Shell: Studio/Editor toggle, sidebar chat, templates, wallet, GPUs

One shared shell asset (middleware/shell.{js,css}, served at /studio/shell.*)
is loaded by BOTH views — the Studio home <script>-includes it, and the Editor
gets a single tag injected into the engine index.html by server.get_root. It
renders one chrome in both: a Studio/Editor toggle, wallet chip, GPUs badge +
panel, and a dockable right chat sidebar backed by the ONE chat path
(/v1/copilot/chat). Same-origin cookies carry the IAM session, so login/org are
inherited — no auth is rebuilt.

New tenant-scoped routes (all via _org_of):
  GET  /studio/shell.js|css
  GET  /v1/workflow?id=<worklog id>   graph from the item's output PNG (404 if
                                      not owned / not landed) — Open in Editor
  POST /v1/templates                  save {name, graph} → orgs/<org>/templates
  GET  /v1/templates                  list
  GET  /v1/templates/{name}           fetch
  POST /v1/templates/render           queue through the ONE dispatch funnel
  GET  /v1/wallet                     display-only proxy of the user token to the
                                      cloud finance balance → {org, balance, currency}

Studio home: "Advanced mode" link replaced by the shell toggle; dead chatfab CSS
removed; Templates tab lists org templates (Open in Editor + Render); work-item
context gets Open in Editor; favorite→template now writes a REAL template.

Mobile (verified 390x844 + 768x1024): chat collapses to a full-width bottom
sheet; the pill bar stays one compact line (icon-only Chat/GPUs) so all controls
stay reachable and clear the content; zero horizontal overflow.

Wallet is display + Top up link (pay.hanzo.ai) only — no card fields, no minting.
Tests extend studio_home_test for the new routes (tenant isolation + shape).

middleware/shell.css

@@ -0,0 +1,63 @@
+/* Hanzo Studio shell — the ONE shared chrome, loaded by BOTH the Studio home
+ * (middleware/studio_home.html) and the Editor (injected into the engine's
+ * index.html by server.get_root). Self-contained dark palette + `hz` id/class
+ * prefix so it never collides with the editor's own theme. */
+#hzbar{position:fixed;bottom:18px;right:18px;z-index:2147483000;display:flex;align-items:center;gap:8px;
+  flex-wrap:wrap;justify-content:flex-end;max-width:calc(100vw - 36px);
+  font:400 14px/1.4 Inter,system-ui,-apple-system,sans-serif}
+#hzbar button,#hzbar a{font:inherit}
+.hz-pill{display:inline-flex;align-items:center;gap:7px;background:#131317;color:#ececf1;border:1px solid #232329;
+  border-radius:999px;padding:7px 13px;cursor:pointer;text-decoration:none;white-space:nowrap}
+.hz-pill:hover{border-color:#3a3a48}
+.hz-pill .hz-dot{width:8px;height:8px;border-radius:50%;background:#555;flex:0 0 auto}
+.hz-pill.on .hz-dot{background:#3ddc84}
+.hz-pill.hz-chat{background:#f4f4f6;color:#111;border-color:#f4f4f6;font-weight:600}
+.hz-topup{color:#6aa5ff;text-decoration:none;font-size:.82em;border-left:1px solid #232329;padding-left:7px}
+.hz-topup:hover{text-decoration:underline}
+/* right-docked chat sidebar (both views) */
+#hzchat{position:fixed;top:0;right:0;height:100vh;width:380px;max-width:94vw;background:#0e0e12;color:#ececf1;
+  border-left:1px solid #232329;z-index:2147483001;display:flex;flex-direction:column;
+  transform:translateX(100%);transition:transform .22s ease;box-shadow:-14px 0 44px #0007}
+#hzchat.on{transform:translateX(0)}
+#hzchat .hz-h{display:flex;align-items:center;gap:9px;padding:13px 15px;border-bottom:1px solid #232329;flex-wrap:wrap}
+#hzchat .hz-h .hz-av{width:26px;height:26px;border-radius:50%;background:#26262e;display:flex;align-items:center;
+  justify-content:center;font-size:.72rem;font-weight:600;flex:0 0 auto}
+#hzchat .hz-h .hz-who{font-size:.82rem;min-width:0}
+#hzchat .hz-h .hz-who b{display:block;font-size:.86rem;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+#hzchat .hz-h .hz-who span{color:#8a8a95;font-size:.72rem}
+#hzchat .hz-h .hz-x{margin-left:auto;cursor:pointer;color:#8a8a95;font-size:1.3rem;line-height:1;background:none;border:none}
+#hzmsgs{flex:1;overflow:auto;padding:14px;display:flex;flex-direction:column;gap:10px}
+.hz-m{max-width:88%;padding:9px 12px;border-radius:12px;font-size:.86rem;line-height:1.45;white-space:pre-wrap;word-break:break-word}
+.hz-m.u{align-self:flex-end;background:#f4f4f6;color:#111;border-bottom-right-radius:3px}
+.hz-m.a{align-self:flex-start;background:#1a1a20;border:1px solid #232329;border-bottom-left-radius:3px}
+.hz-m.sys{align-self:center;color:#8a8a95;font-size:.78rem;background:none}
+#hzform{display:flex;gap:8px;padding:12px;border-top:1px solid #232329}
+#hzform input{flex:1;background:#0a0a0d;border:1px solid #232329;border-radius:9px;color:#ececf1;padding:9px 11px;font:inherit;font-size:.85rem;outline:none}
+#hzform button{background:#f4f4f6;color:#111;border:none;border-radius:9px;padding:0 14px;font-weight:600;cursor:pointer}
+/* GPUs panel (both views) */
+#hzgpus{position:fixed;bottom:64px;right:18px;z-index:2147483001;width:320px;max-width:92vw;background:#131317;
+  color:#ececf1;border:1px solid #232329;border-radius:12px;padding:12px 14px;display:none;box-shadow:0 18px 50px #0009}
+#hzgpus.on{display:block}
+#hzgpus h4{font-size:.82rem;font-weight:600;margin:0 0 8px;display:flex;align-items:center;gap:7px}
+.hz-node{display:flex;align-items:flex-start;gap:9px;padding:7px 0;border-top:1px solid #1e1e24;font-size:.8rem}
+.hz-node:first-of-type{border-top:none}
+.hz-node .hz-dot{width:8px;height:8px;border-radius:50%;background:#555;margin-top:5px;flex:0 0 auto}
+.hz-node.on .hz-dot{background:#3ddc84}
+.hz-node .hz-nn{flex:1;min-width:0}
+.hz-node .hz-nn b{font-weight:500}
+.hz-node .hz-nsub{color:#8a8a95;font-size:.72rem;margin-top:2px}
+/* Tablet: a touch narrower sidebar; the pill bar + panels already fit. */
+@media (max-width:900px){#hzchat{width:340px}}
+/* Phone: chat becomes a full-width bottom sheet (same pattern the old chatpanel
+   used); the pill bar wraps upward from the bottom-right so the toggle, wallet
+   and GPUs badge all stay reachable; the GPUs panel spans the width. */
+@media (max-width:600px){
+  #hzbar{bottom:14px;right:14px;gap:7px}
+  .hz-pill{padding:7px 11px}
+  .hz-pill .hz-lbl{display:none}   /* icon-only Chat/GPUs → one line, clears content */
+  #hzchat{top:auto;bottom:0;width:100vw;max-width:100vw;height:85vh;
+    border-left:none;border-top:1px solid #232329;border-radius:16px 16px 0 0;
+    transform:translateY(100%);box-shadow:0 -14px 44px #0007}
+  #hzchat.on{transform:translateY(0)}
+  #hzgpus{left:12px;right:12px;width:auto;bottom:66px}
+}

