@bongos/core 1.19.1043 → 1.19.1045

package/docs/module-api-changelog.md

@@ -2573,5 +2573,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1041 with no explicit bump. run 36254852933. (task 1002620)
   1.19.1043 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1042 with no explicit bump. run 36258640780. (task 1002620)
+  1.19.1044 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1043 with no explicit bump. run 36260641494. (task 1002620)
+  1.19.1045 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1044 with no explicit bump. run 36263855490. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_256_blocker_unlink_releases_task.sql

@@ -0,0 +1,84 @@
+-- core_256_blocker_unlink_releases_task.sql — unlinking a blocker from a task
+-- must release that task when it was the last thing holding it (task 1003518).
+--
+-- THE GAP. `POST /blockers/:id/link` parks a 'ready' task in 'blocked' so the
+-- resolve trigger (009, tightened by core_223) has something to promote. Nothing
+-- removed a link. Post-core_223 a task is released only when its LAST open
+-- blocker resolves, so a wrong link — wrong task id, a duplicate filed by two
+-- people, a blocker later understood to be irrelevant — was permanent. The only
+-- escape was to resolve a blocker that was never real, putting a falsehood in
+-- the blocker ledger to clear a bookkeeping artifact. core_223's own header
+-- names this: "there is no unlink route to detach one first."
+--
+-- WHY A TRIGGER AND NOT THE ROUTE. tests/blocker_resolve_guard.mjs pins that
+-- modules/ideas/blockers.js never writes `tasks.status = 'ready'` itself: "if it
+-- ever started UPDATE-ing tasks.status, this guard would be bypassable and the
+-- fix would need to live in two places." An unlink that promoted in JS would be
+-- exactly that second place — a hand-copy of the predicate below, free to drift
+-- from it. Putting the release here keeps ONE definition of "this task has
+-- nothing open against it any more", and has a second payoff: the direct
+-- `DELETE FROM task_blockers` that was the only workaround before this task now
+-- does the right thing too, instead of silently leaving the task stranded.
+--
+-- NO `b.id <> …` EXCLUSION, AND THAT IS THE DIFFERENCE FROM core_223. That
+-- migration runs in a BEFORE UPDATE trigger, where the blocker being resolved
+-- still reads 'open' in the table and would count itself as an open blocker —
+-- so without the exclusion nothing would ever promote. This is an AFTER DELETE
+-- trigger: the link row is already gone when the body runs, so the NOT EXISTS
+-- already sees exactly the blockers that remain. Adding the exclusion here would
+-- be cargo-cult; omitting it is deliberate.
+--
+-- Deliberately NOT gating on dependencies, for core_223's reason: the
+-- dep-promotion triggers (163) only ever flip 'backlog' -> 'ready', never
+-- 'blocked' -> 'ready', so a task this left in 'blocked' for unshipped deps
+-- would have no release path at all. The claim path re-checks DEPS_NOT_SHIPPED
+-- as its second line of defence. Blocker-clearing and dep-clearing stay separate.
+--
+-- ONLY 'blocked' IS REWRITTEN. A task that was never parked (link arrived while
+-- it was active/backlog/shipped — see LINK_BLOCKABLE_STATUSES) is left exactly
+-- as it is, so an unlink can never launder a task past the metic+archon promote
+-- gate.
+--
+-- Legacy markdown-anchor links (a task_blockers row with blocker_ref and no
+-- blocker_id) are out of scope, the same scope core_223 and 176 draw: the JOIN
+-- below only sees structured links, so a legacy row neither blocks nor releases.
+--
+-- CASCADE SAFETY. task_blockers.task_id and .blocker_id are both ON DELETE
+-- CASCADE. Nothing in the repo hard-deletes a task (abandon is terminal) or a
+-- blocker (resolve is), so in practice this fires only on a real unlink. If a
+-- blocker ever were deleted outright, releasing the tasks it held is the correct
+-- reading — the thing that was blocking them no longer exists.
+--
+-- Idempotent: CREATE OR REPLACE for the function, DROP IF EXISTS + CREATE for
+-- the trigger (a trigger has no CREATE OR REPLACE before PG 14, and this must
+-- apply cleanly on a re-run).
+
+BEGIN;
+
+CREATE OR REPLACE FUNCTION trg_release_task_on_blocker_unlink()
+RETURNS TRIGGER AS $$
+BEGIN
+  UPDATE tasks
+     SET status = 'ready', updated_at = now()
+   WHERE id = OLD.task_id
+     AND status = 'blocked'
+     -- … and nothing open is left against this task (core_223's predicate,
+     -- minus the self-exclusion an AFTER DELETE trigger does not need).
+     AND NOT EXISTS (
+       SELECT 1
+         FROM task_blockers tb
+         JOIN blockers b ON b.id = tb.blocker_id
+        WHERE tb.task_id = OLD.task_id
+          AND b.status = 'open'
+     );
+  RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS release_task_on_blocker_unlink ON task_blockers;
+CREATE TRIGGER release_task_on_blocker_unlink
+  AFTER DELETE ON task_blockers
+  FOR EACH ROW
+  EXECUTE FUNCTION trg_release_task_on_blocker_unlink();
+
+COMMIT;

