@bongos/core 1.19.1044 → 1.19.1046

package/docs/file-map.md

@@ -134,7 +134,7 @@
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
-│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
+│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `roster.css` the Builders roster's identity cell (was `people.css`, shared with the cross-project `/people` directory until task 1003444 deleted that page — `/people` and its legacy door `/scouting` now 302 to `/roster`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
@@ -377,8 +377,7 @@ tests/
 ├── canonical_profile_url.mjs      ← (task 1002804, goal 1000045 criterion C1, ADR 0214): the P08 proof — the canonical profile URL is resolved in ONE place, `handle` reaches `GET /builders/:id/profile` under the EXISTENCE predicate (so a hidden builder keeps their address), absent/provisional/private are BYTE-IDENTICAL so the numeric-id redirect cannot become an existence oracle, and the widened response still leaks no private column. Real core router over a WHERE-derived fake pool on a real socket; the real browser script in a vm above a stub DOM, run twice — as shipped (every surface dark, because `/u/<handle>` still 404s) and with the liveness constant flipped, so the three live behaviours are proved rather than deferred. Asserts its own DB-free lane membership. DB-free `unit` lane.
 ├── application_lifecycle.mjs     ← (task 1002284, goal 1000045, ADR 0201 D1/D3.2/D4 + ADR 0208): the application lifecycle EXECUTED — apply, list-pending, approve, decline, RESCIND (`invited → dismissed`), idempotency on the state already held, and the two things that must never happen: a builder without `access_request.review` moving the queue, and a VOUCH buying admission. Real router, REAL `requirePermission` resolving against the real government catalog's rank seed, and the REAL `hasInvitedAccessRequest` from `src/bongos/db-kernel.js` pointed at the same in-memory `access_requests` table (a stubbed `./pool`), whose filter is built from each statement's own WHERE clause and which refuses a predicate it cannot read. The no-authority proof seeds a vouched row and asserts the approve path and the admission read are byte-identical to the unvouched twin, and that no statement on either path names `applicant_github_id`/`vouched_at`. DB-free `unit` lane.
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
-├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Since task 1002291 (R15, ADR 0334) it also proves the directory's NAME-ONLY tier: a hidden, reachable builder is listed by login, name and avatar alone, never ranked, and none of their record reaches the body. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked five ways. DB-free `unit` lane. The page half is `people_name_only.mjs` (the real people.js + kit in a vm).
-├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
+├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting`, returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Since task 1002291 (R15, ADR 0334) it also proves the directory's NAME-ONLY tier: a hidden, reachable builder is listed by login, name and avatar alone, never ranked, and none of their record reaches the body. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked five ways. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 ├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.

package/docs/module-api-changelog.md

@@ -2575,5 +2575,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1042 with no explicit bump. run 36258640780. (task 1002620)
   1.19.1044 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1043 with no explicit bump. run 36260641494. (task 1002620)
+  1.19.1045 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1044 with no explicit bump. run 36263855490. (task 1002620)
+  1.19.1046 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1045 with no explicit bump. run 36265788618. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -212,7 +212,7 @@ caught a real bug during task 1003548, so read its assertion before blaming the
 
