Rebuild 8 bundles for the print warnings (a sheet that cannot be generated; a page that is not secure), and regenerate the tree and SRI

At the floor tier the gap between points is 3px (was 5px) and the point text 18px (was 18.5px). All 11
languages fit one sheet; several now take a larger tier. The packet-strings pin is renewed for the new wording.

README.md

@@ -26,7 +26,7 @@ Made by Vibe Coders for Vibe Coders to prepare the way of the Lord and make His
   relational-stewardship training (bounded and centered sets).
 - **What each map is for:**
   - **Big Picture:** the library's own interface, the one agents use to build maps.
-  - **UPG-100:** the most strategic. It divides the task into prayer packets.
+  - **UPG100 List:** the most strategic. It divides the task into prayer packets.
   - **Gospel maps:** the resources that exist in each language.
   - **UPG Neighbor:** the reached neighbors near each unreached group.
   - **Gospel × Internet:** all of it, together. Built for linguists, catalysts, translators (human
@@ -37,8 +37,9 @@ Built with love, with the prayer that these maps bless the nations.
 **A blessing for you.** These maps and posters are given to bless the people who bless the nations.
 We love you, and we are thankful for your work. We bless you in Jesus' name.
 
-Every poster is in Posterverse (`plugin-designs/posterverse/`): the UPG 100 List, Country Posters,
-Poster Design and Wall of People Groups. They are all in the Plugin Studio (`bun run dev`) too.
+Posterverse (`plugin-designs/posterverse/`) brings the six poster plugins together: UPG100 Posters, Country
+Posters, Poster Design, Wall of People Groups, Bible Posters and Bless India Posters. They are all in the
+Plugin Studio (`bun run dev`) too.
 
 # dx-maps — one build, maps that embed everywhere
 
@@ -60,7 +61,7 @@ capabilities, three outputs, one shared library, one build.
 | 🔗 **Maps that talk to each other** | Maps share props and events, so one app can nest them and a click in one can move another. |
 | 🪶 **Small bundles** | Each map's file carries only the parts of the shared library it uses (tree-shaken). |
 | ⚙️ **One build step** | `bun run build` makes every map at once. |
-| 📦 **Three outputs** | A web folder (iframe, script embed), a mobile app, a desktop app — [the 3 outputs](#what-the-build-makes--3-outputs). |
+| 📦 **Three outputs** | A web folder (iframe, script embed), a mobile app, and a desktop app built from the same code you run in the browser — [the 3 outputs](#what-the-build-makes--3-outputs). |
 
 | What dx-maps set out to do | Proof |
 |---|---|
@@ -70,7 +71,7 @@ capabilities, three outputs, one shared library, one build.
 | **One app nests every map** — and each stays embeddable on its own | [capability 5](#capability-5--app-shell-the-research-gallery) · `bun run check:composite-reg` |
 | **5 capabilities, every one shippable in every output** | `bun run verify:5-caps` |
 | **Shared library, private plugins** — reuse without breaking each other | `bun run check:library-index` |
-| **One owner per plugin, a second reader for every change, one landing at a time** | [agent swarm](#build-it-with-an-agent-swarm) |
+| **One agent per plugin, the repo agent reads every change, one merge at a time** | [agent swarm](#build-it-with-an-agent-swarm) |
 
 ## For vibe coders: build, open the Studio, embed a map
 
@@ -119,15 +120,15 @@ people groups of the world. When you work here, the goal is one of these:
 | **Reach a city** | Regions (`regions-dashboard`) and the country map (`country-map`): the people groups of each country. The production maps work by country and region; city-level planning (Prayer Walk Planner) is still experimental |
 | **Mobilize for people groups** | Big Picture (`dashboard-plus-grid`); Simple Research (`research-map-plus-grid`) |
 | **Plan outreach** | Gospel Resources (`gospel-resources`): what exists in each language; Cities with Internet (`cities-internet`): whether a group can be reached online |
-| **Pray: packets and prayer resources** | UPG 100 List (`my-upg-100-list`), Regions and Simple Research: posters and prayer packets; Prayer Progress (`doxa-simple-map`) |
+| **Pray: packets and prayer resources** | UPG100 Posters (`my-upg-100-list`), Regions and Simple Research: posters and prayer packets; Prayer Progress (`doxa-simple-map`) |
 
 - **Start with the skill:** [`skills/plugin-designer`](./skills/plugin-designer) teaches the patterns, the shared
   library and the checks.
 - **One plugin per folder** in `plugin-designs/`; shared code goes in `library/` only if it stays reusable for
   every other plugin.
-- **Land on `development`**, one change at a time through the lock, with `bun run gates:pre` passing. `main` is
+- **Join `development`** (the pilot), one change at a time through the lock, with `gates:pre`, `gates:post` and the landing checks passing. `main` is
   production and moves only on a publish.
-- These 8 maps are in production: the 7 in the gallery, plus the country map for DX Life's country pages. The
+- These 8 maps are in production: the 7 production maps in the gallery, plus the country map for DX Life's country pages. The
   other maps are experimental: leave them as they are unless your task is one
   of them.
 
@@ -135,11 +136,12 @@ people groups of the world. When you work here, the goal is one of these:
 
 ---
 
-## The 7 production maps
+## The production maps
 
-**Seven maps DX uses today** — each one a plugin you can embed on its own, and all seven together in
-the Research Gallery, which DX Life publishes as **Deep Research**. An eighth production map, the country map
-(`country-map`), draws DX Life's country pages; it isn't in the gallery.
+**Seven production maps DX uses today, all together in the Research Gallery**, which DX Life publishes
+as **Deep Research**; each one is also a plugin you can embed on its own. The gallery also carries two
+poster plugins still marked experimental, Country Posters and Poster Design (see Posterverse). An eighth
+production map, the country map (`country-map`), draws DX Life's country pages; it isn't in the gallery.
 
 <table>
 <tr>
@@ -149,10 +151,10 @@ the Research Gallery, which DX Life publishes as **Deep Research**. An eighth pr
 <td width="25%" valign="top"><img src="documentation/readme-images/cap2-prayer.png" alt="Prayer Progress"><br><b>Prayer Progress</b><br><sub>where prayer is happening, and where it is still needed</sub></td>
 </tr>
 <tr>
-<td width="25%" valign="top"><img src="documentation/readme-images/cap4-upg100-mfe.png" alt="UPG-100 List"><br><b>UPG-100 List</b><br><sub>prayer lists of 100 people groups, with posters to print</sub></td>
+<td width="25%" valign="top"><img src="documentation/readme-images/cap4-upg100-mfe.png" alt="UPG100 Posters"><br><b>UPG100 Posters</b><br><sub>prayer lists of 100 people groups, with posters to print</sub></td>
 <td width="25%" valign="top"><img src="documentation/readme-images/prod-cities-internet.png" alt="Cities with Internet"><br><b>Cities with Internet</b><br><sub>internet access where unreached people groups live</sub></td>
 <td width="25%" valign="top"><img src="documentation/readme-images/prod-gospel-resources.png" alt="Gospel Resources"><br><b>Gospel Resources</b><br><sub>which people groups have scripture, film or audio — and which have nothing</sub></td>
-<td width="25%" valign="top"><img src="documentation/readme-images/cap5-doxa-maps-spa.png" alt="Research Gallery"><br><b>Research Gallery</b><br><sub>all seven in one app — capability 5</sub></td>
+<td width="25%" valign="top"><img src="documentation/readme-images/cap5-doxa-maps-spa.png" alt="Research Gallery"><br><b>Research Gallery</b><br><sub>all nine in one app — capability 5</sub></td>
 </tr>
 </table>
 
@@ -163,7 +165,7 @@ the Research Gallery, which DX Life publishes as **Deep Research**. An eighth pr
 <td width="25%" valign="top"><img src="documentation/readme-images/prod-simple-research-phone.png" alt="Simple Research on a phone"><br><b>Simple Research</b></td>
 <td width="25%" valign="top"><img src="documentation/readme-images/prod-regions-phone.png" alt="Regions on a phone"><br><b>Regions</b></td>
 <td width="25%" valign="top"><img src="documentation/readme-images/prod-prayer-phone.png" alt="Prayer Progress on a phone"><br><b>Prayer Progress</b></td>
-<td width="25%" valign="top"><img src="documentation/readme-images/deploy2-mobile-upg100.png" alt="UPG-100 List on a phone"><br><b>UPG-100 List</b></td>
+<td width="25%" valign="top"><img src="documentation/readme-images/deploy2-mobile-upg100.png" alt="UPG100 Posters on a phone"><br><b>UPG100 Posters</b></td>
 </tr>
 <tr>
 <td width="25%" valign="top"><img src="documentation/readme-images/prod-cities-internet-phone.png" alt="Cities with Internet on a phone"><br><b>Cities with Internet</b></td>
@@ -173,12 +175,36 @@ the Research Gallery, which DX Life publishes as **Deep Research**. An eighth pr
 </tr>
 </table>
 
+### Print your first poster
+
+1. **Open a poster wall:** *UPG100 Posters*, *Country Posters*, or *Regions* (its **View country posters**
+   button). Every card on the wall has a **Print Options** strip. India's whole-country poster isn't
+   available yet; its state posters are.
+2. **Pick what to print:** **Poster Map** (the poster), **Prayer List** (choose **Full detail** or
+   **Lightweight**) or **Card Deck** (choose a card size). On *UPG100 Posters*, clicking the poster
+   picture prints it too.
+3. **Your browser's print window opens, and it is the preview.** Choose the printer and print. Nothing
+   is downloaded; to keep a file, choose **Save as PDF** instead of a printer.
+
+Posters, lists and packets print on Letter-size pages (8.5 × 11 in). Cards print at their own size:
+2.5 × 3.5 in, 4 × 6 in or A6.
+
+**Bigger posters.** *Bible Posters* and the *Wall of People Groups* also offer bigger sizes, up to 5 × 8
+ft, for a print shop: in the print window choose **Save as PDF** and send the file. The Wall's 5 × 8 ft
+poster prints as 3 sheets, one per page, stacked so that each overlaps the next by 6 in; every sheet is
+numbered (1 / 3, 2 / 3 …) and marked **glue here** where the next one goes.
+
+**On a phone.** The same print window rises over the page; choose **Save as PDF** to keep the file or
+send it on. A phone prints page sizes only (Letter or A4 paper), and the largest poster sizes are
+switched off there. A few prints say they need a computer: *Bless India Posters*, the *Wall of People
+Groups* and a selection of more than 1,000 groups on *UPG100 Posters*.
+
 ### Every capability ships every way
 
 | Capability | Example | iframe | Mobile app | JavaScript embed | WordPress / Disciple Tools | Desktop |
 |---|---|:-:|:-:|:-:|:-:|:-:|
 | **5 — app shell** | Research Gallery | ✅ | ✅ | ✅ | 🧪 | ✅ |
-| **4 — composite** | UPG-100 List | ✅ | ✅ | ✅ | 🧪 | ✅ |
+| **4 — composite** | UPG100 Posters | ✅ | ✅ | ✅ | 🧪 | ✅ |
 | **3 — multi-view** | research map | ✅ | ✅ | ✅ | 🧪 | ✅ |
 | **2 — presets** | Prayer Progress | ✅ | ✅ | ✅ | 🧪 | ✅ |
 | **1 — single element** | all people groups | ✅ | ✅ | ✅ | 🧪 | ✅ |
@@ -235,10 +261,9 @@ If you build with AI agents, this repo is made for you:
   updating the moment you save.
 - **Speak instead of typing.** Rudder, an offline voice-to-text tool, sits as a corner widget in the
   Studio: look at a plugin, say what you see, and hand the text to your agent. Nothing leaves your
-  computer (Linux today).
-- **One plugin, several outputs.** The same plugin ships as a web embed or a mobile app, and a plugin
-  can target the desktop: Rudder is the desktop example, a corner widget in the Studio and its own
-  desktop app (`bun run desktop:build rudder-voice`, see [HOWTO-build-the-desktop-app](./documentation/HOWTO-build-the-desktop-app.md)).
+  computer. It also runs as its own desktop app.
+- **One plugin, several outputs.** The same code ships as a web embed, a mobile app or a desktop app
+  ([the desktop app](#output-3--the-desktop-app--works-today)).
 - **Build together.** [Run it in the cloud](#run-it-in-the-cloud) gives a whole team one shared dev
   server.
 
@@ -251,8 +276,8 @@ embed just the one you need.
 |---|---|---|
 | a **translator** (or an AI translation pipeline) | Gospel Resources (map, list, data tables) | which people groups have no Scripture, film or audio in their language, and which bridge language already reaches them |
 | **media to movements** | Cities with Internet · Gospel × Internet | where unreached people groups live with internet access, country by country and down to province where data exists |
-| a **catalyst** or mobilizer | Big Picture · Prayer Walk Planner · UPG 100 List · Gospel × Internet | find **gospel resources** for the people you are reaching real time, build prayer walking maps for real outreach, as you prayer walk each key zone in your cities of choice, find indigenous disciples, groups, and leaders mobilize them each to have prayer packets, cards and posters to blanket all the people groups in prayer as a prayer mobilizer catalyst  |
-| **praying** | Prayer Progress · UPG-100 List | where prayer is covered and where it is still needed; print a **Prayer List**, **Poster Map** or **Card Deck** for a list of 100 |
+| a **catalyst** or mobilizer | Big Picture · Prayer Walk Planner · UPG100 Posters · Gospel × Internet | find **gospel resources** for the people you are reaching real time, build prayer walking maps for real outreach, as you prayer walk each key zone in your cities of choice, find indigenous disciples, groups, and leaders mobilize them each to have prayer packets, cards and posters to blanket all the people groups in prayer as a prayer mobilizer catalyst  |
+| **praying** | Prayer Progress · UPG100 Posters | where prayer is covered and where it is still needed; print a **Prayer List**, **Poster Map** or **Card Deck** for a list of 100 |
 | a **teacher** or presenter | the Research Gallery | every map in one app, multiple languages support |
 
 <details>
@@ -302,7 +327,7 @@ improvement on the next build.
 </details>
 
 <details>
-<summary><b>What the Research Gallery is made of — seven production maps, an Experimental shelf, all five capabilities in one plugin</b></summary>
+<summary><b>What the Research Gallery is made of — seven production maps, two poster plugins, an Experimental shelf, all five capabilities in one plugin</b></summary>
 
 ```text
 Research Gallery                          <doxa-maps-spa>          capability 5
@@ -317,10 +342,12 @@ Research Gallery                          <doxa-maps-spa>          capability 5
 │      ├─ regions list                    regions-list             capability 1
 │      └─ region dashboards               region-dashboards        capability 1
 ├─ Prayer Mobilization
-│  ├─ UPG-100 List                        upg-100-mfe              capability 4
-│  │   ├─ list                            upg-100-list             capability 1
+│  ├─ Prayer Progress                     doxa-simple-map          capability 2
+│  ├─ UPG100 Posters                      upg-100-mfe              capability 4
+│  │   ├─ zoned map                       upg-100-list             capability 1
 │  │   └─ poster wall                     poster-wall              capability 1
-│  └─ Prayer Progress                     doxa-simple-map          capability 2
+│  ├─ Country Posters                     country-posters-mfe      capability 4
+│  └─ Poster Design                       poster-design-mfe        capability 4
 ├─ Gospel Research
 │  ├─ Cities with Internet                connectivity-map         capability 1
 │  └─ Gospel Resources                    resources-map            capability 1
@@ -328,7 +355,6 @@ Research Gallery                          <doxa-maps-spa>          capability 5
    ├─ prayer walk planner                 prayer-walk-planner      capability 1
    ├─ UPG neighbor                        upg-neighbor             capability 3
    ├─ all people groups                   all-people-groups        capability 1
-   ├─ country posters                     country-posters          capability 4
    ├─ vision card                         doxa-vision-card         capability 2
    ├─ PPLR data maps                      pplr-data-maps           capability 3
    └─ Wall of People Groups               wall-of-people-groups    capability 3
@@ -340,11 +366,11 @@ Research Gallery                          <doxa-maps-spa>          capability 5
 
 **Several plugins glued into one**, talking to each other — and each piece still embeddable alone.
 
-![Capability 4 — the UPG-100 composite (my-upg-100-list)](documentation/readme-images/cap4-upg100-mfe.png)
+![Capability 4 — the UPG100 Posters composite (my-upg-100-list)](documentation/readme-images/cap4-upg100-mfe.png)
 
 | List (capability 1, embeddable alone) | Poster wall (capability 1, embeddable alone) |
 |---|---|
-| ![UPG-100 list leaf](documentation/readme-images/cap4-upg100-list.png) | ![UPG-100 poster-wall leaf](documentation/readme-images/cap4-upg100-poster-wall.png) |
+| ![UPG100 Posters zoned-map leaf](documentation/readme-images/cap4-upg100-list.png) | ![UPG100 Posters poster-wall leaf](documentation/readme-images/cap4-upg100-poster-wall.png) |
 
 <details>
 <summary><b>More about capability 4 — composites</b></summary>
@@ -354,7 +380,7 @@ as views you switch between — and ships the set as **one new element**. The pi
 **props** (settings passed in) and **events** (messages sent out): click a region in one piece and
 another piece updates. Nothing is copied, so each piece can still be embedded on its own.
 
-- **Example:** `plugin-designs/my-upg-100-list/` — the UPG-100 list and its poster wall, joined into
+- **Example:** `plugin-designs/my-upg-100-list/` — the UPG100 Posters zoned map and its poster wall, joined into
   `upg-100-mfe`. Big Picture, Simple Research and Regions are composites too.
 - **How to declare one:** a `<name>.meta.json` beside it with `"type": "nested-elements-mfe"` and a
   `"composes"` list of the plugins inside.
@@ -474,7 +500,7 @@ files in the repo. The `Dockerfile` and `compose.yaml` sit at the repo root; rec
 
 **Plugin Studio: the public Studio, with PocketBase.** The highest route: the same container with
 `ACCESS=public`, on your research subdomain.
-- The Plugin Studio follows `development` and is open to everyone, so what agents land shows up live.
+- The Plugin Studio follows `development` and is open to everyone, so what agents add to the pilot shows up live.
 - Its `/cdn`, built from `main`, serves your site's production maps.
 - Publishing and PocketBase's dashboard ask for a password you set when you deploy; OIDC stays available.
 
@@ -572,13 +598,13 @@ installed.
 **The same maps, wrapped as a phone app.** No new code — the maps are JAMstack: they fetch their data
 from a remote API, which is exactly what a mobile app needs.
 
-<p align="center"><img src="documentation/readme-images/deploy2-mobile-upg100.png" alt="Mobile app — the UPG-100 list at phone size" width="320"></p>
+<p align="center"><img src="documentation/readme-images/deploy2-mobile-upg100.png" alt="Mobile app — UPG100 Posters at phone size" width="320"></p>
 
 <details>
 <summary><b>More about the mobile app</b></summary>
 
 [Capacitor](https://capacitorjs.com) wraps the built folder into an Android app. Shown here: the
-UPG-100 prayer lists and posters at phone size, each poster with its own print options.
+UPG100 prayer lists and posters at phone size, each poster with its own print options.
 
 ```bash
 bun run check:mobile   # checks the app is wired up correctly — needs no Android tools
@@ -591,21 +617,38 @@ bun run phone          # builds the app and installs it on a phone or emulator
 
 ### Output 3 — the desktop app ✅ works today
 
-**We got the JAMstack map app running as a desktop app.**
-
-![Desktop app (Tauri), working](documentation/readme-images/deploy5-desktop.png)
-
-**Rudder, the voice-to-text plugin, runs as its own desktop app too**, built with
-`bun run desktop:build rudder-voice` ([HOWTO-build-the-desktop-app](./documentation/HOWTO-build-the-desktop-app.md)).
+**Run it in your browser, then ship the same code as a desktop app.** [Tauri](https://tauri.app) wraps
+it in a small Rust program that runs on your computer. Rudder, the offline voice-to-text plugin, is the
+proof: its Linux desktop app works and is used to dictate the work on many of these maps. Its goal is
+private voice-to-text that you own: offline, no telemetry, no cloud.
 
 ![Rudder, the offline voice-to-text desktop app, running](documentation/readme-images/deploy5-desktop-rudder.png)
 
 <details>
-<summary><b>More about the desktop app</b></summary>
+<summary><b>More: how it works, Rudder's goal, and what isn't run yet</b></summary>
 
