@bongos/core 1.18.19 → 1.19.2

package/modules/hall-ui/public/people.js

@@ -0,0 +1,100 @@
+// people.js — the People page: the /scouting cross-project builder directory
+// graduated into the hall (task 1002577; ADR 0141 §4 is the data's design of
+// record). Same data endpoint as scouting.js — /api/gds/scouting, Archon-gated
+// server-side ('project.curate'); the page itself is gated in serve-internal.js
+// on that exact permission, so a visitor without it never sees this shell. The
+// hall chrome + kit primitives are what "graduate" means: searchable, paged,
+// shell-navigable — spec R14 (goal 1000045) later widens WHO sees it, not this.
+// All network values render through OTBKit.esc — never raw innerHTML.
+(function () {
+  'use strict';
+  var kit = window.OTBKit;
+  var esc = kit.esc;
+  var body = document.getElementById('people-body');
+
+  function fmtRecency(iso) {
+    if (!iso) return '—';
+    var t = Date.parse(iso);
+    if (isNaN(t)) return '—';
+    var days = Math.floor((Date.now() - t) / 86400000);
+    if (days <= 0) return 'today';
+    if (days === 1) return '1 day ago';
+    if (days < 30) return days + ' days ago';
+    return Math.floor(days / 30) + ' mo ago';
+  }
+
+  function builderName(b) {
+    return b.github_login || b.display_name || ('#' + b.github_id);
+  }
+
+  var all = [];
+  var query = '';
+
+  function matches(b) {
+    if (!query) return true;
+    var hay = (builderName(b) + ' ' + (b.display_name || '') + ' ' +
+      (Array.isArray(b.disciplines) ? b.disciplines.join(' ') : '')).toLowerCase();
+    return hay.indexOf(query) !== -1;
+  }
+
+  var pager = kit.makePager('people', 'hall-people-per-page');
+  var ledger = null;
+
+  function rowHtml(b) {
+    return '<tr>' +
+      '<td><span class="who">' + esc(builderName(b)) + '</span></td>' +
+      '<td class="num">' + esc(b.project_count != null ? b.project_count : '—') + '</td>' +
+      '<td class="num">' + esc(b.total_credits != null ? b.total_credits : 0) + '</td>' +
+      '<td class="num">' + esc(b.total_tasks_shipped != null ? b.total_tasks_shipped : 0) + '</td>' +
+      '<td class="num">' + esc(b.total_karma != null ? b.total_karma : 0) + '</td>' +
+      '<td>' + esc(Array.isArray(b.disciplines) ? b.disciplines.join(', ') : '—') + '</td>' +
+      '<td>' + esc(fmtRecency(b.last_active)) + '</td>' +
+      '</tr>';
+  }
+
+  function rerender() {
+    if (ledger) ledger.render(all.filter(matches));
+  }
+
+  function mountDirectory(builders) {
+    all = Array.isArray(builders) ? builders : [];
+    kit.makeFilterBar({
+      mount: document.getElementById('people-filters'),
+      search: { id: 'people-q', label: 'Search', placeholder: 'name or discipline' },
+      onChange: function (vals) {
+        query = String(vals['people-q'] || '').trim().toLowerCase();
+        pager.page = 1;
+        rerender();
+      },
+    });
+    body.textContent = '';
+    ledger = kit.makeLedger({
+      mount: body,
+      columns: ['Builder', { label: 'Projects', class: 'num' }, { label: 'Credits', class: 'num' },
+        { label: 'Ships', class: 'num' }, { label: 'Karma', class: 'num' }, 'Disciplines', 'Last active'],
+      rowHtml: rowHtml,
+      emptyMsg: 'No cross-project activity reported yet.',
+      pager: pager,
+    });
+    rerender();
+  }
+
+  function notice(msg) {
+    body.innerHTML = '';
+    body.className = 'note';
+    body.textContent = msg;
+  }
+
+  fetch('/api/gds/scouting?limit=500', { headers: { Accept: 'application/json' } })
+    .then(function (r) {
+      if (r.status === 403 || r.status === 401) { throw { gated: true }; }
+      if (!r.ok) throw new Error('http ' + r.status);
+      return r.json();
+    })
+    .then(function (data) { mountDirectory(data && data.builders); })
+    .catch(function (e) {
+      notice(e && e.gated
+        ? 'The builder directory is Archon-only for now.'
+        : 'Couldn’t load the directory right now.');
+    });
+}());