 ## CRLF: a multi-line find silently misses, and a whole-file diff is usually line endings
 
-- Several hall files (`people.css`, `people.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/gds/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
+- Several hall files (`roster.css`, `roster.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/gds/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
 - A `git diff --stat` that touches every line of a file you barely edited is an EOL flip — check with `git diff --stat --ignore-cr-at-eol`, and restore the original EOL before committing.
 - **`copy-inventory.js --check` no longer reds on line endings alone** (task 1003619). It used to: the generator emits LF and the check byte-compared that against a CRLF worktree file, so `/ship-check` showed one permanent red line on every Windows checkout while the committed content was already correct — and a builder who "fixed" it committed a whole-file CRLF diff. `docs/copy-inventory.md` is now pinned `text eol=lf` in `.gitattributes` (its `.json` sibling always was, via `*.json`), and the check compares EOL-blind so an already-CRLF worktree passes without a re-clone. If it reports STALE now, the content really is stale — regenerate, don't reach for `--ignore-cr-at-eol`. Since task 1003981 `*.md` IS pinned repo-wide (`*.md text eol=lf`), so a fresh clone gets LF markdown everywhere and a markdown reader no longer has to be CRLF-aware to be correct. An EXISTING Windows checkout keeps its CRLF copies until git rewrites them — the clean filter still normalises to LF on add, so `git status` stays quiet and nothing is broken; to convert in place, `git rm --cached -r . && git reset --hard`.
 - **A freshness check compares CONTENT, so route it through `sameContent()`** (`scripts/gds/gen-freshness.js`) rather than `===` on file bytes. A pin is the wrong lever on its own: regenerating never clears a byte-wise red, because the write lands LF and git converts it back on the next checkout. `tests/gen_freshness.mjs` enforces this for the four gated generators; `tests/api_client.mjs` was outside that guard and reported the client STALE forever on Windows until task 1003529 (`index.d.ts` and `README.md` are the two generated client files with no `eol=lf` pin).

