rewritable 0.9.0 → 0.11.0

package/seeds/rewritable.html

@@ -41,20 +41,26 @@
 [hidden]{display:none!important;}
 body{font-family:var(--font-ui);background:var(--bg);color:var(--text);min-height:100dvh;padding-bottom:160px;line-height:1.5;-webkit-font-smoothing:antialiased;}
 #rwa-set{position:fixed;top:12px;right:12px;display:flex;gap:6px;align-items:center;z-index:1000;}
-#rwa-mode-tabs{display:flex;gap:2px;align-items:center;background:var(--white);border:1px solid var(--gray-200);border-radius:8px;padding:2px;box-shadow:0 1px 4px rgba(0,0,0,0.04);}
-.rwa-mode-tab{background:transparent;border:0;color:var(--gray-500);font-family:var(--font-mono);font-size:10px;padding:5px 8px;border-radius:6px;cursor:pointer;letter-spacing:.4px;text-transform:uppercase;transition:color .15s,background .15s;}
-.rwa-mode-tab:hover{color:var(--gray-900);background:var(--gray-50);}
-.rwa-mode-tab.on{background:var(--gray-900);color:var(--white);}
 .rwa-st-btn{background:var(--white);border:1px solid var(--gray-200);color:var(--gray-500);font-family:var(--font-mono);font-size:10px;padding:6px 10px;border-radius:6px;cursor:pointer;letter-spacing:.5px;text-transform:uppercase;transition:color .15s,background .15s,border-color .15s;}
 .rwa-st-btn:hover{color:var(--gray-900);border-color:var(--gray-300);background:var(--gray-50);}
 .rwa-st-btn.dirty{color:var(--gray-900);border-color:var(--gray-300);background:var(--gray-100);}
 .rwa-st-btn.pri{background:var(--gray-900);color:var(--white);border-color:var(--gray-900);}
 .rwa-st-btn.pri:hover{background:var(--gray-700);border-color:var(--gray-700);color:var(--white);}
+#rwa-st-modeseg{display:inline-flex;background:var(--gray-100);border:1px solid var(--gray-200);border-radius:8px;padding:2px;gap:2px;}
+.rwa-seg{background:transparent;border:0;color:var(--gray-500);font:600 11px var(--font-ui);padding:5px 12px;border-radius:6px;cursor:pointer;letter-spacing:.2px;transition:color .12s,background .12s;}
+.rwa-seg:hover{color:var(--gray-900);}
+.rwa-seg.on{background:var(--white);color:var(--gray-900);box-shadow:0 1px 3px rgba(0,0,0,0.12);}
 .rwa-st-btn.run{color:var(--gray-700);border-color:var(--gray-300);background:var(--gray-50);}
 .rwa-st-btn.err{color:var(--red);border-color:var(--red);background:var(--white);}
 .rwa-st-btn.ok{color:var(--green);border-color:var(--green);background:var(--white);}
 #rwa-set-panel{position:fixed;top:50px;right:12px;background:var(--white);border:1px solid var(--gray-200);border-radius:var(--radius-sm);padding:14px;display:none;width:340px;max-width:calc(100vw - 24px);z-index:999;box-shadow:0 4px 16px rgba(0,0,0,0.08);}
 #rwa-set-panel.open{display:block;}
+#rwa-st-menu-panel{position:fixed;top:50px;right:12px;background:var(--white);border:1px solid var(--gray-200);border-radius:var(--radius-sm);padding:6px;display:flex;flex-direction:column;gap:2px;min-width:172px;z-index:999;box-shadow:0 4px 16px rgba(0,0,0,0.08);}
+#rwa-st-menu-panel[hidden]{display:none;}
+.rwa-st-menu-item{display:flex;align-items:center;gap:10px;background:transparent;border:0;border-radius:6px;padding:8px 10px;font:500 13px var(--font-ui);color:var(--gray-800);cursor:pointer;text-align:left;text-transform:none;letter-spacing:0;}
+.rwa-st-menu-item:hover{background:var(--gray-100);color:var(--gray-900);}
+.rwa-st-menu-item.on{background:var(--gray-100);color:var(--gray-900);}
+.rwa-st-menu-ic{font-size:14px;width:16px;text-align:center;color:var(--gray-500);}
 .rwa-set-row{display:flex;flex-direction:column;gap:4px;margin-bottom:10px;}
 .rwa-set-row:last-child{margin-bottom:0;}
 .rwa-set-row label{font-family:var(--font-mono);font-size:9px;letter-spacing:1.5px;text-transform:uppercase;color:var(--gray-500);}
@@ -190,21 +196,38 @@ body{font-family:var(--font-ui);background:var(--bg);color:var(--text);min-heigh
 #rwa-img-chip button{width:22px;height:22px;border:0;border-radius:6px;background:transparent;color:var(--gray-900);font-size:11px;line-height:1;cursor:pointer;padding:0;font-family:var(--font-ui);}
 #rwa-img-chip button:hover{background:var(--gray-100);}
 #rwa-img-chip button.on{background:var(--gray-900);color:var(--white);}
-#rwa-selection-bar{position:absolute;z-index:70;display:flex;align-items:center;gap:4px;padding:5px;border-radius:10px;border:1px solid var(--gray-200);background:var(--white);box-shadow:0 8px 24px rgba(0,0,0,0.12);font-family:var(--font-ui);}
+/* The bubble floats over the line above the selection. It is pointer-transparent by default
+   so a press meant to start a NEW selection passes THROUGH it to the text (otherwise the
+   press lands on the bar and its buttons' mousedown-preventDefault swallows the selection —
+   the "bubble appears every second selection" bug). It "arms" (becomes clickable) only after
+   the pointer deliberately dwells over it (see maybeArmBar). */
+#rwa-selection-bar{position:absolute;z-index:70;display:flex;align-items:center;gap:4px;padding:5px;border-radius:10px;border:1px solid var(--gray-200);background:var(--white);box-shadow:0 8px 24px rgba(0,0,0,0.12);font-family:var(--font-ui);pointer-events:none;}
+#rwa-selection-bar.armed{pointer-events:auto;}
 #rwa-selection-bar[hidden]{display:none!important;}
 #rwa-selection-bar button{height:28px;border:0;border-radius:7px;background:transparent;color:var(--gray-700);font:600 12px var(--font-ui);cursor:pointer;padding:0 9px;}
 #rwa-selection-bar button:hover{background:var(--gray-100);color:var(--gray-900);}
 #rwa-selection-bar button.pri{background:var(--gray-900);color:var(--white);}
+#rwa-selection-bar button.mono{font-family:var(--font-mono);font-size:11px;}
+#rwa-selection-bar button.on{background:var(--gray-900);color:var(--white);}
+#rwa-selection-bar .rwa-sel-sep{width:1px;align-self:stretch;margin:2px 1px;background:var(--gray-200);}
+#rwa-selection-bar button svg{display:block;}
+#rwa-selection-block,#rwa-selection-size{height:28px;border:1px solid var(--gray-200);border-radius:7px;background:var(--white);color:var(--gray-800);font:600 12px var(--font-ui);padding:0 4px;cursor:pointer;}
+#rwa-selection-block:hover,#rwa-selection-size:hover{background:var(--gray-100);}
+#rwa-selection-cmdwrap{display:flex;align-items:center;gap:4px;}
+#rwa-selection-cmdwrap[hidden]{display:none;}
 #rwa-selection-bar[data-listening="1"] #rwa-selection-voice{background:var(--red);color:var(--white);}
-#rwa-selection-cmd{width:170px;border:1px solid var(--gray-200);border-radius:7px;padding:6px 8px;outline:none;font:12px var(--font-ui);color:var(--gray-900);}
-#rwa-selection-cmd:focus{border-color:var(--gray-400);}
+#rwa-selection-cmd,#rwa-selection-link-input{width:170px;border:1px solid var(--gray-200);border-radius:7px;padding:6px 8px;outline:none;font:12px var(--font-ui);color:var(--gray-900);}
+#rwa-selection-cmd:focus,#rwa-selection-link-input:focus{border-color:var(--gray-400);}
+#rwa-selection-link-input{width:160px;}
+#rwa-selection-bar input[hidden]{display:none!important;}
+#rwa-selection-bar .rwa-color-a{border-bottom:3px solid #dc2626;line-height:1;padding-bottom:1px;font-weight:700;}
+#rwa-selection-color-pop{position:absolute;top:40px;left:8px;display:flex;gap:5px;padding:7px;background:var(--white);border:1px solid var(--gray-200);border-radius:9px;box-shadow:0 8px 24px rgba(0,0,0,0.12);z-index:71;}
+#rwa-selection-color-pop[hidden]{display:none;}
+#rwa-selection-color-pop .rwa-sw{width:18px;height:18px;border:1px solid rgba(0,0,0,0.14);border-radius:50%;cursor:pointer;padding:0;transition:transform .1s;}
+#rwa-selection-color-pop .rwa-sw:hover{transform:scale(1.15);}
 body:not([data-rwa-mode="edit"]) #rwa-lens,
 body:not([data-rwa-mode="edit"]) #rwa-pal,
-body:not([data-rwa-mode="edit"]) #rwa-set-panel,
-body:not([data-rwa-mode="edit"]) #rwa-skin-panel,
 body:not([data-rwa-mode="edit"]) #rwa-lens-hist-panel,
-body:not([data-rwa-mode="edit"]) #rwa-st-cog,
-body:not([data-rwa-mode="edit"]) #rwa-st-skin,
 body:not([data-rwa-mode="edit"]) #rwa-img-chip,
 body:not([data-rwa-mode="edit"]) #rwa-selection-bar{display:none!important;}
 body:not([data-rwa-mode="document"]) #rwa-view-toggle,
@@ -225,11 +248,13 @@ body:not([data-rwa-mode="document"]) #rwa-view-chrome{display:none!important;}
 .rwa-editable-leaf:hover{background:rgba(59,130,246,0.045);box-shadow:0 0 0 3px rgba(59,130,246,0.08);}
 .rwa-editable-leaf:focus-visible{outline:2px solid rgba(59,130,246,0.5);outline-offset:2px;}
 .rwa-editable-leaf[contenteditable="true"]{background:rgba(59,130,246,0.07);box-shadow:0 0 0 2px rgba(59,130,246,0.22);outline:none;caret-color:var(--blue);}
-/* Inline prompt mode — the block's text starts with "/" (addressing the model,
-   not writing content). Tint + inset accent bar only: no border/padding so the
-   per-keystroke toggle never shifts layout (caret stays put), and no ::before
-   glyph (pseudo-elements on contenteditable cause Chromium caret jumps). */
+/* Inline prompt mode — a "/" at a word boundary addresses the model. ONLY the "/command" suffix
+   turns the accent colour (the data-rwa-cmd-text span), so the content before it stays normal
+   (Notion-style); the block also gets a faint tint + inset accent bar as a secondary cue. Colour/
+   tint/shadow only — no border/padding (would shift layout/move the caret) and no ::before glyph
+   (Chromium caret jumps). */
 [data-rwa-cmd="on"]{background:rgba(59,130,246,0.06);box-shadow:inset 2px 0 0 var(--blue);border-radius:4px;}
+[data-rwa-cmd-text]{color:var(--blue);}
 .rwa-locked{position:relative;background:rgba(239,68,68,0.04);border-left:3px solid var(--red);padding-left:8px;}
 .rwa-locked::before{content:'\1F512';position:absolute;top:4px;right:8px;font-size:12px;opacity:.6;}
 /* === DOCUMENT-PRODUCT DEFAULT: baseline content typography === */
@@ -1007,6 +1032,8 @@ function closeRuntimePanels() {
   }
   const hist = document.getElementById('rwa-lens-hist-panel');
   if (hist) hist.hidden = true;
+  const menu = document.getElementById('rwa-st-menu-panel');
+  if (menu && !menu.hidden) { menu.hidden = true; const mb = document.getElementById('rwa-st-menu'); if (mb) mb.setAttribute('aria-expanded', 'false'); }
 }
 
