@bongos/core 1.19.1042 → 1.19.1043

package/docs/file-map.md

@@ -137,7 +137,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
+│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -2571,5 +2571,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         1.19.0 precedent, riding the next CI patch as joinabilityMode did.
   1.19.1042 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1041 with no explicit bump. run 36254852933. (task 1002620)
+  1.19.1043 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1042 with no explicit bump. run 36258640780. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -98,7 +98,10 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
     "pollers":     ["box-lifecycle"], //   background pollers (start/stop lifecycle)
     "disciplines": ["artist"],        //   builder disciplines this module adds
     "skills":      ["otb-tile-generate"], // slash-command skills it ships
-    "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__
+    "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__. Ship public/hall-widget.js
+                                      //   and it is injected into the hall index; ship public/task-widget.js and it
+                                      //   is injected into a task's page before task.js, to fill #task-contrib on
+                                      //   `otb:task-shown` (task 1004301). The page itself names no module.
     "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces: a Host PREFIX (BV1.R84)…
                                                             // …or { "apexRoot": true, "dir": "public" } for the
                                                             // apex root (ADR 0218). One or the other, never both.

package/modules/hall-ui/public/style.css

@@ -3151,6 +3151,10 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   min-width: 0;
   max-width: 100%;
 }
+/* The 24px floor (task 1004301 found it failing): at 13px the base field's padding left a
+   number input 21px tall beside a select that clears it — the task page's "Wait for task"
+   box. Sized to sit level with its select. */
+.td-field input { min-height: 26px; box-sizing: border-box; }
 .td-form .td-actions, .td-form-hint, .td-form .td-action-note { grid-column: 1 / -1; }
 .td-form .td-actions { margin: 4px 0 0; }
 .td-form-hint { font-size: 12.5px; color: var(--ink-soft); margin: 0; }

package/modules/hall-ui/public/task.css

@@ -139,3 +139,9 @@
   .tk-axis:nth-child(3) { border-left: 0; padding-left: 0; }
   .tk-lrow { grid-template-columns: 1fr; gap: 6px; }
 }
+
+/* The module slot under the rail (task 1004301): a module's task-widget.js may write one
+   line of its own here (the npm-release module says which version carries the task).
+   Empty unless a module fills it, and then it takes no room at all. */
+.tk-contrib { margin: var(--sp-md) 0 0; }
+.tk-contrib:empty { display: none; }

package/modules/hall-ui/public/task.html

@@ -69,6 +69,6 @@
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/md-reader.js" defer></script>
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>
-<script src="/builders/task.js?v=2026-07-03-taskpage1" defer></script>
+<script src="/builders/task.js?v=2026-09-26-taskwhere" defer></script>
 </body>
 </html>

package/modules/hall-ui/public/task.js

@@ -634,6 +634,11 @@
       ['Priority', t.priority == null ? null : 'P' + t.priority],
     ]));
     parts.push(lifecycleRail(t, creditVal));
+    // A slot a MODULE may fill (task 1004301): the module's public/task-widget.js is
+    // injected just before this script and writes into it on `otb:task-shown` below. The
+    // page itself names no module and draws nothing here — with none enabled it stays
+    // empty, and `:empty` in task.css collapses it.
+    parts.push('<div class="tk-contrib" id="task-contrib" aria-live="polite"></div>');
 
     // Claim history (task 751). The most recent holder leads; since task 1003437
     // the read also carries the FULL claim ledger (?include=claims), so a task
@@ -806,6 +811,7 @@
 
     const body = $('#task-body');
     if (body) body.innerHTML = parts.join('');
+    announceShown(t);
 