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/claim-action.js

@@ -0,0 +1,250 @@
+// modules/hall-ui/public/claim-action.js — the hall's ONE claim/release action
+// (task 1003458, from the board's own copy).
+//
+// WHY THIS EXISTS. /work owned the only working claim path in the hall, and the
+// moment a second surface wanted a claim button it got one by copy-paste:
+// goals-page.js's own comments still name the line ranges it lifted ("ported
+// from work.js renderClaimable, work.js:345-394"). The copies then drifted, the
+// way task-lib.js's header says they always do — by the time this was written
+// the SAME refusal read "Someone else claimed that task first. The board will
+// refresh." on /work and "… Reloading." on /goals, and the goals copy had
+// quietly dropped the "Wait for it to ship." advice from TOUCHES_CONFLICT and
+// "Pick another for now." from DEPS_NOT_SHIPPED. Neither copy had a single test.
+//
+// AND THE DRIFT HID A BIGGER HOLE. Both copies handled 8 of the server's refusal
+// codes. modules/lifecycle/CLAUDE.md documents the claim gate's refusal chain in
+// order, and REBASE_REQUIRED (#2), TASK_NOT_FOUND (#3), OPEN_BLOCKER (#5),
+// GOAL_MEMBERSHIP_REQUIRED (#8) and MODULE_CONFLICT (#10) were in neither — so a
+// builder who hit any of them, including the two most ordinary ones, got "The
+// board could not complete that (409). Try again." tests/claim_action.mjs now
+// reads db-claims.js and FAILS if the server grows a refusal this file has no
+// sentence for, which is what makes "a new surface needs no new refusal
+// handling" true rather than aspirational.
+//
+// Contract, mirrored from task-lib.js so load order only needs "before the page
+// script": dependency-free (its own envelope readers, no window.OTB use), no
+// eval-time DOM, everything hangs off one global, Node-require-safe so it can be
+// unit-tested. The ACTION half takes its I/O injected — each board keeps its own
+// postJSON (auth posture), toast and refresh — so this file never touches the
+// network or the DOM itself.
+//
+// NOT here: task.js's friendlyActionError. That maps the LIFECYCLE refusals of
+// POST /tasks/:id/ship and /confirm (task_not_confirmed, task_not_completed,
+// verify_attestation_required) — a different route, a disjoint code set. Folding
+// the two would make one switch that is wrong about half its cases.
+(function () {
+  'use strict';
+
+  // ADR 0116's envelope: { error: { code, message, details } }. Both readers fall
+  // back to the flat legacy shape, because a refusal that renders "[object
+  // Object]" is the defect task 1002462 was about and it must not come back.
+  function errCode(data) {
+    const e = data && data.error;
+    return (e && typeof e === 'object') ? e.code : e;
+  }
+  function errDetails(data) {
+    const e = data && data.error;
+    return (e && typeof e === 'object' && e.details) ? e.details : (data || {});
+  }
+  function errMessage(data) {
+    const e = data && data.error;
+    if (e && typeof e === 'object' && e.message) return e.message;
+    return (data && data.message) || '';
+  }
+
+  // Every code POST /claims, /claims/batch and /claims/:id/resolve can refuse
+  // with, in the order modules/lifecycle/CLAUDE.md documents the gate checking
+  // them. Keep this list in that order: it is the map a reader compares against.
+  function friendlyClaimError(status, data) {
+    const det = errDetails(data);
+    switch (errCode(data)) {
+      // 1. the builder, before anything about the task
+      case 'BUILDER_INACTIVE':
+        return 'Your account is inactive. Contact an Archon.';
+      // 2. ADR 0120 part 3 — one stale claim blocks every NEW claim, so the
+      // sentence has to name the way out or the builder just retries forever.
+      // The server sends its own hint; prefer it, since it names the task.
+      case 'REBASE_REQUIRED':
+        return errMessage(data)
+          || 'A task you hold needs rebasing before you can claim anything new. Run /strand-fix on it.';
+      // 3. the board is showing something the server no longer has
+      case 'TASK_NOT_FOUND':
+        return 'That task no longer exists. The board will refresh.';
+      case 'TASK_NOT_READY':
+        return 'That task is no longer ready to be claimed.';
+      // 5. task 1002650 — the feed filters these out, but a direct claim can
+      // still land on one, and "could not complete that" tells the builder
+      // nothing about a blocker they could go and read.
+      case 'OPEN_BLOCKER':
+        return 'That task is held by an open blocker. See /blockers for what it is waiting on.';
+      // 6 + 7 are two DIFFERENT axes (the permission queue vs the task's own