 function hideEditTransients() {
@@ -1024,7 +1051,9 @@ function hideEditTransients() {
 function syncModeChrome() {
   if (document.body) document.body.dataset.rwaMode = rwaMode;
   document.querySelectorAll('[data-rwa-mode-target]').forEach(btn => {
-    btn.classList.toggle('on', btn.dataset.rwaModeTarget === rwaMode);
+    const on = btn.dataset.rwaModeTarget === rwaMode; // View/Edit segments + Skills/Activity menu items
+    btn.classList.toggle('on', on);
+    if (btn.hasAttribute('aria-pressed')) btn.setAttribute('aria-pressed', String(on));
   });
   const panel = document.getElementById('rwa-mode-panel');
   if (!panel) return;
@@ -1469,18 +1498,21 @@ function buildFile(doc) {
 function buildUI() {
   document.getElementById('rwa-runtime').innerHTML = `
 <div id="rwa-set">
-  <div id="rwa-mode-tabs" role="tablist" aria-label="runtime mode">
-    <button class="rwa-mode-tab" type="button" data-rwa-mode-target="document">Document</button>
-    <button class="rwa-mode-tab" type="button" data-rwa-mode-target="edit">Edit</button>
-    <button class="rwa-mode-tab" type="button" data-rwa-mode-target="skills">Skills</button>
-    <button class="rwa-mode-tab" type="button" data-rwa-mode-target="actions">Actions</button>
-  </div>
   <button class="rwa-st-btn" id="rwa-st-status">● ready</button>
-  <button class="rwa-st-btn" id="rwa-st-info" title="what is this?" aria-label="what is this?">ⓘ</button>
-  <button class="rwa-st-btn" id="rwa-st-cog">⚙</button>
-  <button class="rwa-st-btn" id="rwa-st-skin" title="skins — pick a look" aria-label="skins">✦</button>
-  <button class="rwa-st-btn" id="rwa-st-share" title="share at a link" aria-label="share at a link">↗</button>
-  <button class="rwa-st-btn pri" id="rwa-st-commit">⌘S</button>
+  <div id="rwa-st-modeseg" role="group" aria-label="view or edit mode">
+    <button class="rwa-seg" type="button" id="rwa-st-view" data-rwa-mode-target="document" aria-pressed="true" title="Reading view">View</button>
+    <button class="rwa-seg" type="button" id="rwa-st-edit" data-rwa-mode-target="edit" aria-pressed="false" title="Edit — format and edit in place">Edit</button>
+  </div>
+  <button class="rwa-st-btn" id="rwa-st-menu" title="Menu" aria-label="menu" aria-haspopup="true" aria-expanded="false">⋯</button>
+  <button class="rwa-st-btn pri" id="rwa-st-commit" title="Save (⌘S)" hidden>⌘S</button>
+</div>
+<div id="rwa-st-menu-panel" hidden role="menu" aria-label="runtime menu">
+  <button class="rwa-st-menu-item" id="rwa-st-info" role="menuitem" title="what is this?"><span class="rwa-st-menu-ic" aria-hidden="true">ⓘ</span>What is this?</button>
+  <button class="rwa-st-menu-item" id="rwa-st-cog" role="menuitem"><span class="rwa-st-menu-ic" aria-hidden="true">⚙</span>Settings</button>
+  <button class="rwa-st-menu-item" id="rwa-st-skin" role="menuitem" title="skins — pick a look"><span class="rwa-st-menu-ic" aria-hidden="true">✦</span>Skins</button>
+  <button class="rwa-st-menu-item" id="rwa-st-share" role="menuitem" title="share at a link"><span class="rwa-st-menu-ic" aria-hidden="true">↗</span>Share…</button>
+  <button class="rwa-st-menu-item" id="rwa-st-skills" role="menuitem" data-rwa-mode-target="skills" title="manage installed skills" hidden><span class="rwa-st-menu-ic" aria-hidden="true">◈</span>Skills</button>
+  <button class="rwa-st-menu-item" id="rwa-st-activity" role="menuitem" data-rwa-mode-target="actions" title="recent edits, history and live affordances"><span class="rwa-st-menu-ic" aria-hidden="true">↻</span>Activity</button>
 </div>
 <div id="rwa-set-panel">
   <div class="rwa-set-row"><label>Backend</label><select id="rwa-backend"><option value="openrouter">OpenRouter (API key)</option><option value="ollama">Ollama (localhost)</option><option value="lmstudio">LM Studio (localhost)</option><option value="atomic">atomic.chat (localhost)</option><option value="bridge">Bridge (claude -p, localhost)</option><option value="bridge-session">Bridge session (claude, persistent)</option></select></div>
@@ -1490,6 +1522,7 @@ function buildUI() {
   <div class="rwa-set-row" id="rwa-set-row-base-url" style="display:none;"><label>Base URL</label><div class="rwa-set-base-url-line"><input type="text" id="rwa-base-url" autocomplete="off" spellcheck="false"><button type="button" id="rwa-base-url-test">Test</button></div><div id="rwa-base-url-result" class="rwa-set-hint"></div></div>
   <div class="rwa-set-row" id="rwa-set-row-model"><label>Model</label><input type="text" id="rwa-model" autocomplete="off" list="rwa-model-options"><datalist id="rwa-model-options"></datalist></div>
   <div class="rwa-set-row" id="rwa-set-row-hint" style="display:none;"><div id="rwa-backend-hint" class="rwa-set-hint"></div></div>
+  <div class="rwa-set-row" id="rwa-set-row-vault-kdf" style="display:none;"><label>Vault KDF</label><div><button type="button" id="rwa-vault-upgrade">Upgrade to Argon2id</button><div id="rwa-vault-kdf-result" class="rwa-set-hint"></div></div></div>
 </div>
 <div id="rwa-info-panel"></div>
 <div id="rwa-skin-panel"></div>
@@ -1517,10 +1550,48 @@ function buildUI() {
   <div id="rwa-lens-hint"></div>
 </div>
 <div id="rwa-selection-bar" hidden data-rwa-no-inline-edit>
-  <button type="button" id="rwa-selection-bold" title="Bold selection" aria-label="bold selection"><strong>B</strong></button>
-  <input id="rwa-selection-cmd" placeholder="make it bold" autocomplete="off" spellcheck="false">
-  <button type="button" class="pri" id="rwa-selection-run">Run</button>
-  <button type="button" id="rwa-selection-voice">Mic</button>
+  <select id="rwa-selection-block" title="Block type" aria-label="block type">
+    <option value="paragraph">¶</option>
+    <option value="h1">H1</option>
+    <option value="h2">H2</option>
+    <option value="h3">H3</option>
+  </select>
+  <select id="rwa-selection-size" title="Text size" aria-label="text size">
+    <option value="" disabled selected>Size</option>
+    <option value="small">Small</option>
+    <option value="normal">Normal</option>
+    <option value="large">Large</option>
+    <option value="huge">Huge</option>
+  </select>
+  <span class="rwa-sel-sep" aria-hidden="true"></span>
+  <button type="button" id="rwa-selection-bold" title="Bold" aria-label="bold selection"><strong>B</strong></button>
+  <button type="button" id="rwa-selection-italic" title="Italic" aria-label="italic selection"><em>I</em></button>
+  <button type="button" id="rwa-selection-underline" title="Underline" aria-label="underline selection"><span style="text-decoration:underline">U</span></button>
+  <button type="button" id="rwa-selection-strike" title="Strikethrough" aria-label="strikethrough selection"><span style="text-decoration:line-through">S</span></button>
+  <button type="button" id="rwa-selection-code" title="Inline code" aria-label="inline code selection" class="mono">&lt;&gt;</button>
+  <button type="button" id="rwa-selection-link" title="Link" aria-label="link selection"><svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"><path d="M6.5 9.5l3-3"/><path d="M7 4.5l1-1a2.5 2.5 0 0 1 3.5 3.5l-1 1"/><path d="M9 11.5l-1 1a2.5 2.5 0 0 1-3.5-3.5l1-1"/></svg></button>
+  <input id="rwa-selection-link-input" hidden type="text" placeholder="https://…" autocomplete="off" spellcheck="false">
+  <button type="button" id="rwa-selection-color" title="Text color" aria-label="text color"><span class="rwa-color-a">A</span></button>
+  <div id="rwa-selection-color-pop" hidden role="menu" aria-label="text color">
+    <button class="rwa-sw" type="button" data-color="#111827" title="Ink" aria-label="ink" style="background:#111827"></button>
+    <button class="rwa-sw" type="button" data-color="#dc2626" title="Red" aria-label="red" style="background:#dc2626"></button>
+    <button class="rwa-sw" type="button" data-color="#d97706" title="Amber" aria-label="amber" style="background:#d97706"></button>
+    <button class="rwa-sw" type="button" data-color="#16a34a" title="Green" aria-label="green" style="background:#16a34a"></button>
+    <button class="rwa-sw" type="button" data-color="#2563eb" title="Blue" aria-label="blue" style="background:#2563eb"></button>
+    <button class="rwa-sw" type="button" data-color="#7c3aed" title="Violet" aria-label="violet" style="background:#7c3aed"></button>
+    <button class="rwa-sw" type="button" data-color="#6b7280" title="Gray" aria-label="gray" style="background:#6b7280"></button>
+  </div>
+  <span class="rwa-sel-sep" aria-hidden="true"></span>
+  <button type="button" id="rwa-selection-align-left" title="Align left" aria-label="align left"><svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"><line x1="2" y1="4" x2="14" y2="4"/><line x1="2" y1="8" x2="10" y2="8"/><line x1="2" y1="12" x2="13" y2="12"/></svg></button>
+  <button type="button" id="rwa-selection-align-center" title="Align center" aria-label="align center"><svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"><line x1="3" y1="4" x2="13" y2="4"/><line x1="5" y1="8" x2="11" y2="8"/><line x1="4" y1="12" x2="12" y2="12"/></svg></button>
+  <button type="button" id="rwa-selection-align-right" title="Align right" aria-label="align right"><svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"><line x1="2" y1="4" x2="14" y2="4"/><line x1="6" y1="8" x2="14" y2="8"/><line x1="3" y1="12" x2="14" y2="12"/></svg></button>
+  <span class="rwa-sel-sep" aria-hidden="true"></span>
+  <button type="button" id="rwa-selection-more" title="Command / voice" aria-label="command and voice" aria-haspopup="true" aria-expanded="false">⋯</button>
+  <span id="rwa-selection-cmdwrap" hidden>
+    <input id="rwa-selection-cmd" placeholder="make it bold…" autocomplete="off" spellcheck="false">
+    <button type="button" class="pri" id="rwa-selection-run">Run</button>
+    <button type="button" id="rwa-selection-voice" title="Dictate a command" aria-label="dictate a command">Mic</button>
+  </span>
 </div>
 <div id="rwa-lens-hist-panel" hidden></div>`;
 
@@ -1529,7 +1600,10 @@ function buildUI() {
   m.value = sessionStorage.getItem(RWA.K_MODEL) || RWA.MODEL;
   k.oninput = e => sessionStorage.setItem(RWA.K_API, e.target.value.trim());
   m.oninput = e => sessionStorage.setItem(RWA.K_MODEL, e.target.value.trim() || RWA.MODEL);
-  attachModeTabs();
+  attachModeTabs(); // wires the View/Edit segments + the Activity/Skills menu items (data-rwa-mode-target)
+  // Skills is a skill-host-only menu item.
+  const skillsItem = document.getElementById('rwa-st-skills'); // PRODUCT_KIND is available now; the doc (#rwa-skills) may not be rendered yet
+  if (skillsItem && PRODUCT_KIND === 'skill-host') skillsItem.hidden = false;
 
   // Bridge SESSION backend config: the bearer token the bridge requires on every
   // /session/* call, and a server-side working dir for the claude session.
@@ -1689,6 +1763,25 @@ function buildUI() {
     }
   };
 
+  // Unobtrusive chrome: the secondary actions (info/settings/skins/share) live behind a
+  // single ⋯ menu so the persistent row stays quiet. Opening it closes any panel; choosing
+  // an item runs the item's own handler (below) then closes the menu; an outside click
+  // dismisses it. The item ids/handlers are unchanged — they're just relocated.
+  const stMenuBtn = document.getElementById('rwa-st-menu');
+  const stMenuPanel = document.getElementById('rwa-st-menu-panel');
+  if (stMenuBtn && stMenuPanel) {
+    stMenuBtn.onclick = (e) => {
+      e.stopPropagation();
+      const willOpen = stMenuPanel.hidden;
+      closeRuntimePanels();
+      stMenuPanel.hidden = !willOpen;
+      stMenuBtn.setAttribute('aria-expanded', String(willOpen));
+    };
+    stMenuPanel.addEventListener('click', () => { stMenuPanel.hidden = true; stMenuBtn.setAttribute('aria-expanded', 'false'); });
+    document.addEventListener('click', (e) => {
+      if (!stMenuPanel.hidden && !stMenuPanel.contains(e.target) && e.target !== stMenuBtn) { stMenuPanel.hidden = true; stMenuBtn.setAttribute('aria-expanded', 'false'); }
+    });
+  }
   document.getElementById('rwa-st-cog').onclick = () => {
     document.getElementById('rwa-info-panel').classList.remove('open');   // panels are mutually exclusive
     document.getElementById('rwa-skin-panel').classList.remove('open');
@@ -1696,6 +1789,21 @@ function buildUI() {
     document.getElementById('rwa-mode-panel').classList.remove('open');
     document.getElementById('rwa-set-panel').classList.toggle('open');
   };
+  // Vault KDF upgrade (I9 §13) — skill-host only. Argon2id migration needs the passphrase
+  // (to derive the old key), so prompt for it; the ~1–2s derive runs in a blob: Worker.
+  const vkRow = document.getElementById('rwa-set-row-vault-kdf');
+  if (vkRow && PRODUCT_KIND === 'skill-host') {
+    vkRow.style.display = '';
+    const vkBtn = document.getElementById('rwa-vault-upgrade'), vkRes = document.getElementById('rwa-vault-kdf-result');
+    vkBtn.onclick = async () => {
+      const pass = prompt('Vault passphrase (to upgrade the vault KDF to Argon2id):');
+      if (!pass) return;
+      vkBtn.disabled = true; vkRes.textContent = 'Deriving key (Argon2id, ~1–2s)…';
+      try { await runtimeVaultUnlock(pass, { targetKdfVersion: 1 }); vkRes.textContent = 'Vault KDF upgraded to Argon2id.'; }
+      catch (e) { vkRes.textContent = 'Upgrade failed: ' + ((e && e.message) || e); }
+      finally { vkBtn.disabled = false; }
+    };
+  }
   // ⓘ "what is this?" — render the rwa-identity/1 bundle as prose on open so it
   // reflects current state every time (title/blocks/locked regions change as the
   // doc is edited). Mutually exclusive with the settings panel.
@@ -1834,7 +1942,75 @@ function buildUI() {
   }
 
   const selCmd = document.getElementById('rwa-selection-cmd');
-  document.getElementById('rwa-selection-bold').addEventListener('click', () => runSelectionCommand('make it bold', { actor: 'user:selection-command' }).catch(() => {}));
+  // Deterministic formatting buttons → the same local rwa-edit/1 wrap path (no model).
+  // mousedown preventDefault keeps the text selection alive through the click (a real
+  // browser would otherwise collapse it when focus moves to the button).
+  const wireFormatBtn = (id, command) => {
+    const b = document.getElementById(id);
+    if (!b) return;
+    b.addEventListener('mousedown', (e) => e.preventDefault());
+    b.addEventListener('click', () => runSelectionCommand(command, { actor: 'user:selection-command' }).catch(() => {}));
+  };
+  wireFormatBtn('rwa-selection-bold', 'make it bold');
+  wireFormatBtn('rwa-selection-italic', 'italic');
+  wireFormatBtn('rwa-selection-underline', 'underline');
+  wireFormatBtn('rwa-selection-strike', 'strikethrough');
+  wireFormatBtn('rwa-selection-code', 'inline code');
+  wireFormatBtn('rwa-selection-align-left', 'align left');
+  wireFormatBtn('rwa-selection-align-center', 'align center');
+  wireFormatBtn('rwa-selection-align-right', 'align right');
+  // Link control: the button reveals a URL field (prefilled if the selection is already a
+  // link); Enter applies the sanitized href, Esc cancels. mousedown preventDefault keeps
+  // the text selection alive; the cached selectionCommandState backs the apply.
+  const linkBtn = document.getElementById('rwa-selection-link');
+  const linkInput = document.getElementById('rwa-selection-link-input');
+  if (linkBtn && linkInput) {
+    linkBtn.addEventListener('mousedown', (e) => e.preventDefault());
+    linkBtn.addEventListener('click', () => {
+      if (!linkInput.hidden) { linkInput.hidden = true; return; }
+      const t = resolveSelectionCommandTarget() || selectionCommandState;
+      let pre = '';
+      try { const n = t && t.range && t.range.startContainer; const el = n && (n.nodeType === 1 ? n : n.parentElement); const a = el && el.closest && el.closest('a[href]'); if (a) pre = a.getAttribute('href') || ''; } catch (_) {}
+      linkInput.value = pre; linkInput.hidden = false; linkInput.focus();
+    });
+    linkInput.addEventListener('keydown', (e) => {
+      if (e.key === 'Enter') { e.preventDefault(); const url = linkInput.value || ''; linkInput.hidden = true; runSelectionLink(url, { actor: 'user:selection-command' }).catch(() => {}); }
+      else if (e.key === 'Escape') { e.preventDefault(); linkInput.hidden = true; }
+    });
+  }
+  // Color control: the button reveals a fixed swatch palette; a swatch applies its hex.
+  const colorBtn = document.getElementById('rwa-selection-color');
+  const colorPop = document.getElementById('rwa-selection-color-pop');
+  if (colorBtn && colorPop) {
+    colorBtn.addEventListener('mousedown', (e) => e.preventDefault());
+    colorBtn.addEventListener('click', () => { colorPop.hidden = !colorPop.hidden; });
+    colorPop.addEventListener('mousedown', (e) => e.preventDefault());
+    colorPop.addEventListener('click', (e) => {
+      const sw = e.target.closest('[data-color]');
+      if (!sw) return;
+      colorPop.hidden = true;
+      runSelectionColor(sw.getAttribute('data-color'), { actor: 'user:selection-command' }).catch(() => {});
+    });
+  }
+  // ⋯ reveals the typed-command + voice cluster (tucked away so the bubble stays compact —
+  // all formatting is one click via the buttons above; this is the command/voice fallback).
+  const moreBtn = document.getElementById('rwa-selection-more');
+  const cmdWrap = document.getElementById('rwa-selection-cmdwrap');
+  if (moreBtn && cmdWrap) {
+    moreBtn.addEventListener('click', () => {
+      cmdWrap.hidden = !cmdWrap.hidden;
+      moreBtn.setAttribute('aria-expanded', String(!cmdWrap.hidden));
+      moreBtn.classList.toggle('on', !cmdWrap.hidden);
+      if (!cmdWrap.hidden && selCmd) selCmd.focus();
+    });
+  }
+  // The block-type <select> can't preventDefault its mousedown (that would block the
+  // dropdown); it relies on the cached selectionCommandState, which survives because the
+  // bar holds focus while the select is open.
+  const blockSel = document.getElementById('rwa-selection-block');
+  if (blockSel) blockSel.addEventListener('change', () => runSelectionCommand(blockSel.value, { actor: 'user:selection-command' }).catch(() => {}));
+  const sizeSel = document.getElementById('rwa-selection-size');
+  if (sizeSel) sizeSel.addEventListener('change', () => { const v = sizeSel.value; sizeSel.value = ''; if (v) runSelectionSize(v, { actor: 'user:selection-command' }).catch(() => {}); });
   document.getElementById('rwa-selection-run').addEventListener('click', () => {
     runSelectionCommand(selCmd.value || '', { actor: 'user:selection-command' }).catch(() => {});
   });
@@ -1850,6 +2026,9 @@ function buildUI() {
   document.addEventListener('selectionchange', scheduleSelectionCommandRefresh);
   document.addEventListener('mouseup', scheduleSelectionCommandRefresh);
   document.addEventListener('keyup', scheduleSelectionCommandRefresh);
+  // Track the pointer to arm the bubble on a deliberate dwell (so it stays pointer-transparent
+  // to a press that's starting a selection over the text it overlaps).
+  document.addEventListener('mousemove', (e) => { _lastPointer = { x: e.clientX, y: e.clientY }; maybeArmSelectionBar(e.clientX, e.clientY); });
 