     const copyBtn = $('#copy-prompt-btn');
     if (copyBtn) {
@@ -958,6 +964,17 @@
   // The two honest failures. Both keep the <h1> — the empty and error renders are
   // renders like any other, and a page whose only heading lives on the happy path
   // has none in the states a reader is most likely to hit.
+  // Tell any module widget which task is on screen (task 1004301). Fired after EVERY
+  // render, because render() rebuilds #task-body wholesale and the slot a widget filled a
+  // moment ago is gone. The last task shown is also left on window.OTBTaskShown for a
+  // widget that loads after the first announcement. Only the id and the status travel:
+  // a widget that needs more asks its own module's route, which applies its own gate.
+  function announceShown(t) {
+    const detail = { id: String(t.id), status: t.status || null };
+    window.OTBTaskShown = detail;
+    if (typeof CustomEvent === 'function') document.dispatchEvent(new CustomEvent('otb:task-shown', { detail }));
+  }
+
   function renderNotFound(id) {
     const body = $('#task-body');
     if (body) body.innerHTML = `

package/modules/hall-ui/records/record-family.md

@@ -11,3 +11,5 @@
 **The task record's grade panel, session log and claim ledger (task 1003437).** Two net-new regions the owner approved at the composition round (direction doc §6 decision 4) sit between Shipped and Actions on `task.html`. Four rules carry them: all three ride the ONE task read as opt-in siblings — `GET /tasks/:id?include=last_claim,grade,session_logs,claims`; the two new reads (`getTaskSessionLogs`, `getTaskClaims` in `modules/lifecycle/db-claim-reads.js`) are keyed by `task_id`, newest first, **rank never returned**; absent → **NOTHING** (the ship-visual precedent), except a grade row whose panel was `unavailable`, which is data and says so in one line; and verdicts and outcomes wear the fixed verification vocabulary through `.rec-pill--ok/warn/danger`, **never the accent**. Pinned in `tests/hall_record_world.mjs` (page) and `tests/task_detail_includes.mjs` (route + reads).
 
 **The way into and out of a task record (task 1003468, ADR 0229).** Since 1759/1869 a to-do card's BODY toggles selection so a builder can bulk-claim — which is why the owner could not open a card, the only door being a 26px ⤢ glyph nobody found. Now **the title is the door**: `.task__link` on both surfaces that render the card (`work.js`, `goals-render.js`), bought up to the 24px floor with the `.scroll__lede a` recipe; both click handlers let it through; the glyph is gone. **The link carries where it was opened from** — `OTBTaskDetail.href(id)` appends `?from=<path+query+hash>` (a query param so the origin survives a reload and keeps a goal's `#/goal/N`, which a referrer drops) — and `task.js` resolves the exit once (`?from=` → same-origin referrer → the work board), points the crumb **before** the fetch so the way back exists in every state, and refuses anything that is not a path on this host. **Never write a bare `/task/N` link from a list again — call `OTBTaskDetail.href(id)`.** Pinned by §10 of `tests/hall_record_world.mjs` and §7 of `tests/hall_board_world.mjs`.
+
+**The task page carries a module slot (task 1004301).** Under the lifecycle rail sits `#task-contrib`, empty and collapsed (`.tk-contrib:empty`) unless a module fills it, and `task.js` announces every render as `otb:task-shown` with `{ id, status }` (also left on `window.OTBTaskShown` for a late widget). The page names no module: the server injects each enabled module's `public/task-widget.js` just before `task.js` (the loader's uiSections seam, `hallWidgetScripts({ file: 'task-widget.js' })`), so both run deferred in order and the listener exists before the first announcement. Render rebuilds `#task-body` wholesale, which is why the announcement is per render, not per load. The first filler is npm-release's line — "In 1.19.1036 · running here · not released to other projects yet", or "Done, but not merged" for a stranded ship. Tests: `tests/hall_record_world.mjs` (slot + announcement), `tests/npm_release_where.mjs` (the widget and the seam).