package/modules/hall-ui/public/claim-action.js

@@ -0,0 +1,250 @@
+// modules/hall-ui/public/claim-action.js — the hall's ONE claim/release action
+// (task 1003458, from the board's own copy).
+//
+// WHY THIS EXISTS. /work owned the only working claim path in the hall, and the
+// moment a second surface wanted a claim button it got one by copy-paste:
+// goals-page.js's own comments still name the line ranges it lifted ("ported
+// from work.js renderClaimable, work.js:345-394"). The copies then drifted, the
+// way task-lib.js's header says they always do — by the time this was written
+// the SAME refusal read "Someone else claimed that task first. The board will
+// refresh." on /work and "… Reloading." on /goals, and the goals copy had
+// quietly dropped the "Wait for it to ship." advice from TOUCHES_CONFLICT and
+// "Pick another for now." from DEPS_NOT_SHIPPED. Neither copy had a single test.
+//
+// AND THE DRIFT HID A BIGGER HOLE. Both copies handled 8 of the server's refusal
+// codes. modules/lifecycle/CLAUDE.md documents the claim gate's refusal chain in
+// order, and REBASE_REQUIRED (#2), TASK_NOT_FOUND (#3), OPEN_BLOCKER (#5),
+// GOAL_MEMBERSHIP_REQUIRED (#8) and MODULE_CONFLICT (#10) were in neither — so a
+// builder who hit any of them, including the two most ordinary ones, got "The
+// board could not complete that (409). Try again." tests/claim_action.mjs now
+// reads db-claims.js and FAILS if the server grows a refusal this file has no
+// sentence for, which is what makes "a new surface needs no new refusal
+// handling" true rather than aspirational.
+//
+// Contract, mirrored from task-lib.js so load order only needs "before the page
+// script": dependency-free (its own envelope readers, no window.OTB use), no
+// eval-time DOM, everything hangs off one global, Node-require-safe so it can be
+// unit-tested. The ACTION half takes its I/O injected — each board keeps its own
+// postJSON (auth posture), toast and refresh — so this file never touches the
+// network or the DOM itself.
+//
+// NOT here: task.js's friendlyActionError. That maps the LIFECYCLE refusals of
+// POST /tasks/:id/ship and /confirm (task_not_confirmed, task_not_completed,
+// verify_attestation_required) — a different route, a disjoint code set. Folding
+// the two would make one switch that is wrong about half its cases.
+(function () {
+  'use strict';
+
+  // ADR 0116's envelope: { error: { code, message, details } }. Both readers fall
+  // back to the flat legacy shape, because a refusal that renders "[object
+  // Object]" is the defect task 1002462 was about and it must not come back.
+  function errCode(data) {
+    const e = data && data.error;
+    return (e && typeof e === 'object') ? e.code : e;
+  }
+  function errDetails(data) {
+    const e = data && data.error;
+    return (e && typeof e === 'object' && e.details) ? e.details : (data || {});
+  }
+  function errMessage(data) {
+    const e = data && data.error;
+    if (e && typeof e === 'object' && e.message) return e.message;
+    return (data && data.message) || '';
+  }
+
+  // Every code POST /claims, /claims/batch and /claims/:id/resolve can refuse
+  // with, in the order modules/lifecycle/CLAUDE.md documents the gate checking
+  // them. Keep this list in that order: it is the map a reader compares against.
+  function friendlyClaimError(status, data) {
+    const det = errDetails(data);
+    switch (errCode(data)) {
+      // 1. the builder, before anything about the task
+      case 'BUILDER_INACTIVE':
+        return 'Your account is inactive. Contact an Archon.';
+      // 2. ADR 0120 part 3 — one stale claim blocks every NEW claim, so the
+      // sentence has to name the way out or the builder just retries forever.
+      // The server sends its own hint; prefer it, since it names the task.
+      case 'REBASE_REQUIRED':
+        return errMessage(data)
+          || 'A task you hold needs rebasing before you can claim anything new. Run /strand-fix on it.';
+      // 3. the board is showing something the server no longer has
+      case 'TASK_NOT_FOUND':
+        return 'That task no longer exists. The board will refresh.';
+      case 'TASK_NOT_READY':
+        return 'That task is no longer ready to be claimed.';
+      // 5. task 1002650 — the feed filters these out, but a direct claim can
+      // still land on one, and "could not complete that" tells the builder
+      // nothing about a blocker they could go and read.
+      case 'OPEN_BLOCKER':
+        return 'That task is held by an open blocker. See /blockers for what it is waiting on.';
+      // 6 + 7 are two DIFFERENT axes (the permission queue vs the task's own