-[Tauri](https://tauri.app) wraps the same built folder into a desktop program: it produced a Linux
-app and a `.deb` installer. It isn't in the dx bundler for production yet — and the Research Gallery
-could become a strong desktop app.
+**How it works.** What you build and try on the development server (`bun run dev`) is what ships to
+the desktop; there is no second code base. Rudder runs as a corner widget in the Plugin Studio and as
+its own desktop app, built with `bun run desktop:build rudder-voice`
+([HOWTO-build-the-desktop-app](./documentation/HOWTO-build-the-desktop-app.md)): look at a plugin, say
+what you see, and hand the text to an agent. The map app runs as a desktop app the same way.
+
+**Rudder's goal, from the start: private voice-to-text that you own.**
+
+- **Offline, with no telemetry and no cloud.** Your own code and your own self-hosted speech model
+  (NVIDIA's open NeMo-Speech.cpp runtime and a small speech model, about 742 MB) run on a modest amount
+  of your computer's CPU. After a one-time download of the runtime and the model, nothing needs the
+  network; a trace of the speech runtime showed zero sockets and zero DNS lookups. The aim is that it
+  works out of the box: today the first-run download is still a manual step.
+- **Be careful who commits to Rudder.** A voice-to-text tool hears everything said near it, so one
+  bad change could turn it into spyware. Take changes to `plugin-designs/rudder-voice/` and
+  `backend/rudder-engine/` only from people you trust, and have a second person read every one.
+- **Planned: an egress monitor** that shows you, as it runs, that Rudder sends no data out to anyone.
+
+**What isn't run yet.** Tauri builds a Linux app and a `.deb` installer today. The macOS and Windows
+builds are set up but have not been run ([the HOWTO](./documentation/HOWTO-build-the-desktop-app.md)
+says which steps are proven). The desktop build runs on demand with the commands below; the automatic
+production build doesn't make it yet. The Research Gallery could become a strong desktop app too.
 
 ```bash
 bun run check:tauri    # checks the desktop setup — needs no Rust tools
@@ -655,9 +698,9 @@ with the bundle. `bun run check:sri` keeps the manifest and the built pages in s
 **Every map speaks 11 languages** — add `?lang=<code>` to a map's page address, or, when a map is embedded in
 your own page, set `"locale"` in its `profile-config`. Arabic reads right to left.
 
-![UPG-100 List in Arabic, right to left](documentation/readme-images/lang-arabic-upg100.png)
+![UPG100 Posters in Arabic, right to left](documentation/readme-images/lang-arabic-upg100.png)
 
-<sub>UPG-100 List with `?lang=ar`: the interface is in Arabic; people-group and place names come from the data.</sub>
+<sub>UPG100 Posters with `?lang=ar`: the interface is in Arabic; people-group and place names come from the data.</sub>
 
 | Code | Language | | Code | Language |
 |---|---|---|---|---|
@@ -695,61 +738,106 @@ your own page, set `"locale"` in its `profile-config`. Arabic reads right to lef
 ## Build it with an agent swarm
 
 **Many AI agents can build many plugins at once without breaking each other's work.** Every plugin
-has one agent that owns it, and changes are added to `development`, the shared working version, one
-at a time. `main` is the production version: it moves only when you publish a release.
+has one agent that owns it, and the work moves through three kinds of branch:
+
+- **The pilot branch (`development`)** is where reviewed PR branches come together. A pilot server
+  with hot reload follows it, so each change that joins can be seen there within about 15 seconds.
+- **The landing branch (`main`)** is what ships. It moves only when a person approves a publish, and
+  the landing server rebuilds from it.
+- **PR branches** hold one plugin or feature each. They start from the pilot branch, take in the latest
+  pilot by merging (never rebasing), and join it one at a time, after the checks pass and a second agent,
+  usually the repository's agent, has read the change.
+
+**It scales by adding PR branches, not by sharing one.** Many people, each with several agents, can
+work on many plugins at the same time: every plugin or feature gets its own PR branch, and each one
+can be seen on the pilot server as soon as it joins the pilot.
 
 **Bring your own harness.** dx-maps works with whatever AI coding agent or agent harness you already
 use. The repo gives you the branch strategy below, the checks (`bun run gates:pre`) and the Plugin
-Studio; it does not ship a harness. Roles such as a coordinator that puts the landings in order, or a
-gate-keeper that reads each change before it lands, are jobs your harness gives to its agents.
+Studio; it does not ship a harness. There are three roles: one agent per repository, which handles its
+branches and watches the work being done in it; one agent per plugin; and one shepherd agent that all the
+other agents talk to, which keeps order and puts the merges onto the pilot in order. Your harness gives
+these jobs to its agents.
 
-![The delegation model: development at the centre behind a landing lock, inside the Plugin Studio; eight plugins around it, each owned by one agent; a coordinator and a gate-keeper over the agents; below, how a change lands in four steps, and the three outputs](documentation/readme-images/delegation-model.png)
+![The delegation model: the pilot branch (development) at the centre behind the pilot lock; publishing to the landing branch (main) and its outputs below it; inside the Plugin Studio; eight plugins around it, each owned by one agent; a shepherd and a repo agent over the plugin agents; below, how a change joins the pilot and then reaches the landing branch, in four steps, the three outputs, and how it scales: one PR branch per plugin, a self-hosted git service, and publishing to a public host only from the landing branch](documentation/readme-images/delegation-model.png)
 
 <sub>[Open the diagram full size](documentation/readme-images/delegation-model.png): on a phone its small text needs it.</sub>
 
 ### Set up the branch strategy
 
-1. **`main` is production.** It moves only when you publish a release (step 7).
-2. **`development` is the shared working branch.** Create it once, from `main`:
+1. **The landing branch (`main`) is what ships.** It moves only when a person approves a publish (step 7).
+2. **The pilot branch (`development`) is the shared working branch.** Create it once, from `main`:
    ```bash
    git fetch origin && git switch -c development origin/main && git push -u origin development
    ```
-3. **One branch and worktree per plugin agent**, from `origin/development`, then install once in each:
+3. **One PR branch and worktree per feature**, each started from the pilot branch, then install
+   once in each:
    ```bash
    git worktree add -b regions/work ../dx-maps-regions origin/development
    git worktree add -b upg100/work  ../dx-maps-upg100  origin/development
    cd ../dx-maps-regions && bun install --frozen-lockfile
    ```
-4. **One preview server per agent, each on its own port:**
+4. **One preview server per agent on your own machine, each on its own port** (in the cloud, the one
+   pilot server below takes this role):
    ```bash
    bun x vite --port 5301 --strictPort    # the next agent uses 5302, and so on
    ```
-5. **Land one at a time, through a lock.** Catch up with `development`, run the checks, and push only
-   if nothing fails (`gates:pre` exits non-zero when a check fails, so the push never runs then):
+5. **Join the pilot one at a time, through a lock that works like a merge queue.** First merge the
+   latest pilot into your PR branch (merge, never rebase) and fix any clash there. A second agent reads
+   the change, and looks at it on screen where it shows. Then, inside the lock, merge the pilot once more
+   in case it moved, run the checks (`gates:pre`, `gates:post`) and the landing checks (fresh bundles,
+   the tree, the integrity hashes, no conflict markers), and push only if nothing fails:
    ```bash
+   git fetch origin && git merge --no-edit origin/development    # on your PR branch: the latest pilot
    flock /tmp/dx-maps-development.lock sh -c '
-     git fetch origin && git rebase origin/development &&
-     bun run gates:pre && git push origin HEAD:development'
+     git fetch origin && git merge --no-edit origin/development &&
+     bun run gates:pre && bun run gates:post &&
+     node internal/landing-preconditions.mjs &&
+     git push origin HEAD:development'
    ```
-   `flock` guards one machine. Agents on several machines need a shared lock, such as one your
+   If the merge stops on a conflict, run `git merge --abort`, fix the clash on your PR branch and join
+   again. `flock` guards one machine. Agents on several machines need a shared lock, such as one your
    harness provides.
-6. **One agent owns the full build**; the others build only their own plugin:
+6. **Each change rebuilds what it touches.** There is no single build owner: rebuild every bundle your
+   change reaches, then the tree and the integrity hashes, and commit them with the change. The landing
+   checks refuse a change whose bundles are stale:
    ```bash
-   BUILD_ALLOW=1 bun run build                                          # the build owner: every plugin
-   BUNDLE=<name> bun x vite build && bun run tree && bun run fix:sri    # everyone else: one plugin
+   BUNDLE=<name> bun x vite build      # each bundle your change reaches
+   bun run tree && bun run fix:sri     # then the tree and the integrity hashes
    ```
-7. **Release:** fast-forward `main` to a `development` commit that passed the checks, tag it, and
-   deploy from the tag:
+   Only a change to the build itself (its config or its dependencies) reaches every bundle:
+   `BUILD_ALLOW=1 bun run build`.
+7. **Publish, when a person approves it:** make sure the release the landing branch is on now has its
+   own version tag (that tag is the rollback point), fast-forward the landing branch to a pilot commit
+   that passed the checks, tag it, and deploy from the tag:
    ```bash
    git fetch origin && git switch main && git merge --ff-only origin/main
+   git tag -a v0.2.0 -m "Release v0.2.0" && git push origin v0.2.0   # the outgoing release, if untagged
    git merge --ff-only <development-commit>   # a commit that passed the checks
-   bun run gates:pre                          # the checks must pass on exactly this commit
+   bun run gates:pre && bun run gates:post    # the checks must pass on exactly this commit
    git tag -a v1.0.0 -m "Release v1.0.0" && git push origin main v1.0.0
    ```
-   The tag's `public/dx-maps/` folder is the built site: deploy that
-   ([how to deploy](./documentation/DEPLOY.md)).
+   The tag's `public/dx-maps/` folder is the built site: deploy that, and build the landing demo from
+   the same tag ([how to deploy](./documentation/DEPLOY.md)). To go back, deploy the previous release's tag. Publish to a public host, such as GitHub, only from
+   the landing branch and only when it is ready.
+
+### Developing in the cloud with a swarm
+
+Keep the repository on a git service you host yourself: a swarm pushes often, and an agent can
+publish by accident. On a public host, one wrong push publishes work you did not mean to share, so
+publish there only from the landing branch, when it is ready. Give each app two servers: a **pilot server** that
+follows the pilot branch with hot reload, and a **landing server** that rebuilds from the landing
+branch. The cloud container in `deployment/cloud/` runs both today (`BRANCH=development` for the pilot server,
+`PRODUCTION_BRANCH=main` for the landing server; `BRANCH` defaults to `main`). One pilot server per app, rather
+than one per pull request, keeps the memory the same however many pull requests are open. Each
+developer can still build on their own machine with the Plugin Studio and push their branch.
+
+Planned, not built yet: switching the pilot server to show one pull request at a time (with a table of
+the open pull requests under it), and rebuilding the landing branch from the accepted pull requests in
+order, so a rejected one is simply left out of the next rebuild.
 
 How to contribute, and the bar for shared code: [documentation/CONTRIBUTING.md](./documentation/CONTRIBUTING.md).
+Taking contributions from a contributor's own forge into your GitHub repository: [documentation/contribute/TUTORIAL.md](./documentation/contribute/TUTORIAL.md).
 Diagram source: [`delegation-model.svg`](./documentation/readme-images/src/delegation-model.svg).
 
 <details>
@@ -759,19 +847,20 @@ All the maps here share **one project, one library and one build step**. That's
 work together, and it's also the danger: if one agent's change breaks the shared library, **every
 map breaks at once**. And when several agents work in the same project at the same time, they step on
 each other — two agents edit the same file, one change quietly erases another, or half-finished work
-lands in the version everyone else is using.
+ends up in the version everyone else is using.
 
 So the project works like a busy kitchen:
 
 1. **Each agent works in its own branch and copy of the project** — its own counter, so nobody bumps
    anybody. One owner per plugin, and one per shared file.
-2. **Only one change lands at a time.** Whoever holds the *landing lock* first catches up with
-   everyone else's latest work, fixes any clash itself and runs every check; the change goes into
-   `development` only if nothing fails. `development` always works.
-3. **Someone keeps order.** A coordinator can put the landings in order, and a gate-keeper can read
-   each change by its content before it lands. Your harness gives these jobs to its agents.
-4. **`main` moves only when you publish a release**, after the checks pass on that exact version.
-   A preview can follow `development`; the published site follows `main`.
+2. **Only one change joins the pilot at a time.** Whoever holds the *pilot lock* first catches up with
+   everyone else's latest work, fixes any clash itself and runs every check; the change goes into the
+   pilot branch only if nothing fails. The pilot branch always works.
+3. **Someone keeps order.** One shepherd agent, which all the other agents talk to, keeps order and puts
+   the merges onto the pilot in order; one agent per repository handles its branches and watches the work
+   being done in it. Your harness gives these jobs to its agents.
+4. **The landing branch moves only when a person approves a publish**, after the checks pass on that exact version.
+   The pilot server follows the pilot branch; the landing server rebuilds from the landing branch.
 
 That's how many plugins get built at the same time, in one project, without the maps breaking.
 
@@ -783,12 +872,12 @@ That's how many plugins get built at the same time, in one project, without the
 | Word | In plain terms |
 |---|---|
 | **repo** | the project folder, with its full history |
-| **development** | the shared working version: every agent's change is added here, one at a time |
-| **main** | the production version: it moves only when `development` is published |
+| **development** (the pilot) | the shared working version: every agent's change is added here, one at a time |
+| **main** (the landing) | the version that ships: it moves only when a person approves publishing `development` |
 | **worktree** | a private copy of the project for one agent to work in |
 | **merge conflict** | two changes touched the same lines; someone has to decide how to combine them |
-| **rebase** | catching your work up with everyone else's latest before adding it |
-| **landing lock** | only one change lands on `development` at a time; its holder catches up and runs every check first |
+| **merge** | taking everyone else's latest work into your branch: the latest pilot goes into your PR branch (never a rebase), before joining and once more inside the pilot lock |
+| **pilot lock** | only one change merges onto `development` at a time; its holder catches up and runs every check first |
 | **tag** | a fixed name for one release commit, such as `v1.0.0`, so you can always deploy exactly it |
 
 </details>
@@ -871,7 +960,7 @@ The studio is a plugin like any other: `plugin-designs/plugin-studio/plugin-stud
 ### Run it in the cloud
 
 **One shared dev server for the whole team, no laptop setup.** A container clones the repo, follows
-`development`, and hot-reloads every change an agent lands, so everyone sees the Plugin Studio update in
+`development`, and hot-reloads every change that joins the pilot, so everyone sees the Plugin Studio update in
 their browser within seconds, with no rebuild. Add OIDC settings and it puts a "Sign in with *your
 provider*" page in front of everything, open only to the groups you allow. Recipe and settings:
 [deployment/cloud/](./deployment/cloud/README.md).
@@ -882,7 +971,7 @@ The three ways dx-maps ships (a drop-in into your own site, the container on its
 
 ### Cloud development environment
 
-**Your laptop can follow what agents land somewhere else.** By default `bun run dev` is fully local: no
+**Your laptop can follow what agents add to the pilot somewhere else.** By default `bun run dev` is fully local: no
 settings, nothing fetched, and only your own edits hot-reload. To also see what agents push to a shared
 branch (an agent on a server, or the whole team), add two lines to `.env.local` (gitignored):
 
@@ -908,7 +997,7 @@ doxa-maps/
 ├── plugin-designs/            YOUR maps — one folder per plugin (the free zone)
 │   ├── doxa-maps-spa/         the Research Gallery (capability 5)
 │   ├── plugin-studio/         the Plugin Studio (capability 5)
-│   ├── my-upg-100-list/       UPG-100 List (capability 4)
+│   ├── my-upg-100-list/       UPG100 Posters (capability 4)
 │   ├── doxa-simple-map/       Prayer Progress and its presets (capability 2)
 │   ├── all-people-groups/     a single map (capability 1)
 │   └── template-bundle/       copy this to start a new plugin

data/people-groups/scripture-sources.json

@@ -1,6 +1,6 @@
 {
   "_what": "Provenance for the Mark 5:1-20 passage on packet page 8 (prayer point 4), per locale.",
-  "_rule": "Scripture is NEVER machine-translated and never reproduced from memory. Each text is a published PUBLIC-DOMAIN translation fetched from a citable source that ships licence metadata, stored with the translation's NAME. dx-shepherd END-DXS-MK5GO, 2026-09-27.",
+  "_rule": "Scripture is NEVER machine-translated and never reproduced from memory. Each text is a published PUBLIC-DOMAIN translation fetched from a citable source that ships licence metadata, stored with the translation's NAME (added 2026-09-27).",
   "_verified": "Verse numbering checked against the English (World English Bible): all five extract exactly verses 1-20, verse 1 matches 'they came to the other side of the sea, into the country of the Gadarenes' and verse 20 ends at 'Decapolis ... everyone marveled'.",
   "_api": "https://bible.helloao.org/api/<id>/MRK/5.json",
   "locales": {

data/tables/gospel-by-province-groups.json

@@ -2,11 +2,11 @@
  "meta": {
   "title": "Which province each people group falls in — India and China",
   "why": "Published so no other build has to repeat this point-in-polygon. gospel-internet ran the identical ray-casting over the identical geometry and could only check itself against our aggregates; a second implementation of the same geometry is a second place for it to drift.",
-  "generated": "2026-09-27",
+  "generated": "2026-10-02",
   "grain": "one row per PLACED people group; the four that fall outside every polygon are in the aggregate file's `unassigned`",
   "rows": 1009,
   "agrees_with": "gospel-by-province.json — per-province counts and the assigned total are reconciled at build time, and neither file is written if they differ",
-  "approximate": "Every row is approximate. The coordinate marks where a PEOPLE is found, not a settlement, and near a border it can fall on the wrong side. No surface may present a province as a fact about a group."
+  "approximate": "Every row is approximate. The coordinate marks a PEOPLE group, not a settlement; its position is approximate, and near a border it can fall on the wrong side. No surface may present a province as a fact about a group."
  },
  "columns": [
   {

data/tables/gospel-by-province.json

@@ -2,7 +2,7 @@
  "meta": {
   "title": "Gospel access by province — India and China",
   "why": "These two countries hold 47.9% of Doxa's roster (855 + 154 of 2,107). No other country is close; the third is Sudan at 105. A national fill cannot answer \"where would a team go\" for half the map.",
-  "generated": "2026-09-27",
+  "generated": "2026-10-02",
   "provinces_with_groups": 46,
   "provinces_available": 48,
   "groups_assigned": 1009,
@@ -13,7 +13,7 @@
   "near_border_note": "NONE unassigned now, and two rows say why. Jing and Pana fell in no province: measured 8.7 km outside Guangxi and 5.4 km outside Yunnan — across the border, not outside the file, which is what an earlier version of this note wrongly said (both provinces are in it). Sourcing China's complete 34-unit ADM1 moved neither distance: same source geometry, 22 more provinces, none of them theirs — so better data is not the answer and nobody need repeat it. A point within 15 km of exactly ONE province now joins it and carries near_border_km; two provinces within the tolerance leave it unassigned, because a hint between two answers is not one. A single coordinate for a whole people is not precise to 9 km, which is why this is a correction and not a guess.",
   "china_note": "China's ADM1 file carries 12 provinces, not 31+. Measured rather than assumed: 152 of 154 Chinese groups fall inside them and all twelve are used, so the file is cut to the provinces where the unreached peoples are.",
   "ways_in": "Chosen FOR THE PROVINCE where the province can answer: the languages of groups standing in it that already have Scripture AND film, ranked by the people here who already hold them. The column says which basis was used. This replaces a country-level answer that produced a measured absurdity — Arunachal Pradesh, in the far north-east, was offered TELUGU, because the curated bridge table is keyed by country and a curated bridge outranks a computed one. A province with no tier-2 language of its own still falls back to the country answer, and ways_in_basis says so rather than hiding it. It is a NEIGHBOUR, not a recommendation: whether a group actually speaks it is a question for someone on the ground.",
-  "approximate": "A province is assigned by point-in-polygon on the group's coordinate, and that coordinate marks where a PEOPLE is found, not a settlement — 108 groups across the roster even share a coordinate with another group. Near a border the point can fall on the wrong side. Every row is flagged approximate and the unassigned are counted, never dropped. No surface may present a province as a fact about a group."
+  "approximate": "A province is assigned by point-in-polygon on the group's coordinate, and that coordinate marks a PEOPLE group, not a settlement; its position is approximate, and 108 groups across the roster even share a coordinate with another group. Near a border the point can fall on the wrong side. Every row is flagged approximate and the unassigned are counted, never dropped. No surface may present a province as a fact about a group."
  },
  "columns": [
   {

data/tables/key-cities.json

@@ -2,7 +2,7 @@
  "meta": {
   "title": "Key Cities / Location Clusters",
   "grain": "one row per ~25km location cluster",
-  "caveat": "A cluster is people-group CENTROIDS, not a settlement. place_name comes from a cited gazetteer (Nominatim/OSM, ODbL); an unnamed row is honest, not missing.",
+  "caveat": "A cluster is people-group PINS (each marks a people group, not a town), not a settlement. place_name comes from a cited gazetteer (Nominatim/OSM, ODbL); an unnamed row is honest, not missing.",
   "internet_caveat": "Internet figures are NATIONAL. Per-city connectivity is not publicly available at this scale."
  },
  "columns": [

data/tables/languages-per-city.json

@@ -3,7 +3,7 @@
   "title": "Languages per City x Resources",
   "grain": "one row per location cluster x language spoken there",
   "why": "399 of 1,646 clusters are multi-language — a city-level bridge can exist that a country average hides.",
-  "place_caveat": "A location is a cluster of people-group centroids within ~25km, NOT a municipal boundary. An empty place_name is an unnamed cluster, never an invented one.",
+  "place_caveat": "A location is a cluster of people-group pins within ~25km, NOT a municipal boundary. An empty place_name is an unnamed cluster, never an invented one.",
   "resolution_caveat": "resolved:false means the language LABEL did not match an ISO 639-3 record here — its resource status is UNKNOWN, not absent.",
   "pools_caveat": "Resource status is from eBible + JESUS Film only. GRN and FCBH audio are key-blocked."
  },

deployment/cloud/public-exclusions.txt

@@ -12,11 +12,12 @@ AGENT-BRIEF.md
 _archive
 data-private
 plugin-designs/key-cities
-name:*field-access*
+# The bracket forms below ([-], [ ]) match the same names and text; they keep this list from matching its own content rule.
+name:*field[-]access*
 name:*visa*.json
 name:.env
 name:.env.*
 name:*.pem
 name:*.key
 keep:.env.example
-content:field-access|Visa Requirements
+content:field[-]access|Visa[ ]Requirements

documentation/HOWTO-build-the-desktop-app.md

@@ -4,8 +4,9 @@ Rudder (`plugin-designs/rudder-voice`) is voice-to-text that runs on your own co
 local engine (`backend/rudder-engine`, Go) that drives NVIDIA's NeMo-Speech.cpp speech server. The
 desktop app is a Tauri window around the built web tree, with the engine started as a **sidecar**.
 
-This page is written for an agent following it cold. **Read "What is proven" first**: most of the
-desktop path has never been run by anyone, and the steps say so where that is the case.
+This page is written for an agent following it cold. **Read "What is proven" first**: the Linux app is
+proven and in use; the macOS and Windows path has not been run yet, and the steps say so where that is
+the case.
 
 ## What is proven, and what is not
 
@@ -18,8 +19,8 @@ desktop path has never been run by anyone, and the steps say so where that is th
 | The engine **compiling** for macOS (arm64, x86_64) and Windows (x86_64) | Proven by cross-compiling. It has **never been run** on either. |
 | The engine accepting a WebSocket from the Tauri webview (`tauri://localhost`, `http://tauri.localhost`) | Proven against a running engine; another site's origin is refused. |
 | NeMo-Speech.cpp runtime for macOS / Windows | Published by NVIDIA (release v0.1.0: `macos-aarch64-cpu`, `macos-aarch64-metal`, `macos-x86_64-cpu`, `windows-x86_64-cpu` / `-cuda` / `-vulkan`). **Never run here.** |
-| `bun run desktop:build rudder-voice` on **Linux** | Proven: produced `Rudder_0.1.0_amd64.deb` (8.8 MB) holding the app and the `rudder-engine` sidecar side by side. The app has **not been launched** from it yet (no display on the build box). |
-| The shell starting and stopping the engine sidecar | Built (`deployment/src-tauri/src/main.rs`), compiled into that installer; not yet run. |
+| `bun run desktop:build rudder-voice` on **Linux** | Proven: produced `Rudder_0.1.0_amd64.deb` (8.8 MB) holding the app and the `rudder-engine` sidecar side by side. The installed Linux app has since been launched and is in use: it is used to dictate the work on these maps. |
+| The shell starting and stopping the engine sidecar | Built (`deployment/src-tauri/src/main.rs`), compiled into that installer. The installed Linux app works (the row above); not yet run on macOS or Windows. |
 | First-run model download | **Not built.** Run `setup-runtime.sh` into the app's data folder by hand (step 7). |
 
 ## 1. Prerequisites

documentation/README-embed-gospel-resources.md

@@ -42,7 +42,7 @@ Two things to know before you publish a link:
 
 - **No zoom or centre parameter.** The frame is derived from the pins the link selects, so a link
   stays correct when the data moves under it.
-- **Placement is approximate.** A dot marks where a *people* is found, not a town or a boundary,
+- **Placement is approximate.** A dot marks a *people group*, not a town or a boundary,
   and 108 of the placed groups share a coordinate with another group. The sheet says so in the
   reader's language.
 - **An unknown parameter is ignored, never fatal.** `?country=ZZZ` renders the map, not an error —

documentation/architecture/poster-generation.md

@@ -1,4 +1,4 @@
-# Architecture — UPG-100 poster generation
+# Architecture — UPG100 List poster generation
 
 > The simple overview is in `library/scripts/posters/README.md`. This is the full reference for the
 > generator: files, environment, pipeline, and the gotchas that have bitten before.
@@ -53,7 +53,7 @@ the app is rebuilt.**
 | `VITE_API_BASE_URL` | — | Satisfies the fail-closed config gate. No request is made under `OFFLINE=1`. |
 | `ONLY` | — | Build a single zone by `zoneKey`. |
 | `UPG100_DATA_PATH` | the profile in this repo | Only override to test against other data. |
-| `SERIES_INDEX` / `SERIES_NAME` | derived / `List of 100 UPG's` | Series line on the sheet. |
+| `SERIES_INDEX` / `SERIES_NAME` | derived / `UPG100 List` | Series line on the sheet. |
 
 ## Two things that will bite you
 

documentation/contribute/TUTORIAL.md

@@ -0,0 +1,48 @@
+# Connect a contributor's repo to your GitHub
+
+*For the repository's GitHub admin. About 10 minutes. The contributor needs no GitHub account, and you keep control of every step.*
+
+**What you'll have at the end:** a GitHub Action in your repo that, about once an hour, copies the contributor's `release` branch from their own forge into a `contributor` branch of yours. Nothing reaches your main branch until you review and merge it.
+
+**Before you start:** the contributor sends you the URL of their release repo. Try it on a test repo first if you like; the steps are the same.
+
+## 1. Add the secret
+
+**Settings → Secrets and variables → Actions → New repository secret.**
+- Name: `UPSTREAM_URL`
+- Value: the release-repo URL the contributor sent you
+
+It's a secret so the URL stays out of your public files.
+
+## 2. Add the workflow
+
+Create `.github/workflows/pull-contributor.yml` **on your default branch** with the contents of [`pull-contributor.yml`](pull-contributor.yml). Scheduled workflows run only from the default branch. Read it first: it's about 25 lines, and it:
+- fetches the contributor's `release` branch from `UPSTREAM_URL`;
+- **stops** if the contributor's commits add, change or delete anything under `.github/`, so nothing from outside can touch a workflow. Your own workflows are fine: it compares their commits with the history you share. If you share none (a fresh release), any `.github/` content is refused;
+- updates your `contributor` branch **without force-pushing**, so if their history is ever rewritten, the run fails and waits for you.
+
+## 3. Run it once
+
+**Actions → Pull contributor → Run workflow.** When it turns green, you'll see a new `contributor` branch under **Code → Branches**.
+If the push step fails with a permission error, check **Settings → Actions → General → Workflow permissions**, or your organization's Actions policy.
+
+## 4. Protect your main branch
+
+**Settings → Rules → Rulesets → New branch ruleset**, targeting your default branch:
+- **Require a pull request before merging**, with at least one approval;
+- **Block force pushes.**
+
+(Or use **Settings → Branches → Add branch protection rule** with the same two settings.) Don't restrict pushes to `contributor` itself, because the Action has to update it.
+
+## 5. Review and merge
+
+**Pull requests → New pull request**, base: your main branch, compare: `contributor`. Review it like any outside contribution, and merge when you're happy. If the pull request stays open, it updates itself each time the Action brings new commits.
+
+## Good to know
+
+- **Turn it off:** delete the file, or use **Actions → Pull contributor → ⋯ → Disable workflow**.
+- **A red run** means the Action refused something (a change under `.github/`, or a rewritten history). Nothing was changed. Tell the contributor.
+- **"Entirely different commit histories":** the release was made fresh, as a new project. Ask the contributor to base it on your main branch, or use it as the start of a new repo.
+- **Quiet repos:** GitHub pauses scheduled workflows in a public repo after 60 days with no activity. Re-enable it under **Actions**.
+- **Please don't** download the code and re-upload it by hand. It's slower, and it breaks the link to the source.
+- **Check the guard yourself:** `bash test-pull-contributor.sh` (next to this file) runs the workflow's exact lines against throwaway local repos, with no network, and shows what it accepts and refuses.

documentation/contribute/pull-contributor.yml

@@ -0,0 +1,27 @@
+# .github/workflows/pull-contributor.yml
+# Copies the contributor's `release` branch into this repo's `contributor` branch,
+# about once an hour. Commit it to your default branch. Delete it to stop.
+name: Pull contributor
+on:
+  schedule: [{ cron: '17 * * * *' }]
+  workflow_dispatch: {}
+permissions: { contents: write }
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - env: { URL: '${{ secrets.UPSTREAM_URL }}' }
+        run: |
+          git fetch --no-tags "$URL" release
+          # refuse any change they make to .github/
+          BASE=$(git merge-base HEAD FETCH_HEAD) \
+            || BASE=$(git mktree </dev/null)
+          CHANGED=$(git diff --name-only \
+            "$BASE" FETCH_HEAD -- .github)
+          if [ -n "$CHANGED" ]; then
+            echo "refusing .github/ changes"; exit 1
+          fi
+          git push origin \
+            FETCH_HEAD:refs/heads/contributor

documentation/contribute/test-pull-contributor.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Runs the sync step of pull-contributor.yml against throwaway local repos and
+# checks what it accepts and refuses. Needs only git and bash; touches no network.
+# Usage: bash test-pull-contributor.sh [path/to/pull-contributor.yml]
+# What it can't check: GitHub's own behaviour (checkout auth, GITHUB_TOKEN, the schedule).
+set -uo pipefail
+here="$(cd "$(dirname "$0")" && pwd)"
+wf="${1:-$here/pull-contributor.yml}"
+t="$(mktemp -d)"; trap 'rm -rf "$t"' EXIT
+# the run: block, unindented: exactly what GitHub executes
+sed -n '/run: |/,$p' "$wf" | tail -n +2 | sed 's/^          //' > "$t/sync.sh"
+export GIT_AUTHOR_NAME=Test GIT_AUTHOR_EMAIL=test@example.invalid
+export GIT_COMMITTER_NAME=Test GIT_COMMITTER_EMAIL=test@example.invalid
+fails=0
+c() { git -C "$t/$1" "${@:2}" -q; }
+sync() { # $1 = receiver bare repo, $2 = contributor bare repo, $3 = clone depth (0 = full)
+  rm -rf "$t/runner"
+  if [ "${3:-0}" = 0 ]; then git clone -q "$t/$1" "$t/runner"; else git clone -q --depth "$3" "file://$t/$1" "$t/runner"; fi
+  (cd "$t/runner" && URL="$t/$2" bash --noprofile --norc -eo pipefail "$t/sync.sh" >/dev/null 2>&1)
+}
+check() { # $1 = name, $2 = expected (ok|refused), then the sync arguments
+  local name="$1" want="$2"; shift 2
+  local before after got; before=$(git -C "$t/$1" rev-parse -q --verify refs/heads/contributor || echo none)
+  if sync "$@"; then got=ok; else got=refused; fi
+  after=$(git -C "$t/$1" rev-parse -q --verify refs/heads/contributor || echo none)
+  if [ "$got" = refused ] && [ "$before" != "$after" ]; then got="refused BUT the branch moved"; fi
+  if [ "$got" = "$want" ]; then echo "PASS  $name ($got)"; else echo "FAIL  $name: wanted $want, got $got"; fails=$((fails+1)); fi
+}
+commit() { (cd "$t/$1" && git add -A && git commit -qm "$2"); }
+
+# A receiver whose main already has workflows; the contributor works on top of it.
+git init -q --bare -b main "$t/gh.git"; git init -q --bare -b release "$t/up.git"
+git init -q -b main "$t/pm"; mkdir -p "$t/pm/.github/workflows"
+echo ci > "$t/pm/.github/workflows/ci.yml"; echo m > "$t/pm/m"; commit pm m1; c pm push "$t/gh.git" main
+git clone -q "$t/gh.git" "$t/cw"; c cw checkout -b release
+echo work > "$t/cw/w"; commit cw w1; c cw push "$t/up.git" release
+echo pull > "$t/pm/.github/workflows/pull-contributor.yml"; commit pm add-pull; c pm push "$t/gh.git" main
+check "receiver has workflows; release = its main + 1 commit" ok gh.git up.git
+echo ci2 > "$t/pm/.github/workflows/ci.yml"; commit pm ci2; c pm push "$t/gh.git" main
+echo more >> "$t/cw/w"; commit cw w2; c cw push "$t/up.git" release
+check "receiver changed .github/ since; contributor didn't" ok gh.git up.git
+good=$(git -C "$t/cw" rev-parse HEAD)
+reset() { c cw reset --hard "$good"; c cw push -f "$t/up.git" release; }
+echo evil > "$t/cw/.github/workflows/ci.yml"; commit cw edit; c cw push "$t/up.git" release
+check "contributor edits a workflow" refused gh.git up.git
+reset; echo new > "$t/cw/.github/workflows/new.yml"; commit cw add; c cw push "$t/up.git" release
+check "contributor adds a workflow" refused gh.git up.git
+reset; rm "$t/cw/.github/workflows/ci.yml"; commit cw delete; c cw push "$t/up.git" release
+check "contributor deletes a workflow" refused gh.git up.git
+reset
+c cw fetch origin; (cd "$t/cw" && git merge -q --no-edit origin/main)
+echo m3 >> "$t/cw/w"; commit cw w3; c cw push "$t/up.git" release
+check "contributor merges the receiver's main (its .github/ changes come along)" ok gh.git up.git
+(cd "$t/cw" && git commit -q --amend -m rewritten); c cw push -f "$t/up.git" release
+check "contributor rewrites history (no force-push)" refused gh.git up.git
+
+# A fresh-history release: no history shared with the receiver.
+git init -q --bare -b main "$t/gh2.git"; git init -q --bare -b release "$t/up2.git"
+git init -q -b main "$t/pm2"; mkdir -p "$t/pm2/.github/workflows"; echo ci > "$t/pm2/.github/workflows/ci.yml"
+commit pm2 init; c pm2 push "$t/gh2.git" main
+git init -q -b release "$t/fr"; echo app > "$t/fr/app"; commit fr fresh; c fr push "$t/up2.git" release
+check "fresh history without .github/" ok gh2.git up2.git
+mkdir -p "$t/fr/.github/workflows"; echo x > "$t/fr/.github/workflows/x.yml"; commit fr add-gh; c fr push "$t/up2.git" release
+check "fresh history with .github/ (nothing shared to compare: strict)" refused gh2.git up2.git
+
+# Fails closed when the checkout is shallow and no shared base can be found.
+git init -q --bare -b main "$t/gh3.git"; git init -q --bare -b release "$t/up3.git"
+git init -q -b main "$t/pm3"; mkdir -p "$t/pm3/.github/workflows"; echo ci > "$t/pm3/.github/workflows/ci.yml"
+commit pm3 m1; echo 2 > "$t/pm3/f2"; commit pm3 m2; echo 3 > "$t/pm3/f3"; commit pm3 m3; c pm3 push "$t/gh3.git" main
+git clone -q "$t/gh3.git" "$t/cw3"; c cw3 checkout -b release; c cw3 reset --hard HEAD~2
+echo evil > "$t/cw3/.github/workflows/ci.yml"; commit cw3 edit; c cw3 push "$t/up3.git" release
+check "shallow checkout + a workflow edit" refused gh3.git up3.git 1
+
+[ "$(git -C "$t/gh.git" rev-list --count main)" = 3 ] && echo "PASS  the receiver's main was never touched" || { echo "FAIL  main moved"; fails=$((fails+1)); }
+echo; [ "$fails" = 0 ] && echo "ALL PASS" || { echo "$fails FAILED"; exit 1; }

documentation/deploy/README.md

@@ -0,0 +1,3 @@
+# Deploy workflows
+
+To deploy to GitHub Pages, copy `github-pages.workflow.yml` into `.github/workflows/` in your own repository.

documentation/how-to-build-mobile-apps-from-plugins/README.md

@@ -12,7 +12,7 @@ Deep Research is the plugin that is already a whole app. It is the app shell in
 - Simple Research;
 - Regions;
 - Prayer Progress;
-- UPG-100 List;
+- UPG100 Posters;
 - Cities with Internet;
 - Gospel Resources.
 
@@ -95,7 +95,7 @@ It is the same command with another start page. Name the page's folder inside `p
 
