@bongos/core 1.19.1045 → 1.19.1046

package/docs/adr/0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md

@@ -4,6 +4,7 @@
 - **Date:** 2026-09-25
 - **Deciders:** the owner (direction given 2026-09-24 while reviewing goal 1000110 Wave 1; the D4 calls answered 2026-09-25), Claude.
 - **Task:** [task 1004255](https://cloudbongos.com/builders#/task/1004255) (goal 1000110, Working area 2: account creation, management & community)
+- **Amended:** 2026-09-25 evening, D5 — the owner's four placement calls from the Wave 2 review sheet, recorded by [task 1003444](https://cloudbongos.com/builders#/task/1003444).
 - **Amends:** [ADR 0336](0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md) D5 (superseded by D4.4 below) and D8 (the map ranks by the rounded total); `docs/specs/<redacted>.md` D8 (D4.1); the privacy spec's "`hide_stats` beats everything" rule, for guild totals only, and only for a member who was told and left counting on (D4.4). ADR 0336 D4 (a guild's size is its public roster length) is **unchanged**.
 - **Relates to:** [ADR 0141](<redacted>.md) (the hub is the identity provider; authority stays local), [ADR 0217](0217-rank-gates-inviting-not-viewing.md) (rank gates inviting, not viewing), [ADR 0334](0334-the-recruiting-directory-lists-a-hidden-builder-by-name.md) (the name-only recruiting tier), [ADR 0335](0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md) (an invite is the project's own row), [ADR 0255](0255-a-public-lists-ordering-is-part-of-its-payload.md) (a public list is ordered only by what it publishes)
 
@@ -21,9 +22,9 @@ Goal 1000110 Wave 1 (2026-09-24) showed what that costs. R15 ([task 1002291](htt
 
 | A surface goes on… | when what it shows is… | e.g. |
 |---|---|---|
-| **the HUB** (`modules/public-landing/`, `modules/platform-identity/`) | the person across projects, or more than one project | the people directory, community (leaderboards, search, builder of the week), guilds, connections, recruiting and scouting, the public profile, platform-account settings (D4.3) |
+| **the HUB** (`modules/public-landing/`, `modules/platform-identity/`) | the person across projects, or more than one project | the people directory, community (leaderboards, search, builder of the week), guilds, connections (primary home, D5.4), recruiting and scouting, the public profile (with "Projects you build on" in its own view, D5.3), platform-account settings (D4.3), project invitations and the "join a project" field on their own page (D5.2) |
 | **the HALL** (the project's own instance, `modules/hall-ui/`) | this project's people and work | `/roster` (Builders), the project console (invites, admission, ranks), tasks, goals, in-project activity and achievements |
-| **both** | a person-centred view that has a useful in-project cut | "Builders you may know" (D4.2) |
+| **both** | a person-centred view that has a useful in-project cut | "Builders you may know" (D4.2); connections, where the hall's tab shows only your connections who also build on that project (D5.4) |
 
 `modules/status-ui/` is neither: it is the public status dashboard at `status.<apex>`, not the hall. A hall page may *link* to the hub for the cross-project view, but it does not rebuild it. When a task's text places a cross-project surface in the hall, the task is re-scoped before anyone claims it, never built as written.
 
@@ -35,6 +36,8 @@ D1 decides where pages go. It moves no authority. ADR 0141's line stands: the hu
 
 The hall's `/people` retires ([task 1003444](https://cloudbongos.com/builders#/task/1003444)). Its cross-project job, including ADR 0334's two-tier recruiting directory, moves to the one hub community page ([task 1003363](https://cloudbongos.com/builders#/task/1003363)). ADR 0334's predicates move unchanged; only the page that renders them changes. `/roster` ("Builders") stays as the in-project directory and stops linking out to `/people`.
 
+**Amended by D5.1:** `/people` is deleted now, without waiting for [task 1003363](https://cloudbongos.com/builders#/task/1003363). Until that page ships, `/people` (and its legacy door `/scouting`) redirects to `/roster`.
+
 ### D4 — The owner's calls from the re-scope
 
 1. **Hidden builders open to recruiters: the recruiter panel is recruiter-only, and public search is unchanged.** A builder who hides their numbers but stays open to recruiters appears in ADR 0334's name-only panel (login, display name, avatar) on the hub community page. The panel is shown only to a signed-in viewer that the recruiting door admits, which ADR 0334 defines as a project owner or a holder of `project.curate`. The public builder search (`GET /community/search`, [task 1002979](https://cloudbongos.com/builders#/task/1002979)) keeps listing such a builder by name with no numbers, the same as their public profile page already does. Private accounts stay out of both, and the private-and-discoverable sliver keeps its archon floor (ADR 0217 D2). This amends community-tab spec D8's "to every viewer identically": the public view stays the same for every viewer, and a signed-in recruiter also sees the panel. It adds no new disclosure class.
@@ -55,6 +58,15 @@ The hall's `/people` retires ([task 1003444](https://cloudbongos.com/builders#/t
 
    The notice and the switch exist for this reason. A non-public member is told that their numbers count, and can turn it off for any guild they don't trust. This relaxes the owner-signed privacy rule "`hide_stats` beats everything" (privacy spec D2) for **guild totals only**, and only for a member who was told and left counting on. Every other surface keeps the rule.
 
