);
+    if (showing) { pendingTarget = null; $('ctxGo').style.display = 'none'; return; }
+    // The server has already said nothing draws this. Offering it, or chasing it
+    // because auto-switch is on, only reproduces the failure — and the context
+    // sits on such an address for as long as the conversation is working there,
+    // so it would reproduce it every poll. The URL on the line is the way in.
+    if (undrawn[target]) { pendingTarget = null; $('ctxGo').style.display = 'none'; return; }
+    pendingTarget = target;
+    if (following()) { $('ctxGo').style.display = 'none'; openPage(target); return; }
+    // Not following: say so, and let them choose.
+    $('ctxGo').style.display = '';
+    $('ctxGo').textContent = 'open ' + target.split('/').slice(0, 2).join('/') + ' →';
+    $('ctxGo').title = 'The working context moved to ' + target + '. Click to open it here.';
+  }
+  function updateCtxSeg() {
+    if (!LIVE || !grantedBare['read']) return;
+    // A navigation is in flight and the server has not yet been told where we
+    // went. Reading context now would return the PREVIOUS page and, with
+    // auto-switch on, navigate back to it — the poll undoing the click.
+    if (navPending) return;
+    // haveRev is the whole reason a 3s poll is reasonable: unchanged means an
+    // empty reply and no server-side query. See get_context.
+    var gen = navGen;
+    var args = { resource: 'context' };
+    if (ctxRev !== null) args.haveRev = ctxRev;
+    shellCall('read', args).then(function (r) {
+      // A navigation began (and maybe already finished) while this read was in
+      // flight. Its result names the PREVIOUS location; with auto-switch on,
+      // onContextTarget would openPage that old target and revert the move. Drop
+      // it — endNav has nulled ctxRev, so the next poll re-reads from clean.
+      if (navPending || navGen !== gen) return;
+      if (r && r.isError) { $('ctxSeg').textContent = '—'; return; }
+      var raw = firstText(r), parsedRev = null, notMod = false;
+      try { var j = JSON.parse(raw); notMod = !!j.notModified; parsedRev = j.rev; } catch (e) {}
+      if (typeof parsedRev === 'number') ctxRev = parsedRev;
+      if (notMod) return;        // nothing moved — and nothing to redraw
+      var p = parseCtx(r);
+      $('ctxSeg').textContent = p.label;
+      $('ctxSeg').title = 'Current context (click to refresh)\n' + p.full.slice(0, 600);
+      // An artifact has no address bar. This link is the only thing on screen
+      // that says where the page IS, and the only way back to the same thing in
+      // Fenix. Cleared when the server names none, never guessed.
+      ctxUrlValue = p.url;
+      var a = $('ctxUrl');
+      if (p.url) { a.textContent = p.url; a.href = p.url; a.title = 'Open in Fenix — ' + p.url; }
+      else { a.textContent = ''; a.removeAttribute('href'); }
+      // Where the Draft control goes for this matter, named by the server. Only
+      // present on a full reply; a notModified poll returns above, so this is not
+      // cleared by the 3s heartbeat.
+      try {
+        var j2 = JSON.parse(raw);
+        draftTarget = j2 && j2.draft && j2.draft.path ? j2.draft : null;
+        navTargets = j2 && j2.nav && typeof j2.nav === 'object' ? j2.nav : null;
+      } catch (e) { draftTarget = null; navTargets = null; }
+      updateDraftBtn();
+      onContextTarget(p.target);
+    });
+  }
+  $('ctxSeg').addEventListener('click', function () {
+    ctxRev = null;               // force a full reply, not a notModified
+    ctxInvalidate('manual refresh');
+    updateCtxSeg();
+  });
+  // Poll fast while visible, slowly while not: a hidden workspace has nobody to
+  // be immediate for, and the interval is the one thing multiplied by every
+  // open copy.
+  var pollTimer = null;
+  function schedulePoll() {
+    if (pollTimer) clearInterval(pollTimer);
+    var hidden = typeof document.hidden === 'boolean' && document.hidden;
+    pollTimer = setInterval(updateCtxSeg, hidden ? CTX_POLL_IDLE_MS : CTX_POLL_MS);
+  }
+  document.addEventListener('visibilitychange', function () {
+    schedulePoll();
+    if (!document.hidden) updateCtxSeg();   // catch up immediately on return
+  });
+  schedulePoll();
+  // ---- diagnostics --------------------------------------------------------
+  setInterval(function () {
+    $('diagStats').textContent = ART_ID + ' ' + VERSION + ' · ctx ' + ctxStats.hits + 'h/' +
+      ctxStats.misses + 'm/' + ctxStats.invalidations + 'i · rpc ' + details.rpc.length;
+  }, 2000);
+  function buildReport() {
+    var installedMarker = null;
+    try { installedMarker = localStorage.getItem('fx.installed.' + ART_ID); } catch (e) {}
+    var cacheState = ownKeys().map(function (k) {
+      var chars = 0, ver = null;
+      try { var raw = localStorage.getItem(k); chars = raw.length; ver = (JSON.parse(raw) || {}).version; } catch (e) {}
+      return { key: k, chars: chars, version: ver };
+    });
+    return {
+      kind: details.kind, artifact: ART_ID, version: VERSION,
+      surface: LIVE ? 'installed' : 'no-bridge',
+      deliveredMetaToolCount: grantedFq.length, deliveredMetaTools: grantedFq,
+      manifestTools: manifest.tools, missingTools: missingTools(),
+      prefix: PREFIX, installedMarker: installedMarker,
+      currentPage: currentPage, contextUrl: ctxUrlValue,
+      contextCache: { ttlMs: CTX_TTL_MS, hits: ctxStats.hits, misses: ctxStats.misses,
+                      invalidations: ctxStats.invalidations },
+      cache: cacheState, rpc: details.rpc.slice(-60), errors: details.errors,
+      // Addresses this session asked for and the server said nothing draws.
+      // Names the page-coverage gaps a real session actually walked into, which
+      // is better evidence of what to build next than the coverage list.
+      undrawn: Object.keys(undrawn),
+      timestamp: new Date().toISOString()
+    };
+  }
+  /** Copy `text`, reporting on `btn`. execCommand fallback: not every host exposes the async clipboard. */
+  function copyTo(btn, text) {
+    var label = btn.textContent;
+    function done(suffix) { btn.textContent = 'Copied' + (suffix || ''); setTimeout(function () { btn.textContent = label; }, 2000); }
+    function fb() {
+      var ta = document.createElement('textarea'); ta.value = text;
+      document.body.appendChild(ta); ta.select();
+      try { document.execCommand('copy'); } catch (e) {}
+      document.body.removeChild(ta);
+      done(' (fallback)');
+    }
+    if (navigator.clipboard && navigator.clipboard.writeText)
+      navigator.clipboard.writeText(text).then(function () { done(); }, fb);
+    else fb();
+  }
+  $('btnCopy').addEventListener('click', function () {
+    copyTo($('btnCopy'), JSON.stringify(buildReport(), null, 2));
+  });
+  // ---- startup ------------------------------------------------------------
+  cacheSummary();
+  $('follow').checked = following();
+  if (LIVE && details.kind !== 'no-access') {
+    openPage(null);          // server chooses the entry page (may depend on context)
+    updateCtxSeg();
+  }
+})();
+</script>
+</body>
+</html>