+      // requires_rank floor) and lifecycle/CLAUDE.md says never to collapse
+      // them — but from the builder's chair the remedy is identical, so they
+      // share one sentence rather than one case.
+      case 'rank_too_low_for_task':
+      case 'XENOS_RESTRICTED':
+      case 'INSUFFICIENT_RANK':
+        return 'Your rank is not yet high enough for that task.';
+      // 8. task 1003137. The refusal deliberately carries no title or scope for
+      // a private goal, so this must not invent one either.
+      case 'GOAL_MEMBERSHIP_REQUIRED':
+        return errMessage(data) || 'That task belongs to a goal you are not a member of.';
+      case 'DEPS_NOT_SHIPPED':
+        return 'That task waits on unshipped dependencies. Pick another for now.';
+      // 10. the module-level sibling of TOUCHES_CONFLICT, and a REFUSAL where
+      // TOUCHES_CONFLICT is only advisory.
+      case 'MODULE_CONFLICT':
+        return det.module_key
+          ? `That task shares module "${det.module_key}" with an active claim. Wait for it to ship.`
+          : 'That task shares a module with an active claim. Wait for it to ship.';
+      // 11. advisory since task 880 — it only refuses on the enforcing path.
+      case 'TOUCHES_CONFLICT': {
+        const titles = Array.isArray(det.conflicts) ? det.conflicts.map((c) => c.title).filter(Boolean) : [];
+        return titles.length
+          ? `That task overlaps an active claim: ${titles.join('; ')}. Wait for it to ship.`
+          : 'That task overlaps another active claim. Wait for it to ship.';
+      }
+      // 12. the 23505 backstop: anything unrecognised fails CLOSED onto this.
+      case 'ALREADY_CLAIMED':
+        return 'Someone else claimed that task first. The board will refresh.';
+      // route-layer gates, chained on POST /claims
+      case 'session_already_has_active_claim':
+      case 'session_already_has_bound_claim':
+        return 'This session already holds a claim. Ship or release it first.';
+      case 'newcomer_must_ship_first':
+        return det.what_to_do || 'Ship your current claim before opening another.';
+      // gateOneActiveClaimPerSession fails CLOSED: if it cannot read what this
+      // session holds it refuses rather than risk a second claim. Say that it is
+      // transient, or the builder reads it as a permission problem.
+      case 'session_claim_check_failed':
+        return 'Could not check what this session already holds. Try again in a moment.';
+      // release-side
+      case 'NOT_YOUR_CLAIM':
+        return 'That claim is not yours to release.';
+      case 'ALREADY_RESOLVED':
+        return 'That claim was already resolved. The board will refresh.';
+      default:
+        return `The board could not complete that (${status}). Try again.`;
+    }
+  }
+
+  // The action itself: the CALL, the refusal, and the refresh — the half the
+  // boards used to hand-roll four times each. `postJSON` must reject with
+  // { status, data } on a non-2xx (both boards' helpers already do) and may
+  // throw the sentinel 'redirecting to auth', which every caller swallows
+  // rather than toasting.
+  //
+  // What stays with the CALLER: its own button text, its re-entrancy guard, its
+  // confirm() wording, and its selection state. Those are page furniture and
+  // differ per surface; the network call and what a refusal MEANS do not. Each
+  // method answers { ok } (plus { redirected } on the auth sentinel) so a caller
+  // can re-enable its own button without re-reading the error.
+  //
+  // `refresh` is awaited after a success AND after a 409, because a 409 always
+  // means the board is showing something stale.
+  //
+  // `describeBatchReason` maps ONE item of a batch refusal (task-lib.js's
+  // friendlyBatchReason). Injected rather than imported to keep this file
+  // dependency-free; a caller that omits it gets the raw reason, never a crash.
+  function makeClaimAction({ postJSON, toast, refresh, API = '/api/bongos', describeBatchReason } = {}) {
+    const reason = describeBatchReason || ((f) => (f && f.reason) || 'not claimable');
+    const reload = async () => { if (refresh) await refresh(); };
+    const quiet = async () => { try { await reload(); } catch (_) { /* the toast already told them */ } };
+
+    // The batch endpoints are ALL-OR-NOTHING: a 409 batch_failed means nothing
+    // was claimed, so the toast has to name which tasks stopped it or the
+    // builder cannot tell what to deselect. task 1002462: this used to compare
+    // `err.data.error` (an object) to a string, so every batch refusal fell
+    // through to the generic line and the per-task reasons were dropped.