package/modules/hall-ui/public/profile.html

@@ -82,6 +82,7 @@
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
-<script src="/builders/profile.js?v=2026-06-14-domutils"></script>
+<script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
+<script src="/builders/profile.js?v=2026-08-04-reward1"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -131,6 +131,14 @@
     const tbody = $('#works-table tbody');
     const lede = $('#works-lede');
     if (!tbody) return;
+    // Every row here is a shipped task, so one header serves them all — but on a
+    // cost-plus-only instance the figure is still an unpaid estimate, so the
+    // label must keep its "Est." qualifier (ADR 0146).
+    const rewardTh = $('#works-table thead .ledger__drachmae');
+    if (rewardTh) {
+      rewardTh.textContent = window.OTBBranding?.taskCreditLabel?.({ status: 'shipped' }, { caps: true })
+        ?? (curLabel(true) + ' Est.');
+    }
     const list = Array.isArray(ships) ? ships : [];
     if (!list.length) {
       tbody.innerHTML = `<tr><td colspan="4" class="ledger__empty">Nothing shipped yet.</td></tr>`;
@@ -138,9 +146,7 @@
       return;
     }
     tbody.innerHTML = list.map((s) => {
-      // credits_awarded is the actual ledger figure for a shipped task; fall back
-      // to the creation-time estimate only if the awarded figure is absent.
-      const reward = s.credits_awarded != null ? s.credits_awarded : s.credits_reward;
+      const reward = window.OTBBranding?.taskCreditValue?.(s) ?? s.credits_reward;
       const summary = s.value_summary
         ? `<span style="display:block;margin-top:2px;font-size:12px;color:var(--ink-faint)">${escapeHtml(s.value_summary)}</span>`
         : '';

package/modules/hall-ui/public/sessions.js

@@ -208,8 +208,10 @@
       return;
     }
 
-    if (!builder || builder.rank !== 'archon') {
-      showSealed('The session log is available to Archons only. Your current rank does not have access.');
+    // ADR 0157: `session.search` moved archon→metic, so the session log is a
+    // Metic+ surface now. Cosmetic — the route gate is the wall.
+    if (!builder || (builder.rank !== 'metic' && builder.rank !== 'archon')) {
+      showSealed('The session log is available from the Metic rank up. Your current rank does not have access.');
       return;
     }
 

