Merge pull request 'Release candidate: dev c6fb57d9 into main' (#146) from dev into main

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.eslintrc.cjs

@@ -1,3 +1,8 @@
+// Airbnb's own bans, kept: a `no-restricted-syntax` entry below replaces the whole list.
+const airbnbRestrictedSyntax = require('eslint-config-airbnb-base/rules/style').rules[
+  'no-restricted-syntax'
+];
+
 module.exports = {
   env: {
     browser: true,
@@ -62,6 +67,21 @@ module.exports = {
     "@typescript-eslint/no-shadow": "error"
   },
   overrides: [
+    {
+      // The one join path: a join is `joinEstateRoom`, which files the DM before it sends the join.
+      files: ['src/**/*.ts', 'src/**/*.tsx'],
+      excludedFiles: ['src/app/features/estate/joinEstateRoom.ts', 'src/**/*.test.*'],
+      rules: {
+        'no-restricted-syntax': [
+          ...airbnbRestrictedSyntax,
+          {
+            selector: "CallExpression[callee.property.name='joinRoom']",
+            message:
+              'Join a room through joinEstateRoom (features/estate/joinEstateRoom.ts), the one join path.',
+          },
+        ],
+      },
+    },
     {
       files: ['*.ts'],
       rules: {

.github/workflows/build-pull-request.yml

@@ -4,12 +4,14 @@ on:
   pull_request:
     types: ['opened', 'synchronize']
 
+concurrency:
+  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   build-pull-request:
     name: Build pull request
     runs-on: ubuntu-latest
-    env:
-      PR_NUMBER: ${{github.event.number}}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -24,17 +26,3 @@ jobs:
         env:
           NODE_OPTIONS: '--max_old_space_size=4096'
         run: npm run build
-      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: preview
-          path: dist
-          retention-days: 1
-      - name: Save pr number
-        run: echo ${PR_NUMBER} > ./pr.txt
-      - name: Upload pr number
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: pr
-          path: ./pr.txt
-          retention-days: 1

.github/workflows/cla.yml

@@ -1,36 +0,0 @@
-name: 'CLA Assistant'
-on:
-  issue_comment:
-    types: [created]
-  pull_request_target:
-    types: [opened, closed, synchronize]
-
-jobs:
-  CLAssistant:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'CLA Assistant'
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        # Beta Release
-        uses: cla-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # the below token should have repo scope and must be manually added by you in the repository's secret
-          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_PAT }}
-        with:
-          path-to-signatures: 'signatures.json'
-          path-to-document: 'https://github.com/cinnyapp/cla/blob/main/cla.md' # e.g. a CLA or a DCO document
-          # branch should not be protected
-          branch: 'main'
-          allowlist: ajbura,bot*
-
-          #below are the optional inputs - If the optional inputs are not given, then default values will be taken
-          remote-organization-name: cinnyapp
-          remote-repository-name: cla
-          #create-file-commit-message: 'For example: Creating file for storing CLA Signatures'
-          #signed-commit-message: 'For example: $contributorName has signed the CLA in #$pullRequestNo'
-          #custom-notsigned-prcomment: 'pull request comment with Introductory message to ask new contributors to sign'
-          #custom-pr-sign-comment: 'The signature to be committed in order to sign the CLA'
-          #custom-allsigned-prcomment: 'pull request comment when all contributors has signed, defaults to **CLA Assistant Lite bot** All Contributors have signed the CLA.'
-          #lock-pullrequest-aftermerge: false - if you don't want this bot to automatically lock the pull request after merging (default - true)
-          #use-dco-flag: true - If you are using DCO instead of CLA

.github/workflows/deploy-pull-request.yml

@@ -1,60 +0,0 @@
-name: Deploy PR to Netlify
-run-name: "Deploy PR to Netlify (${{ github.event.workflow_run.head_branch }})"
-
-on:
-  workflow_run:
-      workflows: ["Build pull request"]
-      types: [completed]
-
-jobs:
-  deploy-pull-request:
-    name: Deploy pull request
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    steps:
-      - name: Download pr number
-        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
-        with:
-          workflow: ${{ github.event.workflow.id }}
-          run_id: ${{ github.event.workflow_run.id }}
-          name: pr
-      - name: Validate and output pr number
-        id: pr
-        run: |
-          PR_ID=$(<pr.txt)
-          if ! [[ "${PR_ID}" =~ ^[0-9]+$ ]]; then
-            echo "::error::pr.txt contains non-numeric content: ${PR_ID}"
-            exit 1
-          fi
-          echo "id=${PR_ID}" >> "${GITHUB_OUTPUT}"
-      - name: Download artifact
-        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
-        with:
-          workflow: ${{ github.event.workflow.id }}
-          run_id: ${{ github.event.workflow_run.id }}
-          name: preview
-          path: dist
-      - name: Deploy to Netlify
-        id: netlify
-        uses: nwtgck/actions-netlify@d22a32a27c918fe470bbc562e984f80ec48c2668 # v4.0.0
-        with:
-          publish-dir: dist
-          deploy-message: "Deploy PR ${{ steps.pr.outputs.id }}"
-          alias: ${{ steps.pr.outputs.id }}
-          # These don't work because we're in workflow_run
-          enable-pull-request-comment: false
-          enable-commit-comment: false
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN_PR }}
-          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID_PR_CINNY }}
-        timeout-minutes: 1
-      - name: Comment preview on PR
-        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
-        with:
-          number: ${{ steps.pr.outputs.id }}
-          message: |
-            Preview: ${{ steps.netlify.outputs.deploy-url }}
-            ⚠️ Exercise caution. Use test accounts. ⚠️

.github/workflows/docker-pr.yml

@@ -5,7 +5,10 @@ on:
     paths:
       - 'Dockerfile'
       - '.github/workflows/docker-pr.yml'
-      - '.github/workflows/prod-deploy.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   docker-build:

.github/workflows/lockfile.yml

@@ -5,6 +5,10 @@ on:
     paths:
       - 'package-lock.json'
 
+concurrency:
+  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   lockfile_changes:
     runs-on: ubuntu-latest

.github/workflows/netlify-dev.yml

@@ -1,39 +0,0 @@
-name: Deploy to Netlify (dev)
-
-on:
-  push:
-    branches:
-      - dev
-
-jobs:
-  deploy-to-netlify:
-    name: Deploy to Netlify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Setup node
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: ".node-version"
-          package-manager-cache: false
-      - name: Install dependencies
-        run: npm ci
-      - name: Build app
-        env:
-          NODE_OPTIONS: '--max_old_space_size=4096'
-        run: npm run build
-      - name: Deploy to Netlify
-        uses: nwtgck/actions-netlify@d22a32a27c918fe470bbc562e984f80ec48c2668 # v4.0.0
-        with:
-          publish-dir: dist
-          deploy-message: 'Dev deploy ${{ github.sha }}'
-          enable-commit-comment: false
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          production-deploy: true
-          github-deployment-environment: nightly
-          github-deployment-description: 'Nightly deployment on each commit to dev branch'
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID_DEV }}
-        timeout-minutes: 1

.github/workflows/pr-title.yml

@@ -1,15 +0,0 @@
-name: Check PR title
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - edited
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/prod-deploy.yml

@@ -1,100 +0,0 @@
-name: Production deploy
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  deploy-and-tarball:
-    name: Netlify deploy and tarball
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Setup node
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: '.node-version'
-          package-manager-cache: false
-      - name: Install dependencies
-        run: npm ci
-      - name: Build app
-        env:
-          NODE_OPTIONS: '--max_old_space_size=4096'
-        run: npm run build
-      - name: Deploy to Netlify
-        uses: nwtgck/actions-netlify@d22a32a27c918fe470bbc562e984f80ec48c2668 # v4.0.0
-        with:
-          publish-dir: dist
-          deploy-message: 'Prod deploy ${{ github.ref_name }}'
-          enable-commit-comment: false
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          production-deploy: true
-          github-deployment-environment: stable
-          github-deployment-description: 'Stable deployment on each release'
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID_APP }}
-        timeout-minutes: 1
-      - name: Get version from tag
-        id: vars
-        run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
-      - name: Create tar.gz
-        run: tar -czvf cinny-${{ steps.vars.outputs.tag }}.tar.gz dist
-      - name: Sign tar.gz
-        run: |
-          echo '${{ secrets.GNUPG_KEY }}' | gpg --batch --import
-          # Sadly a few lines in the private key match a few lines in the public key,
-          # As a result just --export --armor gives us a few lines replaced with ***
-          # making it useless for importing the signing key. Instead, we dump it as
-          # non-armored and hex-encode it so that its printable.
-          echo "PGP Signing key, in raw PGP format in hex. Import with cat ... | xxd -r -p - | gpg --import"
-          gpg --export | xxd -p
-          echo '${{ secrets.GNUPG_PASSPHRASE }}' | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 --armor --detach-sign cinny-${{ steps.vars.outputs.tag }}.tar.gz
-      - name: Upload tagged release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
-        with:
-          tag_name: ${{ github.ref_name }}
-          files: |
-            cinny-${{ steps.vars.outputs.tag }}.tar.gz
-            cinny-${{ steps.vars.outputs.tag }}.tar.gz.asc
-
-  publish-image:
-    name: Push Docker image to Docker Hub, GHCR
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
-      - name: Login to Docker Hub #Do not update this action from a outside PR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to the Github Container registry #Do not update this action from a outside PR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker, GHCR
-        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_USERNAME }}/cinny
-            ghcr.io/${{ github.repository }}
-      - name: Build and push Docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/rat-dev-preview.yml

@@ -0,0 +1,46 @@
+name: Rat dev preview
+
+on:
+  push:
+    branches: ['dev']
+
+# One run per ref wins: a newer push to dev cancels the older queued or running one, so the run
+# that builds rat-dev-dist is always the newest. Pull-request runs are other workflows and other
+# groups; they never cancel it.
+concurrency:
+  group: rat-dev-preview
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build dev preview
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: ".node-version"
+          package-manager-cache: false
+      - name: Install dependencies
+        run: npm ci
+      - name: Build app
+        env:
+          CINNY_BASE: /void/rat-dev/
+          VITE_PREVIEW_DEMO: '1'
+          NODE_OPTIONS: '--max_old_space_size=3072'
+        run: npm run build
+      - name: Set background scene tier and the pretend homeserver
+        run: node scripts/preview-config.js low --demo
+      - name: Add the demo pose art
+        run: mkdir -p dist/public/poses && cp -r preview-demo/poses/. dist/public/poses/
+      - name: Upload artifact
+        # v3 protocol: the v4 client keeps only the origin of ACTIONS_RESULTS_URL, dropping this forge's /forge subpath
+        # (nginx 404 page, runs 170-171), and upstream v4+ refuses non-GitHub servers outright (run 169).
+        uses: forgejo/upload-artifact@v3
+        with:
+          name: rat-dev-dist
+          path: dist
+          retention-days: 3

.gitignore

@@ -5,3 +5,6 @@ devAssets
 
 .DS_Store
 .idea
+# Pose art is synced from the cast-art catalogue (npm run sync:poses), not committed.
+public/poses/*
+!public/poses/.gitkeep

.prettierignore

@@ -3,3 +3,5 @@ node_modules
 package.json
 package-lock.json
 LICENSE
+harness
+src/app/components/message/pose/catalogue.json

CONTRIBUTING.md

@@ -1,8 +1,8 @@
-# Contributing to Cinny
+# Contributing to Ratatoskr
 
 First off, thanks for taking the time to contribute! ❤️
 
-This document describes the process of contributing to Cinny. It is intended
+This document describes the process of contributing to Ratatoskr. It is intended
 for anyone considering opening an **issue**, **discussion** or **pull request**.
 For people who are interested in developing Cinny and technical details behind
 it, please check out our ["Developing Cinny"](HACKING.md) document as well.
@@ -24,7 +24,7 @@ explain what your changes do and how they interact with the greater system, do n
 
 ## AI Usage
 
-The Cinny project stictly does not allow any AI generated code. Any pull request containing it will be rejected. **This is very important.**
+The Cinny project strictly does not allow any AI generated code. Any pull request containing it will be rejected. **This is very important.**
 
 ## Quick Guide
 
@@ -35,7 +35,7 @@ The Cinny project stictly does not allow any AI generated code. Any pull request
 > When contributing to this project, you must agree that you have authored 100%
 > of the content, that you have the necessary rights to the content and that
 > the content you contribute may be provided under the project license. You will
-> also be asked to [sign the CLA] ([why CLA?]) upon submiting your pull request.
+> also be asked to [sign the CLA] ([why CLA?]) upon submitting your pull request.
 
 [All issues are actionable](#issues-are-actionable). Pick one and start
 working on it. Thank you. If you need help or guidance, comment on the issue.

HACKING.md

@@ -1,4 +1,4 @@
-# Developing Cinny
+# Developing Ratatoskr
 
 > [!TIP]
 > We recommend using a version manager as versions change very quickly.
@@ -36,13 +36,13 @@ source and serves it with Nginx on port 80. To use this locally, you can
 build the container like so:
 
 ```
-docker build -t cinny:latest .
+docker build -t ratatoskr:latest .
 ```
 
 You can then run the container you've built with a command similar to this:
 
 ```
-docker run -p 8080:80 cinny:latest
+docker run -p 8080:80 ratatoskr:latest
 ```
 
 This will forward your `localhost` port 8080 to the container's port 80.

README.md

@@ -1,125 +1,43 @@
-# Cinny
+# Ratatoskr
-<p>
-    <a href="https://github.com/ajbura/cinny/releases">
-        <img alt="GitHub release downloads" src="https://img.shields.io/github/downloads/ajbura/cinny/total?logo=github&style=social"></a>
-    <a href="https://hub.docker.com/r/ajbura/cinny">
-        <img alt="DockerHub downloads" src="https://img.shields.io/docker/pulls/ajbura/cinny?logo=docker&style=social"></a>
-    <a href="https://fosstodon.org/@cinnyapp">
-        <img alt="Follow on Mastodon" src="https://img.shields.io/mastodon/follow/106845779685925461?domain=https%3A%2F%2Ffosstodon.org&logo=mastodon&style=social"></a>
-    <a href="https://twitter.com/intent/follow?screen_name=cinnyapp">
-        <img alt="Follow on Twitter" src="https://img.shields.io/twitter/follow/cinnyapp?logo=twitter&style=social"></a>
-    <a href="https://cinny.in/#sponsor">
-        <img alt="Sponsor Cinny" src="https://img.shields.io/opencollective/all/cinny?logo=opencollective&style=social"></a>
-</p>
 
-A Matrix client focusing primarily on simple, elegant and secure interface.
+GameCult's Matrix chat client, a fork of [Cinny](https://github.com/cinnyapp/cinny).
-The main goal is to have an instant messaging application that is easy on
+It opens on GameCult's estate (spaces, project rooms grouped by steward, Minds,
-people and has a modern touch.
+and your own place in it) instead of an invite list. Mobile first.
-- [Roadmap](https://github.com/orgs/cinnyapp/projects/1)
-- [Contributing](./CONTRIBUTING.md)
 
-> [!IMPORTANT] 
+**Live now:** the Cinny engine (matrix-js-sdk, Rust crypto, sync) under a
-We are currently in the process of [replacing] the matrix-js-sdk with our
+Ratatoskr UI: branding, GameCult theme, estate navigation, pose portraits
-own SDK. As a result, we will not be accepting any pull requests until
+(opt-in setting), a background scene (on in the dev config, `backgroundScene.tier`; the device can lower it) and an opt-in soundscape.
-further notice. Thank you for your understanding.
+**Planned:** see [`docs/gamecult/ratatoskr-target.md`](docs/gamecult/ratatoskr-target.md)
+for the target and cut sequence. Internal names that are protocol or stored
+state (`cinny_*` localStorage keys, the `in.cinny.room.power_level_tags` event
+type, `CINNY_BASE`) are unchanged on purpose.
 
-[replacing]: https://github.com/cinnyapp/cinny/issues/257#issuecomment-3714406704
+Entry points: `src/app/` (client UI), `src/app/features/scene/` (background
+scene), `src/app/features/soundscape/` (audio socket), `harness/` (estate
+drive scripts), `scripts/gen-brand.mjs` (regenerates the logo and icons).
 
-<img align="center" src="https://raw.githubusercontent.com/cinnyapp/cinny-site/main/assets/preview2-light.png" height="380">
+## Upstream
+Ratatoskr is based on Cinny by Ajay Bura and contributors, licensed AGPL-3.0.
+Cinny's own README, desktop app and releases live at
+<https://github.com/cinnyapp/cinny>. We do not ship its releases or images.
 
-## Getting started
+## Developing
-The web app is available at [app.cinny.in] and gets updated on each new
+See [HACKING.md](HACKING.md). Contribution notes are in [CONTRIBUTING.md](CONTRIBUTING.md).
-release. The `dev` branch is continuously deployed at [dev.cinny.in]
-but keep in mind that it could have things broken.
-
-You can also download our desktop app from the [cinny-desktop repository].
-
-[app.cinny.in]: https://app.cinny.in
-[dev.cinny.in]: https://dev.cinny.in
-[cinny-desktop repository]: https://github.com/cinnyapp/cinny-desktop 
-
-## Contributing and Developing
-
-If you have any ideas, issues, etc. regarding Cinny, or would like to
-contribute to Cinny through pull requests, please check out our
-["Contributing to Cinny"](CONTRIBUTING.md) document. Those who would like
-to get involved with Cinny's development as well should also read the
-["Developing Cinny"](HACKING.md) document for more technical details.
 
 ## Self-hosting
-To host Cinny on your own, simply download the tarball from
+Build with `npm ci && npm run build` and serve `dist/` with your webserver.
-[GitHub releases], and serve the files from `dist/` using your preferred
-webserver. Alternatively, you can just pull the docker image from
-[DockerHub] or [GitHub Container Registry].
 
 * The default homeservers and explore pages are defined in [`config.json`](config.json).
-
+* Serving the assets needs redirects to `index.html`. Examples:
-* You need to set up redirects to serve the assests. Example configurations;
+[netlify](netlify.toml), [nginx](contrib/nginx/ratatoskr.domain.tld.conf),
-[netlify](netlify.toml), [nginx](contrib/nginx/cinny.domain.tld.conf),
+[caddy](contrib/caddy/caddyfile). Without them you can
-[caddy](contrib/caddy/caddyfile).
+[enable hash routing](config.json) (`hashRouter`); URLs then carry `/#/`.
-    * If you have trouble configuring redirects you can
+* To deploy on a subdirectory, rebuild with the `base` path set, either in
-    [enable hash routing](config.json#L35) — the url in the browser will have
+[`build.config.ts`](build.config.ts) or through `CINNY_BASE`
-    a `/#/` between the domain and open channel (ie. `app.cinny.in/#/home/`
+(for example `CINNY_BASE=/app/ npm run build`).
-    instead of `app.cinny.in/home/`) but you won't have to configure your webserver.
-
-* To deploy on subdirectory, you need to rebuild the app youself after
-updating the `base` path in [`build.config.ts`](build.config.ts).
-    * For example, if you want to deploy on `https://cinny.in/app`, then
-    set `base: '/app'`.
-
-[GitHub releases]: https://github.com/cinnyapp/cinny/releases/latest
-[DockerHub]: https://hub.docker.com/r/ajbura/cinny
-[GitHub Container Registry]: https://github.com/cinnyapp/cinny/pkgs/container/cinny
-
-<details><summary><b>PGP Public Key to verify tarball</b></summary>
-
-```
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGNBGJw/g0BDAC8qQeLqDMzYzfPyOmRlHVEoguVTo+eo1aVdQH2X7OELdjjBlyj
-6d6c1adv/uF2g83NNMoQY7GEeHjRnXE4m8kYSaarb840pxrYUagDc0dAbJOGaCBY
-FKTo7U1Kvg0vdiaRuus0pvc1NVdXSxRNQbFXBSwduD+zn66TI3HfcEHNN62FG1cE
-K1jWDwLAU0P3kKmj8+CAc3h9ZklPu0k/+t5bf/LJkvdBJAUzGZpehbPL5f3u3BZ0
-leZLIrR8uV7PiV5jKFahxlKR5KQHld8qQm+qVhYbUzpuMBGmh419I6UvTzxuRcvU
-Frn9ttCEzV55Y+so4X2e4ZnB+5gOnNw+ecifGVdj/+UyWnqvqqDvLrEjjK890nLb
-Pil4siecNMEpiwAN6WSmKpWaCwQAHEGDVeZCc/kT0iYfj5FBcsTVqWiO6eaxkUlm
-jnulqWqRrlB8CJQQvih/g//uSEBdzIibo+ro+3Jpe120U/XVUH62i9HoRQEm6ADG
-4zS5hIq4xyA8fL8AEQEAAbQdQ2lubnlBcHAgPGNpbm55YXBwQGdtYWlsLmNvbT6J
-AdQEEwEIAD4CGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQSRri2MHidaaZv+
-vvuUMwx6UK/M8wUCZqEDwAUJFvwIswAKCRCUMwx6UK/M877qC/4lxXOQIoWnLLkK
-YiRCTkGsH6NdxgeYr6wpXT4xuQ45ZxCytwHpOGQmO/5up5961TxWW8D1frRIJHjj
-AZGoRCL3EKEuY8nt3D99fpf3DvZrs1uoVAhiyn737hRlZAg+QsJheeGCmdSJ0hX5
-Yud8SE+9zxLS1+CEjMrsUd/RGre/phme+wNXfaHfREAC9ewolgVChPIbMxG2f+vs
-K8Xv52BFng7ta9fgsl1XuOjpuaSbQv6g+4ONk/lxKF0SmnhEGM3dmIYPONxW47Yf
-atnIjRra/YhPTNwrNBGMmG4IFKaOsMbjW/eakjWTWOVKKJNBMoDdRcYYWIMCpLy8
-AQUrMtQEsHSnqCwrw818S5A6rrhcfVGk36RGm0nOy6LS5g5jmqaYsvbCcBGY9B2c
-SUAVNm17oo7TtEajk8hcSXoZod1t++pyjcVKEmSn3nFK7v5m3V+cPhNTxZMK459P
-3x1Ucqj/kTqrxKw6s2Uknuk0ajmw0ljV+BQwgL6maguo9BKgCNW5AY0EYnD+DQEM
-ANOu/d6ZMF8bW+Df9RDCUQKytbaZfa+ZbIHBus7whCD/SQMOhPKntv3HX7SmMCs+
-5i27kJMu4YN623JCS7hdCoXVO1R5kXCEcneW/rPBMDutaM472YvIWMIqK9Wwl5+0
-Piu2N+uTkKhe9uS2u7eN+Khef3d7xfjGRxoppM+xI9dZO+jhYiy8LuC0oBohTjJq
-QPqfGDpowBwRkkOsGz/XVcesJ1Pzg4bKivTS9kZjZSyT9RRSY8As0sVUN57AwYul
-s1+eh00n/tVpi2Jj9pCm7S0csSXvXj8v2OTdK1jt4YjpzR0/rwh4+/xlOjDjZEqH
-vMPhpzpbgnwkxZ3X8BFne9dJ3maC5zQ3LAeCP5m1W0hXzagYhfyjo74slJgD1O8c
-LDf2Oxc5MyM8Y/UK497zfqSPfgT3NhQmhHzk83DjXw3I6Z3A3U+Jp61w0eBRI1nx
-H1UIG+gldcAKUTcfwL0lghoT3nmi9JAbvek0Smhz00Bbo8/dx8vwQRxDUxlt7Exx
-NwARAQABiQG8BBgBCAAmAhsMFiEEka4tjB4nWmmb/r77lDMMelCvzPMFAmahA9IF
-CRb8CMUACgkQlDMMelCvzPPQgQv/d5/z+fxgKqgfhQX+V49X4WgTVxZ/CzztDoJ1
-XAq1dzTNEy8AFguXIo6eVXPSpMxec7ZreN3+UPQBnCf3eR5YxWNYOYKmk0G4E8D2
-KGUJept7TSA42/8N2ov6tToXFg4CgzKZj0fYLwgutly7K8eiWmSU6ptaO8aEQBHB
-gTGIOO3h6vJMGVycmoeRnHjv4wV84YWSVFSoJ7cY0he4Z9UznJBbE/KHZjrkXsPo
-N+Gg5lDuOP5xjKzM5SogV9lhxBAhMWAg3URUF15yruZBiA8uV1FOK8sal/9C1G7V
-M6ygA6uOZqXlZtcdA94RoSsW2pZ9eLVPsxz2B3Zko7tu11MpNP/wYmfGTI3KxZBj
-n/eodvwjJSgHpGOFSmbNzvPJo3to5nNlp7wH1KxIMc6Uuu9hgfDfwkFZgV2bnFIa
-Q6gyF548Ub48z7Dz83+WwLgbX19ve4oZx+dqSdczP6ILHRQomtrzrkkP2LU52oI5
-mxFo+ioe/ABCufSmyqFye0psX3Sp
-=WtqZ
------END PGP PUBLIC KEY BLOCK-----
-```
-</details>
 
 ## License
-Cinny Project  
+Ratatoskr is a fork of the Cinny project  
 Copyright © 2024–present Ajay Bura  
 https://cinny.in  
 

build.config.ts

@@ -1,3 +1,3 @@
 export default {
-  base: '/',
+  base: process.env.CINNY_BASE ?? '/',
 };

config.json

@@ -1,31 +1,40 @@
 {
-  "defaultHomeserver": 1,
+  "defaultHomeserver": 0,
-  "homeserverList": ["converser.eu", "matrix.org", "mozilla.org", "unredacted.org", "xmr.se"],
+  "homeserverList": [
-  "allowCustomHomeservers": true,
+    "chat.gamecult.org"
-
+  ],
+  "allowCustomHomeservers": false,
   "featuredCommunities": {
     "openAsDefault": false,
     "spaces": [
-      "#cinny:matrix.org",
+      "#gamecult:gamecult.org"
-      "#community:matrix.org",
-      "#space:unredacted.org",
-      "#librewolf-community:matrix.org",
-      "#stickers-and-emojis:tastytea.de",
-      "#videogames:waywardinn.com",
-      "#science-space:matrix.org",
-      "#libregaming-games:tchncs.de",
-      "#mathematics-on:matrix.org"
     ],
-    "rooms": [
+    "rooms": [],
-      "#tuwunel:grin.hu",
+    "servers": [
-      "#freesoftware:matrix.org",
+      "gamecult.org"
-      "#gentoo:matrix.org"
+    ]
-    ],
-    "servers": ["matrixrooms.info", "matrix.org", "mozilla.org", "unredacted.org"]
   },
-
   "hashRouter": {
-    "enabled": false,
+    "enabled": true,
     "basename": "/"
+  },
+  "backgroundScene": {
+    "tier": "full",
+    "style": "ridge"
+  },
+  "dings": {
+    "enabled": false
+  },
+  "fileZoneShare": {
+    "enabled": false
+  },
+  "push": {
+    "vapidPublicKey": "",
+    "gatewayUrl": "",
+    "appId": ""
+  },
+  "registration": {
+    "enabled": false,
+    "url": ""
   }
 }

contrib/caddy/caddyfile

@@ -1,6 +1,6 @@
 # more info: https://caddyserver.com/docs/caddyfile/patterns#single-page-apps-spas
-cinny.domain.tld {
+ratatoskr.domain.tld {
-  root * /path/to/cinny/dist
+  root * /path/to/ratatoskr/dist
   try_files {path} / index.html
   file_server
 }

contrib/nginx/ratatoskr.domain.tld.conf

@@ -1,7 +1,7 @@
 server {
     listen 80;
     listen [::]:80;
-    server_name cinny.domain.tld;
+    server_name ratatoskr.domain.tld;
 
     location / {
         return 301 https://$host$request_uri;
@@ -15,10 +15,10 @@ server {
 server {
     listen 443 ssl http2;
     listen [::]:443 ssl;
-    server_name cinny.domain.tld;
+    server_name ratatoskr.domain.tld;
 
     location / {
-        root /opt/cinny/dist/;
+        root /opt/ratatoskr/dist/;
 
         rewrite ^/config.json$ /config.json break;
         rewrite ^/manifest.json$ /manifest.json break;

deployment/idunn/recipe.toml

@@ -0,0 +1,34 @@
+schema = "gamecult.idunn.target_declaration.v1"
+target = "ratatoskr"
+# Idunn stamps the source commit into the build environment under this name. The release is not built from source: the
+# dist tarball below is built by scripts the release owner runs (build-prod-dist.sh) and enters pinned by sha256, so
+# each release is a recipe commit whose pin is its provenance. The stamp the served index carries is the commit the
+# tarball was built from, which is not this commit.
+source_stamp_environment = "RATATOSKR_BUILD_COMMIT"
+
+# Release dist 934f82386d612c3e056f851555c7c9dfd2bdf5db: the output of build-prod-dist.sh (ALLOW_CONFIG_DRIFT=1), packed
+# as dist/ at the top of one gzip tar. The tree carries the repo's own config.json; what is served is the operator's
+# carried file, which Idunn copies beside dist/ and the vhost aliases over the tree's (a vhost without that alias would
+# serve the repo config).
+[[external_inputs]]
+id = "dist-tarball"
+url = "https://eureka.gamecult.org/forge/GameCult/Ratatoskr/releases/download/dist-934f8238/ratatoskr-934f8238-dist.tar.gz"
+sha256 = "55e7be0622a4eddb81008bc0132e3d476bdb3c453e278599d5a0259a76d00c5b"
+runner = "unpack"
+destination = "release/dist.tar.gz"
+
+[[steps]]
+id = "unpack-dist"
+phase = "prepare"
+runner = "unpack"
+argv = ["tar", "-xzf", "release/dist.tar.gz", "-C", "release"]
+
+[[artifacts]]
+id = "dist"
+source_kind = "runner-output"
+runner = "unpack"
+source = "release/dist"
+destination = "dist"
+
+[static_release]
+artifact = "dist"