+    function batchRefusal(err) {
+      if (!(err && err.status === 409 && errCode(err.data) === 'batch_failed')) return null;
+      const failures = errDetails(err.data).failures;
+      const lines = Array.isArray(failures) ? failures.map((f) => `#${f.task_id} (${reason(f)})`) : [];
+      return lines.length
+        ? `The batch could not be claimed — ${lines.join('; ')}.`
+        : 'The batch could not be claimed. It was left untouched (all-or-nothing).';
+    }
+
+    async function run(fn, okMsg) {
+      try {
+        const out = await fn();
+        if (okMsg) toast(typeof okMsg === 'function' ? okMsg(out) : okMsg);
+        await reload();
+        return { ok: true, data: out };
+      } catch (err) {
+        if (err && err.message === 'redirecting to auth') return { ok: false, redirected: true };
+        const batch = batchRefusal(err);
+        toast(batch || friendlyClaimError(err && err.status, err && err.data));
+        if (batch || (err && err.status === 409)) await quiet();
+        return { ok: false, error: err };
+      }
+    }
+
+    // bind_session:false — a web claim has no working session, so leave it
+    // unbound (claims.js resolveCreatorSessionId) and the builder can ship it
+    // later from any of their own terminals.
+    const claimOne = (taskId) => postJSON(`${API}/claims`, { task_id: Number(taskId), bind_session: false });
+    // No DELETE /claims/:id exists — release is resolve(outcome=abandoned), the
+    // same path /builder-release uses, scoped server-side to the caller's own
+    // claim (NOT_YOUR_CLAIM).
+    const releaseOne = (claimId) => postJSON(`${API}/claims/${encodeURIComponent(claimId)}/resolve`, { outcome: 'abandoned' });
+
+    // THE DRY RUN. /claims/batch/validate asks the server what a bulk claim
+    // WOULD do, so a refusal can be shown before the click rather than after it.
+    // Best-effort by design: on any failure it answers "not parallel-safe, know
+    // nothing", because the caller uses this to decide whether to offer a
+    // parallel prompt, and copying a prompt for tasks nobody verified is worse
+    // than offering nothing. It therefore never throws and never toasts — an
+    // unavailable pre-check is not a refusal to report.
+    async function validateMany(ids) {
+      try {
+        const result = await postJSON(`${API}/claims/batch/validate`, { task_ids: ids });
+        return {
+          ok: true,
+          parallelSafe: !!result.parallel_safe,
+          byId: new Map((result.results || []).map((r) => [String(r.task_id), r])),
+        };
+      } catch (_) {
+        return { ok: false, parallelSafe: false, byId: new Map() };
+      }
+    }
+
+    return {
+      validateMany,
+      claim: (taskId) => run(() => claimOne(taskId), `You claimed #${taskId}. Open a terminal to start work.`),
+      release: (claimId, taskId) => run(() => releaseOne(claimId), `Released #${taskId}. It returns to the queue.`),
+
+      // One id takes the SINGLE endpoint, not a batch of one: the batch route is
+      // all-or-nothing and reports per-item reasons, which is the wrong shape
+      // (and the wrong sentence) for a selection of one.
+      claimMany: (ids) => run(
+        () => (ids.length === 1 ? claimOne(ids[0]) : postJSON(`${API}/claims/batch`, { task_ids: ids, bind_session: false })),
+        ids.length === 1
+          ? `You claimed #${ids[0]}. Open a terminal to start work.`
+          : `Claimed ${ids.length} tasks. Open a terminal to start work.`
+      ),
+
+      // entries: [claimId, taskId] pairs. The batch release is NOT all-or-nothing
+      // — it answers released[] + failures[] — so its sentence counts rather
+      // than lists.
+      releaseMany: (entries) => run(
+        () => (entries.length === 1
+          ? releaseOne(entries[0][0])
+          : postJSON(`${API}/claims/batch/release`, { claim_ids: entries.map(([cid]) => Number(cid)) })),
+        entries.length === 1
+          ? `Released #${entries[0][1]}. It returns to the queue.`
+          : (result) => {
+            const released = Array.isArray(result && result.released) ? result.released.length : 0;
+            const failed = Array.isArray(result && result.failures) ? result.failures.length : 0;
+            return failed
+              ? `Released ${released} of ${entries.length} — ${failed} could not be released.`
+              : `Released ${released} tasks. They return to the queue.`;
+          }
+      ),
+    };
+  }
+
+  const api = { errCode, errDetails, errMessage, friendlyClaimError, makeClaimAction };
+  if (typeof window !== 'undefined') window.OTBClaimAction = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/goals-page.js