+### D5 — The owner's calls of 2026-09-25 evening (Wave 2 review)
+
+Reviewing the Wave 2 sheet, the owner made four placement calls. They amend the D1 table above.
+
+1. **Delete the hall's People page now.** The hall already has a Builders page (`/roster`), so `/people` goes without waiting for the hub community page ([task 1003363](https://cloudbongos.com/builders#/task/1003363)). The owner accepted that cross-project search and the recruiter name-only panel (D4.1) are absent until that page ships. [Task 1003444](https://cloudbongos.com/builders#/task/1003444) deleted the page, its nav entry and its page gate; `/people` and `/scouting` redirect to `/roster`. The recruiting API (`GET /scouting`, its own route gate and ADR 0334's predicates) is unchanged and waits for the hub page to render it.
+2. **A builder's project invitations get their own hub page.** The invitations a builder has received (today a section of the hub's `/projects` page) move to a standalone hub page, and the "join a project" field (a project address and an optional note) moves there with them.
+3. **"Projects you build on" moves to the builder's own profile, own view only.** Today a section of the hub's `/projects` page; a builder will see it on their own profile, and a visitor will not.
+4. **Connections live on the hub first.** The hub is the primary home for connections. A project hall's connections tab becomes project-specific: it shows only your connections who also build on that project.
+
 ## Consequences
 
 - Goal 1000110 is re-scoped against D1 before its Wave 2, in one owner-run script. Retargeted tasks carry a description append citing this ADR. Duplicates of the hub community page merge into task 1003363. Dependency edges are re-pointed before any merge or abandon, so no dependent is left on a dead edge. The goal's module scope widens to `public-landing` and `hall-ui`.