middleware/shell.js

@@ -0,0 +1,201 @@
+/* Hanzo Studio shell — the ONE shared chrome for BOTH views.
+ *
+ *   Studio home (/studio)      includes this via <script src="/studio/shell.js">
+ *   Editor (/ ?advanced=1)     gets the same tag injected into the engine's
+ *                              index.html by server.get_root
+ *
+ * It renders (identically in both views): a Studio/Editor toggle, a wallet chip,
+ * a GPUs badge + panel, and a dockable right chat SIDEBAR backed by the ONE chat
+ * path (POST /v1/copilot/chat). Same-origin cookies carry the IAM session, so org
+ * + login are inherited — no auth is rebuilt here. In the editor it also honours
+ * ?load=<worklog id> / ?template=<name> to open a graph, and offers Save as
+ * template. Guarded end to end: any failure logs and no-ops, never throws. */
+(function () {
+  "use strict";
+  if (window.__hzShell) return;
+  window.__hzShell = 1;
+
+  var STUDIO = location.pathname === "/studio" || location.pathname === "/studio/";
+  var $ = function (id) { return document.getElementById(id); };
+  var el = function (tag, attrs, html) {
+    var e = document.createElement(tag);
+    if (attrs) for (var k in attrs) e.setAttribute(k, attrs[k]);
+    if (html != null) e.innerHTML = html;
+    return e;
+  };
+  var esc = function (s) { return String(s == null ? "" : s).replace(/[<>&]/g, function (c) { return { "<": "&lt;", ">": "&gt;", "&": "&amp;" }[c]; }); };
+  async function getJSON(url, opt) {
+    var r = await fetch(url, Object.assign({ credentials: "same-origin" }, opt || {}));
+    var j = {}; try { j = await r.json(); } catch (_) {}
+    return { ok: r.ok, status: r.status, body: j };
+  }
+
+  // ── chrome: bottom-right pill cluster + docked chat sidebar + GPUs panel ──────
+  var bar = el("div", { id: "hzbar" });
+  var toggle = el("a", { class: "hz-pill", href: STUDIO ? "/?advanced=1" : "/studio",
+    title: STUDIO ? "Open the node editor" : "Back to Studio" }, STUDIO ? "⇄ Editor" : "⇄ Studio");
+  var tmplBtn = STUDIO ? null : el("button", { class: "hz-pill", title: "Save the current graph as a reusable template" }, "★ Template");
+  var wallet = el("a", { class: "hz-pill", id: "hzwallet", href: "https://pay.hanzo.ai", target: "_blank", rel: "noopener",
+    title: "Wallet — top up at pay.hanzo.ai" }, "wallet …");
+  var gpus = el("button", { class: "hz-pill", id: "hzgpubtn", title: "GPUs" }, '<span class="hz-dot"></span><span class="hz-lbl">GPUs</span>');
+  var chatBtn = el("button", { class: "hz-pill hz-chat", title: "Chat" }, '💬<span class="hz-lbl"> Chat</span>');
+  bar.appendChild(toggle);
+  if (tmplBtn) bar.appendChild(tmplBtn);
+  bar.appendChild(wallet); bar.appendChild(gpus); bar.appendChild(chatBtn);
+
+  var gpuPanel = el("div", { id: "hzgpus" }, '<h4>GPUs</h4><div id="hznodes"></div>');
+  var chat = el("aside", { id: "hzchat" });
+  chat.innerHTML =
+    '<div class="hz-h"><span class="hz-av" id="hzav">·</span>' +
+    '<span class="hz-who"><b id="hzuser">…</b><span id="hzorg"></span></span>' +
+    '<button class="hz-x" id="hzclose" title="Close">×</button></div>' +
+    '<div id="hzmsgs"></div>' +
+    '<form id="hzform"><input id="hzin" placeholder="Ask the copilot…" autocomplete="off"><button type="submit">Send</button></form>';
+
+  function mount() {
+    document.body.appendChild(bar);
+    document.body.appendChild(gpuPanel);
+    document.body.appendChild(chat);
+    wire();
+    loadSession(); loadWallet(); loadGpus();
+    if (!STUDIO) editorBoot();
+  }
+
+  // ── chat: the ONE path — POST /v1/copilot/chat; ops applied via the editor's
+  // existing applier when present (no second chat mechanism) ────────────────────
+  var HISTORY = [];
+  function addMsg(role, text) {
+    var m = el("div", { class: "hz-m " + role }, esc(text));
+    $("hzmsgs").appendChild(m); $("hzmsgs").scrollTop = $("hzmsgs").scrollHeight;
+    return m;
+  }
+  async function graphContext() {
+    var app = window.app;
+    if (!app || typeof app.graphToPrompt !== "function") return {};
+    try {
+      var p = await app.graphToPrompt();
+      var ctx = { graph_json: p.output || {} };
+      try { ctx.catalog = { types: Object.keys((window.LiteGraph && window.LiteGraph.registered_node_types) || {}) }; } catch (_) {}
+      return ctx;
+    } catch (_) { return {}; }
+  }
+  async function send(text) {
+    HISTORY.push({ role: "user", content: text });
+    addMsg("u", text);
+    var pending = addMsg("sys", "…");
+    var payload = Object.assign({ messages: HISTORY.slice(-20) }, await graphContext());
+    var r = await getJSON("/v1/copilot/chat", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) });
+    pending.remove();
+    var reply = (r.body && r.body.reply) || (r.body && r.body.error) || (r.ok ? "" : "chat failed (" + r.status + ")");
+    if (reply) { HISTORY.push({ role: "assistant", content: reply }); addMsg("a", reply); }
+    var ops = (r.body && r.body.ops) || [];
+    if (ops.length && window.HanzoCopilot && typeof window.HanzoCopilot.applyOps === "function") {
+      try { window.HanzoCopilot.applyOps(ops); } catch (e) { addMsg("sys", "couldn't apply changes: " + e.message); }
+    } else if (ops.length && STUDIO) {
+      addMsg("sys", "Open the Editor to apply " + ops.length + " graph change" + (ops.length > 1 ? "s" : "") + ".");
+    }
+  }
+
+  function wire() {
+    chatBtn.onclick = function () { chat.classList.toggle("on"); if (chat.classList.contains("on")) $("hzin").focus(); };