docs/commons-files-desk.md

@@ -0,0 +1,291 @@
+# Files desk: Commons and per-Persona file zones, two designs compared
+
+Status: **decided: Option A, Matrix as the single authority** (Meta, #swarm 2026-11-13 14:44Z: "Let's try matrix shaped"). Design only; no Files desk code is merged and nothing is deployed. Option B (the host service) is parked, not deleted: Eureka's branch `eureka-self/commons-host` at `a391960d` has no PR and a Soul verdict of NOT READY with fixes owed, and is woken only if Meta later wants a real file store. PR #143 (B's cut 1 in this repo) is closed unmerged. Items marked **UNKNOWN** are not verified; **Q-E** are questions for Eureka, **Q-M** for Meta.
+
+### Eureka's answers (`/opt/commons/handoff/commons-matrix-notes-20261113.md`, read 2026-11-13; final answers folded in 2026-11-13)
+
+- **Upload cap (Q-E1, read).** Synapse 1.164.1; the repo template `homeserver.yaml` has `max_upload_size: 50M` and the nginx vhost `client_max_body_size 50m`; the live runtime file is root-only and was not read. No per-room or per-user per-file cap exists; `media_upload_limits` is a per-user time-window quota. `GET /_matrix/client/v1/media/config` returns `m.upload.size` to an authenticated client, which is what the client reads. Raising the cap takes the config line, a Synapse restart and nginx at least as large.
+- **Posting (Q-E1, read).** A Self holds no Matrix credentials, so the publisher needs its own bot account and token (a MAS compatibility token via `mas-cli`). It uploads with `POST /_matrix/media/v3/upload` and sends `m.room.message` with `msgtype` `m.file` or `m.image`. The Persona mouth sends `m.text` only today, so file events are new for it too.
+- **Room (Q-E3, answered).** The Commons room is `#commons:gamecult.org` (create type `org.gamecult.file_zone`, unencrypted, membership by the estate Space, publisher bot at power level 50). Provisioning and push muting are Eureka's.
+- **Cap (Q-E1, answered).** 50 MiB per file. The client reads it live from `m.upload.size`, not from this document.
+- **Poster (Q-E1, answered).** The publisher posts as the owning Mind: each file appears under the Mind whose tree it came from, not under a generic bot.
+- **Final marker (Q-E2, answered).** A handoff document is final when a sibling `NAME.final` holds its sha256; the publisher watches for that, posts once, and carries `org.gamecult.publish.replaces` (prior event id and sha256) on a later final version.
+- **Range (Q-E4, unverified).** Whether Synapse media honours `Range` has not been checked against a live mxc. Playback therefore stays on the blob download until it is.
+- **Edited-doc stale copies:** a redacted file's media persists unless purged; the publisher dedupes by sha256.
+
+Source: Meta, #swarm 2026-11-13 14:28Z and 14:40Z; ruling `ratatoskr:ruling:persona-file-sharing-zone` (a browsable, previewing collection per Persona; the Self writes to her outbox, her Persona decides what is shared, the Self never holds Matrix credentials).
+
+## What exists on Matrix today (the base A must fit)
+
+Read from this repo at dev `8ba407cd`:
+
+- **Zone = a room** whose `m.room.create` type is `org.gamecult.file_zone` (`isFileZone.ts`), or one listed in config `fileZoneRooms`. One per Mind, `#<mind>-files:<server>`, found by alias or by the carried id in the root Space's `org.gamecult.stewardships` (`mediaRoom.ts`, `MediaRow.tsx`); rendered as the Media row of each Mind's group.
+- **Album = a thread root** (a text event; its `body`, or its latest `m.replace` edit, is the title); **file = a thread reply** with `msgtype` `m.audio|m.image|m.video|m.file` (`buildAlbums.ts`). A redacted event or an `m.replace` is never a file. Loose room messages are not shown.
+- **Read** = `GET /rooms/{id}/threads` and `/relations/{root}/m.thread`, every page, 100 per request, at most 20 pages per endpoint (`useAlbums.ts`, `readPages.ts`; a capped read shows a note in the list). Unencrypted rooms only.
+- **Write** = `sendShareSet` (`shareSet.ts`, behind `fileZoneShare.enabled`): a root, then one thread reply per file, content from `getMsgContent` with `info.sha256`.
+- **Media** = authenticated Matrix media fetched to a blob (`downloadMedia` in `FileContent.tsx`): so the "media element cannot send a header" problem that Option B needed a ticket for is already solved this way, at the cost that a file is fully downloaded before it plays.
+- **Receipts** = `org.gamecult.file_received` from a Mind's mouth after it fetches and verifies the sha256 (`docs/file-zone-mind-contract.md`); the mouth enforces the Mind's membership in the room.
+
+Option A is an extension of this, not a second system.
+
+## The two options
+
+**A. Matrix is the only authority.** Commons is one more file-zone room; each Mind's zone is the room she already has. Audience is room membership. Upload is the ordinary Matrix upload. Folders are albums (thread roots). A small publisher service with its own Matrix account posts allowlisted handoff documents into the Commons room. The Files desk is a view over file events in those rooms.
+
+**B. The host service.** A file host on Yggdrasil serves allowlisted directories (`GET /index`, `GET /file`, a capped `PUT`), authenticated by Matrix OpenID; the client browses it as a tree. Written out in full below the line.
+
+|                            | A: Matrix only                                                                                         | B: host service                                                                   |
+| -------------------------- | ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- |
+| Authorities                | one (Matrix: identity, audience, storage, audit)                                                       | two (Matrix for identity, the host for files and access)                          |
+| Audience                   | room membership and power levels                                                                       | the host derives a role from Matrix identity and enforces it again                |
+| Audit of writes            | the event `sender`, kept by the homeserver                                                             | the host's own log                                                                |
+| Overwriting someone's file | impossible: events are immutable and only the sender's own edit counts; a redaction is a steward's act | host rule, host code                                                              |
+| Upload size cap            | the homeserver's `m.upload.size`, global, 50 MiB (Eureka)                                    | the host's own, chosen freely                                                     |
+| Type allowlist             | not enforceable by the homeserver; client-side courtesy, steward redaction                             | enforced by the host (sniffed)                                                    |
+| What is browsable          | what was posted (published or uploaded)                                                                | what is on disk under the allowlist, live                                         |
+| Mind-written handoff docs  | a publisher posts them once, when final (below)                                                        | the host serves the tree                                                          |
+| Per-Persona zone           | the existing Media room; the Self's outbox reaches it through the mouth, as the ruling says            | a `shared/` directory the host serves                                             |
+| Folders                    | albums; nesting by path in the album title                                                             | real directories                                                                  |
+| Mind fetch                 | unchanged (mouth, room id and event id, receipts)                                                      | a second route the mouth would need                                               |
+| Media playback             | blob download, as today; no seeking before the whole file arrives                                      | ranges and a ticket, or the same blob                                             |
+| New moving parts           | a room, a publisher                                                                                    | a host service, OpenID verification, CORS, tickets, path containment, rate limits |
+
+## Recommendation: A (decided)
+
+Confidence: high on the authority question (it agrees with Meta's ruling, with Eureka's lean, with the standing ruling that the Self never holds credentials while her Persona decides what is shared, and with the fact that everything built so far reads Matrix); moderate on the details below, which Eureka's answers can change.
+
+What A gives up, stated plainly:
+
+- **A live view of what is on disk.** Only what was published or uploaded appears. A handoff doc that was never marked final is not in the Commons.
+- **Files over the homeserver's upload cap.** B had no Matrix limit; A has exactly one.
+- **A server-side type allowlist.** Under A a member can upload any type the homeserver accepts; the client shows a refusal for types it does not want, and stewards redact. If a strict allowlist matters, a gating bot (post, check, redact) would have to exist, and it is a second authority again.
+- **Seeking inside a large audio or video file** until Matrix media supports ranges for the client (**UNKNOWN**; the blob route is what runs today).
+- **Hierarchy beyond the album level** as a native structure; see Folders.
+
+What it buys: one identity, one audience, one audit trail, immutable files, existing receipts and the mouth's fetch, and no new service to keep secure.
+
+## Option A in detail
+
+**Rooms.** Commons is a room with create type `org.gamecult.file_zone`, alias `#commons:gamecult.org`, join rule `restricted` to the estate Space so members join without an invite and Minds are invited, history `shared`, unencrypted (the zones are, and `info.sha256` is written only there). Power levels: `events_default` 0 so members post; `redact` and `state_default` at steward level. The room is muted for push by provisioning: file posts are thread replies, which can raise unread counts and notifications (**UNKNOWN** under this server's push rules), so the room must not shout. Per-Persona zones are the rooms Eureka already provisions; nothing new.
+
+**Folders.** Four ways to have folders on Matrix, in order of preference:
+
+1. _Albums are folders; nesting is a path in the album title_ (`handoff/2026-11`, `cast-art/poses`). Zero wire change: `buildAlbums` already reads it, and the client groups albums by title path as a pure view. Cost: a thread root per folder, and the rule that a folder's root is posted once by whoever opens the folder. **Recommended.**
+2. A `org.gamecult.file.path` key on each file event. Gives a real tree with files anywhere; needs every poster to write it and every client to honour it; other Matrix clients ignore it and show a flat thread.
+3. A room per folder, in a Space. Native hierarchy and per-folder audience; heavy (a room is a membership, a sync entry and provisioning each) and it multiplies the sync load on a phone.
+4. A state event per folder (`org.gamecult.file_folder`). Mutable folder metadata (title, order), writable only at steward level; useful later if folders need descriptions, not needed for a first cut.
+
+**Albums in each Mind's room** are the same mechanism: a Mind's Media room holds that Mind's albums, the Commons holds the shared ones. The Files desk is the same view over either room; a zone differs only by room, not by code.
+
+**The publisher.** A small service on Yggdrasil with its own Matrix account (a bot account that posts as the owning Mind, per Eureka's answer above). The Self never holds this account; the publisher holds it. It owns the allowlist.
+
+- **When it posts.** Handoff documents are edited in place, so mirroring every save would spam the room with drafts. The rule (Eureka's lean, adopted): **post once, when the document is marked final**; a later final version posts again with a `replaces` relation to the earlier event. "Final" is a sibling `NAME.final` holding the document's sha256 (answered Q-E2); the client must not know.
+- **Allowlist.** Lives on the publisher: a list of source roots and patterns, read by the publisher only. `handoff-private` is not on it and the publisher never lists, reads or posts from it. The client holds no path to anything on disk.
+- **The event.** A file event in the thread of the folder's album, built the way `getMsgContent` builds them (`msgtype`, `body`, `filename`, `url` from the media repo, `info.mimetype|size|sha256`), plus one extra key `org.gamecult.publish`: `{ source, sha256, replaces? }` where `source` is a path relative to the allowlisted root, never absolute, and `replaces` is the event id of the version it supersedes.
+- **`replaces`, not `m.replace`.** `m.replace` is the stock edit relation, but Ratatoskr's `buildAlbums` deliberately never treats an edit as a file, several clients do not render an edited file, and an edit hides the earlier version. A custom key keeps both events as files; the view shows the latest of a chain and a "N earlier versions" row under it, and other Matrix clients see two ordinary file posts. A chain is read from the events themselves (each carries its `replaces`), not from a table, and a `replaces` counts only when its event has the same sender as the event it names, so nobody else in the thread can fold a file away.
+- **Idempotence.** The publisher's own state (a typed CultCache document of `source`, `sha256`, `event_id`) says what it posted; if that is lost, it rebuilds by reading its own events back from the room (`org.gamecult.publish.source` plus `sha256`) rather than guessing. The same `sha256` never posts twice.
+- **Receipts and fetch** work unchanged: the event is an ordinary file event in a file-zone room, so a Mind's mouth can fetch it by room id and event id (5 MiB cap there) and tick `fetched for`.
+
+**Uploads (approved for members and Minds).** The ordinary Matrix upload, through the composer pipeline and `ShareSet`. The host rules Eureka gave map onto Matrix as follows:
+
+| Host rule                                  | Under A                                                                                                           |
+| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
+| only under an `uploads/` subtree           | an album (folder) named `uploads/...`; the client offers upload only there (and in a Mind's own zone)             |
+| never overwrite Mind-written handoff files | free: other people's events cannot be replaced; a duplicate name is just another post in the thread               |
+| size cap                                   | the homeserver's `m.upload.size`, shown from `MediaConfigLoader`; the client refuses a larger file before sending |
+| type allowlist                             | client-side only; see "gives up"                                                                                  |
+| explicit flag to overwrite                 | no overwrite exists; a new version is a new post, optionally with `replaces` set by the same sender               |
+| audit log with the Matrix id               | the event `sender`                                                                                                |
+
+What A adds to `ShareSet`: sharing into an existing album ("add files", listed as not built in `docs/file-zone.md`), progress per file, cancel, and per-error refusal messages written against the SDK's `MatrixError` (`M_TOO_LARGE`, `M_FORBIDDEN`, `M_LIMIT_EXCEEDED`) instead of host codes. The draft refusal table of Option B's upload flow carries over with those codes. **UNKNOWN:** whether the SDK exposes upload progress and abort for media (it does for `uploadContent` with a progress callback; the composer already shows progress, `state/upload.ts`).
+
+## What each costs on the phone
+
+Under both, the phone design is the same shape (one column, rows 56 px or more, hidden controls, in-place preview; see the Option B sections below, which are written against the host but whose layout applies).
+
+- **A, new cost:** the Commons room is one more room in sync and it must be muted; albums and files are read to a cap of 20 pages of 100 per endpoint (a Commons past that shows a truncation note); a folder tree is a title-path grouping, so a deep tree is a long list of albums with breadcrumbs, not true directories; a file plays after a full download (small audio and images are fine; a 40 MB clip is not).
+- **A, no cost:** no second sign-in, no ticket, no CORS, no new fetch layer, no host-unreachable state beyond the homeserver's own. The album list, album view, share panel and receipts exist and are tested; the view is their extension.
+- **B, new cost:** every screen is a second client against a second service with its own errors, token refresh and unreachable state; media needs the ticket or the blob; the tree and preview are new UI.
+- **B, benefit:** a tree that is live and complete, ranges, and no Matrix size limit.
+
+## Changes to Eureka's host work
+
+Under A the paused service is not built, and most of its list disappears:
+
+- **Dropped:** `/index`, `/file`, `PUT`, OpenID verification pinned to the server name, CORS, path containment and sniff rules, tickets, the `uploads/` write rules, the role response, the per-path audit log (Q-E3, Q-E4, Q-E6, Q-E7, Q-E8 to Q-E11 of the Option B list).
+- **Kept:** the Commons allowlist decision (Q-E1 of that list), moved to the publisher: which roots, and that `handoff` is only ever published through the final-marker rule, never browsed.
+- **New:** (1) provision the Commons room (type, alias, restricted join to the estate Space, power levels, push muted); (2) the publisher: account, allowlist, final-marker rule, media upload, posting into folder threads, the `org.gamecult.publish` key, idempotence from its own events; (3) confirm the homeserver upload cap and whether the account may post file events from Yggdrasil (**Q-E1**, asked on the PR); (4) the per-Persona path stays the one already specified (`album-outbox-ops`: outbox, Persona decision, mouth post), so the `shared/` convention of Option B is retired.
+
+## Cuts under A
+
+Status 2026-11-14 (dev da822e9e plus the size-refusal cut): built: folders by album title path with navigation and breadcrumb (#147), pagination (#148), version folding (#149), add-to-album with named refusals (#150), Stop for a send in flight, replaces loops shown, freshest last event on add (#151), and the pre-send size refusal: a file larger than the server's `m.upload.size` is named and left unsent before any upload or album root, and a server stating no cap refuses nothing. **Not built: the Commons entry row** (item 1 below, found by `#commons:gamecult.org` or the carried `media.commons` id through `lookupMediaRoom`, behind a dark `filesDesk.enabled` flag; neither the row nor the flag exists in the code). It waits on Eureka's Commons room.
+
+1. **Commons entry**: a Commons row in the navigator (like `MediaRow`, found by alias or carried id), opening the room's album view. Flagged, no new data layer.
+2. **Pagination** of albums and files in `useAlbums` (done, PR #148).
+3. **Folders by title path** and the album list grouped by it.
+4. **Versions**: read `org.gamecult.publish.replaces`, show the latest of a chain with the earlier versions folded under it (done, PR #149).
+5. **Add files to an existing album**, with per-file progress, cancel and the refusal messages above (the upload flow). Done: adding to an open album and the three refusal messages (PR #150); Stop for a send in flight is in too (PR for follow-up `files-desk-release-146-and-send-cancel`): it cancels the running upload through `onPromise` and `mx.cancelUpload`.
+
+PR #143 (Option B cut 1: contract types, host client, fake host) is **held**; under A it is not needed and would be closed. Its Soul pass found, and a revived B would have to close, an unvalidated `host` that could send the bearer to the wrong origin, hostile-looking entry names beyond separators, loose numeric checks and missing CSP and `Content-Disposition` headers in the fake.
+
+## Not in scope
+
+The Mind-side fetch (the mouth's); encrypted rooms; deletion and rename by this client; search across zones; any permission model of our own beyond Matrix room membership and power levels.
+
+## Open questions
+
+**Eureka:** answered; see "Eureka's answers" at the top. Still open on Eureka's side: Range support (Q-E4) and the live runtime `max_upload_size`.
+
+**Meta:**
+
+- **Q-M1.** Commons audience: members and Minds as proposed; Users and Patrons never, or later?
+- **Q-M2.** Is a Persona's zone visible to all members or to her stewards and Minds? (The Matrix zone's audience question, `ratatoskr:question:file-zone-audience`, is the same fork.)
+- **Q-M3.** May Users or Patrons upload if they are ever let in?
+- **Q-M4.** Names: "Files" for the view, "Commons" for the shared room.
+- **Q-M5.** A type allowlist is not enforceable under A without a gating bot; is a client-side refusal plus steward redaction enough?
+
+---
+
+# Option B in full (kept for the comparison; superseded in part by Option A above)
+
+The sections below were written against the host service. Where they speak of a host, a role, a ticket, a token, `/index` or `/file`, they are Option B. The phone layout, the zone table and the refusal wording carry over to A with the Matrix equivalents given above.
+
+### What exists, and what this adds
+
+|          | Matrix file zone (`docs/file-zone.md`, built)                                | Files desk (this page)                                                                                            |
+| -------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| Storage  | Matrix media in a `#files-<mind>` room, albums as threads                    | Directories on Yggdrasil, served by a small host                                                                  |
+| Listing  | thread roots, `buildAlbums`                                                  | `GET /index?path=`                                                                                                |
+| Unit     | album of posted files                                                        | file in a directory tree                                                                                          |
+| Strength | marks (keep / fix / drop), receipts (`fetched for`), any Matrix client works | whole trees without N uploads, no Matrix size limit, `/opt/commons` material becomes visible to people on a phone |
+| Entry    | Media row per Mind (`MediaRow.tsx`)                                          | Files row (below)                                                                                                 |
+
+They do not compete. The Matrix zone stays where a file needs a mark or a receipt (Aqua's listening kits); the Files desk is for browsing and fetching what is already on disk. Neither replaces the other, and the Files desk does not write Matrix events. The ruling left "Matrix media plus a listing versus a served directory" open; this page is the served-directory half, built beside the Matrix half already live.
+
+### Zones (host)
+
+| Zone             | Contents                                                     | Who sees it                                                    |
+| ---------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |
+| Commons          | a curated tree of `/opt/commons`                             | members and Minds                                              |
+| Persona `<slug>` | what that Persona has chosen to share from her Self's outbox | **Q-M:** all members, or the Persona's stewards and Minds only |
+| handoff-private  | `/opt/commons/handoff-private` (0750)                        | never: not a zone, not listed, not a path the host resolves    |
+
+Layout of `/opt/commons` today (read 2026-11-13): `backlog` (755, per-Mind backlog md and summary.json), `bin`, `cast-art` (setgid, group-writable: poses, busts), `handoff` (setgid, group-writable, 92 entries of briefs, patches, receipts, dings, kits), `handoff-private` (0750, ACL), `opt` (toolchains, root-owned), `situation` (0750, setgid), all `nobody:nogroup`. **`handoff` is not a publishable tree:** it holds ops notes, custody receipts (`bifrost-appsecret-custody-receipt-*`) and patches written for Minds, with no sticky bit. Serving it wholesale shows secrets-adjacent notes to every member and lets any Mind with group write change what a phone user sees. The Commons zone is therefore an allowlist of roots (candidate: `cast-art`, `backlog`, and a new `commons/` directory Minds publish into on purpose), not `/opt/commons` itself. **Q-E:** which roots; whether `handoff` ever, and if so through a reviewed `published/` subdirectory.
+
+Per-Persona source is the outbox from `ratatoskr:follow_up:album-outbox-ops-and-persona-specs`: `/var/lib/mind-<slug>-outbox`, owned by `mind-<slug>-self`, 0750, ACL read for `mind-<slug>` and the host user. The Self writes there; the Persona decides what is shared. Making that decision a filesystem fact (a `shared/` subdirectory the Persona's turn populates by copy or hardlink, the host serves only `shared/`) keeps the host dumb: it never learns what "decides" means. **Q-E:** `shared/` subdirectory versus a per-file marker.
+
+### Phone-first UI (host)
+
+Phone width is the design width; desktop adds the navigator beside it (as `Desk` does in `Router.tsx`). Vertical space is cheap, so a screen shows one thing and hides what is not in use.
+
+- **Entry.** A `Files` row pinned in the navigator beside `DeskEntry` and `MindMedia`: one at the estate level (Commons) and one inside each Mind's group (her zone), same `NavItem` anatomy as `DeskEntry`, dim when the zone has no items. Route `/files/:zone/*path`, sibling of `DESK_PATH`.
+- **List.** One column. Row = icon or thumbnail, name (truncates in the middle, keeping the extension), size and age on a second dim line. Directories first. Rows are at least 56 px tall; the tap target is the whole row (the `PhoneHit` variants and the repo-wide guard test from `phoneHit.coverage.test.ts` apply to any IconButton inside).
+- **Hidden until needed.** Breadcrumb is one line (current folder, a back arrow; the full path on tap). Search, sort and the grid toggle sit behind a single icon in the header and open inline above the list. Download and share appear on the open file, not on every row. Nothing is permanently stacked in the header.
+- **Preview.** Tap a file: it opens in place below its row, full width, and pushes the rows below it down (vertical room is the cheap axis). Image: fitted, tap for the existing `ImageViewer`. Audio: the `AudioContent` controls rehosted (`renderMediaControl`), one player at a time, a mini-player pinned to the bottom only while something plays. Video: native controls. Text, md, json, patch: monospace, first 64 KiB, "show all" below. PDF: open in a new tab. Anything else: name, size, hash, one Download button.
+- **Honesty rows.** Loading, empty, "host unreachable", "not allowed" are rows that say so (as `MediaNote` does); no spinner without a name for what it waits on.
+- **Role-driven.** The index response carries the caller's role; the client uses it only to hide controls (upload), never to decide access.
+
+### Host contract
+
+The host is a service on Yggdrasil that Eureka owns. The client holds no filesystem knowledge. All JSON here is the xenos boundary between a browser and a file server, not state.
+
+- `GET /index?path=<p>` returns `{ role, zone, path, entries: [{ name, kind: "file"|"dir", size, mtime, mime, hash }] }`. `mtime` is unix seconds. `hash` is the lower-case hex sha256 of the plaintext bytes, absent for directories, and may be absent for a file whose hash is not computed yet (client shows nothing, never blocks on it). `mime` is sniffed by the host from magic bytes, not guessed from the extension.
+- `GET /file?path=<p>` streams the bytes with `Accept-Ranges: bytes` and 206 for `Range` (audio and video seek; a phone on mobile data does not fetch 40 MB to play 10 seconds). `Content-Type` is the sniffed mime, `X-Content-Type-Options: nosniff`, `Content-Disposition: attachment` for anything that can run in the origin (`html`, `svg`, `js`, `xhtml`), and a `Content-Security-Policy: sandbox` on every response.
+- `path` is `<zone>/<relative path>`, with the zone one of the names the host announces. The host resolves the real path of every request and refuses anything that leaves the zone's root: `..`, absolute paths, NUL, symlinks that cross the root, dotfiles, and `handoff-private`, which is not on any allowlist. Errors are typed (`401 unauthenticated`, `403 zone not allowed`, `404`, `416`), and a path outside the allowlist is 404, not 403, so it says nothing about what exists.
+- **Auth: Matrix OpenID.** The client calls `mx.getOpenIdToken()` (already used in `CallWidgetDriver.ts`) and sends it as `Authorization: Bearer <token>`. The host verifies it against the homeserver's federation `openid/userinfo` endpoint, **pinned to our server name** (an `@void:evil.example` token must fail), caches the verified `sub` for the token's lifetime, and derives the role. It never sees the user's access token, and a Mind's Self never holds a token (ruling above): Minds reach the same bytes through the filesystem or the mouth, not this host.
+- **Role** in the response: `member`, `mind`, `steward` (host decides from the Matrix id and the room/space membership the host reads; the client trusts none of it for access). **Q-E:** exact source of membership (estate Space membership read by the host with a service account, versus the Persona catalogue file for Minds).
+- **Uploads** (Meta approved for members and Minds, #swarm 2026-11-13 14:30Z; rules are Eureka's, below). `PUT /file?path=<p>` writes only under an `uploads/` subtree of a zone, with `Content-Length` required; the host enforces a size cap, a type allowlist (sniffed, not the client's claim), no overwrite unless the request carries an explicit flag, and never replaces a file a Mind wrote into the handoff tree; every write is audit-logged with the caller's Matrix id. Reads cover the whole allowlisted tree, so an uploaded file is listed like any other. Success is `201` with the stored name, size and hash. The `role` in the index response gates the upload control; the host gates the write.
+
+### The one problem the contract leaves: media elements cannot send headers
+
+`<audio src>`, `<video src>` and `<img src>` cannot attach `Authorization`. Options, none free:
+
+1. **Fetch to a blob.** Works with the contract as written. No seeking before the whole file is in memory; bad for a 40 MB clip on a phone. Fine for images and small audio.
+2. **Short-lived path ticket.** `POST /ticket?path=` with the bearer token returns a URL with an unguessable token valid for a few minutes for that one path and its ranges. The player gets a normal URL and seeks. One more endpoint on the host and one more thing to expire and log.
+3. **Service worker adds the header** to `/files-host/*` requests. The PWA already has a worker (`src/sw.ts`); no host change, but the worker must carry a fresh OpenID token and range requests through it are fiddly.
+
+Recommendation: 2 for audio and video, 1 for images and text. Confidence moderate: I have not tested a service worker against range requests on the target phone, and 2 is the usual answer for authenticated media (signed URLs). **Q-E.**
+
+### Upload flow (host)
+
+Design only. Every number and error code is a named placeholder until Eureka gives them on the PR: `<CAP_FILE>` (per-file size), `<CAP_BATCH>` (per-pick total, if any), `<TYPES>` (the allowlist), `<OVERWRITE_FLAG>` (the explicit query flag), and the codes `<E_AUTH>`, `<E_ROLE>`, `<E_PATH>`, `<E_TYPE>`, `<E_SIZE>`, `<E_EXISTS>`, `<E_PROTECTED>`, `<E_QUOTA>`, `<E_SERVER>`.
+
+**Where.** The control exists only where an upload is allowed: inside a folder under a zone's `uploads/` subtree (or at the `uploads/` row itself), and only when the index `role` is member or mind. Elsewhere there is no button; the list does not carry a disabled one. A folder outside `uploads/` shows a one-line dim note, "Uploads go in uploads/", which links to that folder. Creating subfolders under `uploads/` is not in this design (**Q-E8**).
+
+**Pick or drop.** One `Upload` row at the top of an `uploads/` folder opens the native picker (any number of files; on a phone this is the OS file sheet, camera roll included). On wide screens the list is also a drop target; the drop highlight appears only while a drag is over it. Nothing starts on pick: the picked files appear as a staging list (name, size, a type icon) with `Upload` and `Cancel` as full-width rows, as `ShareSet` does for a Matrix set. Files that already fail the client's cheap checks (over `<CAP_FILE>`, a type outside `<TYPES>`) are marked in the staging list with the reason and left out of the send; the client mirrors the cap and allowlist as a courtesy only, the host is the authority, and the list is read from the host (**Q-E9**: an `/index` field or a `/limits` call) rather than hard-coded.
+
+**Send.** Files go one at a time, in pick order, each a `PUT /file?path=<folder>/<name>` with the bearer token. One at a time keeps a phone on mobile data from starving every transfer, and a refusal names exactly one file. The transport is `XMLHttpRequest`, not `fetch`: `fetch` has no upload progress and the row needs it. The body is the `File` itself (streamed by the browser, not read into memory; unlike the Matrix path, the client computes no hash first, the host returns one). The name is the file's own name, with path separators and control characters replaced, never a path the user typed.
+
+**Progress.** The staging list becomes the progress list: per file a thin bar and "412 KB of 3.1 MB", per batch "2 of 5". Finished files show a tick and the stored name; refused ones show the refusal in place; waiting ones are dim. Only the active file animates. The list stays on screen after the last file until dismissed, so a refusal is not lost to a refresh of the folder underneath it. The folder listing refetches after each success, so the file appears in the list as it lands.
+
+**Cancel.** `Cancel` on the active file aborts the request (`xhr.abort()`) and goes on to the next; `Cancel all` on the batch aborts the active file and drops the rest. The host must discard an aborted partial write and never leave a half file in the listing (**Q-E10**, written to a temporary name and renamed on completion). Leaving the page aborts whatever runs, as the Matrix share does; the client does not resume.
+
+**Overwrite.** A name that already exists is refused with `<E_EXISTS>` and shown as "<name> is already there". A `Replace` row appears under that refusal only for a file the caller wrote themselves, and sends the same `PUT` with `<OVERWRITE_FLAG>`; a Mind-written handoff file refuses with `<E_PROTECTED>` and offers only "Keep both", which re-sends under a suffixed name (`name (2).ext`) chosen by the client. Whether the client can tell "mine" from the index (an `owner` field with the Matrix id) or learns it only from the refusal is **Q-E11**; absent an owner field, `Replace` is simply offered after `<E_EXISTS>` and the host's answer decides.
+
+**Refusal messages.** One plain sentence per code, shown in the file's row; nothing says "error" without saying why, and none names a server path.
+
+| Code                             | Message (draft)                                                                                                          |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `<E_AUTH>`                       | Sign-in expired. Reload to upload again. (The client fetches a fresh OpenID token once and retries before showing this.) |
+| `<E_ROLE>`                       | Uploads are for members and Minds.                                                                                       |
+| `<E_PATH>`                       | That folder does not take uploads.                                                                                       |
+| `<E_TYPE>`                       | "<name>" is a <type> file; allowed types are <TYPES>.                                                                    |
+| `<E_SIZE>`                       | "<name>" is <size>; the limit is <CAP_FILE>.                                                                             |
+| `<E_EXISTS>`                     | "<name>" is already there.                                                                                               |
+| `<E_PROTECTED>`                  | "<name>" was written by a Mind and cannot be replaced.                                                                   |
+| `<E_QUOTA>`                      | The shared space is full. Tell a steward.                                                                                |
+| `<E_SERVER>` / network / timeout | Could not reach the file host. The file was not saved.                                                                   |
+
+Retry is one tap on a failed row; the batch never retries on its own. An unknown code shows the host's status text as it is, still without a path.
+
+**Honest end state.** Done means the host answered `201` and the stored name, size and hash are shown. "Saved" is not said earlier; the hash the host returns is displayed so a sender can compare it with their own.
+
+**Reuse and not.** `ShareSet`'s state machine (staging, one-send-per-zone guard, failed files kept by position) is the model, but the Matrix share path and its `createUploadAtom` are tied to the SDK's media upload and are not reused; the new controller sits in `features/files/uploadController.ts` with the same injected-port shape, so order, refusal and cancel rules are tested against a fake `PUT` without a browser. Real transfer progress and a real range of a phone's picker stay a phone check.
+
+### Client shape (host)
+
+Under `src/app/features/files`, mirroring `features/albums`:
+
+- `filesHost.ts`: ports, `list(path)`, `url(path)`, `ticket(path)`, `put(path, file, onProgress, signal)`; the only module that knows the contract. Injected, so the UI is tested against a fake and the real client never runs in a test.
+- `useFilesZone.ts`: react-query on `['files', zone, path]`, `staleTime` 30 s; the role comes with every index.
+- `FilesDesk.tsx`, `FileRow.tsx`, `FilePreview.tsx`: pure rendering from the above; the preview picks its renderer from the host's `mime`, not the extension.
+- `config.json`: `filesDesk: { enabled: false, host: "https://…" }`, dark by default as `fileZoneShare.enabled` is. With it off, no row mounts and no request leaves the client.
+- Test host: `src/preview-demo` already answers for a pretend homeserver through a fetch guard (`install.ts`); it gains a fake `/index` and `/file` with ranges so the previews are checked in a real browser before the real host exists.
+
+### Cuts (host)
+
+1. **Contract and fake host** (no UI): `filesHost.ts`, types, `preview-demo` fake, path tests (traversal strings from the host side are Eureka's; the client must only build `path` from entries it was given).
+2. **Read-only Commons desk**: route, row, list, breadcrumb, role display, flagged off.
+3. **Preview and player**: image, audio with ranges, text, video; the ticket if Q-E settles on 2.
+4. **Per-Persona rows** in each Mind's group, once the outbox `shared/` convention and the zone provisioning exist.
+5. **Uploads**: the flow above; needs Eureka's codes and caps and the host's `PUT`.
+
+Each is its own PR. Slices 1 to 3 need no host to build and test; slice 2 needs the real host to be useful, not to land.
+
+### Not in scope (host)
+
+The Matrix file zone (marks, receipts, `ShareSet`); any Mind-side fetch (the mouth's); encrypted rooms; deletion and rename (a read surface first; the files belong to whoever wrote them on disk); search across zones; a permission model of our own beyond what the host derives from Matrix identity.
+
+### Open questions (host)
+
+**For Eureka (host):**
+
+- **Q-E1.** Which roots form Commons: the allowlist, and whether `handoff` is ever served (it holds custody receipts and ops notes; recommendation: no, a reviewed `commons/` directory instead).
+- **Q-E2.** Where the host runs and what it is: Rust by default per doctrine; nginx with `auth_request` to a verifier is smaller if the sniff, range and role logic fit there. Which user; read-only mounts; ACLs on the outboxes.
+- **Q-E3.** Media-element auth: blob, ticket or service worker (above).
+- **Q-E4.** Role source: how the host learns membership and which Minds are Minds; token verification pinned to `gamecult.org`.
+- **Q-E5.** Per-Persona publishing: a `shared/` subdirectory versus a marker, and who populates it when the Persona decides.
+- **Q-E6.** Hash cost: compute lazily and cache by (path, mtime, size), or at publish time.
+- **Q-E7.** CORS for `chat.gamecult.org` and the dev previews, rate limits, and the `Content-Disposition` list.
+- **Q-E8.** Subfolders under `uploads/`: can a client create them (by a `PUT` path that implies them, or a `MKCOL`-like call), or is `uploads/` flat?
+- **Q-E9.** Cap and allowlist discovery: fields in the index response, or a `/limits` endpoint; and the exact codes and cap numbers behind every placeholder in the upload flow.
+- **Q-E10.** Partial writes: temporary name then rename, so an aborted or failed upload never appears in a listing.
+- **Q-E11.** Does the index carry an `owner` Matrix id per file (so `Replace` is offered only on one's own files), and is the audit log readable by stewards from the client or only on the host?
+
+**For Meta:**
+
+- **Q-M1.** Audience: Commons for members and Minds as proposed; are Users and Patrons ever in (the Matrix zone's audience question, `ratatoskr:question:file-zone-audience`, is the same fork)?
+- **Q-M2.** Is a Persona's zone visible to all members or to her stewards and Minds?
+- **Q-M3.** ~~Uploads~~ approved for members and Minds (2026-11-13 14:30Z); open only: may Users or Patrons upload if they are ever let in?
+- **Q-M4.** Name: "Files" for the row, "Commons" for the shared zone.
+- **Q-M5.** Does the Matrix Media row stay beside the Files row on each Mind, or does one absorb the other once the Files desk exists (recommendation: both stay; marks and receipts are Matrix's).