   // rwa-lens/1: Esc releases the anchor when one is held. Listener is on
   // `window` so Esc anywhere works (including with focus outside the lens
@@ -1862,7 +2041,7 @@ function buildUI() {
 }
 const setStatus = (cls, msg) => { const e = document.getElementById('rwa-st-status'); if (e) { e.className = 'rwa-st-btn ' + (cls || ''); e.textContent = msg; } };
 const setPalSt = (cls, msg) => { const e = document.getElementById('rwa-pal-st'); if (e) { e.className = cls || ''; e.textContent = msg; } };
-const setDirty = d => { const e = document.getElementById('rwa-st-commit'); if (e) e.classList.toggle('dirty', d); };
+const setDirty = d => { const e = document.getElementById('rwa-st-commit'); if (e) { e.classList.toggle('dirty', d); e.hidden = !d; } }; // Save is shown only when there are unsaved changes
 
 // rwa-lens/1 progress chip: inline status above the textarea during in-flight
 // agent runs. State drives both visibility and color (CSS keyed off
@@ -2145,8 +2324,8 @@ async function renderActionsModePanel(panel) {
   ).join('') : '<div class="rwa-mode-empty">No installed skills.</div>';
   panel.innerHTML = [
     '<div class="rwa-mode-section">',
-    '<div class="rwa-mode-kicker">Actions</div>',
-    '<h4>Action center</h4>',
+    '<div class="rwa-mode-kicker">Activity</div>',
+    '<h4>Activity</h4>',
     '<div class="rwa-mode-actions">',
     '<button type="button" id="rwa-actions-undo">Undo</button>',
     '<button type="button" class="pri" id="rwa-actions-save">Save / Export</button>',
@@ -3123,9 +3302,18 @@ if (typeof navigator !== 'undefined' && /jsdom/i.test(navigator.userAgent)) {
 // the i-th live anchorable corresponds to map[i].
 function handleMountClick(e) {
   if (rwaMode !== 'edit' || activeView) return;
-  // Pointer-down may already have opened a WYSIWYG inline edit. In that case
-  // the click belongs to caret placement, not to lens anchoring.
+  // The working-block outline is owned solely by inline edit (enterInlineEdit→anchorTo). While
+  // editing, this click path must NOT anchor — a second writer here is exactly what raced the
+  // outline onto the previous block. handleMountClick now only anchors NON-editable containers
+  // (figure/pre/aside/table), which have no inline edit (design 2026-06-24-working-block).
   if (inlineEdit) return;
+  // During a DIRTY block switch inlineEdit is briefly null (old block committed, new not yet
+  // entered). Anchoring the clicked leaf here left a black outline with no edit ("the outline
+  // comes back, the blue disappears"). The pending enter will paint it — skip this writer.
+  if (_inlineSwitchPending) return;
+  // A drag that produced a text selection is a FORMAT gesture — the floating toolbar owns it.
+  const _sel = window.getSelection && window.getSelection();
+  if (_sel && _sel.rangeCount > 0 && !_sel.isCollapsed) return;
   // Audit R3 (scoped): respect the per-kind click-to-anchor flag. When
   // false (e.g. workflow files), all clicks pass through without anchoring
   // — the lens stays in default state and every command runs against the
@@ -3243,8 +3431,13 @@ function anchorTo(entry) {
     x.addEventListener('click', releaseAnchor);
     badge.appendChild(x);
   }
-  // Visual highlight on the live block.
-  if (lensState._highlighted) lensState._highlighted.removeAttribute('data-rwa-anchored');
+  // Visual highlight on the live block. Clear EVERY existing outline first — never trust the
+  // single _highlighted ref: it goes stale across re-renders (the old node is detached, the
+  // rebuilt one keeps no attribute), so removing only from it left the PREVIOUS block outlined
+  // and just stacked a second outline on the new block. Querying the live DOM is the source of
+  // truth. (This is why the outline "showed the previous block" while anchoring itself worked.)
+  const _hlMount = document.getElementById('rwa-doc-mount');
+  if (_hlMount) _hlMount.querySelectorAll('[data-rwa-anchored]').forEach(n => n.removeAttribute('data-rwa-anchored'));
   if (liveNode) {
     liveNode.setAttribute('data-rwa-anchored', '');
     lensState._highlighted = liveNode;
@@ -3271,10 +3464,11 @@ function releaseAnchor() {
     badge.hidden = true;
     badge.textContent = '';
   }
-  if (lensState._highlighted) {
-    lensState._highlighted.removeAttribute('data-rwa-anchored');
-    lensState._highlighted = null;
-  }
+  // Clear EVERY outline (not just the possibly-stale _highlighted ref) so releasing always
+  // leaves a clean DOM — no orphan outline can linger on a previously-anchored block.
+  const _hlMount = document.getElementById('rwa-doc-mount');
+  if (_hlMount) _hlMount.querySelectorAll('[data-rwa-anchored]').forEach(n => n.removeAttribute('data-rwa-anchored'));
+  lensState._highlighted = null;
   lensState.anchor = null;
   const input = lens.querySelector('#rwa-lens-input');
   if (input) input.placeholder = LENS_PLACEHOLDER;
@@ -3283,6 +3477,7 @@ window.releaseAnchor = releaseAnchor;
 if (typeof navigator !== 'undefined' && /jsdom/i.test(navigator.userAgent)) {
   window.__handleMountClick = handleMountClick;
   window.__liveNodeForEntry = liveNodeForEntry;
+  window.commandStartIndex = commandStartIndex;
 }
 
 // ─── Inline manual edit (edit-surface: direct, no-LLM block editing) ──────
@@ -3298,6 +3493,7 @@ if (typeof navigator !== 'undefined' && /jsdom/i.test(navigator.userAgent)) {
 // containers; FIGCAPTION is not independently anchorable (lives in FIGURE).
 const INLINE_EDITABLE = new Set(['P','H1','H2','H3','H4','H5','H6','BLOCKQUOTE','LI','TD']);
 let inlineEdit = null; // { el, entry } while a block is being hand-edited
+let _inlineSwitchPending = false; // true between exit-old and enter-new during a DIRTY block switch
 const INLINE_EDIT_BYPASS = 'button,input,textarea,select,option,summary,[contenteditable="true"],[data-rwa-no-inline-edit]';
 
 // Controlled serializer: turn an edited contenteditable node into a clean
@@ -3325,8 +3521,28 @@ window.serializeLeafSafe = serializeLeafSafe;
 let selectionCommandState = null; // { el, entry, text, occurrence, range }
 let selectionVoiceRecognizer = null;
 
+// The bubble is pointer-transparent (CSS) until "armed". Arming on a brief pointer dwell
+// distinguishes "moving onto the bar to click a control" (arm → clickable) from "pressing to
+// select text the bar happens to overlap" (no dwell → press passes through to the text). A
+// fresh/hidden bar is always disarmed, so a press right after it appears reaches the text.
+let _barArmTimer = null, _lastPointer = { x: -1, y: -1 };
+function disarmSelectionBar() {
+  if (_barArmTimer) { clearTimeout(_barArmTimer); _barArmTimer = null; }
+  const bar = document.getElementById('rwa-selection-bar');
+  if (bar) bar.classList.remove('armed');
+}
+function maybeArmSelectionBar(x, y) {
+  const bar = document.getElementById('rwa-selection-bar');
+  if (!bar || bar.hidden) { disarmSelectionBar(); return; }
+  let r; try { r = bar.getBoundingClientRect(); } catch (_) { return; }
+  const inside = x >= r.left && x <= r.right && y >= r.top && y <= r.bottom;
+  if (inside) {
+    if (!bar.classList.contains('armed') && !_barArmTimer) _barArmTimer = setTimeout(() => { _barArmTimer = null; bar.classList.add('armed'); }, 130);
+  } else { disarmSelectionBar(); }
+}
 function hideSelectionCommandBar() {
   selectionCommandState = null;
+  disarmSelectionBar();
   const bar = document.getElementById('rwa-selection-bar');
   if (bar) {
     bar.hidden = true;
@@ -3421,7 +3637,16 @@ function parseSelectionCommand(raw) {
   if (!t) return null;
   if (/\b(bold|strong|emphasize strongly)\b/.test(t)) return { kind: 'wrap', tag: 'strong', label: 'bold' };
   if (/\b(italic|italics|emphasize)\b/.test(t)) return { kind: 'wrap', tag: 'em', label: 'italic' };
+  if (/\b(underline|underlined)\b/.test(t)) return { kind: 'wrap', tag: 'u', label: 'underline' };
+  if (/\b(strikethrough|strike through|strikethru|strike|crossed out|cross out)\b/.test(t)) return { kind: 'wrap', tag: 's', label: 'strikethrough' };
   if (/\b(code|monospace|inline code)\b/.test(t)) return { kind: 'wrap', tag: 'code', label: 'code' };
+  if (/\b(h1|heading 1|title)\b/.test(t)) return { kind: 'retag', tag: 'h1', label: 'heading 1' };
+  if (/\b(h2|heading 2|heading)\b/.test(t)) return { kind: 'retag', tag: 'h2', label: 'heading 2' };
+  if (/\b(h3|heading 3|subheading|subhead)\b/.test(t)) return { kind: 'retag', tag: 'h3', label: 'heading 3' };
+  if (/\b(paragraph|body text|normal text|plain text)\b/.test(t)) return { kind: 'retag', tag: 'p', label: 'paragraph' };
+  if (/\b(align center|center|centre|centered|centred)\b/.test(t)) return { kind: 'align', align: 'center', label: 'center' };
+  if (/\b(align right|right align|right)\b/.test(t)) return { kind: 'align', align: 'right', label: 'right' };
+  if (/\b(align left|left align|left)\b/.test(t)) return { kind: 'align', align: 'left', label: 'left' };
   return null;
 }
 
@@ -3442,7 +3667,7 @@ async function applySelectionWrap(target, action, actor, instruction) {
     return { ok: false, reason: 'anchor_unresolved' };
   }
   const tag = action.tag;
-  const nextBlock = loc.block.slice(0, loc.start) + '<' + tag + '>' + loc.selectedSource + '</' + tag + '>' + loc.block.slice(loc.end);
+  const nextBlock = loc.block.slice(0, loc.start) + '<' + tag + (action.attrs || '') + '>' + loc.selectedSource + '</' + tag + '>' + loc.block.slice(loc.end);
   const replace = a.replacePrefix + nextBlock + a.replaceSuffix;
   await runtimeApplyEnvelope(
     { version: 'rwa-edit/1', edits: [{ find: a.find, replace, reason: 'selection:' + action.label }] },
@@ -3453,6 +3678,63 @@ async function applySelectionWrap(target, action, actor, instruction) {
   return { ok: true };
 }
 
+// Split a leaf block's source into its open tag, attributes, inner HTML and any
+// trailing whitespace — so a retag/restyle preserves every attribute (data-rwa-id
+// included) and the surrounding bytes exactly.
+function blockOpenInner(block, tag) {
+  const lt = tag.toLowerCase();
+  const openEnd = block.indexOf('>');
+  const closeMatch = new RegExp('(</' + lt + '\\s*>)(\\s*)$', 'i').exec(block);
+  if (openEnd < 0 || !closeMatch) return null;
+  return { openTag: block.slice(0, openEnd + 1), attrs: block.slice(1 + lt.length, openEnd), inner: block.slice(openEnd + 1, closeMatch.index), trailing: closeMatch[2] };
+}
+// Merge text-align into an open tag's style attribute (idempotent; keeps other props).
+function setOpenTagTextAlign(openTag, align) {
+  const decl = 'text-align:' + align;
+  const m = /\sstyle="([^"]*)"/i.exec(openTag);
+  if (m) {
+    let props = m[1].replace(/\s*text-align\s*:[^;]*;?/ig, '').trim().replace(/;\s*$/, '');
+    props = props ? props + '; ' + decl : decl;
+    return openTag.slice(0, m.index) + ' style="' + props + '"' + openTag.slice(m.index + m[0].length);
+  }
+  return openTag.slice(0, -1) + ' style="' + decl + '">';
+}
+// Block-level formatting (heading retag / alignment) — operates on the whole leaf the
+// selection sits in, committed through the same non-agent path as the inline wraps.
+async function applyBlockFormat(target, action, actor) {
+  if (inlineEdit && serializeLeafSafe(inlineEdit.el) !== inlineEdit.original) {
+    showAffordance('finish the current edit first');
+    return { ok: false, reason: 'inline_edit_dirty' };
+  }
+  if (inlineEdit) exitInlineEdit();
+  const block = currentDocCache.slice(target.entry.start, target.entry.end);
+  const parts = blockOpenInner(block, target.entry.tag);
+  if (!parts) { showAffordance('block could not be parsed'); return { ok: false, reason: 'block_unparsed' }; }
+  let nextBlock;
+  if (action.kind === 'retag') {
+    if (!/^(p|h[1-6])$/.test(target.entry.tag.toLowerCase())) { showAffordance("can't change this block's type"); return { ok: false, reason: 'not_retaggable' }; }
+    if (target.entry.tag.toLowerCase() === action.tag) { showAffordance('already ' + action.label); return { ok: true, noop: true }; }
+    nextBlock = '<' + action.tag + parts.attrs + '>' + parts.inner + '</' + action.tag + '>' + parts.trailing;
+  } else {
+    nextBlock = setOpenTagTextAlign(parts.openTag, action.align) + block.slice(block.indexOf('>') + 1);
+  }
+  const a = resolveAnchorFind(target.entry);
+  if (!a) { showAffordance('selection block is ambiguous'); return { ok: false, reason: 'anchor_unresolved' }; }
+  const replace = a.replacePrefix + nextBlock + a.replaceSuffix;
+  try {
+    await runtimeApplyEnvelope(
+      { version: 'rwa-edit/1', edits: [{ find: a.find, replace, reason: 'format:' + action.label }] },
+      { surface: 'selection-edit', instruction: action.label, actor: actor || 'user:selection-command' });
+  } catch (e) {
+    showAffordance("couldn't " + action.label + ' here — ' + ((e && e.message) || 'blocked'));
+    return { ok: false, reason: (e && e.code) || 'apply_failed' };
+  }
+  try { window.getSelection().removeAllRanges(); } catch (_) {}
+  hideSelectionCommandBar();
+  showAffordance(action.label + ' — ⌘Z to undo');
+  return { ok: true };
+}
+
 async function runSelectionCommand(raw, options) {
   options = options || {};
   const target = resolveSelectionCommandTarget() || selectionCommandState;
@@ -3466,9 +3748,64 @@ async function runSelectionCommand(raw, options) {
     return { ok: false, reason: 'unknown_command' };
   }
   if (action.kind === 'wrap') return applySelectionWrap(target, action, options.actor, raw);
+  if (action.kind === 'retag' || action.kind === 'align') return applyBlockFormat(target, action, options.actor);
   return { ok: false, reason: 'unknown_command' };
 }
 