+    $("hzclose").onclick = function () { chat.classList.remove("on"); };
+    $("hzform").onsubmit = function (e) {
+      e.preventDefault();
+      var v = $("hzin").value.trim(); if (!v) return;
+      $("hzin").value = ""; send(v).catch(function (err) { addMsg("sys", "error: " + err.message); });
+    };
+    gpus.onclick = function () { gpuPanel.classList.toggle("on"); if (gpuPanel.classList.contains("on")) loadGpus(); };
+    if (tmplBtn) tmplBtn.onclick = saveTemplate;
+  }
+
+  // ── session · wallet · GPUs ───────────────────────────────────────────────────
+  async function loadSession() {
+    var r = await getJSON("/v1/session"); var s = r.body || {};
+    var nm = (s.user || s.email || "You").trim();
+    $("hzav").textContent = (nm[0] || "·").toUpperCase();
+    $("hzuser").textContent = nm;
+    $("hzorg").textContent = s.org ? ("org · " + s.org) : "";
+  }
+  function money(n, cur) {
+    if (n == null || isNaN(n)) return "—";
+    var sym = (cur || "").toLowerCase() === "usd" ? "$" : "";
+    return sym + Number(n).toFixed(2) + (sym ? "" : " " + (cur || "").toUpperCase());
+  }
+  async function loadWallet() {
+    var r = await getJSON("/v1/wallet"); var w = r.body || {};
+    wallet.innerHTML = esc(money(w.balance, w.currency)) + '<span class="hz-topup">Top up ↗</span>';
+    wallet.title = "Wallet" + (w.org ? " · " + w.org : "") + " — top up at pay.hanzo.ai";
+  }
+  async function loadGpus() {
+    var nres = await getJSON("/v1/nodes"); var qres = await getJSON("/v1/queue/status");
+    var nodes = (nres.body && nres.body.nodes) || [];
+    var pod = (nres.body && nres.body.pod) || null;
+    if (pod) nodes = nodes.concat([pod]);
+    var items = (qres.body && qres.body.items) || {};
+    var byNode = {};
+    Object.keys(items).forEach(function (id) {
+      var it = items[id]; var k = it.node || "gpu";
+      (byNode[k] = byNode[k] || { running: null, depth: 0 });
+      byNode[k].depth++;
+      if (it.status === "running") byNode[k].running = it.prompt || it.kind || "a render";
+    });
+    var online = nodes.filter(function (n) { return n.online; }).length;
+    gpus.innerHTML = '<span class="hz-dot"></span><span class="hz-lbl">GPUs </span>' + online + "/" + nodes.length;
+    gpus.classList.toggle("on", online > 0);
+    $("hznodes").innerHTML = nodes.length ? nodes.map(function (n) {
+      var s = byNode[n.name] || { running: null, depth: 0 };
+      var sub = (n.online ? "online" : "offline") +
+        (s.running ? " · running: " + esc(String(s.running).slice(0, 40)) : (n.online ? " · idle" : "")) +
+        " · queue " + s.depth;
+      return '<div class="hz-node ' + (n.online ? "on" : "") + '"><span class="hz-dot"></span>' +
+        '<div class="hz-nn"><b>' + esc(n.name) + '</b><div class="hz-nsub">' + sub + "</div></div></div>";
+    }).join("") : '<div class="hz-nsub">No GPU nodes connected. Run <b>hanzo gpu connect</b> on a box to add one.</div>';
+  }
+
+  // ── editor-only: open a graph (?load / ?template), Save as template ────────────
+  function waitForApp(ms) {
+    return new Promise(function (resolve, reject) {
+      var t0 = Date.now();
+      (function poll() {
+        if (window.app && typeof window.app.loadGraphData === "function") return resolve(window.app);
+        if (Date.now() - t0 > ms) return reject(new Error("editor not ready"));
+        setTimeout(poll, 150);
+      })();
+    });
+  }
+  function editorLoad(g) {
+    var app = window.app; if (!app || !g) return false;
+    if (g.workflow && typeof app.loadGraphData === "function") { app.loadGraphData(g.workflow); return true; }
+    if (g.output && typeof app.loadApiJson === "function") { app.loadApiJson(g.output, "hanzo"); return true; }
+    if ((g.nodes || g.last_node_id != null) && typeof app.loadGraphData === "function") { app.loadGraphData(g); return true; }
+    if (typeof app.loadApiJson === "function") { app.loadApiJson(g, "hanzo"); return true; }
+    if (typeof app.loadGraphData === "function") { app.loadGraphData(g); return true; }
+    return false;
+  }
+  async function editorBoot() {
+    var q = new URLSearchParams(location.search);
+    var load = q.get("load"), template = q.get("template");
+    if (!load && !template) return;
+    try {
+      await waitForApp(30000);
+      var url = load ? "/v1/workflow?id=" + encodeURIComponent(load) : "/v1/templates/" + encodeURIComponent(template);
+      var r = await getJSON(url);
+      if (!r.ok) { addMsg("sys", "couldn't open: " + ((r.body && r.body.error) || r.status)); return; }
+      editorLoad(r.body.graph || r.body);
+    } catch (e) { console.warn("[hz shell]", e); }
+  }
+  async function saveTemplate() {
+    var app = window.app;
+    if (!app || typeof app.graphToPrompt !== "function") { alert("Open a workflow in the editor first."); return; }
+    var name = prompt("Save this graph as a template named:");
+    if (!name || !name.trim()) return;
+    var g;
+    try { g = await app.graphToPrompt(); } catch (e) { alert("Couldn't read the graph: " + e.message); return; }
+    var r = await getJSON("/v1/templates", { method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ name: name.trim(), graph: { workflow: g.workflow, output: g.output } }) });
+    alert(r.ok ? '★ Saved template "' + (r.body.name || name.trim()) + '"' : "Save failed: " + ((r.body && r.body.error) || r.status));
+  }
+
+  if (document.body) mount();
+  else document.addEventListener("DOMContentLoaded", mount);
+})();