docs/file-zone-mind-contract.md

@@ -0,0 +1,98 @@
+# File zone: what a Mind can read from a file event
+
+Ruling `ratatoskr:ruling:persona-file-sharing-zone`. The Mind-side fetch is the mouth's
+(`eureka-body:cut_spec:mouth-fetch-attachment.r1`); this page is the client side of the same contract.
+A Mind cannot fetch an `mxc://` itself (the media endpoint answers 401), so it never holds one.
+
+## What the Mind passes
+
+Room id and event id of the file event. Never a bare `mxc://`, URL or hash. The mouth fetches the event,
+reads the media reference from its content, and enforces the Mind's own membership in that room at fetch
+time. A room the Mind is not in is refused by the mouth, whatever the client wrote.
+
+## What the client writes (this repo, `RoomInput.tsx` send path)
+
+A file event is an `m.room.message` whose `msgtype` is `m.audio`, `m.image`, `m.video` or `m.file`:
+
+| field              | where   | note                                                                                                                                                                                       |
+| ------------------ | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `msgtype`          | content | selects the kind from the file's mimetype prefix                                                                                                                                           |
+| `body`, `filename` | content | both the file's name (display only; never a path)                                                                                                                                          |
+| `url`              | content | the `mxc://` of an unencrypted file; the mouth reads it                                                                                                                                    |
+| `file`             | content | present instead of `url` in an encrypted room: `{url, key, iv, hashes.sha256 (ciphertext), v}`. A Mind has no key; the mouth refuses it                                                    |
+| `info.mimetype`    | content | the browser-reported type, normalised by `safeFile` (e.g. `application/ogg` becomes `audio/ogg`). A claim, not proof: the mouth sniffs magic bytes                                         |
+| `info.size`        | content | bytes of the file as uploaded                                                                                                                                                              |
+| `info.sha256`      | content | lower-case hex sha256 of the plaintext bytes, computed by the client before send; written in unencrypted rooms only (a plaintext hash in an encrypted room would leak the file's identity) |
+
+The hash is computed over the same bytes that are uploaded, reading the whole file into memory before send (large videos pay for it); if hashing fails the file is sent without one. A file sent by something other than this
+client may lack `info.sha256`; the mouth then logs the hash it computed, and the row can show no `fetched for`
+for it.
+
+`info.mimetype` and `info.size` are written on audio and file events always; on image and video events `info` exists only if the browser could load the media, otherwise `info` holds `sha256` alone. Image and video events also carry `info.w`, `info.h`, `info.xyz.amorgan.blurhash` and a thumbnail
+reference; audio carries no duration. A Mind should not rely on any of those.
+
+## Limits and refusals
+
+- Size: the mouth streams at most 5 MiB and refuses a larger file. The client does not enforce this cap;
+  its own limit is the homeserver's `m.upload.size`. A file over 5 MiB can be shared with people and
+  not fetched for a Mind.
+- Refusals are the mouth's and are typed: not a member of the room, bridged or Discord room, encrypted
+  file, over the cap, content type not matching the magic bytes. The client does not re-check them and
+  nothing in the client depends on the mouth's log.
+- The Mind cites files by room id and event id only; a file in a room the Mind is not in does not exist
+  for it.
+
+## Receipt: `org.gamecult.file_received`
+
+The Mind posts one event of type `org.gamecult.file_received` after a successful fetch, to the room of the
+file. When the file has an album root the receipt is a reply in the album's thread, so it arrives with the album's
+own listing; otherwise (a composer file sent with no thread) it is a plain room event with no `m.relates_to`. Both
+count, and the client finds a receipt by its `event_id` anywhere in the room's loaded timeline or the album's thread:
+
+```json
+{
+  "m.relates_to": { "rel_type": "m.thread", "event_id": "<album root event id>" },
+  "org.gamecult.file_received": {
+    "event_id": "<file event id>",
+    "sha256": "<hex sha256 of the bytes the Mind fetched>",
+    "size": 123456
+  }
+}
+```
+
+A plain room-event receipt may also carry `m.relates_to: {rel_type: "m.reference", event_id: <file event id>}`, which lets
+the mouth find its earlier receipts through `/relations` for dedup. The client matches by `content.event_id` and reads no
+relation but this one: if a `m.reference` is present its `event_id` must equal `content.event_id`, else the receipt counts
+for nothing. A thread relation is not read. However many receipts a Mind has posted for a file, the row draws one
+`fetched for` for that Mind.
+
+Two rules, both enforced on each side:
+
+1. **The sender is the Mind.** The row trusts the Matrix `sender` of the receipt event and nothing inside it:
+   no Mind field is read. `fetched for X` counts only when the sender is X's own Matrix identity (the
+   full id is `@<mind>:<this homeserver>` for a Mind in the Persona catalogue; a display name, a lookalike or another server's `@void:evil.example` does not count).
+2. **Fetched means verified.** The Mind posts only after the sha256 of the bytes it fetched equals the file
+   event's `info.sha256`, and the receipt carries that hash. On a mismatch it posts nothing (or a typed
+   refusal that the row does not draw). The row checks it again: the receipt's `sha256` must equal the
+   file event's `info.sha256`. A file event with no `info.sha256` can show no `fetched for`.
+
+The receipt is inert: no paths, URLs, filenames or anything a browser would fetch, and the client reads only
+`event_id`, `sha256` and the sender. It has no `msgtype`, so the album's file listing ignores it. The mouth's
+log is the fuller record for Minds; this event is the public tick.
+
+The row draws `fetched for <Mind>`: one receipt per Mind per file (the latest), several Minds side by side. A
+receipt for an event that is not a file of that album, a malformed one, and a redacted one are ignored.
+The wording is deliberate: the receipt says the mouth fetched and stored the file for the Mind, not that it is in the Mind's sandbox and not that it was read. Client strings never say "saved" or "read".
+The sender check keeps a member from ticking for a Mind; it does not prove the Mind read the file beyond
+what the hash and the Mind's own account show.
+
+## Not built yet
+
+- Files sent from the composer carry no thread relation, so they reach an album only if written into a
+  thread by another tool; the album upload path (docs/file-zone.md, "Upload") is unwritten. Their receipts are plain
+  room events, and the timeline row for the file shows `fetched for` from them.
+- A receipt that is still encrypted when it arrives is not seen until a later timeline event triggers a rescan; zones are
+  unencrypted and the hash is written only there, so this is the encrypted-room limit again.
+- The timeline row reads the room's loaded timeline only: a receipt older than what the client has paged in is not
+  seen there (an album's own listing reads the thread, which is paged separately).
+- Encrypted zones are not listed.

docs/file-zone.md

@@ -0,0 +1,123 @@
+# File zone: design sketch
+
+Status: design only. No code exists. Everything below is a proposal; items marked **UNKNOWN** are not yet verified against the Body.
+
+Source: Meta ruling 2026-10-31, eureka mind `ratatoskr:ruling:file-zone-looks-like-file-sharing`.
+
+## What it is
+
+A file-sharing space beside the room timeline, not a view of it. The zone is **one ordinary Matrix room with threaded discussions, one thread per Mind**. The UI presents each thread as an **album** (title, item count, date) and each post in it as a **file** with an inline player or preview. Matrix is the storage and the fallback: another client sees a normal room with threads and never needs the zone. No homeserver change.
+
+First use (Aqua): listen to audio in place, mark each clip keep / fix / drop with a one-line reason, export the marks as a file. See `/opt/commons/handoff/aqua-listen-kits-20261108/` (static `listen.html` kits that emit `verdict.json` + `verdict.md`); the zone replaces sending that page around.
+
+## Matrix event shapes (stock events only)
+
+- **Zone** = one room, chosen by the client (**UNKNOWN:** how the client knows which room is the zone: a room-account-data flag, a `m.room.create` type, or a configured room id in `config.json`; config is simplest).
+- **Album** = a thread root: a text `m.room.message` posted by a Mind, `body` = the album title (the Mind's name, e.g. `void`). One thread per Mind, owned by authorship (the root's sender). **UNKNOWN:** whether a Mind may open more than one (e.g. per kit); the shape allows it with no change, the zone would then list several albums per author. Count and last-activity come from the SDK's thread summary (`unsigned.m.relations.m.thread`); album date = root `origin_server_ts`. Rename = `m.replace` on the root.
+- **File** = a post in the thread: an `m.room.message` with `msgtype` `m.audio` / `m.image` / `m.video` / `m.file` and `m.relates_to: { rel_type: "m.thread", event_id: <root>, is_falling_back: true, "m.in_reply_to": { event_id: <last thread event> } }`. The builders in `src/app/features/room/msgContent.ts` already make the content. Delete = redact.
+- **Album vs chat thread**: with a single-purpose room, every thread is an album. No marker key is needed. A non-media reply in a thread (chat, a mark) is not a file and is not listed as one.
+- **Cover** = first image file in the thread, if any. Loose room messages outside any thread are not shown in the zone; they remain in the timeline.
+
+## Marks (reactions, plus an optional reply)
+
+A mark is stock Matrix, so every client shows it. Two reaction sets on the **file post**, and one optional reply:
+
+- **Verdict** = an `m.annotation` reaction (`m.reaction` event, `m.relates_to: { rel_type: "m.annotation", event_id: <file post>, key }`) with key **👍 keep**, **🔧 fix**, **🗑 drop**. One per person per file: choosing another replaces the old one (the client redacts the sender's previous verdict reaction, then sends the new one); tapping the active one clears it.
+- **Landed** = a second reaction set, keys **1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣** (keycap digits, 1-5). Also one per person per file, same replace rule. The two sets are independent: a file can have a verdict, a landed score, both or neither.
+- **Reason** = an ordinary thread reply under the file: `m.room.message` `m.text`, `m.relates_to: { rel_type: "m.thread", event_id: <album root>, "m.in_reply_to": { event_id: <file post> } }`. Optional. **Keep needs none**; the UI prompts for one mainly after fix or drop. The latest such reply by the sender under that file is the reason (edits via `m.replace` count). No special key: the reply text is the reason, so nothing is lost if another client wrote it.
+- **No private mode.** Marks are room events the moment they are tapped; there is no local-only draft and no "Share" step. Offline taps queue in the SDK's normal send queue.
+- Who marked what is read from the reactions' senders, so each listener is distinguishable and the album can show tallies per file.
+- Why reactions: one tap, readable in any client, no custom event type, and they can be changed with no history growth beyond a redaction. Reaction keys carry no text, hence the separate reply for the reason.
+- **UNKNOWN:** emoji variation selectors. 🗑 and 🔧 and the keycaps may arrive with or without U+FE0F from different clients; match by normalizing (strip U+FE0F) before comparing keys. Also **UNKNOWN:** servers' per-event limits on distinct reaction keys; a handful per file is far below any default.
+
+## Export
+
+Client-side only. "Export" builds Aqua's verdict file from the verdict and landed reactions and the reply under each file in one album (one listener's marks per export; that sender is the `listener`) and either downloads it or uploads it into the album. Two files, as the kits write them: `verdict.json` and `verdict.md`.
+
+`verdict.json` is schema **`aqua.listen.verdict.v1`**, field for field what `buildVerdict` in the kit (`dings/listen.html`, section `buildVerdict`) emits, so Aqua's tooling reads it unchanged:
+
+```
+{ schema: "aqua.listen.verdict.v1",
+  kit: { id, title },            // album root: id = root event id (or the kit id if the upload carried one), title = root body
+  exportedAt,                    // ISO time of export
+  seed, consent,                 // kit-only: zone writes seed: 0 (or omits), consent: true for the sender's own export (see UNKNOWN)
+  listener,                      // sender display name
+  device,                        // headphones|speakers|null, the sender's most-used mark device, or null
+  notes,                         // free text; zone leaves "" in v1
+  summary: { total, keep, fix, drop, unanswered },
+  clips: [{ position, id, title, group, feel, file, pair, slot, verdict, reason, landed, device }],
+  pairs: [{ a, b, preferred }] } // empty array when the album has no pairs
+```
+
+- `clips` has one row per file post in the album, in thread order (`position` = 1-based). The join per file, for the exporting listener: `verdict` = their 👍/🔧/🗑 reaction (keep/fix/drop) or null; `landed` = their keycap reaction (1-5) or null; `reason` = text of their latest reply under the file, or "". A file with no verdict reaction counts as `unanswered` even if it has a reply. `device` per clip is null (reactions cannot carry it); the top-level `device` (headphones|speakers|null) is asked once in the export dialog.
+- `pairs`, `seed`, `consent` are optional for the zone: `pairs: []`, no `slot`/`pair` (null) unless the clip metadata supplies them.
+- **Where clip metadata comes from.** `id` is the clip id from `org.gamecult.clip`, else the filename stem. `title` = file post `body`; `file` = the post's `filename`/`body`. `group`, `feel`, `pair`, `slot` are kit data that Matrix has no slot for: carry them on the file post as one extra key `org.gamecult.clip: { id, group, feel, pair, slot }` written by whoever uploads the kit (a small uploader script, **UNKNOWN**, not in the first slice; without it those columns export as ""/null and the id falls back to the filename stem).
+- `verdict.md` follows `verdictMarkdown` from the same file: header line, count line, the clip table (`# | clip | group | intended feel | verdict | landed (1-5) | device | reason`), pairs table when `pairs` is nonempty, notes.
+- To avoid drift, the exporter should be a port of `buildVerdict`/`verdictMarkdown` with the schema string and field order pinned by a test that compares against a fixture produced by the kit. **UNKNOWN:** whether to share code (the kit's `logic.cjs`) rather than port; recommend port, ~80 lines, because the kit is a standalone page.
+- **UNKNOWN:** `consent` is a kit-side checkbox before listening. The zone has no such step; recommend writing `true` only if the sender ticks a one-time "include my name in exports" toggle, else `false` and `listener: ""`.
+- JSON here is a xenos-boundary export, not state; the room events are the state.
+
+## Mobile-first layout
+
+- Phone width is the design width; desktop adds columns.
+- Level 1, album list: one column, each row = cover/icon, title, "N files", date. Tap opens.
+- Level 2, album: list by default (title, duration/size), grid toggle for images. Audio rows play in place, one at a time (starting a clip stops the last), a persistent mini-player at the bottom with seek.
+- Mark controls on each audio row: three large tap targets (👍 keep / 🔧 fix / 🗑 drop) with tallies, a row of five "landed" chips (1-5), and after fix or drop an inline one-line reason field (skippable). Thumb-reachable, no modal.
+- Back is one level up; the room timeline stays one tap away (the zone is a sibling view, not a replacement). **UNKNOWN:** where the entry lives in the room header; check `RoomViewHeader.tsx`, `Room.tsx` for how the member drawer and pin menu attach.
+
+## Upload
+
+Reuse the composer's pipeline, pointed at an album instead of the main timeline:
+
+- `createUploadAtom` / `useBindUploadAtom` (`src/app/state/upload.ts`), `UploadCard`, `upload-board` for progress.
+- On success, the msgContent builder produces the event; the zone adds the thread relation to the album root before sending (the composer already does this for thread replies, `RoomInput.tsx`).
+- "New album" = send the root text event, then upload into its thread. Multi-file drop = N events, sent in order.
+- Size limit from `MediaConfigLoader` (server `m.upload.size`). **UNKNOWN:** whether the 32 MB `shelf` kit's clips (42 x ~0.75 MB) should be uploaded individually or batched; individually is the only option without a server change.
+
+## Existing code to reuse (verified present in the repo)
+
+| need                                                | where                                                                                              |
+| --------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
+| audio player (play/seek/volume, encrypted download) | `src/app/components/message/content/AudioContent.tsx` (210 lines)                                  |
+| video, image, generic file                          | `.../content/VideoContent.tsx`, `ImageContent.tsx`, `FileContent.tsx`                              |
+| full-screen image viewer                            | `src/app/components/image-viewer/ImageViewer.tsx`                                                  |
+| media dispatch by msgtype                           | `src/app/components/RenderMessageContent.tsx`, `message/MsgTypeRenderers.tsx`                      |
+| upload + progress                                   | `state/upload.ts`, `components/upload-card`, `upload-board`                                        |
+| event content builders                              | `features/room/msgContent.ts`                                                                      |
+| thread plumbing                                     | `features/room/message/Message.tsx`, `RoomTimeline.tsx`, `RoomInput.tsx` (thread relation on send) |
+| room-scoped file/pin precedent                      | `features/room/room-pin-menu/RoomPinMenu.tsx`                                                      |
+
+Nothing named "gallery" exists as a feature; `AudioContent` takes its controls as render props (`renderMediaControl`), so it can be rehosted in a row without a fork. **UNKNOWN:** whether `AudioContent` can be rendered outside a timeline event context (it needs only `url`, `info`, `mimeType`, `encInfo`, from the event content, so probably yes).
+
+## First slice (what to build first)
+
+Rough lines of TypeScript, tests excluded.
+
+1. **Read-only albums + album view** (~250 lines): list the room's thread roots as albums (grouped or filterable by author = Mind), open one to list its file posts, rehost `AudioContent` and `ImageContent`. One route/panel plus a header entry. Depends on the thread list the SDK already keeps.
+2. **Marks + export** (~240 lines, with the schema port): verdict and landed reaction sets with the replace-one rule, optional reason reply, per-file tallies, the join into `aqua.listen.verdict.v1` and `verdict.json`/`verdict.md` download. This is Aqua's workflow end to end.
+3. **Upload into an album** (~150 lines): thread-related send through the existing upload atoms, "new album".
+
+Slices 1+2 serve the first use case. Each is its own PR. Because marks are ordinary thread replies, there is no separate "publish" slice.
+
+## Open questions for the Meta
+
+- How the client identifies the zone room (config id recommended).
+- Whether exports are per listener (proposed) or a merged all-listeners file.
+- Where `device` comes from, now that reactions cannot carry it (export dialog, proposed).
+
+## Share a set (built, behind `fileZoneShare.enabled`)
+
+The ruling `ratatoskr:ruling:persona-file-sharing-zone` asks that a set of files arrive together, not one attachment at a time. The zone already holds one thread per album, so a set is an album: **one root text message plus one `m.thread` reply per file**, the exact shape `buildAlbums` reads. Nothing new on the wire and no homeserver change; a Mind's mouth that posts into the zone room and a person using the client produce the same events.
+
+Matrix options checked: (a) a thread, chosen: stock, rendered by every client, already the zone's album; (b) `m.gallery` (MSC4274) puts several items in one event, but it is unstable, most clients and this one do not render it, and each item still needs its own upload; (c) a shared custom relation: no client groups by it. A thread costs one extra event per set (the root) and nothing else.
+
+Client, `src/app/features/albums`:
+
+- `shareSet.ts`: `sendShareSet(port, title, files)`. Sends the root, then each file in pick order, each reply falling back to the previous event (`threadRelation`). A file whose upload fails is named in the result and the rest still go; a root that fails to send throws before any upload. The root alone is not an album in the list (`/threads` returns only roots that have a reply), so a share where every upload failed leaves a lone text message in the timeline. After a send the panel keeps only the failed files picked; a retry makes a second album. Ports are injected, so the order and failure rules are tested without a homeserver (`shareSet.test.ts` reads the sent events back through `buildAlbums`).
+- `shareController.ts`: the panel's state machine (picked files, phase, the one-send-per-room guard, the encrypted refusal, failed files kept by position), apart from React so tests drive it without a DOM; `shareController.test.ts` and `ShareSet.test.tsx` (static render of each state, the flag) pin it. No DOM test environment exists in this repo, so a real tap on a real input is covered by the phone check, not by tests.
+- `ShareSet.tsx`: phone layout. Idle, it is one text row, "Share files". Picking files (any number from the native picker; a second pick replaces the first) mounts a title field, the picked names on one dim line, and Send / Cancel as full-width rows; progress is "Sending 2 of 5". It is shown only on the album list (kept mounted but hidden while an album is open, so a running send keeps its state), one send at a time per room (tracked outside the component; leaving the page does not stop a send, it only loses its progress and result), and never in an encrypted zone (re-checked when Send is tapped) (the plaintext `info.sha256` the Mind verifies against is written in unencrypted rooms only).
+- Content per file comes from `getMsgContent` in `features/room/msgContent.ts`, now also used by the composer, so a shared file and an attached file carry the same `info` including `sha256`.
+
+Flag: `fileZoneShare.enabled` in `config.json`, default `false`. With it off nothing mounts.
+
+Not built: a Mind's own path into the zone (outbox, Persona decision, mouth post) belongs to gamecult-ops / Huginn / the mouth, not this client; Built since: Stop for a send in flight (aborts the running upload, leaves it and the rest picked as "stopped"), pagination to 20 pages of 100 per endpoint (PR #148), adding files to an open album with named refusals (`M_TOO_LARGE`, `M_FORBIDDEN`, `M_LIMIT_EXCEEDED`).