 ```bash
 APP_START=doxa-simple-map/doxa-simple-map bun run phone:from-tree   # Prayer Progress
-bun run phone:from-tree                                             # unset: the UPG-100 list
+bun run phone:from-tree                                             # unset: UPG100 Posters
 ```
 
 Pick a page that works on a phone; Big Picture, for one, is desktop only. The start-page step

documentation/how-to.md

@@ -237,7 +237,7 @@ snippets (leave it empty for relative URLs that work wherever the folder is drop
 ## Hosting the dx-maps folder: caching, compression, CORS
 
 **Why it matters.** On a cold load a map's layers draw about 10–17 s after the page opens (measured
-on the UPG-100 list page). The bundle and the map engine take under 2 s of that; the rest is basemap
+on the UPG100 Posters page). The bundle and the map engine take under 2 s of that; the rest is basemap
 tiles and data files such as the country-boundary file (1,866 KB raw, 597 KB gzipped). Compression
 cuts every visit; caching means a returning reader doesn't download the same files again.
 
@@ -415,6 +415,7 @@ every third-party script is pinned with an integrity hash (`library/constants/cd
 | `style-src` | `'unsafe-inline'`, the same CDN hosts | each plugin styles its own shadow root with a `<style>` element |
 | `worker-src` | `blob:` | the map engines run their tile workers from a blob URL |
 | `connect-src` | the tile/style hosts you use (`https://tiles.openfreemap.org` for MapLibre, `https://*.mapbox.com` for Mapbox), your data API | tiles, styles, glyphs, data |
+| `connect-src` (Bible Posters) | `https://bible.helloao.org` | the public-domain Bible text, fetched per book at render time (no text is bundled) |
 | `img-src` | `data:` `blob:` and the same tile hosts | sprites and raster tiles |
 
 ---

documentation/readme-images/src/delegation-model.svg

@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1500" height="2086" viewBox="0 0 1500 2086" font-family="Inter, 'Helvetica Neue', Arial, sans-serif">
+<svg xmlns="http://www.w3.org/2000/svg" width="1500" height="2256" viewBox="0 0 1500 2256" font-family="Inter, 'Helvetica Neue', Arial, sans-serif">
 <defs>
 <marker id="aA" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="8" markerHeight="8" orient="auto"><path d="M0,0 L10,5 L0,10 z" fill="#2563eb"/></marker>
 <marker id="aS" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto"><path d="M0,0 L10,5 L0,10 z" fill="#7c3aed"/></marker>
@@ -9,8 +9,8 @@
 <path id="agL" d="M 194,850 A 556,556 0 0 1 1306,850"/>
 <path id="mqL" d="M 679,884 A 71,71 0 0 0 821,884"/>
 </defs>
-<rect width="1500" height="2086" fill="#ffffff"/>
-<text x="750" y="54" text-anchor="middle" font-size="34" font-weight="800" fill="#0f172a">How dx-maps is built: one owner per plugin, one landing at a time</text>
+<rect width="1500" height="2256" fill="#ffffff"/>
+<text x="750" y="54" text-anchor="middle" font-size="34" font-weight="800" fill="#0f172a">How dx-maps is built: one owner per plugin, one merge at a time</text>
 <circle cx="750" cy="850" r="540" fill="none" stroke="#2563eb" stroke-width="1.6" stroke-dasharray="3 7" opacity=".75"/>
 <circle cx="750" cy="850" r="355" fill="none" stroke="#15803d" stroke-width="2.2" opacity=".85"/>
 <circle cx="750" cy="850" r="606" fill="none" stroke="#7c3aed" stroke-width="2" stroke-dasharray="8 7" opacity=".6"/>
@@ -29,8 +29,8 @@
 <circle cx="750" cy="850" r="120" fill="#fef2f2" stroke="#dc2626" stroke-width="3" stroke-dasharray="10 6"/>
 <path id="mqT" d="M 646,850 A 104,104 0 0 1 854,850" fill="none"/>
 <path id="mqB" d="M 644,850 A 106,106 0 0 0 856,850" fill="none"/>
-<text font-size="13" font-weight="800" fill="#b91c1c" letter-spacing="1.6"><textPath href="#mqT" startOffset="50%" text-anchor="middle">LANDING LOCK</textPath></text>
-<text font-size="12" font-weight="700" fill="#b91c1c" letter-spacing="1.2"><textPath href="#mqB" startOffset="50%" text-anchor="middle">ONE LANDING AT A TIME</textPath></text>
+<text font-size="13" font-weight="800" fill="#b91c1c" letter-spacing="1.6"><textPath href="#mqT" startOffset="50%" text-anchor="middle">PILOT LOCK</textPath></text>
+<text font-size="12" font-weight="700" fill="#b91c1c" letter-spacing="1.2"><textPath href="#mqB" startOffset="50%" text-anchor="middle">ONE MERGE AT A TIME</textPath></text>
 <rect x="617" y="846" width="26" height="20" rx="4" fill="#dc2626"/>
 <path d="M 622,846 v -6 a 8,8 0 0 1 16,0 v 6" fill="none" stroke="#dc2626" stroke-width="3.5"/>
 <circle cx="630" cy="856" r="3" fill="#fff"/>
@@ -38,9 +38,10 @@
 <path d="M 862,846 v -6 a 8,8 0 0 1 16,0 v 6" fill="none" stroke="#dc2626" stroke-width="3.5"/>
 <circle cx="870" cy="856" r="3" fill="#fff"/>
 <circle cx="750" cy="850" r="72" fill="#166534" stroke="#14532d" stroke-width="3"/>
-<text x="750" y="850" text-anchor="middle" font-size="18" font-weight="800" fill="#fff">development</text>
-<text x="750" y="872" text-anchor="middle" font-size="12.5" fill="#dcfce7">every change</text>
-<text x="750" y="888" text-anchor="middle" font-size="12.5" fill="#dcfce7">lands here</text>
+<text x="750" y="842" text-anchor="middle" font-size="24" font-weight="800" fill="#fff">pilot</text>
+<text x="750" y="862" text-anchor="middle" font-size="13" font-weight="700" fill="#dcfce7">development</text>
+<text x="750" y="882" text-anchor="middle" font-size="12.5" fill="#dcfce7">every change</text>
+<text x="750" y="897" text-anchor="middle" font-size="12.5" fill="#dcfce7">joins here</text>
 <text font-size="16" font-weight="800" fill="#15803d" letter-spacing="3"><textPath href="#plL" startOffset="50%" text-anchor="middle">PLUGINS</textPath></text>
 <text font-size="16" font-weight="800" fill="#2563eb" letter-spacing="3"><textPath href="#agL" startOffset="18%" text-anchor="middle">AGENTS</textPath></text>
 <line x1="862.1" y1="579.3" x2="822.7" y2="674.5" stroke="#15803d" stroke-width="1.4" opacity=".45"/>
@@ -71,8 +72,8 @@
 <line x1="862.1" y1="1120.7" x2="822.7" y2="1025.5" stroke="#15803d" stroke-width="1.4" opacity=".45"/>
 <line x1="940.6" y1="1310.1" x2="912.3" y2="1241.7" stroke="#2563eb" stroke-width="2.4" marker-end="url(#aA)"/>
 <circle cx="885.9" cy="1178.0" r="62" fill="#f0fdf4" stroke="#15803d" stroke-width="2.6"/>
-<text x="885.9" y="1168.0" text-anchor="middle" font-size="14" font-weight="800" fill="#14532d">UPG-100</text>
-<text x="885.9" y="1185.0" text-anchor="middle" font-size="14" font-weight="800" fill="#14532d">List</text>
+<text x="885.9" y="1168.0" text-anchor="middle" font-size="14" font-weight="800" fill="#14532d">UPG100</text>
+<text x="885.9" y="1185.0" text-anchor="middle" font-size="14" font-weight="800" fill="#14532d">Posters</text>
 <rect x="859.9" y="1193.0" width="52" height="20" rx="10" fill="#15803d"/>
 <text x="885.9" y="1208.0" text-anchor="middle" font-size="11.5" font-weight="800" fill="#fff">cap 4</text>
 <circle cx="956.6" cy="1348.9" r="40" fill="#eff6ff" stroke="#2563eb" stroke-width="2.5"/>
@@ -115,20 +116,20 @@
 <text x="614.1" y="556.0" text-anchor="middle" font-size="12" font-weight="800" fill="#155e75">Experimental</text>
 <text x="614.1" y="570.0" text-anchor="middle" font-size="10.5" fill="#155e75">shelf · 5 plugins</text>
 <circle cx="543.4" cy="351.1" r="40" fill="#ecfeff" stroke="#0891b2" stroke-width="2.5"/>
-<text x="543.4" y="349.1" text-anchor="middle" font-size="12" font-weight="700" fill="#155e75">roaming</text>
-<text x="543.4" y="364.1" text-anchor="middle" font-size="12" font-weight="700" fill="#155e75">agent</text>
+<text x="543.4" y="349.1" text-anchor="middle" font-size="12" font-weight="700" fill="#155e75">an agent</text>
+<text x="543.4" y="364.1" text-anchor="middle" font-size="12" font-weight="700" fill="#155e75">per plugin</text>
 <circle cx="690" cy="248" r="56" fill="#f5f3ff" stroke="#7c3aed" stroke-width="3.5"/>
-<text x="690" y="254" text-anchor="middle" font-size="14" font-weight="800" fill="#4c1d95">coordinator</text>
+<text x="690" y="254" text-anchor="middle" font-size="14" font-weight="800" fill="#4c1d95">shepherd</text>
 <circle cx="812" cy="248" r="56" fill="#f1f5f9" stroke="#334155" stroke-width="3.5"/>
-<text x="812" y="254" text-anchor="middle" font-size="14" font-weight="800" fill="#1e293b">gate-keeper</text>
-<text x="884" y="192" font-size="17" fill="#4c1d95">a coordinator puts the landings in order;</text>
-<text x="884" y="216" font-size="17" fill="#1e293b">a gate-keeper checks each one by its content</text>
-<text x="750" y="1502" text-anchor="middle" font-size="20" font-weight="800" fill="#1e3a8a">one owner per plugin, in its own branch · a second reader for every change</text>
+<text x="812" y="254" text-anchor="middle" font-size="14" font-weight="800" fill="#1e293b">repo agent</text>
+<text x="884" y="192" font-size="17" fill="#4c1d95">one shepherd: every agent talks to it; it orders the merges;</text>
+<text x="884" y="216" font-size="17" fill="#1e293b">a repo agent per repo runs its branches and watches the work</text>
+<text x="750" y="1502" text-anchor="middle" font-size="20" font-weight="800" fill="#1e3a8a">one agent per plugin, in its own branch · the repo agent reads every change</text>
 <rect x="36" y="110" width="304" height="280" rx="14" fill="#f8fafc" stroke="#e2e8f0" stroke-width="2"/>
 <circle cx="64" cy="142" r="11" fill="#166534" stroke="#14532d" stroke-width="2.5"/>
-<text x="88" y="147" font-size="15" fill="#334155">development — shared branch</text>
+<text x="88" y="147" font-size="15" fill="#334155">pilot branch (development)</text>
 <circle cx="64" cy="174" r="11" fill="#fef2f2" stroke="#dc2626" stroke-width="2.5"/>
-<text x="88" y="179" font-size="15" fill="#334155">landing lock — one at a time</text>
+<text x="88" y="179" font-size="15" fill="#334155">pilot lock — one at a time</text>
 <circle cx="64" cy="206" r="11" fill="#fffbeb" stroke="#d97706" stroke-width="2.5"/>
 <text x="88" y="211" font-size="15" fill="#334155">Plugin Studio — the one repo</text>
 <circle cx="64" cy="238" r="11" fill="#f0fdf4" stroke="#15803d" stroke-width="2.5"/>
@@ -138,11 +139,11 @@
 <circle cx="64" cy="302" r="11" fill="#eff6ff" stroke="#2563eb" stroke-width="2.5"/>
 <text x="88" y="307" font-size="15" fill="#334155">agent — owns one plugin</text>
 <circle cx="64" cy="334" r="11" fill="#f5f3ff" stroke="#7c3aed" stroke-width="2.5"/>
-<text x="88" y="339" font-size="15" fill="#334155">coordinator — orders landings</text>
+<text x="88" y="339" font-size="15" fill="#334155">shepherd — orders merges</text>
 <circle cx="64" cy="366" r="11" fill="#f1f5f9" stroke="#334155" stroke-width="2.5"/>
-<text x="88" y="371" font-size="15" fill="#334155">gate-keeper — checks landings</text>
+<text x="88" y="371" font-size="15" fill="#334155">repo agent — one per repo</text>
 <rect x="60" y="1536" width="1380" height="232" rx="20" fill="#fef2f2" stroke="#fca5a5" stroke-width="2"/>
-<text x="750" y="1578" text-anchor="middle" font-size="22" font-weight="800" fill="#7f1d1d">How a change lands — one at a time, so many plugins can be built at once</text>
+<text x="750" y="1578" text-anchor="middle" font-size="22" font-weight="800" fill="#7f1d1d">How a change joins the pilot — one at a time, so many plugins can be built at once</text>
 <rect x="80.0" y="1600" width="305" height="148" rx="14" fill="#fff" stroke="#dc2626" stroke-width="2"/>
 <circle cx="114.0" cy="1634" r="18" fill="#dc2626"/>
 <text x="114.0" y="1641" text-anchor="middle" font-size="19" font-weight="800" fill="#fff">1</text>
@@ -154,30 +155,30 @@
 <rect x="425.0" y="1600" width="305" height="148" rx="14" fill="#fff" stroke="#dc2626" stroke-width="2"/>
 <circle cx="459.0" cy="1634" r="18" fill="#dc2626"/>
 <text x="459.0" y="1641" text-anchor="middle" font-size="19" font-weight="800" fill="#fff">2</text>
-<text x="487.0" y="1641" font-size="19" font-weight="800" fill="#0f172a">Second reader</text>
-<text x="445.0" y="1680" font-size="15" fill="#475569">another agent reads every</text>
+<text x="487.0" y="1641" font-size="19" font-weight="800" fill="#0f172a">Repo agent reads</text>
+<text x="445.0" y="1680" font-size="15" fill="#475569">the repo agent reads every</text>
 <text x="445.0" y="1702" font-size="15" fill="#475569">change by its content</text>
-<text x="445.0" y="1724" font-size="15" fill="#475569">before it may land</text>
+<text x="445.0" y="1724" font-size="15" fill="#475569">before it may join</text>
 <text x="750.0" y="1682" text-anchor="middle" font-size="26" font-weight="800" fill="#dc2626">→</text>
 <rect x="770.0" y="1600" width="305" height="148" rx="14" fill="#fff" stroke="#dc2626" stroke-width="2"/>
 <circle cx="804.0" cy="1634" r="18" fill="#dc2626"/>
 <text x="804.0" y="1641" text-anchor="middle" font-size="19" font-weight="800" fill="#fff">3</text>
 <text x="832.0" y="1641" font-size="19" font-weight="800" fill="#0f172a">One at a time</text>
-<text x="790.0" y="1680" font-size="15" fill="#475569">in the lock: merge development,</text>
+<text x="790.0" y="1680" font-size="15" fill="#475569">in the lock: merge the pilot,</text>
 <text x="790.0" y="1702" font-size="15" fill="#475569">rebuild, run every check;</text>
 <text x="790.0" y="1724" font-size="15" fill="#475569">push only if nothing fails</text>
 <text x="1095.0" y="1682" text-anchor="middle" font-size="26" font-weight="800" fill="#dc2626">→</text>
 <rect x="1115.0" y="1600" width="305" height="148" rx="14" fill="#fff" stroke="#dc2626" stroke-width="2"/>
 <circle cx="1149.0" cy="1634" r="18" fill="#dc2626"/>
 <text x="1149.0" y="1641" text-anchor="middle" font-size="19" font-weight="800" fill="#fff">4</text>
-<text x="1177.0" y="1641" font-size="19" font-weight="800" fill="#0f172a">Promote to main</text>
-<text x="1135.0" y="1680" font-size="15" fill="#475569">main is production: it moves</text>
-<text x="1135.0" y="1702" font-size="15" fill="#475569">only when the owner approves,</text>
+<text x="1177.0" y="1641" font-size="19" font-weight="800" fill="#0f172a">Publish to landing</text>
+<text x="1135.0" y="1680" font-size="15" fill="#475569">landing (main), production:</text>
+<text x="1135.0" y="1702" font-size="15" fill="#475569">moves only when a person approves,</text>
 <text x="1135.0" y="1724" font-size="15" fill="#475569">after full checks on that version</text>
 <line x1="750" y1="956" x2="750" y2="1786" stroke="#334155" stroke-width="2.5" stroke-dasharray="2 5" opacity=".0"/>
 <rect x="60" y="1812" width="1380" height="254" rx="20" fill="#f8fafc" stroke="#cbd5e1" stroke-width="2"/>
-<text x="750" y="1856" text-anchor="middle" font-size="22" font-weight="800" fill="#0f172a">main → ONE build → one web folder → three outputs</text>
-<text x="750" y="1882" text-anchor="middle" font-size="16" fill="#475569">the dev preview follows development · the published site follows main</text>
+<text x="750" y="1856" text-anchor="middle" font-size="22" font-weight="800" fill="#0f172a">landing (main) → ONE build → one web folder → three outputs</text>
+<text x="750" y="1882" text-anchor="middle" font-size="16" fill="#475569">the pilot server follows development · the landing server rebuilds from main</text>
 <rect x="80.0" y="1908" width="420" height="130" rx="14" fill="#fff" stroke="#15803d" stroke-width="2.5"/>
 <text x="290.0" y="1930" text-anchor="middle" font-size="13" font-weight="800" fill="#64748b">OUTPUT 1</text>
 <text x="290.0" y="1962" text-anchor="middle" font-size="22" font-weight="800" fill="#0f172a">The web folder</text>
@@ -196,4 +197,9 @@
 <text x="1210.0" y="1988" text-anchor="middle" font-size="15" fill="#475569">the same folder, wrapped by Tauri</text>
 <rect x="1110.0" y="2002" width="200" height="26" rx="13" fill="#15803d" opacity=".13"/>
 <text x="1210.0" y="2020" text-anchor="middle" font-size="12" font-weight="800" fill="#15803d">WORKING</text>
-</svg>
+<rect x="60" y="2090" width="1380" height="146" rx="20" fill="#eff6ff" stroke="#93c5fd" stroke-width="2"/>
+<text x="750" y="2132" text-anchor="middle" font-size="22" font-weight="800" fill="#0f172a">At scale: many people × many agents × many plugins</text>
+<text x="750" y="2164" text-anchor="middle" font-size="16" fill="#475569">one PR branch per plugin or feature → joins the pilot through the lock → previewed on the pilot server</text>
+<text x="750" y="2192" text-anchor="middle" font-size="16" fill="#475569">in the cloud: a self-hosted git service, because an agent can publish by accident</text>
+<text x="750" y="2218" text-anchor="middle" font-size="16" fill="#475569">publish to a public host only from landing (main), when it is ready</text>
+</svg>

documentation/readme-images/src/deploy5-desktop.svg

@@ -1,12 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630" font-family="Inter, 'Helvetica Neue', Arial, sans-serif">
-<rect width="1200" height="630" rx="28" fill="#f8fafc"/>
-<rect x="1.5" y="1.5" width="1197" height="627" rx="27" fill="none" stroke="#e2e8f0" stroke-width="3"/>
-<g transform="translate(110,175) scale(11.5)"><path d="M13.912 0a8.72 8.72 0 0 0-8.308 6.139c1.05-.515 2.18-.845 3.342-.976 2.415-3.363 7.4-3.412 9.88-.097 2.48 3.315 1.025 8.084-2.883 9.45a6.131 6.131 0 0 1-.3 2.762 8.72 8.72 0 0 0 3.01-1.225A8.72 8.72 0 0 0 13.913 0zm.082 6.451a2.284 2.284 0 1 0-.15 4.566 2.284 2.284 0 0 0 .15-4.566zm-5.629.27a8.72 8.72 0 0 0-3.031 1.235 8.72 8.72 0 1 0 13.06 9.9131 10.173 10.174 0 0 1-3.343.965 6.125 6.125 0 1 1-7.028-9.343 6.114 6.115 0 0 1 .342-2.772zm1.713 6.27a2.284 2.284 0 0 0-2.284 2.283 2.284 2.284 0 0 0 2.284 2.284 2.284 2.284 0 0 0 2.284-2.284 2.284 2.284 0 0 0-2.284-2.284z" fill="#24C8DB"/></g>
-<text x="480" y="250" font-size="54" font-weight="800" fill="#0f172a">Desktop app (Tauri)</text>
-<text x="480" y="315" font-size="27" fill="#475569">We got the JAMstack map app running</text>
-<text x="480" y="355" font-size="27" fill="#475569">as a desktop app.</text>
-<rect x="480" y="400" width="420" height="62" rx="31" fill="#fef3c7" stroke="#d97706" stroke-width="2.5"/>
-<text x="690" y="441" text-anchor="middle" font-size="26" font-weight="800" fill="#92400e">PROVEN · NOT YET LIVE</text>
-<text x="480" y="508" font-size="22" fill="#64748b">Proven, not yet in production. The Research</text>
-<text x="480" y="538" font-size="22" fill="#64748b">Gallery could become a strong desktop app.</text>
-</svg>

documentation/reference-capability-exemplars.md

@@ -13,7 +13,7 @@
 > bundle `parameterized` (cap-2) no matter how light it looks, and a `meta.json` `type`
 > declares tiers 3/4/5.
 
-Generated from 27 bundle(s).
+Generated from 30 bundle(s).
 
 ### One canonical exemplar per tier (generated — quote these)
 
@@ -37,12 +37,15 @@ Generated from 27 bundle(s).
 | Bundle | Profile | Machine key |
 |---|---|---|
 | `all-people-groups` | `all-people-groups` | `single` |
+| `bible-posters` | `bible-posters` | `single` |
+| `bless-india-posters` | `bless-india-posters` | `single` |
 | `cities-internet` | `connectivity-list` | `single` |
 | `cities-internet` | `connectivity-map` | `single` |
 | `cities-internet` | `data-tables` | `single` |
 | `country-map` | `country-map` | `single` |
 | `country-posters` | `countries-map` | `single` |
 | `country-posters` | `country-poster-wall` | `single` |
+| `country-posters` | `poster-section` | `single` |
 | `golden-path-check` | `golden-path-check` | `single` |
 | `gospel-internet` | `board` | `single` |
 | `gospel-resources` | `charts` | `single` |
@@ -65,6 +68,7 @@ Generated from 27 bundle(s).
 | `doxa-simple-map` | `doxa-simple-map` | `parameterized` |
 | `doxa-vision-card` | `doxa-vision-card` | `parameterized` |
 | `people-groups-grid` | `people-groups-grid` | `parameterized` |
+| `poster-sections` | `poster-sections` | `parameterized` |
 
 ## Capability 3 — multi-view-element (monolithic)
 

documentation/reference-library-index.md

@@ -98,6 +98,10 @@ and a change here can break other maps.
   `import … from '@map/components/poster/PosterDialog.vue'`
 - **PosterPreview** — PosterPreview.vue — scaled live preview of the poster composition.  
   `import … from '@map/components/poster/PosterPreview.vue'`
+- **PosterSection** — PosterSection.vue — ONE section of a poster wall: its head (the name, the count, the collapse toggle) and its  
+  `import … from '@map/components/poster/PosterSection.vue'`
+- **PosterSectionView** — PosterSectionView.vue — ONE poster section on its own: the profile behind <dxm-poster-section>.  
+  `import … from '@map/components/poster/PosterSectionView.vue'`
 - **PosterWall** — PosterWall.vue — THE SHARED POSTER WALL.  
   `import … from '@map/components/poster/PosterWall.vue'`
