docs: record the deck-store decision and the layout-picker upstream PR

README.md

@@ -109,5 +109,6 @@ Offered to `nyblnet/bento` from this fork. Bodies live in `docs/upstream-prs/`.
 
 - `AppConfig` lift: `publicKeyJwk` and `syncHost` as optional per-app config. Branch `upstream-pr/appconfig-lift`, open as [nyblnet/bento#423](https://github.com/nyblnet/bento/pull/423).
 - `embed` element, consumer side in slides, to the `bento/embed` shape. Branch `upstream-pr/embed-consumer`, open as [nyblnet/bento#424](https://github.com/nyblnet/bento/pull/424).
+- Layout picker clamped to the viewport (the fork's #12). Branch `upstream-pr/layout-picker-clamp`, open as [nyblnet/bento#425](https://github.com/nyblnet/bento/pull/425).
 
 Both were opened from Johan's GitHub account on 2026-09-08 at his instruction. The branches carry no agent attribution trailers (upstream's hard rule 8); whether upstream accepts them under its rule 10 is upstream's call.

docs/DECISIONS.md

@@ -6390,3 +6390,27 @@ chance to run and it is cheap. Reconciliation for this cycle: 41 commits, 40
 mapped, 1 correctly absent, run by bento-team-slides.
 
 Claude-Session: https://claude.ai/code/session_01Jcfdy8A69nonyATtm8vRy8
+
+## 2026-09-08 — BETA FORK: Beta-internal deck hosting is in; client hosting stays out
+
+The v1 fork plan (`docs/plans/2026-09-08-001-feat-beta-slides-bento-fork-plan.md`)
+listed "hosting decks behind a Beta login" as outside the product's identity:
+sharing is the file, or the `publish` pipeline. The 2026-09-08 review of
+release 2026.9.1 reversed that for Beta-internal use only, and Johan confirmed
+it. The reason is what the review showed: a deck reaches a colleague only as
+an attachment, because nothing gives it a link or a home. Upstream's model,
+the file as the invitation and a blind relay for live edits, is kept intact;
+the gap was storage and addressing, not collaboration.
+
+The store (`server/deck-store/`, `decks.betamobility.ai`) holds decks as their
+owner saved them and serves them byte for byte behind Cloudflare Access for
+`@betamobility.io` identities. It never rewrites, indexes or decrypts a deck;
+that is `bento/vault`'s territory upstream and Beta tracks it rather than
+building it. Two consequences are accepted on the same basis as Beta's other
+internal tools, that every writer is a signed-in colleague: a stored deck
+carries `ownerPriv`, so store access is owner access on its live session; and
+a script inside any stored deck runs first-party on the store origin. Client
+decks still travel as a read-only file or through `publish`; a store that
+admits a non-Beta writer is a different product and reopens this entry.
+
+Plan of record: `docs/plans/2026-09-08-002-feat-beta-slides-v1-1-plan.md`.

docs/upstream-prs/layout-picker-clamp.md

@@ -0,0 +1,21 @@
+# Upstream PR: keep the layout picker inside the viewport
+
+**Branch:** `upstream-pr/layout-picker-clamp` (cherry-picked from the fork's #12 onto `upstream/main`, `slides/src/editor/editor.ts` and `slides/src/styles.css` only, no attribution trailers)
+**Target:** `nyblnet/bento` `main`
+**Status:** open as [nyblnet/bento#425](https://github.com/nyblnet/bento/pull/425), from Johan's account, 2026-09-08, per his decision in the v1.1 plan (fix in the fork, offer upstream afterwards).
+
+## What it fixes
+
+The New-slide button at the bottom of the sidebar opened the layout picker upward from itself. Once a deck carries a few custom layouts the picker is taller than the space above the button and its top lands above the viewport: measured top = −7 px at a 600 px-tall window, with the first row of thumbnails clipped under the topbar. Beta hit it because every Beta template carries six layouts.
+
+Every anchor now opens beside itself, clamped on-screen. The picker is appended first so the clamp uses its real height, and `.ed-layoutpick` caps at `calc(100vh - 16px)` (it already scrolls) so very short windows scroll inside the picker instead of losing rows.
+
+## Measured
+
+| Case | Before | After |
+|---|---|---|
+| Add button, 1280×600 | top −7, first row clipped | top 150, bottom 592, six layouts, no internal scroll |
+| Add button, 1280×400 | not measured | top 8, bottom 392, scrolls internally |
+| Insert gap, 1280×600 | not measured | inside the viewport |
+
+The insert-gap and panel anchors keep their placement; only the clamp floor changes from a fixed 460 px to the measured height. Screenshots were taken through Playwright on the built shell; the fork's `docs/plans/2026-09-08-002-feat-beta-slides-v1-1-plan.md` U4 carries the scenarios.