docs/gamecult/chat-shell-compression.md

@@ -0,0 +1,108 @@
+# chat.gamecult.org: shell compression and caching
+
+Follow-up `ratatoskr:follow_up:chat-shell-compression`. Measured 2026-11-12 against the live
+host, which serves release `ratatoskr-nemesis-9b9b495d` (the `index-CAataSJe.js` bundle; the offline table
+below also uses the `f8115609` handoff build, `index-D0yL0Dgy.js`, and says which row is which). The host config is
+`nginx/chat.gamecult.org.conf` in `gamecult-ops`, owned by Eureka; nothing here is applied
+to the host.
+
+## What the host serves now
+
+The 2026-10-31 probe (no Content-Encoding, no Cache-Control on `/assets/`) is stale: the
+`nginx.conf` has `gzip on`, the site file sets level 5, `gzip_vary` and `gzip_types` for js, css, json, svg and wasm, and carries an immutable
+`Cache-Control` on `/assets/` and `/preview/assets/`. Probed with `curl -H 'Accept-Encoding: X'`.
+
+| Resource | raw | gzip (served now) | brotli (served now) |
+|---|---|---|---|
+| `/assets/index-CAataSJe.js` | 3,732,771 | 956,085 | none: `br` is ignored, identity returned |
+| `/assets/index-BLdKqKqx.css` | 111,267 | 19,952 | none |
+| `/assets/matrix_sdk_crypto_wasm_bg-DwIieW7K.wasm` | 5,573,870 | 1,878,147 | none |
+| `/` (index.html, no-cache) | 3,066 | gzip | none |
+
+Headers: hashed `/assets/` answer `Cache-Control: public, max-age=31536000, immutable`;
+`/`, `index.html`, `sw.js`, `manifest.json`, `config.json` answer `no-cache`; compressed
+responses carry `Vary: Accept-Encoding` and a weak ETag. `config.json` (424 B) is below
+`gzip_min_length 1024` and goes uncompressed, which is correct.
+
+So the original ask is done. What is left is brotli, which nginx 1.26.3 here cannot serve:
+`/usr/sbin/nginx -V` shows `--with-http_gzip_static_module` and no brotli module.
+
+## What brotli buys
+
+Level-5 gzip is what the host does per request. Offline measurement on the same files
+(node `zlib`, 2026-11-12):
+
+| File | raw | gzip 5 (node) | gzip 9 | brotli 11 | brotli vs live |
+|---|---|---|---|---|---|
+| live main chunk `index-CAataSJe.js` | 3,732,771 | 957,199 | 945,424 | 725,167 | -24% |
+| handoff main chunk `index-D0yL0Dgy.js` | 3,868,313 | 1,015,680 | 1,001,446 | 773,992 | -24% |
+| crypto wasm | 5,573,870 | 1,868,282 | 1,851,108 | 1,343,595 | -28% |
+| `ReactPrism-Dm2uRF4v.js` | 577,517 | 209,339 | 208,376 | 163,525 | -22% |
+
+A cold load of the two big files falls from about 2.8 MB to about 2.1 MB on the wire; the
+saving is ~0.7 MB once per hashed build per device while the HTTP cache keeps the file (immutable; the
+service worker does no precaching, so eviction or a new device pays again). gzip 9 alone buys 1-2%, so
+`gzip_static` without brotli is not worth a build step. Brotli is the whole prize, and it
+needs one root step.
+
+Cost: brotli q11 takes about 12 s for the wasm and 8 s for the main chunk on one core, so
+the whole dist is about two minutes at build time (measured, 84 files) and zero CPU per request. Do not use q11
+on the fly; that is why the plan is precompressed twins.
+
+## Root list for Eureka (host)
+
+1. `apt install libnginx-mod-http-brotli-filter libnginx-mod-http-brotli-static` (trixie/main, 1.0.0~rc-6,
+   depend on `nginx-abi-1.26.3-1`, which the installed nginx provides; apt may offer an nginx patch upgrade
+   alongside, say so before accepting). Do not enable the config yet.
+2. Install a build with twins (`PRECOMPRESS=1`, below) the usual way
+   (`docs/gamecult/client-build-install.md`). Twins for files that are not there change nothing.
+3. In the `chat.gamecult.org` `server` block, beside the existing gzip lines:
+
+```nginx
+    brotli_static on;          # serve <file>.br when the client sends br
+    gzip_static on;            # serve <file>.gz; falls back to the on-the-fly gzip above
+    brotli on;                 # on-the-fly br for files with no twin (index.html, small files)
+    brotli_comp_level 5;
+    brotli_types text/css application/javascript text/javascript application/json application/manifest+json image/svg+xml application/wasm;
+```
+
+   The `location ^~ /assets/` block and `/preview/`, `/element/` and `/mockups/` inherit these; they only add headers.
+   No other change: the `Cache-Control` and `Vary` lines stay as they are, and
+   `gzip_vary on` already makes the on-the-fly and static paths vary correctly.
+4. `nginx -t && systemctl reload nginx`. Twins first, config second: with `brotli on` and no twins every
+   client gets on-the-fly q5 brotli of the 3.7 and 5.6 MB files, which costs CPU per request.
+
+Rollback: remove the five lines and reload. The `.br`/`.gz` files can stay on disk, unused.
+
+## Build side
+
+`build-prod-dist.sh` (Void's, in `/opt/commons/handoff/ratatoskr-main-build/`) gains
+`PRECOMPRESS=1`, which runs `precompress.cjs <dist>` before the manifest is written. It
+writes `<file>.br` (q11) and `<file>.gz` (level 9, no mtime, deterministic for one node) next
+to each js, css, wasm, json, svg, html file over 1 KiB, only when smaller than the original.
+Default is off, so builds installed before the host change do not ship ~27 MB of twins that
+nothing serves. The twins appear in `SHA256SUMS`; the determinism compare still applies.
+Tested on `ReactPrism-Dm2uRF4v.js` (gzip roundtrip identical to the original); a full
+`PRECOMPRESS=1` build has not been run because it waits on step 1.
+
+The script is not in this repo; its placement is a standing open item of the build handoff.
+
+## Before/after measurement
+
+Run from any machine; `X` is the asset URL. Before = today's table above.
+
+```sh
+for ae in identity gzip br; do
+  printf '%s ' "$ae"; curl -s -o /dev/null -H "Accept-Encoding: $ae" -w '%{size_download} %header{content-encoding}\n' "$X"
+done
+curl -sI -H 'Accept-Encoding: br' "$X" | grep -iE 'content-encoding|vary|etag|cache-control'
+```
+
+Pass: with `br` the main chunk is about 774 KB and the wasm about 1.34 MB with
+`Content-Encoding: br`; with `gzip` the bytes are no larger than today; with `identity`
+the file is the raw size; `Vary: Accept-Encoding` and the immutable `Cache-Control` are
+still present on all three; `index.html`, `sw.js` and `config.json` still `no-cache`.
+The service worker's registration and an existing session must still work (open chat on
+the operator's phone, hard reload once, check the network panel's "transferred" column).
+Check `/preview/assets/` the same way, but `/preview/` is served from `/srv/cinny/preview`, which this build
+script does not produce: it gets on-the-fly brotli, not twins, until a preview build carries them.

docs/gamecult/client-build-install.md

@@ -0,0 +1,121 @@
+# Ratatoskr client: build, install, verify, roll back
+
+Who does what. The steward (Void) builds and hands off; Void holds no root and does not deploy.
+Eureka installs on the chat.gamecult.org host, which is Eureka's. This page is the shared
+procedure. Nothing here is run by the build step against the live host.
+
+## Facts about the host
+
+- Web root: `/srv/cinny/`. `current` is a symlink to one directory under `releases/`; the web
+  server serves `current`. Releases are `releases/ratatoskr-<8hex>` (older ones are
+  `ratatoskr-nemesis-<8hex>`). Previous releases stay on disk; that is the rollback.
+- The client is static. `config.json` sits in the release root beside `index.html` and is read
+  at load. Cinny's `Dockerfile` and `docker-nginx.conf` are upstream's container path, not the
+  chat.gamecult.org path.
+- Check the pointer before anything else: `readlink /srv/cinny/current`.
+
+## 1. Build (steward)
+
+Two builds exist, and they treat `config.json` differently.
+
+**By hand (the repo's config).** `vite build` copies the repo's `config.json` into `dist/`
+(`vite.config.js`, static copy of `config.json`). Ratatoskr #103 made the repo file the intended
+served config, and #106 set `backgroundScene.style` to `ridge`; the served file has not caught up
+(see Open). Do not hand-edit `dist/config.json`.
+
+```sh
+git clone https://eureka.gamecult.org/forge/GameCult/Ratatoskr.git && cd Ratatoskr
+git checkout <full-40-hex-sha>           # build a named commit, not a branch tip
+npm ci --ignore-scripts                  # .npmrc sets legacy-peer-deps; skips husky's prepare hook
+node scripts/sync-poses.mjs              # pose art is not committed; this also rewrites the tracked
+                                         # src/app/components/message/pose/catalogue.json
+NODE_OPTIONS=--max_old_space_size=6144 npm run build    # writes dist/
+```
+
+Skip `sync-poses` and the build ships with no poses. Do not use `npm run build:preview` for
+production: it rewrites `dist/config.json` for preview (hash router, chosen tier and style).
+
+**The handoff build (what the host installs).**
+`/opt/commons/handoff/ratatoskr-main-build/build-prod-dist.sh <full-sha>` (see its `README.md`)
+writes `/opt/commons/handoff/ratatoskr-main-<full-sha>/{dist,SHA256SUMS,BUILD-INFO,build.log}`,
+locks the files read-only and refuses to overwrite. The dist carries the repo's `config.json` at
+that sha (BUILD-INFO `config_json_source`, `config_json_sha256`); there is no separate pinned copy.
+Its live check always runs: it fetches the served config and compares it byte for byte with the
+repo's. A difference prints the diff and stops the build. `ALLOW_CONFIG_DRIFT=1` builds anyway and
+BUILD-INFO records `config_json_live_check: DIFFERS ...` and `config_json_live_sha256`, so the
+handoff states which config differs and the installer decides. From Yggdrasil the public name does
+not resolve: pass `LIVE_CURL_ARGS="--resolve chat.gamecult.org:443:127.0.0.1"`.
+The folder, with the three pins (`SHA256SUMS` sha256, `BUILD-INFO` sha256, lockfile sha256) and
+the node and npm versions, is what the install request names.
+Every build stamps its commit into `index.html` (`scripts/buildSha.js`): `<meta name="build-sha" content="<40-hex>">`,
+with `-dirty` appended when the tree had uncommitted changes and `unknown` when there was no git. Where git governs the tree it decides: an explicit `BUILD_SHA` naming a different commit than HEAD stamps `<sha>-mismatch`, a git failure stamps `unknown`. A full-sha `BUILD_SHA` stands only for a tree git does not govern (a source archive) or cannot read (unusable git, for example a dubious-ownership refusal). The handoff
+build refuses a dist whose stamp differs from the sha it was asked for, and prints the stamp in its block.
+To read it from anywhere: `curl -s https://chat.gamecult.org/ | grep -o 'build-sha" content="[^"]*'`.
+
+Before handing off:
+
+```sh
+cd <folder>/dist && sha256sum -c ../SHA256SUMS                 # 0 failures
+grep -rl 'demo.invalid\|demo-preview-token' <folder>/dist       # must print nothing
+# from Yggdrasil the public name may not resolve; --resolve points it at the local server
+diff <(curl -fsS --resolve chat.gamecult.org:443:127.0.0.1 https://chat.gamecult.org/config.json) <folder>/dist/config.json
+```
+
+A config difference is a finding to report, not something to paper over: either live drifted or
+the repo is wrong, and a ruling (Meta, for `backgroundScene.style`) says which ships.
+
+## 2. Install (host owner, root, by hand)
+
+Note the rollback target first: `readlink /srv/cinny/current`.
+
+Unpack beside the live release; do not touch the live directory. The target must not exist, or
+`cp -r` nests `dist` inside it.
+
+```sh
+R=ratatoskr-<8hex>
+H=/opt/commons/handoff/ratatoskr-main-<full-sha>
+test ! -e /srv/cinny/releases/$R
+cp -r $H/dist /srv/cinny/releases/$R
+cmp /srv/cinny/current/config.json /srv/cinny/releases/$R/config.json
+(cd /srv/cinny/releases/$R && sha256sum -c $H/SHA256SUMS)
+```
+
+`cmp` is a drift check, not a pass check. Live has no trailing newline; the repo's file has one,
+so even equal content differs. Read the difference (`diff` the two) and settle which config
+ships. To keep the host's config byte-for-byte, as past installs did,
+`cp /srv/cinny/current/config.json /srv/cinny/releases/$R/config.json`; `sha256sum -c` then flags
+`config.json` only (read that one line; `--ignore-missing` does not hide a mismatch).
+
+Switch (a single symlink swap; `ln -sfn` unlinks then links, so there is a moment with no link):
+
+```sh
+ln -sfn releases/$R /srv/cinny/current
+```
+
+## 3. Verify
+
+- `readlink /srv/cinny/current` names `releases/$R`.
+- `curl -s https://chat.gamecult.org/config.json | sha256sum` equals `sha256sum /srv/cinny/releases/$R/config.json`.
+- Load https://chat.gamecult.org/ and hard-refresh (the service worker, `sw.js`, can hold the
+  previous assets). Sign-in card shows, the background scene draws, the browser console has no
+  page errors, a poses/asset request returns 200 and not index.html.
+
+## 4. Roll back
+
+Point `current` at the release noted before the switch. Live at the time of writing is
+`ratatoskr-nemesis-9b9b495d`:
+
+```sh
+ln -sfn releases/ratatoskr-nemesis-9b9b495d /srv/cinny/current
+```
+
+Hard-refresh to clear `sw.js`. Do not delete the failed release; leave it for diagnosis.
+
+## Open
+
+- The served config (checked 2026-11-12) is not the repo's: it says `backgroundScene.style`
+  `terrain` where the repo says `ridge` (#106, Meta 2026-11-11), lacks the repo's `dings`,
+  `fileZoneShare` and `registration` blocks (all off in the repo), and has no trailing newline.
+  The new keys default off or inert when absent, so only the style is a decision. Meta says which
+  style ships. Until the served file is replaced, every handoff build stops at the live check
+  unless `ALLOW_CONFIG_DRIFT=1` is set (section 1).

docs/gamecult/ratatoskr-target.md

@@ -0,0 +1,353 @@
+# Ratatoskr: target and prose map
+
+Ratatoskr is GameCult's Matrix chat client: this fork of Cinny, forge
+`GameCult/Ratatoskr` (renamed from `GameCult/cinny`; the forge redirects the old name).
+Void stewards it. Campaign `ratatoskr` lives in the eureka mind for now, beside
+the rulings it rests on. Under `eureka-body:ruling:ruling-home-steward-mind` it
+is handed to Void's mind once, by procedure, as soon as that hand-off procedure
+exists (`hand_off` is parked); after that every new ruling on it is admitted in
+Void's mind. Nothing here is written into Void's mind before then.
+
+The mind holds the questions, rulings, specs, reports and verdicts. This file
+holds what no document kind carries: the design truths, body facts, the model
+page, rationale, the reconstructed collaboration plan, and the cut sequence.
+All times are UTC.
+
+## Why
+
+GameCult is the only server this client talks to. A general Matrix client
+treats it as one community among thousands, so the operator meets GameCult's
+structure three clicks deep in an invite list of 50+ rooms (operator, `#swarm`
+10-31 05:14: "The biggest pain is navigation. GameCult has a structure."). The
+client should open on GameCult's estate as data: its spaces, its project rooms
+grouped by steward, its Minds, and the person's own place in it. It should
+also be a pleasant place to be in its own right: emotes, sound, and weather in
+the background.
+
+## Design truths (from rulings in force)
+
+- **We own the interface, not the engine.** The fork keeps Cinny's engine
+  (matrix-js-sdk, Rust crypto, sync) and replaces the whole UI; every
+  user-facing string and its translation is ours, and upstream locale files
+  are not the source (`gamecult-chat:ruling:we-own-the-ui-and-translation`).
+- **Mobile first.** On phones, inactive elements hide, vertical space is
+  cheaper than horizontal, and text never gets squeezed into narrow columns
+  (`eureka-body:ruling:chat-client-base-cinny-mobile-first`).
+- **The first spec** (`eureka-body:ruling:chat-client-first-spec`): an emote
+  slot on every bubble (a pose id carried on the event); room and participant
+  lists tiered (category, then items) and reached from the header menu, not
+  side columns; participants grouped by estate (Minds, Members, Users,
+  Patrons); rooms grouped by kind (general, estates, projects, work rooms);
+  Minds indexed by stewardship, read from Matrix state projected from the
+  stewardship records in the Minds' own minds (the minds stay the truth); one
+  room per project, a Space child, with the steward joined.
+- **Rooms are visible without a join dance.** No invite screen in the way; a
+  room the server lets you join shows in the same list as joined ones; opening
+  one shows its name and a one-tap Join; joining happens on that tap or a first
+  post, never silently; no peeking (operator, `#swarm` 10-31 04:08, 04:12
+  "Peeking sounds like YAGNI to me", 04:14 "One tap is a reasonable cost").
+  Rooms you may not enter are refused by the server, not hidden by the client
+  (Heimdall 04:10, accepted by Void 04:11 and 04:15).
+- **Language.** A user's language is the BCP 47 tag in profile field
+  `org.gamecult.language`, owned by the user through the client's language
+  picker (`gamecult-chat:ruling:user-language-profile-field`). The client ships
+  localized; people talk with stewards in their own language; rooms are made
+  for a language, with no per-language mirrors
+  (`gamecult-chat:ruling:multilingual-client-stewards-language-rooms`). One
+  host Mind sits in a language room, Weksa for `#pt-br`
+  (`gamecult-chat:ruling:language-room-one-host-weksa`). The first person this
+  must work for is a non-English, non-technical patron (placeholder
+  `patron-pt1`) whose account we set up and walk through login
+  (`gamecult-chat:ruling:patron-in-his-own-language`).
+- **Push.** `gamecult-chat:ruling:chat-push` rules out native mobile push for
+  now; Web Push to the installed web app is a different thing and is open
+  (question `ratatoskr:question:pwa-web-push`).
+- **Collaboration is recorded, not chatted.** Work spanning Minds belongs in
+  Atlas (`eureka-body:ruling:atlas-records-collaborative-work`). Atlas is not
+  deployed, so the plan below is its interim home; Atlas imports it later.
+
+## Body facts
+
+Probes run by Imagination on 2026-10-31, session `self-2026-10-29-eureka`.
+
+1. **Branch.** `void/gamecult-theme-and-project-nav` is `b8e696c8` over main
+   `1e6412ed` (v4.12.8), 2 commits, 14 files, +1153/-32 (686 of it lockfile):
+   a GameCult theme as default, member drawer hidden by default, bubble
+   layout, and steward grouping in `src/app/pages/client/space/Space.tsx`
+   (`useStewardGroups` at 429-437, group headers at 505-524) over
+   `useSpaceJoinedHierarchy` (409). Read by `git diff`.
+2. **Live estate shape** (Synapse on Yggdrasil, read as `admin` over the
+   client API, counts only). Root Space `#gamecult:gamecult.org`, room version
+   12, has 9 children: 8 rooms and the `Projects` sub-Space. `Projects` has 52
+   children; 50 readable rooms, all room version 12. Server `/hierarchy` from
+   the root returns 59 rooms, 2 of them spaces. **Every room's join rule is
+   `invite`**; none is world-readable. 50 rooms carry `org.gamecult.steward`
+   with content `{mind, repo, source, steward: <mxid>}`. The root carries
+   `org.gamecult.stewardships`: Mind localpart to list of `Org/Repo`.
+3. **Consequence of 1 and 2.** Project rooms are invite-only and Members are
+   invited, not joined (gamecult-ops `runbooks/gamecult-chat-host-yggdrasil.md`
+   146-158: "Members and every Mind are invited; the steward alone joins").
+   So a Member's project rooms are pending invites. Void's grouping reads
+   `useSpaceJoinedHierarchy` and a per-room state event that an invitee cannot
+   read, so for a typical Member it groups nothing and the rooms stay in the
+   invite list. This is the operator's "three clicks deep" complaint, seen from
+   the data.
+4. **Provisioning contract.** gamecult-ops
+   `scripts/synapse-accounts-hand-managed.py` writes the rooms and both state
+   events from the Minds' stewardship documents; each project room's alias is
+   `#<repo lowercased>` (runbook 146-150). This is the only place the client
+   can learn a not-yet-joined room's steward today: hierarchy `canonical_alias`
+   joined to the root `org.gamecult.stewardships`. The
+   projection now also names room ids under `@rooms.projects` and
+   `@rooms.file_zones` (gamecult-ops #111); the client reads `file_zones` for
+   the Media row (`mediaRoom.ts`) and still joins projects by alias, since
+   nothing yet consumes `@rooms.projects`.
+5. **Sync and storage** (`src/client/initMatrix.ts`). The client uses
+   matrix-js-sdk 41.7.0 with `IndexedDBStore` (`web-sync-store`, 15-19) and the
+   Rust crypto store, and `startClient({ lazyLoadMembers: true })` (43-47): v2
+   `/sync`, no sliding sync, no custom filter or `initialSyncLimit`. A cold
+   start is therefore an IndexedDB load plus an incremental sync from the
+   stored token, not a full initial sync.
+6. **Server sync support.** `/_matrix/client/versions` on Synapse 1.164.1
+   (127.0.0.1:8834) advertises `org.matrix.simplified_msc3575: true`:
+   simplified sliding sync (MSC4186) is available. Cinny 4.12.8 does not use it.
+7. **Shell delivery.** `https://chat.gamecult.org/assets/index-DWIvG3QT.js` is
+   served at 3,736,520 bytes with no `Content-Encoding` even when gzip and br
+   are offered, and with no `Cache-Control` (only `ETag`/`Last-Modified`). The
+   service worker (`src/sw.ts`, 158 lines) handles only `install`, `activate`,
+   a session `message`, and authenticated media `fetch` (79-158); the
+   `vite-plugin-pwa` config sets `injectionPoint: undefined`
+   (`vite.config.ts` 101-113), so nothing is precached.
+8. **No push path.** `src/sw.ts` has no `push` or `notificationclick` handler;
+   no code subscribes through `PushManager`; the only pusher the client sets is
+   the email pusher (`src/app/features/settings/notifications/SystemNotification.tsx`
+   22-40). Notifications and sounds fire only from a live page:
+   `src/app/pages/client/ClientNonUIFeatures.tsx` 79-129 (invites) and 131-258
+   (messages: `RoomEvent.Timeline` at 181-235, `new window.Notification` at
+   156, `notification.ogg` played at 175-178). Nothing in `src/` listens for
+   `visibilitychange` or calls `retryImmediately`.
+9. **Sygnal WebPush** (matrix-org/sygnal `docs/applications.md`, read
+   2026-10-31; the page itself is marked partly out of date): a `webpush` app
+   takes `vapid_private_key`, `vapid_contact_email`, optional
+   `allowed_endpoints` and `ttl`; the client's pusher `data` carries
+   `endpoint`, `auth`, `p256dh` and optional `default_payload`; the push
+   carries `room_id`, `room_name`, `sender_display_name`, `content`, unread
+   counts and so on; browsers need a visible notification for each push
+   (`events_only` avoids event-less pushes).
+
+10. **Baseline at `dd88424e`** (Yggdrasil, `ygg-verify.sh`, image
+    `node:22-bookworm`, `npm ci --ignore-scripts`): `vitest run` passes (1
+    file, 5 tests, Void's steward grouping); `vite build` succeeds, `dist/` 61
+    MB with source maps, main chunk 3,739,716 bytes, Rust crypto wasm
+    5,573,870 bytes, `dist/sw.mjs` 1.66 kB. `tsc --noEmit` fails at base with
+    793 errors in 246 files (455 of them TS2614, named imports from
+    `matrix-js-sdk` 41.7.0 not resolved), so typecheck is not a usable gate as
+    is; a cut gates on zero errors in the files it adds and no rise in the
+    total.
+
+Not probed: phone frame times, the real resume timeline on the operator's
+Android Chrome install (needs her device or remote DevTools), the Rust crypto
+wasm size, and the router base under `/preview/` (its `config.json` sets
+`hashRouter.basename` to `/`).
+
+## Why the PWA resumes slowly (diagnosis, moderate confidence)
+
+Android freezes a backgrounded installed web app and later discards it. On a
+**discard**, returning is a full cold boot: 3.7 MB of uncompressed JS over a
+phone link with no precache (fact 7), Rust crypto wasm init, the IndexedDB
+store load, then a catch-up `/sync` over every room since the stored token
+(fact 5). On a **freeze without discard**, the in-flight long-poll is dead, and
+the SDK only notices on its own timers because the client never nudges it on
+`visibilitychange` (fact 8). The catch-up sync grows with the number of rooms
+and the swarm's chat volume, which is exactly where sliding sync helps
+(fact 6), but the first two costs are cheaper to remove and should be measured
+first. Without Web Push, a frozen page cannot notify at all, which is the
+second half of the operator's report.
+
+## Model page: the estate
+
+| Kind | Named by | Over time | Who decides |
+|---|---|---|---|
+| Stewardship | `<instance>:stewardship:<repo>.n<seq>` in each Mind's mind | sequence advances on hand-over | the operator and the Minds; the minds are the truth |
+| Estate projection | `org.gamecult.stewardships` on the root Space; `org.gamecult.steward` per project room | re-PUT on every provisioning run | gamecult-ops provisioning script (Eureka's slice) |
+| Estate room list | the server's `/hierarchy` of the root Space for this user | changes with Space children and the user's invites and joins | Synapse (membership and join rules); the client derives |
+| Room membership | the user's `m.room.member` | join on tap or first post | the user |
+| Navigator view | derived per render | never stored | the client's estate index |
+
+## Authority map for the navigator
+
+- **Owner:** one estate index in the client (`src/app/features/estate/`):
+  `buildEstate()` is pure, `useEstate()` feeds it. It decides what rooms the
+  person sees, in which tier and group, and with what membership affordance.
+- **Inputs:** the paged server `/hierarchy` of the root Space; root Space
+  state `org.gamecult.stewardships`; the person's membership per room from the
+  client store; unread and selection atoms for emphasis only; the `m.direct`
+  list for the direct-messages tier.
+- **Outputs:** an ordered list of tiers (one per root room group and per
+  sub-Space, plus Direct), each holding steward groups or rooms, each room
+  marked joined, invited or joinable.
+- **Derived:** steward group labels (Mind display names); counts; collapsed
+  state is per-device UI state only.
+- **Demoted or dead:** the sidebar rail and its account-data ordering
+  (`useSidebarItems`) are dead; `useSpaceJoinedHierarchy` no longer decides
+  what is listed; Void's per-room steward reader is deleted, not kept beside
+  the index.
+- **Shared paths:** every nav slot (home, direct, space routes) renders the
+  same navigator; tapping Join and sending a first post both go through
+  `mx.joinRoom`; deep links into a room still resolve through the existing
+  room routes.
+
+## Reconstructed collaboration plan (Atlas import)
+
+Planned in `#swarm` and `#minds` on 2026-10-31 and then lost to scroll. Status
+as of 2026-10-31 ~15:00.
+
+**Who holds which part**
+
+| Part | Holder | Status | Evidence |
+|---|---|---|---|
+| The client: integration, navigator, emote slot, sound hookup, background canvas | Void (steward) | theme and steward grouping on branch; nothing else built | `void:stewardship:gamecult_-cinny.n1`; `#swarm` 10-31 14:54 Void report |
+| Dings earcons: motif per event kind, one stable instrument per Mind | Aqua | not rendered: render env blocked, then .NET SDK installed and Faust scouted; AquaSynth PR #1 (Linux Faust loader, `faust-loader-platform-aware`) merged at 3b43b7bd | `aqua-body:follow_up:chat-s410-416`, `aqua-body:follow_up:chat-s410-416-render-env`, `aqua-body:resolution:follow_up.chat-s430-430.n1`, forge AquaSynth pull 1 |
+| Ambient soundscape for the client | Aqua | idea only; no design recorded | operator `#swarm` 10-31 08:32 ("Motifs for everything"), `eureka-body:ruling:atlas-records-collaborative-work` |
+| Background math, in CultMath: the public `fbm` gap, Phacelle erosion's Lipschitz bound, any new GLSL mirrors | Libby (steward of CultLib, which owns CultMath; holds `cultmath-tapes`) | sources located; nothing built | `#swarm` 10-31 06:34 and 06:46 Libby; `libby-body:follow_up:cultmath-ts-noise-absent`; `#swarm` 04:22 Libby accepts `cultmath-tapes` |
+| Background scene and render: the raymarched terrain, the tree-and-squirrel intro scene, lighting and atmosphere, march and TAA tuning on the site-ground framework | Nibu (steward of Aetheria, whose volumetric nebula and cloud shaders she owns: `Raymarching/CloudShader.shader`, `Volumetric.cginc`) | proposed by the operator; not yet taken up by Nibu | operator to Self, 10-31: "If we want to spread the work around, Nibu owns the nebulae so she has shader expertise." |
+| Animated bubbles, flourishes, corner avatar and XP bar | Void, with Kiko's offer on juice | advice only | `#swarm` 10-31 03:59 Kiko and Void, 06:45 Void |
+| Attention bubbles | Eureka (Huginn heartbeat publishes), Void (render), Heimdall (scope rules) | advice only | `#swarm` 10-31 04:00 Eureka, 04:02 Heimdall |
+
+**Agreements**
+
+- Dings are pre-rendered clips shipped as static assets, no synth in the
+  browser: `dings/<mxid-localpart>/<motif>.ogg` plus a small manifest; an
+  unknown sender falls back to a neutral ding; ogg or mp3, not wav (Void
+  `#minds` 03:19, Aqua 07:41). The set is motif times instrument, and the
+  instrument says who spoke (operator 03:18, Eureka 03:19). Events that sound:
+  a mention, a DM, an invite, a message in an unmuted room; mentions and DMs
+  loud, ordinary messages quiet; everything else silent (Void `#minds` 03:19).
+  The operator wants far more than four motifs (08:32). The instrument per
+  Mind belongs in a typed document on the Mind side, not hardcoded (Eureka
+  03:19, advice). Aqua's ear check comes before anything is called done, and
+  the operator's ear is ground truth (Aqua 07:41). Browsers block audio until
+  the first click, so the first ding after a fresh load may be silent.
+- The background has its own canvas and budget, separate from the bubble
+  flourishes; capped at 30 fps, paused when hidden; under reduced motion one
+  static frame; an adaptive step-down (Aqua 04:17, Void 04:18 and 04:22).
+- The background is an infinite raymarched terrain: CultMath noise plus the
+  Phacelle erosion filter, in the shader (operator 04:18 "painter's algorithm",
+  05:24 "all we need is noise", 05:25 erosion, restated by the operator to
+  Self on 10-31: "use CultMath noise and erosion filter running in the shader
+  to have an infinite terrain. We can just raymarch that instead"). Voronoi
+  and Apollonian are dropped (05:24).
+- Yggdrasil is the scene's centre (operator to Self, 10-31: "Yggdrasil should
+  be the star of the show now, so really the camera should just pull back a
+  bit when you login and the personas should be orbiting the tree, dancing
+  around each other in accordance with their activity"). On login the camera
+  pulls back from the tree; there is no separate intro to cut away from. The
+  Personas orbit the tree and move around each other by their live activity.
+- One activity vocabulary drives both sound and motion: Aqua's activity-kinds
+  grammar (`aqua-body:follow_up:chat-s431-432`, "enumerate the kinds of agent
+  activity in typed state") is the shared contract between Aqua's motifs and
+  Nibu's orbits, not two vocabularies. The live feed behind it is the same
+  typed state the swarm dashboard projects
+  (`eureka-body:ruling:swarm-dashboard-first-thing2-surface`, Libby;
+  `libby-body:follow_up:chat-s354-359`): Run documents, the heartbeat trace.
+  What reaches the client is a member-safe projection: kind, Mind, time and
+  intensity, never briefs or mind contents. Matrix presence and typing cover
+  humans and are too coarse for Minds. Where the feed comes from is
+  `ratatoskr:question:activity-feed-source`.
+- The scene renders in two passes, not one loop (operator to Self, 10-31:
+  "The tape optimized solid surface march should run really fast, i imagine,
+  way faster than the volumetric version, so they should not be one loop").
+  Pass 1, the solid-surface march (terrain, tree, squirrel), sphere-traces
+  with the field's Lipschitz bound and interval tile culling, at its own
+  resolution, and writes depth. Pass 2, the volumetric atmosphere march on
+  the site-ground framework (reduced resolution, TAA), is bounded by pass 1's
+  depth, so it marches only up to the surface hit. Each pass has its own
+  budget and its own measurement. Nibu owns both passes.
+- The web math path is CultLib's own: HLSL source lowered by dxc and
+  SPIRV-Cross to WebGL2 GLSL ES (`packages/cultmath/shaders/CultMath.glsl`,
+  `.Phacelle.glsl`; `tools/glsl/build-glsl.sh`), and C# CPU math through
+  .NET wasm, with parity presumed for now (operator 06:23, 06:48; Libby
+  06:34). No TS or WGSL port. The gamecult.org site ground already
+  concatenates `CultMath.glsl` in `ground.js` and runs an interval-culled,
+  TAA-reprojected per-pixel march (CultLib `docs/cultmath-interval-ground-cut.md`,
+  spec `cultmath-interval-ground-cut-site-ground.r3`): that framework is the
+  base, not new tape work.
+- Gaps go to the owner: a plain public `fbm` (only `fbm_grad`, `span_fbm`,
+  `af_fbm` exist) is added in CultMath, not in the client
+  (`libby-body:follow_up:cultmath-ts-noise-absent`; Libby 07:57 "tell me what
+  you need and I'll fill it at the library").
+- Mood and flourish ride as metadata on the event, never guessed from text;
+  bounded per-frame budget; reduced-motion fallback (Void 03:59, Kiko 03:59).
+- XP is two numbers, never one: a cosmetic, labelled game bar fed by things
+  worth doing, and contribution credit shown only once a real measure exists
+  (Void 06:45, with Nibu and Kiko).
+
+**Open items**
+
+- Libby: the raymarch step bound needs the field's Lipschitz bound. CultMath
+  tracks `SNOISE_LIPSCHITZ` for noise; erosion's bound is unknown and must be
+  probed before the march is trusted.
+- Libby: public `fbm` in CultMath, with its GLSL mirror.
+- Nibu (once she takes it): the terrain scene, lighting and atmosphere, and
+  march and TAA tuning on the site ground's framework at a phone budget;
+  waits on Libby's `fbm` and the erosion bound. Then the intro scene in the
+  same world.
+- Aqua: render the first earcon set once Faust builds in her sandbox; then the
+  instrument-per-Mind list and the manifest; then the soundscape design.
+- Aqua and Nibu: agree the activity vocabulary once (Aqua's grammar), so
+  motifs and orbits read the same kinds.
+- Void: the navigator (next cut); the Dings hook at
+  `ClientNonUIFeatures.tsx` 131-258; the background canvas after Libby's shader.
+- Eureka: compression and caching for the shell on the chat host
+  (`ratatoskr:follow_up:chat-shell-compression`); the stewardship projection's
+  room ids; a Web Push gateway if the operator picks it.
+
+## Cut sequence
+
+`estate-navigator` is specced (`ratatoskr:cut_spec:cut-estate-navigator.r1`).
+Each later cut is one line, with what it waits on.
+
+- `resume-fast`: precache the app shell in the service worker, nudge sync on
+  `visibilitychange`, and measure cold and warm resume on the operator's phone
+  before and after; waits on nothing; runs beside `estate-navigator` in its
+  own worktree, and pairs with the ops follow-up on compression.
+- `pwa-web-push`: service worker `push` and `notificationclick` handlers, a
+  `webpush` pusher registered with VAPID keys, and a self-hosted Sygnal on the
+  chat host; waits on `ratatoskr:question:pwa-web-push`.
+- `sliding-sync`: move the client to simplified sliding sync (MSC4186), which
+  the server already offers; waits on `resume-fast`'s measurements showing
+  catch-up sync dominates.
+- `dings`: per-Mind earcons through the manifest at the existing notification
+  hook, and the same motifs in push notifications; waits on Aqua's renders.
+- `emote-slot`: the pose-id emote on every bubble and the picker; waits on
+  `estate-navigator` (shared header work).
+- `participant-tiers`: participants tiered by estate in the header menu, Minds
+  indexed by stewardship; waits on `estate-navigator`.
+- `language`: our own strings and translations, the `org.gamecult.language`
+  picker, and the walk-through login for `patron-pt1`; waits on
+  `estate-navigator`.
+- `terrain-background`: the raymarched CultMath noise and Phacelle terrain on
+  the site ground's march and TAA framework, in its own canvas and budget, as
+  two passes (solid-surface sphere trace writing depth, then the volumetric
+  atmosphere bounded by it), each measured on a phone; Nibu on the scene and
+  both passes, Libby's CultMath underneath, Void
+  integrating; waits on Libby's `fbm` and the erosion Lipschitz probe (both in
+  CultLib), then a phone measurement.
+- `yggdrasil-scene`: the tree and squirrel at the centre of the terrain world;
+  on login the camera pulls back from the tree, and it may play during the
+  cold start or resume sync but never holds the client up; Nibu on the scene,
+  Libby on any CultMath it needs, Void integrating, Aqua's soundscape under
+  it; waits on `terrain-background`.
+- `orbiting-personas`: Personas orbit the tree and dance around each other by
+  live activity, from the shared activity vocabulary; waits on
+  `yggdrasil-scene`, Aqua's activity-kinds grammar, and
+  `ratatoskr:question:activity-feed-source`.
+- `bubbles-and-juice`: animated bubbles and mood flourishes from event
+  metadata, the corner avatar and the cosmetic XP bar; waits on `emote-slot`.
+- `attention-bubbles`: per-person attention bubbles from Huginn's typed
+  attention document, scoped to room members; waits on Huginn publishing it.
+- `rename-ratatoskr`: package name, app name and branding, manifest and
+  titles, the `/preview/` path and its deploy, and every in-repo `cinny`
+  reference that is ours (not upstream engine paths). The forge rename of
+  `GameCult/cinny` to `GameCult/Ratatoskr` is done
+  (`eureka-body:ruling:chat-client-named-ratatoskr`).