package/modules/hall-ui/public/shell.js

@@ -12,7 +12,7 @@
 //     top bar (drawer toggle, page title, greeting slot) into the static mounts
 //     (#app-sidebar / #app-topbar / #app-foot) every hall page carries;
 //   - rank-gate nav items COSMETICALLY (server-side page gates remain the real
-//     access control — serve-internal.js requireArchonPage etc.);
+//     access control — serve-internal.js requireGovernancePage etc.);
 //   - on the index (body[data-page="home"]) route the three views (#home,
 //     #standing, #leaderboard) plus the #achievements alias into Standing. The
 //     `#/task|idea|blocker/N` deep-link hashes belong to builders.js and are
@@ -78,6 +78,7 @@
     goals: '<circle cx="9" cy="9" r="6.5"/><circle cx="9" cy="9" r="3.5"/><circle cx="9" cy="9" r="0.8" fill="currentColor"/>',
     roadmap: '<path d="M3 15.5V3.5l4 2 4-2 4 2v10l-4-2-4 2-4-2Z"/><path d="M7 3.5v10M11 5.5v10"/>',
     leaderboard: '<path d="M3.5 15.5v-6M9 15.5V3.5m5.5 12v-9"/>',
+    people: '<circle cx="6.5" cy="6.5" r="2.5"/><path d="M2.5 15c.5-2.4 2-3.7 4-3.7s3.5 1.3 4 3.7"/><circle cx="12.5" cy="7" r="2"/><path d="M12 11.5c1.8.1 3 1.3 3.5 3.3"/>',
     docs: '<path d="M4 3.5h7l3 3v10H4v-13Z"/><path d="M11 3.5v3h3"/>',
     settings: '<circle cx="9" cy="9" r="2.5"/><path d="M9 2.5v2m0 9v2M2.5 9h2m9 0h2M4.4 4.4l1.4 1.4m6.4 6.4 1.4 1.4m0-9.2-1.4 1.4M5.8 12.2l-1.4 1.4"/>',
     admin: '<path d="M9 2.5 15 5v4c0 3.5-2.4 6-6 7-3.6-1-6-3.5-6-7V5l6-2.5Z"/>',
@@ -96,10 +97,13 @@
   //   work      — signed, but for newcomers only once the "ship three" stage is
   //               current (mirrors the old #hall-nav-work rule, task #833)
   //   archon    — rank === 'archon'
+  //   governance — rank is metic or archon (ADR 0157): the monitoring/ops pages.
+  //               Mirrors the server's `page.view.governance` floor, which that ADR
+  //               lowered archon→metic. Cosmetic only — requireGovernancePage is the wall.
   // `view` marks an index view (hash-routed); `module` gates on window.__MODULES__.
   // task 2175: grouped by AUDIENCE of the data, so the sidebar reads in coherent
   // runs instead of one long list — the project (unlabeled), You, Community,
-  // Docs, Archon. A group's `gate` must match its most permissive item's, or the
+  // Docs, Governance. A group's `gate` must match its most permissive item's, or the
   // head renders over nothing.
   var NAV = [
     { group: '', items: [
@@ -131,6 +135,12 @@
     ] },
     { group: 'Community', gate: 'member', items: [
       { id: 'leaderboard', label: 'Leaderboard', icon: 'leaderboard', href: '/#leaderboard', view: 'leaderboard', gate: 'member' },
+      // task 1002577: the cross-project builder directory (/scouting graduated
+      // into the hall). Archon-gated to MATCH its data — /api/gds/scouting is
+      // deliberately "NOT shown to builders" (ADR 0141 §4) until spec R14 widens
+      // it; this gate is cosmetic, requireProjectCuratePage is the wall. The
+      // module gate hides the tab on instances without the platform-identity hub.
+      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'archon', module: 'platform-identity' },
     ] },
     { group: 'Docs', gate: 'signed', items: [
       { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'member' },
@@ -150,11 +160,18 @@
       // subdomain — external so the rewrite shim doesn't turn it into /builders/docs.
       { id: 'apidocs', label: 'API docs', icon: 'docs', href: '/docs', gate: 'signed', external: true },
     ] },
-    { group: 'Archon', gate: 'archon', items: [
-      { id: 'watch', label: 'Watch', icon: 'admin', href: '/watch', gate: 'archon' },
-      { id: 'harbor', label: 'Harbor', icon: 'admin', href: '/harbor', gate: 'archon', module: 'dev-box' },
-      { id: 'gate', label: 'Gate', icon: 'admin', href: '/gate', gate: 'archon' },
-      { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'archon' },
+    // Relabeled 'Archon' → 'Governance' in ADR 0157: these pages are no longer
+    // Archon-only, so a group header reading "Archon" over items a Metic can open
+    // would misdescribe the ladder to the builders most likely to be learning it.
+    { group: 'Governance', gate: 'governance', items: [
+      { id: 'watch', label: 'Watch', icon: 'admin', href: '/watch', gate: 'governance' },
+      { id: 'harbor', label: 'Harbor', icon: 'admin', href: '/harbor', gate: 'governance', module: 'dev-box' },
+      { id: 'gate', label: 'Gate', icon: 'admin', href: '/gate', gate: 'governance' },
+      { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'governance' },
+      // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
+      // Archon-only item the 'governance' gate comment anticipated — cosmetic
+      // only; requireGovernanceManagePage (the governance.manage atom) is the wall.
+      { id: 'governance', label: 'Roles', icon: 'admin', href: '/governance', gate: 'archon' },
     ] },
   ];
 