 - **FooterSlot** — FooterSlot.vue — STUB. Poster-rendering slot for FooterSlot.  
@@ -233,6 +237,8 @@ and a change here can break other maps.
   `import … from '@map/composables/useSharedMapToken.js'`
 - **useTextHighlight** — highlightRanges(value, indices) — wrap each matched index range in  
   `import … from '@map/composables/useTextHighlight.js'`
+- **useViewAddress** — useViewAddress.js — the page's ADDRESS for the view a reader is on: which app tab, which view inside it, which  
+  `import … from '@map/composables/useViewAddress.js'`
 
 ### Utilities (pure helper functions)
 
@@ -270,8 +276,12 @@ and a change here can break other maps.
   `import … from '@map/utils/languageRequest.js'`
 - **loadPinnedUmd** — loadPinnedUmd — load a PINNED, integrity-checked UMD library and capture it WITHOUT touching the host  
   `import … from '@map/utils/loadPinnedUmd.js'`
+- **peopleGroupName** — peopleGroupName.js — a people group's name in the reader's language, or English if it was machine-translated.  
+  `import … from '@map/utils/peopleGroupName.js'`
 - **peopleGroupPoints** — peopleGroupPoints.js — SHARED (@map/utils/peopleGroupPoints.js).  
   `import … from '@map/utils/peopleGroupPoints.js'`
+- **publicEmbed** — publicEmbed.js: the Share menu's Embed codes for THIS plugin, from the tree's PUBLIC address.  
+  `import … from '@map/utils/publicEmbed.js'`
 - **scrollport** — findScrollportAncestor — the nearest ancestor that actually scrolls.  
   `import … from '@map/utils/scrollport.js'`
 - **viewportScrim** — viewportScrim.js — make a position:fixed full-screen SCRIM actually cover the VIEWPORT,  

documentation/reference.md

@@ -347,7 +347,7 @@ The measurements behind the rules above, kept for whoever needs the reasoning.
   one. `verify:map-paint` passes under both tokens (it checks GL + attribution, not tiles), so judge tile
   loading by the tile response count, not a screenshot — the basemap is Mapbox Light, which looks bare.
 - **Share round-trip (2026-09-22).** 8/8 passed with six distinct reopened tags, each matching its plugin
-  (the two UPG-100 profiles share one tag). A pass count alone cannot catch an SPA fallback that renders
+  (the two UPG100 Posters profiles share one tag). A pass count alone cannot catch an SPA fallback that renders
   *a* map for every URL.
 - **Why SRI identity, not HTTP status.** A platform's app URL can return 200 with a sign-in page; comparing
   each live bundle's bytes against the manifest's `integrity` hash is a cryptographic identity proof that

internal/_tree-name.mjs

@@ -50,6 +50,19 @@ function readGated() {
 }
 export const GATED_PROFILES = readGated()
 
+// The PUBLIC address of the tree for the Share menu's Embed tab (the config's shareBaseUrl): an https URL with no
+// trailing slash, or '' (unset). vite.config.js bakes it as __DOXA_SHARE_BASE__; library/utils/embedBase.js reads it.
+function readShareBase() {
+  let v = ''
+  try {
+    const cfg = JSON.parse(readFileSync(BUILD_CONFIG_FILE, 'utf8'))
+    v = typeof cfg.shareBaseUrl === 'string' ? cfg.shareBaseUrl.trim().replace(/\/+$/, '') : ''
+  } catch { return '' }
+  if (v && !/^https:\/\/[^\s"'<>]+$/i.test(v)) throw new Error(`[_tree-name] build config "shareBaseUrl" must be an https URL, got ${JSON.stringify(v)}`)
+  return v
+}
+export const SHARE_BASE = readShareBase()
+
 // The name escaped for use inside a RegExp source (a '.' in a future name must not match any char).
 export const TREE_NAME_RE = TREE_NAME.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 

internal/build-packet-fixtures.mjs

@@ -26,7 +26,7 @@
  *
  * Usage: node internal/build-packet-fixtures.mjs
  */
-import { existsSync, renameSync, readdirSync } from 'node:fs'
+import { existsSync, renameSync, readdirSync, mkdirSync, rmSync } from 'node:fs'
 import { resolve, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
@@ -38,6 +38,11 @@ const OUT = resolve(REPO, 'library/scripts/posters/out/packets')
 // Every fixture is built against this zone: the records come from the fixture, and the zone only
 // supplies page 1's map. Keeping it constant means a shape difference is the ONLY variable.
 const ZONE = 'asia-china-tibet-autonomous-region'
+// ★ BUILT IN THEIR OWN DIRECTORY. packet.mjs writes <zone>.html into its output dir, and every fixture is built
+// against the REAL Tibet zone; built straight into out/packets, each run overwrote the real Tibet packet and the
+// rename then removed it, so check:packets-all reported a generated zone as missing. PACKET_OUT sends each build
+// to a private directory; only the renamed fixture-<name>.html reaches out/packets.
+const BUILD = join(OUT, '.fixture-build')
 
 if (!existsSync(FIXTURES)) {
   console.log(`PACKET-FIXTURES: SKIP — no fixtures directory at ${FIXTURES}`)
@@ -54,14 +59,16 @@ console.log(`PACKET-FIXTURES: building ${fixtures.length} fixture(s)`)
 const built = []
 const failed = []
 
+mkdirSync(OUT, { recursive: true })
+mkdirSync(BUILD, { recursive: true })
 for (const fx of fixtures) {
   const name = fx.replace(/^records-/, '').replace(/\.json$/, '')
   const res = spawnSync(process.execPath, [join(REPO, 'library/scripts/posters/packet.mjs')], {
     cwd: REPO,
     encoding: 'utf8',
-    env: { ...process.env, PACKET_RECORDS: join(FIXTURES, fx), ONLY: ZONE },
+    env: { ...process.env, PACKET_RECORDS: join(FIXTURES, fx), ONLY: ZONE, PACKET_OUT: BUILD },
   })
-  const produced = join(OUT, `${ZONE}.html`)
+  const produced = join(BUILD, `${ZONE}.html`)
   if (res.status !== 0 || !existsSync(produced)) {
     // The ERROR line, not the last line: Node ends a crash with its version banner, so the last line
     // of a TDZ ReferenceError read "Node.js v20.20.2" and named nothing.
@@ -77,6 +84,8 @@ for (const fx of fixtures) {
   console.log(`  ✓ ${fx} -> fixture-${name}.html`)
 }
 
+try { rmSync(BUILD, { recursive: true, force: true }) } catch { /* best effort */ }
+
 if (failed.length) {
   console.error(`\nPACKET-FIXTURES: FAIL — ${failed.length} fixture(s) did not build`)
   for (const f of failed) console.error('  - ' + f)

internal/check-approx-pin-note.mjs

@@ -74,4 +74,4 @@ try {
   check('Arabic joins the names with و, never an English comma inside Arabic prose', /Koraga وMaila/.test(ar2) && !/Koraga, Maila/.test(ar2), ar2)
 } finally { await server.close() }
 if (bad) { console.log(`APPROX-PIN-NOTE: FAIL — ${bad} case(s).`); process.exit(1) }
-console.log('APPROX-PIN-NOTE: PASS — pins say they are localities, and name the groups that share a point.')
+console.log('APPROX-PIN-NOTE: PASS — pins say what they are, and name the groups that share a point.')

internal/check-batch-selection-export.mjs

@@ -183,6 +183,21 @@ ok(!disagree.length, `Copy's regroup warning disagrees with apply-grouping: ${di
     `a state-only selection is titled "Gujarāt"; a state + a country names both; a province with no table is not named; Mizoram alone reads "${empty}"`)
 }
 
+// ── A7. A selection too big for a PHONE'S PRINT starts nothing there ────────────────────────────────────
+// Printing the whole selection (2,209 groups, 113 sheets) crashed the page in a 2.5 GB browser; 1,857 finished. The
+// ceiling (half of that, for a phone tab's memory) is recorded beside its measurement in data/selection-export.js.
+// Self-test: a phone over the ceiling is blocked; a desktop over it is not; a phone at or under it (India alone, 905)
+// is not. The wiring (arm C) checks each of Prayer list, Card deck and Poster asks BEFORE it prints.
+{
+  const c = X.PHONE_GROUP_CEILING
+  const src = readFileSync(P('plugin-designs/my-upg-100-list/data/selection-export.js'), 'utf8')
+  const cases = [[2209, true, true], [1001, true, true], [2209, false, false], [c, true, false], [905, true, false]]
+  const wrong = cases.filter(([n, phone, want]) => X.overPhoneCeiling(n, phone) !== want).map(([n, phone]) => `${n} on a ${phone ? 'phone' : 'desktop'}`)
+  ok(c === 1000 && !wrong.length && /2,209 groups +113 sheets +the page CRASHED/.test(src) && /1,857 groups/.test(src),
+    `phone ceiling ${c}: wrong for ${wrong.join(', ') || '(none)'}; the measurement beside it is ${/2,209 groups/.test(src) ? 'present' : 'MISSING'}`,
+    `a phone over ${c} groups prints nothing (2,209 → blocked); a desktop is never blocked; India alone (905) still prints on a phone`)
+}
+
 // ── B. the CSV ───────────────────────────────────────────────────────────────────────────────────
 function parseCsv(s) {   // RFC 4180: quoted fields, doubled quotes, CRLF records
   const rows = []; let row = [], cell = '', q = false
@@ -236,6 +251,30 @@ const wired = {
     const body = vue.slice(at, vue.indexOf('\n  })', at))
     return !/toggleTerritory|toggleByProps|toggleZoneSelection/.test(body)
   })(),
+  // Each print action asks the phone ceiling BEFORE it prints, and says so in the house words.
+  'a big selection on a phone prints nothing': (() => {
+    const body = (name) => { const at = vue.indexOf(`async function ${name}() {`); return at < 0 ? '' : vue.slice(at, vue.indexOf('\n}\n', at)) }
+    const before = (name, call) => { const b = body(name); const g = b.indexOf('phoneTooBig('), p = b.indexOf(call); return g > 0 && p > g }
+    return before('makeSelectionPacket', 'packetPrints.printPacket(') && before('makeSelectionCards', 'packetPrints.printCardDeck(')
+      && before('makeSelectionPoster', 'packetPrints.printPoster(') && /hudSay\(t\('poster\.phoneLimitAll'\), 6000\)/.test(vue)
+      && /const ON_PHONE = isPhonePrint\(\);/.test(vue)
+  })(),
+  // ★ ON A PHONE .upg-status IS display:none, so a batch message written only there is INVISIBLE (a reader tapped
+  // Prayer List and nothing visible happened). Every batch action's message, and the print's progress, reach the
+  // HUD's line (.upg-hud-flash, a polite live region that no rule hides) as well as the status badge.
+  'batch messages and progress reach the visible HUD on a phone': (() => {
+    const body = (name) => { const at = vue.indexOf(`async function ${name}() {`); return at < 0 ? '' : vue.slice(at, vue.indexOf('\n}\n', at)) }
+    const actions = ['makeSelectionPacket', 'makeSelectionCards', 'makeSelectionPoster'].map(body)
+    const tooBig = vue.slice(vue.indexOf('function phoneTooBig('), vue.indexOf('function phoneTooBig(') + 300)
+    return /const hudSay = \(text, ms\) => \{ flashStatus\(text, ms\); flashRef\(copyFlash, text, ms\); \};/.test(vue)
+      && /hudSay\(t\('poster\.phoneLimitAll'\)/.test(tooBig) && !/flashStatus\(/.test(tooBig)
+      && actions.every((b) => b && !/flashStatus\(/.test(b))
+      && /class="upg-hud-flash" role="status" aria-live="polite">\{\{ copyFlash \|\| hudProgress \}\}/.test(vue)
+      && /hudProgress\.value = printStatus;/.test(vue)
+      // …and it sits ABOVE the action rows: on a phone the PinHint toast covers the HUD's bottom edge
+      && vue.indexOf('class="upg-hud-flash"') > 0 && vue.indexOf('class="upg-hud-flash"') < vue.indexOf('class="upg-hud-actions"')
+      && !/\.upg-hud-flash\{[^}]*display:\s*none/.test(vue) && !/@media[^{]*\{[^}]*\.upg-hud-flash\{[^}]*display:\s*none/.test(vue)
+  })(),
   'the regroup warning on Copy': /const warn = regroupable\(sel\) \? '' : t\('upgMap\.copyNotRegroupable'\)/.test(vue),
   // The packet / card-deck title goes through selectionTitleNames (arm A6 proves it), with the keyed empty case.
   'the title names come from selectionTitleNames': /const names = selectionTitleNames\(zoneNames, selectedTerritories\.value, from,\s*\n\s*\(\) => keyedError\('wall\.hud\.noRecords'/.test(vue)
@@ -249,6 +288,7 @@ ok(!missingWires.length, `the HUD is missing: ${missingWires.join(', ')}`, 'the
 // ── D. the strings, ×11 ──────────────────────────────────────────────────────────────────────────
 const LANGS = ['en', 'es', 'fr', 'pt', 'de', 'it', 'ro', 'ru', 'ar', 'hi', 'zh']
 const KEYS = {
+  poster: ['phoneLimitAll'],
   upgMap: ['copySelection', 'exportCsv', 'copyNotRegroupable', 'peopleStillLoading', 'selectionColourGroup', 'selectionColour', 'customColour', 'copiedSelection', 'copiedTerritoriesOnly', 'csvSaved', 'csvFailed'] }
 const cat = (l, f) => JSON.parse(readFileSync(P('library/i18n/locales', l, `${f}.json`), 'utf8'))
 const bad = []

internal/check-dev-leaf-escape.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * check-dev-leaf-escape.mjs — a dev leaf URL cannot write markup into the page it opens.
+ *
+ * THE DEFECT. The dev server's leaf route, /__leaf/<bundle>/<profile>[/<instance>] (and a production embed URL,
+ * <bundle>/<profile>[/<instance>]/index.html, rewritten onto it), writes the URL's parts into the page it serves: the
+ * <title> and the element's profile-config='…' attribute. It refused only `..` and `/`, so a quote or a tag in the path
+ * was written raw, and a crafted link broke out of the attribute on a publicly reachable dev server.
+ * internal/plugin-gallery/dev-plugin.mjs now refuses any part outside LEAF_PART (the shape every bundle folder, profile
+ * id and instance id has) before either sink, and escapes the <title> as well.
+ *
+ * The plugin's own middleware answers each request (no server, no browser):
+ *   A. every leaf the dev manifest advertises (galleryModel), as /__leaf/… AND as its production embed URL → 200 with
+ *      its element: the rule refuses no real page;
+ *   B. a hostile part (a quote, a double quote, a tag, an ampersand, a space, a backtick, an encoded slash or
+ *      backslash, `..`, `.`, an attribute break-out) in each position, both URL forms → refused here (400) or left to
+ *      Vite, never a page;
+ *   C. escHtml leaves none of & < > " ' raw;
+ *   D. with the part rule set back to the old one (`..` and `/` only), a tag in the profile still reaches the <title>
+ *      escaped: the title has its own escaping, not only the rule in front of it.
+ * Response bodies are never printed: a leaf page carries the build config's token.
+ * `--self-test`: the old guard, a rule too strict for a real profile, an unescaped <title> and an escHtml that misses
+ * the quote must each FAIL.
+ */
+import { readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { discoverSpaRegistry } from './plugin-gallery/discover.mjs'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const PLUGIN = join(HERE, 'plugin-gallery/dev-plugin.mjs')
+const SRC = readFileSync(PLUGIN, 'utf8')
+const GUARD = 'parts.some(s => !LEAF_PART.test(s))'
+const OLD_GUARD = "parts.some(s => !s || s.includes('..') || s.includes('/'))"
+const RULE = 'export const LEAF_PART = /^[A-Za-z0-9][\\w-]{0,63}$/'
+const TITLE = '${escHtml(bundle)} · ${escHtml(profile)}'
+const ESC_CLASS = `/[&<>"']/g`
+
+// A copy of the plugin, altered or not, imported from beside the original so its relative imports resolve; the
+// file is removed as soon as it is loaded.
+let seq = 0
+async function load(src) {
+  if (src === SRC) return import(pathToFileURL(PLUGIN).href)
+  const tmp = join(HERE, 'plugin-gallery', `.tmp-check-dev-leaf-escape-${process.pid}-${++seq}.mjs`)
+  writeFileSync(tmp, src)
+  try { return await import(pathToFileURL(tmp).href) } finally { rmSync(tmp, { force: true }) }
+}
+
+// The plugin's middleware, answering one GET: { status, body } ('next' = not answered here, Vite would).
+function client(mod) {
+  let mw = null
+  mod.autoSpaDevPlugin('').configureServer({ middlewares: { use: (f) => { if (!mw) mw = f } } })
+  return (url) => new Promise((done) => {
+    const res = { statusCode: 200, setHeader() {}, end: (b) => done({ status: res.statusCode, body: String(b ?? '') }) }
+    try { mw({ url, method: 'GET', headers: {} }, res, () => done({ status: 'next', body: '' })) }
+    catch (e) { done({ status: 'threw', body: String(e && e.message) }) }
+  })
+}
+
+// Every /__leaf/ URL the dev manifest advertises, with the tag its page must mount.
+function advertised(mod) {
+  const out = []
+  const walk = (o, tag) => {
+    if (!o || typeof o !== 'object') return
+    for (const v of Object.values(o)) {
+      if (typeof v === 'string' && v.startsWith('/__leaf/')) out.push({ url: v.split(/[?#]/)[0], tag })
+      else walk(v, tag)
+    }
+  }
+  for (const b of mod.galleryModel(discoverSpaRegistry()).bundles) walk(b, (b.elements || [])[0])
+  return [...new Map(out.map((x) => [x.url, x])).values()]
+}
+
+const HOSTILE = ["a'b", 'a"b', 'a<b', 'a>b', 'a&b', 'a b', 'a`b', 'a/b', 'a\\b', '..', '.', "x'><img src=x onerror=alert(1)>"]
+
+async function audit(src) {
+  const f = []
+  let mod
+  try { mod = await load(src) } catch (e) { return [`load: the plugin does not import (${e.message})`] }
+  const get = client(mod)
+  const leaves = advertised(mod)
+  if (leaves.length < 20) f.push(`A: only ${leaves.length} advertised leaves found (the manifest walk is broken)`)
+  for (const { url, tag } of leaves) {
+    for (const u of [url, url.replace('/__leaf/', '/') + '/index.html']) {
+      const r = await get(u)
+      if (r.status !== 200 || !r.body.includes(`<${tag} `)) f.push(`A: ${u} → ${r.status}${r.status === 200 ? `, no <${tag}>` : ''} (a real page refused)`)
+    }
+  }
+  const [b0, p0] = (leaves[0] ? leaves[0].url : '/__leaf/x/x').slice('/__leaf/'.length).split('/')
+  for (const h of HOSTILE) {
+    const e = encodeURIComponent(h)
+    for (const parts of [[e, p0], [b0, e], [b0, p0, e]]) {
+      const leaf = '/__leaf/' + parts.join('/')
+      const r = await get(leaf)
+      if (r.status !== 400) f.push(`B: ${leaf} → ${r.status} (want 400)`)
+      const embed = '/' + parts.join('/') + '/index.html'
+      const r2 = await get(embed)
+      if (r2.status !== 400 && r2.status !== 'next') f.push(`B: ${embed} → ${r2.status} (want 400, or left to Vite)`)
+    }
+  }
+  const esc = mod.escHtml ? mod.escHtml(`&<>"'`) : null
+  if (esc !== '&amp;&lt;&gt;&quot;&#39;') f.push(`C: escHtml(& < > " ') = ${JSON.stringify(esc)}`)
+  if (!src.includes(GUARD)) f.push('D: the leaf guard is not the LEAF_PART rule, so the title cannot be tested behind the old one')
+  else {
+    let loose
+    try { loose = await load(src.replace(GUARD, OLD_GUARD)) } catch (e) { f.push(`D: ${e.message}`) }
+    if (loose) {
+      const r = await client(loose)(`/__leaf/${b0}/${encodeURIComponent('<b>x')}`)
+      const title = (/<title>([^]*?)<\/title>/.exec(r.body) || [])[1]
+      if (r.status !== 200 || title === undefined) f.push(`D: behind the old rule the page did not render (${r.status})`)
+      else if (title.includes('<b>') || !title.includes('&lt;b&gt;')) f.push('D: behind the old rule a tag in the profile reached the <title> raw')
+    }
+  }
+  return f
+}
+
+if (process.argv.includes('--self-test')) {
+  const poisons = [
+    ['the old guard (`..` and `/` only)', SRC.replace(GUARD, OLD_GUARD), /^B: /],
+    ['a rule too strict for a real profile', SRC.replace(RULE, 'export const LEAF_PART = /^[a-z]{1,63}$/'), /^A: /],
+    ['an unescaped <title>', SRC.replace(TITLE, '${bundle} · ${profile}'), /^D: /],
+    ['an escHtml that misses the quote', SRC.replace(ESC_CLASS, `/[&<>"]/g`), /^C: /],
+  ]
+  let missed = 0
+  for (const [name, src, rx] of poisons) {
+    if (src === SRC) { console.log(`✗ MISSED: ${name} (not planted: its source line was not found)`); missed++; continue }
+    const f = await audit(src); const hit = f.find((x) => rx.test(x))
+    console.log(hit ? `✓ caught: ${name} -> ${hit}` : `✗ MISSED: ${name}${f.length ? ` (failed instead: ${f[0]})` : ''}`)
+    if (!hit) missed++
+  }
+  if (missed) process.exitCode = 1
+} else {
+  const f = await audit(SRC)
+  if (f.length) { for (const x of f.slice(0, 40)) console.log('✗ ' + x); console.log(`FAIL check:dev-leaf-escape (${f.length})`); process.exitCode = 1 }
+  else console.log(`PASS check:dev-leaf-escape — every advertised dev leaf is served in both URL forms; ${HOSTILE.length} hostile parts are refused in every position of both forms; the <title> escapes on its own`)
+}

internal/check-evangelical-share.mjs

@@ -90,15 +90,28 @@ const notes = []
   if (!partial.includes(`5 ${ppl}`) || !partial.includes(`995 ${ppl}`)) {
     fails.push(`a 0.5% list of 1,000 people does not state both totals ("5 ${ppl}" who follow Jesus, "995 ${ppl}" who do not yet)`)
   } else notes.push('  ok    both totals are stated in people: 5 who follow Jesus, 995 who do not yet')
-  if (/week/i.test(partial) || /class="lc-(wk|y)"/.test(partial)) fails.push('the page still counts in weeks or draws a week/year axis')
+  // The grid is one SVG now (lifeGrid): its week numbers are <text class="lc-t lc-tw">, its year numbers
+  // "lc-t lc-ty", and its markup names `data-weeks` as geometry, so the WORDS a reader sees are read with the