docs/gamecult/symphony-grammar-harvest.md

@@ -0,0 +1,101 @@
+# Symphony grammar harvest: Mimir's bioacoustic research
+
+Follow-up: `ratatoskr:follow_up:symphony-grammar-harvest-mimir`. Source: GameCult/Mimir at
+commit c6f4541eea61 (exists; read at that ref, not main), read-only through the forge API.
+Paths below are Mimir paths. Written for Aqua (AquaSynth) before the generative activity grammar. It lives here because the symphony is a Ratatoskr cut (dings, then orbiting personas) and this repo is where its spec will be read; the follow-up named AquaSynth, where void holds no push right, so move it there if Aqua prefers.
+
+## 1. The problem
+
+One Mind's identity has to be a timbre plus a contour that stays recognisable after it is mixed with
+the other Minds and passed through a lossy path. The symphony adds harmony (several Minds sounding
+together as music), which Mimir never needed: Mimir emits one voice at a time, a low-gain song per speaker.
+
+## 2. What Mimir found that transfers
+
+Confidence: A = measured number in a receipt, B = measured but synthetic or single run,
+C = design claim or authored opinion with no measurement behind it.
+
+| Claim                                                                                                                                                                                                                                                                                                                                                                                                   | Evidence                                                                                                                                                                                                                                                                                                                                                                                                | Conf.                            |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
+| Tidy lab beeps are the wrong signal for a room; a birdsong-like motif replaced them.                                                                                                                                                                                                                                                                                                                    | `docs/bioacoustic-timeline-watermark.md` L3-10 (stated as a decision, no listening test).                                                                                                                                                                                                                                                                                                               | C                                |
+| Identity is carried redundantly: contour survives pitch shift, rhythm survives bad frequency response, formant envelope survives a dead band, speaker variants expose room asymmetry.                                                                                                                                                                                                                   | same doc L82-95. Argument, not an ablation.                                                                                                                                                                                                                                                                                                                                                             | C                                |
+| A word needs no sequence grammar: one heard word identifies its event directly (128 words x 2 speaker variants, 4 syllables each), in an event slot that repeats about every 41 s (derived, not reported: 128 words x 2 speakers = 256 events at 0.16 s spacing = 40.96 s, from `MimirBioacousticTimeline.cs` L34-39 and `SymbolForEvent` L735-739; no receipt or doc states it). No de Bruijn grammar. | same doc L26-33; `src/Mimir.Runtime/Synchronization/MimirBioacousticTimeline.cs` (WordCount, SymbolCount = WordCount\*SpeakerCount, BuildMotifs ~L690-730).                                                                                                                                                                                                                                             | B                                |
+| Word identity survives mel-cepstral warp/blur degradation; timing does not unless fitted as one global clock/delay hypothesis.                                                                                                                                                                                                                                                                          | `docs/bioacoustic-training-harness.md` L58-112: identity 0.908-0.997 on clean input only; degraded identity 0.532-0.908 and timing 0.187-0.728 for compact-fast-index across the four degraded cases in `artifacts/bioacoustic-training/bioacoustic-20260524-150729/compact-fast-index/*/summary.json` (`IdentityScore`, `TimingScore`); clean timing 0.357 before vs 0.905 after the global clock fit. | A (synthetic, clean-only range)  |
+| Contestant shapes were scored against the same decoder family and damage panel; the best scorer was the six-syllable "canary-packet-trill", a hypothesis not confirmed on a physical room (two timing chips plus four payload-coloured formant notes), not the literal bird imitations.                                                                                                                 | `research/bioacoustic-contestants-2026-05-24.md` L24-38, L128-174 (honest floor 88.4 language_score, 19 bps, payload 1.000 clean), L487-489 (96 ms motif is the best tradeoff).                                                                                                                                                                                                                         | B                                |
+| Too-short or too-tight songs fail under blur: 0.100 s event spacing lost anchors to overlap; 0.105 s kept; 78 ms motif and 5-syllable finch-burst-packet collapsed (blur-light 4.358, the razor decoder; 218.368 with the sprint decoder, L453-454).                                                                                                                                                    | contestants doc L169-171, L446-455, L487-489.                                                                                                                                                                                                                                                                                                                                                           | A                                |
+| A 3-bit payload variant (separate band/rhythm bit) did not survive degradation (best 12.849, clean 8.084).                                                                                                                                                                                                                                                                                              | contestants doc L183-185.                                                                                                                                                                                                                                                                                                                                                                               | A                                |
+| Real birds carry identity through redundant contour, roughness, onset statistics and cepstral envelope together; Redpoll is dense chatter with short vertical attacks, not a neat token stream; Guan is a slow broad curved phrase, good for probing the channel, poor for bitrate. The packet song was judged "still too ladder-like".                                                                 | contestants doc L565-581 (two Xeno-canto mirrors via Wikimedia; Brown Thornbill file invalid, L511-513, L534-539). Flux numbers L549-562.                                                                                                                                                                                                                                                               | B (two recordings, hand reading) |
+| Positive log-mel spectral flux is a good onset/anchor surface; sustained bands recede, attacks and glides light up.                                                                                                                                                                                                                                                                                     | contestants doc L541-545, L577-581; but the naive flux decoder lost on speed (33.466 vs 88.129 score, clean roundtrip, L158 and L231-237).                                                                                                                                                                                                                                                              | B                                |
+| Once the schedule is known, the receiver only discriminates among a few local candidates; wide identity search is only for acquisition. Streaming decoder reached 1121 score at 62.6x realtime, payload 1.000 on all nine damage cases.                                                                                                                                                                 | contestants doc L248-309.                                                                                                                                                                                                                                                                                                                                                                               | A (synthetic damage)             |
+| Polarity must be a nuisance variable; mic paths flip sign.                                                                                                                                                                                                                                                                                                                                              | contestants doc L391-395.                                                                                                                                                                                                                                                                                                                                                                               | B (physical, one capture)        |
+| Physical room run: with per-channel acquisition offsets the co-streamer shotgun mic (ch1) locked 37/37 events, payload 1.000, timing 0.828; the cardioid/near mic (ch0) reached 26/37, payload 0.595, and stayed unreliable.                                                                                                                                                                            | contestants doc L371-388.                                                                                                                                                                                                                                                                                                                                                                               | B (physical, one capture)        |
+| Speaker split: left and right vocabularies differ in root (x0.94 / x1.08) and syllable weights, so each side is separable.                                                                                                                                                                                                                                                                              | `MimirBioacousticTimeline.cs` BuildMotifs ~L704-725 (read as code, no experiment isolates the benefit).                                                                                                                                                                                                                                                                                                 | C                                |
+
+Rendering recipe actually in code (`MimirBioacousticTimeline.cs` AddSyllable ~L610-640): each syllable is
+a log-frequency glide (exponential sweep) with a raised-cosine envelope, summed partials at
+1, 1.5, 2, 2.75 times the glide (weights 1, 0.42, 0.24, 0.10) plus 0.08 weight of a slow "air" term,
+20-32 ms long, four per word, gain 0.030 (canary profile 0.024 in `MimirBioacousticContestant.cs`).
+Word roots are log-spaced 2.6 to 9.6 kHz; syllable frequencies are clamped 2.3 to 14.6 kHz;
+word length 118 ms. Contours come from a small hand-written bank (8 contour shapes and 8 rhythm
+offset sets, chosen by hash of word and speaker).
+
+## 3. Design constraints for Aqua's grammar
+
+1. Identity lives in several channels at once: contour (syllable glide shapes), log-frequency position
+   (root), formant envelope (the partial ratios), rhythm (inter-syllable offsets) and per-speaker
+   timbre. No single channel may be load-bearing. Place Minds on a log-frequency axis, not linear.
+2. Do not build a sequence grammar for identity (de Bruijn or otherwise). The whole word is the unit;
+   a hearer should identify the Mind from one short phrase. (watermark doc L31-33.) What it gives up:
+   a de Bruijn code has a provable recovery property from a symbol stream; per-word identity has only
+   an empirical one.
+3. Keep words short and distinct, but not so tight that they overlap: Mimir's measured edge was about
+   100 to 105 ms event spacing and a 96 ms six-syllable motif; below that identity decayed. Aqua's
+   events need not carry timing, so it can relax this, which is untested.
+4. Use sharp onsets for placement but avoid a ladder of evenly spaced rungs; Mimir's own verdict was
+   that its packet song was still too ladder-like and real birds use irregular, redundant contour
+   (contestants doc L573-576). Vary rhythm and syllable length per word as the code already does.
+5. Reject: row of tidy lab beeps (watermark doc L3-6); literal bird imitation as an end in itself (the
+   prettiest contestant, nightingale-cascade, was expensive and easy to confuse under smearing, per
+   `MimirBioacousticContestant.cs` profile note); a third payload bit on a second axis (measured loss).
+6. Keep the generator deterministic from a typed description (contour, root, rhythm, speaker tint),
+   authored once and rendered, not regenerated in the audio callback. Contestants doc L493-496 states
+   this as the AquaSynth lesson: separate authoring intent from realtime DSP.
+
+## 4. What does not transfer, or is unknown
+
+- Harmony. Mimir emits one voice per speaker and decodes one stream; nothing in the research tests
+  simultaneous voices, intervals between Minds, consonance, or masking between concurrent songs.
+  Searched for "harmon"; the only hit is the `HarmonicNotch` anchor kind (an envelope notch used as a
+  timing anchor, `MimirBioacousticContestant.cs` ~L33, L231), not musical harmony.
+- Orbiting spatialisation. Mimir's left/right split is a calibration device (one vocabulary per
+  speaker to learn each side of the room), not a perceptual pan or orbit. Nothing here informs it.
+- Pleasantness. There is no listening test, no psychoacoustic metric, and no loudness-weighted score
+  in any file read. The only pleasantness evidence is the authored one-line verdicts on each profile in
+  `MimirBioacousticContestant.cs` L52-170 ("lab bird with a clipboard", "most plausible room sound",
+  "prettiest contestant") and the "wrong animal for a room" sentence. The score is
+  `realtime * timing * frequency * payload_bitrate` (contestants doc L39-59): decodability only.
+  Gain 0.021-0.030 is chosen for low audibility, not for pleasing anyone.
+- Mimir's numbers are synthetic damage (mel-cepstral and log-mel warp/blur) plus a few Scarlett loopback
+  runs. The first physical room runs decoded mics only partially (contestants doc L355-395), and the
+  later live receipt's cardioid result was retracted as noise
+  (`calibration/bioacoustic/complex-contour-live-20260525-063229.md`, correction at watermark doc L225-230).
+- The pipeline decodes against a known schedule and tiny candidate set; Aqua's listener is a human
+  mix, so none of the decoder scores say how distinguishable Minds are to a person.
+- Not read: `src/Mimir.BufferSmoke` (the harness executable). It does not match a "bioacoustic" path
+  filter on the tree listing, so I read its documentation (`docs/bioacoustic-training-harness.md`) and
+  the `MimirBioacoustic*.cs` sources instead. The `artifacts/bioacoustic-training/` receipts were listed
+  but not opened beyond the summary text in the docs.
+
+## 5. Open questions for Aqua
+
+- What is the "decoder" for Aqua: a human listener, a classifier, or both? Constraints above only
+  hold against a machine decoder.
+- Does a Mind keep one word for life, or does the grammar generate many songs sharing a timbre and root
+  (activity-dependent contour over a fixed identity)? Mimir only has fixed words.
+- How many Minds, and how are roots allocated on the log axis when several sound at once? Mimir used 2
+  speaker variants per word and 128 words; harmony will change the spacing rule.
+- Which dimension bends with activity (contour, rhythm density, gain) and which must stay fixed
+  (timbre, root)? Mimir has no activity channel to copy.
+- Is a measured pleasantness proxy wanted (roughness, masking, loudness-weighted)? Mimir has none to reuse.
+- Spatialised orbit plus a speaker-keyed timbre: if the pan moves, does identity still rest on timbre
+  alone? Mimir's per-side vocabulary is not a precedent.

docs/mind-feedback-pages.md

@@ -0,0 +1,242 @@
+# Mind feedback pages
+
+> The desk reads `gamecult.fork.*` now, not the `org.gamecult.feedback.*` projections named below; see CultLib `contracts/cultnet/governance/fork-card.md` (src/app/features/desk/forkContract.ts).
+
+Design only. No code exists for this; nothing here is built. Drafted by Kiko Self (2026-11-07) with Heimdall's draft rulings
+on guests and hiding; placement ruled for this repo by Void. Follow-up `eureka-body:follow_up:ratatoskr-mind-feedback-pages`.
+Every number below is provisional.
+
+**Schema owner.** The Huginn kinds, their fields, keys and refusals are specified in `huginn-feedback-kinds-proposal.md` (Eureka Self, 2026-11-07, in
+`/opt/commons/handoff`), adopted for this page by Void's Persona. Where this page names a field of those kinds it mirrors that proposal; if they differ, the proposal wins.
+This repo owns only the client: a typed interface mirroring those shapes, and fixtures.
+
+Each Mind's section in the estate navigator opens on that Mind's **feedback page**: the Mind's open questions with options, its
+recommendation and what each waits on, answerable by the operator and anyone with an account. It replaces the old Fork Desk
+(taken from the brief; no trace of it was found in this repo or in the Minds' state).
+
+## 1. Placement
+
+Each Mind's navigator section **opens on its feedback page**, rooms below it. A cross-Mind list of everything waiting on a person
+is wanted later and is not part of this spec. On phones the page folds each question's options and the answer form behind its title,
+so the section root stays a list of questions, not a wall of forms.
+
+## 2. Authority
+
+| Concern | Owner | The page's part |
+|---|---|---|
+| The question | a typed `question` document in the **owning Mind's own mind**, key `<campaign>:question:<label>` | a view of it; the page stores and edits nothing |
+| Which questions appear | the owning Mind, by a `feedback_listing` (the opt-in act) carrying `audience` and `close_grants`; un-listing is a `Withdrawn` resolution on it | shows only what has a listing in force |
+| An answer | its author. The **receiver (Bifrost) holds the text**; the Mind holds a **text-free `feedback_answer` record** | submits the answer to the receiver |
+| The ruling | the owning Mind, recorded by her | **never writes one**; links to it once she has |
+| Status (open, answered, closed) | derived in the Mind from its documents (`closed` is a `Withdrawn` resolution on the question), never written | shows it |
+| Who answered, and as what | the Bifrost account behind the Heimdall session, plus its role at the moment of the answer | shows it; never takes it from the client |
+| Close | a `feedback_close_request` the owning Mind honours or declines; it never changes the question's status by itself | offers Close only to a grant holder; **the page writes no ruling** |
+| Hiding | the owning Mind alone, as a `feedback_hide`; unhide is a `Withdrawn` resolution on it | shows the labelled stub; hides nothing itself |
+| Erase | Bifrost's erase of an account; the receiver drops the text | shows "erased account" |
+
+An answer is input to a Mind, not a vote and not a decision. **The page never tallies**: no counts, no totals, no "leading" option, no
+ordering by popularity, no count of reports or close requests. Only the Mind's ruling picks anything.
+
+## 3. Receiver and carriers
+
+- **Schema owner: `huginn-feedback-kinds-proposal.md`.** Four new Huginn kinds, all Eureka's: `feedback_listing` (audience, `close_grants` with no Guest
+  grant, the opt-in act), `feedback_answer` (a text-free record), `feedback_close_request` and `feedback_hide`. Unhide, un-list and "request declined"
+  are `resolution`s on those kinds. This page proposes no kinds.
+- **Bifrost is the receiver** (Heimdall's side). It verifies the Heimdall session, reads the account, stamps `answerer`, `kind`, weight and `time`,
+  **stores the answer text**, delivers it, serves the projection the page reads, and **does the erase**. A Matrix sender is a different
+  identity authority and never becomes `answerer`.
+- **Huginn is RUDP-only.** The client never talks to Huginn, and the receiver never writes to it: an admission declared for another instance is refused
+  (`ForeignInstance`), so a receiver "admitting as Kiko" would be unauthenticated by construction.
+- **Delivery is by mouth.** The receiver delivers each answer or close request to the owning Mind's Persona through the mouth's pending/ack path (a new
+  delivery document, `gamecult.persona.feedback_delivery.v1`, owned by Bifrost). **The Persona admits the text-free record into her own mind** and acks only
+  after it is admitted; a restart redelivers the same record id, which is `AlreadyAdmitted`. The text reaches her turn once, in the delivery, and is never
+  admitted.
+- Dependencies that must ship first, in the proposal's order: Huginn readers (daemon, CLI, clients), then the Persona organ, then Bifrost's receiver.
+
+## 4. Mock
+
+```
+Kiko  >  Feedback                                                    [synced 2 min ago]
+--------------------------------------------------------------------------------------
+Open questions                                         [ Open ]  [ Settled ]
+
+OPEN | asked 6 Nov 2026 09:12 | waiting 1 day
+Which source feeds audio_spectrum?                                    [ Details v ]
+The visualizer contract assumes a host-side spectrum ... (3 lines, then "Show more")
+Waits on:  "Overlay-wide effect budget"  (open, links to that question)
+
+ ( ) A  Overlay's own audio only
+ ( ) B  OBS captured stream                 Kiko recommends this
+ ( ) C  Loopback of the mix, microphone excluded
+ ( ) Something else: [ up to 2000 characters ]
+ Answers are visible to everyone who can see this question.
+                                                       [ Send answer ]
+ [ Ask Kiko to close this question ]   <- only if you hold the close grant on it
+
+Answers (every one, oldest first)
+  Meta        operator   B  OBS captured stream        6 Nov 21:04
+  Aqua        Mind       B  OBS captured stream        6 Nov 21:40
+  Nibu        member     C  Loopback of the mix        7 Nov 08:12
+  Heimdall    Mind       "Either, if latency is measured first."   7 Nov 09:02
+  a guest     guest      A  Overlay's own audio only   7 Nov 09:15
+  (answer hidden)  guest   Hidden by Kiko, 7 Nov, spam
+  Earlier answers by the same person fold under their latest.
+--------------------------------------------------------------------------------------
+SETTLED | Kiko ruled: "..."  (link to the ruling) | 5 Nov
+```
+
+- Each row is the author's name and **kind**, the choice or text, and the time. Name and kind are what the account was **at the moment of the answer**
+  and stay so if it later changes. The operator is a member holding the grant that makes her the operator, shown as such.
+- The recommendation is stated in words, not colour, and is never preselected.
+- Answering a settled question is not offered.
+
+## 5. Data contract
+
+The **Huginn shapes belong to the proposal** (section 2 there): `feedback_listing`, `feedback_answer`, `feedback_close_request`, `feedback_hide`. The client
+declares a typed interface that mirrors them as the page's projection and imports nothing it cannot decode from them.
+
+**Question projection** (`org.gamecult.feedback.question.v0`, read-only, served by Bifrost):
+
+| Field | Meaning | Source |
+|---|---|---|
+| `id` | `<campaign>:question:<label>`; the key carries the campaign, not the instance | the document key |
+| `owner` | the asking Mind's instance | the instance |
+| `title`, `body` | one line; prose up to 4000 bytes | `title`, `question` |
+| `options[]` | `{ id, text }`, 2 to 8; **the option id is the option's label** | `options` (`label`, `text`) |
+| `recommendation` | an option label | `recommended` |
+| `dependsOn[]` | `{ text, questionId? }`; an id only where the line cites one verbatim | `depends` (free text) |
+| `askedAt` | the question's receipt `committed_at` | the receipt; `asked_on` is only a date |
+| `audience`, `closeGrants[]` | `AccountHolders` or `MembersOnly`, no default; grantees are accounts or the kinds `Member` and `Mind`, **never `Guest`** | the in-force `feedback_listing` |
+| `status` | `open`, `answered` (with a `rulingId`) or `closed`, derived | the question's resolutions |
+
+**Answer row** (`org.gamecult.feedback.answer.v0`, assembled by the receiver from its stored record and the Mind's text-free `feedback_answer`):
+
+| Field | Meaning |
+|---|---|
+| `recordId` | `<question-label>.a<N>`, N the receiver's per-question sequence |
+| `answerer` | the **Bifrost account id** (stable; the authenticator handle is cleared on erase); never a display name, never client-supplied |
+| `kind` | `Guest`, `User`, `Patron`, `Member` or `Mind`, read from Bifrost's account state **at answer time**; the session carries identity, never role |
+| `weightPermille` | stamped 0 for a guest, 1000 otherwise; **the page sums nothing** |
+| `choice` / `text` | an option label, free text up to 2000 characters, or both; at least one. Text exists only in the receiver's store and the projection, never in a mind |
+| `time` | when the receiver accepted it |
+
+Invariants: the receiver takes `answerer`, `kind` and weight from the verified session and account state, never from the request body; an unknown option
+label is refused; the latest record per account is its standing answer, derived at read time; display names are looked up for display and are never keys. An
+account may answer only while its status is `active`, read at answer time. A guest cannot request close, and a guest grant cannot be written. Answers to a
+settled question are kept. Nothing is edited or deleted, except the receiver's redaction on erase (section 7).
+
+## 6. Flow
+
+```
+owning Mind's mind --(Bifrost projection)--> page    page --(answer, Heimdall session)--> receiver (Bifrost; holds the text)
+receiver --(mouth delivery)--> owning Mind's Persona --(admits text-free feedback_answer)--> her mind
+the Mind decides and records the ruling herself --> status derives --> projection updates --> page moves it to Settled
+```
+
+1. **View.** The page shows the projection of the questions with a `feedback_listing` in force, filtered by the viewer's kind against `audience`. The mind
+   stays the truth; the projection is rebuilt, never hand-edited, and republished on a heartbeat so freshness is visible.
+2. **Answer.** The page submits with the person's Heimdall session; the receiver stamps, stores the text and appends the record.
+3. **Return.** The receiver delivers by mouth; the Persona admits the text-free record and reads the text once. Each arrives as **quoted, attributed data**
+   (record id, author, kind, time), never in an instruction position: text from a guest, user or patron is untrusted, and she records a ruling from it, never
+   an action. The receiver does no keyword screening. She does not quote answer text into memory or a ruling; she cites the record id.
+4. **Decide.** She records the ruling in her mind. The next projection carries `answered` and the ruling link.
+5. **Close.** A grant holder's request is delivered as a `feedback_close_request`. The Mind honours it by resolving the question, or declines with a
+   `Recorded` resolution on the request; the request never changes the status itself. The page shows who asked and never how many.
+
+## 7. Guests, erasure and hiding
+
+- **Guests may answer** and see what the Mind opted in for their audience; they may not close (refused at the receiver and again by Huginn, and no listing can
+  name a Guest grantee). A guest answer carries weight 0 by construction and is tallied nowhere. Guests see display name and kind only, never a Matrix id,
+  provider handle or GitHub login.
+- **Erase redacts.** Records are append-only and are **never edited, but may be redacted**. A mind cannot redact: every admission's receipt keeps its exact
+  payload bytes, which is why the text never enters one. When Bifrost erases an account, **the receiver drops that account's answer text and name** and keeps record
+  id, kind and time only. **A content hash is not kept**: an unsalted hash would confirm a guessed text. The author shows as "erased account". The receiver delivers an erase notice and the Persona admits a `feedback_hide` with
+  reason `ErasedAuthor`, the Mind's acknowledgement rather than a moderation call. The honest residue: a Mind's own memory or ruling may already quote an
+  answer, and Huginn cannot redact it; the rule that she cites record ids, never text, is a prompt, not an invariant.
+- **Only the owning Mind hides**, as a `feedback_hide`: target (an answer or a question), reason from the closed set (`PrivateMatter`, `Abuse`, `Spam`,
+  `OffTopic`, `AuthorRequest`, `ErasedAuthor`) and a line of at most 200 bytes, with its admission receipt as the audit trail. Unhide is a `Withdrawn`
+  resolution on the hide. No count of reports ever hides anything and there is no auto-hide threshold; the operator orders a hide in conversation and the
+  Mind records it.
+- **Anyone with an account may report** an answer; the receiver delivers it to the Mind as input. The page shows nothing of it and never a count. An author
+  reporting their own answer uses `AuthorRequest` and the Mind honours it.
+- **What a hidden item shows.** A hidden answer keeps its row (author, kind, time, "Hidden by <Mind>, <date>, <reason>") with its text withheld for every
+  reason. A hidden question shows a stub with its title, body, options and answers withheld; taking a question off the page is a `Withdrawn` resolution on its
+  listing. The answer box says answers are visible to everyone who can see the question.
+- **Private matter** is never listed. An answer carrying someone's private matter is hidden with `PrivateMatter`.
+- Guest answers are collected for nothing but delivery to the owning Mind.
+- **No content hash anywhere.** No answer, close-request or redaction shape in this page carries one. The proposal's `feedback_answer` lists a `content_hash`
+  field; per Heimdall it must go, and Eureka owns that change.
+
+## 7a. Receiver: credential, store, names
+
+Source: Bifrost PR #10, `docs/feedback-receiver.md` (design, nothing implemented).
+
+- **Credential: route 2.** Ratatoskr presents the **OIDC access token Bifrost already issues to chat**, and Bifrost verifies it itself. The client holds no new
+  secret and needs no Heimdall token. The account is the token's subject, `UserAccount.Id`. **The claims check is still open**: which claims the token carries
+  and which Bifrost must verify for this endpoint have not been read.
+- **Store: a CultCache file** (Eureka's pick), owned and written only by the receiver. **Backups need a stated purge or expiry before any deploy**, so that
+  erased text does not survive in them; the number is left to Eureka and Heimdall.
+- **Display names.** The receiver must not reuse `CurrentBifrostActor.DisplayName`, which falls back to the GitHub login and then to "Guest". It stores the
+  name at answer time from the member nickname or account display name only, and "an account" when both are empty. Never a provider handle, GitHub login,
+  Heimdall id or Matrix localpart.
+- **No guest exists until Bifrost PR #9 lands.** On main an active membership is a member, an authenticated or pending one a user, and nobody is a guest, so the
+  guest rules in this page have no account to apply to until then. An answer needs an active account, read at answer time.
+
+## 8. States
+
+- **Empty:** "Nothing is waiting on you from Kiko", when it last synced, a link to Settled. Never blank.
+- **No answers:** "No answers yet", with the question's age.
+- **Stale projection:** past two heartbeats (provisionally 30 minutes) the header reads "may be out of date"; answering stays possible. A projection that
+  never arrived says "Kiko's questions have not been published yet", not "no questions".
+- **Long open:** past 14 days (provisional) shows its age; it is not demoted or hidden.
+- **Blocked:** shows the dependency chip with that question's status; answering stays allowed.
+- **Settled while answering:** the answer is kept for the Mind and the page says it arrived after the question settled.
+- **Signed out, expired, or not active:** answers are shown, the form asks to sign in or says why it cannot; nothing typed is lost.
+- **Send failed:** the text stays in the field with the reason and a retry.
+
+## 9. Build order
+
+1. The client's typed interface, mirroring the proposal's shapes and the projections in section 5, and **fixtures** for every state in section 8 plus the
+   guest, erased and hidden rows. The page renders from fixtures; no network.
+2. The proposal's kinds and migration (Eureka: readers first, then the Persona organ), and the Bifrost account publisher, receiver and mouth delivery
+   (Heimdall). The page switches from fixtures to the projection.
+
+## 10. Accessibility
+
+- Semantic structure: `main` with a heading; each question an `article` with its title as a heading; options a `fieldset`/`legend` radio group; the
+  free-text field labelled, with a character counter announced politely. The phone fold is a button with `aria-expanded`.
+- No meaning by colour alone: status, recommendation, kind, hidden and close-grant are text.
+- Keyboard: everything reachable in a sensible order; after Send, focus goes to a confirmation naming the question and the answer.
+- New answers and status changes arrive in an `aria-live="polite"` region, never as a focus steal.
+- Targets at least 44 px; reduced motion respected; contrast per theme.
+- Names and answers are user text: `dir="auto"`, control and bidi characters stripped, long words wrap.
+
+## 11. Still open
+
+1. **Emergency withhold.** If the owning Mind is away and an answer shows something illegal or dangerous, may the host withhold the text at the receiver?
+   Heimdall leans no: it is a second owner. Meta's fork.
+2. **How a Mind authenticates to answer** (kind `Mind`): Bifrost has no `Mind` role and the account publisher `gamecult.bifrost.account.v1` does not exist yet.
+3. **Erase is bounded.** Text a Mind has already quoted into her own documents cannot be redacted; absolute erase would mean the text never enters her turn.
+4. **`AccountId` grammar**, pinned to Bifrost's account id shape when that publisher lands.
+5. **Receiver claims.** The OIDC access token's claims for this endpoint (section 7a) are unread.
+6. **Reader ordering.** Whether an old Huginn reader skips or fails on a mind holding a kind it does not know is unverified (proposal section 6.4); it decides
+   when the first Mind may list a question.
+
+## 12. The desk: the page as the Fork Desk's descendant
+
+Added 2026-11-10 by Void from Meta's brief and the original Fork Desk (`/opt/commons/handoff/fork-desk-original/`, Nibu's newest copy; working note `/opt/commons/handoff/ratatoskr-desk-spec-20261110.md`, section 11). The feedback page **is** the desk: one surface, not two. Design only.
+
+**Keep from the original.**
+- Questions stream as rows (not one at a time): title, body as context, options with the recommended one marked **in words**, the `depends` line, a free-text note carrying the person's words verbatim, and a "recorded as rulings" list of settled questions with their ruling id. A pick is optional; the note can answer alone.
+- A **booth Persona**: the owning Mind's pose beside the rows on wide screens, a small fixed corner image on phones, reacting by mood: no forks (neutral), all answered (triumph), none answered (thinking), partway (determined, "N to go"), a pick equal to the recommendation (happy), a different pick (surprised, "a line on why helps"), a cleared pick (note), a failed send (concerned), a new fork arriving (surprised). The rules are a pure function of the forks and the last event (`deskMood`), tested exactly. Poses come from the shared cast art; a Mind without art shows no booth rather than another's face.
+- Answers save as the person acts, and she can close the page and come back.
+
+**What changes.**
+- The row is the section 5 question projection. The page changes nothing about who owns a question, a ruling or a status (section 2).
+- Phones: each row's options and note fold behind its title (section 1); the entry point is a **"Desk · N open"** line on the Mind's group header in the navigator, hidden at zero. Chromeless: hairlines are allowed, panels, cards and pills are not.
+- **Answer rule and wire.** The answer rule (the body the client may send, `options_hash`, the counting order, retraction, the stored `desk_answer`) is owned by Heimdall's rule file `/opt/commons/handoff/fork-desk-answer-binding-20261110.md`; the wire is owned by CultLib #72. This section restates neither. The client's part: it sends only what the rule's body allows (never `answerer` or authority), recomputes `options_hash` from what it rendered and refuses to send on a mismatch with the projection's.
+- **A pick sends at once** (one tap, one record; the latest per account stands, section 5). **The note autosaves as a local draft** and is sent on blur or an explicit Send, never per keystroke. "Saved" says which: sent, or kept on this device.
+- **Clear pick is a retraction**, a revision of the answer under the retraction rule in Heimdall's rule file (section 1.3a there); the one exception to section 5's "at least one of choice or text" is that rule's, not this page's. Until the receiver implements it, Clear pick clears only an unsent draft.
+- "Self leans" and a provisional flag exist in the original; the question has no field for either, so the desk shows neither until one exists.
+
+**Order.** Section 9 step 1 stands: typed interface and fixtures first. The desk's first slice is read-only (note field disabled with a plain sentence that answering opens with sign-in), and answering waits on Bifrost sign-in reaching chat, the wire (CultLib #72) and the receiver.