+// Link insertion — wraps the selection in <a href>. The URL is sanitized (scheme allowlist:
+// http(s)/mailto/tel, plus scheme-less relative/anchor; javascript:/data:/vbscript:/etc. are
+// refused) and attribute-escaped, so a hostile URL can never become script in the document.
+function sanitizeHref(url) {
+  const u = String(url || '').trim();
+  if (!u) return null;
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(u);
+  if (scheme) return /^(https?|mailto|tel)$/i.test(scheme[1]) ? u : null;
+  return u; // no scheme → relative / anchor → allowed
+}
+async function applySelectionLink(target, url, actor) {
+  const href = sanitizeHref(url);
+  if (!href) { showAffordance('that link is not allowed'); return { ok: false, reason: 'bad_url' }; }
+  const esc = href.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  return applySelectionWrap(target, { tag: 'a', label: 'link', attrs: ' href="' + esc + '"' }, actor, 'link');
+}
+async function runSelectionLink(url, options) {
+  options = options || {};
+  const target = resolveSelectionCommandTarget() || selectionCommandState;
+  if (!target) { showAffordance('select text in Edit mode first'); return { ok: false, reason: 'no_selection' }; }
+  return applySelectionLink(target, url, options.actor || 'user:selection-command');
+}
+
+// Text color — wraps the selection in <span style="color:#hex">. The color MUST be a plain
+// hex (the swatch palette feeds it); anything else is refused so no extra style declaration
+// (e.g. background:url(...)) can be injected through the attribute.
+function sanitizeColor(c) { const v = String(c || '').trim(); return /^#[0-9a-f]{3,8}$/i.test(v) ? v : null; }
+async function applySelectionColor(target, color, actor) {
+  const c = sanitizeColor(color);
+  if (!c) { showAffordance('that color is not allowed'); return { ok: false, reason: 'bad_color' }; }
+  return applySelectionWrap(target, { tag: 'span', label: 'color', attrs: ' style="color:' + c + '"' }, actor, 'color');
+}
+async function runSelectionColor(color, options) {
+  options = options || {};
+  const target = resolveSelectionCommandTarget() || selectionCommandState;
+  if (!target) { showAffordance('select text in Edit mode first'); return { ok: false, reason: 'no_selection' }; }
+  return applySelectionColor(target, color, options.actor || 'user:selection-command');
+}
+
+// Font size — a fixed em-scale (named steps only) wrapped as <span style="font-size:Xem">.
+// Headings give semantic sizes; this is the fine control the user's "font/-sizes" ask wants.
+const RWA_FONT_SIZE_SCALE = { small: '0.85em', normal: '1em', large: '1.3em', huge: '1.7em' };
+async function applySelectionSize(target, size, actor) {
+  const em = RWA_FONT_SIZE_SCALE[String(size || '').trim().toLowerCase()];
+  if (!em) { showAffordance('that size is not available'); return { ok: false, reason: 'bad_size' }; }
+  return applySelectionWrap(target, { tag: 'span', label: 'size', attrs: ' style="font-size:' + em + '"' }, actor, 'size');
+}
+async function runSelectionSize(size, options) {
+  options = options || {};
+  const target = resolveSelectionCommandTarget() || selectionCommandState;
+  if (!target) { showAffordance('select text in Edit mode first'); return { ok: false, reason: 'no_selection' }; }
+  return applySelectionSize(target, size, options.actor || 'user:selection-command');
+}
+
 function positionSelectionCommandBar(target) {
   const bar = document.getElementById('rwa-selection-bar');
   if (!bar || !target || !target.range) return;
@@ -3481,7 +3818,15 @@ function positionSelectionCommandBar(target) {
   const left = Math.max(8, Math.min(window.scrollX + (rect ? rect.left : 0), window.scrollX + window.innerWidth - 320));
   bar.style.top = top + 'px';
   bar.style.left = left + 'px';
+  const blockSel = document.getElementById('rwa-selection-block');
+  if (blockSel) { const tg = (target.entry && target.entry.tag || '').toLowerCase(); blockSel.value = /^h[1-3]$/.test(tg) ? tg : 'paragraph'; }
+  // A fresh bubble starts collapsed — hide the reveal-on-demand surfaces (command/voice
+  // cluster, link field, color swatches) so they don't carry over from a prior selection.
+  for (const sid of ['rwa-selection-cmdwrap', 'rwa-selection-link-input', 'rwa-selection-color-pop']) { const e = document.getElementById(sid); if (e) e.hidden = true; }
+  const moreBtn = document.getElementById('rwa-selection-more'); if (moreBtn) { moreBtn.setAttribute('aria-expanded', 'false'); moreBtn.classList.remove('on'); }
+  bar.classList.remove('armed'); // a freshly (re)positioned bar starts pointer-transparent
   bar.hidden = false;
+  maybeArmSelectionBar(_lastPointer.x, _lastPointer.y); // arm only if the pointer is already dwelling on it
 }
 
 function refreshSelectionCommandBar() {
@@ -3538,7 +3883,11 @@ function startSelectionVoice() {
 if (typeof navigator !== 'undefined' && /jsdom/i.test(navigator.userAgent)) {
   window.__refreshSelectionCommandBar = refreshSelectionCommandBar;
   window.__runSelectionCommand = runSelectionCommand;
+  window.__runSelectionLink = runSelectionLink;
+  window.__runSelectionColor = runSelectionColor;
+  window.__runSelectionSize = runSelectionSize;
   window.__startSelectionVoice = startSelectionVoice;
+  window.__setDirty = setDirty;
   window.__parseSelectionCommand = parseSelectionCommand;
 }
 
@@ -3594,6 +3943,12 @@ function enterInlineEdit(el, entry) {
   // Baseline serialization for the no-op guard (so an accidental double-click +
   // click-away commits nothing — no undo frame, no history record, no dirty).
   inlineEdit.original = serializeLeafSafe(el);
+  // "The block I'm working on": the block your caret is in IS the single source of truth for the
+  // outline + the lens (⌘K) target. anchorTo paints exactly this block — clearing every other
+  // outline — and points the lens at it. There is no second writer (handleMountClick no longer
+  // anchors while editing), and switching blocks goes through exit→enter atomically, so the
+  // cursor and outline can never land on different blocks (design 2026-06-24-working-block).
+  if (entry && typeof anchorTo === 'function') anchorTo(entry);
 }
 function exitInlineEdit() {
   if (!inlineEdit) return;
@@ -3605,6 +3960,8 @@ function exitInlineEdit() {
   try { el.removeAttribute('contenteditable'); } catch (_) {}
   try { delete el.dataset.rwaCmd; } catch (_) {}
   inlineEdit = null;
+  // Stop editing → the lens releases back to whole-doc (the anchor never lingers past the edit).
+  if (typeof releaseAnchor === 'function') releaseAnchor();
 }
 // Esc — discard the hand-edit and restore the block from the stored doc.
 function revertInlineEdit() {
@@ -3661,15 +4018,78 @@ function insertSoftBreak() {
 // the serialized text is what a commit would write, so the mode the user sees
 // matches what would actually happen. A leading "/" survives HTML-escaping
 // unchanged, so the serializer is safe to discriminate on.
-function isSlashCommand(text) {
-  // leading whitespace ignored; a lone "/" still shows prompt mode
-  const t = text.replace(/^\s+/, '');
-  return t.startsWith('/') && !t.startsWith('\\/');
+// Inline LLM command: a "/" at a word boundary (block start, after leading whitespace, or after
+// any whitespace mid-block) turns the suffix from there to the end into an instruction for the
+// model. Returns that "/" position (the LAST such — so "fix this /shorten it" targets the trailing
+// command), or -1. The \/ escape and mid-word slashes (http://, /etc/hosts) are NOT commands.
+function commandStartIndex(text) {
+  let last = -1;
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] !== '/') continue;
+    if (i > 0 && text[i - 1] === '\\') continue;     // \/ escape → literal slash
+    if (i === 0 || /\s/.test(text[i - 1])) last = i;  // start, or preceded by whitespace
+  }
+  return last;
+}
+// Caret <-> character offset within the block, so the command-colour span can be rebuilt without
+// the caret jumping (defensive: jsdom's Range/Selection support is partial — never throw).
+function inlineCaretOffset(el) {
+  const sel = window.getSelection && window.getSelection();
+  if (!sel || !sel.rangeCount) return null;
+  try {
+    const pre = document.createRange();
+    pre.selectNodeContents(el);
+    pre.setEnd(sel.getRangeAt(0).startContainer, sel.getRangeAt(0).startOffset);
+    return pre.toString().length;
+  } catch (_) { return null; }
 }
-function handleInlineInput() {
+function inlineOffsetPoint(el, offset) {
+  let rem = offset;
+  const w = document.createTreeWalker(el, NodeFilter.SHOW_TEXT, null);
+  let n;
+  while ((n = w.nextNode())) { if (rem <= n.data.length) return { node: n, off: rem }; rem -= n.data.length; }
+  return null;
+}
+function inlineSetCaret(el, offset) {
+  if (offset == null) return;
+  const sel = window.getSelection && window.getSelection();
+  if (!sel) return;
+  try {
+    const p = inlineOffsetPoint(el, offset);
+    const r = document.createRange();
+    if (p) r.setStart(p.node, p.off); else { r.selectNodeContents(el); r.collapse(false); }
+    r.collapse(true); sel.removeAllRanges(); sel.addRange(r);
+  } catch (_) {}
+}
+// Colour ONLY the "/command" suffix (span[data-rwa-cmd-text]); the content before it stays normal.
+// Rebuilt from a clean tree each keystroke; caret preserved by offset; surroundContents preserves
+// any inline markup before the command.
+function paintCommandSpan(el, isCmd) {
+  const off = inlineCaretOffset(el);
+  el.querySelectorAll('span[data-rwa-cmd-text]').forEach(s => {
+    const p = s.parentNode; while (s.firstChild) p.insertBefore(s.firstChild, s); p.removeChild(s);
+  });
+  el.normalize();
+  if (isCmd) {
+    const text = el.textContent;
+    const ci = commandStartIndex(text);
+    const a = inlineOffsetPoint(el, ci), b = inlineOffsetPoint(el, text.length);
+    if (a && b) {
+      const r = document.createRange();
+      r.setStart(a.node, a.off); r.setEnd(b.node, b.off);
+      const span = document.createElement('span'); span.setAttribute('data-rwa-cmd-text', '');
+      r.surroundContents(span);
+    }
+  }
+  inlineSetCaret(el, off);
+}
+function handleInlineInput(e) {
   if (!inlineEdit) return;
-  if (inlineEdit.demoted) { setInlineCmd(false); return; } // Esc demoted to plain text — stay there
-  setInlineCmd(isSlashCommand(serializeLeafSafe(inlineEdit.el)));
+  if (e && e.isComposing) return; // mid-IME — don't touch the DOM
+  const el = inlineEdit.el;
+  const isCmd = !inlineEdit.demoted && commandStartIndex(el.textContent) >= 0;
+  setInlineCmd(isCmd);
+  if (isCmd || el.querySelector('span[data-rwa-cmd-text]')) { try { paintCommandSpan(el, isCmd); } catch (_) {} }
 }
 function setInlineCmd(on) {
   if (!inlineEdit) return;
@@ -3692,11 +4112,13 @@ function handleInlineKeydown(e) {
   } else if (e.key === 'Escape') {
     e.preventDefault();
     if (inlineEdit.commandMode) {
-      // Esc in command mode demotes to literal text — "/usr/local" must be
-      // typeable. Sticky for the rest of this edit session so re-typing
-      // slashes doesn't fight the user. Second Esc reverts as always.
+      // Esc stops command mode but KEEPS the text: the "/command" becomes plain literal text
+      // (un-coloured), it is NOT reverted/deleted. ("/usr/local" must be typeable too.) Sticky
+      // for the rest of this session so re-typing slashes doesn't fight the user; a second Esc
+      // (now not in command mode) reverts the block as always.
       inlineEdit.demoted = true;
       setInlineCmd(false);
+      try { paintCommandSpan(inlineEdit.el, false); } catch (_) {} // unwrap the colour span, keep the text
     } else {
       revertInlineEdit();
     }
@@ -3730,9 +4152,19 @@ function handleInlineBlur(e) {
 // The quote entities are future-proofing — escapeHtml doesn't emit them today.
 async function runInlineCommand() {
   if (!inlineEdit) return;
-  const instruction = serializeLeafSafe(inlineEdit.el)
-    .replace(/^\s*\/\s?/, '')
-    .replace(/<br\s*\/?>/gi, '\n')
+  const el = inlineEdit.el;
+  // Unwrap the colour span so the serialization is clean (no span tags leak into the prompt).
+  el.querySelectorAll('span[data-rwa-cmd-text]').forEach(s => { const p = s.parentNode; while (s.firstChild) p.insertBefore(s.firstChild, s); p.removeChild(s); });
+  el.normalize();
+  // The instruction is the text AFTER the command "/" — which may be MID-block ("fix this /shorten
+  // it"). Convert soft breaks to newlines FIRST (so a "<br/>" slash can't masquerade as the
+  // command), find the word-boundary command "/", take the suffix, then unescape the entities so
+  // the model sees what the user typed ("<h2>" not "&lt;h2&gt;", "&" not "&amp;"). renderDoc below
+  // restores the committed block, so the "/command" — never committed — is removed.
+  const ser = serializeLeafSafe(el).replace(/<br\s*\/?>/gi, '\n');
+  const ci = commandStartIndex(ser);
+  const instruction = (ci >= 0 ? ser.slice(ci + 1) : ser.replace(/^\s*\/\s?/, ''))
+    .replace(/^[ \t]?/, '')
     .replace(/&lt;/g, '<').replace(/&gt;/g, '>')
     .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
     .replace(/&amp;/g, '&')
@@ -3801,13 +4233,43 @@ window.commitInlineEdit = commitInlineEdit;
 
 function startInlineEditFromEvent(e) {
   if (rwaMode !== 'edit' || activeView) return false;
-  if (inlineEdit) return false;
   const hit = resolveInlineEditTarget(e && e.target);
   if (!hit) return false;
+  // Already editing this exact block → leave it; the browser handles the caret move.
+  if (inlineEdit && inlineEdit.el === hit.el) return false;
+  // Editing a DIFFERENT block → switch atomically (commit/exit old, enter new) so the cursor
+  // and the working-block outline land on the new block in ONE click, never lagging a block
+  // behind (design 2026-06-24-working-block).
+  if (inlineEdit) { switchInlineEditTo(hit); return true; }
   enterInlineEdit(hit.el, hit.entry);
   return true;
 }
 