+  // tags stripped.
+  const axis = /class="lc-t lc-t[wy]\b/
+  if (/week/i.test(partial.replace(/<[^>]+>/g, ' ')) || axis.test(partial)) fails.push('the page still counts in weeks or draws a week/year axis')
   else notes.push('  ok    no weeks and no week/year axis on the page')
+  // ★ ITS SIDE LABELS ARE SHARES (2026-10-02): each 10-row block is 520 boxes, a tenth of the list's people,
+  // labelled 10% ... 100% in the page's own numerals; exactly those ten, in order.
+  const shares = [...partial.matchAll(/class="lc-t lc-tp[^"]*"[^>]*>([^<]*)</g)].map((m) => m[1])
+  const want = Array.from({ length: 10 }, (_, i) => `${((i + 1) * 10).toLocaleString('en')}%`)
+  if (shares.join('|') !== want.join('|')) fails.push(`the people grid's side labels should read ${want.join(' ')}, got ${shares.join(' ') || 'none'}`)
+  else notes.push('  ok    the people grid labels each 10-row block with its share: 10% ... 100%')
   // A TINY SHARE: the totals come from the unrounded figure. 0.004% of 1,000,000,000 is 40,000 people,
   // which must not print as 0 because the percentage rounds to 0.00.
   const tiny = page({ groupsInList: 5, groupsMatched: 5, population: 1e9, evangelicalPopulation: 40000, pctEvangelical: 0.004 })
   if (!tiny.includes(`40,000 ${ppl}`) || !/ev-pct">&lt;0\.01%</.test(tiny)) fails.push('a 0.004% share of a billion does not print 40,000 people and "<0.01%"')
   else notes.push('  ok    a share below the printed digits keeps its real total (40,000 people) and reads "<0.01%"')
-  // NEG CONTROL: the life page itself keeps its axes, so the axis test above can see one when it is there.
-  if (!/class="lc-wk"/.test(R.lifePage(zone))) fails.push('the life page lost its week axis (the axis check above cannot fail)')
+  // NEG CONTROL: the life page itself keeps both axes, so the axis test above can see one when it is there,
+  // and it carries no share labels, so the share test above is not satisfied by any grid.
+  const life = R.lifePage(zone)
+  if (!/class="lc-t lc-tw"/.test(life) || !/class="lc-t lc-ty/.test(life)) fails.push('the life page lost its week or year axis (the axis check above cannot fail)')
+  if (/class="lc-t lc-tp/.test(life)) fails.push('the life page carries share labels: a week of a life is not a share of people')
 }
 
 for (const n of notes) console.log(n)

internal/check-gospel-all.mjs

@@ -37,6 +37,7 @@ const STATIC = [
   ['check:click-sheet', 'the country sheet resolves, links are absolute'],
   ['check:snapshot-guard', 'no fetcher writes around the guard'],
   ['check:gospel-tables-staged', 'every asset the map fetches is in the shipped tree'],
+  ['check:gospel-clear-filter-url', 'Show all drops only the filter keys, not a partner\'s'],
 ]
 const BROWSER = [
   ['check:leaves-mount', 'all five leaves actually mount'],

internal/check-gospel-tables-staged.mjs

@@ -64,6 +64,44 @@ for (const prefix of dirLike) {
   for (const file of named.filter((f) => f.endsWith(ext))) wanted.push(prefix + file)
 }
 
+/**
+ * ⚠ AN INTERPOLATED FILE NAME IS NOT A FILE EITHER. The field card fetches
+ * `${assetsBase.value}/tables/card-${cardShard(cardSlug)}.json`, so the parse above captures "tables/card-" and
+ * stops at the interpolation; read as a file it failed as "not staged" while all its shards were there. Its
+ * expected set comes from the SOURCE, as the rule above says, never from the tree: every roster row the card
+ * builder keeps (data/tables/doxa-people-groups.json, the same filter as build-field-cards.mjs) hashed with the
+ * leaf's own cardShard. This file carries a copy of that function and fails if the leaf's copy changes, so the
+ * two cannot drift apart; any other interpolated name is reported as unresolved, never passed.
+ */
+const SHARD_FN = 'let h = 5381 for (let i = 0; i < slug.length; i++) h = (((h << 5) + h) ^ slug.charCodeAt(i)) & 0xffffffff return ((h >>> 0) & 0xff).toString(16).padStart(2, \'0\')'
+const cardShard = (slug) => {
+  let h = 5381
+  for (let i = 0; i < slug.length; i++) h = (((h << 5) + h) ^ slug.charCodeAt(i)) & 0xffffffff
+  return ((h >>> 0) & 0xff).toString(16).padStart(2, '0')
+}
+function checkInterpolatedName(rel, missing) {
+  if (rel !== 'tables/card-') { missing.push(`${rel} — an interpolated file name this check cannot resolve`); return }
+  const leafFn = (src.match(/const cardShard = \(slug\) => \{([\s\S]*?)\n\}/) || [])[1]
+  if (!leafFn || leafFn.replace(/\s+/g, ' ').trim() !== SHARD_FN) {
+    missing.push('tables/card-*.json — the leaf\'s cardShard changed; update this check\'s copy (and build-field-cards.mjs) to match')
+    return
+  }
+  let rows = []
+  try { rows = JSON.parse(readFileSync(resolve(ROOT, 'data/tables/doxa-people-groups.json'), 'utf8')).rows || [] }
+  catch (e) { missing.push(`tables/card-*.json — could not read the roster: ${e.message}`); return }
+  const keys = [...new Set(rows.filter((r) => r && r.slug && r.mapped && r.lat != null && r.lng != null).map((r) => cardShard(r.slug)))].sort()
+  if (keys.length < 20) { missing.push(`tables/card-*.json — the roster gave only ${keys.length} shard key(s); the roster changed shape`); return }
+  let ok = 0, bytes = 0
+  for (const k of keys) {
+    const p = resolve(POOL, `tables/card-${k}.json`)
+    if (!existsSync(p)) { missing.push(`tables/card-${k}.json — not staged`); continue }
+    const b = statSync(p).size
+    if (b < 200) { missing.push(`tables/card-${k}.json — staged but only ${b} bytes`); continue }
+    ok++; bytes += b
+  }
+  console.log(`  ${ok === keys.length ? 'ok  ' : 'FAIL'} ${'tables/card-*.json'.padEnd(42)} ${ok}/${keys.length} shard(s) the roster needs, ${bytes} bytes`)
+}
+
 const missing = []
 for (const rel of wanted) {
   if (rel.endsWith('/')) {
@@ -73,6 +111,7 @@ for (const rel of wanted) {
     if (!found.length) missing.push(`${rel} — a dynamic fetch this check could not resolve to a file`)
     continue
   }
+  if (!/\.(?:geojson|json)$/.test(rel)) { checkInterpolatedName(rel, missing); continue }
   const p = resolve(POOL, rel)
   if (!existsSync(p)) { missing.push(`${rel} — not staged`); continue }
   const bytes = statSync(p).size

internal/check-host-floor.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+/**
+ * check-host-floor.mjs — the profile floor is decided against the host WITHOUT disturbing live content.
+ *
+ * library/elements/hostFloor.js (used by ProfileLoader.vue) probes the host at mount, and after that re-probes ONLY
+ * when the host may have changed kind, saving and restoring every scrolled descendant. The regression this pins:
+ * the probe ran on EVERY host resize, collapsing the loader under live content; a scrolling child's scrollTop was
+ * clamped to 0 and the embedded UPG-100 app flipped from Map back to its first view whenever a phone's URL bar
+ * resized the host.
+ *
+ * A stub DOM models the layout that matters: the host's height from its mode and the loader's min-height, the
+ * floor (100svh) as a number the test moves like a window resize, and a scrolled CHILD whose scrollTop clamps to 0
+ * whenever the loader collapses.
+ *   A. after mount, a content-sized host following a window resize, and a sized host that keeps its size, never
+ *      write the loader's min-height nor move the child's scrollTop;
+ *   B. a sized host (523 px) is filled: the floor goes off at mount;
+ *   C. a host styled SHORTER than the floor after mount flips to sized ONCE, then stays;
+ *   D. a host capped by max-height (600 < floor) is found at mount: 0 flips and 0 re-probes over 20 resizes;
+ *   E. a max-height cap that arrives AFTER mount: at most 1 flip and 1 re-probe over 20 resizes, ends content-sized;
+ *   F. a sized host restyled to height:auto with NO content gets the floor back;
+ *   H. a sized host restyled to height:auto WITH in-flow content (420) gets the floor back: at most 1 flip over 20
+ *      resizes, and the scrolled child keeps its scrollTop through the re-probe;
+ *   G. an inline host is left alone after mount.
+ * `--self-test`: the old per-resize probe (A), a missing capped latch (D/E re-probe in a loop), a missing re-check
+ * of a sized host (H stays sized) and a missing scroll restore (H loses the child's scrollTop) must each FAIL.
+ */
+import { readFileSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+const SRC = join(ROOT, 'library/elements/hostFloor.js')
+const asModule = (src) => import('data:text/javascript;base64,' + Buffer.from(src).toString('base64'))
+
+// mode: 'content' (height = max(content, min-height)), 'sized' (a fixed height), 'capped' (content-sized up to a cap)
+function world({ mode = 'content', fixed = 523, cap = 600, content = 0, floor = 844, display = 'block' } = {}) {
+  const w = { mode, fixed, cap, content, floor, display, writes: [], child: { scrollTop: 787 } }
+  const attrs = new Set()
+  const minPx = () => {
+    const v = loader.style._min
+    if (v === '' || v === undefined) return w.floor
+    return parseFloat(v)
+  }
+  w.hostH = () => {
+    if (w.mode === 'sized') return w.fixed
+    const natural = Math.max(w.content, minPx())
+    return w.mode === 'capped' ? Math.min(natural, w.cap) : natural
+  }
+  const loader = {
+    style: {
+      _min: '',
+      get minHeight() { return this._min },
+      set minHeight(v) {
+        this._min = v; w.writes.push(v)
+        if (v === '0px' && w.mode !== 'sized') w.child.scrollTop = 0   // the loader collapsed: the child clamps
+      },
+    },
+    hasAttribute: (n) => attrs.has(n), setAttribute: (n) => attrs.add(n), removeAttribute: (n) => attrs.delete(n),
+  }
+  const host = { getBoundingClientRect: () => ({ height: w.hostH() }) }
+  w.loader = loader; w.host = host
+  w.style = (n) => (n === host ? { display: w.display, minHeight: '0px' } : { display: 'block', minHeight: (loader.style._min === '' ? w.floor : parseFloat(loader.style._min)) + 'px' })
+  w.sized = () => attrs.has('data-host-sized')
+  w.probes = () => w.writes.filter((v) => v === '100000px').length
+  return w
+}
+
+async function audit(src) {
+  const { createHostFloor } = await asModule(src)
+  const fails = []
+  let t = 0
+  const make = (opts) => { const w = world(opts); w.f = createHostFloor(w.loader, w.host, { style: w.style, scrolled: () => (w.child.scrollTop ? [w.child] : []) }); return w }
+
+  // A: content-sized host, a window resize moves the floor and the host with it
+  { const w = make({ mode: 'content', content: 0 }); w.f.probeOnce(); w.child.scrollTop = 787; w.writes.length = 0
+    for (const fl of [830, 760, 700, 844]) { w.floor = fl; w.f.follow() }
+    if (w.child.scrollTop !== 787) fails.push(`A: a host resize after mount clamped a scrolled child (scrollTop 787 → ${w.child.scrollTop})`)
+    if (w.writes.length) fails.push(`A: a host resize after mount wrote the loader's min-height (${w.writes.join(', ')})`)
+    if (w.sized()) fails.push('A: a content-sized host was flipped to sized by a window resize') }
+  { const w = make({ mode: 'sized', fixed: 523 }); w.f.probeOnce(); w.writes.length = 0; w.child.scrollTop = 300
+    for (let i = 0; i < 4; i++) w.f.follow()
+    if (w.writes.length || w.child.scrollTop !== 300) fails.push('A: a sized host\'s resize callbacks touched the loader') }
+  // B
+  { const w = make({ mode: 'sized', fixed: 523 }); w.f.probeOnce()
+    if (!w.sized() || w.loader.style.minHeight !== '0px') fails.push('B: a sized host (523) is not filled (the floor stayed on)') }
+  // C
+  { const w = make({ mode: 'content' }); w.f.probeOnce(); let flips = 0, was = w.sized()
+    w.mode = 'sized'; w.fixed = 600
+    for (let i = 0; i < 10; i++) { t += 100; w.f.follow(); if (w.sized() !== was) { flips++; was = w.sized() } }
+    if (!w.sized() || flips !== 1) fails.push(`C: a host sized after mount should flip to sized exactly once (flips ${flips}, sized ${w.sized()})`) }
+  // D
+  { const w = make({ mode: 'capped', cap: 600, content: 0 }); w.f.probeOnce(); let flips = 0, was = w.sized()
+    for (let i = 0; i < 20; i++) { t += 50; w.f.follow(); if (w.sized() !== was) { flips++; was = w.sized() } }
+    const probes = w.probes() - 1
+    if (flips !== 0 || w.sized() || probes > 0) fails.push(`D: a max-height host flipped ${flips} time(s) / was re-probed ${probes} time(s) (it must be found at mount and left alone)`) }
+  // E
+  { const w = make({ mode: 'content', content: 0 }); w.f.probeOnce(); let flips = 0, was = w.sized(); const p0 = w.probes()
+    w.mode = 'capped'; w.cap = 600
+    for (let i = 0; i < 20; i++) { t += 50; w.f.follow(); if (w.sized() !== was) { flips++; was = w.sized() } }
+    const probes = w.probes() - p0
+    if (flips > 1 || w.sized() || probes > 1) fails.push(`E: a max-height cap that arrived after mount LOOPS or stays sized (flips ${flips}, re-probes ${probes}, sized ${w.sized()})`) }
+  // H: sized → height:auto with in-flow content
+  { const w = make({ mode: 'sized', fixed: 523 }); w.f.probeOnce(); w.child.scrollTop = 300; let flips = 0, was = w.sized()
+    w.mode = 'content'; w.content = 420
+    for (let i = 0; i < 20; i++) { t += 50; w.f.follow(); if (w.sized() !== was) { flips++; was = w.sized() } }
+    if (w.sized()) fails.push('H: a sized host restyled to height:auto with content (420) stayed sized (the floor did not come back)')
+    if (flips > 1) fails.push(`H: the sized → auto host flipped ${flips} times`)
+    if (w.child.scrollTop !== 300) fails.push(`H: the re-probe moved a scrolled child (scrollTop 300 → ${w.child.scrollTop})`) }
+  // F
+  { const w = make({ mode: 'sized', fixed: 523 }); w.f.probeOnce(); w.mode = 'content'; w.content = 0; w.f.follow()
+    // with the floor off and no content the host is 0 high; follow() must bring the floor back
+    if (w.sized()) fails.push('F: a sized host that collapsed to 0 did not get the floor back') }
+  // G
+  { const w = make({ mode: 'content', display: 'inline' }); w.f.probeOnce(); w.writes.length = 0; w.floor = 700; w.f.follow()
+    if (w.writes.length) fails.push('G: an inline host was acted on after mount') }
+  return fails
+}
+
+const src = readFileSync(SRC, 'utf8')
+if (process.argv.includes('--self-test')) {
+  const poisons = [
+    ['the old per-resize probe (follow() re-measures, no restore)', src.replace(/function follow\(\) \{/, 'function follow() { decide(); return;'), /^A: /],
+    ['no latch for a capped host', src.replace('if (capped) { if (h + 1 >= f) capped = false }\n      else if', 'if'), /^[DE]: /],
+    ['no re-check of a sized host', src.replace('if (lastH === null || Math.abs(h - lastH) >= 1) reprobe()', '/* no re-check */'), /^H: .*stayed sized/],
+    ['no scroll restore in the re-probe', src.replace("for (const [e, top, left] of kept) { if (e.scrollTop !== top) e.scrollTop = top; if (e.scrollLeft !== left) e.scrollLeft = left }", ''), /^H: the re-probe moved/],
+  ]
+  let missed = 0
+  for (const [name, poisoned, rx] of poisons) {
+    if (poisoned === src) { console.log(`NOT MEASURED: the poison anchor for "${name}" moved`); process.exitCode = 75; continue }
+    const f = await audit(poisoned); const hit = f.find((x) => rx.test(x))
+    console.log(hit ? `✓ caught: ${name} -> ${hit}` : `✗ MISSED: ${name}`)
+    if (!hit) missed++
+  }
+  if (missed) process.exitCode = 1
+} else {
+  const f = await audit(src)
+  if (f.length) { for (const x of f) console.log('✗ ' + x); console.log(`FAIL check:host-floor (${f.length})`); process.exitCode = 1 }
+  else console.log('PASS check:host-floor — probed at mount; after it, re-probed only on a change of kind and without moving a scrolled child; a window resize writes nothing; a sized host fills; late sizing flips once; a max-height cap never loops; a sized host restyled to auto (with or without content) gets the floor back; inline hosts are left alone')
+}

internal/check-i18n-parity.mjs

@@ -68,6 +68,11 @@ const areas = readdirSync(join(ROOT, 'en')).filter((f) => f.endsWith('.json'))
 // translations, add the locale here with its count and lower it as they arrive.
 // Never raise a number; never add a locale that is already complete.
 const DEBT = {
+  // 2026-10-03, the Share menu's 10 new share.json keys (shareable pages P3): localization is English-only for now.
+  // tStatic falls back to the English text, so these locales show English until the translations arrive;
+  // lower each to 0 then, and empty the map again.
+  // + the Embed tab's 9 keys (URL / Iframe / JavaScript, P3b), the same English-only rule.
+  ar: 19, de: 19, es: 19, fr: 19, hi: 19, it: 19, pt: 19, ro: 19, ru: 19, zh: 19,
 }
 
 const fails = []

internal/check-map-menu-anchor.mjs

@@ -39,7 +39,19 @@ const m = code.match(/host\.value\s*=\s*([^\n]+)/)
 if (!m) {
   fails.push('the area resolution moved — this gate cannot find `host.value = …` and would pass blind.')
 } else {
-  const expr = m[1]
+  let expr = m[1]
+  // The resolution may live in a named function (resolveHost(), shareable pages P3: a standalone Share button
+  // re-resolves at open time). Then judge THAT function's body, and fail if it cannot be found.
+  const fn = expr.match(/^\s*(\w+)\(\)/)
+  if (fn) {
+    const body = code.match(new RegExp('function\\s+' + fn[1] + '\\s*\\(\\)\\s*\\{([\\s\\S]*?)\\n\\}'))
+    // every return that resolves a named area must carry its structural fallback on the SAME expression
+    // a same-line comment is not a fallback: strip `//…` before testing each return
+    const rets = body ? [...body[1].matchAll(/return\s+([^\n]*closest\([^\n]*)/g)].map((r) => r[1].replace(/\s*\/\/.*$/, '')) : []
+    expr = rets.length && rets.every((r) => /offsetParent|parentElement|document\.body/.test(r)) ? rets.join(' ;; ') : (rets.find((r) => !/offsetParent|parentElement|document\.body/.test(r)) || '')
+    if (!body) fails.push(`the area resolution calls ${fn[1]}(), and this gate cannot find that function to read it.`)
+    else if (!rets.length) fails.push(`${fn[1]}() returns no named-area resolution, so this gate would pass blind.`)
+  }
   if (!/offsetParent|parentElement|document\.body/.test(expr)) {
     fails.push('MapControlMenu resolves its anchor from a class allowlist with no structural fallback:\n'
       + `      ${expr.trim()}\n`

internal/check-nav-reachable-mobile.mjs

@@ -112,12 +112,12 @@ const PROBE = () => {
   const rail = all.find(n => /vtl-nav/.test(cls(n)))
   if (!rail) return { noRail: true }
 
-  // Any control that can bring the rail on screen. Both are legitimate: the header toggle when a
-  // header exists, the phone bar's ☰ (.vtl-phone-menu, which replaced the floating corner circle) when
-  // it does not.
+  // Any control that can bring the rail on screen. All are legitimate: the header toggle when a
+  // header exists; with none, the phone bar's ☰ (.vtl-phone-menu, app mode) or the corner ☰ (.vtl-fab,
+  // web mode: a host page with its own site header).
   const openers = all
-    .filter(n => n.tagName === 'BUTTON' && /vtl-menu|vtl-phone-menu/.test(cls(n)))
-    .map(n => ({ kind: /vtl-phone-menu/.test(cls(n)) ? 'phone-bar' : 'header-menu', on: onScreen(n), name: name(n) }))
+    .filter(n => n.tagName === 'BUTTON' && /vtl-menu|vtl-phone-menu|vtl-fab/.test(cls(n)))
+    .map(n => ({ kind: /vtl-phone-menu/.test(cls(n)) ? 'phone-bar' : /vtl-fab/.test(cls(n)) ? 'corner' : 'header-menu', on: onScreen(n), name: name(n) }))
 
   return {
     railOnScreen: onScreen(rail),
@@ -174,7 +174,7 @@ for (const t of targets) {
       for (const c of (n.children || [])) w(c)
     })(document.body)
     const cls = (n) => (n.className || '').toString()
-    const btn = all.find(n => n.tagName === 'BUTTON' && /vtl-menu|vtl-phone-menu/.test(cls(n)) &&
+    const btn = all.find(n => n.tagName === 'BUTTON' && /vtl-menu|vtl-phone-menu|vtl-fab/.test(cls(n)) &&
                               n.getBoundingClientRect().width > 0)
     if (!btn) return { clicked: false }
     btn.click()

internal/check-one-scroll-container.mjs

@@ -93,7 +93,7 @@ for (const bundle of readdirSync(DESIGNS)) {
 // ── ★ THE HOST-SIZED SCROLLER IS A THREE-LINE SHAPE, AND IT MUST BE PORTED WHOLE ────────────────
 // A pane that fills its host absolutely AND turns on overflow is also, necessarily, the thing that
 // scrolls whatever its child overflows by. library/ProfileLoader.vue floors EVERY profile at
-// `min-height: var(--profile-min-h, 100dvh)` -- a VIEWPORT measurement -- while such a pane measures
+// `min-height: var(--profile-min-h, 100svh)` -- a VIEWPORT measurement -- while such a pane measures
 // against its HOST. So on any page with chrome above it, the child is taller than the pane by exactly