@@ -365,6 +382,10 @@
       case 'member': return member;
       case 'work': return authed && (member || access.showWork);
       case 'archon': return authed && access.rank === 'archon';
+      // ADR 0157: the monitoring/ops pages sit at the `page.view.governance` floor,
+      // which is metic. Kept as its own key rather than widening 'archon', so a
+      // genuinely Archon-only nav item can still be added later.
+      case 'governance': return authed && (access.rank === 'metic' || access.rank === 'archon');
       default: return false;
     }
   }

package/modules/hall-ui/public/task-detail.js

@@ -199,9 +199,12 @@
   function triageError(err, fallback) {
     if (err && err.message === 'redirecting to auth') return null;
     var code = errCode(err);
-    // 'rank_forbidden' is what auth.js requireRank actually emits; the 403 arm
-    // also covers POST /tasks, which is Metic+ for the same reason.
-    if (code === 'rank_forbidden' || (err && err.status === 403)) return 'Only Metic+ can triage ideas.';
+    // 'permission_forbidden' is what requirePermission emits (PATCH /inbox/:id →
+    // idea.triage, POST /tasks → task.create, both migrated in BV1.R105);
+    // 'rank_forbidden' is requireRank's older code, still emitted by the in-handler
+    // walls on these paths (e.g. PATCH /tasks/:id's security_sensitive check). Both
+    // mean the same thing to the reader, and the 403 arm backstops either.
+    if (code === 'permission_forbidden' || code === 'rank_forbidden' || (err && err.status === 403)) return 'Only Metic+ can triage ideas.';
     if (code === 'MERGE_SELF') return 'An idea can’t be merged into itself.';
     if (code === 'MERGE_TARGET_NOT_FOUND') return 'No idea with that number.';
     if (code === 'MERGE_TARGET_MERGED') return 'That idea was itself merged — merge into the one it folded into.';

package/modules/hall-ui/public/watch.js

@@ -1,14 +1,19 @@
 // watch.js — Watch (/builders/watch).
 //
-// Archon-only (rank 'archon') monitoring view. One self-contained page that
-// stitches together the oversight surfaces: pending access requests, security
-// (red-team reports + override queue + audit log), the builder roster,
-// per-builder + project-wide review grades, estimation drift, repo health,
-// and a tally of recorded sessions.
+// Metic+ monitoring view (Archon-only until ADR 0157 delegated the operational
+// permissions to the working rank). One self-contained page that stitches together
+// the oversight surfaces: pending access requests, security (red-team reports +
+// override queue + audit log), the builder roster, per-builder + project-wide
+// review grades, estimation drift, repo health, and a tally of recorded sessions.
+//
+// Note the page floor and the panel floors are no longer identical: the page and
+// most panels sit at metic, but ACCESS REQUESTS (`access_request.review`) stayed
+// archon — admitting a builder is identity. So a Metic sees this page with that one
+// section sealed, which is the 403-degrades-per-section path below working as designed.
 //
 // This page reads /api/bongos/me to learn the viewer's rank and shows a
-// restricted notice for non-Archons — but that is DEFENCE IN DEPTH only. Every
-// endpoint below is ALSO gated to rank 'archon' server-side (ADR 0016: the DB
+// restricted notice below the Metic floor — but that is DEFENCE IN DEPTH only. Every
+// endpoint below is ALSO gated server-side (ADR 0016: the DB
 // enforces, the markdown/UI only describes). On a 401 it redirects into the
 // web sign-in flow; on a 403 the affected section degrades to an inline
 // "unavailable" message rather than blanking the whole page. Each section
@@ -870,8 +875,11 @@
       return;
     }
 
-    if (!builder || builder.rank !== 'archon') {
-      showSealed('This page is available to Archons only. Your current rank does not grant access.');
+    // ADR 0157: Watch sits at the `page.view.governance` floor (metic), and every panel
+    // it reads (roster, security reports, audit log, sessions, box costs) delegated to
+    // metic with it. Cosmetic — requireGovernancePage + the route gates are the wall.
+    if (!builder || (builder.rank !== 'metic' && builder.rank !== 'archon')) {
+      showSealed('This page is available from the Metic rank up. Your current rank does not grant access.');
       return;
     }
 

package/modules/ideas/blockers.js

@@ -81,14 +81,49 @@ async function resolveBlocker({ id, builderId, resolutionNote }) {
   return { blocker: rows[0], promoted_tasks: promoted };
 }
 
