Nested (no urlOwner), the shell's pick is claimed with its depth, and the owner above records it as
this shell's ?subtab= segment. First paint claims the current tab as a replace, so the segment exists
before a deeper one; a link that names a row arriving with the manifest is still claimed only once the
row is known. The shell reads its tab from its own segment first, then ?tab= only when it names one of
its rows (a one-level partner page), on load and on Back/Forward. Each child is told its depth: 1 under
an owning shell, one deeper otherwise. Pages where the shell owns the address are unchanged.
Each pane's profile-config now carries addressDepth (1 below Studio while Studio owns the address), so a nested shell such as the Research Gallery or Posterverse writes its own tab as ?subtab= at that depth instead of losing it.
Not the owner: a rail pick announces the tab with this shell's depth (claimView),
and an outer owner such as Plugin Studio records it as its subtab segment; on a
partner's page nobody listens and nothing is written. Once the tab is settled
after the manifest (never at mount, so a link's Experimental tab is honoured),
the shell names it once with a replace, so a deeper shell's claim always has
this segment to sit under. On load it reads its own subtab segment when it names
one of its tabs, then tab when it does (a partner's page), else its default.
Back follows the segment only once the shell knows an owner records it.
Children are told their depth: 1 under an owner, else this shell's depth + 1.
As the owner (its own leaf, DX Life) the code path is unchanged.
When a shell sits inside another plugin that owns the address (Plugin Studio → the Research Gallery → …), its own
tab had no key. P1 never wrote it from a nested shell, and P2's ownAddress dropped a nested `tab`, so every tab
inside Studio had the same URL.
`subtab` is a PATH, one segment per nested shell below the owner: ?subtab=regions-dashboard at depth 1, and
?subtab=posterverse.upg-100 when a shell sits inside a shell. There are at most 6 segments, each a plain id.
- A nested shell claims its tab with claimView({ tab }, { depth }), where depth comes from its profile-config
addressDepth (depthOf; its parent passes it down).
- The owner records the claim as that segment: the segments above are kept, the deeper ones and pane/place dropped.
- The same tab again is a no-op (a shell's first-paint claim on a deep link keeps everything below it).
- A segment missing above the claimed depth (a hole) is refused.
- The owner's own tab change drops the whole path.
- subtabAt(search, depth) gives a shell its segment.
Standalone pages and DX Life never see subtab: there the shell is the owner and writes `tab`.
check:view-address H covers depth 1, 2 and 3: first-paint replace, pick push, a composite's pane/place beside
subtab, the same tab claimed again, Back, and the owner's tab change. It has 9 new poisons (52).
Reached as /public/<tree>/, the dev server treats a built bundle as source and
injects an import into its IIFE, so a child loaded as a classic script threw
"Cannot use import statement outside a module" on the staging page. The root
path is tried first; /public/<tree>/ stays last, for a plain static server.
Built trees resolve the manifest before these fallbacks and are unaffected.
On a staging page the manifest fallback was /public/<tree>/manifest.json, which
made /public/<tree>/ the base for every child script. The dev server treats a
/public/… request as source and injects an import into the built IIFE, so the
child failed as a classic script ("Cannot use import statement outside a
module"). The fallback is now /<tree>/manifest.json, where the dev server serves
the built tree unchanged. Built trees are unaffected (they resolve the manifest
before this fallback).
check:dev-leaf-escape and its self-test join gates:pre. The comment on the
dev pages' owner rule named the wrong reason for leaving a framed page
unowned: the frame is a partner page that iframes a leaf (the iframe
embed). Plugin Studio mounts its rows directly.
Four lines outside the swarm section still used 'land' for a change joining development: the agents' first bullet, the Plugin Studio line, the cloud dev server and the laptop-follows paragraph. They now say join / add to the pilot, so 'land' only ever means the landing branch.
The precondition's scope against the pilot (its own step-4 rule): every bundle
that imports ShareButton/MapControlMenu or reads the share catalogue area, plus
the P1 shells. Built one bundle at a time, then bun run tree + fix:sri.
gates:pre 141/0/1, gates:post 99/0/16.