+// Atomic block switch. Clean (unedited) old block → exit + enter, synchronous. Dirty old block
+// → commit it (which re-renders), then re-resolve the target by its ORDINAL in the rebuilt DOM
+// and enter it (ordinals are stable because a leaf commit changes the block's text, not the
+// block order). Either way the outline ends on the clicked block, never the previous one.
+function switchInlineEditTo(hit) {
+  const mount = document.getElementById('rwa-doc-mount');
+  const targetOrd = mount ? anchorableOrdinal(mount, hit.el) : -1;
+  let dirty = false;
+  try { dirty = serializeLeafSafe(inlineEdit.el) !== inlineEdit.original; } catch (_) {}
+  if (!dirty) {
+    exitInlineEdit();
+    enterInlineEdit(hit.el, hit.entry);
+    return;
+  }
+  // Dirty switch is async (commit re-renders). Flag it so the click that triggered the switch
+  // doesn't anchor the clicked leaf in the gap before the new block is entered.
+  _inlineSwitchPending = true;
+  commitInlineEdit().then(() => {
+    if (targetOrd < 0 || !sourceMap) return;
+    const newEntry = sourceMap[targetOrd];
+    const newEl = newEntry ? liveNodeForEntry(newEntry) : null;
+    if (newEl && newEntry) enterInlineEdit(newEl, newEntry);
+  }).catch(() => {}).then(() => { _inlineSwitchPending = false; });
+}
+
 // Pointer-down opens the edit before the browser performs its default caret
 // placement for the ensuing click. This is the WYSIWYG path: click text, type.
 function handleMountPointerDown(e) {
@@ -6426,22 +6888,59 @@ function runtimeSetView(name) {
     sessionStorage.setItem(rwaViewKey(), '');
   } else {
     const spec = providers.view;
-    if (!spec || spec.name !== name) throw new Error('no registered view named ' + name);
-    validateViewOutput(spec.render(currentDocCache, viewCtx()), spec); // throws → never activates
-    releaseAnchor();
-    if (rwaMode !== 'document') {
-      hideEditTransients();
-      closeRuntimePanels();
-      rwaMode = 'document';
-      emitRuntimeEvent('mode', { mode: rwaMode });
+    if (spec && spec.name === name) {
+      validateViewOutput(spec.render(currentDocCache, viewCtx()), spec); // throws → never activates
+      releaseAnchor();
+      if (rwaMode !== 'document') {
+        hideEditTransients();
+        closeRuntimePanels();
+        rwaMode = 'document';
+        emitRuntimeEvent('mode', { mode: rwaMode });
+      }
+      activeView = spec;
+      sessionStorage.setItem(rwaViewKey(), name);
+    } else {
+      // I7 (v0.9 §8) — an INSTALLED view skill (by skillId or name). Resolve SYNCHRONOUSLY so an
+      // unknown name still throws (unchanged behavior); only a genuine installed view goes async.
+      // Its render() runs in a Worker, so we invoke once, validate the returned HTML main-side (same
+      // contract as a first-party view — no <script>, no reserved ids), and activate a SNAPSHOT
+      // overlay whose sync render() returns the cached HTML. A view never commits (read-only);
+      // re-activate to refresh (auto-refresh-on-change is the deferred `observe` opt-in).
+      const rec = installedSkills.get(name) || Array.from(installedSkills.values()).find(s => s.name === name && s.kind === 'view');
+      if (!rec || rec.kind !== 'view' || !(rec.manifest && rec.manifest.output && rec.manifest.output.kind === 'html-render')) throw new Error('no registered view named ' + name);
+      runtimeActivateInstalledView(rec);
+      return;
     }
-    activeView = spec;
-    sessionStorage.setItem(rwaViewKey(), name);
   }
   if (typeof syncModeChrome === 'function') syncModeChrome();
   if (typeof syncViewChrome === 'function') syncViewChrome();
   getDoc().then(d => renderDoc(canonLF(d)));
 }
+async function runtimeActivateInstalledView(rec) {
+  try {
+    const d = canonLF(await getDoc());
+    const html = String(await runtimeInvokeSkill(rec.skillId, { doc: d, ctx: viewCtx() }));
+    validateViewOutput(html, { name: rec.name }); // throws → never activates (fail-loud, same as first-party)
+    releaseAnchor();
+    if (rwaMode !== 'document') { hideEditTransients(); closeRuntimePanels(); rwaMode = 'document'; emitRuntimeEvent('mode', { mode: rwaMode }); }
+    activeView = { name: rec.name, label: rec.name, skillId: rec.skillId, __provenance: 'installed', __html: html, render() { return this.__html; } };
+    if (typeof syncModeChrome === 'function') syncModeChrome();
+    if (typeof syncViewChrome === 'function') syncViewChrome();
+    renderDoc(d);
+  } catch (e) {
+    setStatus('err', '✗ ' + ((e && e.message) || 'view failed'));
+  }
+}
+// I7 (v0.9 §8) — invoke an INSTALLED edit-surface skill: its run() returns an rwa-edit/1 envelope
+// (a deterministic, model-free transform), which is applied through the SAME validated commit path
+// the agent/lens use (frozen-zone + structural-shape guards, one ⌘Z), attributed to the skill.
+async function runtimeInvokeEditSurface(skillId, input) {
+  const rec = installedSkills.get(skillId);
+  if (!rec || rec.kind !== 'edit-surface') throw new Error('not an edit-surface skill');
+  const envelope = await runtimeInvokeSkill(skillId, input || {});
+  if (!envelope || typeof envelope !== 'object' || envelope.version !== 'rwa-edit/1') throw new Error('invalid_transform_output');
+  return runtimeApplyEnvelope(envelope, { surface: 'skill:edit-surface', actor: 'skill:transform:' + String(skillId).slice(0, 8) });
+}
 function rwaViewKey() { return 'rwa_view_active_' + DOC_UUID; }
 function rwaSlideKey() { return 'rwa_view_slide_' + DOC_UUID; }
 