-// Link a blocker to a task (lives in task_blockers via the new blocker_id col).
+// Statuses that linking a blocker moves to 'blocked' (task 1002559).
+//
+// 'ready' only, deliberately. The resolve trigger (migration 009) promotes
+// 'blocked' → 'ready', so anything we flip INTO blocked must be something
+// 'ready' is a correct destination for. 'backlog' is not: it is pre-workable
+// and already unclaimable, and migration 176 keeps a dep-ship from promoting it
+// past an open blocker — so blocking it would buy nothing and would let a
+// blocker resolution launder a task past the metic+archon promote gate.
+const LINK_BLOCKABLE_STATUSES = ['ready'];
+
+function blocksOnLink(status) {
+  return LINK_BLOCKABLE_STATUSES.includes(status);
+}
+
+// Link a blocker to a task (lives in task_blockers via the new blocker_id col)
+// and park the task in 'blocked' so the resolve-side trigger has something to
+// promote. Both writes share one transaction: a link that recorded the edge but
+// left the task claimable is the exact defect this replaces.
 async function linkBlockerToTask({ blockerId, taskId }) {
-  await pool.query(
-    `INSERT INTO task_blockers (task_id, blocker_id, blocker_ref)
-     VALUES ($1, $2, $3)
-     ON CONFLICT DO NOTHING`,
-    [taskId, blockerId, `blocker:${blockerId}`]
-  );
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    await client.query(
+      `INSERT INTO task_blockers (task_id, blocker_id, blocker_ref)
+       VALUES ($1, $2, $3)
+       ON CONFLICT DO NOTHING`,
+      [taskId, blockerId, `blocker:${blockerId}`]
+    );
+    const { rows } = await client.query(
+      `UPDATE tasks
+          SET status = 'blocked', updated_at = now()
+        WHERE id = $1 AND status = ANY($2)
+        RETURNING id`,
+      [taskId, LINK_BLOCKABLE_STATUSES]
+    );
+    await client.query('COMMIT');
+    return { blocked: rows.length > 0 };
+  } catch (err) {
+    await client.query('ROLLBACK');
+    throw err;
+  } finally {
+    client.release();
+  }
 }
 
 module.exports = {
@@ -97,4 +132,6 @@ module.exports = {
   createBlocker,
   resolveBlocker,
   linkBlockerToTask,
+  blocksOnLink,
+  LINK_BLOCKABLE_STATUSES,
 };

package/modules/ideas/routes/blockers.js

@@ -73,7 +73,7 @@ module.exports = function buildBlockersRouter() {
   // /blockers above); a Xenos cannot resolve or link them.
   // rank: metic+archon — blocker review (auto-promotes linked blocked tasks);
   // criterion C2 / #360 / ADR 0018.
-  router.post('/blockers/:id/resolve', api.requireBuilder, api.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/blockers/:id/resolve', api.requireBuilder, api.requirePermission('blocker.review'), async (req, res) => {
     if (validateOrRespond(req, res, {
       resolution_note: { type: 'string', maxLength: LIMITS.NOTES },
     })) return;
@@ -95,11 +95,13 @@ module.exports = function buildBlockersRouter() {
     }
   });
 