Measured in a browser on a fresh load: ?owner=x&pane=map came back as ?pane=map&owner=x through one replaceState.
viewSearch puts the view keys first, and writeViewKeys compared strings. The link meant the same thing and no Back
step was added, but it was a needless write, and on a host it would be a needless router.replace. writeViewKeys now
compares the parsed tab/pane/place. check:view-address B covers it, with a poison (44); the real-file revert fails.
From the 5B: an observer fires only when the COLUMN resizes. A pane whose height arrives later (styles adopted late
in a shadow root) would have left the link pending, and a pending link blocks the settle's write. check:view-address
covers it: a fresh load whose observer never fires again still opens the link (43 poisons).
Measured in a browser on Country Posters and on Regions: a fresh load with ?pane=<second pane> stayed on the first
pane, with the column's scrollTop 0 at 6 s. The column is built in the composite's onMounted, before it has a
layout, so the pane's offsetTop was 0 when the link was shown. And a ResizeObserver's first callback, which comes
after layout, only recorded the height.
Now the link waits until the column has a height and the pane a top, then shows it once. The wait is the observer's
callback, or a bounded rAF without one. A scroll that settles while the link waits does not overwrite it. The
composite's view readout follows from the scroll event it already listens to.
check:view-address F models a column with no layout at build, whose observer first fires after layout. There are 2
new poisons (42 in all), and restoring the old immediate show in the real file fails the gate.
manifest.json marks 8 maps production (the gallery's 7 plus the country map); Country Posters and Poster Design are in the gallery but still marked experimental, and the README now says so. Publishing tags the outgoing release with its own version (v0.2.0 in the example), which is the rollback point; going back means deploying the previous release's tag.
PR branches start from the pilot and take in the latest pilot by merging, never rebasing; a second
agent, usually the repository's agent, reads the change (and looks at it where it shows). In the lock
the pilot is merged once more, gates:pre and gates:post run with the landing checks
(internal/landing-preconditions.mjs), and the branch is pushed only if nothing fails. There is no
single build owner: each change rebuilds the bundles it reaches, then the tree and SRI. Publishing
tags the outgoing release as a rollback point, runs both gate sets on the exact commit, and builds the
landing demo from the release tag. The counts follow the code: the Research Gallery composes nine maps
(plus Country Posters and Poster Design, both in Prayer Mobilization, so they leave the Experimental
list), ten maps are in production with the country map, and Posterverse brings six poster plugins
together. The glossary's "merge" row matches.
ownAddress on the shell's element, while the page owns its address: a nested
composite's open pane or selected place is written by this shell, the page's
one writer, and a nested element can never switch the shell's tab. Released
in beforeUnmount.
Studio owns the page address and writes ?tab=. A composite nested in a
tab announces its own choice (its open pane, its selected place); Studio
now records that beside ?tab=, while it owns the address, so a reload
or a sent link opens the same pane and place. Only pane and place: the
tab stays Studio's own. The listener is released on unmount, before the
hot-update return.
The shell owns the address for the views inside its tabs too: a nested
composite's ?pane= / ?place= choice is recorded through the shared helper, only
while this page owns its address, never as a tab switch, and the event stops at
the shell.
- ownAddress records only pane and place. tab is the owner's own key, so a nested announcement cannot switch it.
- A shell keeps Regions (and UPG100) alive when another tab is open. Switching back dropped ?pane= and ?place=
(the tab change), while the screen still showed them. pane-wrapper and region-dashboards now watch for being
shown again (a ResizeObserver: no height, then height) and claim their pane / place back with a replace. An
address that names one wins, because Back to an entry of this tab is applied while the column has no layout.
- scrollTo(id, null) behaves as scrollTo(id).
check:view-address covers each of these (34 poisons, each caught). The slow pane-wrapper arm runs only for
pane-wrapper poisons, so the self-test takes 16 s.
The agent model names exactly three roles: one agent per repository (handles its branches, watches the work in it), one agent per plugin, and one shepherd agent that all the other agents talk to, which keeps order and puts the merges onto the pilot in order. The harness paragraph, the kitchen list, the alt text and the diagram's circle, caption and legend say shepherd. The PNG is re-rendered at 2x.
With the roles as they are (one coordinator, one repo agent per repository, one agent per plugin), the step that read every change before it joins the pilot is the repo agent's, not an unnamed second reader: the summary row, the PR-branch bullet, the diagram's banner and its step 2 card say so. The PNG is re-rendered at 2x.