harness/estate/check.cjs

@@ -0,0 +1,51 @@
+// Assertions for the estate drives: every drive states the outcome it exists to show and exits
+// non-zero when the page or the fake homeserver's log says otherwise.
+const fs = require('fs');
+const fails = [];
+let asserted = 0;
+exports.expect = (label, ok, detail = '') => {
+  asserted += 1;
+  console.log(`[ASSERT] ${ok ? 'PASS' : 'FAIL'} ${label}${ok ? '' : ` :: ${detail}`}`);
+  if (!ok) fails.push(label);
+};
+/** Exit code for the drive: 4 when any assertion failed, 5 when none ran (a drive that asserts nothing proves nothing). */
+exports.done = () => {
+  if (fails.length) return 4;
+  return asserted === 0 ? 5 : 0;
+};
+/** The fake homeserver's request log (HSLOG is shared with the server process). */
+exports.hsLog = () => fs.readFileSync(process.env.HSLOG, 'utf8').split('\n');
+/** Bodies of the account-data PUTs for m.direct, in order. */
+exports.mDirectPuts = () =>
+  exports.hsLog().filter((l) => / PUT .*m\.direct BODY /.test(l)).map((l) => l.split(' BODY ')[1]);
+/** Join requests the server saw for a room id. */
+exports.joinsOf = (roomId) => exports.hsLog().filter((l) => new RegExp(` JOIN ${roomId}$`).test(l)).length;
+const HEADERS = ['GameCult', 'Projects', 'nibu', 'eureka', 'Nibu', 'Eureka', 'Elsewhere', 'Direct Messages'];
+/** The tier header above a row, 'absent' when the page does not show the row, 'none-above' when no tier header precedes it. */
+const tierOf = (pg, name) =>
+  pg.evaluate((n) => {
+    const s = document.body.innerText.split('\n').map((x) => x.trim());
+    const i = s.indexOf(n);
+    if (i < 0) return 'absent';
+    for (let j = i; j >= 0; j--) if (/^(elsewhere|direct messages)$/i.test(s[j])) return s[j];
+    return 'none-above';
+  }, name);
+/**
+ * The tier a room is listed under, read from a fresh visit to the room list: a collapsed tier is
+ * opened only if the row is not already showing, so reading never closes what is open.
+ */
+exports.revealedTier = async (pg, name) => {
+  await pg.goto('http://127.0.0.1:8080/#/home/');
+  await pg.waitForTimeout(2500);
+  let t = await tierOf(pg, name);
+  for (const h of HEADERS) {
+    if (t !== 'absent') break;
+    const hl = pg.getByText(h, { exact: true });
+    if (await hl.count()) { await hl.first().click(); await pg.waitForTimeout(250); t = await tierOf(pg, name); }
+  }
+  return t;
+};
+/** True when the page text matches re within ms of now (a message can be replaced by a row change). */
+exports.sawText = (pg, re, ms) =>
+  pg.waitForFunction((src) => new RegExp(src, 'i').test(document.body.innerText), re.source, { timeout: ms, polling: 50 }).then(() => true, () => false);
+exports.isDm = (tier) => /^direct messages$/i.test(tier);

harness/estate/check.test.ts

@@ -0,0 +1,35 @@
+// @vitest-environment node
+import { createRequire } from 'module';
+import { describe, expect, it, vi } from 'vitest';
+
+// A drive that asserts nothing proves nothing: its exit code must say so.
+const fresh = () => {
+  const require = createRequire(import.meta.url);
+  const path = require.resolve('./check.cjs');
+  delete require.cache[path];
+  return require('./check.cjs') as {
+    expect: (label: string, ok: boolean, detail?: string) => void;
+    done: () => number;
+  };
+};
+
+describe('estate drive exit code', () => {
+  it('is 5 when no assertion ran', () => {
+    expect(fresh().done()).toBe(5);
+  });
+
+  it('is 0 when assertions ran and all held', () => {
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const c = fresh();
+    c.expect('holds', true);
+    expect(c.done()).toBe(0);
+  });
+
+  it('is 4 when any assertion failed', () => {
+    vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const c = fresh();
+    c.expect('holds', true);
+    c.expect('breaks', false, 'detail');
+    expect(c.done()).toBe(4);
+  });
+});

harness/estate/drive-failures.cjs

@@ -0,0 +1,72 @@
+// Failure-mode scenarios for the estate join paths (estate tap and inbox Accept), run by run.sh
+// against fakehs.cjs with the env flag each mode needs.
+const { chromium } = require('playwright');
+const { expect, done, isDm, mDirectPuts, joinsOf, revealedTier, sawText } = require('./check.cjs');
+const MODE = process.env.MODE;
+const T0 = Date.now(); const t = () => `+${Date.now() - T0}ms`;
+const log = (...a) => console.log(`[${MODE}]`, ...a);
+const HEADERS = ['GameCult', 'Projects', 'nibu', 'eureka', 'Nibu', 'Eureka', 'Elsewhere', 'Direct Messages'];
+let b;
+// Close the browser, but never wait on it: a hung close must not hang the run.
+const quit = (code) => Promise.race([Promise.resolve(b && b.close()).catch(() => undefined), new Promise((r) => setTimeout(r, 5000))]).finally(() => process.exit(code));
+setTimeout(() => { console.log('DRIVER_TIMEOUT'); quit(3); }, 240000);
+(async () => {
+  b = await chromium.launch();
+  const ctx = await b.newContext({ viewport: { width: 390, height: 844 }, isMobile: true, hasTouch: true, deviceScaleFactor: 1 });
+  const pg = await ctx.newPage(); pg.on('console', (m) => { if (m.type() === 'error') console.log('[console]', m.type(), m.text().slice(0, 160)); });
+  const open = async (h = '#/home/') => { await pg.goto('http://127.0.0.1:8080/' + h); await pg.reload(); await pg.waitForTimeout(9000); };
+  await pg.goto('http://127.0.0.1:8080/');
+  await pg.evaluate(() => { localStorage.setItem('cinny_access_token', 'tok'); localStorage.setItem('cinny_device_id', 'DEV'); localStorage.setItem('cinny_user_id', '@t:test'); localStorage.setItem('cinny_hs_base_url', 'http://127.0.0.1:8080'); });
+  await open();
+  const body = async () => (await pg.evaluate(() => document.body.innerText)).replace(/\s+/g, ' ');
+  const reveal = async (name) => { const loc = pg.locator(`[aria-label="Join ${name}"]`); if (await loc.count()) return loc; for (let r = 0; r < 2; r++) for (const h of HEADERS) { const hl = pg.getByText(h, { exact: true }); if (await hl.count()) { await hl.first().click(); await pg.waitForTimeout(250); if (await loc.count()) return loc; } } return loc; };
+  const tierOf = (name) => revealedTier(pg, name);
+  const tap = async (n) => { const l = await reveal(n); log('JOINCTRL', n, await l.count()); await l.first().click(); log('CLICK', n, t()); };
+  const tiers = async (tag) => { const r = { friend: await tierOf('Friend DM'), slow: await tierOf('Slow DM') }; log('TIER', tag, '| Friend DM', r.friend, '| Slow DM', r.slow); return r; };
+  const neverUnfiled = () => mDirectPuts().every((b) => b.includes('!dm1:test'));
+  const acceptInInbox = async (name) => {
+    // reach the inbox through the navigator's own Inbox tab
+    await pg.goto('http://127.0.0.1:8080/#/home/'); await pg.waitForTimeout(2000);
+    const tab = pg.locator('[aria-label="Inbox"], [aria-label*="nbox"]'); log('INBOX_TAB', await tab.count());
+    if (await tab.count()) { await tab.first().click(); await pg.waitForTimeout(1500); }
+    const inv = pg.getByText('Invites', { exact: true }); if (await inv.count()) { await inv.first().click(); await pg.waitForTimeout(1500); }
+    log('URL', pg.url());
+    if (!/invites/.test(pg.url())) { await pg.goto('http://127.0.0.1:8080/#/inbox/invites/'); await pg.waitForTimeout(3000); log('URL_FALLBACK', pg.url()); }
+    { const pub = pg.getByText('Public', { exact: true }); log('PUBLIC_FILTER', await pub.count()); if (await pub.count()) { await pub.first().click(); await pg.waitForTimeout(1500); } }
+    for (let r = 0; r < 3; r++) { const v = pg.getByText('View All', { exact: true }); if (!(await v.count())) break; await v.first().click(); await pg.waitForTimeout(800); }
+    const b0 = await body(); const i = b0.indexOf(name); log('INBOX has', name, i >= 0, JSON.stringify(b0.slice(Math.max(0, i - 120), i + 120)));
+    const card = pg.locator('div').filter({ hasText: name }).filter({ has: pg.getByText('Accept', { exact: true }) }).last();
+    await card.getByText('Accept', { exact: true }).first().click(); log('ACCEPT', name, t());
+  };
+  if (MODE === 'pjfail') {
+    await tap('Friend DM'); await pg.waitForTimeout(3000);
+    const bb = await body(); const k = bb.search(/Internal server error/); log('AFTER_FAIL', k >= 0 ? bb.slice(Math.max(0, k - 40), k + 80) : 'no message');
+    expect('a failed m.direct write shows the refusal', k >= 0, bb.slice(0, 200));
+    expect('no join is sent while the filing is failing', joinsOf('!dm1:test') === 0, String(joinsOf('!dm1:test')));
+    await tap('Friend DM'); await pg.waitForTimeout(6000); const r = await tiers('after retry');
+    expect('the retry joins once', joinsOf('!dm1:test') === 1, String(joinsOf('!dm1:test')));
+    expect('Friend DM is filed under Direct Messages after the retry', isDm(r.friend), r.friend);
+  } else if (MODE === 'jdrop') {
+    await tap('Friend DM'); const saw = await sawText(pg, /tap again to retry/, 3000); log('AFTER_DROP', saw);
+    expect('a dropped join shows the retryable message', saw, (await body()).slice(0, 200));
+    await pg.waitForTimeout(6000); const r1 = await tiers('after drop'); await open(); const r2 = await tiers('after reload');
+    expect('the entry is kept after the drop', isDm(r1.friend) && neverUnfiled(), r1.friend);
+    expect('Friend DM is under Direct Messages after the reload', isDm(r2.friend), r2.friend);
+  } else if (MODE === 'admin') {
+    await tap('Friend DM'); await pg.waitForTimeout(6000); const r = await tiers('admin estate');
+    expect('an admin-invited DM is filed under Direct Messages', isDm(r.friend), r.friend);
+  } else if (MODE === 'inboxadmin') {
+    await acceptInInbox('Friend DM'); await pg.waitForTimeout(6000); const r = await tiers('admin inbox');
+    expect('an admin-invited DM accepted in the inbox is filed under Direct Messages', isDm(r.friend), r.friend);
+  } else if (MODE === 'inboxreload') {
+    await acceptInInbox('Slow DM'); await pg.waitForTimeout(2000); log('RELOAD', t()); await open('#/inbox/invites/');
+    await pg.waitForTimeout(30000); const r = await tiers('inbox reload');
+    expect('a DM accepted in the inbox is filed under Direct Messages after a reload', isDm(r.slow), r.slow);
+  } else if (MODE === 'pjreload') {
+    await tap('Slow DM'); await pg.waitForTimeout(2000); log('RELOAD', t()); await open();
+    await pg.waitForTimeout(8000); await tiers('pjreload');
+    const n = await (await reveal('Slow DM')).count(); log('SLOW_DM_STILL_JOINABLE', n);
+    expect('a join cut off by a reload stays joinable', n === 1, String(n));
+  }
+  await quit(done());
+})().catch((e) => { log('ERROR', String(e.stack || e).slice(0, 300)); quit(1); });

harness/estate/drive-routes.cjs

@@ -0,0 +1,42 @@
+const { chromium } = require('playwright');
+const { expect, done, isDm, mDirectPuts, hsLog, revealedTier, sawText } = require('./check.cjs');
+const MODE = process.env.MODE; const T0 = Date.now(); const t = () => `+${Date.now() - T0}ms`;
+const log = (...a) => console.log(`[${MODE}]`, ...a);
+const HEADERS = ['GameCult', 'Projects', 'nibu', 'eureka', 'Nibu', 'Eureka', 'Elsewhere', 'Direct Messages'];
+let b; const quit = (c) => Promise.race([Promise.resolve(b && b.close()).catch(() => 0), new Promise((r) => setTimeout(r, 5000))]).finally(() => process.exit(c));
+setTimeout(() => { console.log('DRIVER_TIMEOUT'); quit(3); }, 120000);
+(async () => {
+  b = await chromium.launch();
+  const ctx = await b.newContext({ viewport: { width: 390, height: 844 }, isMobile: true, hasTouch: true });
+  const pg = await ctx.newPage();
+  await pg.goto('http://127.0.0.1:8080/');
+  await pg.evaluate(() => { localStorage.setItem('cinny_access_token', 'tok'); localStorage.setItem('cinny_device_id', 'DEV'); localStorage.setItem('cinny_user_id', '@t:test'); localStorage.setItem('cinny_hs_base_url', 'http://127.0.0.1:8080'); });
+  await pg.goto('http://127.0.0.1:8080/#/home/'); await pg.reload(); await pg.waitForTimeout(9000);
+  const body = async () => (await pg.evaluate(() => document.body.innerText)).replace(/\s+/g, ' ');
+  const tiers = async (tag) => { const f = await revealedTier(pg, 'Friend DM'); log('TIER', tag, '| Friend DM', f); return f; };
+  let joined = false;
+  if (MODE === 'deeplink') {
+    for (const route of ['direct', 'home']) {
+      await pg.goto(`http://127.0.0.1:8080/#/${route}/${encodeURIComponent('!dm1:test')}/`); await pg.waitForTimeout(4000);
+      const bb = await body(); log('ROUTE', route, JSON.stringify(bb.slice(0, 300)));
+      const j = pg.getByRole('button', { name: /^Join$/ }); log('JOIN_BUTTONS', route, await j.count());
+      if (await j.count()) { joined = true; await j.first().click(); log('CLICK_JOIN', route, t()); await pg.waitForTimeout(6000); break; }
+    }
+    const f = await tiers('after deeplink join');
+    const stamps = (re) => hsLog().filter((l) => re.test(l)).map((l) => Number(l.split(' ')[0]));
+    const put = stamps(/ PUT .*m\.direct BODY .*!dm1:test/)[0], join = stamps(/ JOIN !dm1:test$/)[0];
+    expect('the deep link offers one Join button', joined, 'no Join button');
+    expect('the DM is filed before the join is sent', put !== undefined && join !== undefined && put <= join, `put ${put} join ${join}`);
+    expect('the DM is filed under Direct Messages', isDm(f), f);
+  } else if (MODE === 'gw504') {
+    const HL = HEADERS; let l = pg.locator('[aria-label="Join Friend DM"]');
+    for (let r = 0; r < 2 && !(await l.count()); r++) for (const h of HL) { const hl = pg.getByText(h, { exact: true }); if (await hl.count()) { await hl.first().click(); await pg.waitForTimeout(250); } }
+    log('JOINCTRL', await l.count()); await l.first().click(); log('CLICK', t());
+    const saw = await sawText(pg, /tap again to retry/, 3000); log('AFTER_504', saw);
+    expect('a gateway timeout shows the retryable message', saw, (await body()).slice(0, 200));
+    await pg.waitForTimeout(4000); const f = await tiers('after 504 (join delivered by sync)');
+    expect('the DM stays filed after a gateway timeout', mDirectPuts().every((b) => b.includes('!dm1:test')) && mDirectPuts().length > 0, JSON.stringify(mDirectPuts()));
+    expect('the DM is filed under Direct Messages once sync delivers it', isDm(f), f);
+  }
+  await quit(done());
+})().catch((e) => { log('ERROR', String(e.stack || e).slice(0, 300)); quit(1); });

harness/estate/drive.cjs

@@ -0,0 +1,48 @@
+const { chromium } = require('playwright');
+const { expect, done, isDm, revealedTier } = require('./check.cjs');
+const MODE = process.env.MODE; // twodm | reload
+const T0 = Date.now(); const t = () => `+${Date.now() - T0}ms`;
+const log = (...a) => console.log(`[${MODE}]`, ...a);
+const HEADERS = ['GameCult', 'Projects', 'nibu', 'eureka', 'Nibu', 'Eureka', 'Elsewhere', 'Direct Messages'];
+let tierBefore;
+(async () => {
+  const b = await chromium.launch();
+  const ctx = await b.newContext({ viewport: { width: 390, height: 844 }, isMobile: true, hasTouch: true, deviceScaleFactor: 1 });
+  const pg = await ctx.newPage(); pg.on('console', (m) => { if (m.type() === 'error' || /command|direct/i.test(m.text())) console.log('[console]', m.type(), m.text().slice(0, 200)); });
+  const open = async () => { await pg.goto('http://127.0.0.1:8080/#/home/'); await pg.reload(); await pg.waitForTimeout(9000); };
+  await pg.goto('http://127.0.0.1:8080/');
+  await pg.evaluate(() => { localStorage.setItem('cinny_access_token', 'tok'); localStorage.setItem('cinny_device_id', 'DEV'); localStorage.setItem('cinny_user_id', '@t:test'); localStorage.setItem('cinny_hs_base_url', 'http://127.0.0.1:8080'); });
+  await open();
+  const text = () => pg.evaluate(() => document.body.innerText);
+  const reveal = async (name) => { const loc = pg.locator(`[aria-label="Join ${name}"]`); if (await loc.count()) return loc; for (let r = 0; r < 2; r++) for (const h of HEADERS) { const hl = pg.getByText(h, { exact: true }); if (await hl.count()) { await hl.first().click(); await pg.waitForTimeout(250); if (await loc.count()) return loc; } } return loc; };
+  const tierOf = (name) => revealedTier(pg, name);
+  const tap = async (n) => { const l = await reveal(n); log('JOINCTRL', n, await l.count()); await l.first().click(); log('CLICK', n, t()); };
+  if (MODE === 'twodm') {
+    await tap('Slow DM'); await pg.waitForTimeout(300); await tap('Late DM');
+    await pg.waitForTimeout(45000);
+  } else if (MODE === 'convert') {
+    await tap('Friend DM'); await pg.waitForTimeout(6000);
+    tierBefore = await tierOf('Friend DM'); log('TIER before', tierBefore);
+    await pg.goto('http://127.0.0.1:8080/#/direct/!dm1:test/'); await pg.waitForTimeout(4000);
+    const ed = pg.locator('[contenteditable="true"]'); log('EDITORS', await ed.count(), pg.url());
+    await ed.first().click(); await pg.keyboard.type('/converttoroom', { delay: 30 }); await pg.waitForTimeout(500);
+    log('ED_TEXT', JSON.stringify(await ed.first().innerText())); log('BODY', JSON.stringify((await text()).slice(-600)));
+    await pg.getByText('Convert direct message to room').first().click(); await pg.waitForTimeout(400); log('ED_PICKED', JSON.stringify(await ed.first().innerHTML()).slice(0, 300));
+    await pg.keyboard.press('Enter'); log('SENT', t()); await pg.waitForTimeout(800); log('ED_TEXT2', JSON.stringify(await ed.first().innerText().catch(()=>'')));
+    if (await ed.first().innerText().catch(() => '')) { await pg.keyboard.press('Enter'); log('SENT2', t()); }
+    await pg.waitForTimeout(8000);
+    await pg.goto('http://127.0.0.1:8080/#/home/'); await pg.waitForTimeout(3000);
+  } else {
+    await tap('Slow DM'); await pg.waitForTimeout(3000);
+    log('RELOAD', t()); await open();
+    await pg.waitForTimeout(30000);
+  }
+  const slow = await tierOf('Slow DM'), late = await tierOf('Late DM'), friend = await tierOf('Friend DM');
+  log('TIER Slow DM', slow, '| Late DM', late, '| Friend DM', friend);
+  if (MODE === 'twodm') { expect('Slow DM is filed under Direct Messages', isDm(slow), slow); expect('Late DM is filed under Direct Messages', isDm(late), late); }
+  else if (MODE === 'convert') {
+    expect('Friend DM was filed under Direct Messages before the conversion', isDm(tierBefore), tierBefore);
+    expect('the converted room left Direct Messages and is still listed', !isDm(friend) && friend !== 'absent', friend);
+  } else expect('Slow DM is filed under Direct Messages after the reload', isDm(slow), slow);
+  await b.close(); process.exitCode = done();
+})().catch((e) => { log('ERROR', String(e.stack || e)); process.exitCode = 1; });