@@ -6655,6 +7154,43 @@ async function _skSourceGet(pubkey) {
   if (!pubkey) return null;
   try { return (await idbGet(RWA.SOURCES, pubkey)) || null; } catch (_) { return null; }
 }
+// I6 (v0.9 §11) — TOFU author identity. Fingerprint = sha256(pubkey).hex[:16] (mirrors the
+// service's skillFingerprint). The per-author install count + first_seen come from rwa_sources (I5),
+// so the dialog can say "first time seeing this author" vs "trusted, N installs".
+async function _skFingerprint(pubkey) {
+  const h = await _skSha256(_skUtf8(String(pubkey)));
+  let s = ''; for (const b of h) s += b.toString(16).padStart(2, '0');
+  return s.slice(0, 16);
+}
+async function _skTofu(pubkey) {
+  const rec = await _skSourceGet(pubkey);
+  const installs = (rec && rec.count) || 0;
+  return { fingerprint: await _skFingerprint(pubkey), firstTime: installs === 0, installs };
+}
+// I6 (v0.9 §11) — marketplace discovery (opt-in network, like the ↗ share panel). discover →
+// GET /skills/index (paginated/filterable). fetch → GET /skills/index/:id → the full envelope,
+// VERIFIED client-side (WebCrypto Ed25519 via _skVerify) before any install; a revoked skill returns
+// {revoked:true}. The index only informs — install still runs the dialog + gates (the trust anchor).
+const SKILLS_INDEX_DEFAULT = 'https://rewritable.ikangai.com';
+async function runtimeDiscoverSkills(opts) {
+  opts = opts || {};
+  const base = (opts.baseUrl || SKILLS_INDEX_DEFAULT).replace(/\/+$/, '');
+  const qs = new URLSearchParams();
+  for (const k of ['kind', 'author', 'search', 'verified_only', 'page', 'limit']) if (opts[k] != null) qs.set(k, String(opts[k]));
+  const res = await fetch(base + '/skills/index' + (qs.toString() ? '?' + qs.toString() : ''));
+  if (!res.ok) throw new Error('discover_failed:' + res.status);
+  return res.json(); // { entries, total, page, limit }
+}
+async function runtimeFetchSkillFromIndex(skillId, opts) {
+  opts = opts || {};
+  const base = (opts.baseUrl || SKILLS_INDEX_DEFAULT).replace(/\/+$/, '');
+  const res = await fetch(base + '/skills/index/' + encodeURIComponent(skillId));
+  if (res.status === 410) return { revoked: true, envelope: null, verified: false };
+  if (!res.ok) throw new Error('fetch_failed:' + res.status);
+  const data = await res.json();
+  const verified = await _skVerify(data.envelope); // client-side: never trust the index's `verified`
+  return { envelope: data.envelope, metadata: data.metadata, verified, revoked: false };
+}
 // Append (name, now) for a key, creating the record if absent. Idempotent per distinct name.
 async function _skSourceRecord(pubkey, name, at) {
   if (!pubkey || !name) return;
@@ -6713,28 +7249,99 @@ function _skB64(bytes) { let s = ''; for (const b of bytes) s += String.fromChar
 async function _vaultLoadRec() {
   if (_vaultRec) return _vaultRec;
   let rec = null; try { rec = await idbGet(RWA.VAULT); } catch (_) {}
-  if (!rec || typeof rec !== 'object') rec = { salt: _skB64(crypto.getRandomValues(new Uint8Array(16))), check: null, entries: {} };
+  if (!rec || typeof rec !== 'object') rec = { salt: _skB64(crypto.getRandomValues(new Uint8Array(16))), kdf_version: 1, check: null, entries: {} }; // new vaults default to v1 (Argon2id); a loaded v0.8 record keeps its (absent→0) version
   _vaultRec = rec; return rec;
 }
-async function _vaultDeriveKey(passphrase, saltB64) {
-  const km = await crypto.subtle.importKey('raw', _skUtf8(passphrase), 'PBKDF2', false, ['deriveKey']);
-  return crypto.subtle.deriveKey({ name: 'PBKDF2', salt: _skFromB64(saltB64), iterations: 200000, hash: 'SHA-256' }, km, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+// rwa:argon2:begin ARGON2_SRC
+// Vendored Argon2id (pure JS) — @noble/hashes@2.2.0, MIT. Bundled by
+// tools/vendor-argon2.mjs (esbuild iife/min). Assigns globalThis._argon2id(pw,salt,
+// {t,m,p,dkLen,key?,ad?}). Used to build the blob: Worker in _argon2idViaWorker; the
+// frozen CSP is unchanged (no WASM, no eval). RFC-9106-pinned by tests/vault-kdf.mjs.
+const ARGON2_SRC = "(()=>{var q=BigInt(4294967295),ht=BigInt(32);function ut(e,t=!1){return t?{h:Number(e&q),l:Number(e>>ht&q)}:{h:Number(e>>ht&q)|0,l:Number(e&q)|0}}var j=(e,t,n)=>e>>>n|t<<32-n,C=(e,t,n)=>e<<32-n|t>>>n,J=(e,t,n)=>e<<64-n|t>>>n-32,Q=(e,t,n)=>e>>>n-32|t<<64-n,W=(e,t)=>t,K=(e,t)=>e;function rt(e,t,n,s){let f=(t>>>0)+(s>>>0);return{h:e+n+(f/2**32|0)|0,l:f|0}}var $=(e,t,n)=>(e>>>0)+(t>>>0)+(n>>>0),z=(e,t,n,s)=>t+n+s+(e/2**32|0)|0;function At(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name===\"Uint8Array\"&&\"BYTES_PER_ELEMENT\"in e&&e.BYTES_PER_ELEMENT===1}function G(e,t=\"\"){if(typeof e!=\"number\"){let n=t&&`\"${t}\" `;throw new TypeError(`${n}expected number, got ${typeof e}`)}if(!Number.isSafeInteger(e)||e<0){let n=t&&`\"${t}\" `;throw new RangeError(`${n}expected integer >= 0, got ${e}`)}}function H(e,t,n=\"\"){let s=At(e),f=e?.length,r=t!==void 0;if(!s||r&&f!==t){let i=n&&`\"${n}\" `,o=r?` of length ${t}`:\"\",h=s?`length=${f}`:`type=${typeof e}`,u=i+\"expected Uint8Array\"+o+\", got \"+h;throw s?new RangeError(u):new TypeError(u)}return e}function ot(e,t=!0){if(e.destroyed)throw new Error(\"Hash instance has been destroyed\");if(t&&e.finished)throw new Error(\"Hash#digest() has already been called\")}function at(e,t){H(e,void 0,\"digestInto() output\");let n=t.outputLen;if(e.length<n)throw new RangeError('\"digestInto() output\" expected to be of length >='+n)}function P(e){return new Uint8Array(e.buffer,e.byteOffset,e.byteLength)}function I(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function E(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}var dt=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function pt(e){return e<<24&4278190080|e<<8&16711680|e>>>8&65280|e>>>24&255}var m=dt?e=>e:e=>pt(e)>>>0;function kt(e){for(let t=0;t<e.length;t++)e[t]=pt(e[t]);return e}var L=dt?e=>e:kt;function Lt(e){if(typeof e!=\"string\")throw new TypeError(\"string expected\");return new Uint8Array(new TextEncoder().encode(e))}function v(e,t=\"\"){return typeof e==\"string\"?Lt(e):H(e,void 0,t)}function xt(e,t={}){let n=(f,r)=>e(r).update(f).digest(),s=e(void 0);return n.outputLen=s.outputLen,n.blockLen=s.blockLen,n.canXOF=s.canXOF,n.create=f=>e(f),Object.assign(n,t),Object.freeze(n)}var yt=Uint8Array.from([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,14,10,4,8,9,15,13,6,1,12,0,2,11,7,5,3,11,8,12,0,5,2,15,13,10,14,3,6,7,1,9,4,7,9,3,1,13,12,11,14,2,6,5,10,4,0,15,8,9,0,5,7,2,4,10,15,14,1,11,12,6,8,3,13,2,12,6,10,0,11,8,3,4,13,7,5,15,14,1,9,12,5,1,15,14,13,4,10,0,7,6,3,9,2,8,11,13,11,7,14,12,1,3,9,5,0,15,4,8,6,2,10,6,15,14,9,11,3,0,8,12,2,13,7,1,4,10,5,10,2,8,4,7,6,1,5,15,11,9,14,3,12,13,0,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,14,10,4,8,9,15,13,6,1,12,0,2,11,7,5,3,11,8,12,0,5,2,15,13,10,14,3,6,7,1,9,4,7,9,3,1,13,12,11,14,2,6,5,10,4,0,15,8,9,0,5,7,2,4,10,15,14,1,11,12,6,8,3,13,2,12,6,10,0,11,8,3,4,13,7,5,15,14,1,9]);var w=Uint32Array.from([4089235720,1779033703,2227873595,3144134277,4271175723,1013904242,1595750129,2773480762,2917565137,1359893119,725511199,2600822924,4215389547,528734635,327033209,1541459225]),c=new Uint32Array(32);function T(e,t,n,s,f,r){let i=f[r],o=f[r+1],h=c[2*e],u=c[2*e+1],l=c[2*t],a=c[2*t+1],x=c[2*n],y=c[2*n+1],d=c[2*s],p=c[2*s+1],B=$(h,l,i);u=z(B,u,a,o),h=B|0,{Dh:p,Dl:d}={Dh:p^u,Dl:d^h},{Dh:p,Dl:d}={Dh:W(p,d),Dl:K(p,d)},{h:y,l:x}=rt(y,x,p,d),{Bh:a,Bl:l}={Bh:a^y,Bl:l^x},{Bh:a,Bl:l}={Bh:j(a,l,24),Bl:C(a,l,24)},c[2*e]=h,c[2*e+1]=u,c[2*t]=l,c[2*t+1]=a,c[2*n]=x,c[2*n+1]=y,c[2*s]=d,c[2*s+1]=p}function S(e,t,n,s,f,r){let i=f[r],o=f[r+1],h=c[2*e],u=c[2*e+1],l=c[2*t],a=c[2*t+1],x=c[2*n],y=c[2*n+1],d=c[2*s],p=c[2*s+1],B=$(h,l,i);u=z(B,u,a,o),h=B|0,{Dh:p,Dl:d}={Dh:p^u,Dl:d^h},{Dh:p,Dl:d}={Dh:j(p,d,16),Dl:C(p,d,16)},{h:y,l:x}=rt(y,x,p,d),{Bh:a,Bl:l}={Bh:a^y,Bl:l^x},{Bh:a,Bl:l}={Bh:J(a,l,63),Bl:Q(a,l,63)},c[2*e]=h,c[2*e+1]=u,c[2*t]=l,c[2*t+1]=a,c[2*n]=x,c[2*n+1]=y,c[2*s]=d,c[2*s+1]=p}function Et(e,t={},n,s,f){if(G(n),e<=0||e>n)throw new Error(\"outputLen bigger than keyLen\");let{key:r,salt:i,personalization:o}=t;if(r!==void 0&&(r.length<1||r.length>n))throw new Error('\"key\" expected to be undefined or of length=1..'+n);i!==void 0&&H(i,s,\"salt\"),o!==void 0&&H(o,f,\"personalization\")}var it=class{buffer;buffer32;finished=!1;destroyed=!1;length=0;pos=0;blockLen;outputLen;canXOF=!1;constructor(t,n){G(t),G(n),this.blockLen=t,this.outputLen=n,this.buffer=new Uint8Array(t),this.buffer32=I(this.buffer)}update(t){ot(this),H(t);let{blockLen:n,buffer:s,buffer32:f}=this,r=t.length,i=t.byteOffset,o=t.buffer;for(let h=0;h<r;){this.pos===n&&(L(f),this.compress(f,0,!1),L(f),this.pos=0);let u=Math.min(n-this.pos,r-h),l=i+h;if(u===n&&!(l%4)&&h+u<r){let a=new Uint32Array(o,l,Math.floor((r-h)/4));L(a);for(let x=0;h+n<r;x+=f.length,h+=n)this.length+=n,this.compress(a,x,!1);L(a);continue}s.set(t.subarray(h,h+u),this.pos),this.pos+=u,this.length+=u,h+=u}return this}digestInto(t){ot(this),at(t,this);let{pos:n,buffer32:s}=this;if(this.finished=!0,E(this.buffer.subarray(n)),L(s),this.compress(s,0,!0),L(s),t.byteOffset&3)throw new RangeError('\"digestInto() output\" expected 4-byte aligned byteOffset, got '+t.byteOffset);let f=this.get(),r=I(t),i=Math.floor(this.outputLen/4);for(let l=0;l<i;l++)r[l]=m(f[l]);let o=this.outputLen%4;if(!o)return;let h=i*4,u=f[i];for(let l=0;l<o;l++)t[h+l]=u>>>8*l}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let s=t.slice(0,n);return this.destroy(),s}_cloneInto(t){let{buffer:n,length:s,finished:f,destroyed:r,outputLen:i,pos:o}=this;return t||=new this.constructor({dkLen:i}),t.set(...this.get()),t.buffer.set(n),t.destroyed=r,t.finished=f,t.length=s,t.pos=o,t.outputLen=i,t}clone(){return this._cloneInto()}},st=class extends it{v0l=w[0]|0;v0h=w[1]|0;v1l=w[2]|0;v1h=w[3]|0;v2l=w[4]|0;v2h=w[5]|0;v3l=w[6]|0;v3h=w[7]|0;v4l=w[8]|0;v4h=w[9]|0;v5l=w[10]|0;v5h=w[11]|0;v6l=w[12]|0;v6h=w[13]|0;v7l=w[14]|0;v7h=w[15]|0;constructor(t={}){let n=t.dkLen===void 0?64:t.dkLen;super(128,n),Et(n,t,64,16,16);let{key:s,personalization:f,salt:r}=t,i=0;if(s!==void 0&&(H(s,void 0,\"key\"),i=s.length),this.v0l^=this.outputLen|i<<8|65536|1<<24,r!==void 0){H(r,void 0,\"salt\");let o=I(r);this.v4l^=m(o[0]),this.v4h^=m(o[1]),this.v5l^=m(o[2]),this.v5h^=m(o[3])}if(f!==void 0){H(f,void 0,\"personalization\");let o=I(f);this.v6l^=m(o[0]),this.v6h^=m(o[1]),this.v7l^=m(o[2]),this.v7h^=m(o[3])}if(s!==void 0){let o=new Uint8Array(this.blockLen);o.set(s),this.update(o)}}get(){let{v0l:t,v0h:n,v1l:s,v1h:f,v2l:r,v2h:i,v3l:o,v3h:h,v4l:u,v4h:l,v5l:a,v5h:x,v6l:y,v6h:d,v7l:p,v7h:B}=this;return[t,n,s,f,r,i,o,h,u,l,a,x,y,d,p,B]}set(t,n,s,f,r,i,o,h,u,l,a,x,y,d,p,B){this.v0l=t|0,this.v0h=n|0,this.v1l=s|0,this.v1h=f|0,this.v2l=r|0,this.v2h=i|0,this.v3l=o|0,this.v3h=h|0,this.v4l=u|0,this.v4h=l|0,this.v5l=a|0,this.v5h=x|0,this.v6l=y|0,this.v6h=d|0,this.v7l=p|0,this.v7h=B|0}compress(t,n,s){this.get().forEach((h,u)=>c[u]=h),c.set(w,16);let{h:f,l:r}=ut(BigInt(this.length));c[24]=w[8]^r,c[25]=w[9]^f,s&&(c[28]=~c[28],c[29]=~c[29]);let i=0,o=yt;for(let h=0;h<12;h++)T(0,4,8,12,t,n+2*o[i++]),S(0,4,8,12,t,n+2*o[i++]),T(1,5,9,13,t,n+2*o[i++]),S(1,5,9,13,t,n+2*o[i++]),T(2,6,10,14,t,n+2*o[i++]),S(2,6,10,14,t,n+2*o[i++]),T(3,7,11,15,t,n+2*o[i++]),S(3,7,11,15,t,n+2*o[i++]),T(0,5,10,15,t,n+2*o[i++]),S(0,5,10,15,t,n+2*o[i++]),T(1,6,11,12,t,n+2*o[i++]),S(1,6,11,12,t,n+2*o[i++]),T(2,7,8,13,t,n+2*o[i++]),S(2,7,8,13,t,n+2*o[i++]),T(3,4,9,14,t,n+2*o[i++]),S(3,4,9,14,t,n+2*o[i++]);this.v0l^=c[0]^c[16],this.v0h^=c[1]^c[17],this.v1l^=c[2]^c[18],this.v1h^=c[3]^c[19],this.v2l^=c[4]^c[20],this.v2h^=c[5]^c[21],this.v3l^=c[6]^c[22],this.v3h^=c[7]^c[23],this.v4l^=c[8]^c[24],this.v4h^=c[9]^c[25],this.v5l^=c[10]^c[26],this.v5h^=c[11]^c[27],this.v6l^=c[12]^c[28],this.v6h^=c[13]^c[29],this.v7l^=c[14]^c[30],this.v7h^=c[15]^c[31],E(c)}destroy(){this.destroyed=!0,E(this.buffer32),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}},N=xt(e=>new st(e));var et={Argond2d:0,Argon2i:1,Argon2id:2},F=4,bt=(e,t=\"\")=>e===void 0?Uint8Array.of():v(e,t);function ft(e,t){let n=e&65535,s=e>>>16,f=t&65535,r=t>>>16,i=Math.imul(n,f),o=Math.imul(s,f),h=Math.imul(n,r),u=Math.imul(s,r),l=(i>>>16)+(o&65535)+h,a=u+(o>>>16)+(l>>>16)|0,x=l<<16|i&65535;return{h:a,l:x}}function Ut(e,t){let{h:n,l:s}=ft(e,t);return{h:(n<<1|s>>>31)&4294967295,l:s<<1&4294967295}}function tt(e,t,n,s){let{h:f,l:r}=Ut(t,s),i=$(t,s,r);return{h:z(i,e,n,f),l:i|0}}var b=new Uint32Array(256);function D(e,t,n,s){let f=b[2*e],r=b[2*e+1],i=b[2*t],o=b[2*t+1],h=b[2*n],u=b[2*n+1],l=b[2*s],a=b[2*s+1];({h:r,l:f}=tt(r,f,o,i)),{Dh:a,Dl:l}={Dh:a^r,Dl:l^f},{Dh:a,Dl:l}={Dh:W(a,l),Dl:K(a,l)},{h:u,l:h}=tt(u,h,a,l),{Bh:o,Bl:i}={Bh:o^u,Bl:i^h},{Bh:o,Bl:i}={Bh:j(o,i,24),Bl:C(o,i,24)},{h:r,l:f}=tt(r,f,o,i),{Dh:a,Dl:l}={Dh:a^r,Dl:l^f},{Dh:a,Dl:l}={Dh:j(a,l,16),Dl:C(a,l,16)},{h:u,l:h}=tt(u,h,a,l),{Bh:o,Bl:i}={Bh:o^u,Bl:i^h},{Bh:o,Bl:i}={Bh:J(o,i,63),Bl:Q(o,i,63)},b[2*e]=f,b[2*e+1]=r,b[2*t]=i,b[2*t+1]=o,b[2*n]=h,b[2*n+1]=u,b[2*s]=l,b[2*s+1]=a}function wt(e,t,n,s,f,r,i,o,h,u,l,a,x,y,d,p){D(e,f,h,x),D(t,r,u,y),D(n,i,l,d),D(s,o,a,p),D(e,r,l,p),D(t,i,a,x),D(n,o,h,y),D(s,f,u,d)}function X(e,t,n,s,f){for(let r=0;r<256;r++)b[r]=e[t+r]^e[n+r];for(let r=0;r<128;r+=16)wt(r,r+1,r+2,r+3,r+4,r+5,r+6,r+7,r+8,r+9,r+10,r+11,r+12,r+13,r+14,r+15);for(let r=0;r<16;r+=2)wt(r,r+1,r+16,r+17,r+32,r+33,r+48,r+49,r+64,r+65,r+80,r+81,r+96,r+97,r+112,r+113);if(f)for(let r=0;r<256;r++)e[s+r]^=b[r]^e[t+r]^e[n+r];else for(let r=0;r<256;r++)e[s+r]=b[r]^e[t+r]^e[n+r];E(b)}function ct(e,t){let n=P(e),s=new Uint32Array(1),f=P(s);if(s[0]=m(t),t<=64)return N.create({dkLen:t}).update(f).update(n).digest();let r=new Uint8Array(t),i=N.create({}).update(f).update(n).digest(),o=0;for(r.set(i.subarray(0,32)),o+=32;t-o>64;o+=32){let h=N.create({}).update(i);h.digestInto(i),h.destroy(),r.set(i.subarray(0,32),o)}return r.set(N(i,{dkLen:t-o}),o),E(i,s),r}function Ht(e,t,n,s,f,r,i=!1){let o;e===0?t===0?o=f-1:i?o=t*s+f-1:o=t*s+(f==0?-1:0):i?o=n-s+f-1:o=n-s+(f==0?-1:0);let h=e!==0&&t!==F-1?(t+1)*s:0,u=o-1-ft(o,ft(r,r).h).h;return(h+u)%n}var gt=Math.pow(2,32);function _(e){return Number.isSafeInteger(e)&&e>=0&&e<gt}function It(e){let t={version:19,dkLen:32,maxmem:gt-1,asyncTick:10};for(let[u,l]of Object.entries(e))l!==void 0&&(t[u]=l);let{dkLen:n,p:s,m:f,t:r,version:i,onProgress:o,asyncTick:h}=t;if(!_(n)||n<4)throw new Error('\"dkLen\" must be 4..');if(!_(s)||s<1||s>=Math.pow(2,24))throw new Error('\"p\" must be 1..2^24');if(!_(f))throw new Error('\"m\" must be 0..2^32');if(!_(r)||r<1)throw new Error('\"t\" (iterations) must be 1..2^32');if(o!==void 0&&typeof o!=\"function\")throw new Error('\"progressCb\" must be a function');if(G(h,\"asyncTick\"),!_(f)||f<8*s)throw new Error('\"m\" (memory) must be at least 8*p bytes');if(i!==16&&i!==19)throw new Error('\"version\" must be 0x10 or 0x13, got '+i);return t}function Tt(e,t,n,s){if(e=v(e,\"password\"),t=v(t,\"salt\"),!_(e.length))throw new Error('\"password\" must be less of length 1..4Gb');if(!_(t.length)||t.length<8)throw new Error('\"salt\" must be of length 8..4Gb');if(!Object.values(et).includes(n))throw new Error('\"type\" was invalid');let{p:f,dkLen:r,m:i,t:o,version:h,key:u,personalization:l,maxmem:a,onProgress:x,asyncTick:y}=It(s);u=bt(u,\"key\"),l=bt(l,\"personalization\");let d=N.create(),p=new Uint32Array(1),B=P(p);for(let A of[f,r,i,o,h,n])p[0]=m(A),d.update(B);for(let A of[e,t,u,l])p[0]=m(A.length),d.update(B).update(A);let g=new Uint32Array(18),k=P(g);d.digestInto(k);let O=f,M=4*f*Math.floor(i/(F*f)),U=Math.floor(M/f),V=Math.floor(U/F),R=M*1024;if(!_(a))throw new Error('\"maxmem\" expected <2**32, got '+a);if(R>a)throw new Error('\"maxmem\" limit was hit: memUsed(mP*1024)='+R+\", maxmem=\"+a);let nt=new Uint32Array(R/4);for(let A=0;A<f;A++){let Y=256*U*A;g[17]=m(A),g[16]=m(0),nt.set(L(I(ct(g,1024))),Y),g[16]=m(1),nt.set(L(I(ct(g,1024))),Y+256)}let lt=()=>{};if(x){let A=o*F*f*V-2*f,Y=Math.max(Math.floor(A/1e4),1),Z=0;lt=()=>{Z++,x&&(!(Z%Y)||Z===A)&&x(Z/A)}}return E(p,g),{type:n,mP:M,p:f,t:o,version:h,B:nt,laneLen:U,lanes:O,segmentLen:V,dkLen:r,perBlock:lt,asyncTick:y}}function St(e,t,n,s){let f=new Uint32Array(256);for(let i=0;i<t;i++)for(let o=0;o<256;o++)f[o]^=e[256*(n*i+n-1)+o];let r=ct(L(f),s);return E(e,f),r}function Dt(e,t,n,s,f,r,i,o,h,u,l,a,x){u%i&&(l=u-1);let y,d;if(a){let k=r%128;k===0&&(t[268]++,X(t,256,2*256,0,!1),X(t,0,2*256,0,!1)),y=t[2*k],d=t[2*k+1]}else{let k=256*l;y=e[k],d=e[k+1]}let p=s===0&&f===0?n:d%h,B=Ht(s,f,i,o,r,y,p==n),g=i*p+B;X(e,256*l,256*g,u*256,x)}function _t(e,t,n,s){let{mP:f,p:r,t:i,version:o,B:h,laneLen:u,lanes:l,segmentLen:a,dkLen:x,perBlock:y}=Tt(t,n,e,s),d=new Uint32Array(3*256);d[262]=f,d[264]=i,d[266]=e;for(let p=0;p<i;p++){let B=p!==0&&o===19;d[256]=p;for(let g=0;g<F;g++){d[260]=g;let k=e==et.Argon2i||e==et.Argon2id&&p===0&&g<2;for(let O=0;O<r;O++){d[258]=O,d[268]=0;let M=0;p===0&&g===0&&(M=2,k&&(d[268]++,X(d,256,2*256,0,!1),X(d,0,2*256,0,!1)));let U=O*u+g*a+M,V=U%u?U-1:U+u-1;for(let R=M;R<a;R++,U++,V++)y(),Dt(h,d,O,p,g,R,u,a,l,U,V,k,B)}}}return E(d),St(h,r,u,x)}var mt=(e,t,n)=>_t(et.Argon2id,e,t,n);globalThis._argon2id=function(e,t,n){return n=n||{},mt(e,t,{t:n.t,m:n.m,p:n.p,dkLen:n.dkLen||32,key:n.key,personalization:n.ad})};})();";
+// rwa:argon2:end ARGON2_SRC
+function _argon2idViaWorker(pwBytes, saltBytes, params) {
+  return new Promise((resolve, reject) => {
+    let url = null, w = null;
+    const TAIL = '\nself.onmessage=function(e){try{var d=e.data;var h=self._argon2id(d.pw,d.salt,{t:d.t,m:d.m,p:d.p,dkLen:d.dkLen});self.postMessage({hash:h});}catch(err){self.postMessage({error:String(err&&err.message||err)});}};';
+    try { url = URL.createObjectURL(new Blob([ARGON2_SRC + TAIL], { type: 'text/javascript' })); w = new Worker(url); }
+    catch (_) { if (url) { try { URL.revokeObjectURL(url); } catch (e) {} } reject(new Error('vault_kdf_unavailable')); return; }
+    let settled = false;
+    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(to); try { w.terminate(); } catch (_) {} try { URL.revokeObjectURL(url); } catch (_) {} fn(arg); };
+    const to = setTimeout(() => finish(reject, new Error('vault_kdf_timeout')), 15000);
+    w.onmessage = (e) => { if (e.data && e.data.error) finish(reject, new Error('vault_kdf_error')); else finish(resolve, new Uint8Array(e.data.hash)); };
+    w.onerror = () => finish(reject, new Error('vault_kdf_error'));
+    w.postMessage({ pw: pwBytes, salt: saltBytes, t: params.t, m: params.m, p: params.p, dkLen: params.dkLen });
+  });
 }
-async function _vaultEnc(text) {
+// Argon2id is synchronous (~1.5s @ 64 MiB) — run it in a transient blob: Worker so the
+// unlock never freezes the page (the frozen CSP already allows worker-src blob:; no WASM,
+// no eval). No Worker (jsdom / very old engines) → a sync fallback uses an injected
+// globalThis._argon2id, else fails loud (Workers are already a skill-host requirement).
+function _argon2idHash(pwBytes, saltBytes, params) {
+  if (typeof Worker !== 'undefined' && typeof Blob !== 'undefined' && typeof URL !== 'undefined' && URL.createObjectURL) return _argon2idViaWorker(pwBytes, saltBytes, params);
+  if (typeof globalThis._argon2id === 'function') { try { return Promise.resolve(globalThis._argon2id(pwBytes, saltBytes, params)); } catch (_) { return Promise.reject(new Error('vault_kdf_error')); } }
+  return Promise.reject(new Error('vault_kdf_unavailable'));
+}
+// _vaultDeriveKey(passphrase, saltB64, kdfVersion=0): 0 = PBKDF2-200k (v0.8 + I13 transport
+// callers default here, byte-unchanged); 1 = Argon2id(m=64 MiB,t=3,p=4) — memory-hard (I9 §13).
+async function _vaultDeriveKey(passphrase, saltB64, kdfVersion = 0) {
+  if (kdfVersion === 0) {
+    const km = await crypto.subtle.importKey('raw', _skUtf8(passphrase), 'PBKDF2', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'PBKDF2', salt: _skFromB64(saltB64), iterations: 200000, hash: 'SHA-256' }, km, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+  }
+  if (kdfVersion === 1) {
+    const hash = await _argon2idHash(_skUtf8(passphrase), _skFromB64(saltB64), { t: 3, m: 65536, p: 4, dkLen: 32 }); // m=65536 KiB = 64 MiB
+    return crypto.subtle.importKey('raw', hash, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt']);
+  }
+  throw new Error('vault_unknown_kdf_version');
+}
+async function _encWith(key, text) {
   const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, _vaultKey, _skUtf8(text)));
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, _skUtf8(text)));
   return { iv: _skB64(iv), ct: _skB64(ct) };
 }
-async function _vaultDec(entry) {
-  return new TextDecoder().decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: _skFromB64(entry.iv) }, _vaultKey, _skFromB64(entry.ct)));
-}
-async function runtimeVaultUnlock(passphrase) {
+async function _decWith(key, entry) {
+  return new TextDecoder().decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: _skFromB64(entry.iv) }, key, _skFromB64(entry.ct)));
+}
+function _vaultEnc(text) { return _encWith(_vaultKey, text); }
+function _vaultDec(entry) { return _decWith(_vaultKey, entry); }
+// runtimeVaultUnlock(passphrase, options?:{targetKdfVersion}) — derive under the record's
+// kdf_version (0=PBKDF2, 1=Argon2id; missing→0). targetKdfVersion>current migrates the vault
+// (I9 §13): re-derive + re-encrypt check + every entry under the new KDF, committed as ONE
+// record write; _vaultKey/_vaultRec are assigned ONLY after the put resolves, so a
+// mid-migration failure leaves the vault locked and the stored record intact (Inv 42/43).
+async function runtimeVaultUnlock(passphrase, options) {
+  const opts = options || {};
   const rec = await _vaultLoadRec();
-  const key = await _vaultDeriveKey(passphrase, rec.salt);
-  _vaultKey = key;
-  if (rec.check) { try { await _vaultDec(rec.check); } catch (_) { _vaultKey = null; throw new Error('vault_bad_passphrase'); } }
-  else { rec.check = await _vaultEnc('rwa-vault-ok'); try { await idbPut(RWA.VAULT, rec); } catch (_) { _vaultKey = null; throw new Error('vault_storage_error'); } }
-  try { sessionStorage.setItem('rwa_vault_key', _skB64(new Uint8Array(await crypto.subtle.exportKey('raw', key)))); } catch (_) {}
+  const cur = (rec.kdf_version == null) ? 0 : rec.kdf_version;
+  if (cur !== 0 && cur !== 1) { _vaultKey = null; throw new Error('vault_unknown_kdf_version'); }
+  const target = opts.targetKdfVersion;
+  if (target != null && target !== 0 && target !== 1) { _vaultKey = null; throw new Error('vault_unknown_kdf_version'); }
+  if (rec.check == null) {
+    // new / empty vault: adopt the latest KDF (default v1) — covers new-vault-default AND
+    // auto-migrate-on-empty (no data at risk); an explicit target wins.
+    const useVer = (target != null) ? target : 1;
+    const key = await _vaultDeriveKey(passphrase, rec.salt, useVer);
+    rec.kdf_version = useVer;
+    rec.check = await _encWith(key, 'rwa-vault-ok');
+    try { await idbPut(RWA.VAULT, rec); } catch (_) { _vaultKey = null; throw new Error('vault_storage_error'); }
+    _vaultKey = key;
+    try { sessionStorage.setItem('rwa_vault_key', _skB64(new Uint8Array(await crypto.subtle.exportKey('raw', key)))); } catch (_) {}
+    return true;
+  }
+  const oldKey = await _vaultDeriveKey(passphrase, rec.salt, cur);
+  try { await _decWith(oldKey, rec.check); } catch (_) { _vaultKey = null; throw new Error('vault_bad_passphrase'); }
+  if (target != null && target > cur) {
+    const newKey = await _vaultDeriveKey(passphrase, rec.salt, target);
+    const next = { salt: rec.salt, kdf_version: target, check: await _encWith(newKey, 'rwa-vault-ok'), entries: {} };
+    for (const k of Object.keys(rec.entries)) next.entries[k] = await _encWith(newKey, await _decWith(oldKey, rec.entries[k]));
+    try { await idbPut(RWA.VAULT, next); } catch (_) { _vaultKey = null; throw new Error('vault_storage_error'); }
+    _vaultRec = next; _vaultKey = newKey;
+    try { sessionStorage.setItem('rwa_vault_key', _skB64(new Uint8Array(await crypto.subtle.exportKey('raw', newKey)))); } catch (_) {}
+    return true;
+  }
+  _vaultKey = oldKey;
+  try { sessionStorage.setItem('rwa_vault_key', _skB64(new Uint8Array(await crypto.subtle.exportKey('raw', oldKey)))); } catch (_) {}
   return true;
 }
 async function _vaultReimportSession() {
@@ -6766,6 +7373,64 @@ async function runtimeVaultNamespaces() {
   for (const k of Object.keys(rec.entries)) { const i = k.indexOf('\0'); if (i > 0) set.add(k.slice(0, i)); }
   return Array.from(set);
 }
+// ── I13 (v0.9 §14) — portable vault EXPORT/IMPORT (offline; escrow + account service deferred to
+// v1). A version-tagged, self-contained `rwa-vault-export/1` file: selected namespaces re-encrypted
+// under a SEPARATE transport passphrase (PBKDF2-200k + AES-256-GCM, per-namespace salt + check), so
+// it decrypts on another machine with only the passphrase — no server. The machine-local vault stays
+// the default; this travels ONLY on an explicit user action. Requires the vault unlocked (to read
+// plaintext to re-wrap). Never logs the passphrase. CLI/Worker have no access (UI/runtime action only).
+async function runtimeVaultExport(passphrase, namespaces) {
+  if (!_vaultKey) throw new Error('vault_locked');
+  if (!passphrase) throw new Error('vault_bad_passphrase');
+  const rec = await _vaultLoadRec();
+  const allNs = await runtimeVaultNamespaces();
+  const sel = (Array.isArray(namespaces) && namespaces.length) ? namespaces.filter(n => allNs.includes(n)) : allNs;
+  const out = { rwa: 'rwa-vault-export/1', containerUuid: DOC_UUID, exportedAt: Date.now(), namespaces: sel, entries: {} };
+  for (const ns of sel) {
+    const salt = _skB64(crypto.getRandomValues(new Uint8Array(16)));
+    const ekey = await _vaultDeriveKey(passphrase, salt);
+    const enc = async (text) => { const iv = crypto.getRandomValues(new Uint8Array(12)); const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, ekey, _skUtf8(text))); return { iv: _skB64(iv), ct: _skB64(ct) }; };
+    const items = [];
+    for (const k of Object.keys(rec.entries)) {
+      const i = k.indexOf('\0'); if (i <= 0 || k.slice(0, i) !== ns) continue;
+      const plain = await _vaultDec(rec.entries[k]); // decrypt under the LOCAL vault key…
+      items.push(Object.assign({ key: k.slice(i + 1) }, await enc(plain))); // …re-encrypt under the export key
+    }
+    out.entries[ns] = { salt, check: await enc('rwa-vault-export-ok'), items };
+  }
+  return out;
+}
+async function runtimeVaultImport(exportObj, passphrase, opts) {
+  opts = opts || {};
+  if (!_vaultKey) throw new Error('vault_locked'); // need the local key to re-wrap imported items
+  if (!exportObj || exportObj.rwa !== 'rwa-vault-export/1' || !exportObj.entries || typeof exportObj.entries !== 'object') throw new Error('account_export_malformed');
+  const rec = await _vaultLoadRec();
+  const result = { imported: 0, skipped: 0, namespaces: [], containerMismatch: exportObj.containerUuid !== DOC_UUID };
+  for (const ns of Object.keys(exportObj.entries)) {
+    const e = exportObj.entries[ns];
+    if (!e || typeof e.salt !== 'string' || !Array.isArray(e.items)) throw new Error('account_export_malformed');
+    const ekey = await _vaultDeriveKey(passphrase, e.salt);
+    const dec = async (entry) => new TextDecoder().decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: _skFromB64(entry.iv) }, ekey, _skFromB64(entry.ct)));
+    if (e.check) { try { await dec(e.check); } catch (_) { throw new Error('vault_decrypt_failed'); } } // wrong passphrase fails here, before any write
+    for (const it of e.items) {
+      let plain; try { plain = await dec(it); } catch (_) { throw new Error('vault_decrypt_failed'); }
+      const dk = ns + '\0' + it.key;
+      if (rec.entries[dk] && !opts.overwrite) { result.skipped++; continue; } // don't clobber without explicit overwrite
+      rec.entries[dk] = await _vaultEnc(plain); // re-encrypt under the LOCAL vault key (usable immediately)
+      result.imported++;
+    }
+    result.namespaces.push(ns);
+  }
+  try { await idbPut(RWA.VAULT, rec); } catch (_) { throw new Error('vault_storage_error'); }
+  return result;
+}
+// I13 — live-only account identity (opt-in, sessionStorage rwa_account; default null). Never stamped
+// into the file; never exposed to skill code (UI/describe only). Escrow/account-service deferred to v1.
+function runtimeAccountIdentity() {
+  let raw = null; try { raw = sessionStorage.getItem('rwa_account'); } catch (_) { return null; }
+  if (!raw) return null;
+  try { const a = JSON.parse(raw); return a && a.mode ? { mode: a.mode, accountId: a.accountId || null, lastSync: a.lastSync || null } : null; } catch (_) { return null; }
+}
 // §6 — the bridge's per-call vault gate (mirror of cli/src/skill-manifest.mjs vaultNamespaceAllowed).
 function _skVaultAllowed(skill, ns) {
   const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
@@ -6776,6 +7441,9 @@ function _skBusAllowed(skill, topic) {
   const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
   return perms.indexOf('bus:' + topic) !== -1;
 }
+// §5 (I1b) — per-message subscribe filter. true for all today; I12 wires a peer-allowlist here
+// (defense-in-depth — a declared bus: perm can't be further runtime-restricted; Shape B holds).
+function _skBusMessageAllowed(_skill, _envelope) { return true; }
 // §6 (I3) — the bridge's per-call fs gate: the (already traversal-checked) path must fall under
 // a declared fsa:<scope> subtree (left-anchored prefix, no wildcards).
 function _skFsAllowed(skill, path) {
@@ -6955,6 +7623,13 @@ function _skValidateInstall(skill, vr) {
   if (skill.kind === 'compute' && perms.length > 0) errors.push('compute_with_permissions');
   // §9 (I8): a hook is compute-only — only hook:<event> perms; any other tier → compute_with_permissions.
   if (skill.kind === 'hook' && perms.some(p => { try { return _skParsePermission(p).tier !== 'hook'; } catch (_) { return false; } })) errors.push('compute_with_permissions');
+  // §8 (I7): view/edit-surface are zero-capability DOM authors — reject any permission + require a
+  // matching typed output contract (view → html-render, edit-surface → dom-transform).
+  if (skill.kind === 'view' || skill.kind === 'edit-surface') {
+    if (perms.length > 0) errors.push('output_skill_with_permissions');
+    const want = skill.kind === 'view' ? 'html-render' : 'dom-transform';
+    if (!skill.output || skill.output.kind !== want) errors.push('invalid_output_kind');
+  }
   if (!vr.signed && perms.length > 0) errors.push('unsigned_with_permissions');
   // Tools AND hooks carry capability (a hook runs autonomously) → must be signed+verified.
   if ((skill.kind === 'tool' || skill.kind === 'hook') && !vr.verified) errors.push('unsigned_capability');
@@ -7004,6 +7679,8 @@ async function runtimeReviewSkill(envelope) {
   } catch (_) { /* a malformed name/id can't match an install → treat as fresh; gates reject it downstream */ }
   // I5 — per-author name_history: surface a same-key rename so identity reads across name changes.
   const nameInfo = await _skNameChange(skill.author_pubkey, skill.name);
+  // I6 — TOFU author identity (fingerprint + per-author install count) for the install dialog.
+  const tofu = await _skTofu(skill.author_pubkey);
   return {
     name: skill.name, version: skill.version, kind: skill.kind,
     purpose: skill.description || '(no description provided)',
@@ -7011,7 +7688,7 @@ async function runtimeReviewSkill(envelope) {
     permissions: perms.map(p => ({ perm: p, prose: _skPermProse(p) })),
     compoundRisk: _skCompoundRisk(perms), scanNotes: _skCapabilityScan(skill.code),
     lookalike, lookalikeKind, lookalikeBlock,
-    priorNames: nameInfo.priorNames, nameChange: nameInfo.nameChange,
+    priorNames: nameInfo.priorNames, nameChange: nameInfo.nameChange, tofu,
     gates: _skValidateInstall(skill, vr), update,
   };
 }
@@ -7070,6 +7747,7 @@ async function runtimeInstallSkill(envelope) {
   // I5 — record this (key, name) in the per-author name_history (best-effort; never fails the
   // install). On a same-key rename the new name is appended; identity stays anchored on the key.
   await _skSourceRecord(skill.author_pubkey, skill.name);
+  _skEvictPool(id); // I2 — an install/update may change the code → drop any stale pooled Workers
   return { ok: true, skillId: id };
 }
 // §7 — remove a skill + persist the emptied/updated zone (same rollback discipline).
@@ -7077,6 +7755,7 @@ async function runtimeUninstallSkill(skillId) {
   const prev = installedSkills.get(skillId);
   if (!prev) return { ok: false, errors: ['not_installed'] };
   installedSkills.delete(skillId);
+  _skEvictPool(skillId); // I2 — drop any pooled Workers for the removed skill
   try {
     await runtimeRegionCommit({ regions: [_skSkillsRegion()], actor: 'skill:uninstall', reachability: 'frozen' });
   } catch (e) {
@@ -7253,6 +7932,8 @@ function showSkillInstallDialog(envelope) {
       '<h2 style="margin:0 0 .2em;font-size:1.25rem">Install ' + _skEsc(rv.name) + '?</h2>' +
       '<p style="margin:.2em 0 1em;color:#444"><strong>What it claims to do:</strong> ' + _skEsc(rv.purpose) + '</p>' +
       '<p style="margin:.2em 0"><strong>Author.</strong> ' + authorHtml + '</p>' +
+      // I6 — TOFU author identity: the key fingerprint + whether you've installed from this author before.
+      (rv.tofu ? '<p style="margin:.2em 0;color:#555">🔑 Author fingerprint: <code>' + _skEsc(rv.tofu.fingerprint) + '</code>. ' + (rv.tofu.firstTime ? 'First time seeing this author.' : 'Trusted — ' + rv.tofu.installs + ' previous install' + (rv.tofu.installs === 1 ? '' : 's') + '.') + '</p>' : '') +
       lookalikeHtml +
       nameChangeHtml +
       updHtml +
@@ -7346,13 +8027,13 @@ const SKILL_WORKER_PROLOGUE = `(function(){
   'use strict';
   var REMOVE = ['importScripts','Worker','SharedWorker','ServiceWorkerContainer','XMLHttpRequest','WebSocket','EventSource','indexedDB','eval','Function','fetch','WebAssembly'];
   for (var i=0;i<REMOVE.length;i++){ try { Object.defineProperty(self, REMOVE[i], { value: undefined, writable: false, configurable: false }); } catch(_e){} }
-  var IDENTITY=null, BRIDGED=false, _seq=0, _pending=new Map(), RUNTIME={};
+  var IDENTITY=null, BRIDGED=false, _seq=0, _pending=new Map(), RUNTIME={}, _subs={};
   function _bridge(type, payload){ return new Promise(function(res,rej){ var id=++_seq; _pending.set(id,{res:res,rej:rej}); self.postMessage({ type:type, id:id, identity_tag:IDENTITY, payload:payload }); }); }
   function _serializeOpts(o){ if(!o||typeof o!=='object') return undefined; var out={}; if(o.method) out.method=String(o.method); if(typeof o.body==='string') out.body=o.body; if(o.headers&&typeof o.headers==='object') out.headers=o.headers; return out; }
   function _installBridge(){
     RUNTIME.fetch=function(url,opts){ return _bridge('bridge:fetch',{ url:String(url), opts:_serializeOpts(opts) }); };
     RUNTIME.vault={ get:function(ns,k){ return _bridge('bridge:vault',{op:'get',ns:ns,key:k}); }, set:function(ns,k,v){ return _bridge('bridge:vault',{op:'set',ns:ns,key:k,val:v}); }, has:function(ns,k){ return _bridge('bridge:vault',{op:'has',ns:ns,key:k}); } };
-    RUNTIME.bus={ publish:function(topic,message){ return _bridge('bridge:bus:publish',{ topic:String(topic), message:message }); } };
+    RUNTIME.bus={ publish:function(topic,message){ return _bridge('bridge:bus:publish',{ topic:String(topic), message:message }); }, subscribe:function(topic,cb){ var t=String(topic); return _bridge('bridge:bus:subscribe',{ topic:t }).then(function(){ (_subs[t]=_subs[t]||[]).push(cb); return function(){ var a=_subs[t]||[], i=a.indexOf(cb); if(i>=0) a.splice(i,1); try{ _bridge('bridge:bus:unsubscribe',{ topic:t }); }catch(_e){} }; }); } };
     RUNTIME.fs={ read:function(p){ return _bridge('bridge:fs',{op:'read',path:String(p)}); }, write:function(p,d){ return _bridge('bridge:fs',{op:'write',path:String(p),data:d}); }, del:function(p){ return _bridge('bridge:fs',{op:'del',path:String(p)}); }, list:function(p){ return _bridge('bridge:fs',{op:'list',path:String(p)}); } };
     RUNTIME.db={ get:function(s,k){ return _bridge('bridge:idb',{op:'get',store:String(s),key:k}); }, put:function(s,k,v){ return _bridge('bridge:idb',{op:'put',store:String(s),key:k,value:v}); }, del:function(s,k){ return _bridge('bridge:idb',{op:'del',store:String(s),key:k}); }, all:function(s){ return _bridge('bridge:idb',{op:'all',store:String(s)}); } };
   }
@@ -7366,10 +8047,85 @@ const SKILL_WORKER_PROLOGUE = `(function(){
         .catch(function(err){ self.postMessage({ type:'result', id:msg.id, identity_tag:IDENTITY, ok:false, error:String(err&&err.message||err) }); });
       return;
     }
+    if(msg.type==='bus:message'){ var env=msg.envelope||{}, subs=_subs[env.topic]||[]; for(var i=0;i<subs.length;i++){ try{ subs[i](env); }catch(_e){} } return; } // I1b — deliver to skill-side subscribers
+    if(msg.type==='shutdown'){ try{ self.postMessage({ type:'shutdown_ack', identity_tag:null }); }catch(_e){} return; } // I2 — pool drain handshake
   };
 })();
 `;
 