The swarm section and the delegation diagram named a gate-keeper that checks each merge; that role
does not exist. The roles are one coordinator agent that puts the merges onto the pilot in order, one
repo agent per repository that handles its branches and watches the work being done in it, and one
agent per plugin. The harness paragraph, the kitchen list, the alt text, the diagram's second circle,
its caption and its legend say so, and the Experimental shelf's "roaming agent" becomes an agent per
plugin. The PNG is re-rendered at 2x.
The deploy5-desktop card read "Proven, not yet live", which the desktop section now contradicts: the desktop app works and Rudder is its proof. The README's only use of it goes, and so do the card and its SVG source, which nothing else uses. The sentence that the map app runs as a desktop app the same way stays.
pageLink() drops ?tk= from the page's address: a leaf page reads a token from
there and leaves it in place, so pressing Share would have sent it. The URL is
rewritten only when tk is present; every other link is the address as it stands.
The comments name the page, not who measured it, and no longer cite a request.
check:map-menu-anchor strips a same-line comment before testing each return, so
a fallback named only in a comment no longer passes.
The address gets its second and third keys:
- ?pane= is the open view of a composite;
- ?place= is Regions' subject.
Both keep the ONE-writer rule:
- On its own leaf the composite owns the address and writes.
- Nested in a shell it announces, and the shell writes.
- On a partner's page nothing is written; a link is still read.
useViewAddress:
- claimView() is the one call for a reader's choice: the owner writes it, any other element announces it.
- ownAddress() lets an owner record its nested elements' announcements, and stops them there.
- An announcement carries only the view keys, one event per action.
- pane and place are siblings: a tab change drops both, but a pane change keeps the place, because Regions keeps
its region while the reader is on the list.
pane-wrapper (buildPaneColumn) takes an opt-in `address`:
- a link opens its pane without writing;
- a click is a push, and a selection made by the same click rides in the same push (one Back step);
- where the reader's scroll settles is a replace;
- Back/Forward scroll and never write;
- the first pane is the default and is never written.
Regions:
- regions-mfe opts its column in and records its panes' announcements on its own leaf. A list click opens the
dashboard with its place in one write.
- region-dashboards claims ?place= instead of writing its #slug with its own pushState (replace at first paint,
push on a choice, re-applied on Back). An old #slug link still opens, and on its own leaf it is rewritten to
?place=.
- urlSync:false now guards only the tab title.
check:view-address adds:
- E: nested claims and the owner;
- F: pane-wrapper on a simulated column;
- G: the Regions wiring.
The census drops region-dashboards (5 writers now). Self-test: 29 poisons, each caught. Real-source mutations are
caught too.
The dev leaf route wrote the URL's parts into the page's <title> and the
element's profile-config attribute, refusing only .. and /. A quote or a
tag in a crafted link broke out of the attribute on a publicly reachable
dev server. Each part must now have the shape every bundle, profile and
instance id has, before it reaches either; the title is escaped too.
check:dev-leaf-escape drives the plugin's own middleware: every leaf the
dev manifest advertises is still served in both URL forms, hostile parts
are refused in every position, and the title escapes on its own.
ShareButton: the first tab is "Share this page", the link to exactly what the
reader is looking at. Where the page owns its address (urlOwner 'app' or 'host',
on the map's own profile-config or any element above it across shadow roots)
that is the page's own URL, read at open and at copy; on a partner's page it is
the map's own page, as before. The second tab, "Embed", says in plain words what
embedding is and why it helps, keeps the buttons.shareSteps list, then the paste
hint, the sizes and the code. Copy/sizes labels come from the catalogue.
MapControlMenu: a standalone anchor (a Share button outside any map toolbar)
resolves where its menu lives when it opens, and places it below the button,
toward the side with room, inside the viewport, at the readable width (340 or the
viewport minus its edges), converting into the menu's real containing block. The
render-time area tag that sent header menus far left and narrow is gone. Map
toolbars keep their placement unchanged.
English only for now (the new share.json keys are recorded as translation debt in
check:i18n-parity). check:map-menu-anchor reads a resolution that lives in a named
function, every named-area return must keep its structural fallback.