package/modules/npm-release/module.json

@@ -1,7 +1,7 @@
 {
   "key": "npm-release",
   "title": "npm release",
-  "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
+  "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622) — and the same line on a task's own page (task 1004301). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
   "coreVersion": "^1.19.0",
   "default": false,
   "author": "Cloud Bongos",
@@ -12,7 +12,13 @@
     "status": "core-maintained"
   },
   "contributes": {
-    "routes": ["work"]
+    "routes": [
+      "work",
+      "task-where"
+    ],
+    "uiSections": [
+      "task-where"
+    ]
   },
   "provides": [],
   "consumes": []

package/modules/npm-release/public/task-widget.js

@@ -0,0 +1,79 @@
+// modules/npm-release/public/task-widget.js — the line a task's own page shows about where
+// its code is (task 1004301): "In 1.19.1036 · running here · not released yet", or that a
+// task marked done never reached main — which is how a stranded ship becomes visible to the
+// person who shipped it.
+//
+// HOW IT GETS THERE. The core's task page names no module. It renders an empty slot
+// (#task-contrib) and announces each render as `otb:task-shown`; the server injects this file
+// just before task.js because the module declares a uiSection and ships task-widget.js
+// (src/module-loader/loader.js hallWidgetScripts, file: 'task-widget.js'). Module off: this
+// file is never injected, its asset 404s, and the slot stays empty.
+//
+// THE PAGE KNOWS NOTHING (deploy.js's rule, kept). The stage and version are the server's
+// reading; a partial reading says so; any failure draws no line rather than a wrong one.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const client = window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const DONE = ['completed', 'confirmed', 'shipped'];
+
+  // One reading per task per page load: the page re-renders on every action, and each
+  // render re-announces, but where the code is does not change between clicks. Bounded —
+  // a page shows one task, and the overlay can walk to a few more; nothing needs more than
+  // the last handful.
+  const cache = new Map();
+  const CACHE_MAX = 8;
+
+  // The line for each stage, in the deploy page's own words (its stage names), shortened to
+  // read as one sentence under a task's lifecycle rail.
+  const REST = {
+    unversioned: () => 'Merged, waiting for the next published version.',
+    not_live: (w) => `published, not running here yet${w.offered ? ' · already offered to other projects' : ''}.`,
+    live_unreleased: () => 'running here · not released to other projects yet.',
+    released: (w) => `${w.live ? 'running here · ' : ''}released to other projects.`,
+    // Said with the reason a builder would recognise, the way "Done, but not merged" is: this
+    // is most often work that changed no code, and only sometimes a merge that lost its name.
+    no_version: () => 'Shipped, though no published version lists it — usually a change that needed no code, like a scope edit or a check, and now and then a merge whose note did not name this task.',
+  };
+
+  function lineHtml(w) {
+    if (w.stage === 'not_merged') {
+      return '<p class="rec-meta nr-where nr-where--stranded"><b>Done, but not merged.</b> The ledger marks this task done, and its code is not on main yet — a ship that has not landed.</p>';
+    }
+    const rest = REST[w.stage];
+    if (!rest) return '';
+    const lead = w.version ? `In <b>${esc(w.version)}</b> · ` : '';
+    const partial = w.partial ? ' (a partial reading: the registry or the release notes could not be read)' : '';
+    return `<p class="rec-meta nr-where">${lead}${esc(rest(w) + partial)}</p>`;
+  }
+
+  async function reading(id) {
+    if (cache.has(id)) return cache.get(id);
+    const p = (async () => {
+      if (!client) return null;
+      const res = await client.request('GET', `${API}/npm-release/task/${encodeURIComponent(id)}`);
+      return res && res.status === 200 && res.data ? res.data : null;
+    })().catch(() => null);
+    cache.set(id, p);
+    while (cache.size > CACHE_MAX) cache.delete(cache.keys().next().value);
+    return p;
+  }
+
+  async function show(detail) {
+    if (!detail || !/^\d{1,12}$/.test(String(detail.id || ''))) return;
+    if (!DONE.includes(detail.status)) return;           // nothing to place until it is done
+    const w = await reading(String(detail.id));
+    // The page may have re-rendered while the read was in flight: write into the slot that
+    // exists NOW, and only for the task it is still showing.
+    const slot = document.getElementById('task-contrib');
+    const shown = window.OTBTaskShown;
+    if (!slot || !w || (shown && String(shown.id) !== String(detail.id))) return;
+    slot.innerHTML = lineHtml(w);
+  }
+
+  document.addEventListener('otb:task-shown', (e) => { show(e && e.detail); });
+  if (window.OTBTaskShown) show(window.OTBTaskShown);
+})();