+      // requires_rank floor) and lifecycle/CLAUDE.md says never to collapse
+      // them — but from the builder's chair the remedy is identical, so they
+      // share one sentence rather than one case.
+      case 'rank_too_low_for_task':
+      case 'XENOS_RESTRICTED':
+      case 'INSUFFICIENT_RANK':
+        return 'Your rank is not yet high enough for that task.';
+      // 8. task 1003137. The refusal deliberately carries no title or scope for
+      // a private goal, so this must not invent one either.
+      case 'GOAL_MEMBERSHIP_REQUIRED':
+        return errMessage(data) || 'That task belongs to a goal you are not a member of.';
+      case 'DEPS_NOT_SHIPPED':
+        return 'That task waits on unshipped dependencies. Pick another for now.';
+      // 10. the module-level sibling of TOUCHES_CONFLICT, and a REFUSAL where
+      // TOUCHES_CONFLICT is only advisory.
+      case 'MODULE_CONFLICT':
+        return det.module_key
+          ? `That task shares module "${det.module_key}" with an active claim. Wait for it to ship.`
+          : 'That task shares a module with an active claim. Wait for it to ship.';
+      // 11. advisory since task 880 — it only refuses on the enforcing path.
+      case 'TOUCHES_CONFLICT': {
+        const titles = Array.isArray(det.conflicts) ? det.conflicts.map((c) => c.title).filter(Boolean) : [];
+        return titles.length
+          ? `That task overlaps an active claim: ${titles.join('; ')}. Wait for it to ship.`
+          : 'That task overlaps another active claim. Wait for it to ship.';
+      }
+      // 12. the 23505 backstop: anything unrecognised fails CLOSED onto this.
+      case 'ALREADY_CLAIMED':
+        return 'Someone else claimed that task first. The board will refresh.';
+      // route-layer gates, chained on POST /claims
+      case 'session_already_has_active_claim':
+      case 'session_already_has_bound_claim':
+        return 'This session already holds a claim. Ship or release it first.';
+      case 'newcomer_must_ship_first':
+        return det.what_to_do || 'Ship your current claim before opening another.';
+      // gateOneActiveClaimPerSession fails CLOSED: if it cannot read what this
+      // session holds it refuses rather than risk a second claim. Say that it is
+      // transient, or the builder reads it as a permission problem.
+      case 'session_claim_check_failed':
+        return 'Could not check what this session already holds. Try again in a moment.';
+      // release-side
+      case 'NOT_YOUR_CLAIM':
+        return 'That claim is not yours to release.';
+      case 'ALREADY_RESOLVED':
+        return 'That claim was already resolved. The board will refresh.';
+      default:
+        return `The board could not complete that (${status}). Try again.`;
+    }
+  }
+
+  // The action itself: the CALL, the refusal, and the refresh — the half the
+  // boards used to hand-roll four times each. `postJSON` must reject with
+  // { status, data } on a non-2xx (both boards' helpers already do) and may
+  // throw the sentinel 'redirecting to auth', which every caller swallows
+  // rather than toasting.
+  //
+  // What stays with the CALLER: its own button text, its re-entrancy guard, its
+  // confirm() wording, and its selection state. Those are page furniture and
+  // differ per surface; the network call and what a refusal MEANS do not. Each
+  // method answers { ok } (plus { redirected } on the auth sentinel) so a caller
+  // can re-enable its own button without re-reading the error.
+  //
+  // `refresh` is awaited after a success AND after a 409, because a 409 always
+  // means the board is showing something stale.
+  //
+  // `describeBatchReason` maps ONE item of a batch refusal (task-lib.js's
+  // friendlyBatchReason). Injected rather than imported to keep this file
+  // dependency-free; a caller that omits it gets the raw reason, never a crash.
+  function makeClaimAction({ postJSON, toast, refresh, API = '/api/bongos', describeBatchReason } = {}) {
+    const reason = describeBatchReason || ((f) => (f && f.reason) || 'not claimable');
+    const reload = async () => { if (refresh) await refresh(); };
+    const quiet = async () => { try { await reload(); } catch (_) { /* the toast already told them */ } };
+
+    // The batch endpoints are ALL-OR-NOTHING: a 409 batch_failed means nothing
+    // was claimed, so the toast has to name which tasks stopped it or the
+    // builder cannot tell what to deselect. task 1002462: this used to compare
+    // `err.data.error` (an object) to a string, so every batch refusal fell
+    // through to the generic line and the per-task reasons were dropped.