middleware/studio_home.html

@@ -2,6 +2,8 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Hanzo Studio</title>
+<link rel="stylesheet" href="/studio/shell.css">
+<script src="/studio/shell.js" defer></script>
 <style>
 :root{--bg:#0a0a0b;--panel:#131317;--panel2:#17171c;--line:#232329;--txt:#ececf1;--dim:#8a8a95;
 --brand:#f4f4f6;--ok:#3ddc84;--warn:#ffb648;--pub:#6aa5ff;font-size:15px}
@@ -143,18 +145,8 @@ body.immersive #stage{display:block}
 #stage .dots span{width:6px;height:6px;border-radius:50%;background:rgba(255,255,255,.35);cursor:pointer} #stage .dots span.on{background:#fff;width:20px;border-radius:4px}
 #stage .exit{position:absolute;top:18px;right:22px;z-index:7;color:#fff;background:rgba(0,0,0,.4);border:1px solid rgba(255,255,255,.25);border-radius:8px;padding:6px 12px;font-size:.8rem;cursor:pointer;opacity:0;transition:.2s} #stage:hover .exit{opacity:1}
 .viewbtn{border:1px solid var(--line);background:var(--panel);color:var(--txt);border-radius:8px;padding:7px 13px;font-size:.85rem;cursor:pointer}
-/* ── Hanzo AI chat widget ──────────────────────────────────────────────────── */
-#chatfab{position:fixed;bottom:22px;right:22px;width:52px;height:52px;border-radius:50%;background:var(--brand);color:#111;border:none;font-size:1.4rem;cursor:pointer;z-index:48;box-shadow:0 8px 24px #0008;display:flex;align-items:center;justify-content:center}
-#chatpanel{position:fixed;bottom:22px;right:22px;width:380px;max-width:92vw;height:560px;max-height:82vh;background:#0e0e12;border:1px solid var(--line);border-radius:16px;z-index:49;display:none;flex-direction:column;overflow:hidden;box-shadow:0 20px 60px #000b}
-#chatpanel.on{display:flex} #chatpanel .ch{display:flex;align-items:center;gap:9px;padding:14px 16px;border-bottom:1px solid var(--line)}
-#chatpanel .ch .av{width:26px;height:26px;border-radius:7px;background:#111;display:flex;align-items:center;justify-content:center}
-#chatpanel .ch b{font-size:.9rem} #chatpanel .ch .x{margin-left:auto;cursor:pointer;color:var(--dim);font-size:1.2rem}
-#chatmsgs{flex:1;overflow:auto;padding:14px;display:flex;flex-direction:column;gap:10px}
-.cmsg{max-width:86%;padding:9px 12px;border-radius:12px;font-size:.86rem;line-height:1.45;white-space:pre-wrap}
-.cmsg.u{align-self:flex-end;background:var(--brand);color:#111;border-bottom-right-radius:3px}
-.cmsg.a{align-self:flex-start;background:#1a1a20;border:1px solid var(--line);border-bottom-left-radius:3px}
-#chatbar{display:flex;gap:8px;padding:12px;border-top:1px solid var(--line)}
-#chatbar input{flex:1;background:#0a0a0d;border:1px solid var(--line);border-radius:9px;color:var(--txt);padding:9px 11px;font:inherit;font-size:.85rem}
+/* The Studio/Editor toggle, wallet, GPUs and chat sidebar are the shared shell
+   (/studio/shell.css + shell.js), loaded in both views. */
 /* ── Responsive: tablet ≤900px, phone ≤600px ─────────────────────────────── */
 @media (max-width:900px){
   main{padding:12px 16px 90px}
@@ -162,7 +154,6 @@ body.immersive #stage{display:block}
   .grid{grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:11px}
   .tgrid{grid-template-columns:repeat(auto-fill,minmax(120px,1fr))}
   #livebar{margin-left:16px;margin-right:16px}
-  #chatpanel{width:calc(100vw - 24px);height:70vh}
 }
 @media (max-width:600px){
   header{padding:11px 14px;gap:9px}
@@ -180,8 +171,6 @@ body.immersive #stage{display:block}
   .search{width:120px} .tabs .sp{display:none}
   #livebar{flex-wrap:wrap;font-size:.78rem}
   #bulkbar,#reftray{left:8px;right:8px;transform:none;flex-wrap:wrap;justify-content:center}
-  #chatfab{bottom:16px;right:16px}
-  #chatpanel{bottom:0;right:0;left:0;width:100vw;height:82vh;max-height:82vh;border-radius:16px 16px 0 0}
   .card .delx,.card .addref{width:30px;height:30px}  /* bigger tap targets */
 }
 /* touch: no hover-reveal — always show card tools on touch devices */
@@ -192,7 +181,6 @@ body.immersive #stage{display:block}
 <header>
   <svg class="logo" viewBox="0 0 520 520" xmlns="http://www.w3.org/2000/svg"><rect width="520" height="520" rx="120" fill="#111"/><g transform="translate(100,100) scale(4.78)" fill="#fff"><path d="M22.21 67V44.6369H0V67H22.21Z"/><path d="M66.7038 22.3184H22.2534L0.0878906 44.6367H44.4634L66.7038 22.3184Z"/><path d="M22.21 0H0V22.3184H22.21V0Z"/><path d="M66.7198 0H44.5098V22.3184H66.7198V0Z"/><path d="M66.7198 67V44.6369H44.5098V67H66.7198Z"/></g></svg>
   <h1>Hanzo Studio</h1><span class="beta">Beta</span><span class="sp"></span>
-  <a class="lnk" href="/?advanced=1">Advanced mode</a>
   <button class="btn" onclick="load()">Refresh</button>
   <div class="user" id="user" title="Account"><span class="av" id="av">·</span><span class="nm" id="org">…</span></div>
 </header>
@@ -238,7 +226,12 @@ body.immersive #stage{display:block}
     <button class="mini" onclick="bulk('deleted')">Delete</button>
     <button class="mini" onclick="clearSel()">Cancel</button>
   </div>
-  <section id="templates" hidden><div class="grid" id="tgall"></div></section>
+  <section id="templates" hidden>
+    <div class="sec-l">Your templates</div>
+    <div class="tgrid" id="orgtmpl"></div>
+    <div class="sec-l">Start from a kind</div>
+    <div class="grid" id="tgall"></div>
+  </section>
   <section id="pipelines" hidden><div class="grid" id="wfgrid"></div></section>
   <section id="runs" hidden>
     <div id="qhead" class="qhead"></div>
@@ -290,6 +283,7 @@ body.immersive #stage{display:block}
   <div class="row" style="justify-content:flex-end;margin-top:14px;gap:6px">
     <button class="mini" id="ctxcancel" onclick="cancelCtx()" style="display:none">✕ Cancel job</button>
     <button class="mini" id="ctxedit" onclick="editCtx()" style="display:none">✎ Edit</button>