package/modules/npm-release/routes/task-where.js

@@ -0,0 +1,48 @@
+'use strict';
+
+// modules/npm-release/routes/task-where.js — GET /npm-release/task/:id, the one line a
+// task's own page shows about where its code is (task 1004301): which version carries it,
+// whether this hall runs that version, whether it is released — or that a task marked done
+// never reached main. See readTaskWhere in ../work.js for the reading.
+//
+// ANY SIGNED-IN BUILDER, NOT THE DEPLOY PAGE'S ATOM. Every builder can open a task page, so
+// the question the task asked was what this line may show them. It shows nothing that is
+// not already public: the version naming the task is in the package's own release notes on
+// npm, the core this hall runs is what the public GET /version reports, and "released" is
+// the registry's `latest` label. The deploy page stays on `core.pin.move` for what it adds
+// beyond that — the ledger of upgrades, the door. requireBuilder rather than nothing, like
+// the task page's own read, so the line is never a signed-out probe.
+//
+// READ-ONLY.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { readTaskWhere } = require('../work');
+
+const log = api.logger('npm-release');
+
+module.exports = function buildNpmReleaseTaskWhereRouter({ read = readTaskWhere } = {}) {
+  const router = express.Router();
+
+  router.get(
+    '/npm-release/task/:id',
+    api.requireBuilder,
+    async (req, res) => {
+      const id = String((req.params && req.params.id) || '');
+      if (!/^\d{1,12}$/.test(id)) {
+        res.status(400).json({ error: { code: 'bad_task_id', message: 'A task id is a number.' } });
+        return;
+      }
+      try {
+        const where = await read({ pool: api.pool, id });
+        if (!where) { res.status(404).json({ error: { code: 'task_not_found', message: `No task ${id}.` } }); return; }
+        res.json(where);
+      } catch (e) {
+        log.error(`npm-release task-where read failed: ${e && e.message}`);
+        res.status(500).json({ error: { code: 'task_where_failed', message: 'Could not read where this task\'s code is right now.' } });
+      }
+    },
+  );
+
+  return router;
+};

package/modules/npm-release/work.js

@@ -57,9 +57,16 @@ function configuredPackage(env = process.env) {
   return v || CORE_PACKAGE;
 }
 
+// READ ONCE PER PROCESS. The file ships inside the installed package, so it cannot change
+// while this process runs — an upgrade replaces the package AND restarts the server. The
+// deploy page's reading reached it rarely; a task's own page (task 1004301) reaches it on
+// every view by every builder, and a synchronous disk read has no business on that path.
+let installedNotesMemo;
 function readInstalledNotes() {
-  try { return JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
-  catch { return null; }
+  if (installedNotesMemo !== undefined) return installedNotesMemo;
+  try { installedNotesMemo = JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
+  catch { installedNotesMemo = null; }
+  return installedNotesMemo;
 }
 
 function boundText(text) {
@@ -194,12 +201,9 @@ function clampInt(v, dflt, max) {
  * `now`, `store` and `installedNotes` are the seams tests drive; `live` defaults to this
  * process's own core version when the package is the core.
  */
-async function readWork({
-  pool, pkg = configuredPackage(), live, days, before, limit,
-  installedNotes = readInstalledNotes, get, now, store,
-} = {}) {
-  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
-  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+// What versions exist and what each carried — the half of the reading both the deploy page
+// and a task's own page need (task 1004301 split it out of readWork unchanged).
+async function readVersions({ pkg, live, installedNotes, get, now, store }) {
   const running = live !== undefined ? live : (pkg === CORE_PACKAGE ? api.CORE_VERSION : null);
   const liveVersion = VERSION_RE.test(String(running || '')) ? running : null;
 