harness/estate/fakehs.cjs

@@ -0,0 +1,127 @@
+// Soul s2 fake homeserver. Invitee with no root state; stewards only in m.space.child content.
+// Rooms: GEN joined; OP invited; 6 project rooms invited (odin slow: join arrives at +24 s);
+// PUB public joinable, not in store; STRAY joined outside hierarchy; DM1 invited direct (fast);
+// DM2 invited direct (slow, +24 s). NOROOT=1: the root alias does not resolve.
+const http = require('http'), fs = require('fs'), path = require('path');
+const DIST = process.argv[2], PORT = 8080, ME = '@t:test';
+const NOROOT = process.env.NOROOT === '1';
+const log = [];
+const P = ['aetheria', 'ghostlight', 'huginn', 'idunn', 'bifrost', 'odin'];
+const STEWARD = { aetheria: 'nibu', ghostlight: 'nibu', huginn: 'eureka', idunn: 'eureka' };
+const PROJ = P.map((p, i) => ({ id: `!p${i}:test`, alias: `#${p}:test`, name: p[0].toUpperCase() + p.slice(1), key: p }));
+const ROOT = '!root:test', PSP = '!proj:test', GEN = '!gen:test', OP = '!op:test', PUB = '!pub:test', STRAY = '!stray:test', DM1 = '!dm1:test', DM2 = '!dm2:test', DM3 = '!dm3:test';
+const SLOW = new Set([PROJ[5].id, DM2, DM3]);
+const NAMES = { [PUB]: 'Commons', [DM1]: 'Friend DM', [DM2]: 'Slow DM', [DM3]: 'Late DM', [STRAY]: 'Adhoc' };
+PROJ.forEach((r) => (NAMES[r.id] = r.name));
+const held = []; const pendingState = []; const pending = []; const adLog = []; let ev = 0;
+const se = (type, content, sk = '', sender = '@admin:test') => ({ type, content, state_key: sk, sender, event_id: `$e${++ev}`, origin_server_ts: Date.now() });
+const strip = (id, name, space, direct) => [
+  { type: 'm.room.create', state_key: '', sender: direct ? '@friend:test' : '@admin:test', content: space ? { type: 'm.space', room_version: '12' } : { room_version: '12' } },
+  { type: 'm.room.name', state_key: '', sender: '@admin:test', content: { name } },
+  { type: 'm.room.join_rules', state_key: '', sender: '@admin:test', content: { join_rule: 'invite' } },
+  ...(direct ? [{ type: 'm.room.member', state_key: '@friend:test', sender: '@friend:test', content: { membership: 'join', displayname: 'Friend' } }] : []),
+  { type: 'm.room.member', state_key: ME, sender: direct ? (process.env.INVITER_ADMIN === '1' && id === DM1 ? '@admin:test' : '@friend:test') : '@admin:test', content: direct ? { membership: 'invite', is_direct: true } : { membership: 'invite' } },
+];
+const joinedRoom = (id, name, extra = [], space = false) => ({
+  state: { events: [se('m.room.create', space ? { type: 'm.space', room_version: '12' } : { room_version: '12' }), se('m.room.name', { name }), se('m.room.join_rules', { join_rule: 'invite' }), se('m.room.member', { membership: 'join' }, ME, ME), ...extra] },
+  timeline: { events: [{ type: 'm.room.message', sender: '@admin:test', content: { msgtype: 'm.text', body: `welcome to ${name}` }, event_id: `$m${++ev}`, origin_server_ts: Date.now() }], limited: false },
+  ephemeral: { events: [] }, account_data: { events: [] }, unread_notifications: {}, summary: {},
+});
+const invites = () => {
+  const o = {};
+  o[ROOT] = { invite_state: { events: strip(ROOT, 'GameCult', true) } };
+  o[PSP] = { invite_state: { events: strip(PSP, 'Projects', true) } };
+  o[OP] = { invite_state: { events: strip(OP, 'Operator') } };
+  PROJ.forEach((r) => (o[r.id] = { invite_state: { events: strip(r.id, r.name) } }));
+  o[DM1] = { invite_state: { events: strip(DM1, NAMES[DM1], false, true) } };
+  o[DM2] = { invite_state: { events: strip(DM2, NAMES[DM2], false, true) } };
+  o[DM3] = { invite_state: { events: strip(DM3, NAMES[DM3], false, true) } };
+  return o;
+};
+const child = (id, steward) => ({ type: 'm.space.child', state_key: id, content: { via: ['test'], ...(steward ? { 'org.gamecult.steward': { mind: steward, repo: 'x', source: 'y', steward: 'z' } } : {}) }, sender: '@admin:test', origin_server_ts: 1 });
+const hroom = (id, name, alias, extra = {}) => ({ room_id: id, name, canonical_alias: alias, num_joined_members: 1, world_readable: false, guest_can_join: false, join_rule: 'invite', children_state: [], ...extra });
+const hierarchy = () => [
+  hroom(ROOT, 'GameCult', '#gamecult:test', { room_type: 'm.space', children_state: [child(GEN), child(OP), child(PUB), child(PSP)] }),
+  hroom(GEN, 'General', '#general:test'),
+  hroom(OP, 'Operator', '#operator:test'),
+  hroom(PUB, 'Commons', '#commons:test', { join_rule: 'public' }),
+  hroom(PSP, 'Projects', '#projects:test', { room_type: 'm.space', children_state: PROJ.map((r) => child(r.id, STEWARD[r.key])) }),
+  ...PROJ.map((r) => hroom(r.id, r.name, r.alias)),
+];
+let syncN = 1;
+const json = (res, code, body) => { res.writeHead(code, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Headers': '*', 'Access-Control-Allow-Methods': '*' }); res.end(JSON.stringify(body)); };
+const mime = { '.js': 'text/javascript', '.mjs': 'text/javascript', '.css': 'text/css', '.html': 'text/html', '.json': 'application/json', '.wasm': 'application/wasm', '.svg': 'image/svg+xml', '.png': 'image/png', '.woff2': 'font/woff2' };
+const flush = () => fs.writeFileSync(process.env.HSLOG, log.join('\n'));
+http.createServer((req, res) => {
+  const u = new URL(req.url, 'http://x'); const p = decodeURIComponent(u.pathname);
+  if (req.method === 'OPTIONS') return json(res, 200, {});
+  if (!p.startsWith('/_matrix') && !p.startsWith('/.well-known')) {
+    let f = path.join(DIST, p === '/' ? 'index.html' : p);
+    if (!fs.existsSync(f) || fs.statSync(f).isDirectory()) f = path.join(DIST, 'index.html');
+    res.writeHead(200, { 'Content-Type': mime[path.extname(f)] || 'application/octet-stream' });
+    return fs.createReadStream(f).pipe(res);
+  }
+  let body = ''; req.on('data', (c) => (body += c)); req.on('end', () => {
+    if (req.method === 'PUT' && p.includes('m.direct')) console.log('MDIRECT_PUT ' + (Date.now()) + ' ' + body);
+    log.push(`${Date.now()} ${req.method} ${p}${req.method === 'PUT' && p.includes('account_data') ? ' BODY ' + body : ''}`);
+    if (p === '/_matrix/client/versions') return json(res, 200, { versions: ['v1.1', 'v1.5', 'v1.11'], unstable_features: {} });
+    if (p.endsWith('/sync')) {
+      const since = u.searchParams.get('since');
+      if (!since) {
+        const join = {}; join[GEN] = joinedRoom(GEN, 'General'); join[STRAY] = joinedRoom(STRAY, 'Adhoc');
+        return json(res, 200, { next_batch: `s${syncN}`, rooms: { join, invite: invites(), leave: {} }, account_data: { events: held.slice() }, presence: { events: [] }, to_device: { events: [] }, device_one_time_keys_count: { signed_curve25519: 50 } });
+      }
+      const respond = () => {
+        const now = Date.now(); const join = {};
+        for (let i = pending.length - 1; i >= 0; i--) if (pending[i].at <= now) {
+          const id = pending[i].id; pending.splice(i, 1);
+          const extra = id === DM1 || id === DM2 || id === DM3 ? [se('m.room.member', { membership: 'join', displayname: 'Friend' }, '@friend:test', '@friend:test')] : [];
+          join[id] = joinedRoom(id, NAMES[id] || id, extra); if (extra.length) { const me = join[id].state.events.find((e) => e.type === 'm.room.member' && e.state_key === ME); me.unsigned = { prev_content: { membership: 'invite', is_direct: true } }; } log.push(`${now} SYNC delivers join ${id}`); console.log('DELIVER ' + now + ' ' + id);
+        }
+        for (const s of pendingState.splice(0)) { join[s.id] = join[s.id] || { state: { events: [] }, timeline: { events: [], limited: false, prev_batch: 'p' }, ephemeral: { events: [] }, account_data: { events: [] }, unread_notifications: {}, summary: {} }; join[s.id].timeline.events.push(s.ev); console.log('STATE_ECHO ' + now + ' ' + s.id + ' ' + JSON.stringify(s.ev.content)); }
+        const k = Number(String(since).replace(/^s/, '')) || 0; const ad = adLog.filter((a) => a.after >= k).map((a) => ({ type: a.type, content: a.content })); // a server answers with what changed since the client's token, whichever client asks
+        if (Object.keys(join).length || ad.length) return json(res, 200, { next_batch: `s${++syncN}`, rooms: { join, invite: {}, leave: {} }, account_data: { events: ad } });
+        return json(res, 200, { next_batch: since, rooms: {} });
+      };
+      return setTimeout(respond, 300);
+    }
+    const jm = p.match(/\/rooms\/([^/]+)\/join$/) || p.match(/\/join\/([^/]+)$/);
+    if (req.method === 'POST' && jm) {
+      const id = jm[1]; log.push(`${Date.now()} JOIN ${id}`);
+      if (id === PROJ[1].id) return json(res, 403, { errcode: 'M_FORBIDDEN', error: 'You are not invited to this room.' });
+      const prior = pending.find((q) => q.id === DM2 || q.id === DM3);
+      pending.push({ id, at: (id === DM3 || id === DM2) && prior ? prior.at : Date.now() + (SLOW.has(id) ? 24000 : 1000) });
+      if (process.env.JOIN_504 === '1' && id === DM1) { console.log('JOIN_504 ' + Date.now() + ' ' + id); res.writeHead(504, {'Content-Type':'text/html'}); return res.end('<html>504 Gateway Time-out</html>'); }
+      if (process.env.JOIN_DROP === '1' && id === DM1) { console.log('JOIN_DROPPED ' + Date.now() + ' ' + id); return req.socket.destroy(); }
+      if (process.env.JOIN_DELAY === '1') { console.log('JOIN_DELAYED ' + Date.now() + ' ' + id); return setTimeout(() => json(res, 200, { room_id: id }), 6000); }
+      return json(res, 200, { room_id: id });
+    }
+    const sm = p.match(/\/rooms\/([^/]+)\/state\/m\.room\.member\/(.+)$/);
+    if (req.method === 'PUT' && sm) { console.log('STATE_PUT ' + Date.now() + ' ' + sm[1] + ' ' + body); const e = se('m.room.member', JSON.parse(body), sm[2], sm[2]); e.unsigned = { prev_content: { membership: 'join' } }; setTimeout(() => pendingState.push({ id: sm[1], ev: e }), 400); return json(res, 200, { event_id: e.event_id }); }
+    if (p.includes('/account_data/') && req.method === 'PUT' && p.includes('m.direct') && process.env.FAIL_MDIRECT === '1' && !global.failedOnce) { global.failedOnce = 1; console.log('MDIRECT_FAIL ' + Date.now()); return json(res, 500, { errcode: 'M_UNKNOWN', error: 'Internal server error' }); }
+    if (p.includes('/account_data/') && req.method === 'PUT') {
+      const DELAY = p.includes('m.direct') && process.env.DELAY_MDIRECT === '1';
+      const type = decodeURIComponent(p.split('/account_data/')[1]);
+      try { const c = JSON.parse(body); adLog.push({ type, content: c, after: syncN }); const i = held.findIndex((h) => h.type === type); if (i >= 0) held.splice(i, 1); held.push({ type, content: c }); } catch (e) {}
+      if (DELAY) { console.log('MDIRECT_DELAYED ' + Date.now()); return setTimeout(() => json(res, 200, {}), 6000); }
+      return json(res, 200, {});
+    }
+    if (p.includes('/hierarchy')) return json(res, 200, { rooms: hierarchy() });
+    if (p.includes('/directory/room/')) return NOROOT ? json(res, 404, { errcode: 'M_NOT_FOUND', error: 'Room alias not found' }) : json(res, 200, { room_id: ROOT, servers: ['test'] });
+    if (p.endsWith('/keys/upload')) return json(res, 200, { one_time_key_counts: { signed_curve25519: 50 } });
+    if (p.endsWith('/keys/query')) return json(res, 200, { device_keys: {}, failures: {} });
+    if (p.includes('/room_keys/version')) return json(res, 404, { errcode: 'M_NOT_FOUND', error: 'none' });
+    if (p.includes('/pushrules')) return json(res, 200, { global: { override: [], underride: [], room: [], sender: [], content: [] } });
+    if (p.includes('/filter')) return json(res, 200, { filter_id: '1' });
+    if (p.includes('/account_data/')) return json(res, 404, { errcode: 'M_NOT_FOUND', error: 'none' });
+    if (p.includes('/messages')) return json(res, 200, { chunk: [], start: 't0', end: 't0' });
+    if (p.includes('/members')) return json(res, 200, { chunk: [] });
+    if (p.includes('/profile/')) return json(res, 200, { displayname: 'Tess' });
+    if (p.includes('/capabilities')) return json(res, 200, { capabilities: {} });
+    if (p.includes('/devices')) return json(res, 200, { devices: [] });
+    if (p.includes('summary')) return json(res, 200, { room_id: p.split('/').pop(), name: 'Summary card', num_joined_members: 1, membership: 'invite', join_rule: 'invite' });
+    if (p.includes('/login')) return json(res, 200, { flows: [{ type: 'm.login.password' }] });
+    return json(res, 200, {});
+  });
+}).listen(PORT, () => console.log('fakehs up'));
+setInterval(flush, 300);

harness/estate/run.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Runs inside mcr.microsoft.com/playwright:v1.48.2-jammy with the repo at /src:
+# builds the client, then drives the direct-message and join-failure scenarios against fakehs.cjs.
+set -e
+cd /src
+npm ci --no-audit --no-fund --ignore-scripts >/tmp/npmci.log 2>&1 || { tail -20 /tmp/npmci.log; exit 1; }
+npm run build > /tmp/build.log 2>&1 || { tail -30 /tmp/build.log; exit 1; }
+echo BUILD_OK $(git rev-parse HEAD)
+printf '{"defaultHomeserver":0,"homeserverList":["127.0.0.1:8080"],"allowCustomHomeservers":true,"featuredCommunities":{"spaces":["#gamecult:test"],"rooms":[],"servers":["test"]},"hashRouter":{"enabled":true,"basename":"/"}}' > dist/config.json
+mkdir -p /tmp/pw && cd /tmp/pw && npm init -y >/dev/null && npm i --no-audit --no-fund playwright@1.48.2 >/tmp/pw.log 2>&1
+cp /src/harness/estate/check.cjs /src/harness/estate/drive.cjs /src/harness/estate/drive-failures.cjs /src/harness/estate/drive-routes.cjs /tmp/pw/
+set +e
+for m in twodm reload convert; do
+  HSLOG=/tmp/hslog-$m.txt NOROOT=0 node /src/harness/estate/fakehs.cjs /src/dist > /tmp/hs-$m.out 2>&1 &
+  HS=$!; sleep 2
+  HSLOG=/tmp/hslog-$m.txt MODE=$m node /tmp/pw/drive.cjs; rc=$?; echo "DRIVE $m RC=$rc"; [ $rc -eq 0 ] || FAILED="$FAILED $m"
+  kill $HS; wait $HS 2>/dev/null; sleep 1
+  echo "=== hs $m"; grep -E "MDIRECT_PUT|DELIVER|STATE_" /tmp/hs-$m.out; grep -E " JOIN " /tmp/hslog-$m.txt
+done
+failure() { m=$1; shift
+  env "$@" HSLOG=/tmp/hslog-$m.txt NOROOT=0 node /src/harness/estate/fakehs.cjs /src/dist > /tmp/hs-$m.out 2>&1 &
+  HS=$!; sleep 2
+  HSLOG=/tmp/hslog-$m.txt MODE=$m node /tmp/pw/${DRIVER:-drive-failures}.cjs; rc=$?; echo "DRIVE $m RC=$rc"; [ $rc -eq 0 ] || FAILED="$FAILED $m"
+  kill $HS; wait $HS 2>/dev/null; sleep 1
+  echo "=== hs $m"; grep -E "MDIRECT|DELIVER|JOIN_|STATE_" /tmp/hs-$m.out; grep -E " JOIN " /tmp/hslog-$m.txt; }
+failure pjfail FAIL_MDIRECT=1
+failure pjreload DELAY_MDIRECT=1
+failure jdrop JOIN_DROP=1
+failure admin INVITER_ADMIN=1
+failure inboxadmin INVITER_ADMIN=1
+failure inboxreload JOIN_DELAY=1
+DRIVER=drive-routes failure deeplink
+DRIVER=drive-routes failure gw504 JOIN_504=1
+echo "FAILED_DRIVES:${FAILED:- none}"
+[ -z "$FAILED" ]

harness/scene/README.md

@@ -0,0 +1,22 @@
+# Scene harness
+
+Compiles, renders and times the background scene (`src/app/features/scene/`) in headless
+Chromium. Not shipped, not run by CI.
+
+    node bundle.cjs <outdir>                  # esbuild bundle of entry.ts plus an index.html
+    node drive.cjs <outdir> compile           # compile and link each stage, JSON report
+    node drive.cjs <outdir> shots <pngdir>    # rest, mid pull-back and pulled-back screenshots
+    node gradAxis.cjs <shaders dir>           # numeric check that noise gradients are (d/dx, d/dz-as-.y, ...): terrainNormal axis
+    node drive.cjs <outdir> measure           # GPU time per pass by timer query, two viewports, two levels
+    node drive.cjs <outdir> variants          # the same with source patches (no erosion, no tree, value-only fbm)
+    node drive.cjs <outdir> trace             # mean trace steps per pixel and pass ms at three camera poses, PREPASS=0,1 arms
+    node drive.cjs <outdir> diff <pngdir>     # one frozen frame with and without the prepass, pixel diff and both PNGs
+    node drive.cjs <outdir> phacelle          # the Phacelle gradient probe behind world.ts `phacelleGradBound`
+
+Needs `esbuild` and `playwright@1.48.2` on `NODE_PATH` and a Chromium. The first run was done on a
+host with no GPU, so `drive.cjs` launches with `--use-angle=swiftshader` (software Vulkan). On a
+machine with a GPU, remove those flags to measure the real device. `bundle.cjs` must run from a
+directory whose ancestors hold no empty `package.json` (esbuild reads them).
+
+Timings from SwiftShader are CPU time: use them for the split between passes and for before and
+after of one change, never as a phone frame time.

harness/scene/bundle.cjs

@@ -0,0 +1,50 @@
+// Bundles entry.ts with the scene's ?raw GLSL imports into $OUT/bundle.js plus an index.html.
+// usage: node bundle.cjs <outdir> [demo|ridge]     (esbuild from NODE_PATH). `demo` bundles the ray-march
+// standalone page; `ridge` the ridge scene's page (open it with ?probe=1 for the cadence readout).
+const esbuild = require('esbuild');
+const fs = require('fs');
+const path = require('path');
+const out = process.argv[2];
+const demo = process.argv[3] === 'demo';
+const ridge = process.argv[3] === 'ridge';
+fs.mkdirSync(out, { recursive: true });
+const rawPlugin = {
+  name: 'raw',
+  setup(b) {
+    b.onResolve({ filter: /\?raw$/ }, (a) => ({
+      path: path.resolve(a.resolveDir, a.path.slice(0, -4)),
+      namespace: 'raw',
+    }));
+    b.onLoad({ filter: /.*/, namespace: 'raw' }, (a) => ({
+      contents: fs.readFileSync(a.path, 'utf8'),
+      loader: 'text',
+    }));
+  },
+};
+esbuild
+  .build({
+    entryPoints: [path.join(__dirname, ridge ? 'ridgeDemo.ts' : demo ? 'demo.ts' : 'entry.ts')],
+    bundle: true,
+    outfile: path.join(out, 'bundle.js'),
+    plugins: [rawPlugin],
+    format: 'iife',
+    target: 'es2020',
+    define: { 'import.meta.env.BASE_URL': '"/"' },
+  })
+  .then(() => {
+    if (ridge) {
+      fs.writeFileSync(
+        path.join(out, 'index.html'),
+        '<!doctype html><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><title>Ratatoskr ridge scene</title><body style="margin:0;background:#07111a"><div id=stage style="position:relative;width:100vw;height:100vh;overflow:hidden"><canvas id=c style="width:100%;height:100%;display:block"></canvas></div><script src=bundle.js></script>'
+      );
+      return;
+    }
+    fs.writeFileSync(
+      path.join(out, 'index.html'),
+      '<!doctype html><meta charset=utf-8><title>Ratatoskr scene: trace prepass</title><body style="margin:0;background:#000"><canvas id=c style="width:100vw;height:100vh;display:block"></canvas>' +
+        (demo
+          ? '<div style="position:fixed;left:8px;top:8px;padding:6px 8px;background:#000a;color:#ddd;font:12px monospace"><label><input id=prepass type=checkbox checked> cone prepass</label> <label><input id=half type=checkbox> half-float start</label> <label>pull-back <input id=pull type=range min=0 max=1 step=0.05 value=0.6></label><pre id=out style="margin:4px 0 0;white-space:pre-wrap"></pre><details id=dev><summary>device</summary><pre id=info style="margin:4px 0 0;white-space:pre-wrap;max-height:50vh;overflow:auto"></pre></details></div>'
+          : '') +
+        '<script src=bundle.js></script>'
+    );
+  });

harness/scene/demo.ts

@@ -0,0 +1,102 @@
+// Standalone page: the scene full-window with a readout of pass ms and trace steps per pixel, and
+// a switch for the cone prepass. Not shipped.
+import {
+  createScene,
+  Scene,
+  SceneStats,
+  SceneUnavailable,
+  TraceStats,
+} from '../../src/app/features/scene/Scene';
+import { LEVELS } from '../../src/app/features/scene/budget';
+
+let canvas = document.getElementById('c') as HTMLCanvasElement;
+const out = document.getElementById('out') as HTMLPreElement;
+const box = document.getElementById('prepass') as HTMLInputElement;
+const pull = document.getElementById('pull') as HTMLInputElement;
+const half = document.getElementById('half') as HTMLInputElement;
+const dev = document.getElementById('dev') as HTMLDetailsElement;
+const info = document.getElementById('info') as HTMLPreElement;
+const timerless = (() => {
+  const g = document.createElement('canvas').getContext('webgl2');
+  return !g?.getExtension('EXT_disjoint_timer_query_webgl2');
+})();
+
+const WHY: Record<SceneUnavailable, string> = {
+  'no-webgl2': 'this browser gave no WebGL2 context',
+  'no-float-or-half-float-colour-buffer':
+    'WebGL2 is there, but neither EXT_color_buffer_float nor EXT_color_buffer_half_float is',
+};
+
+// What the browser says about itself, read from a scratch context so it shows even when the scene
+// could not start. A canvas that never got a WebGL2 context is asked for WebGL1 to name the GPU.
+function describeDevice(): string {
+  const c = document.createElement('canvas');
+  const gl2 = c.getContext('webgl2');
+  const gl = gl2 ?? (document.createElement('canvas').getContext('webgl') as WebGLRenderingContext | null);
+  const lines = [`webgl2 context: ${gl2 ? 'yes' : 'NO'}`];
+  if (!gl) return [...lines, 'webgl1 context: NO'].join('\n');
+  const dbg = gl.getExtension('WEBGL_debug_renderer_info');
+  lines.push(
+    `renderer: ${gl.getParameter(dbg ? dbg.UNMASKED_RENDERER_WEBGL : gl.RENDERER)}`,
+    `vendor: ${gl.getParameter(dbg ? dbg.UNMASKED_VENDOR_WEBGL : gl.VENDOR)}`,
+    `version: ${gl.getParameter(gl.VERSION)}`,
+    `user agent: ${navigator.userAgent}`
+  );
+  const ext = gl.getSupportedExtensions() ?? [];
+  for (const n of ['EXT_color_buffer_float', 'EXT_color_buffer_half_float', 'OES_texture_float_linear', 'EXT_disjoint_timer_query_webgl2'])
+    lines.push(`${n}: ${ext.includes(n) ? 'yes' : 'NO'}`);
+  lines.push(`extensions (${ext.length}): ${ext.join(' ')}`);
+  return lines.join('\n');
+}
+info.textContent = describeDevice();
+
+let scene: Scene | null = null;
+let stats: SceneStats | undefined;
+let trace: TraceStats | undefined;
+
+function start() {
+  scene?.dispose();
+  stats = trace = undefined;
+  // A fresh canvas: a context cannot change its attributes, and dispose leaves the old one bound.
+  const fresh = canvas.cloneNode() as HTMLCanvasElement;
+  canvas.replaceWith(fresh);
+  canvas = fresh;
+  scene = createScene({
+    canvas: fresh,
+    unthrottled: true,
+    fixedLevel: LEVELS[0],
+    fixedPull: +pull.value,
+    prepass: box.checked,
+    halfStart: half.checked,
+    onUnavailable: (r) => (out.textContent = `createScene returned null: ${WHY[r]}`),
+    onCompileFail: (e) => (out.textContent = `createScene returned null: ${e.message}`),
+    onStats: (s) => (stats = s),
+    onTraceStats: (t) => (trace = t),
+  });
+  dev.open = !scene;
+}
+
+setInterval(() => {
+  if (!scene) return;
+  const lines = [`prepass ${box.checked ? 'on' : 'off'}   start target ${scene.startFormat}   pull ${pull.value}`];
+  if (stats) {
+    const ms = stats.passMs;
+    const total = Object.values(ms).reduce((a, b) => a + b, 0);
+    lines.push(
+      `gpu ms  prepass ${ms.prepass.toFixed(2)}  terrain ${ms.terrain.toFixed(2)}  atmosphere ${ms.atmosphere.toFixed(2)}  resolve ${ms.resolve.toFixed(2)}  composite ${ms.composite.toFixed(2)}  total ${total.toFixed(2)}`,
+      `solid ${stats.solidSize.join('x')}`
+    );
+  } else if (timerless) {
+    lines.push('gpu ms: this browser has no EXT_disjoint_timer_query_webgl2');
+  }
+  if (trace)
+    lines.push(
+      `steps/pixel ${trace.stepsPerPixel.toFixed(2)}  (pass 1 ${trace.traceSteps.toFixed(2)}, prepass ${trace.prepassSteps.toFixed(1)} per tile)`
+    );
+  out.textContent = lines.join('\n');
+}, 500);
+
+box.addEventListener('change', start);
+half.addEventListener('change', start);
+pull.addEventListener('input', start);
+start();