+    <button class="mini" id="ctxeditor" onclick="editorCtx()" title="Load this graph into the node editor" style="display:none">⇄ Open in Editor</button>
     <button class="mini" id="ctxreuse" onclick="reuseCtx()" title="Open Fix primed with this prompt + references">↻ Reuse context</button>
     <button class="mini hot" id="ctxfix" onclick="fixCtx()">Fix this version</button>
   </div>
@@ -335,7 +329,26 @@ const thumbURL=a=>`/v1/library/file?thumb=1&path=${encodeURIComponent(a.path)}`;
 function tcard(x){return `<div class="tcard" onclick="pickTemplate('${x.k}','${x.t.replace(/'/g,"")}')"><div class="ic">${x.ic}</div><div class="tl">${x.t}</div><div class="td">${x.d}</div></div>`;}
 function tab(name){document.querySelectorAll('.tabs button').forEach(b=>b.classList.toggle('on',b.dataset.tab===name));
   for(const s of ['assets','templates','pipelines','runs'])$(s).hidden=s!==name;
-  if(name==='runs')runs(); if(name==='pipelines')pipes();}
+  if(name==='runs')runs(); if(name==='pipelines')pipes(); if(name==='templates')loadOrgTemplates();}
+// ── Org templates: saved graphs, Open in Editor + Render (the ONE dispatch path) ──
+async function loadOrgTemplates(){
+  let d={templates:[]}; try{d=await (await fetch('/v1/templates')).json();}catch(_){}
+  const ts=d.templates||[];
+  $('orgtmpl').innerHTML=ts.length?ts.map(t=>{const nm=(t.name||t.slug).replace(/</g,'&lt;'),ne=(t.name||t.slug).replace(/'/g,"\\'");
+    return `<div class="tcard"><div class="ic">★</div><div class="tl">${nm}</div>
+      <div class="td">${t.ts?new Date(t.ts*1000).toLocaleDateString():''}</div>
+      <div class="row" style="padding:0 11px 11px;gap:6px">
+        <a class="mini" href="/?advanced=1&template=${encodeURIComponent(t.slug)}">Open in Editor</a>
+        ${t.renderable?`<button class="mini hot" onclick="renderTemplate('${t.slug}','${ne}')">Render</button>`:''}
+      </div></div>`;}).join(''):'<div class="empty" style="grid-column:1/-1;padding:20px">No templates yet. In the Editor, build a graph and click ★ Template to save one.</div>';
+}
+async function renderTemplate(slug,name){
+  toast('Queueing '+name+'…');
+  const r=await fetch('/v1/templates/render',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({name:slug})});
+  const j=await r.json().catch(()=>({}));
+  toast(r.ok?'Render queued → see Queue & History':'Failed: '+(errMsg(j)||('error '+r.status)));
+}
+function editorCtx(){ if(CTX&&CTX.id)location.href='/?advanced=1&load='+encodeURIComponent(CTX.id); }
 function pickTemplate(k,t){$('tmpl').textContent=t; tab('assets'); $('pin').focus(); toast('Template: '+t);}
 function pickPreset(){toast('Design systems / presets — coming in the preset library');}
 function create(){const p=$('pin').value.trim(); const t=$('tmpl').textContent;
@@ -589,6 +602,7 @@ async function openContext(id){
   $('ctxfix').style.display=hasBase?'':'none';
   $('ctxcancel').style.display=live?'':'none';
   $('ctxedit').style.display=live?'':'none';
+  $('ctxeditor').style.display=(it.output&&it.id&&!String(it.id).startsWith('failed-'))?'':'none';
   $('ctxdlg').showModal();
 }
 function cancelCtx(){ if(!CTX)return; ctxdlg.close(); cancelJob(CTX.id); }
@@ -596,7 +610,7 @@ function editCtx(){ if(!CTX)return; ctxdlg.close(); openAmend(CTX.id); }
 async function openLineage(path){
   CTX={output:path,parents:[],refs:[],uploads:[],prompt:'',kind:'asset',status:''};
   $('ctxtitle').textContent='Versions'; $('ctxbody').innerHTML=ctxHTML(CTX, await lineageFor(path));
-  $('ctxreuse').style.display='none'; $('ctxfix').style.display=''; $('ctxdlg').showModal();
+  $('ctxreuse').style.display='none'; $('ctxfix').style.display=''; $('ctxeditor').style.display='none'; $('ctxdlg').showModal();
 }
 function openLibItem(path){ ctxdlg.close(); zoom(imgURL({path})); }
 async function primeFix(base,prompt,libRefs,upRefs){
@@ -672,10 +686,15 @@ async function toggleFav(key,title){const cur=RATINGS[key]||{};const nv=!cur.fav
   else runs();
 }
 async function saveTemplate(){const nm=$('tmplname').value.trim();if(!nm){toast('Name the template');return;}
-  // Real save lands with the studio-app template store (HIP-0506 phase 3); for now
-  // persist intent on the rating entry so it's not lost and surfaces the guided flow.
-  await fetch('/v1/library/rate',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({key:FAVKEY,notes:'TEMPLATE: '+nm+' — '+$('tmpldesc').value})});
-  $('tmpldlg').close();toast('★ Saved "'+nm+'" — it will appear under Templates');runs();
+  // Real save: the favorited run's graph is embedded in its output (fetched via
+  // /v1/workflow by the run's id) → POST /v1/templates, the ONE template store the
+  // Editor's ★ Template also writes to.
+  let g=null; try{const wr=await fetch('/v1/workflow?id='+encodeURIComponent(FAVKEY)); if(wr.ok)g=(await wr.json()).graph;}catch(_){}
+  if(!g){$('tmpldlg').close();toast('No graph on this run — open it in the Editor and use ★ Template');return;}
+  const r=await fetch('/v1/templates',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({name:nm,graph:g})});
+  const j=await r.json().catch(()=>({}));
+  $('tmpldlg').close();toast(r.ok?('★ Saved "'+nm+'" — see Templates'):('Failed: '+(errMsg(j)||('error '+r.status))));
+  if(r.ok&&!$('templates').hidden)loadOrgTemplates();
 }
 async function setSt(i,status){const a=DATA.assets[i];const r=await fetch('/v1/library/status',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path:a.path,status})});if(r.ok){a.status=status;render();toast(`${a.path.split('/').pop()} → ${status}`);}else toast('Failed');}
 // Optimistic trash: mark deleted locally + re-render immediately (feels instant),