+// ── I2 (v0.9 §10) — optional compute-Worker POOL. DISABLED BY DEFAULT: only an explicit
+// poolingHint {pooling:'enabled'} on a COMPUTE skill (no role) takes this path; every other invoke
+// (tools, agent-role, no-hint) rides the byte-unchanged spawn→invoke→terminate path below. Pooled
+// Workers are compute-only (bridgeless, same worker-scoped CSP), keyed by skillId+code-hash (a code
+// change evicts the pool), bounded by an idle timeout + a hard cap, and drained on shutdown. Per-
+// invocation isolation is unchanged: each invoke re-inits a fresh identity_tag and races the 5s
+// timeout; a timeout/error terminates the Worker (never returns it to the pool). Statelessness is
+// the author's responsibility (Inv 25; no global reset between invokes — documented "pool only if pure").
+const SKILL_POOLS = new Map(); // skillId → { codeHash, idle:[Worker], lastUsed:Map<Worker,ts> }
+const SKILL_POOL_CAP = Math.min(4, (typeof navigator !== 'undefined' && navigator.hardwareConcurrency) || 1);
+let SKILL_POOL_IDLE_MS = 60000; // mutable so the browser proof can shorten it
+async function _skCodeHash(skillId, code) {
+  return _skB64url(await _skSha256(_skConcat(_skUtf8(String(skillId)), _skNUL, _skUtf8(String(code || '')))));
+}
+function _skSpawnComputeWorker(skill) {
+  const blob = new Blob([SKILL_WORKER_PROLOGUE + '\n' + String(skill.code || '')], { type: 'text/javascript' });
+  const url = URL.createObjectURL(blob);
+  const w = new Worker(url); w.__rwaUrl = url; return w;
+}
+function _skKillWorker(w) { try { w.terminate(); } catch (_) {} try { URL.revokeObjectURL(w.__rwaUrl); } catch (_) {} }
+function _skEnforcePoolCap(pool) {
+  while (pool.idle.length > SKILL_POOL_CAP) {
+    let oi = 0; for (let i = 1; i < pool.idle.length; i++) if ((pool.lastUsed.get(pool.idle[i]) || 0) < (pool.lastUsed.get(pool.idle[oi]) || 0)) oi = i;
+    const [w] = pool.idle.splice(oi, 1); pool.lastUsed.delete(w); _skKillWorker(w); // evict oldest-idle
+  }
+}
+function _skEvictPool(skillId) { // code-hash may change on install/update/uninstall → drop stale Workers
+  const pool = SKILL_POOLS.get(skillId);
+  if (pool) { pool.idle.forEach(_skKillWorker); SKILL_POOLS.delete(skillId); }
+}
+function _skPoolEvictIdle() { // background sweep: terminate Workers idle ≥ SKILL_POOL_IDLE_MS
+  const now = Date.now();
+  for (const pool of SKILL_POOLS.values())
+    pool.idle = pool.idle.filter(w => { if (now - (pool.lastUsed.get(w) || 0) >= SKILL_POOL_IDLE_MS) { pool.lastUsed.delete(w); _skKillWorker(w); return false; } return true; });
+}
+async function _skPoolShutdown() { // send shutdown, 500ms grace, terminate (idempotent)
+  const all = [];
+  for (const pool of SKILL_POOLS.values()) for (const w of pool.idle) all.push(w);
+  for (const w of all) { try { w.postMessage({ type: 'shutdown', identity_tag: null }); } catch (_) {} }
+  await new Promise(r => setTimeout(r, 500));
+  for (const w of all) _skKillWorker(w);
+  SKILL_POOLS.clear();
+}
+function runtimePoolStats() {
+  const pools = {}; let live = 0;
+  for (const [id, pool] of SKILL_POOLS) { pools[id] = pool.idle.length; live += pool.idle.length; }
+  return { live, cap: SKILL_POOL_CAP, idleMs: SKILL_POOL_IDLE_MS, pools };
+}
+// Run ONE invocation on a pooled compute Worker (reuse-or-spawn). Success → return to pool; timeout
+// or error → terminate (never pool). Compute skills have no bridge, so a pooled Worker only ever
+// emits `result` — the onmessage here is the full message contract for the pooled path.
+async function _skPooledInvoke(skillId, skill, input) {
+  const codeHash = await _skCodeHash(skillId, skill.code);
+  let pool = SKILL_POOLS.get(skillId);
+  if (pool && pool.codeHash !== codeHash) { _skEvictPool(skillId); pool = null; }
+  if (!pool) { pool = { codeHash, idle: [], lastUsed: new Map() }; SKILL_POOLS.set(skillId, pool); }
+  const w = pool.idle.pop() || _skSpawnComputeWorker(skill);
+  const tag = crypto.randomUUID();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn, arg, keep) => {
+      if (settled) return; settled = true; clearTimeout(timer); w.onmessage = null; w.onerror = null;
+      if (keep) { pool.lastUsed.set(w, Date.now()); pool.idle.push(w); _skEnforcePoolCap(pool); }
+      else { pool.lastUsed.delete(w); _skKillWorker(w); }
+      fn(arg);
+    };
+    const timer = setTimeout(() => done(reject, new Error('timeout'), false), 5000); // per-invocation, not per-tenure
+    w.onmessage = (e) => { const m = e.data; if (!m || m.identity_tag !== tag) return; if (m.type === 'result') m.ok ? done(resolve, m.result, true) : done(reject, new Error(m.error || 'runtime_error'), false); };
+    w.onerror = () => done(reject, new Error('runtime_error'), false);
+    w.postMessage({ type: 'init', identity_tag: tag, bridged: false }); // re-init each invoke: fresh tag, never bridged
+    w.postMessage({ type: 'invoke', id: 1, input });
+  });
+}
 // §5a — invoke an installed skill in an isolated Worker. compute = bridgeless; tool =
 // bridged fetch/vault with per-call origin/namespace enforcement on THIS (main) thread.
 // Per-invocation identity_tag binds responses; 5s timeout; spawn -> invoke -> terminate.
@@ -7397,6 +8153,9 @@ function runtimeInvokeSkill(skillId, input, opts) {
   // skills (which never passed through runtimeInstallSkill's gate), every kind.
   const forbidden = _skCodeForbidden(skill.code);
   if (forbidden) return Promise.reject(new Error(forbidden));
+  // I2 — opt-in compute-Worker pool. Only a compute skill with an explicit pooling hint and no
+  // agent-role takes the warm path; everything else falls through to the byte-unchanged fresh spawn.
+  if (opts && opts.pooling === 'enabled' && skill.kind === 'compute' && !agentRole) return _skPooledInvoke(skillId, skill, input);
   const identity_tag = crypto.randomUUID();
   const blob = new Blob([SKILL_WORKER_PROLOGUE + '\n' + String(skill.code || '')], { type: 'text/javascript' });
   const url = URL.createObjectURL(blob);
@@ -7405,8 +8164,9 @@ function runtimeInvokeSkill(skillId, input, opts) {
   // F6: cancel an in-flight bridge fetch when the 5s timeout (or any settle)
   // fires, so a slow request doesn't keep running after the skill is finished.
   const _skAc = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+  const busSubs = []; // I1b — active bus subscriptions for THIS invoke; torn down on settle
   return new Promise((resolve, reject) => {
-    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(timer); if (_skAc) { try { _skAc.abort(); } catch (_) {} } try { w.terminate(); } catch (_) {} URL.revokeObjectURL(url); fn(arg); };
+    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(timer); if (_skAc) { try { _skAc.abort(); } catch (_) {} } for (const u of busSubs) { try { u(); } catch (_) {} } try { w.terminate(); } catch (_) {} URL.revokeObjectURL(url); fn(arg); };
     const timer = setTimeout(() => finish(reject, new Error('timeout')), 5000);
     const reply = (id, ok, extra) => w.postMessage(Object.assign({ type: 'bridge:response', id, identity_tag, ok }, extra));
     w.onmessage = async (e) => {
@@ -7451,6 +8211,22 @@ function runtimeInvokeSkill(skillId, input, opts) {
         catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
         return;
       }
+      if (msg.type === 'bridge:bus:subscribe') {
+        const pl = msg.payload || {};
+        if (!_skBusAllowed(skill, pl.topic)) { reply(msg.id, false, { error: 'bus_topic_denied' }); return; } // §5 per-call gate
+        // I1b — forward each allowed envelope to the Worker until it settles (finish() tears these
+        // down). The 5s timeout bounds the subscribe CALL (the ok reply), not the subscription.
+        try {
+          const unsub = runtimeBusSubscribe(pl.topic, (env) => {
+            if (!_skBusMessageAllowed(skill, env)) return;
+            try { w.postMessage({ type: 'bus:message', id: msg.id, identity_tag, envelope: { topic: env.topic, from: env.from, at: env.at, message: env.message } }); } catch (_) {}
+          });
+          busSubs.push(unsub);
+          reply(msg.id, true, { result: true });
+        } catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
+        return;
+      }
+      if (msg.type === 'bridge:bus:unsubscribe') { reply(msg.id, true, { result: true }); return; } // MVP: precise teardown deferred; finish() unsubscribes all on settle
       if (msg.type === 'bridge:fs') {
         const pl = msg.payload || {}, op = pl.op, p = pl.path;
         // Reject traversal/invalid paths BEFORE the scope check (mirror of assertUserFsPath); a
@@ -7558,6 +8334,9 @@ function runtimeDescribe() {
     // undo-only — there is no redo (re-write-able-spec Invariant 7).
     baseline: { edit: ['lens'], tools: ['apply_dsl_plan', 'apply_edits', 'replace_document'], export: ['html', 'print'], history: ['undo'] },
     activeView: activeView ? activeView.name : null,
+    // I13 (v0.9 §14) — opt-in account identity, LIVE-only (never stamped into the file). null unless
+    // the user linked an account this session (sessionStorage rwa_account); machine-local is the default.
+    accountIdentity: runtimeAccountIdentity(),
   };
 }
 