 // the height of that chrome, and the pane scrolls the whole plugin, tab strip and all.
 //
@@ -124,7 +124,7 @@ for (const [file, label] of [
     if (!/--profile-min-h:\s*0/.test(r)) {
       const sel = r.slice(0, r.indexOf('{')).trim().split('\n').pop().trim()
       fails.push(`${file}: "${sel}" fills its host and owns the overflow but does NOT set --profile-min-h:0.\n`
-        + '      ProfileLoader floors every child at 100dvh (the VIEWPORT), so on a page with a header the\n'
+        + '      ProfileLoader floors every child at 100svh (the VIEWPORT), so on a page with a header the\n'
         + '      child is taller than this pane by the header height and this pane scrolls the whole plugin,\n'
         + '      tab strip included. The three lines are one shape: fill, scroll, release the floor.')
     }

internal/check-packet-a1-structure.mjs

@@ -78,7 +78,7 @@ function sequence(html) {
       : /word-title/.test(seg) ? 'word'   // point 4's passage in full + the Father's-heart list (2026-09-30)
       : /points-title|points_title|Prayer Points/.test(seg) ? 'points'
       : `?${cls.trim()}`
-    if ((kind === 'profiles' || kind === 'worksheet') && out[out.length - 1] === kind) return   // one entry per run
+    if ((kind === 'profiles' || kind === 'worksheet' || kind === 'points') && out[out.length - 1] === kind) return   // one entry per run
     out.push(kind)
   })
   return out.join(' · ')
@@ -119,9 +119,9 @@ const box = (html) => {
   ok(p1.indexOf('class="map-sheet"') >= 0 && p1.indexOf('class="map-sheet"') < p1.indexOf('map-series'),
     'page 1 draws its title BEFORE the map, so the map-only sheet\'s background paints over it', 'on a map-only sheet the map is drawn first, the title over it')
   // two-sided: the series line WITH a packet count, and NOT without one
-  ok(/class="map-series"[\s\S]{0,200}One of 28 UPG 100 prayer lists/.test(p1), 'page 1 (map-only) does not say it is one of the 28 UPG 100 prayer lists')
+  ok(/class="map-series"[\s\S]{0,200}One of 28 UPG100 prayer lists/.test(p1), 'page 1 (map-only) does not say it is one of the 28 UPG100 prayer lists')
   const noKp1 = R.mapPage(zone, groups, liftedMap, noK)
-  ok(!/map-series/.test(noKp1), 'page 1 prints a series line with NO packet count to state', 'a map-only page 1 says "One of 28 UPG 100 prayer lists" — and stays silent without a count')
+  ok(!/map-series/.test(noKp1), 'page 1 prints a series line with NO packet count to state', 'a map-only page 1 says "One of 28 UPG100 prayer lists" — and stays silent without a count')
   // ★ A POSTER PAGE 1 HAS ONE HEADER, THE POSTER'S — two-sided against the map-only page above, which has the packet's.
   const posterP1 = R.mapPage(zone, groups, R.liftMap(POSTER_SHEET), withK)
   ok(/sheet-map-poster/.test(posterP1) && !/map-series/.test(posterP1) && !posterP1.includes(strings.en.map_page_sub.split('{count}')[0]),
@@ -143,10 +143,10 @@ const box = (html) => {
   ok(tiers === funnelRaw.steps.length + 2 && nums === tiers,
     `with a packet count the triangle should have ${funnelRaw.steps.length + 2} tiers each with its number; got ${tiers} tiers, ${nums} numbers`,
     `${tiers} tiers, every one with its number: ${funnelRaw.steps.length} global steps, the packets, this packet`)
-  ok(/UPG 100 prayer packets divide/.test(page), 'the packets tier is missing although a packet count was supplied')
+  ok(/UPG100 prayer packets divide/.test(page), 'the packets tier is missing although a packet count was supplied')
   const pageNoK = tri(R.buildPacket(zone, groups, new Map(), liftedMap, noK, christian, 'full', sets))
   const tiersNoK = (pageNoK.match(/class="funnel-tier/g) || []).length
-  ok(tiersNoK === funnelRaw.steps.length + 1 && !/UPG 100 prayer packets divide/.test(pageNoK),
+  ok(tiersNoK === funnelRaw.steps.length + 1 && !/UPG100 prayer packets divide/.test(pageNoK),
     `without a packet count the packets tier must be absent (${tiersNoK} tiers)`, 'no packet count, no packets tier')
   ok(/class="[^"]*funnel-mine/.test(page), 'the reader\'s own count (.funnel-mine) is missing from the triangle')
   // two-sided: a step is subtracted where the sets nest, and only there

internal/check-packet-render.mjs

@@ -117,8 +117,11 @@ const layout = await page.evaluate(() => {
     const tb = rng.getBoundingClientRect()
     if (tb.width < 20 || box.width < 50 || box.width - tb.width < 12) continue
     if (cs.direction === 'rtl') out.rtlComputed += 1
-    if (Math.round(box.right - tb.right) <= 1) out.pinnedRight += 1
-    else if (Math.round(tb.left - box.left) <= 1) out.pinnedLeft += 1
+    // Against the CONTENT box: a padded table cell (the pace table's) starts its run at its padding, which is
+    // still the left (or right) edge the direction pins it to.
+    const pl = parseFloat(cs.paddingLeft) || 0, pr = parseFloat(cs.paddingRight) || 0
+    if (Math.round(box.right - pr - tb.right) <= 1) out.pinnedRight += 1
+    else if (Math.round(tb.left - box.left - pl) <= 1) out.pinnedLeft += 1
     out.sampled += 1
     if (out.sampled >= 25) break
   }
@@ -181,6 +184,24 @@ const scriptureIsEnglish = lang !== 'en'
   && !(catalog[lang] || {}).point4_passage
 await page.evaluate((words) => { window.__EXPECTED_RHYTHMS = words }, expected)
 
+// The life grid's decoder: every square subpath (M x y …) of an .lc-svg back to its box index, from the geometry
+// the SVG declares. Used by the life-calendar checks below.
+await page.evaluate(() => {
+  window.__lcBoxes = (svg) => {
+    // data-geom x0,y0,px,dec[,py]: the box pitch across and down (one pitch when py is absent).
+    const [x0, y0, px, dec, py = px] = String(svg.dataset.geom || '').split(',').map(Number)
+    const weeks = Number(svg.dataset.weeks)
+    const idx = (d) => [...String(d || '').matchAll(/M([\d.]+) ([\d.]+)/g)].map((m) => {
+      const x = Number(m[1]) - 0.5 - x0, y = Number(m[2]) - 0.5 - y0
+      const b = Math.floor(y / (10 * py + dec))
+      return (b * 10 + Math.round((y - b * (10 * py + dec)) / py)) * weeks + Math.round(x / px)
+    })
+    const off = idx((svg.querySelector('path.lc-off') || {}).getAttribute?.('d'))
+    const sh = svg.querySelector('path.lc-on, path.lc-reached')
+    const shaded = sh ? idx(sh.getAttribute('d')).sort((a, b) => a - b) : []
+    return { total: off.length + shaded.length, shaded, distinct: new Set([...off, ...shaded]).size }
+  }
+})
 const r = await page.evaluate(() => {
   const body = document.body.innerText
   const imgs = [...document.querySelectorAll('.card img, img.ws-ph')]   // profile cards, or lightweight rows (2026-09-30)
@@ -250,27 +271,43 @@ const r = await page.evaluate(() => {
     // stays exact whether or not the caller supplied set data.
     setsSheets: document.querySelectorAll('.sheet-sets').length,
     christianSheets: document.querySelectorAll('.sheet-christian').length,
-    lifeCells: document.querySelectorAll('.lc-frame .lc-c').length,
+    // ★ THE LIFE GRIDS ARE ONE SVG EACH (2026-10-02): two paths of square subpaths (empty and shaded) placed by
+    // the geometry the SVG states (data-geom x0,y0,px,decadeGap,py). Each subpath is decoded back to its box index
+    // in reading order, so the checks below still see box by box what is drawn, not a count the renderer asserts.
+    lifeCells: [...document.querySelectorAll('.lc-frame .lc-svg')].reduce((a, g) => a + window.__lcBoxes(g).total, 0),
     prayBoxes: document.querySelectorAll('.pray-box').length,
+    fdTopOver: (() => { const b = document.querySelector('.fd-top'); if (!b) return 0; const top = b.getBoundingClientRect().top
+      return Math.round(Math.max(0, ...[...b.children].map((k) => k.getBoundingClientRect().bottom + parseFloat(getComputedStyle(k).marginBottom))) - top - b.clientHeight) })(),
+    // The points page is ONE sheet by design and fits only because its sizes were tuned to the longest locale;
+    // measure its content against its box (studio's ask), as fdTopOver does for the list's first page.
+    // Each points sheet's body is measured, the worst one reported (one sheet today).
+    pointsOver: (() => { const bs = [...document.querySelectorAll('.points-body')]; if (!bs.length) return null
+      return Math.max(...bs.map((b) => { const top = b.getBoundingClientRect().top
+        return Math.round(Math.max(b.scrollHeight - b.clientHeight, ...[...b.children].map((k) => k.getBoundingClientRect().bottom - top - b.clientHeight))) })) })(),
+    pointsSheets: document.querySelectorAll('.sheet-points').length,
+    // ★ THE POINTS PAGE SIZES ITSELF FROM AN ESTIMATE (2026-10-03, data-pt-est): the page must never be taller
+    // than the estimate it was sized by, or the estimate is drifting and only its 3% margin still saves the page.
+    pointsUnder: (() => { const b = document.querySelector('.points-body[data-pt-est]'); if (!b) return null
+      const top = b.getBoundingClientRect().top, kids = [...b.children]
+      const real = Math.max(...kids.map((k) => k.getBoundingClientRect().bottom - top)) + parseFloat(getComputedStyle(kids[kids.length - 1]).marginBottom)
+      return { real: Math.round(real), est: Number(b.dataset.ptEst), tier: Number(b.dataset.ptTier) } })(),
     funnelTip: document.querySelectorAll('.funnel-tip').length,
-    lifeShaded: document.querySelectorAll('.lc-frame .lc-reached').length,
+    lifeShaded: (() => { const g = document.querySelector('.sheet-christian .lc-svg'); return g ? window.__lcBoxes(g).shaded.length : null })(),
     // ★ FILLED FROM THE TOP, in reading order (the packet's design), measured on the DOM order of the cells:
     // the shaded boxes must be EXACTLY the first N. This used to require a SCATTER, the opposite design;
     // a count alone still cannot tell a top fill from a scatter or a fill from the bottom.
     lifeTopFill: (() => {
-      const grid = document.querySelector('.sheet-christian .lc-frame')
-      if (!grid) return null
-      const cells = [...grid.querySelectorAll('.lc-c')]
-      const n = cells.filter((c) => c.classList.contains('lc-reached')).length
-      return cells.slice(0, n).every((c) => c.classList.contains('lc-reached'))
+      const g = document.querySelector('.sheet-christian .lc-svg')
+      if (!g) return null
+      const s = window.__lcBoxes(g).shaded
+      return s.every((v, i) => v === i)
     })(),
     // The life page: Jesus' 33 years, the first 33 x 52 = 1,716 boxes and no others.
     jesusTopFill: (() => {
-      const grid = document.querySelector('.sheet-life .lc-frame')
-      if (!grid) return null
-      const cells = [...grid.querySelectorAll('.lc-c')]
-      const on = cells.filter((c) => c.classList.contains('lc-on')).length
-      return { on, top: cells.slice(0, on).every((c) => c.classList.contains('lc-on')) }
+      const g = document.querySelector('.sheet-life .lc-svg')
+      if (!g) return null
+      const s = window.__lcBoxes(g).shaded
+      return { on: s.length, top: s.every((v, i) => v === i) }
     })(),
     funnelEq: document.querySelectorAll('.funnel-eq').length,
     funnelSteps: document.querySelectorAll('.funnel-mine').length,
@@ -368,7 +405,15 @@ const r = await page.evaluate(() => {
       .filter((e) => { const r = e.getBoundingClientRect(); return r.width < 4 || r.height < 4 }).length,
     rhythms: RHYTHMS.filter((w) => body.includes(w)).length,
     rhythmsTotal: RHYTHMS.length,
-    wheelSegs: document.querySelectorAll('svg path[fill^="hsl"]').length,
+    // The segments are the wheel sheet's filled ARC paths (M centre L rim A …), whatever their colour notation:
+    // counting fill^="hsl" read 0 once the wheel took the source's hex palette, and the gate went red on every
+    // packet while the wheel was fine. The "Start here" arrow is a path too, but unfilled and arc-less.
+    wheelSegs: (() => {
+      const title = document.querySelector('.wheel-title')
+      const svg = title ? title.closest('.sheet')?.querySelector('svg') : null
+      return svg ? [...svg.querySelectorAll('path')].filter((p) => / A /.test(p.getAttribute('d') || '')
+        && (p.getAttribute('fill') || 'none') !== 'none').length : 0
+    })(),
     // ⚠ COUNT THE WHEEL'S OWN LABELS, SCOPED TO THE WHEEL SHEET. `rhythms` below
     // searches document.body.innerText, and the SAME rhythm vocabulary is rendered
     // TWICE — once per wheel segment, and once per prayer point (each point prints
@@ -389,11 +434,11 @@ const r = await page.evaluate(() => {
       const sheet = title ? title.closest('.sheet') : null
       const svg = sheet ? sheet.querySelector('svg') : null
       if (!svg) return -1
-      // The segment labels are the non-numeric <text> runs: the pips are all "5" and
-      // the footer reads "5 <minutes> x 12".
-      return [...svg.querySelectorAll('text')]
-        .map((t) => (t.textContent || '').trim())
-        .filter((s) => s && !/^\d+$/.test(s) && !/^\d[\s\S]*×\s*12$/.test(s)).length
+      // The segment labels are the wheel's own label runs (class="wheel-label", packet-render wheelPage), counted
+      // when they carry words. Counting every non-numeric <text> read 25 once each rim badge gained its
+      // "minutes" tag and the wheel its "Start here": those are furniture, not segment labels.
+      return [...svg.querySelectorAll('text.wheel-label')]
+        .filter((t) => (t.textContent || '').trim()).length
     })(),
     // ⚠ NOT body.includes('Gadarenes'). That was an ENGLISH proper noun, so this
     // assertion would go RED on a correctly-translated packet and stays green today
@@ -419,6 +464,10 @@ const r = await page.evaluate(() => {
       if (!title) return -1
       const host = title.parentElement?.parentElement
       if (!host) return -1
+      // Each point's heading carries class="pt-h": a numbered LINE is not a point. German cites "1. Petrus 5:6–11"
+      // (its own name for 1 Peter), and that reference line was counted as a thirteenth point.
+      const heads = document.querySelectorAll('.pt-h')
+      if (heads.length) return heads.length
       return (host.innerText || '').split('\n').filter((l) => /^\s*\d{1,2}\.\s/.test(l)).length
     })(),
     metacamp: (body.match(/metacamp\.org/g) || []).length,
@@ -470,7 +519,7 @@ const pdfBytes = pdf.length
 const fails = []
 if (!r.sheets) fails.push('no .sheet elements — the packet did not render')
 if (!r.cards && !r.wsRows) fails.push('no people-group cards or worksheet rows — a packet of nobody')
-if (r.wsRows && r.wsBoxes !== r.wsRows * 3) fails.push(`${r.wsRows} worksheet rows should carry ${r.wsRows * 3} tick boxes but the packet has ${r.wsBoxes}`)
+if (r.wsRows && r.wsBoxes !== r.wsRows * 3) fails.push(`${r.wsRows} worksheet rows should carry ${r.wsRows * 3} tally cells but the packet has ${r.wsBoxes}`)
 if (r.cardsBlank) {
   fails.push(`${r.cardsBlank} of ${r.cards} people-group card(s) have no NAME — a card that `
     + 'names nobody is a slot on the page, not an entry in a prayer list. The counts above cannot '
@@ -722,19 +771,31 @@ if (!boxes.length) {
 // sheets — a 100-year life in weeks, then the SAME grid shaded by the evangelical share of these
 // groups' population — so they are DETECTED and added as known terms for exactly the reason the
 // funnel was, and for the reason stated above: a tolerance here would hide a dropped list page.
-const PER_PAGE = 20
+// THE PAGE SIZES ARE THE RENDERER'S, read from it rather than retyped: the first list page of each packet
+// gives rows to the explanation band (2026-10-02), so a typed number drifted the moment the band changed.
+const { createPacketRenderer: makeR } = await import(resolve(dirname(fileURLToPath(import.meta.url)), '../library/packet/packet-render.js'))
+const RR = makeR({ strings: catalog, lang: 'en' })
+const PER_PAGE = RR.PER_PAGE
 const funnelSheets = r.funnel ? 1 : 0
 const lifeSheets = (r.lifeSheets || 0) + (r.christianSheets || 0)
 // ⚠ AND THE SETS PAGES (bounded, centered): back matter, DETECTED for the same reason as the rest.
 // Before they were counted the arithmetic only held when a fixture omitted set data.
 const setsSheets = r.setsSheets || 0
-// The worksheet paginates 16 rows on its first page and 18 after (packet-render WS_FIRST / WS_REST; 20 and 24
-// before its rows gained a photo and a description, 2026-09-30).
-const wsPages = (n) => (n <= 0 ? 0 : 1 + Math.ceil(Math.max(0, n - 16) / 18))
-const listSheets = r.cards ? Math.ceil(r.cards / PER_PAGE) : wsPages(r.wsRows)
+// Both lists give their first page to the explanation band: the worksheet holds WS_FIRST rows there and
+// WS_REST after; the profile pages FD_FIRST, then PER_PAGE.
+const wsPages = (n) => (n <= 0 ? 0 : 1 + Math.ceil(Math.max(0, n - RR.WS_FIRST) / RR.WS_REST))
+const fdPages = (n) => (n <= 0 ? 0 : 1 + Math.ceil(Math.max(0, n - RR.FD_FIRST) / PER_PAGE))
+const listSheets = r.cards ? fdPages(r.cards) : wsPages(r.wsRows)
+// The Full detail's first page reserves a block for the explanation and CLIPS what outgrows it (rather than
+// let it overlap the rows): only a measurement sees a clipped line, so measure it.
+if (r.pointsOver !== null && r.pointsOver > 0) fails.push(`the prayer-points page outgrows its sheet by ${r.pointsOver}px — the twelve points and the themes must fit ONE page in every language`)
+if (r.pointsUnder && r.pointsUnder.real > r.pointsUnder.est) fails.push(`the prayer-points page is ${r.pointsUnder.real}px tall, over the ${r.pointsUnder.est}px its size tier ${r.pointsUnder.tier} was chosen by — the estimate (packet-render pointsHeight) under-measures this language`)
+if (r.fdTopOver > 0) fails.push(`the Full detail's explanation block outgrows its reserved height by ${r.fdTopOver}px — text is clipped (raise FD_TOP_H)`)
 if (r.wsRows && r.wsSheets !== wsPages(r.wsRows)) fails.push(`${r.wsRows} worksheet rows should take ${wsPages(r.wsRows)} page(s) but the packet has ${r.wsSheets}`)
 // + 2 again (2026-09-30, the second revision): point 4's Mark 5:18-20 and the Father's-heart list are back ON the
 // points page, so the back matter is the wheel and the points.
+// + 2: the wheel and the points, the twelve points and the themes on ONE sheet (2026-10-02, at the demo).
+if (r.pointsSheets !== 1) fails.push(`the twelve prayer points and the themes should fit ONE sheet, found ${r.pointsSheets}`)
 const expectedSheets = 1 + lifeSheets + funnelSheets + listSheets + setsSheets + 2
 // ── THE LIFE-CALENDAR PAGES, asserted rather than merely counted ──────────────────────────────────
 // A page that EXISTS is not a page that is RIGHT: an empty grid, a grid of the wrong size, or a
@@ -771,10 +832,10 @@ if (r.christianSheets) {
       + `reached and 5200 would claim everybody is; both mean the percentage did not arrive`)
   }
 }
-// The three prayer columns: one tick box per group per question, so the count is exactly 3 x cards.
+// The three prayer columns: one tally cell per group per question, so the count is exactly 3 x cards.
 if (r.cards && r.prayBoxes !== r.cards * 3) {
-  fails.push(`${r.cards} people cards should carry ${r.cards * 3} prayer tick boxes `
-    + `(blessed / what to know / what to do) but the packet has ${r.prayBoxes}`)
+  fails.push(`${r.cards} people cards should carry ${r.cards * 3} prayer tally cells `
+    + `(did I bless them / what do you want me to know / what do you want me to do) but the packet has ${r.prayBoxes}`)
 }
 if (r.cards && r.sheets !== expectedSheets) {
   fails.push(`${r.cards} people cards should lay out as ${expectedSheets} sheets `
@@ -824,6 +885,8 @@ if (r.funnel && r.funnelRows !== r.funnelBars) {
 // an allowlist entry added BEFORE translating would have hidden fifteen untranslated strings.
 // 'UPG' is the same product name as renamed, "UPG 100" with a space: the digits break the run, so it
 // surfaces as 'UPG' (page 2's kicker and packets tier). Settled, like 'UPG-' — a name, not prose.
+// The series is now written as ONE term, "UPG100" (2026-10-02): the digits still break the run, so it too
+// surfaces as 'UPG'.
 const LATIN_OK = new Set(['IMB', 'peoplegroups.org', 'Project', 'UPG-', 'UPG'])
 const NON_LATIN_LOCALES = new Set(['hi', 'ar', 'ru', 'zh', 'he', 'fa', 'ur', 'bn', 'ta', 'th', 'ko', 'ja'])
 if (r.funnel && NON_LATIN_LOCALES.has(String(lang).split('-')[0])) {
@@ -907,6 +970,7 @@ console.log(`  funnel (page 2)  : ${r.funnel
   ? `${r.funnelRows} row(s), ${r.funnelBars} bar(s)${r.funnelShare ? ` — "${r.funnelShare}"` : ' — no share line'}`
   : 'absent' + (EXPECT_FUNNEL ? ' (REQUIRED — see FAIL above)' : ' (not required)')}`)
 console.log(`  prayer points    : ${r.points} / ${POINTS_EXPECT}`)