+    function batchRefusal(err) {
+      if (!(err && err.status === 409 && errCode(err.data) === 'batch_failed')) return null;
+      const failures = errDetails(err.data).failures;
+      const lines = Array.isArray(failures) ? failures.map((f) => `#${f.task_id} (${reason(f)})`) : [];
+      return lines.length
+        ? `The batch could not be claimed — ${lines.join('; ')}.`
+        : 'The batch could not be claimed. It was left untouched (all-or-nothing).';
+    }
+
+    async function run(fn, okMsg) {
+      try {
+        const out = await fn();
+        if (okMsg) toast(typeof okMsg === 'function' ? okMsg(out) : okMsg);
+        await reload();
+        return { ok: true, data: out };
+      } catch (err) {
+        if (err && err.message === 'redirecting to auth') return { ok: false, redirected: true };
+        const batch = batchRefusal(err);
+        toast(batch || friendlyClaimError(err && err.status, err && err.data));
+        if (batch || (err && err.status === 409)) await quiet();
+        return { ok: false, error: err };
+      }
+    }
+
+    // bind_session:false — a web claim has no working session, so leave it
+    // unbound (claims.js resolveCreatorSessionId) and the builder can ship it
+    // later from any of their own terminals.
+    const claimOne = (taskId) => postJSON(`${API}/claims`, { task_id: Number(taskId), bind_session: false });
+    // No DELETE /claims/:id exists — release is resolve(outcome=abandoned), the
+    // same path /builder-release uses, scoped server-side to the caller's own
+    // claim (NOT_YOUR_CLAIM).
+    const releaseOne = (claimId) => postJSON(`${API}/claims/${encodeURIComponent(claimId)}/resolve`, { outcome: 'abandoned' });
+
+    // THE DRY RUN. /claims/batch/validate asks the server what a bulk claim
+    // WOULD do, so a refusal can be shown before the click rather than after it.
+    // Best-effort by design: on any failure it answers "not parallel-safe, know
+    // nothing", because the caller uses this to decide whether to offer a
+    // parallel prompt, and copying a prompt for tasks nobody verified is worse
+    // than offering nothing. It therefore never throws and never toasts — an
+    // unavailable pre-check is not a refusal to report.
+    async function validateMany(ids) {
+      try {
+        const result = await postJSON(`${API}/claims/batch/validate`, { task_ids: ids });
+        return {
+          ok: true,
+          parallelSafe: !!result.parallel_safe,
+          byId: new Map((result.results || []).map((r) => [String(r.task_id), r])),
+        };
+      } catch (_) {
+        return { ok: false, parallelSafe: false, byId: new Map() };
+      }
+    }
+
+    return {
+      validateMany,
+      claim: (taskId) => run(() => claimOne(taskId), `You claimed #${taskId}. Open a terminal to start work.`),
+      release: (claimId, taskId) => run(() => releaseOne(claimId), `Released #${taskId}. It returns to the queue.`),
+
+      // One id takes the SINGLE endpoint, not a batch of one: the batch route is
+      // all-or-nothing and reports per-item reasons, which is the wrong shape
+      // (and the wrong sentence) for a selection of one.
+      claimMany: (ids) => run(
+        () => (ids.length === 1 ? claimOne(ids[0]) : postJSON(`${API}/claims/batch`, { task_ids: ids, bind_session: false })),
+        ids.length === 1
+          ? `You claimed #${ids[0]}. Open a terminal to start work.`
+          : `Claimed ${ids.length} tasks. Open a terminal to start work.`
+      ),
+
+      // entries: [claimId, taskId] pairs. The batch release is NOT all-or-nothing
+      // — it answers released[] + failures[] — so its sentence counts rather
+      // than lists.
+      releaseMany: (entries) => run(
+        () => (entries.length === 1
+          ? releaseOne(entries[0][0])
+          : postJSON(`${API}/claims/batch/release`, { claim_ids: entries.map(([cid]) => Number(cid)) })),
+        entries.length === 1
+          ? `Released #${entries[0][1]}. It returns to the queue.`
+          : (result) => {
+            const released = Array.isArray(result && result.released) ? result.released.length : 0;
+            const failed = Array.isArray(result && result.failures) ? result.failures.length : 0;
+            return failed
+              ? `Released ${released} of ${entries.length} — ${failed} could not be released.`
+              : `Released ${released} tasks. They return to the queue.`;
+          }
+      ),
+    };
+  }
+
+  const api = { errCode, errDetails, errMessage, friendlyClaimError, makeClaimAction };
+  if (typeof window !== 'undefined') window.OTBClaimAction = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/collab.css