-  // Link an existing blocker to a task (puts the task in 'blocked' status if
-  // it's currently 'backlog' or 'ready'). Metic+ (#360 / ADR 0018) — same
-  // blocker-review grant as resolve above.
+  // Link an existing blocker to a task. A task that is currently 'ready' is
+  // parked in 'blocked' so it stops advertising as claimable and the
+  // resolve-side trigger can release it; every other status is left alone
+  // (task 1002559 — see LINK_BLOCKABLE_STATUSES for why 'backlog' is excluded).
+  // Metic+ (#360 / ADR 0018) — same blocker-review grant as resolve above.
   // rank: metic+archon — link a blocker to a task; same blocker-review grant as resolve.
-  router.post('/blockers/:id/link', api.requireBuilder, api.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/blockers/:id/link', api.requireBuilder, api.requirePermission('blocker.review'), async (req, res) => {
     if (validateOrRespond(req, res, {
       task_id: { required: true },  // accept number or stringified number; coerced below
     })) return;
@@ -108,8 +110,11 @@ module.exports = function buildBlockersRouter() {
     const taskId = Number(req.body?.task_id);
     if (!Number.isFinite(taskId)) return res.fail('task_id_required', 400);
     try {
-      await blockers.linkBlockerToTask({ blockerId: id, taskId });
-      res.json({ ok: true });
+      // `blocked` says whether the task actually moved. The old handler always
+      // answered {ok:true} even when nothing changed, which is how a dead link
+      // loop went unnoticed for six weeks (task 1002559).
+      const { blocked } = await blockers.linkBlockerToTask({ blockerId: id, taskId });
+      res.json({ ok: true, blocked });
     } catch (err) {
       console.error('[gds] POST /blockers/:id/link', err);
       res.fail('link_failed', { status: 500, message: 'internal error' });

package/modules/ideas/routes/inbox.js

@@ -129,7 +129,7 @@ module.exports = function buildInboxRouter() {
   // archon-only to metic+archon when the three-rank model went live. Any
   // builder can still FILE an idea (POST /inbox above); a Xenos cannot triage.
   // rank: metic+archon — idea triage shapes the backlog; criterion C2 / #360 / ADR 0018.
-  router.patch('/inbox/:id', api.requireBuilder, api.requireRank('metic', 'archon'), async (req, res) => {
+  router.patch('/inbox/:id', api.requireBuilder, api.requirePermission('idea.triage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       // Enum kept light — inbox.updateIdea returns a structured BAD_STATUS
       // error if the value falls outside the accepted set, and the supervisor
@@ -211,7 +211,7 @@ module.exports = function buildInboxRouter() {
   router.post(
     '/inbox/:id/ratify',
     api.requireBuilder,
-    api.requireRank('archon'),
+    api.requirePermission('idea.ratify'),
     async (req, res) => {
       // notes_md is OPTIONAL and free text. The schema keeps the accepted shape
       // exactly as it was (absent → ''), and adds what the typeof guard could not:

package/modules/lifecycle/db.js

@@ -29,7 +29,7 @@
 'use strict';
 
 const api = require('../../src/module-api');
-const { pool, withTx, insertAuditLog, LIVE_RANK_LADDER } = api;
+const { pool, withTx, insertAuditLog, LIVE_RANK_LADDER, RANK_TIER } = api;
 // The seam registry (resolveOptional/emit/emitAsync) — the doorway re-exports it,
 // so the module reaches the `reward`/`onboarding` ports + emits kernel events
 // (task.shipped, builder.box-reconcile-needed) without importing core.
@@ -149,10 +149,10 @@ function qualifiesForThetesGraduation(rank, shippedCount) {
 
 // GENERAL_QUEUE_RANKS — the live ranks allowed to claim any ready task (the
 // whole general queue). Everything NOT in this set is sandboxed (see
-// xenosClaimAllowed). Mirrors LIVE_RANK_LADDER minus the sandboxed entry rank
-// 'xenos': thetes (graduated newcomer, #692 / ADR 0034) and up.
+// xenosClaimAllowed). LIVE_RANK_LADDER minus the sandboxed entry rank 'xenos':
+// thetes (graduated newcomer, #692 / ADR 0034) and up — derived (BV1.R108).
 
-const GENERAL_QUEUE_RANKS = new Set(['thetes', 'metic', 'archon']);
+const GENERAL_QUEUE_RANKS = new Set(LIVE_RANK_LADDER.filter((r) => r !== 'xenos'));
 
 // xenosClaimAllowed — the row-level half of the three-rank model (#360 / ADR
 // 0018; renamed in V3.R15 #239 to newcomer_friendly). The sandboxed entry rank
@@ -231,7 +231,10 @@ async function claimPermissionsFor(builderId) {
 // claimTask + claimTasksBatch both call it after xenosClaimAllowed; the two
 // gates compose without contradiction (see migration 044 for the rationale).
 