+if (r.pointsUnder) console.log(`  points size tier : ${r.pointsUnder.tier} (estimated ${r.pointsUnder.est}px, measured ${r.pointsUnder.real}px)`)
 console.log(`  wheel segments   : ${r.wheelSegs}  (${r.wheelLabels}/${WHEEL_LABELS} labelled)`)
 console.log(`  point 4         : Mark 5:18-20 ${r.mark5Len} chars, verse 19 bold ${r.v19Len} chars, ${r.heartItems} readings`)
 console.log(`  metacamp.org     : ${r.metacamp}`)

internal/check-packet-strings-parity.mjs

@@ -56,6 +56,10 @@ const DECLARED_ABSENT = {
   point4_passage: 'Mark 5:1-20 — awaiting a CITED public-domain translation for hi/zh/pt/it/ro',
   point4_passage_credit: 'the attribution line for the passage above',
   point4_passage_bold: 'verse 19, verbatim from the passage above (so only where that passage is on file)',
+  // Numbers 6:24-26 on the lightweight list's first page: ro and hi have no strict public-domain text on the
+  // pipeline that vetted the other nine, so they print the English per key rather than an unvetted rendering.
+  blessing_text: 'Numbers 6:24-26 — no strict public-domain text for ro (only a Cyrillic-script 1924) or hi',
+  blessing_credit: 'the attribution line for the blessing above',
   // ── The new packet pages, 2026-09-27: a 100-year life calendar, the same grid shaded by
   // the evangelical share of these groups' population, and the funnel's equation sidebar + tip.
   // ENGLISH-ONLY ON PURPOSE, and declared rather than back-filled: English text copied into ten
@@ -121,6 +125,38 @@ for (const loc of locales) {
   }
 }
 
+// ── SCRIPTURE ADDRESSES ARE ENGLISH'S, AND THE THEMES ARE WHOLE ───────────────────
+// A point's refs are canonical addresses: a language may not keep an older set (point 12 kept Acts 2 / Matthew 28
+// in ten languages after English moved to John 17). The prayer themes are seven and the scenes three in every
+// language, or the page falls back to English for the whole list.
+for (const loc of locales) {
+  const b = cat[loc]
+  ;(b.points || []).forEach((pt, i) => {
+    if (pt && pt.refs !== undefined && JSON.stringify(pt.refs) !== JSON.stringify((en.points[i] || {}).refs)) {
+      fails.push(`${loc} point ${i + 1} carries references ${JSON.stringify(pt.refs)}, not English's ${JSON.stringify((en.points[i] || {}).refs)}`)
+    }
+  })
+  if (!Array.isArray(b.themes) || b.themes.length !== 7 || b.themes.some((x) => typeof x !== 'string' || !x.trim())) fails.push(`${loc} needs 7 prayer themes`)
+  if (!Array.isArray(b.scenes) || b.scenes.length !== 3 || b.scenes.some((x) => typeof x !== 'string' || !x.trim())) fails.push(`${loc} needs 3 prayer scenes`)
+}
+if (!Array.isArray(en.scene_refs) || en.scene_refs.length !== 3 || en.scene_refs.some((r) => !Array.isArray(r) || r.length !== 2)) fails.push('en scene_refs must give each of the 3 scenes two references')
+
+// ── ARABIC: NO ALEF WASLA (U+0671) ─────────────────────────────────────────────
+// The Van Dyck texts write the article with alef wasla (ٱ). A device whose fonts lack U+0671 printed it as a
+// BOX, three times in the blessing and eight in Mark 5. The stored ar text uses plain alef (U+0627), the
+// ordinary print form: display only, no word or vowel changes (_meta.note_on_blessing). Asserted on EVERY ar
+// value, nested ones included, so the next passage pasted from the same source cannot bring it back.
+{
+  const hits = []
+  const walk = (v, path) => {
+    if (typeof v === 'string') { const n = [...v].filter((ch) => ch === '\u0671').length; if (n) hits.push(`${path} (${n})`) }
+    else if (v && typeof v === 'object') for (const [k, x] of Object.entries(v)) walk(x, `${path}.${k}`)
+  }
+  walk(cat.ar || {}, 'ar')
+  if (hits.length) fails.push(`ar carries U+0671 alef wasla, which prints as a box where a font lacks it — store plain alef (U+0627): ${hits.slice(0, 4).join(', ')}`)
+  else notes.push('ar: no U+0671 alef wasla in any value (plain alef, the print form every Arabic font draws)')
+}
+
 console.log('PACKET-STRINGS-PARITY')
 console.log(`  catalog : ${CATALOG.replace(REPO + '/', '')}`)
 console.log(`  locales : ${locales.length} (${locales.join(' ')})`)

internal/check-packet-variants.mjs

@@ -18,7 +18,9 @@ import { readFileSync } from 'node:fs'
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const read = (p) => readFileSync(resolve(ROOT, p), 'utf8')
-const WALL = read('library/components/poster/PosterWall.vue')
+// The wall's cards are drawn by PosterSection.vue (lifted out of PosterWall.vue, which provides it the shared state),
+// so the print-row markup this gate reads lives in BOTH files: read them as one wall.
+const WALL = read('library/components/poster/PosterWall.vue') + '\n' + read('library/components/poster/PosterSection.vue')
 const PRINTS = read('library/composables/usePosterPrints.js')
 const EN = JSON.parse(read('library/i18n/locales/en/buttons.json'))
 
@@ -95,7 +97,7 @@ ok(count(light, /sheet-sets-(bounded|centered)/g) === 0, 'lightweight still carr
 // ⚠ THE DELTA IS DERIVED, never relaxed into a range: lightweight drops four back pages (life, % grid,
 // bounded, centered) AND lists the same people as a worksheet, whose pages hold more rows than profiles.
 {
-  const profilePages = Math.ceil(45 / R.PER_PAGE)
+  const profilePages = 1 + Math.ceil(Math.max(0, 45 - R.FD_FIRST) / R.PER_PAGE)
   const worksheetPages = count(light, /<div class="sheet sheet-worksheet/g)
   const want = 4 + profilePages - worksheetPages
   ok(worksheetPages >= 1 && count(light, /class="ws-row"/g) === 45, `the lightweight worksheet should list all 45 groups, got ${count(light, /class="ws-row"/g)}`)
@@ -114,27 +116,95 @@ ok(count(light, /sheet-sets-(bounded|centered)/g) === 0, 'lightweight still carr
     `each lightweight row should carry ONE photo cell (${pics.size} photos + ${45 - pics.size} "no photo"), got ${imgs} + ${none} in ${rows} rows`)
   ok(count(lw, /class="ws-desc"/g) === 45, `each lightweight row should carry its group's description, got ${count(lw, /class="ws-desc"/g)} of 45`)
 }
+// ★ BOTH LISTS EXPLAIN THEMSELVES FIRST (2026-10-02, v2): the first list page of EACH packet carries, before any
+// row, the blessing in full with its credit, ONE line of further references, the wheel pointer, and ONE band
+// (class="xb"): a five-pace table whose loads are COMPUTED from the list (45 groups: all 45 a day, 6 at a
+// weekly pace), what the three columns ask, and an example row of three tally cells under the table's own
+// question heads. The question heads stand ONCE per page over the tally cells, never per group.
+for (const [name, html, rowRe, cellRe, headRe, pageRe] of [
+  ['lightweight', light, /class="ws-row"/g, /class="ws-box"/g, /class="ws-head"/g, /<div class="sheet sheet-worksheet/g],
+  ['full', full, /class="card"/g, /class="pray-box"/g, /class="pray-head"/g, /<div class="hd">/g],
+]) {
+  const E = strings.en
+  const band = html.indexOf('<section class="xb"')
+  ok(count(html, /<section class="xb"/g) === 1 && band > 0 && band < html.search(rowRe),
+    `the ${name} list should explain itself ONCE, on its first list page, before the first row`)
+  ok(html.includes(E.blessing_text.replace(/&/g, '&amp;')) && html.includes(E.blessing_credit), `the ${name} list should print the blessing (Numbers 6:24-26) with its credit`)
+  ok(count(html, /class="ws-refs"/g) === 1 && count(html, /Psalm 134:3/g) === 1, `the ${name} list should carry ONE line of blessing references`)
+  ok(html.includes(E.howto_wheel), `the ${name} list should point to the prayer wheel at the end of the packet`)
+  const pace = (html.match(/<table class="ws-pace-t">([\s\S]*?)<\/table>/) || [])[1] || ''
+  ok(count(pace, /<tr/g) === 5 && pace.includes('all 45, every day') && pace.includes('about 6 a day') && count(pace, /ws-pace-best/g) === 1,
+    `the ${name} pace table should show five paces, daily = all 45 and weekly = about 6 a day (from the list size), weekly marked: ${pace.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 160)}`)
+  ok(count(html, /class="xb-cell /g) === 3 && count(html, /class="xb-marks"/g) === 3, `the ${name} band's example should be ONE row of three tally cells with marks`)
+  ok(count(html, rowRe) === 45 && count(html, cellRe) === 45 * 3, `every ${name} row should carry three tally cells, got ${count(html, cellRe)} for ${count(html, rowRe)} rows`)
+  ok(count(html, headRe) === count(html, pageRe), `the ${name} question heads should stand once per list page: ${count(html, headRe)} heads on ${count(html, pageRe)} pages`)
+}
+ok(!/no pace to keep/.test(light), 'the lightweight list should no longer say there is no pace to keep')
+// ★ THE PRAYER THEMES HEAD THE POINTS PAGE (2026-10-02): seven themes, then three scenes with two references
+// each, in both packets; point 12 is John 17 (its references are John 17:3, John 17:11–23, Ephesians 3:20).
+for (const [name, html] of [['lightweight', light], ['full', full]]) {
+  const th = (html.match(/<div class="pt-themes">([\s\S]*?)<\/div>\s*<div style="margin-bottom/) || [])[1] || ''
+  const themes = count(th.split('pt-sc-list')[0] || '', /<li>/g), scenes = count(th.split('pt-sc-list')[1] || '', /<li>/g)
+  ok(themes === 7 && scenes === 3 && count(th, /class="pt-sc-r"/g) === 3 && /Haggai 2:7/.test(th) && /Matthew 8:26/.test(th),
+    `the ${name} points page should open with 7 themes and 3 scenes (2 references each): ${themes} themes, ${scenes} scenes`)
+  ok(/John 17:3/.test(html) && /Ephesians 3:20/.test(html) && !/Acts 2:42/.test(html), `the ${name} point 12 should be John 17 (John 17:3 · John 17:11–23 · Ephesians 3:20)`)
+}
+ok(!/<em>[^<]*<\/em><\/span>/.test(full.slice(full.indexOf('class="card"'))), 'the full packet repeats a question under each tally cell; the heads stand once per page')
 // ★ THE LIFE CALENDAR, HEADLESS — the grid's CONTENT, not just its page. An adversarial review mutated the
 // renderer to shade the LAST 33 years, to shade nothing, and to draw 90 rows; every packet gate stayed green
 // because none looked inside the grid. Read the cells of each frame, in order (the legend's sample boxes
 // sit outside the frame and are excluded):
 {
-  const frame = (html, cls) => {
+  // The grid is ONE SVG per page (packet-render lifeGrid): decode each square subpath back to its box index
+  // from the geometry the SVG declares, so the check reads the boxes as drawn, in reading order.
+  const grid = (html, cls) => {
     const i = html.indexOf(`<div class="sheet ${cls}`)
-    // By class PREFIX: the knows-Christ grid is `lc-frame lc-plain` (drawn without week/year axes).
-    const a = html.indexOf('<div class="lc-frame', i)
-    return a < 0 ? '' : html.slice(a, html.indexOf('<div class="lc-legend">', a))
+    const a = html.indexOf('<svg class="lc-svg"', i)
+    return a < 0 || i < 0 ? '' : html.slice(a, html.indexOf('</svg>', a))
   }
-  const cells = (h) => [...h.matchAll(/<i class="lc-c( lc-on| lc-reached)?"><\/i>/g)].map((m) => (m[1] || '').trim())
-  const life = cells(frame(full, 'sheet-life'))
-  ok(life.length === 5200, `the life calendar should hold 100 x 52 = 5,200 boxes, got ${life.length}`)
-  const gold = life.filter((c) => c === 'lc-on').length
-  ok(gold === 33 * 52 && life.slice(0, gold).every((c) => c === 'lc-on'),
-    `the life calendar should shade Jesus' 33 years as its FIRST 1,716 boxes — got ${gold}, from the top: ${life.slice(0, gold).every((c) => c === 'lc-on')}`)
-  const ev = cells(frame(full, 'sheet-christian'))
-  const shaded = ev.filter((c) => c === 'lc-reached').length
-  ok(ev.length === 5200 && shaded === Math.round(0.032 * 5200) && ev.slice(0, shaded).every((c) => c === 'lc-reached'),
-    `the %-evangelical grid should shade 3.2% = ${Math.round(0.032 * 5200)} boxes FROM THE TOP, got ${shaded} of ${ev.length}`)
+  const boxes = (svg) => {
+    // data-geom x0,y0,px,dec[,py]: the box pitch across and down (one pitch when py is absent).
+    const [x0, y0, px, dec, py = px] = ((svg.match(/data-geom="([^"]+)"/) || [])[1] || '').split(',').map(Number)
+    const weeks = Number((svg.match(/data-weeks="(\d+)"/) || [])[1])
+    const idx = (d) => [...String(d || '').matchAll(/M([\d.]+) ([\d.]+)/g)].map((m) => {
+      const x = Number(m[1]) - 0.5 - x0, y = Number(m[2]) - 0.5 - y0, b = Math.floor(y / (10 * py + dec))
+      return (b * 10 + Math.round((y - b * (10 * py + dec)) / py)) * weeks + Math.round(x / px)
+    })
+    const off = idx((svg.match(/<path class="lc-off" d="([^"]*)"/) || [])[1])
+    const on = idx((svg.match(/<path class="lc-(?:on|reached)" d="([^"]*)"/) || [])[1]).sort((a, b) => a - b)
+    return { total: off.length + on.length, distinct: new Set([...off, ...on]).size, on }
+  }
+  const life = boxes(grid(full, 'sheet-life'))
+  ok(life.total === 5200 && life.distinct === 5200, `the life calendar should hold 100 x 52 = 5,200 distinct boxes, got ${life.total} (${life.distinct} distinct)`)
+  ok(life.on.length === 33 * 52 && life.on.every((v, i) => v === i),
+    `the life calendar should shade Jesus' 33 years as its FIRST 1,716 boxes — got ${life.on.length}, from the top: ${life.on.every((v, i) => v === i)}`)
+  const ev = boxes(grid(full, 'sheet-christian'))
+  ok(ev.total === 5200 && ev.on.length === Math.round(0.032 * 5200) && ev.on.every((v, i) => v === i),
+    `the %-evangelical grid should shade 3.2% = ${Math.round(0.032 * 5200)} boxes FROM THE TOP, got ${ev.on.length} of ${ev.total}`)
+  // THE SAME TABLE: the people grid has the life grid's exact shape (one aspect ratio for both pages).
+  const vb = (svg) => (svg.match(/viewBox="([^"]+)"/) || [])[1]
+  ok(vb(grid(full, 'sheet-life')) && vb(grid(full, 'sheet-life')) === vb(grid(full, 'sheet-christian')), 'the people grid should have the life grid\'s exact shape')
+}
+
+// ★ THE POINTS PAGE FITS ITSELF (2026-10-03): per language it takes the LARGEST size tier whose estimate fits
+// one sheet, from the one-sheet sizes up to the two-sheet sizes before them (the cap). Asserted both ways: the
+// tier chosen is the largest that fits, and SHORTER words print LARGER (halving the English points raises
+// the English tier) while the real words keep theirs. check:packet-render holds the estimate to the real page.
+{
+  for (const lang of ['en', 'ar', 'zh', 'fr']) {
+    const R = createPacketRenderer({ strings, lang })
+    const f = R.pointsFit, k = f.chosen(), budget = f.bodyH * f.safe
+    ok(k === f.tiers || f.height(k + 1) > budget, `${lang}: points tier ${k} is not the largest that fits (tier ${k + 1} estimates ${Math.round(f.height(k + 1))}px of ${Math.round(budget)})`)
+    ok(k === 0 || f.height(k) <= budget, `${lang}: points tier ${k} estimates ${Math.round(f.height(k))}px, over the ${Math.round(budget)}px budget`)
+    ok(R.pointsPage().includes(`data-pt-tier="${k}"`), `${lang}: the points page does not print at the tier it chose (${k})`)
+  }
+  const top = (lang, s) => createPacketRenderer({ strings: s, lang }).pointsFit
+  const short = JSON.parse(JSON.stringify(strings))
+  short.en.points = short.en.points.map((p) => ({ ...p, text: p.text.slice(0, Math.ceil(p.text.length / 2)) }))
+  const k0 = top('en', strings).chosen(), k1 = top('en', short).chosen()
+  ok(k1 > k0, `halving the English points' text should raise the English points tier, got ${k0} -> ${k1}`)
+  // the cap is the two-sheet sizes: the largest tier prints the point text at 22.5px
+  ok(/font:400 22\.5px Georgia/.test(createPacketRenderer({ strings, lang: 'en' }).pointsPage(top('en', strings).tiers)), 'the largest points tier should print the text at 22.5px (the two-sheet size, the cap)')
 }
 
 // ★ UNKNOWN POINTS ARE STATED EVEN THOUGH THEY CANNOT BE PLOTTED. layoutBoundedSet gives them no
@@ -147,6 +217,22 @@ ok(count(light, /sheet-sets-(bounded|centered)/g) === 0, 'lightweight still carr
   ok(/10/.test(caps.join(' ')), 'the bounded tally does not state its unknown count — an un-inked category reads as zero in print')
 }
 
+// ★ EVERY GROUP OF THE LIST IS COUNTED (2026-10-03): a group with no record in a figure's data is named in
+// that figure's caption ("15 without data"), so each caption's parts add up to the list. Both ways: the
+// fixture's figures lack records (45 groups; 30 bounded, 24 centered), and complete data prints no such part.
+{
+  const sum = (cap) => [...cap.matchAll(/\d[\d,]*/g)].reduce((a, m) => a + Number(m[0].replace(/,/g, '')), 0)
+  const capsOf = (html) => [...html.matchAll(/class="set-cap">([^<]*)</g)].map((m) => m[1])
+  const nd = String(strings.en.sets_no_data).replace('{n}', '').trim()
+  const short = capsOf(full)
+  ok(short.length === 2 && short.every((c) => sum(c) === 45 && c.includes(nd)),
+    `each set caption should add up to the list's 45 groups, naming the ones ${nd}: ${short.join(' | ')}`)
+  const whole = capsOf(R.buildPacket(zone, groups, new Map(), '<svg/>', funnel, christian, 'full', {
+    bounded: groups.map((g, i) => ({ id: g.slug, reached: i % 2 === 0 })), centered: groups.map((g, i) => ({ id: g.slug, ring: (i % 10) + 1 })) }))
+  ok(whole.length === 2 && whole.every((c) => sum(c) === 45 && !c.includes(nd)),
+    `with a record for every group, each caption should add up to 45 and name none ${nd}: ${whole.join(' | ')}`)
+}
+
 // ── THE RING LEGEND: THE AGREED VOCABULARY, AND ONLY THE RINGS THAT HOLD SOMEONE ────────────────
 // ★ The names are COMPOSED from band x culture rather than a flat 1..10 table, because "same
 // people" (provisional, pending a product decision) appears in rings 1, 4 AND 7 — three cells that a

internal/check-pg-name-gate.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+// check-pg-name-gate — a people group's localized name is shown only when it is a transliteration, never a word
+// that a machine translated (Balantak → "Balance", Balo → "Sac à dos"). The rule lives in ONE place,
+// library/utils/peopleGroupName.js; this gate holds it there and proves it on the REAL table. Headless. Asserts:
+//   A. the table loads (data/pplr/pg-names.json, the file the tree serves as assets/pplr/pg-names.json);
+//   B. REAL ROWS: Balantak, Balo, Abaga and Abai Sungai (translated as words) show English in every locale;
+//      Balangao Bontoc (a transliteration) shows its own names; it and ro, which have no column, show English;
+//   C. TWO-SIDED on planted rows, AT the threshold: EXACTLY two far Latin locales falls back, one is kept (the rule
+//      is "two or more"); a row with only one Latin name to check is not trusted (no evidence → English);
+//   D. the whole table falls back between 30% and 45% (measured 38.2%, 8,172 of 21,419). A similarity that
+//      always says "same" (0%) or always "different" (100%) fails here even if B and C were tuned around;
+//   E. THE ONE-READER RULE: a file in library/ or plugin-designs/ that names pg-names must take its names through
+//      peopleGroupName.js, and must not index its rows itself (`.names[`) even when it imports the helper.
+//      pplr-data-maps is the carded exception (its coverage views read raw rows on purpose). NEGATIVE CONTROLS: a
+//      planted raw reader, and a planted file that imports the helper AND indexes rows, must both be caught.
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { resolve, dirname, join, relative } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const P = (...a) => join(REPO, ...a)
+const fails = [], notes = []
+const ok = (cond, msg, note) => { if (!cond) fails.push(msg); else if (note) notes.push(`  ok    ${note}`) }
+
+let H, table
+try {
+  H = await import(pathToFileURL(P('library/utils/peopleGroupName.js')).href)
+  table = JSON.parse(readFileSync(P('data/pplr/pg-names.json'), 'utf8'))
+} catch (e) {
+  console.error(`PG-NAME-GATE: NOT MEASURED (exit 75) — an input did not load: ${e.message}`)
+  process.exit(75)
+}
+const { locales, names } = table
+const name = (code, lang) => H.peopleGroupName(names[code], locales, lang)
+
+// ── A ──
+ok(Array.isArray(locales) && locales.includes('en') && Object.keys(names).length > 20000,
+  `the table has ${Object.keys(names || {}).length} rows and locales ${JSON.stringify(locales)}`,
+  `the table loads: ${Object.keys(names).length} groups × ${locales.length} locales`)
+
+// ── B: real rows ──
+const TRANSLATED = { 220002: 'Balantak', 220017: 'Balo', 220044: 'Abaga', 220045: 'Abai Sungai' }
+const wrong = []
+for (const [code, en] of Object.entries(TRANSLATED)) {
+  if (!names[code] || names[code][locales.indexOf('en')] !== en) { wrong.push(`${code} is not ${en} in this table`); continue }
+  for (const l of ['fr', 'es', 'de', 'ar', 'hi', 'ru', 'zh']) if (name(code, l) !== en) wrong.push(`${en} in ${l} shows "${name(code, l)}"`)