@@ -225,6 +229,17 @@ async function readWork({
   const coversTo = versions.length ? versions[versions.length - 1].version : null;
   const published = registry.ok ? registry.published : {};
   const released = registry.ok ? registry.latest : null;
+  return { liveVersion, registry, versions, source, notesError, coversTo, published, released };
+}
+
+async function readWork({
+  pool, pkg = configuredPackage(), live, days, before, limit,
+  installedNotes = readInstalledNotes, get, now, store,
+} = {}) {
+  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
+  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+  const { liveVersion, registry, versions, source, notesError, coversTo, published, released } =
+    await readVersions({ pkg, live, installedNotes, get, now, store });
 
   const tasks = await recentTasks(pool, windowDays);
   const stages = placeTasks({ tasks, versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
@@ -255,4 +270,50 @@ async function readWork({
   };
 }
 
-module.exports = { readWork };
+/**
+ * Where ONE task's code is (task 1004301) — the line its own page shows: the same
+ * placement the deploy page's list makes, for one task and without the 14-day window.
+ *
+ * Returns null for an id that is not a task. For a task not yet declared done, `stage` is
+ * null: there is no code to place. Otherwise `stage` is one of the deploy page's six, with
+ * the version that carries it when there is one.
+ *
+ * WHAT IT DISCLOSES, because every builder can open a task page: the version that names the
+ * task (the package's own release notes, published on npm), whether that version is the one
+ * this hall runs (GET /version already says which core runs), and whether it is released
+ * (the registry's `latest` label). Nothing here is not already public, which is why its
+ * route asks only for a signed-in builder — unlike the deploy page, whose ledger view and
+ * upgrade door are the owner's.
+ */
+async function readTaskWhere({ pool, id, pkg = configuredPackage(), live, installedNotes = readInstalledNotes, get, now, store } = {}) {
+  const taskId = String(id == null ? '' : id);
+  if (!/^\d{1,12}$/.test(taskId)) return null;
+  const { rows } = await pool.query(
+    `SELECT id, status, value_summary, COALESCE(shipped_at, updated_at) AS at FROM tasks WHERE id = $1::bigint`,
+    [taskId],
+  );
+  if (!rows.length) return null;
+  const r = rows[0];
+  const task = { id: String(r.id), status: r.status, summary: r.value_summary || null, at: r.at instanceof Date ? r.at.toISOString() : r.at };
+  const base = { task_id: task.id, package: pkg, status: task.status };
+  if (!['completed', 'confirmed', 'shipped'].includes(task.status)) return { ...base, stage: null };
+
+  const { liveVersion, registry, versions, notesError, coversTo, published, released } =
+    await readVersions({ pkg, live, installedNotes, get, now, store });
+  const stages = placeTasks({ tasks: [task], versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
+  const stage = Object.keys(stages).find((k) => stages[k].length) || null;
+  const row = stage ? stages[stage][0] : {};
+  return {
+    ...base,
+    stage,
+    version: row.version || null,
+    offered: !!row.offered,
+    live: liveVersion,
+    released,
+    // A partial reading is said, not hidden: without the notes a shipped task reads as "in no
+    // version", which would be a claim the page cannot back.
+    partial: !registry.ok || !!notesError,
+  };
+}
+
+module.exports = { readWork, readTaskWhere };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1042",
+  "version": "1.19.1043",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1042",
+      "version": "1.19.1043",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1042",
+  "version": "1.19.1043",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7553,5 +7553,11 @@
       "id": "1001433",
       "text": "The nightly security check of the main code line no longer trusts the name typed on each change, which anyone can fake. It now checks that every change to a sensitive file carries the server's own sign-off from a senior builde"
     }
+  ],
+  "1.19.1043": [
+    {
+      "id": "1004301",
+      "text": "A task's own page now says where its code is — which version carries it, whether it is running on Bongos, whether it is released — and says plainly when a task marked done never actually landed."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:299',
+    at: 'src/module-loader/loader.js:309',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/seam-wiring-guard.js