@@ -108,7 +108,7 @@
 
 /* ---- the face -----------------------------------------------------------------
    A row leads with WHO: a 36px disc, the picture when the server sent one, the
-   initial on the glass when it did not (people.css's .dir-avatar, at the row's
+   initial on the glass when it did not (roster.css's .dir-avatar, at the row's
    size). A craft ask wears the craft's letter in the label face, so it never
    passes for a person. Decorative — the name beside it is the door. */
 .cb-face {

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -69,7 +69,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
+<script src="/builders/shell.js?v=2026-09-26-nopeople"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goals-page.js

@@ -23,6 +23,8 @@
 (function () {
   'use strict';
   const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+  // task 1003458 — the hall's one claim/release action.
+  const { makeClaimAction } = window.OTBClaimAction;
   // Shared task-domain helpers (task 1002463). These lived in two copies here and
   // in the other board and had already drifted — goals-page.js had silently lost
   // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
@@ -110,6 +112,18 @@
     if (!res.ok) { const e = new Error(`${path} → ${res.status}`); e.status = res.status; e.data = data; throw e; }
     return data;
   }
+
+  // The hall's ONE claim/release action (task 1003458). This page's three
+  // claim/release functions used to be hand-copied from work.js — their own
+  // comments still say so — and the copies drifted. They now keep only what is
+  // genuinely this page (button text, the pending guard, the confirm wording,
+  // the goal selection) and hand the call, the refusal and the refresh here.
+  // Refreshing the open goal is this surface's equivalent of the board's
+  // refreshLive; with no goal open there is no task list to reload.
+  const claimAction = makeClaimAction({
+    postJSON, toast, API, describeBatchReason: friendlyBatchReason,
+    refresh: async () => { if (state.current != null) await loadGoalTasks(state.current); },
+  });
   // task 1953 — the visibility toggle is the only PATCH this page makes.
   async function patchJSON(path, body) {
     const res = await api.request('PATCH', path, { body: body || {} });
@@ -419,35 +433,17 @@
     const btn = $('#goal-bulk-claim-btn');
     if (btn) { btn.disabled = true; btn.textContent = 'Claiming…'; }
     try {
-      if (ids.length === 1) {
-        await postJSON(`${API}/claims`, { task_id: ids[0], bind_session: false });
-        toast(`You claimed #${ids[0]}. Open a terminal to start work.`);
-      } else {
-        await postJSON(`${API}/claims/batch`, { task_ids: ids, bind_session: false });
-        toast(`Claimed ${ids.length} tasks. Open a terminal to start work.`);
-      }
-      goalSel.claim.clear();
-    } catch (err) {
-      if (err && err.message === 'redirecting to auth') return;
-      // claims/batch is all-or-nothing: a 409 batch_failed means NOTHING was
-      // claimed. Read failures from the ADR 0116 envelope (error.details.failures)
-      // or the flat legacy shape, via the same normalizers friendlyClaimError uses.
-      const det = errDetails(err.data);
-      if (err.status === 409 && errCode(err.data) === 'batch_failed') {
-        // One read covers both envelopes: errDetails returns error.details on the ADR
-        // 0116 shape and the raw body on the flat legacy one, so a second
-        // `err.data.failures` fallback here is unreachable (task 1003657).
-        const failures = Array.isArray(det.failures) ? det.failures : [];
-        const lines = failures.map((f) => `#${f.task_id} (${friendlyBatchReason(f)})`);
-        toast(lines.length
-          ? `The batch could not be claimed — ${lines.join('; ')}.`
-          : 'The batch could not be claimed. It was left untouched (all-or-nothing).');
-      } else {
-        toast(friendlyClaimError(err.status, err.data));
-      }
+      const out = await claimAction.claimMany(ids);
+      if (out.ok) goalSel.claim.clear();
     } finally {
-      if (state.current != null) await loadGoalTasks(state.current);
-      else renderGoalBulkToolbar();
+      // The shared action already reloaded the open goal's task list, on the
+      // success path AND the 409 one — re-fetching here would make every bulk
+      // claim on this page fetch and re-render twice. work.js's doBulkClaim is
+      // the right shape: redraw the toolbar, nothing else. It has to happen on
+      // every path, because the button was disabled above and the paths where
+      // no reload runs (the auth redirect, a refresh that failed quietly) have
+      // nothing else to re-enable it.
+      renderGoalBulkToolbar();
     }
   }
 