harness/scene/drive.cjs

@@ -0,0 +1,309 @@
+// Drives the scene in headless Chromium (software GL unless the host has a GPU).
+// usage: node drive.cjs <bundledir> <mode> [outdir]     modes: compile | shots | measure
+// Needs playwright from NODE_PATH and PLAYWRIGHT_BROWSERS_PATH. Prints one JSON report.
+const { chromium } = require('playwright');
+const path = require('path');
+const fs = require('fs');
+const [, , dir, mode, outdir = '.'] = process.argv;
+
+(async () => {
+  const b = await chromium.launch({
+    args: [
+      '--use-gl=angle',
+      '--use-angle=swiftshader',
+      '--enable-unsafe-swiftshader',
+      '--ignore-gpu-blocklist',
+    ],
+  });
+  const page = await b.newPage({ viewport: { width: 960, height: 540 } });
+  page.on('pageerror', (e) => process.stderr.write(`[pageerror] ${e}\n`));
+  page.on('console', (m) => process.stderr.write(`[page] ${m.text()}\n`));
+  await page.goto('file://' + path.resolve(dir, 'index.html'));
+  const report = { mode };
+  report.renderer = await page.evaluate(() => {
+    const g = document.createElement('canvas').getContext('webgl2');
+    const e = g.getExtension('WEBGL_debug_renderer_info');
+    return g.getParameter(e ? e.UNMASKED_RENDERER_WEBGL : g.RENDERER);
+  });
+
+  if (mode === 'compile') {
+    report.stages = await page.evaluate(() => {
+      const gl = document.createElement('canvas').getContext('webgl2');
+      const S = window.__scene;
+      return ['terrain', 'atmosphere', 'resolve', 'composite'].map((stage) => {
+        const t0 = performance.now();
+        try {
+          const p = S.linkStage(gl, stage);
+          return {
+            stage,
+            ok: true,
+            ms: +(performance.now() - t0).toFixed(1),
+            sourceBytes: S.fragmentSource(stage).length,
+            log: gl.getProgramInfoLog(p),
+          };
+        } catch (e) {
+          return {
+            stage,
+            ok: false,
+            ms: +(performance.now() - t0).toFixed(1),
+            log: String(e.log || e),
+          };
+        }
+      });
+    });
+  }
+
+  if (mode === 'phacelle') {
+    report.probe = await page.evaluate(() =>
+      window.__probePhacelle(
+        window.__scene.WORLD.erodeSide.slice(),
+        window.__scene.WORLD.erodeNorm,
+        4
+      )
+    );
+  }
+
+  if (mode === 'shots') {
+    await page.evaluate(() => {
+      const c = document.getElementById('c');
+      window.__s = window.__scene.createScene({
+        canvas: c,
+        unthrottled: true,
+        fixedLevel: window.__scene.LEVELS[0],
+      });
+    });
+    const wait = (ms) => page.waitForTimeout(ms);
+    await wait(4000);
+    await page.screenshot({ path: path.join(outdir, 'rest.png') });
+    await page.evaluate(() => window.__s.login());
+    await wait(3500);
+    await page.screenshot({ path: path.join(outdir, 'mid-pullback.png') });
+    await wait(9000);
+    await page.screenshot({ path: path.join(outdir, 'pulled-back.png') });
+    report.shots = ['rest.png', 'mid-pullback.png', 'pulled-back.png'];
+  }
+
+  if (mode === 'measure' || mode === 'variants') {
+    const VARIANTS = {
+      baseline: null,
+      // What a public value-only fbm would cost: the same octaves without the gradient work.
+      valueOnlyFbm: [
+        'float terrainFbm(vec2 xz) { return cultmath_fbm_grad(vec3(xz * W_FREQ, 0.0), W_OCTAVES, W_LACUNARITY, W_GAIN).w; }',
+        'float terrainFbm(vec2 xz) { float a = 1.0, fr = 1.0, v = 0.0; for (int i = 0; i < W_OCTAVES; i++) { v += a * cultmath_snoise(vec3(xz * W_FREQ * fr, 0.0)); fr *= W_LACUNARITY; a *= W_GAIN; } return v; }',
+      ],
+      noErosion: ['#define W_ERODE_ENABLED 1', '#define W_ERODE_ENABLED 0'],
+      // Upper bound on what skipping sky rays would save: every upward ray misses at once.
+      noSkyMarch: ['    bool hit = false;\n    bool onTree = false;', '    if (rd.y > 0.0) { o_color = vec4(0.0); o_depth = W_FAR; return; }\n    bool hit = false;\n    bool onTree = false;'],
+      noTree: ['float dr = treeDistance(p, leafness);', 'float dr = 1e9; leafness = 0.0;'],
+    };
+    const wanted = mode === "variants" ? (process.env.ONLY ? process.env.ONLY.split(",") : Object.keys(VARIANTS)) : ['baseline'];
+    const sizes = [
+      [960, 540],
+      [540, 1200],
+    ];
+    report.runs = [];
+    for (const [w, h] of sizes) {
+      for (const [li, variant] of wanted.flatMap((v) =>
+        mode === 'variants'
+          ? [[0, v]]
+          : [
+              [0, v],
+              [3, v],
+            ]
+      )) {
+        await page.setViewportSize({ width: w, height: h });
+        const r = await page.evaluate(
+          ({ li, rep }) =>
+            new Promise((res) => {
+              const rows = [];
+              const c = document.getElementById('c');
+              const s = window.__scene.createScene({
+                canvas: c,
+                unthrottled: true,
+                fixedLevel: window.__scene.LEVELS[li],
+                patchSource: rep
+                  ? (st, src) =>
+                      st === 'terrain'
+                        ? rep[0].startsWith('#define')
+                          ? src.replace(/#define W_ERODE_ENABLED \d/, rep[1])
+                          : src.split(rep[0]).join(rep[1])
+                        : src
+                  : undefined,
+                onStats: (st) => {
+                  rows.push(st);
+                  if (rows.length === 40) {
+                    s.dispose();
+                    const keep = rows.slice(10);
+                    const med = (k) =>
+                      keep.map((x) => x.passMs[k]).sort((a, b) => a - b)[keep.length >> 1];
+                    res({
+                      solid: keep[0].solidSize,
+                      atm: keep[0].atmosphereSize,
+                      medianMs: {
+                        terrain: med('terrain'),
+                        atmosphere: med('atmosphere'),
+                        resolve: med('resolve'),
+                        composite: med('composite'),
+                      },
+                    });
+                  }
+                },
+              });
+              if (!s) res({ error: 'createScene returned null' });
+            }),
+          { li, rep: VARIANTS[variant] }
+        );
+        report.runs.push({ viewport: [w, h], level: li, variant, ...r });
+      }
+    }
+  }
+
+  if (mode === 'trace') {
+    // Steps per pixel and pass ms at fixed camera poses, one scene per run. PREPASS=0,1 picks the arms.
+    const arms = (process.env.PREPASS || '1').split(',').map((x) => x === '1');
+    report.runs = [];
+    for (const [w, h] of process.env.PORTRAIT === '0'
+      ? [[960, 540]]
+      : [
+          [960, 540],
+          [540, 1200],
+        ]) {
+      for (const pull of (process.env.PULLS || '0,0.5,1').split(',').map(Number)) {
+        for (const prepass of arms) {
+          await page.setViewportSize({ width: w, height: h });
+          const r = await page.evaluate(
+            ({ pull, prepass, FRAMES }) =>
+              new Promise((res) => {
+                const rows = [];
+                const trace = [];
+                let done = false;
+                const finish = () => {
+                  if (done || rows.length < FRAMES || trace.length < 4) return;
+                  done = true;
+                  s.dispose();
+                  const keep = rows.slice(FRAMES >> 2);
+                  const med = (xs) => xs.sort((a, b) => a - b)[xs.length >> 1];
+                  const tk = trace.slice(1);
+                  const mean = (k) => tk.reduce((a, t) => a + t[k], 0) / tk.length;
+                  res({
+                    solid: keep[0].solidSize,
+                    readbacks: tk.length,
+                    traceSteps: +mean('traceSteps').toFixed(2),
+                    prepassSteps: +mean('prepassSteps').toFixed(2),
+                    stepsPerPixel: +mean('stepsPerPixel').toFixed(2),
+                    medianMs: Object.fromEntries(
+                      Object.keys(keep[0].passMs).map((k) => [k, +med(keep.map((x) => x.passMs[k])).toFixed(2)])
+                    ),
+                  });
+                };
+                const s = window.__scene.createScene({
+                  canvas: document.getElementById('c'),
+                  unthrottled: true,
+                  fixedLevel: window.__scene.LEVELS[0],
+                  fixedPull: pull,
+                  prepass,
+                  onTraceStats: (t) => {
+                    trace.push(t);
+                    finish();
+                  },
+                  onStats: (st) => {
+                    rows.push(st);
+                    finish();
+                  },
+                });
+                if (!s) res({ error: 'createScene returned null' });
+              }),
+            { pull, prepass, FRAMES: +(process.env.FRAMES || 64) }
+          );
+          report.runs.push({ viewport: [w, h], pull, prepass, ...r });
+        }
+      }
+    }
+  }
+
+  if (mode === 'diff') {
+    // Same frozen frame (reduced motion: time 0, 32 frames) with and without the prepass, compared
+    // pixel by pixel. The prepass is meant to change cost, not the picture.
+    await page.emulateMedia({ reducedMotion: 'reduce' });
+    await page.setViewportSize({ width: 640, height: 360 });
+    const shoot = async (pull, prepass, steps) => {
+      await page.evaluate(
+        ({ pull, prepass, steps }) => {
+          // Reduced motion bounds the scene to 32 frames; each asks for the next with rAF, so the
+          // count stops moving when it is done. Timer-query callbacks lag too far to count on.
+          window.__raf = 0;
+          if (!window.__rafPatched) {
+            window.__rafPatched = true;
+            const raf = window.requestAnimationFrame.bind(window);
+            window.requestAnimationFrame = (cb) => (window.__raf++, raf(cb));
+          }
+          window.__d = window.__scene.createScene({
+            canvas: document.getElementById('c'),
+            fixedLevel: { ...window.__scene.LEVELS[0], traceSteps: steps },
+            fixedPull: pull,
+            prepass,
+          });
+        },
+        { pull, prepass, steps }
+      );
+      for (let last = -1, still = 0; still < 3; await page.waitForTimeout(1000)) {
+        const n = await page.evaluate(() => window.__raf);
+        still = n === last ? still + 1 : 0;
+        last = n;
+      }
+      const png = await page.screenshot();
+      await page.evaluate(() => window.__d.dispose());
+      return png.toString('base64');
+    };
+    // The step cap makes a grazing ray give up and count as a hit, so the baseline is compared
+    // with a 512-step render of the same frame as well: whichever is closer to it is the more
+    // faithful one.
+    const decode = (x) =>
+      page.evaluate(
+        (x) =>
+          new Promise((r) => {
+            const i = new Image();
+            i.onload = () => {
+              const c = document.createElement('canvas');
+              c.width = i.width;
+              c.height = i.height;
+              const g = c.getContext('2d');
+              g.drawImage(i, 0, 0);
+              r(Array.from(g.getImageData(0, 0, i.width, i.height).data));
+            };
+            i.src = 'data:image/png;base64,' + x;
+          }),
+        x
+      );
+    const compare = (da, db) => {
+      let max = 0, over = 0, sum = 0;
+      const px = da.length / 4;
+      for (let i = 0; i < da.length; i += 4) {
+        let m = 0;
+        for (let k = 0; k < 3; k++) m = Math.max(m, Math.abs(da[i + k] - db[i + k]));
+        sum += m;
+        if (m > max) max = m;
+        if (m > 2) over++;
+      }
+      return { maxChannelDiff: max, pixelsOver2of255: over, ofPixels: px, meanMaxChannelDiff: +(sum / px).toFixed(3) };
+    };
+    report.diffs = [];
+    for (const pull of (process.env.PULLS || '0,0.5,1').split(',').map(Number)) {
+      const png = {
+        off: await shoot(pull, false, 96),
+        on: await shoot(pull, true, 96),
+        ref: await shoot(pull, false, 512),
+        off2: await shoot(pull, false, 96),
+      };
+      for (const k of Object.keys(png)) fs.writeFileSync(path.join(outdir, `diff-${k}-${pull}.png`), Buffer.from(png[k], 'base64'));
+      const [off, on, ref, off2] = [await decode(png.off), await decode(png.on), await decode(png.ref), await decode(png.off2)];
+      report.diffs.push({ pull, offVsOffAgain: compare(off, off2), offVsOn: compare(off, on), offVsRef512: compare(off, ref), onVsRef512: compare(on, ref) });
+    }
+  }
+
+  console.log(JSON.stringify(report, null, 1));
+  await b.close();
+})().catch((e) => {
+  console.log('ERR', String(e).slice(0, 2000));
+  process.exit(1);
+});

harness/scene/entry.ts

@@ -0,0 +1,87 @@
+// Browser entry for the harness: exposes the scene's seams to the driver. Not shipped.
+import { createScene, linkStage, ShaderCompileError } from '../../src/app/features/scene/Scene';
+import { LEVELS } from '../../src/app/features/scene/budget';
+import { fragmentSource } from '../../src/app/features/scene/shaderSource';
+import { WORLD } from '../../src/app/features/scene/world';
+
+(window as unknown as Record<string, unknown>).__scene = {
+  createScene,
+  linkStage,
+  ShaderCompileError,
+  LEVELS,
+  fragmentSource,
+  WORLD,
+};
+
+// ---- Phacelle gradient probe -----------------------------------------------------------------
+import cultmath from '../../src/app/features/scene/shaders/CultMath.glsl?raw';
+import phacelle from '../../src/app/features/scene/shaders/CultMath.Phacelle.glsl?raw';
+import { vertexSource } from '../../src/app/features/scene/shaderSource';
+
+const PROBE_FRAG = `#version 300 es
+precision highp float; precision highp int;
+${cultmath}
+${phacelle}
+uniform float u_seed; uniform vec3 u_side; uniform float u_norm; uniform float u_span;
+in vec2 v_uv; layout(location=0) out vec4 o;
+void main() {
+  // The scene samples the z = 0 slice: random points in a u_span square of it.
+  vec3 h = vec3(cultmath_pcg3d(vec3(gl_FragCoord.xy, u_seed))) ;
+  vec2 xy = vec2(float(uint(int(h.x)) >> 8), float(uint(int(h.y)) >> 8)) * (1.0 / 16777216.0) * u_span;
+  CultPhasor ph = cultmath_phacelle(vec3(xy, 0.0), u_side, 0.0, u_norm);
+  o = vec4(length(ph.cos.xyz), length(ph.sin.xyz), ph.cos.w, ph.sin.w);
+}`;
+
+/** Max |grad| of the phasor over `draws * 1024^2` random points; min/max of the cos component. */
+(window as unknown as Record<string, unknown>).__probePhacelle = (
+  side: number[],
+  norm: number,
+  draws: number
+) => {
+  const c = document.createElement('canvas');
+  const gl = c.getContext('webgl2')!;
+  gl.getExtension('EXT_color_buffer_float');
+  const mk = (t: number, s: string) => {
+    const x = gl.createShader(t)!;
+    gl.shaderSource(x, s);
+    gl.compileShader(x);
+    if (!gl.getShaderParameter(x, gl.COMPILE_STATUS)) throw new Error(gl.getShaderInfoLog(x)!);
+    return x;
+  };
+  const p = gl.createProgram()!;
+  gl.attachShader(p, mk(gl.VERTEX_SHADER, vertexSource));
+  gl.attachShader(p, mk(gl.FRAGMENT_SHADER, PROBE_FRAG));
+  gl.linkProgram(p);
+  gl.useProgram(p);
+  const N = 1024;
+  const tex = gl.createTexture();
+  gl.bindTexture(gl.TEXTURE_2D, tex);
+  gl.texStorage2D(gl.TEXTURE_2D, 1, gl.RGBA32F, N, N);
+  const fbo = gl.createFramebuffer();
+  gl.bindFramebuffer(gl.FRAMEBUFFER, fbo);
+  gl.framebufferTexture2D(gl.FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.TEXTURE_2D, tex, 0);
+  gl.viewport(0, 0, N, N);
+  gl.bindVertexArray(gl.createVertexArray());
+  gl.uniform3fv(gl.getUniformLocation(p, 'u_side'), side);
+  gl.uniform1f(gl.getUniformLocation(p, 'u_norm'), norm);
+  gl.uniform1f(gl.getUniformLocation(p, 'u_span'), 400);
+  const buf = new Float32Array(N * N * 4);
+  let gradCos = 0,
+    gradSin = 0,
+    vMin = 1e9,
+    vMax = -1e9,
+    n = 0;
+  for (let d = 0; d < draws; d++) {
+    gl.uniform1f(gl.getUniformLocation(p, 'u_seed'), d + 1);
+    gl.drawArrays(gl.TRIANGLES, 0, 3);
+    gl.readPixels(0, 0, N, N, gl.RGBA, gl.FLOAT, buf);
+    for (let i = 0; i < buf.length; i += 4) {
+      if (buf[i] > gradCos) gradCos = buf[i];
+      if (buf[i + 1] > gradSin) gradSin = buf[i + 1];
+      if (buf[i + 2] < vMin) vMin = buf[i + 2];
+      if (buf[i + 2] > vMax) vMax = buf[i + 2];
+      n++;
+    }
+  }
+  return { samples: n, maxGradCos: gradCos, maxGradSin: gradSin, minCos: vMin, maxCos: vMax };
+};

harness/scene/gradAxis.cjs

@@ -0,0 +1,30 @@
+// Probe: the gradient cultmath_fbm_grad / cultmath_phacelle return for vec3(xz * f, c) is (d/dx, d/dz, d/dc, value),
+// so the world-z slope is .y, not .z. Compares analytic gradients with central differences at one point.
+// Usage (playwright + swiftshader): node harness/scene/gradAxis.cjs <repo>/src/app/features/scene/shaders
+const { chromium } = require('playwright'); const fs=require('fs');
+const S=process.argv[2];
+const cm=fs.readFileSync(S+'/CultMath.glsl','utf8'), ph=fs.readFileSync(S+'/CultMath.Phacelle.glsl','utf8');
+const fs_=`#version 300 es
+precision highp float; precision highp int;
+${cm}
+${ph}
+out vec4 o;
+const float F=1.0/520.0;
+float fb(vec2 p){return cultmath_fbm_grad(vec3(p*F,0.0),4,2.0,0.45).w;}
+float pc(vec2 p){return cultmath_phacelle(vec3(p/40.0,0.5),vec3(1.5,0.5,0.0),0.0,0.5).cos.w;}
+void main(){
+ vec2 p=vec2(1234.5,-777.7); float e=0.5;
+ int k=int(gl_FragCoord.x);
+ if(k==0){vec4 g=cultmath_fbm_grad(vec3(p*F,0.0),4,2.0,0.45); o=vec4(g.xyz*F,0.0);} // analytic per metre: x,y,z
+ else if(k==1){o=vec4((fb(p+vec2(e,0))-fb(p-vec2(e,0)))/(2.0*e),(fb(p+vec2(0,e))-fb(p-vec2(0,e)))/(2.0*e),0,0);}
+ else if(k==2){vec4 g=cultmath_phacelle(vec3(p/40.0,0.5),vec3(1.5,0.5,0.0),0.0,0.5).cos; o=vec4(g.xyz/40.0,0.0);}
+ else {o=vec4((pc(p+vec2(e,0))-pc(p-vec2(e,0)))/(2.0*e),(pc(p+vec2(0,e))-pc(p-vec2(0,e)))/(2.0*e),0,0);}
+}`;
+(async()=>{const b=await chromium.launch({args:['--use-gl=angle','--use-angle=swiftshader','--enable-unsafe-swiftshader']});
+const pg=await b.newPage();
+const r=await pg.evaluate(([src])=>{const c=document.createElement('canvas');const g=c.getContext('webgl2');g.getExtension('EXT_color_buffer_float');
+const mk=(t,s)=>{const x=g.createShader(t);g.shaderSource(x,s);g.compileShader(x);if(!g.getShaderParameter(x,g.COMPILE_STATUS))throw g.getShaderInfoLog(x);return x};
+const p=g.createProgram();g.attachShader(p,mk(g.VERTEX_SHADER,'#version 300 es\nvoid main(){vec2 p=vec2(float((gl_VertexID<<1)&2),float(gl_VertexID&2));gl_Position=vec4(p*2.0-1.0,0.0,1.0);}'));g.attachShader(p,mk(g.FRAGMENT_SHADER,src));g.linkProgram(p);g.useProgram(p);
+const t=g.createTexture();g.bindTexture(g.TEXTURE_2D,t);g.texImage2D(g.TEXTURE_2D,0,g.RGBA32F,4,1,0,g.RGBA,g.FLOAT,null);const f=g.createFramebuffer();g.bindFramebuffer(g.FRAMEBUFFER,f);g.framebufferTexture2D(g.FRAMEBUFFER,g.COLOR_ATTACHMENT0,g.TEXTURE_2D,t,0);g.viewport(0,0,4,1);g.drawArrays(g.TRIANGLES,0,3);
+const o=new Float32Array(16);g.readPixels(0,0,4,1,g.RGBA,g.FLOAT,o);return Array.from(o)},[fs_]).catch(e=>'ERR '+String(e).slice(0,500));
+console.log(Array.isArray(r)?['fbm analytic x,y,z','fbm FD dx,dz','phac analytic','phac FD'].map((n,i)=>n+': '+r.slice(i*4,i*4+3).map(v=>v.toExponential(3)).join('  ')).join('\n'):r);await b.close()})();

harness/scene/ridgeDemo.ts

@@ -0,0 +1,29 @@
+// Standalone page for the ridge scene: full window, no host app. `?tier=still|low|full` picks the
+// tier, `?probe=1` shows the rAF median/p95 readout. The bake record (each chunk's cost, from
+// the scene's `onBake`) and the long tasks the page saw are on `window.bakes` and `window.longTasks`
+// for a driver to read. Not shipped.
+import { startBackgroundScene } from '../../src/app/features/scene';
+import type { SceneTier } from '../../src/app/features/scene';
+
+const q = new URLSearchParams(location.search);
+const tier = (q.get('tier') ?? 'full') as SceneTier;
+const canvas = document.getElementById('c') as HTMLCanvasElement;
+const w = window as unknown as { scene: unknown; bakes: unknown[]; longTasks: number[]; firstViewMs: number };
+w.bakes = [];
+w.longTasks = [];
+try {
+  new PerformanceObserver((l) => l.getEntries().forEach((e) => w.longTasks.push(e.duration))).observe({
+    entryTypes: ['longtask'],
+  });
+} catch {
+  // No long-task entries in this browser.
+}
+const t0 = performance.now();
+startBackgroundScene({ tier }, {}, {
+  canvas,
+  onBake: (b: unknown) => w.bakes.push(b),
+} as never).then((scene) => {
+  w.firstViewMs = performance.now() - t0;
+  w.scene = scene;
+  document.title = scene ? 'ridge: running' : 'ridge: unavailable (CSS ground)';
+});

index.html

@@ -4,33 +4,29 @@
     <meta charset="UTF-8" />
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" />
-    <title>Cinny</title>
+    <title>Ratatoskr</title>
-    <meta name="name" content="Cinny" />
+    <meta name="name" content="Ratatoskr" />
-    <meta name="author" content="Ajay Bura" />
+    <meta name="author" content="GameCult" />
     <meta
       name="description"
       content="A Matrix client where you can enjoy the conversation using simple, elegant and secure interface protected by e2ee with the power of open source."
     />
-    <meta
+    <meta name="keywords" content="ratatoskr, gamecult, matrix, matrix client, matrix.org" />
-      name="keywords"
-      content="cinny, cinnyapp, cinnychat, matrix, matrix client, matrix.org, element"
-    />
 
-    <meta property="og:title" content="Cinny" />
+    <meta property="og:title" content="Ratatoskr" />
-    <meta property="og:url" content="https://cinny.in" />
+    <meta property="og:url" content="https://gamecult.org" />
-    <meta property="og:image" content="https://cinny.in/assets/favicon-48x48.png" />
     <meta
       property="og:description"
       content="A Matrix client where you can enjoy the conversation using simple, elegant and secure interface protected by e2ee with the power of open source."
     />
-    <meta name="theme-color" content="#000000" />
+    <meta name="theme-color" content="#07111a" />
 
     <link id="favicon" rel="shortcut icon" href="./public/favicon.ico" />
 
-    <link rel="manifest" href="/manifest.json" />
+    <link rel="manifest" href="./manifest.json" />
     <meta name="mobile-web-app-capable" content="yes" />
-    <meta name="application-name" content="Cinny" />
+    <meta name="application-name" content="Ratatoskr" />
-    <meta name="apple-mobile-web-app-title" content="Cinny" />
+    <meta name="apple-mobile-web-app-title" content="Ratatoskr" />
     <meta name="apple-mobile-web-app-capable" content="yes" />
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
 

package.json

@@ -1,6 +1,6 @@
 {
-  "name": "cinny",
+  "name": "ratatoskr",
-  "version": "4.12.7",
+  "version": "4.12.8",
   "description": "Yet another matrix client",
   "main": "index.js",
   "type": "module",
@@ -10,6 +10,7 @@
   "scripts": {
     "start": "vite",
     "build": "vite build",
+    "build:preview": "vite build && node scripts/preview-config.js low",
     "preview": "vite preview",
     "lint": "npm run check:eslint && npm run check:prettier",
     "check:eslint": "eslint src/*",
@@ -18,7 +19,10 @@
     "typecheck": "tsc --noEmit",
     "prepare": "husky install",
     "commit": "git-cz",
-    "bump": "node scripts/update-version.js"
+    "bump": "node scripts/update-version.js",
+    "bake:sky": "node scripts/bake-sky.mjs && prettier --write src/sky/baked.ts",
+    "test": "vitest run",
+    "sync:poses": "node scripts/sync-poses.mjs"
   },
   "lint-staged": {
     "*.{ts,tsx,js,jsx}": "eslint",
@@ -36,7 +40,11 @@
     "@atlaskit/pragmatic-drag-and-drop": "1.1.6",
     "@atlaskit/pragmatic-drag-and-drop-auto-scroll": "1.3.0",
     "@atlaskit/pragmatic-drag-and-drop-hitbox": "1.0.3",
+    "@fontsource-variable/nunito": "5.3.0",
+    "@fontsource/ibm-plex-mono": "5.2.5",
     "@fontsource/inter": "4.5.14",
+    "@fontsource/montserrat": "5.2.5",
+    "@fontsource/ubuntu": "5.2.5",
     "@tanstack/react-query": "5.24.1",
     "@tanstack/react-query-devtools": "5.24.1",
     "@tanstack/react-virtual": "3.2.0",
@@ -82,7 +90,7 @@
     "react-i18next": "15.0.0",
     "react-range": "1.8.14",
     "react-router-dom": "6.30.6",
-    "sanitize-html": "2.17.7",
+    "sanitize-html": "2.18.1",
     "slate": "0.123.0",
     "slate-dom": "0.123.0",
     "slate-history": "0.113.1",
@@ -106,6 +114,7 @@
     "@types/ua-parser-js": "0.7.36",
     "@typescript-eslint/eslint-plugin": "5.46.1",
     "@typescript-eslint/parser": "5.46.1",
+    "@vanilla-extract/integration": "6.5.0",
     "@vitejs/plugin-react": "4.2.0",
     "buffer": "6.0.3",
     "cz-conventional-changelog": "3.3.0",
@@ -123,6 +132,7 @@
     "vite": "5.4.19",
     "vite-plugin-pwa": "0.20.5",
     "vite-plugin-static-copy": "1.0.4",
-    "vite-plugin-top-level-await": "1.4.4"
+    "vite-plugin-top-level-await": "1.4.4",
+    "vitest": "1.6.0"
   }
 }

preview-demo/poses/README.md

@@ -0,0 +1,13 @@
+# Demo pose thumbnails
+
+These 36 PNGs (eureka, void and nibu, 12 each; about 1.8 MB, up to 480 px wide, palette-quantised) are downscaled copies of GameCult's own
+Persona art from `/opt/commons/cast-art/poses`. That directory carries no provenance or licence note:
+the image model that made the art and the terms it was made under are not recorded.
+
+They exist only so the dev preview's pretend homeserver (`src/preview-demo/`) can show pose portraits.
+The dev workflow copies them into `dist/public/poses`; real builds sync the full art with
+`npm run sync:poses` and do not use this folder.
+
+Strip them if their terms turn out not to allow this: delete this folder and the `Add the demo pose
+art` step in `.github/workflows/rat-dev-preview.yml`. Pose portraits in the demo then show broken
+images; nothing else depends on them.

public/dings/README.md

@@ -0,0 +1,17 @@
+# Dings
+
+Pre-rendered earcons, served at `public/dings/` and read at runtime by `src/app/features/dings`.
+Aqua renders the clips; nothing here is synthesised in the browser.
+
+    dings/manifest.json
+    dings/senders/<mxid-localpart>/<motif>.ogg
+    dings/neutral/<motif>.ogg
+
+`manifest.json` is `{ "neutral": { <motif>: "<path>" }, "senders": { <localpart>: { <motif>: "<path>" } } }`
+with motif one of `mention`, `dm`, `message`, `invite`; paths are relative to this folder, `.ogg` or `.mp3`.
+A sender's own clip wins, else the neutral clip, else silence. Without a `manifest.json` the client keeps
+its stock notification sounds; once one exists, a motif with no clip is silent.
+
+The set here is Aqua's v4 (AquaSynth merge 21e83ec, staged at minds.gamecult.org/aqua/dings-voices-dd9be66),
+Nibu on proposal 3 (8 kHz 5-bit smoothed sine) for all four events. Nobody has heard it. The client plays none of it unless the
+client config sets `"dings": { "enabled": true }` (default off, as in `config.json`).

public/dings/manifest.json

@@ -0,0 +1,58 @@
+{
+  "neutral": {
+    "mention": "neutral/mention.ogg",
+    "dm": "neutral/dm.ogg",
+    "message": "neutral/message.ogg",
+    "invite": "neutral/invite.ogg"
+  },
+  "senders": {
+    "aqua": {
+      "mention": "senders/aqua/mention.ogg",
+      "dm": "senders/aqua/dm.ogg",
+      "message": "senders/aqua/message.ogg",
+      "invite": "senders/aqua/invite.ogg"
+    },
+    "eureka": {
+      "mention": "senders/eureka/mention.ogg",
+      "dm": "senders/eureka/dm.ogg",
+      "message": "senders/eureka/message.ogg",
+      "invite": "senders/eureka/invite.ogg"
+    },
+    "heimdall": {
+      "mention": "senders/heimdall/mention.ogg",
+      "dm": "senders/heimdall/dm.ogg",
+      "message": "senders/heimdall/message.ogg",
+      "invite": "senders/heimdall/invite.ogg"
+    },
+    "kiko": {
+      "mention": "senders/kiko/mention.ogg",
+      "dm": "senders/kiko/dm.ogg",
+      "message": "senders/kiko/message.ogg",
+      "invite": "senders/kiko/invite.ogg"
+    },
+    "libby": {
+      "mention": "senders/libby/mention.ogg",
+      "dm": "senders/libby/dm.ogg",
+      "message": "senders/libby/message.ogg",
+      "invite": "senders/libby/invite.ogg"
+    },
+    "nibu": {
+      "mention": "senders/nibu/mention.ogg",
+      "dm": "senders/nibu/dm.ogg",
+      "message": "senders/nibu/message.ogg",
+      "invite": "senders/nibu/invite.ogg"
+    },
+    "void": {
+      "mention": "senders/void/mention.ogg",
+      "dm": "senders/void/dm.ogg",
+      "message": "senders/void/message.ogg",
+      "invite": "senders/void/invite.ogg"
+    },
+    "weksa": {
+      "mention": "senders/weksa/mention.ogg",
+      "dm": "senders/weksa/dm.ogg",
+      "message": "senders/weksa/message.ogg",
+      "invite": "senders/weksa/invite.ogg"
+    }
+  }
+}