@@ -95,11 +95,13 @@ const SEAM_CONSUMERS = {
     artifact: (dir, entry) => path.join(dir, 'rooms', `${entry}.js`),
   },
   uiSections: {
-    // Per-MODULE, not per-entry: hallWidgetScripts looks for one hall-widget.js
-    // however many sections the module names.
+    // Per-MODULE, not per-entry: hallWidgetScripts looks for one widget file per page
+    // however many sections the module names — hall-widget.js for the index, and since
+    // task 1004301 task-widget.js for a task's page. Either one wires the declaration.
     consumer: 'src/module-loader/loader.js hallWidgetScripts',
     kind: 'file',
     artifact: (dir) => path.join(dir, 'public', 'hall-widget.js'),
+    alternates: (dir) => [path.join(dir, 'public', 'task-widget.js')],
   },
   skills: {
     // moduleSkillSources resolves a declared name against the module's OWN tree or

package/scripts/hall-preview/server.js

@@ -77,7 +77,8 @@ let express;
 try { express = require(path.join(ROOT, 'node_modules', 'express')); }
 catch (_) { express = require('express'); }
 const { buildStampedHtml } = require(path.join(ROOT, 'src', 'asset-version.js'));
-const { injectBrandingGlobal, mountInternalSurfaces } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
+const { injectBrandingGlobal, mountInternalSurfaces, injectModuleHallWidgets } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
+const { hallWidgetScripts } = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
 const { clientModules } = require(path.join(ROOT, 'src', 'modules.js'));
 const { overrideKey, resolveLiveIdentity } = require('./live-identity');
 
@@ -128,6 +129,9 @@ const FIXTURE_FALLBACKS = [
   // without it /deploy?project=… only ever rendered its "could not read" state, which
   // is the trap this directory's README calls out by name.
   [/^provisioning\/instances\/\d+\/core-upgrade$/, 'provisioning__instances__core-upgrade'],
+  // the npm-release module's line on a task's page (task 1004301): one reading serves any
+  // id, as the core-upgrade preview above does — the page shows one task.
+  [/^npm-release\/task\/\d+$/, 'npm-release__task'],
 ];
 
 // A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request
@@ -283,6 +287,15 @@ for (const key of MODULES_OFF) {
 for (const key of MODULES_ON) {
   (mods.enabled = mods.enabled || {})[key] = true;
 }
+// Module page widgets, injected at boot exactly as serve-internal.js does for prod: the
+// hall index's hall-widget.js and a task page's task-widget.js (task 1004301), for the
+// modules THIS harness runs with. Without it a module's line on a page could never be
+// previewed — the page would only ever render its empty slot.
+{
+  const isOn = (k) => !!(mods.enabled && mods.enabled[k]);
+  if (stamped['index.html']) stamped['index.html'] = injectModuleHallWidgets(stamped['index.html'], hallWidgetScripts({ isEnabled: isOn }));
+  if (stamped['task.html']) stamped['task.html'] = injectModuleHallWidgets(stamped['task.html'], hallWidgetScripts({ isEnabled: isOn, file: 'task-widget.js' }), 'task');
+}
 
 function sendPage(res, name) {
   const html = stamped[name];