@@ -517,15 +513,8 @@
     pendingClaims.add(key);
     if (btn) { btn.disabled = true; btn.textContent = 'Claiming…'; }
     try {
-      // bind_session:false — a web claim has no working session (matches the
-      // Work Board), so the builder can ship it later from any terminal.
-      await postJSON(`${API}/claims`, { task_id: Number(taskId), bind_session: false });
-      toast(`You claimed #${taskId}. Open a terminal to start work.`);
-      if (state.current != null) await loadGoalTasks(state.current);
-    } catch (err) {
-      if (err && err.message === 'redirecting to auth') return;
-      toast(friendlyClaimError(err.status, err.data));
-      if (btn) { btn.disabled = false; btn.textContent = 'Claim'; }
+      const out = await claimAction.claim(taskId);
+      if (!out.ok && !out.redirected && btn) { btn.disabled = false; btn.textContent = 'Claim'; }
     } finally {
       pendingClaims.delete(key);
     }
@@ -542,13 +531,8 @@
     pendingClaims.add(key);
     if (btn) { btn.disabled = true; btn.textContent = 'Releasing…'; }
     try {
-      await postJSON(`${API}/claims/${encodeURIComponent(claimId)}/resolve`, { outcome: 'abandoned' });
-      toast(`Released #${taskId}. It returns to the queue.`);
-      if (state.current != null) await loadGoalTasks(state.current);
-    } catch (err) {
-      if (err && err.message === 'redirecting to auth') return;
-      toast(friendlyClaimError(err.status, err.data));
-      if (btn) { btn.disabled = false; btn.textContent = 'Release'; }
+      const out = await claimAction.release(claimId, taskId);
+      if (!out.ok && !out.redirected && btn) { btn.disabled = false; btn.textContent = 'Release'; }
     } finally {
       pendingClaims.delete(key);
     }

package/modules/hall-ui/public/goals-render.js

@@ -557,34 +557,13 @@
     const shown = paginate(list, pagers.todo);
     listEl.innerHTML = shown.map(goalTaskCardHtml).join('');
   }
-  function errCode(data) {
-    const e = data && data.error;
-    return (e && typeof e === 'object') ? e.code : e;
-  }
-  function errDetails(data) {
-    const e = data && data.error;
-    return (e && typeof e === 'object' && e.details) ? e.details : (data || {});
-  }
-  function friendlyClaimError(status, data) {
-    const det = errDetails(data);
-    switch (errCode(data)) {
-      case 'ALREADY_CLAIMED': return 'Someone else claimed that task first. Reloading.';
-      case 'TASK_NOT_READY': return 'That task is no longer ready to be claimed.';
-      case 'TOUCHES_CONFLICT': {
-        const titles = Array.isArray(det.conflicts) ? det.conflicts.map((c) => c.title).filter(Boolean) : [];
-        return titles.length ? `That task overlaps an active claim: ${titles.join('; ')}.` : 'That task overlaps another active claim.';
-      }
-      case 'DEPS_NOT_SHIPPED': return 'That task waits on unshipped dependencies.';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'Your rank is not yet high enough for that task.';
-      case 'newcomer_must_ship_first': return det.what_to_do || 'Ship your current claim before opening another.';
-      case 'NOT_YOUR_CLAIM': return 'That claim is not yours to release.';
-      case 'ALREADY_RESOLVED': return 'That claim was already resolved. Reloading.';
-      case 'BUILDER_INACTIVE': return 'Your account is inactive. Contact an Archon.';
-      default: return `The board could not do that (${status}). Try again.`;
-    }
-  }
+  // The hall's ONE claim/release refusal copy + envelope readers (task 1003458).
+  // This file used to carry its own errCode/errDetails and a friendlyClaimError
+  // ported from work.js — and the two had drifted: the same refusal said
+  // "Reloading." here and "The board will refresh." there, and this copy had
+  // lost the "Wait for it to ship." / "Pick another for now." advice entirely.
+  // One definition now, in claim-action.js, complete against the server's chain.
+  const { errCode, errDetails, friendlyClaimError } = window.OTBClaimAction;
   function conflictHtml(c) {
     const sev = c.severity
       ? `<span class="conflict__sev conflict__sev--${escapeHtml(c.severity)}">${escapeHtml(c.severity)}</span>`