@@ -8741,12 +9520,16 @@ document.addEventListener('keydown', e => {
       describe: runtimeDescribe, // rwa-identity/1 — what this container is + can do
       listSkills: runtimeListSkills, // v0.8 §8 — installed skills (provenance:'installed')
       invokeSkill: runtimeInvokeSkill, // v0.8 §5a — run a skill in an isolated Worker
+      invokeEditSurface: runtimeInvokeEditSurface, // v0.9 §8 (I7) — run an edit-surface skill → apply its rwa-edit/1 transform
+      poolStats: runtimePoolStats, // v0.9 §10 (I2) — compute-Worker pool observability {live,cap,idleMs,pools}
       reviewSkill: runtimeReviewSkill, // v0.8 §1 — structured trust info for the install dialog
       installSkill: runtimeInstallSkill, // v0.8 §1/§7 — gates + verify + register + persist to the frozen zone (survives reload)
       uninstallSkill: runtimeUninstallSkill, // v0.8 §7 — remove + persist
       showInstallDialog: showSkillInstallDialog, // v0.8 §1 — render the consent dialog for an envelope → resolves with the choice
       promptInstall: runtimePromptInstall, // v0.8 §1.3 — pick a .rwa-skill.json → show the dialog
-      vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked }, // v0.8 §6
+      discoverSkills: runtimeDiscoverSkills, // v0.9 §11 (I6) — GET the marketplace index (opt-in network)
+      fetchSkillFromIndex: runtimeFetchSkillFromIndex, // v0.9 §11 (I6) — fetch + client-side-verify an indexed skill
+      vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked, export: runtimeVaultExport, import: runtimeVaultImport }, // v0.8 §6 + v0.9 §14 (I13) portable export/import
       agents: { list: runtimeListAgents, active: runtimeAgentActive, setActive: runtimeSetActiveAgent, install: runtimeInstallAgent, uninstall: runtimeUninstallAgent, message: runtimeAgentMessage, showInstallDialog: showAgentInstallDialog }, // v0.9 §12 — multi-agent roles
       hookLog: runtimeHookLog, // v0.9 §9 — the hook audit trail (rwa_hook_log)
     };
@@ -8764,6 +9547,10 @@ document.addEventListener('keydown', e => {
       configurable: false,
     });
     startWorkspacePresence();
+    // I2 (v0.9 §10) — background idle eviction (every 30s, terminate compute Workers idle ≥ idleMs)
+    // + drain the pool on unload (shutdown handshake + 500ms grace). No-op until a pooled invoke runs.
+    setInterval(_skPoolEvictIdle, 30000);
+    window.addEventListener('pagehide', () => { _skPoolShutdown(); });
     // §5.10: the presentation render mode ships ONLY for presentation
     // containers. For every other kind this block is skipped entirely —
     // activeView stays null, no provider is registered, no chrome is built,