middleware/studio_home.py

@@ -49,6 +49,7 @@ from middleware import worklog
 log = logging.getLogger("studio.home")
 
 _HTML = Path(__file__).with_name("studio_home.html")
+_ASSET_DIR = Path(__file__).parent
 _STATUSES = ("draft", "approved", "queued", "published", "deleted")
 _PROV_CACHE: dict[str, tuple[float, dict]] = {}  # abspath -> (mtime, provenance)
 
@@ -589,6 +590,94 @@ async def home_redirect(request: web.Request, handler):
     return await handler(request)
 
 
+# ── Shared shell: the ONE chrome (Studio/Editor toggle, wallet, GPUs, chat
+# sidebar) loaded by BOTH views. The Studio home <script>-includes it; the Editor
+# gets it injected into the engine's index.html by server.get_root. ──────────────
+_SHELL_HEAD = '<link rel="stylesheet" href="/studio/shell.css">'
+_SHELL_BODY = '<script src="/studio/shell.js" defer></script>'
+
+
+def _asset(name: str, ctype: str) -> web.Response:
+    """Serve a shell asset. no-store like the SPA HTML — it changes every release."""
+    return web.Response(text=(_ASSET_DIR / name).read_text(), content_type=ctype,
+                        headers={"Cache-Control": "no-store, must-revalidate"})
+
+
+def editor_index(web_root: str) -> web.Response:
+    """The engine's index.html with the shared shell injected — the ONE mechanism
+    the Editor picks up the Studio/Editor toggle, wallet, GPUs and chat sidebar, the
+    same chrome the Studio home includes. Idempotent; no-cache like the upstream
+    root handler (the frontend changes every release)."""
+    html = Path(web_root, "index.html").read_text()
+    if "/studio/shell.js" not in html:
+        html = html.replace("</head>", _SHELL_HEAD + "</head>", 1) if "</head>" in html else _SHELL_HEAD + html
+        html = html.replace("</body>", _SHELL_BODY + "</body>", 1) if "</body>" in html else html + _SHELL_BODY
+    return web.Response(text=html, content_type="text/html",
+                        headers={"Cache-Control": "no-cache", "Pragma": "no-cache", "Expires": "0"})
+
+
+def _templates_root(org: str) -> Path:
+    """orgs/<org>/templates — a per-org sibling of the output tree that holds
+    library.json/worklog.json, so templates are tenant-scoped exactly like every
+    other per-org file. Created on demand."""
+    out = Path(folder_paths.get_org_output_directory(org))
+    base = out.parent if out.parent.name == org else out
+    d = base / "templates"
+    d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def _template_slug(name: str) -> str:
+    return re.sub(r"[^a-z0-9]+", "-", (name or "").lower()).strip("-")[:60]
+
+
+def _template_api_prompt(graph) -> dict | None:
+    """The runnable API prompt inside a stored template graph. A graph saved from the
+    Editor is ``{workflow, output}`` (output = API prompt); one captured from an
+    output PNG is a bare API prompt (numeric ids -> {class_type, inputs}). A UI-only
+    graph has neither and can't be queued headless — returns None so the caller says
+    so instead of dispatching nothing."""
+    if not isinstance(graph, dict) or not graph:
+        return None
+    out = graph.get("output")
+    if isinstance(out, dict) and out:
+        return out
+    if all(isinstance(v, dict) and "class_type" in v for v in graph.values()):
+        return graph
+    return None
+
+
+async def _finance_balance(tok: str) -> dict | None:
+    """Raw cloud finance balance for the caller's IAM token, or None on any failure.
+    The token scopes the org server-side (cloud pins org from the verified owner
+    claim), so this read is inherently tenant-isolated."""
+    from middleware.gpu_dispatch import CLOUD
+    try:
+        async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=10)) as s:
+            async with s.get(f"{CLOUD}/v1/finance/balance", headers={"Authorization": tok}) as r:
+                return await r.json() if r.status == 200 else None
+    except Exception:
+        return None
+
+
+async def _wallet(request: web.Request, org: str) -> dict:
+    """{org, balance, currency} for the wallet chip — a display-only proxy. Balance
+    is the spendable dollar amount (availableCents/100); None when signed-out or the
+    cloud is unreachable (the chip shows '—', never a fabricated number)."""
+    from middleware.gpu_dispatch import _bearer
+    out = {"org": org, "balance": None, "currency": None}
+    tok = _bearer(request)
+    if not tok:
+        return out
+    b = await _finance_balance(tok)
+    if isinstance(b, dict):
+        cents = b.get("availableCents")
+        if isinstance(cents, (int, float)):
+            out["balance"] = round(cents / 100, 2)
+        out["currency"] = b.get("currency") or "usd"
+    return out
+
+
 def add_studio_home_routes(routes: web.RouteTableDef, server) -> None:
 
     @routes.get("/studio")
@@ -601,6 +690,136 @@ def add_studio_home_routes(routes: web.RouteTableDef, server) -> None:
         return web.Response(text=_HTML.read_text(), content_type="text/html",
                             headers={"Cache-Control": "no-store, must-revalidate"})
 