@@ -23,6 +23,8 @@
 (function () {
   'use strict';
   const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+  // task 1003458 — the hall's one claim/release action.
+  const { makeClaimAction } = window.OTBClaimAction;
   // Shared task-domain helpers (task 1002463). These lived in two copies here and
   // in the other board and had already drifted — goals-page.js had silently lost
   // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
@@ -110,6 +112,18 @@
     if (!res.ok) { const e = new Error(`${path} → ${res.status}`); e.status = res.status; e.data = data; throw e; }
     return data;
   }
+
+  // The hall's ONE claim/release action (task 1003458). This page's three
+  // claim/release functions used to be hand-copied from work.js — their own
+  // comments still say so — and the copies drifted. They now keep only what is
+  // genuinely this page (button text, the pending guard, the confirm wording,
+  // the goal selection) and hand the call, the refusal and the refresh here.
+  // Refreshing the open goal is this surface's equivalent of the board's
+  // refreshLive; with no goal open there is no task list to reload.
+  const claimAction = makeClaimAction({
+    postJSON, toast, API, describeBatchReason: friendlyBatchReason,
+    refresh: async () => { if (state.current != null) await loadGoalTasks(state.current); },
+  });
   // task 1953 — the visibility toggle is the only PATCH this page makes.
   async function patchJSON(path, body) {
     const res = await api.request('PATCH', path, { body: body || {} });
@@ -419,35 +433,17 @@
     const btn = $('#goal-bulk-claim-btn');
     if (btn) { btn.disabled = true; btn.textContent = 'Claiming…'; }
     try {
-      if (ids.length === 1) {
-        await postJSON(`${API}/claims`, { task_id: ids[0], bind_session: false });
-        toast(`You claimed #${ids[0]}. Open a terminal to start work.`);
-      } else {
-        await postJSON(`${API}/claims/batch`, { task_ids: ids, bind_session: false });
-        toast(`Claimed ${ids.length} tasks. Open a terminal to start work.`);
-      }
-      goalSel.claim.clear();
-    } catch (err) {
-      if (err && err.message === 'redirecting to auth') return;
-      // claims/batch is all-or-nothing: a 409 batch_failed means NOTHING was
-      // claimed. Read failures from the ADR 0116 envelope (error.details.failures)
-      // or the flat legacy shape, via the same normalizers friendlyClaimError uses.
-      const det = errDetails(err.data);
-      if (err.status === 409 && errCode(err.data) === 'batch_failed') {
-        // One read covers both envelopes: errDetails returns error.details on the ADR
-        // 0116 shape and the raw body on the flat legacy one, so a second
-        // `err.data.failures` fallback here is unreachable (task 1003657).
-        const failures = Array.isArray(det.failures) ? det.failures : [];
-        const lines = failures.map((f) => `#${f.task_id} (${friendlyBatchReason(f)})`);
-        toast(lines.length
-          ? `The batch could not be claimed — ${lines.join('; ')}.`
-          : 'The batch could not be claimed. It was left untouched (all-or-nothing).');
-      } else {
-        toast(friendlyClaimError(err.status, err.data));
-      }
+      const out = await claimAction.claimMany(ids);
+      if (out.ok) goalSel.claim.clear();
     } finally {
-      if (state.current != null) await loadGoalTasks(state.current);
-      else renderGoalBulkToolbar();
+      // The shared action already reloaded the open goal's task list, on the
+      // success path AND the 409 one — re-fetching here would make every bulk
+      // claim on this page fetch and re-render twice. work.js's doBulkClaim is
+      // the right shape: redraw the toolbar, nothing else. It has to happen on
+      // every path, because the button was disabled above and the paths where
+      // no reload runs (the auth redirect, a refresh that failed quietly) have
+      // nothing else to re-enable it.
+      renderGoalBulkToolbar();
     }
   }
 