package/src/bongos/serve-internal.js

@@ -443,14 +443,17 @@ function clientBundleScriptTag() {
 // module's widget is never injected (it vanishes); contributeHallWidget is the second
 // gate (it no-ops a widget whose module is off). `scripts` is the loader projection
 // [{ key, src }]; default reads the live enabled set. Pure + exported for the test.
-function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled })) {
+function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled }), consumer = 'builders') {
   if (!Array.isArray(scripts) || scripts.length === 0) return html;
   const tags = scripts
     .map((s) => `<script src="${s.src}" defer></script>`)
     .join('');
-  // Anchor on builders.js's <script> regardless of its ?v= stamp so the module
-  // widgets always land immediately before the consumer that mounts them.
-  const anchor = html.match(/<script src="\/builders\/builders\.js[^"]*"[^>]*><\/script>/);
+  // Anchor on the consuming page script's <script> (builders.js on the index, task.js on
+  // a task's page — task 1004301) regardless of its ?v= stamp, so the module widgets
+  // always land immediately before the consumer: both are `defer`, so they run in
+  // document order, and a widget's listener exists before the page first announces.
+  const name = /^[a-z-]+$/.test(consumer) ? consumer : 'builders';
+  const anchor = html.match(new RegExp(`<script src="\\/builders\\/${name}\\.js[^"]*"[^>]*><\\/script>`));
   if (anchor) return html.replace(anchor[0], tags + anchor[0]);
   return html.includes('</body>') ? html.replace('</body>', `${tags}</body>`) : html + tags;
 }
@@ -1070,6 +1073,17 @@ function mountInternalSurfaces(app) {
   if (buildersHtml['index.html']) {
     buildersHtml['index.html'] = injectModuleHallWidgets(buildersHtml['index.html']);
   }
+  // task 1004301: the same seam for a task's own page. A module that ships
+  // public/task-widget.js is loaded just before task.js, and fills the slot task.js
+  // renders and announces (`otb:task-shown`). The page names no module; with none
+  // enabled, nothing is injected and the slot stays empty.
+  if (buildersHtml['task.html']) {
+    buildersHtml['task.html'] = injectModuleHallWidgets(
+      buildersHtml['task.html'],
+      hallWidgetScripts({ isEnabled: isModuleEnabled, file: 'task-widget.js' }),
+      'task',
+    );
+  }
 
   // Serve enabled modules' browser assets at /modules/<key>/public/* — the URL the
   // loader's hallWidgetScripts projection points at. Mounted BEFORE the /builders

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1042'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1043'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/loader.js

@@ -213,15 +213,25 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
 // never injected), and contributeHallWidget itself no-ops a stale widget whose module
 // is off. No-op (empty list) until a module ships a hall widget — same SAFE-BY-
 // CONSTRUCTION posture as every other seam here. Returns [{ key, src }].
-function hallWidgetScripts({ isEnabled } = {}, opts) {
+//
+// ONE SEAM, ONE FILE PER PAGE (task 1004301). `file` names which page's widget is being
+// asked for: hall-widget.js for the hall index (the default, and the only caller until
+// then), task-widget.js for a task's own page. Same declaration (uiSections), same
+// enabled-only asset mount, same "a disabled module simply is not there" — so a module
+// adds a line to the task page without the page's own code ever naming it. The name is
+// matched against PAGE_WIDGET_FILES rather than trusted, so no caller can turn this into
+// a way to serve an arbitrary file.
+const PAGE_WIDGET_FILES = Object.freeze(['hall-widget.js', 'task-widget.js']);
+function hallWidgetScripts({ isEnabled, file = 'hall-widget.js' } = {}, opts) {
+  if (!PAGE_WIDGET_FILES.includes(file)) return [];
   const out = [];
   for (const { key, dir, manifest } of discovered(opts).loaded) {
     if (typeof isEnabled === 'function' && !isEnabled(key)) continue;
     const sections = (manifest.contributes && manifest.contributes.uiSections) || [];
     if (sections.length === 0) continue;
-    const scriptPath = path.join(dir, 'public', 'hall-widget.js');
+    const scriptPath = path.join(dir, 'public', file);
     if (!fs.existsSync(scriptPath)) continue; // declarative-only uiSections (e.g. status-page section)
-    out.push({ key, src: `/modules/${key}/public/hall-widget.js` });
+    out.push({ key, src: `/modules/${key}/public/${file}` });
   }
   return out;
 }