Theseus: https:// scheme for BCDN + segmented-toggle registry switcher

BCDN pages now show https:// in the address bar (was bare 'host/', briefly bns://).
Rationale: BCNR replaces DNS (name resolution), NOT HTTP. Under the hood the
delivery IS HTTPS for s3/ip/p records; the on-chain h record has no transport
at all, but https:// is the least-surprising display. BCDN/ICANN badge is the
sole source-of-truth for which registry served us; scheme stays a convention.

Registry chip is now a proper segmented control:
- Two-chip toggle (collision candidates): single rounded pill, split in half
  with a divider — active side filled (acid green for BCDN, blue for ICANN),
  inactive side transparent + clickable. Feels like an on/off toggle.
- Single chip (pure ICANN or BCNR-unique TLD): standalone pill in the
  registry's colour. No toggle affordance since there's no alternative.

Same acid-glow-green (#d6ff3d) and blue (#4c9eff) as the collision.html prompt
so the whole registry palette is consistent across chrome + interstitial.

chrome.html

@@ -72,17 +72,26 @@
   .secbadge.warn     { color: #f6ad55; } /* kept for legacy call sites */
   input { padding: 7px 6px; border-radius: 999px; border: none; background: transparent; color: inherit; font-size: 13.5px; outline: none; }
   #url { flex: 1; }
-  /* registry toggle at the END of the address bar — one or two chips */
-  #reg { display: inline-flex; gap: 4px; align-items: center; }
-  .reg { font-size: 10.5px; letter-spacing: .03em; padding: 2px 9px; border-radius: 999px; white-space: nowrap;
-         cursor: default; user-select: none; transition: opacity .15s, background .15s, color .15s, border-color .15s; }
-  /* Active BCDN — acid glow green */
-  .reg.bcdn.active  { background: rgba(214,255,61,.15); color: #d6ff3d; border: 1px solid #d6ff3d55; }
-  /* Active ICANN — blue */
-  .reg.icann.active { background: rgba(76,158,255,.15); color: #4c9eff; border: 1px solid #4c9eff55; }
-  /* Inactive chip in the toggle — greyed, clickable to switch */
-  .reg.switch { background: transparent; color: #6b7280; border: 1px solid #ffffff1c; cursor: pointer; }
-  .reg.switch:hover { color: #b9c2d0; border-color: #ffffff33; }
+  /* Registry indicator at the END of the address bar. Two shapes:
+     - Toggle (segmented control) when this host could be served by EITHER
+       registry — a single pill split in half, active side filled, inactive
+       side transparent and clickable to switch.
+     - Single pill when there's no alternative (pure ICANN or a BCNR-unique TLD).*/
+  #reg { display: inline-flex; align-items: center; }
+  .reg { font-size: 10.5px; letter-spacing: .03em; padding: 2px 10px; white-space: nowrap;
+         cursor: default; user-select: none; transition: background .12s, color .12s, border-color .12s; }
+  /* Single-chip form (non-collision hosts) */
+  .reg.single { border-radius: 999px; border: 1px solid; }
+  .reg.single.bcdn.active  { background: rgba(214,255,61,.15); color: #d6ff3d; border-color: #d6ff3d55; }
+  .reg.single.icann.active { background: rgba(76,158,255,.15); color: #4c9eff; border-color: #4c9eff55; }
+  /* Toggle (segmented control) form for collision candidates */
+  .tog { display: inline-flex; border-radius: 999px; overflow: hidden; border: 1px solid #ffffff26; }
+  .tog .reg { border: 0; }
+  .tog .reg + .reg { border-left: 1px solid #ffffff26; }
+  .tog .reg.active.bcdn  { background: rgba(214,255,61,.18); color: #d6ff3d; }
+  .tog .reg.active.icann { background: rgba(76,158,255,.18); color: #4c9eff; }
+  .tog .reg.switch { background: transparent; color: #7b8494; cursor: pointer; }
+  .tog .reg.switch:hover { color: #e5e7eb; background: rgba(255,255,255,.05); }
   .star { border: none; background: transparent; cursor: pointer; color: var(--dim); font-size: 15px; padding: 2px 4px; border-radius: 6px; }
   .star:hover { background: var(--line2); color: var(--ink); } .star.on { color: #ffd23d; }
   /* search box: engine icon (click = pick engine) + a wide typing area */
@@ -296,14 +305,14 @@
     if (isCand) {
       const bcdn  = `<span class="reg bcdn ${active === "bcdn"  ? "active" : "switch"}" data-c="bcdn"  title="${active === "bcdn"  ? "Serving from BCDN"  : "Switch to BCDN"}">BCDN</span>`;
       const icann = `<span class="reg icann ${active === "icann" ? "active" : "switch"}" data-c="icann" title="${active === "icann" ? "Serving from ICANN" : "Switch to ICANN"}">ICANN</span>`;
-      r.innerHTML = bcdn + icann;
+      r.innerHTML = `<span class="tog">${bcdn}${icann}</span>`;
       for (const chip of r.querySelectorAll(".reg.switch")) {
         chip.onclick = () => T.collisionSwitch({ choice: chip.dataset.c, remember: "no" });
       }
     } else if (d.kind === "web") {
-      r.innerHTML = `<span class="reg icann active">ICANN</span>`;
+      r.innerHTML = `<span class="reg single icann active">ICANN</span>`;
     } else {
-      r.innerHTML = `<span class="reg bcdn active">BCDN</span>`;
+      r.innerHTML = `<span class="reg single bcdn active">BCDN</span>`;
     }
   }
 

main.js

@@ -954,7 +954,14 @@ async function loadBns(t, id, host, rest, tld) {
   let entry;
   try { entry = await resolveHost(host); }
   catch { setLoading(t, false); return fallbackToWeb("BCNR unreachable"); }
-  t.url = host + (rest === "/" ? "" : rest);
+  // Address-bar display: show https:// even for BCDN sites. Rationale — BCNR
+  // replaces DNS (name resolution), NOT HTTP (transport). For s3/ip/p records
+  // the actual delivery IS HTTPS under the hood; for h records the content is
+  // on-chain (no HTTP at all, but https:// is the least surprising display).
+  // The BCDN/ICANN badge is the source-of-truth for which registry served us;
+  // the URL scheme is a convention, kept consistent so users' muscle memory
+  // holds. (bns:// is an internal Electron protocol implementation detail.)
+  t.url = "https://" + host + (rest === "/" ? "" : rest);
   if (!entry) { setLoading(t, false); return fallbackToWeb("no BCNR record"); }
 
   // ---- Collision policy (BCNR ↔ ICANN) --------------------------------------
@@ -1038,7 +1045,7 @@ ipcMain.handle("collision-switch", async (_e, arg) => {
       await t.view.webContents.loadURL(t.url);
       t.prov = { host, kind: "web", note: "switched to ICANN", tld, registry };
     } else {
-      t.url = host + "/";
+      t.url = "https://" + host + "/";   // display: https://; internal fetch: bns://
       await t.view.webContents.loadURL(`bns://${host}/`);
       const rec = entries.get(host);
       const r = rec?.entry?.records || {};