@@ -517,15 +513,8 @@
     pendingClaims.add(key);
     if (btn) { btn.disabled = true; btn.textContent = 'Claiming…'; }
     try {
-      // bind_session:false — a web claim has no working session (matches the
-      // Work Board), so the builder can ship it later from any terminal.
-      await postJSON(`${API}/claims`, { task_id: Number(taskId), bind_session: false });
-      toast(`You claimed #${taskId}. Open a terminal to start work.`);
-      if (state.current != null) await loadGoalTasks(state.current);
-    } catch (err) {
-      if (err && err.message === 'redirecting to auth') return;
-      toast(friendlyClaimError(err.status, err.data));
-      if (btn) { btn.disabled = false; btn.textContent = 'Claim'; }
+      const out = await claimAction.claim(taskId);
+      if (!out.ok && !out.redirected && btn) { btn.disabled = false; btn.textContent = 'Claim'; }
     } finally {
       pendingClaims.delete(key);
     }
@@ -542,13 +531,8 @@
     pendingClaims.add(key);
     if (btn) { btn.disabled = true; btn.textContent = 'Releasing…'; }
     try {
-      await postJSON(`${API}/claims/${encodeURIComponent(claimId)}/resolve`, { outcome: 'abandoned' });
-      toast(`Released #${taskId}. It returns to the queue.`);
-      if (state.current != null) await loadGoalTasks(state.current);
-    } catch (err) {
-      if (err && err.message === 'redirecting to auth') return;
-      toast(friendlyClaimError(err.status, err.data));
-      if (btn) { btn.disabled = false; btn.textContent = 'Release'; }
+      const out = await claimAction.release(claimId, taskId);
+      if (!out.ok && !out.redirected && btn) { btn.disabled = false; btn.textContent = 'Release'; }
     } finally {
       pendingClaims.delete(key);
     }