+    @routes.get("/studio/shell.js")
+    async def shell_js(request: web.Request):
+        return _asset("shell.js", "text/javascript")
+
+    @routes.get("/studio/shell.css")
+    async def shell_css(request: web.Request):
+        return _asset("shell.css", "text/css")
+
+    @routes.get("/v1/workflow")
+    async def get_workflow(request: web.Request):
+        """The graph that produced a work-log item, for 'Open in Editor'. Tenant-
+        scoped: the id must be in THIS org's work log or it 404s (a cross-tenant id
+        is never confirmed). The graph is read from the item's output PNG, which
+        embeds the litegraph 'workflow' (UI) and/or the API 'prompt'."""
+        org = _org_of(request)
+        pid = request.query.get("id", "")
+        row = next((r for r in worklog.load(org) if r.get("id") == pid), None)
+        if row is None:
+            return web.json_response({"error": "not found"}, status=404)
+        root = _library_root(org)
+        landed = _landed_output(root, row.get("output_prefix"))
+        p = _safe_asset(root, landed) if (root and landed) else None
+        if p is None or p.suffix.lower() != ".png":
+            return web.json_response({"error": "workflow not available yet"}, status=404)
+        try:
+            from PIL import Image
+            info = Image.open(p).info
+        except Exception:
+            info = {}
+        for key, fmt in (("workflow", "ui"), ("prompt", "api")):
+            try:
+                g = json.loads(info.get(key, "null"))
+            except Exception:
+                g = None
+            if isinstance(g, dict) and g:
+                return web.json_response({"id": pid, "format": fmt, "graph": g})
+        return web.json_response({"error": "no embedded workflow in this output"}, status=422)
+
+    @routes.post("/v1/templates")
+    async def save_template(request: web.Request):
+        """Save a workflow graph as an org template (orgs/<org>/templates/<slug>.json,
+        atomic tmp+replace like the work log). Server-resolved org — a template is
+        only ever written to, and read from, the caller's own tenant tree."""
+        try:
+            body = await request.json()
+        except Exception:
+            return web.json_response({"error": "invalid JSON"}, status=400)
+        name = (body.get("name") or "").strip()
+        graph = body.get("graph")
+        slug = _template_slug(name)
+        if not slug:
+            return web.json_response({"error": "name required"}, status=400)
+        if not isinstance(graph, dict) or not graph:
+            return web.json_response({"error": "graph required"}, status=400)
+        rec = {"name": name, "slug": slug, "graph": graph, "ts": int(time.time())}
+        d = _templates_root(_org_of(request))
+        tmp = d / (slug + ".json.tmp")
+        tmp.write_text(json.dumps(rec))
+        tmp.replace(d / (slug + ".json"))
+        return web.json_response({"ok": True, "name": name, "slug": slug})
+
+    @routes.get("/v1/templates")
+    async def list_templates(request: web.Request):
+        org = _org_of(request)
+        out = []
+        for f in sorted(_templates_root(org).glob("*.json")):
+            try:
+                rec = json.loads(f.read_text())
+            except Exception:
+                continue
+            out.append({"name": rec.get("name") or f.stem, "slug": rec.get("slug") or f.stem,
+                        "ts": rec.get("ts", 0),
+                        "renderable": _template_api_prompt(rec.get("graph")) is not None})
+        return web.json_response({"org": org, "templates": out})
+
+    @routes.post("/v1/templates/render")
+    async def render_template(request: web.Request):
+        """Queue a saved template through the ONE dispatch funnel (reseeded); its
+        output lands in the library via the manifest sidecar — no new path. A
+        UI-only graph can't run headless, so it's rejected with a clear reason."""
+        try:
+            body = await request.json()
+        except Exception:
+            return web.json_response({"error": "invalid JSON"}, status=400)
+        org = _org_of(request)
+        slug = _template_slug(body.get("name", ""))
+        f = _templates_root(org) / (slug + ".json")
+        if not slug or not f.is_file():
+            return web.json_response({"error": "not found"}, status=404)
+        try:
+            rec = json.loads(f.read_text())
+        except Exception:
+            return web.json_response({"error": "corrupt template"}, status=422)
+        prompt = _template_api_prompt(rec.get("graph"))
+        if prompt is None:
+            return web.json_response(
+                {"error": "this template has no runnable graph — open it in the Editor to run"}, status=422)
+        out_prefix = ""
+        for n in prompt.values():
+            if isinstance(n, dict) and n.get("class_type") == "SaveImage":
+                out_prefix = n.get("inputs", {}).get("filename_prefix", "") or out_prefix
+        out_prefix = out_prefix or f"templates/{slug}"
+        try:
+            pid = await _dispatch(request, server, org, _reseed(json.loads(json.dumps(prompt))),
+                                  kind="template", prompt=rec.get("name", slug), refs=[], uploads=[],
+                                  parents=[], output_prefix=out_prefix)
+        except DispatchError as e:
+            return web.json_response({"error": str(e)}, status=400)
+        return web.json_response({"ok": True, "prompt_id": pid, "slug": slug})
+
+    @routes.get("/v1/templates/{name}")
+    async def get_template(request: web.Request):
+        org = _org_of(request)
+        slug = _template_slug(request.match_info.get("name", ""))
+        f = _templates_root(org) / (slug + ".json")
+        if not slug or not f.is_file():
+            return web.json_response({"error": "not found"}, status=404)
+        try:
+            return web.json_response(json.loads(f.read_text()))
+        except Exception:
+            return web.json_response({"error": "corrupt template"}, status=422)
+
+    @routes.get("/v1/wallet")
+    async def get_wallet(request: web.Request):
+        """The org's wallet balance for the shell chip — a display-only proxy of the
+        user's IAM token to the cloud finance balance. Returns {org, balance,
+        currency}; top-up is a link to pay.hanzo.ai in the UI. No funds move here."""
+        org = _org_of(request)
+        return web.json_response(await _wallet(request, org))
+
     @routes.get("/v1/library")
     async def get_library(request: web.Request):
         org = _org_of(request)

server.py

@@ -435,11 +435,11 @@ class PromptServer():
                             },
                         )
 
-            response = web.FileResponse(os.path.join(self.web_root, "index.html"))
-            response.headers['Cache-Control'] = 'no-cache'
-            response.headers["Pragma"] = "no-cache"
-            response.headers["Expires"] = "0"
-            return response
+            # Serve the editor SPA with the shared Studio shell injected (the ONE
+            # chrome — Studio/Editor toggle, wallet, GPUs, chat sidebar — that the
+            # Studio home also includes). No-cache, same as before.
+            from middleware.studio_home import editor_index
+            return editor_index(self.web_root)
 
         @routes.get("/embeddings")
         def get_embeddings(request):