+}
+ok(!wrong.length, `translated rows leak: ${wrong.slice(0, 5).join('; ')}`,
+  `the 4 known translated rows (${Object.values(TRANSLATED).join(', ')}) show English in fr es de ar hi ru zh`)
+const bb = names[220001], at = (l) => bb[locales.indexOf(l)]
+ok(bb && name(220001, 'ar') === at('ar') && /[\u0600-\u06FF]/.test(name(220001, 'ar')) && name(220001, 'zh') === at('zh_CN') && name(220001, 'hi') === at('hi'),
+  `Balangao Bontoc lost its own names: ar "${bb && name(220001, 'ar')}", zh "${bb && name(220001, 'zh')}"`,
+  `Balangao Bontoc keeps its own names (ar "${name(220001, 'ar')}", zh "${name(220001, 'zh')}")`)
+ok(name(220001, 'it') === 'Balangao Bontoc' && name(220001, 'ro') === 'Balangao Bontoc' && H.peopleGroupName(bb, locales, 'ar', 'Bontoc, Balangao') === at('ar')
+  && H.peopleGroupName(names[220002], locales, 'fr', 'Balantak (Sulawesi)') === 'Balantak (Sulawesi)',
+  'it/ro or the caller\'s English name are not honoured', 'it and ro show English; a fallback shows the CALLER\'s English name')
+
+// ── C: planted rows, two-sided ──
+const planted = (fn) => { const r = bb.slice(); fn(r); return r }
+const twoFar = planted((r) => { r[locales.indexOf('fr')] = 'Sac à dos'; r[locales.indexOf('de')] = 'Rucksack' })
+const oneFar = planted((r) => { r[locales.indexOf('fr')] = 'Sac à dos' })
+const oneLatin = planted((r) => { for (const l of H.LATIN_LOCALES) if (l !== 'fr') r[locales.indexOf(l)] = '' })
+const kept = (r) => (H.isTransliterated(r, locales) ? 'kept' : 'English')
+ok(kept(twoFar) === 'English' && H.peopleGroupName(twoFar, locales, 'ar') === 'Balangao Bontoc' && kept(oneFar) === 'kept'
+  && kept(oneLatin) === 'English' && H.peopleGroupName(oneLatin, locales, 'ar', 'Balangao Bontoc') === 'Balangao Bontoc',
+  `planted rows: exactly two far → ${kept(twoFar)}, one far → ${kept(oneFar)}, one Latin name only → ${kept(oneLatin)}`,
+  'planted, at the threshold: exactly two far Latin locales → English (ar too); one far → kept; only one Latin name to check → English')
+
+// ── D: the whole table ──
+let back = 0
+for (const row of Object.values(names)) if (!H.isTransliterated(row, locales)) back++
+const share = back / Object.keys(names).length
+ok(share > 0.30 && share < 0.45, `${back} rows (${(share * 100).toFixed(1)}%) fall back; expected 30-45% (measured 38.2%)`,
+  `${back} of ${Object.keys(names).length} rows (${(share * 100).toFixed(1)}%) fall back to English`)
+
+// ── E: one reader ──
+const EXEMPT = ['plugin-designs/pplr-data-maps/']
+const rawReaders = (files) => files.filter(({ path, src }) => /pg-names/.test(src) && !EXEMPT.some((x) => path.startsWith(x))
+  && (!/peopleGroupName(\.js)?['"]/.test(src) || /\.names\s*\[/.test(src)))
+const walk = (dir, out = []) => {
+  for (const f of readdirSync(dir)) {
+    if (f === 'node_modules' || f.startsWith('.')) continue
+    const p = join(dir, f), s = statSync(p)
+    if (s.isDirectory()) walk(p, out)
+    else if (/\.(m?js|vue)$/.test(f)) out.push({ path: relative(REPO, p).split('\\').join('/'), src: readFileSync(p, 'utf8') })
+  }
+  return out
+}
+const sources = [...walk(P('library')), ...walk(P('plugin-designs'))].filter((f) => f.path !== 'library/utils/peopleGroupName.js')
+const PLANT_RAW = "fetch(base + '/pplr/pg-names.json').then((t) => t.names[code][3])"
+const PLANT_BOTH = "import { peopleGroupName } from '@map/utils/peopleGroupName.js'\n" + PLANT_RAW
+const PLANT_GOOD = "import { peopleGroupName } from '@map/utils/peopleGroupName.js'\nfetch(base + '/pplr/pg-names.json').then((t) => peopleGroupName(t.names && row, t.locales, lang, name))"
+ok(rawReaders([{ path: 'plugin-designs/x/a.vue', src: PLANT_RAW }, { path: 'plugin-designs/x/b.vue', src: PLANT_BOTH }, { path: 'plugin-designs/x/c.vue', src: PLANT_GOOD }]).map((f) => f.path).join() === 'plugin-designs/x/a.vue,plugin-designs/x/b.vue',
+  'NEGATIVE CONTROL: the one-reader scan missed a planted raw reader (or flagged a helper-only one)',
+  'negative controls: a raw reader, and one that imports the helper AND indexes rows, are both caught; a helper-only reader passes')
+const raw = rawReaders(sources).map((f) => f.path)
+ok(!raw.length, `pg-names read outside peopleGroupName.js: ${raw.join(', ')}`,
+  `no file outside peopleGroupName.js reads pg-names rows (${sources.length} sources; pplr-data-maps carded)`)
+
+for (const n of notes) console.log(n)
+if (fails.length) {
+  console.error('PG-NAME-GATE: FAIL')
+  for (const f of fails) console.error(`  ✗ ${f}`)
+  process.exit(1)
+}
+console.log('PG-NAME-GATE: PASS — a localized people-group name is shown only when it is a transliteration, decided in one place.')

internal/check-phone-print-keep.mjs

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+/**
+ * check-phone-print-keep.mjs — on a phone, the in-page print document outlives afterprint, so a saved PDF is the preview.
+ *
+ * THE DEFECT (2026-10-02, on a phone): UPG 100 → Print prayer packet. The print preview showed all 11 pages; "Save as
+ * PDF" saved the WEBSITE (one letter page with the host page's title). On a phone printDocument mounts the document into
+ * the page (#dxm-print-root plus a print-only style) and calls window.print(). It dropped both at afterprint, but
+ * Android Chrome's print() does not block, afterprint fires once the PREVIEW is built, and the saved file is rendered
+ * later, after the reader taps Save, from the page as it is then.
+ *
+ * A timeline on fake timers and a stub DOM, with an Android user agent (Playwright cannot reproduce Android's print
+ * pipeline; a real phone is the real check):
+ *   A. after print() and afterprint, the document and its print style are still mounted 30 s on (the Save render);
+ *   B. it goes once the reader is BACK: the page shown again after being hidden, the window focused again after
+ *      losing focus, or a touch after print(), then BACK_GRACE_MS later, not before;
+ *   C. a late print (needs-tap): the Print tap itself does not count as being back, so the document is still
+ *      mounted through the dialog;
+ *   D. a reader who never comes back: dropped at FRAME_CEILING_MS, not before;
+ *   E. printImageBlob: its object URL is NOT revoked at afterprint, and is revoked when the document goes;
+ *   F. a new print replaces the previous document (one root mounted, and the previous one released);
+ *   G. the desktop path is the frame, as before (printDocument's first line, verbatim);
+ *   H. a touch AFTER the first TOUCH_SETTLE_MS, then the print UI opening (the page hidden, or the window blurred):
+ *      the pending drop is cancelled, so the document is still mounted well past BACK_GRACE_MS in the UI, and goes
+ *      after the next "back" (a measured hole in the first cut, found on a second read);
+ *   I. a touch in the first TOUCH_SETTLE_MS after print() (a double tap while the preview builds) is not "back".
+ * `--impl=<path>` runs the timeline against another copy (the pilot's, before this fix, fails A and E: the cause).
+ * `--self-test`: the old drop at afterprint, no release when the reader is back, the listeners armed at mount (so the
+ * Print tap drops it), no grace, printImageBlob revoking at afterprint, no ceiling, no cancel when the page goes away
+ * again during the grace, and no touch settle window must each FAIL.
+ */
+import { readFileSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+const implArg = process.argv.find((a) => a.startsWith('--impl='))
+const SRC = implArg ? implArg.slice(7) : join(ROOT, 'library/composables/printInPlace.js')
+const ROOT_ID = 'dxm-print-root'
+
+// ── fake timers ─────────────────────────────────────────────────────────────────────────────────
+let now = 0, seq = 0
+const timers = new Map()
+globalThis.setTimeout = (fn, ms = 0) => { const id = ++seq; timers.set(id, { at: now + Math.max(0, ms), fn }); return id }
+globalThis.clearTimeout = (id) => { timers.delete(id) }
+function advance(ms) {
+  const t = now + ms
+  for (;;) {
+    let next = null
+    for (const [id, x] of timers) if (x.at <= t && (!next || x.at < next[1].at || (x.at === next[1].at && id < next[0]))) next = [id, x]
+    if (!next) break
+    timers.delete(next[0]); now = next[1].at; next[1].fn()
+  }
+  now = t
+}
+const flush = async () => { for (let i = 0; i < 20; i++) await Promise.resolve() }
+
+// ── a stub DOM: just what mountPrintRoot touches ────────────────────────────────────────────────────
+function events() {
+  const L = new Map()
+  return {
+    addEventListener(t, f) { if (!L.has(t)) L.set(t, []); L.get(t).push(f) },
+    removeEventListener(t, f) { const a = L.get(t); if (a && a.indexOf(f) >= 0) a.splice(a.indexOf(f), 1) },
+    fire(t) { for (const f of [...(L.get(t) || [])]) f({ type: t }) },
+  }
+}
+function node(tag) {
+  const n = {
+    tag, id: '', attrs: {}, children: [], parent: null, textContent: '', style: {}, ...events(),
+    setAttribute(k, v) { this.attrs[k] = String(v) }, getAttribute(k) { return k in this.attrs ? this.attrs[k] : null },
+    appendChild(c) { c.parent = this; this.children.push(c); return c },
+    append(...cs) { for (const c of cs) this.appendChild(c) },
+    remove() { if (this.parent) { this.parent.children.splice(this.parent.children.indexOf(this), 1); this.parent = null } },
+    querySelectorAll() { return [] },
+  }
+  return n
+}
+let revoked = []
+function world({ android = true, active = true } = {}) {
+  now = 0; seq = 0; timers.clear(); revoked = []
+  const body = node('body'), head = node('head')
+  const doc = {
+    body, head, visibilityState: 'visible', ...events(),
+    createElement: (t) => node(t), importNode: (n) => n,
+    getElementById: (id) => [...body.children, ...head.children].find((n) => n.id === id) || null,
+    querySelectorAll: () => [...body.children.filter((n) => n.id === ROOT_ID), ...head.children.filter((n) => 'data-dxm-print' in n.attrs)],
+  }
+  globalThis.document = doc
+  globalThis.window = { ...events(), prints: [], print() { this.prints.push(mounted()) } }
+  globalThis.DOMParser = class { parseFromString() { return { querySelectorAll: (s) => (s === 'style' ? [{ textContent: '@page{size:letter portrait;margin:0}' }] : []), documentElement: { getAttribute: () => null }, body: { childNodes: [node('div')] } } } }
+  Object.defineProperty(globalThis, 'navigator', { configurable: true, value: {
+    userAgent: android ? 'Mozilla/5.0 (Linux; Android 14; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Mobile Safari/537.36' : 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36',
+    userActivation: { isActive: active }, maxTouchPoints: android ? 5 : 0 } })
+  globalThis.URL.createObjectURL = () => 'blob:stub/1'
+  globalThis.URL.revokeObjectURL = (u) => { revoked.push([u, now]) }
+}
+const mounted = () => Boolean(document.body.children.find((n) => n.id === ROOT_ID)) && Boolean(document.head.children.find((n) => 'data-dxm-print' in n.attrs))
+const rootCount = () => document.body.children.filter((n) => n.id === ROOT_ID).length
+let bust = 0
+const load = (src) => import('data:text/javascript;base64,' + Buffer.from(src + `\n// ${++bust}`).toString('base64'))
+
+async function audit(src) {
+  const fails = []
+  const sample = await load(src)
+  const FRAME_CEILING_MS = sample.FRAME_CEILING_MS || 600000, BACK_GRACE_MS = sample.BACK_GRACE_MS || 0, TOUCH_SETTLE_MS = sample.TOUCH_SETTLE_MS || 0
+  if (!sample.FRAME_CEILING_MS || !sample.BACK_GRACE_MS || !sample.TOUCH_SETTLE_MS) fails.push('G: printInPlace.js does not export FRAME_CEILING_MS, BACK_GRACE_MS and TOUCH_SETTLE_MS (the timeline runs on, with 0 for each missing one)')
+  const HTML = '<!doctype html><html><head><style>@page{size:letter portrait}</style></head><body><div>packet</div></body></html>'
+
+  // A + B (hidden → visible)
+  { world(); const m = await load(src); const how = await m.printDocument(HTML)
+    if (how !== 'page' || window.prints.length !== 1 || !window.prints[0]) fails.push(`A: a phone print did not print the mounted document (returned ${how}, prints ${JSON.stringify(window.prints)})`)
+    window.fire('afterprint'); advance(30000)
+    if (!mounted()) fails.push('A: the print document was gone 30 s after afterprint; a PDF saved then is the bare page')
+    document.visibilityState = 'hidden'; document.fire('visibilitychange'); advance(20000)
+    if (!mounted()) fails.push('B: the document went while the page was hidden (the print dialog was still up)')
+    document.visibilityState = 'visible'; document.fire('visibilitychange'); advance(BACK_GRACE_MS - 1)
+    if (!mounted()) fails.push('B: the document went at once when the page was shown again (no grace for a job still rendering)')
+    advance(2)
+    if (mounted()) fails.push('B: the document stayed after the reader was back on the page (shown again) and the grace')
+  }
+  // B (blur → focus) and B (a touch after print)
+  { world(); const m = await load(src); await m.printDocument(HTML); window.fire('afterprint'); window.fire('blur'); advance(10000)
+    if (!mounted()) fails.push('B: the document went while the window had lost focus')
+    window.fire('focus'); advance(BACK_GRACE_MS + 1)
+    if (mounted()) fails.push('B: the document stayed after the window was focused again (back on the page)') }
+  { world(); const m = await load(src); await m.printDocument(HTML); window.fire('afterprint'); advance(TOUCH_SETTLE_MS + 3000); window.fire('pointerdown'); advance(BACK_GRACE_MS + 1)
+    if (mounted()) fails.push('B: the document stayed after the page was touched again') }
+  // C: a late print (the tap's activation expired): the Print tap is not "back"
+  { world({ active: false }); const m = await load(src); let printNow = null
+    const how = await m.printDocument(HTML, { onNeedsTap: (p) => { printNow = p } })
+    if (how !== 'needs-tap' || !printNow) fails.push(`C: an expired tap did not hand out printNow (returned ${how})`)
+    else {
+      // the reader taps Print a few seconds after the document is ready, then spends longer than the grace in the dialog
+      advance(TOUCH_SETTLE_MS + 3000); window.fire('pointerdown'); printNow(); window.fire('afterprint'); advance(BACK_GRACE_MS + 20000)
+      if (window.prints.length !== 1 || !window.prints[0]) fails.push('C: printNow did not print the mounted document')
+      if (!mounted()) fails.push(`C: the Print tap counted as being back: the document was gone ${(BACK_GRACE_MS + 20000) / 1000} s into the dialog`)
+    } }
+  // D: never back
+  { world(); const m = await load(src); await m.printDocument(HTML); window.fire('afterprint'); advance(FRAME_CEILING_MS - 1)
+    if (!mounted()) fails.push('D: the document went before the ceiling with the reader never back')
+    advance(2)
+    if (mounted()) fails.push('D: the document outlived FRAME_CEILING_MS') }
+  // E: printImageBlob's object URL
+  { world(); const m = await load(src); m.printImageBlob({ size: 1 }, { title: 'poster' }); await flush()
+    window.fire('afterprint'); advance(30000)
+    if (revoked.length) fails.push(`E: printImageBlob revoked its object URL at ${revoked[0][1]} ms, before the reader was back (a saved PDF has no image)`)
+    if (!mounted()) fails.push('E: printImageBlob\'s document was gone 30 s after afterprint')
+    window.fire('pointerdown'); advance(BACK_GRACE_MS + 1)
+    if (revoked.length !== 1) fails.push(`E: printImageBlob's object URL was revoked ${revoked.length} time(s) after the reader was back (expected once)`) }
+  // F: a new print replaces the previous one
+  { world(); const m = await load(src); let first = 0
+    await m.printDocument(HTML, { onRelease: () => { first++ } }); window.fire('afterprint'); await m.printDocument(HTML)
+    if (rootCount() !== 1) fails.push(`F: ${rootCount()} print roots mounted after a second print (expected 1)`)
+    if (first !== 1) fails.push(`F: the first print's onRelease ran ${first} time(s) when a second print replaced it (expected 1)`) }
+  // H: a touch after the settle window, then the print UI opens: away again cancels the pending drop
+  for (const via of ['hidden', 'blur']) {
+    world(); const m = await load(src); await m.printDocument(HTML); advance(TOUCH_SETTLE_MS + 500); window.fire('pointerdown'); advance(500)
+    if (via === 'hidden') { document.visibilityState = 'hidden'; document.fire('visibilitychange') } else window.fire('blur')
+    window.fire('afterprint'); advance(BACK_GRACE_MS + 20000)
+    if (!mounted()) fails.push(`H: a touch, then the print UI (${via}): the grace the touch started was not cancelled, and the document went while the reader was still in the UI (a PDF saved then is the bare page)`)
+    else {
+      if (via === 'hidden') { document.visibilityState = 'visible'; document.fire('visibilitychange') } else window.fire('focus')
+      advance(BACK_GRACE_MS + 1)
+      if (mounted()) fails.push(`H: after the print UI (${via}) closed, the document stayed past the grace (the next "back" did not count)`)
+    }
+  }
+  // I: a touch in the settle window (no hide, no blur: an in-page sheet) is not "back"
+  { world(); const m = await load(src); await m.printDocument(HTML); advance(Math.max(1, TOUCH_SETTLE_MS - 1500)); window.fire('pointerdown'); advance(BACK_GRACE_MS + 30000)
+    if (!mounted()) fails.push('I: a touch right after print() (a double tap while the preview builds) counted as being back, and the document went with the dialog still up') }
+  // G: desktop unchanged (the frame path)
+  if (!src.includes("if (!isPhonePrint()) return openPrintFrame(html, { autoprint: true }) ? 'frame' : 'blocked'")) fails.push('G: printDocument\'s desktop path is no longer the frame, verbatim')
+  return fails
+}
+
+const src = readFileSync(SRC, 'utf8')
+if (process.argv.includes('--self-test')) {
+  const MOUNT_END = '  ceiling = setTimeout(drop, FRAME_CEILING_MS)\n  currentJob = job\n'
+  const poisons = [
+    ['the old drop at afterprint', src.replace(MOUNT_END, "  window.addEventListener('afterprint', () => setTimeout(drop, 0))\n" + MOUNT_END), /^A: /],
+    ['no release when the reader is back', src.replace('const back = () => { if (leaving) return; leaving = true; clearTimeout(ceiling); ceiling = setTimeout(drop, BACK_GRACE_MS) }', 'const back = () => {}'), /^B: the document stayed/],
+    ['the listeners armed at mount (the Print tap drops it)', src.replace(MOUNT_END, '  ceiling = setTimeout(drop, FRAME_CEILING_MS)\n  job.printing()\n  currentJob = job\n'), /^C: the Print tap counted/],
+    ['no grace once the reader is back', src.replace('ceiling = setTimeout(drop, BACK_GRACE_MS) }', 'drop() }'), /^B: the document went at once/],
+    ['printImageBlob revoking at afterprint', src.replace("    const release = () => { try { URL.revokeObjectURL(url) } catch { /* gone */ } }\n", "    const release = () => { try { URL.revokeObjectURL(url) } catch { /* gone */ } }\n    window.addEventListener('afterprint', () => setTimeout(release, 0))\n"), /^E: printImageBlob revoked/],
+    ['no ceiling', src.replace(MOUNT_END, '  currentJob = job\n'), /^D: the document outlived/],
+    ['no cancel when the page goes away again', src.replace('const awayAgain = () => { away = true; if (leaving) { leaving = false; clearTimeout(ceiling); ceiling = setTimeout(drop, FRAME_CEILING_MS) } }', 'const awayAgain = () => { away = true }'), /^H: a touch, then the print UI/],
+    ['no touch settle window', src.replace('const onTouch = () => { if (!settling) back() }', 'const onTouch = () => back()'), /^I: /],
+  ]
+  let missed = 0
+  for (const [name, poisoned, rx] of poisons) {
+    if (poisoned === src) { console.log(`NOT MEASURED: the poison anchor for "${name}" moved`); process.exitCode = 75; continue }
+    const f = await audit(poisoned); const hit = f.find((x) => rx.test(x))
+    console.log(hit ? `✓ caught: ${name} -> ${hit}` : `✗ MISSED: ${name}${f.length ? ` (failed instead: ${f[0]})` : ''}`)
+    if (!hit) missed++
+  }
+  if (missed) process.exitCode = 1
+} else {
+  const f = await audit(src)
+  if (f.length) { for (const x of f) console.log('✗ ' + x); console.log(`FAIL check:phone-print-keep (${f.length})`); process.exitCode = 1 }
+  else console.log('PASS check:phone-print-keep — on a phone the print document (and printImageBlob\'s image) outlives afterprint, so a PDF saved after the preview is the document; it goes once the reader is back (shown, focused or touched again) plus a grace, or at the ceiling; the Print tap of a late print and a touch right after print() do not count; going away again cancels a pending drop; a new print replaces it; desktop prints through the frame as before')
+}