-const REQUIRES_RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
+// BV1.R108: no longer a hand-copied literal — the canonical map is DERIVED from
+// LIVE_RANK_LADDER in db-kernel and reaches this module through the doorway.
+// The local name survives because ~10 helpers below and the module export read it.
+const REQUIRES_RANK_TIER = RANK_TIER;
 
 function rankAllowsTask(builderRank, requiredRank) {
   // Tasks default to requires_rank='xenos' (the NOT NULL DEFAULT on the
@@ -575,13 +578,16 @@ async function versionProgress() {
 // commit together, so a bad criterion leaves nothing half-created. Criteria are
 // idempotent on (version_id, criterion_id) so a re-run can't double-insert.
 
-async function createVersion({ id, name, status = 'planning', scopeDocPath = null, doneWhen = null, criteria = [] }) {
+async function createVersion({ id, name, status = 'planning', track = 'product', scopeDocPath = null, doneWhen = null, criteria = [] }) {
+  // versions.track is NOT NULL with no DB default (migration 003) — omitting it
+  // here made every create 500. An instance's first version is its product
+  // track, so that's the default; 'internal' is the platform's own track.
   return withTx(async (client) => {
     const { rows } = await client.query(
-      `INSERT INTO versions (id, name, status, scope_doc_path, done_when)
-            VALUES ($1, $2, $3, $4, $5)
-       RETURNING id, name, status, scope_doc_path, started_at, shipped_at, done_when`,
-      [id, name, status, scopeDocPath, doneWhen]
+      `INSERT INTO versions (id, name, status, track, scope_doc_path, done_when)
+            VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING id, name, status, track, scope_doc_path, started_at, shipped_at, done_when`,
+      [id, name, status, track, scopeDocPath, doneWhen]
     );
     const version = rows[0];
     const createdCriteria = [];
@@ -2479,6 +2485,35 @@ async function unsatisfiedDeps(taskId, client = pool) {
 // overlapping touches[] (caught BEFORE the unique-violation, so we
 // give a useful error rather than a generic constraint failure).
 