tests-unit/studio_home_test/test_studio_home.py

@@ -340,3 +340,141 @@ async def test_home_redirect_only_hits_root_html(monkeypatch):
     req = make_mocked_request("GET", "/", headers={"Accept": "text/html"})
     resp = await sh.home_redirect(req, handler)
     assert resp.text == "spa"
+
+
+# ── Shared shell: editor index injection + templates + workflow + wallet ─────────
+async def _client(server, org_middleware=True):
+    """A real aiohttp app with the studio-home routes and a fake-auth middleware that
+    stamps request['iam_user'] from an X-Org header — so route tests exercise the
+    SAME server-side org scoping (_org_of) production uses."""
+    from aiohttp import web
+    from aiohttp.test_utils import TestClient, TestServer
+
+    @web.middleware
+    async def fake_auth(request, handler):
+        o = request.headers.get("X-Org")
+        if o:
+            request["iam_user"] = {"org_id": o, "orgs": [o]}
+        return await handler(request)
+
+    app = web.Application(middlewares=[fake_auth] if org_middleware else [])
+    routes = web.RouteTableDef()
+    sh.add_studio_home_routes(routes, server)
+    app.add_routes(routes)
+    ts = TestServer(app)
+    await ts.start_server()
+    client = TestClient(ts)
+    await client.start_server()
+    return client
+
+
+def test_editor_index_injects_shell_once(tmp_path):
+    root = tmp_path / "web"
+    root.mkdir()
+    (root / "index.html").write_text("<html><head></head><body><div id=app></div></body></html>")
+    resp = sh.editor_index(str(root))
+    assert resp.headers["Cache-Control"] == "no-cache"
+    assert '<link rel="stylesheet" href="/studio/shell.css"></head>' in resp.text
+    assert '<script src="/studio/shell.js" defer></script></body>' in resp.text
+    # idempotent: an index that already carries the shell is served unchanged
+    (root / "index.html").write_text(resp.text)
+    again = sh.editor_index(str(root))
+    assert again.text.count("/studio/shell.js") == 1
+
+
+def test_template_api_prompt_shapes():
+    api = {"9": {"class_type": "KSampler", "inputs": {}}, "15": {"class_type": "SaveImage", "inputs": {}}}
+    assert sh._template_api_prompt({"output": api, "workflow": {"nodes": []}}) == api   # editor save
+    assert sh._template_api_prompt(api) == api                                          # bare API prompt
+    assert sh._template_api_prompt({"nodes": [{"id": 1}], "last_node_id": 1}) is None   # UI-only, not runnable
+    assert sh._template_api_prompt({}) is None and sh._template_api_prompt("x") is None
+    assert sh._template_slug("Karma — Ghost Mannequin!") == "karma-ghost-mannequin"
+
+
+@pytest.mark.asyncio
+async def test_templates_crud_and_tenant_isolation(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    client = await _client(_FakeServer())
+    graph = {"output": {"15": {"class_type": "SaveImage", "inputs": {"filename_prefix": "t/x"}}}}
+    r = await client.post("/v1/templates", json={"name": "Ghost Mannequin", "graph": graph}, headers={"X-Org": "acme"})
+    assert r.status == 200 and (await r.json())["slug"] == "ghost-mannequin"
+    # acme sees it (renderable — the graph carries an API prompt), fetches it by slug
+    r = await client.get("/v1/templates", headers={"X-Org": "acme"})
+    body = await r.json()
+    assert body["org"] == "acme" and len(body["templates"]) == 1
+    assert body["templates"][0]["name"] == "Ghost Mannequin" and body["templates"][0]["renderable"] is True
+    r = await client.get("/v1/templates/ghost-mannequin", headers={"X-Org": "acme"})
+    assert (await r.json())["graph"] == graph
+    # tenant isolation: globex's list is empty and it can't read acme's template
+    assert (await (await client.get("/v1/templates", headers={"X-Org": "globex"})).json())["templates"] == []
+    assert (await client.get("/v1/templates/ghost-mannequin", headers={"X-Org": "globex"})).status == 404
+    # validation
+    assert (await client.post("/v1/templates", json={"name": "", "graph": graph}, headers={"X-Org": "acme"})).status == 400
+    assert (await client.post("/v1/templates", json={"name": "x", "graph": {}}, headers={"X-Org": "acme"})).status == 400
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_template_render_dispatches_and_rejects_ui_only(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    async def fake_queue(request, server, graph):
+        return "pid-tmpl"
+    monkeypatch.setattr(sh, "_queue_prompt", fake_queue)
+    client = await _client(_FakeServer())
+    runnable = {"output": {"9": {"class_type": "KSampler", "inputs": {"seed": 1}},
+                           "15": {"class_type": "SaveImage", "inputs": {"filename_prefix": "t/run"}}}}
+    await client.post("/v1/templates", json={"name": "Run Me", "graph": runnable}, headers={"X-Org": "acme"})
+    r = await client.post("/v1/templates/render", json={"name": "run-me"}, headers={"X-Org": "acme"})
+    assert r.status == 200 and (await r.json())["prompt_id"] == "pid-tmpl"
+    assert sh.worklog.load("acme")[-1]["kind"] == "template"     # went through the ONE funnel
+    # UI-only graph can't run headless -> 422 with a reason, not a silent dispatch
+    await client.post("/v1/templates", json={"name": "UI Only", "graph": {"nodes": [], "last_node_id": 0}}, headers={"X-Org": "acme"})
+    assert (await client.post("/v1/templates/render", json={"name": "ui-only"}, headers={"X-Org": "acme"})).status == 422
+    # cross-tenant render: globex has no such template -> 404
+    assert (await client.post("/v1/templates/render", json={"name": "run-me"}, headers={"X-Org": "globex"})).status == 404
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_workflow_reads_embedded_graph_tenant_scoped(tmp_path, monkeypatch):
+    from PIL import Image
+    from PIL.PngImagePlugin import PngInfo
+    _orgaware(tmp_path, monkeypatch)
+    root = Path(sh.folder_paths.get_org_output_directory("acme"))
+    (root / "library.json").write_text('{"assets":[]}')
+    (root / "fixes").mkdir(parents=True, exist_ok=True)
+    info = PngInfo()
+    ui = {"nodes": [{"id": 1, "type": "SaveImage"}], "last_node_id": 1}
+    info.add_text("workflow", json.dumps(ui))
+    info.add_text("prompt", json.dumps({"1": {"class_type": "SaveImage", "inputs": {"filename_prefix": "fixes/x"}}}))
+    Image.new("RGB", (4, 4)).save(root / "fixes" / "x_00001_.png", "PNG", pnginfo=info)
+    sh.worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                      output_prefix="fixes/x", pid="p1")
+    sh.worklog.record("acme", kind="fix", prompt="pending", refs=[], uploads=[], parents=[],
+                      output_prefix="fixes/nope", pid="p2")
+    client = await _client(_FakeServer())
+    r = await client.get("/v1/workflow?id=p1", headers={"X-Org": "acme"})
+    body = await r.json()
+    assert r.status == 200 and body["format"] == "ui" and body["graph"] == ui   # UI graph preferred
+    # not landed yet -> 404 (no graph to open)
+    assert (await client.get("/v1/workflow?id=p2", headers={"X-Org": "acme"})).status == 404
+    # cross-tenant id is never confirmed -> 404
+    assert (await client.get("/v1/workflow?id=p1", headers={"X-Org": "globex"})).status == 404
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_wallet_proxies_and_scopes_org(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    async def fake_balance(tok):
+        assert tok == "Bearer tkn"
+        return {"availableCents": 2500, "currency": "usd", "pendingCents": 0}
+    monkeypatch.setattr(sh, "_finance_balance", fake_balance)
+    client = await _client(_FakeServer())
+    r = await client.get("/v1/wallet", headers={"X-Org": "acme", "Authorization": "Bearer tkn"})
+    body = await r.json()
+    assert body == {"org": "acme", "balance": 25.0, "currency": "usd"}
+    # signed-out (no bearer): display-only null balance, never a fabricated number
+    r = await client.get("/v1/wallet", headers={"X-Org": "acme"})
+    assert await r.json() == {"org": "acme", "balance": None, "currency": None}
+    await client.close()