package/modules/hall-ui/public/goals-render.js

@@ -557,34 +557,13 @@
     const shown = paginate(list, pagers.todo);
     listEl.innerHTML = shown.map(goalTaskCardHtml).join('');
   }
-  function errCode(data) {
-    const e = data && data.error;
-    return (e && typeof e === 'object') ? e.code : e;
-  }
-  function errDetails(data) {
-    const e = data && data.error;
-    return (e && typeof e === 'object' && e.details) ? e.details : (data || {});
-  }
-  function friendlyClaimError(status, data) {
-    const det = errDetails(data);
-    switch (errCode(data)) {
-      case 'ALREADY_CLAIMED': return 'Someone else claimed that task first. Reloading.';
-      case 'TASK_NOT_READY': return 'That task is no longer ready to be claimed.';
-      case 'TOUCHES_CONFLICT': {
-        const titles = Array.isArray(det.conflicts) ? det.conflicts.map((c) => c.title).filter(Boolean) : [];
-        return titles.length ? `That task overlaps an active claim: ${titles.join('; ')}.` : 'That task overlaps another active claim.';
-      }
-      case 'DEPS_NOT_SHIPPED': return 'That task waits on unshipped dependencies.';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'Your rank is not yet high enough for that task.';
-      case 'newcomer_must_ship_first': return det.what_to_do || 'Ship your current claim before opening another.';
-      case 'NOT_YOUR_CLAIM': return 'That claim is not yours to release.';
-      case 'ALREADY_RESOLVED': return 'That claim was already resolved. Reloading.';
-      case 'BUILDER_INACTIVE': return 'Your account is inactive. Contact an Archon.';
-      default: return `The board could not do that (${status}). Try again.`;
-    }
-  }
+  // The hall's ONE claim/release refusal copy + envelope readers (task 1003458).
+  // This file used to carry its own errCode/errDetails and a friendlyClaimError
+  // ported from work.js — and the two had drifted: the same refusal said
+  // "Reloading." here and "The board will refresh." there, and this copy had
+  // lost the "Wait for it to ship." / "Pick another for now." advice entirely.
+  // One definition now, in claim-action.js, complete against the server's chain.
+  const { errCode, errDetails, friendlyClaimError } = window.OTBClaimAction;
   function conflictHtml(c) {
     const sev = c.severity
       ? `<span class="conflict__sev conflict__sev--${escapeHtml(c.severity)}">${escapeHtml(c.severity)}</span>`

package/modules/hall-ui/public/goals.html

@@ -243,6 +243,9 @@
 <script src="/builders/hall-kit.js"></script>
 <!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
 <script src="/builders/task-lib.js"></script>
+<!-- task 1003458: the hall's ONE claim/release action + refusal copy (window.OTBClaimAction).
+     Before goals-render.js, which destructures errCode/errDetails/friendlyClaimError from it. -->
+<script src="/builders/claim-action.js?v=2026-09-26-claimaction1"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
 <script src="/builders/goals-lib.js?v=2026-08-21-goalslib1"></script>
@@ -258,7 +261,7 @@
 <!-- task 1003206: the page RENDERERS, the second half of the carve goals-lib.js
      began — goals-lib took the pure helpers, this takes the view painters.
      Loaded BEFORE goals-page.js, which calls window.OTBGoalsRender(ctx). -->
-<script src="/builders/goals-render.js?v=2026-08-24-goalsrender1"></script>
-<script src="/builders/goals-page.js?v=2026-08-21-goals7"></script>
+<script src="/builders/goals-render.js?v=2026-09-26-claimaction1"></script>
+<script src="/builders/goals-page.js?v=2026-09-26-claimaction1"></script>
 </body>
 </html>

package/modules/hall-ui/public/work.html

@@ -180,13 +180,16 @@
 <script src="/builders/hall-kit.js" defer></script>
 <!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
 <script src="/builders/task-lib.js" defer></script>
+<!-- task 1003458: the hall's ONE claim/release action + refusal copy (window.OTBClaimAction).
+     Before work.js, which destructures friendlyClaimError from it. -->
+<script src="/builders/claim-action.js?v=2026-09-26-claimaction1" defer></script>
 <!-- the hall's one definition of "mine" (window.OTBMineLens) — goals you are on, claims you hold, ships you made; shared with the goal board. -->
 <script src="/builders/mine-lens.js" defer></script>
 <!-- the Completed tab's project-wide momentum card (window.OTBWorkSummary), carved out of work.js. -->
 <script src="/builders/work-summary.js" defer></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
-<script src="/builders/work.js?v=2026-07-03-workboard3" defer></script>
+<script src="/builders/work.js?v=2026-09-26-claimaction1" defer></script>
 <script src="/builders/copy-on-click.js?v=2026-06-01-copy-1" defer></script>
 </body>
 </html>