+// task 1002589 (idea 1000638) — a claims INSERT can trip TWO partial unique
+// indexes, and each means something different to the caller:
+//   uniq_active_claim_per_task — race lost: another session claimed the task.
+//   the per-session backstop — this session already holds a bound active claim
+//     in the same working tree. Collapsing this case onto ALREADY_CLAIMED sent
+//     builders hunting a phantom rival claimant while the target task sat
+//     'ready'.
+// Both generations of the backstop index map to the honest code: a deploy
+// applies code and migration at different instants, and an instance may still
+// carry the old index.
+const SESSION_CLAIM_INDEXES = new Set([
+  'uniq_active_claim_per_session',           // migration 180 — session-only (pre-re-key)
+  'uniq_active_claim_per_session_worktree',  // core_204 (task 1002570) — per (session, worktree)
+]);
+// Branch on err.constraint; an UNKNOWN constraint fails CLOSED on the generic
+// ALREADY_CLAIMED (never widen a claim refusal). Pure + exported for DB-free
+// tests; claimTask enriches the session case with the in-flight claim's id.
+function claimUniqueViolationError(err) {
+  if (err && SESSION_CLAIM_INDEXES.has(err.constraint)) {
+    return {
+      code: 'session_already_has_bound_claim',
+      what_to_do: 'Ship or release the in-flight claim first (/builder-ship or /builder-release), '
+        + 'or claim this task from its own separate worktree (since core_204 the index allows '
+        + 'one bound claim per worktree). {"bind_session":false} (an unbound claim) always coexists.',
+    };
+  }
+  return { code: 'ALREADY_CLAIMED' };
+}
+
 async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false }) {
   const heldPermissions = await claimPermissionsFor(builderId); // BV1.R106 — before the tx opens
   const client = await pool.connect();
@@ -2716,8 +2751,31 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
   } catch (err) {
     await client.query('ROLLBACK').catch(() => {});
     if (err && err.code === '23505') {
-      // unique_violation on uniq_active_claim_per_task — race lost
-      throw { code: 'ALREADY_CLAIMED' };
+      // task 1002589: branch on WHICH unique index tripped — see
+      // claimUniqueViolationError above. The session case is enriched with the
+      // in-flight bound claim (post-ROLLBACK, same client) so the refusal
+      // points at the real cause; best-effort — the honest code must not
+      // depend on this read succeeding.
+      let mapped = claimUniqueViolationError(err);
+      if (mapped.code === 'session_already_has_bound_claim' && creatorSessionId) {
+        try {
+          // Same-worktree row first: under the core_204 index that is the
+          // exact colliding claim; under the old session-only index any bound
+          // row of the session is the culprit, so fall back to the earliest.
+          const { rows } = await client.query(
+            `SELECT c.task_id, t.title
+               FROM claims c JOIN tasks t ON t.id = c.task_id
+              WHERE c.creator_session_id = $1 AND c.released_at IS NULL
+              ORDER BY (COALESCE(c.worktree_name, '') = COALESCE($2, '')) DESC, c.claimed_at, c.id
+              LIMIT 1`,
+            [creatorSessionId, worktreeName ?? null]
+          );
+          if (rows[0]) {
+            mapped = { ...mapped, active_task_id: Number(rows[0].task_id), active_task_title: rows[0].title };
+          }
+        } catch (_) { /* enrichment only — the mapped code still throws */ }
+      }
+      throw mapped;
     }
     throw err;
   } finally {
@@ -2941,11 +2999,14 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
     // UPDATE and INSERT (it can't, given the row lock, but defense in depth),
     // we surface that as ALREADY_CLAIMED for the specific task.
     //
-    // task 1802 — uniq_active_claim_per_session (migration 180) is keyed on
-    // creator_session_id alone, so it can't tell "N rows from one batch call"
+    // task 1802 — uniq_active_claim_per_session (migration 180) was keyed on
+    // creator_session_id alone, so it couldn't tell "N rows from one batch call"
     // from "N rows from N separate /claims calls": every row here used to carry
     // the SAME non-null creatorSessionId for a real (bound) CLI session, so the
-    // 2nd INSERT always hit the partial unique index. Each batch-claimed task
+    // 2nd INSERT always hit the partial unique index. (core_204 / task
+    // 1002570 re-keyed it per (session, worktree) — but a prefix-less batch
+    // stores NULL worktree_name on every row, which the index folds into ONE
+    // group, so first-row-only binding stays load-bearing.) Each batch-claimed task
     // also gets its OWN worktree name (worktreePrefix-taskId, right below) — a
     // batch is claiming N tasks for N future (possibly parallel) working
     // sessions, not one shared worktree — so there is no correctness reason to
@@ -2982,7 +3043,11 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
         inserted.push(insertClaim.rows[0]);
       } catch (err) {
         if (err && err.code === '23505') {
-          throw { code: 'BATCH_FAILED', failures: [{ task_id: t.id, reason: 'ALREADY_CLAIMED' }] };
+          // task 1002589: same constraint branch as claimTask — the per-session
+          // index can trip here on the FIRST (bound) row when the calling
+          // session already holds a bound claim; every other 23505 stays the
+          // per-task race answer.
+          throw { code: 'BATCH_FAILED', failures: [{ task_id: t.id, reason: claimUniqueViolationError(err).code }] };
         }
         throw err;
       }
@@ -3663,7 +3728,8 @@ async function listConfirmedTasksForReconcile({ limit = 100 } = {}) {
   // confirm time. The reconciler ages out silent strands on it (task 1546 / blocker 47:
   // 15 tasks sat unprovable for up to 66h because every sweep miss was a silent continue).
   const { rows } = await pool.query(
-    `SELECT DISTINCT ON (t.id) t.id AS task_id, c.builder_id, c.worktree_name, c.head_sha,
+    `SELECT DISTINCT ON (t.id) t.id AS task_id, t.title, t.security_sensitive,
+            c.builder_id, c.worktree_name, c.head_sha,
             c.published_head_sha, t.updated_at AS confirmed_at
        FROM tasks t
        JOIN claims c ON c.task_id = t.id
@@ -5344,6 +5410,7 @@ module.exports = {
   removeTaskCriterion,
   linkTaskCriteria,
   claimTask,
+  claimUniqueViolationError,
   claimTasksBatch,
   releaseClaimsBatch,
   validateClaimBatch,