package/docs/adr/README.md

@@ -428,7 +428,7 @@ This keeps the decision history honest and traceable.
 | 0334 | [**The recruiting directory lists a hidden builder by name, and hide changes a row's shape, not whether it exists** ([task 1002291](https://cloudbongos.com/builders#/task/1002291), R15 — goal 1000110). Privacy spec D2 (owner-signed) lists an active, public, hidden account on the recruiter surface "name-only (if not opted out)"; the directory dropped it outright, making hide a second opt-out while Settings told that builder recruiters would see their name and picture. `GET /scouting` now answers two tiers: `builders` (ranked, `scoutingListableSql`, unchanged) and `name_only` (`scoutingNameOnlySql` = the same predicate with the hide term flipped, so the tiers partition the directory and only the opt-out removes anyone), projected to `github_login`, `display_name`, `avatar_url` by `scouting-name-only.js`. The existence floor stays (a private account is the archon-floor D3 sliver's, never the directory's); presence never depends on activity; the only order is the login; the predicate is pinned to that one reader and its three columns. The hall's `/people` renders the tier as its own panel, never ranked, found by name, never by a role filter. Rejected: fixing only the copy; trailing rows in the ranked ledger; listing private discoverable accounts by name.](0334-the-recruiting-directory-lists-a-hidden-builder-by-name.md) | privacy / recruiting / hall |
 | 0335 | [**An invite is a pre-approved row on the project's own instance, and `project.recruit` says who may send one** ([task 1002813](https://cloudbongos.com/builders#/task/1002813), R1 of the project admin console wave, goal 1000110 — BONGOS-V2). Supersedes ADR 0141 §5's "Invitations (deferred slice)" paragraph only. Formalises spike task 1002786's three decisions and reconciles them with six weeks of shipping: the instance invite route (task 1003044), the PATCH rescind (ADR 0201 D4.2) and the composed join door (ADR 0247) already exist, and the hub invite's dead end is now reachable from the creation wizard. **Decisions:** (D1) authority lives on the project's own instance, and the instance IS the project; the hub is identity, relay, echo, notification and links, and never writes a project's admission row; (D2) a recruit invite is an `access_requests` row with `status='invited'`, so signing in is the acceptance act and the gate is untouched; the row gains `kind ∈ (application, invite)` and `created_by` (the inviter, which a rescind would otherwise overwrite), reuses `note`, backfills exactly (`created_at = resolved_at`), and neither column ever enters an admission read; (D3) one new grantable atom, `project.recruit` (`system:false`, floor archon, widened per instance through the existing governance tab), guards the invite, the outstanding list, the invite rescind and the queue read, while `access_request.review` keeps the verdict; because inviting is admitting, a recruiter without the review atom may not approve or re-admit an APPLICANT through the invite route (409 to the queue); the hub sliver moves onto the atom, and the hub directory and hub invite KEEP `project.curate`, revising ADR 0210/0215/0248, since swapping the directory would raise a gate on a viewing surface (ADR 0217). **Task map:** R2 (task 1002814) = the migration, the invite writes and the sender list, still on `access_request.review`; R3 (task 1002815) = mint the atom, move the gates, the 409 clause, the sliver swap and the pins, and it lands after R2; R5 (task 1002817) is already delivered, so close it into task 1002331; task 1003362 folds into R3. Rejected: a new invitations table; the hub pending row as the invite; widening `access_request.review` instead of minting an atom; a per-project settings row for the floor; letting a recruiter's invite approve applications; `system:true`; swapping `project.curate` on the hub directory.](0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md) | governance / onboarding / platform-identity |
 | 0336 | [**A guild is a hub-side group whose members each consent twice, and its collective record is only ever the sum of what those members already show** ([task 1002299](https://cloudbongos.com/builders#/task/1002299), goal 1000110 — the R23 design spike for goal 1000045's C7/C8/C9). No platform guild existed (every "guild" in the tree is Discord's). Decisions: (1) three hub tables in `platform-identity`, in their own `guilds.js` (the 1,500-line ratchet), distinct from instance-local `goal_members`: guilds (slug, name, `visibility ∈ public|unlisted` with **no default**), members (`membership_kind ∈ owner|member`, never `role` per ADR 0174; a partial unique index holds exactly one owner; a per-member `shown_publicly`), and requests; (2) two consents to join, no self-join, through ADR 0202's connections lifecycle verbatim (silent decline, 90-day swallowed re-ask, 30-day read-time expiry); `accountActiveSql` floors the feature; an **unlisted guild 404s to everyone on the public read, members included**, and takes invites only, because a slug is guessable; (3) the public roster is `shown_publicly AND accountVisibleSql`, and widening a guild to public changes no member's flag but the flipping owner's, so consent given to a small audience is never reused for a large one; (4) **the privacy resolution — NOT ratified; superseded by [ADR 0337](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) D4.4:** it proposed that a member is counted iff shown AND `rollupVisibleSql`, read-time, `no-store`, never stored, and N and M are both lengths of lists the reader can see. The guild record is therefore always a sum of numbers already on members' own public profiles, so nothing can be subtracted out. All-or-nothing is rejected (one member blanks everyone and hiding becomes costly), as is per-member consent to count hidden numbers (it breaks "hide_stats beats everything"). The trade-off: guilds of privacy-minded builders look smaller and rank lower. A union count of all members' projects is refused because it reveals shared private projects; (5) the namespace is `/g/<slug>`, `g` is reserved in the SEO spec's project-slug list, the slug is fixed in V1, and `tests/guild_namespace_reserved.mjs` pins the two documents together; (6) a guild engages a project only through the individual door: a guild application is each member's own vouched application, labelled through ADR 0260's live applicant-profile read (no new instance field); inviting a guild fans out ordinary individual invites to its public roster at that moment, **never a guild-level pre-approval** (that would let a guild owner decide admission to someone else's project); (7) the map ranks public guilds by size and counted works shipped, read-time, with a slug tiebreak, and R29 narrows to the visual. Scope changes for R24–R37 are tabled in the ADR, including R28's dependency on the abandoned R11 and R29/R31's archived orb goals.](0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md) | platform identity / privacy / social graph |
-| 0337 | [**The hub account is the person, a hall account is their seat in one project, so anything that spans projects lives on the hub** ([task 1004255](https://cloudbongos.com/builders#/task/1004255), goal 1000110 — the owner's hub/hall re-scope, 2026-09-24/25). Extends [ADR 0141](<redacted>.md) from identity to placement: (1) a surface about the person across projects, or about more than one project, goes on the HUB (`public-landing`, `platform-identity`): people directory, community, guilds, connections, recruiting, platform-account settings; one about this project goes in the HALL (`hall-ui`); "Builders you may know" is on both; `status-ui` is the status dashboard, not the hall; (2) no authority moves, and hub actions still land as the project's own rows; (3) hall `/people` retires, ADR 0334's recruiting directory moves unchanged to the hub community page, `/roster` is the in-project directory; (4) owner calls: the hidden-builder recruiter panel is recruiter-only while public search is unchanged (amends community-tab spec D8); platform-account settings get a new hub page; **guild totals count hidden and private members by default, with a notice on the join card and a per-guild off switch (`counted_in_totals`), rounded to a 1–2–5 band, only once a guild has at least 3 of them, refreshed weekly; size stays the public roster length** (supersedes ADR 0336 D5; relaxes the privacy spec's "`hide_stats` beats everything" for guild totals only, for a member who was told), with the fake-account padding limit stated and accepted.](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) | platform identity / placement / privacy |
+| 0337 | [**The hub account is the person, a hall account is their seat in one project, so anything that spans projects lives on the hub** ([task 1004255](https://cloudbongos.com/builders#/task/1004255), goal 1000110 — the owner's hub/hall re-scope, 2026-09-24/25). Extends [ADR 0141](<redacted>.md) from identity to placement: (1) a surface about the person across projects, or about more than one project, goes on the HUB (`public-landing`, `platform-identity`): people directory, community, guilds, connections, recruiting, platform-account settings; one about this project goes in the HALL (`hall-ui`); "Builders you may know" is on both; `status-ui` is the status dashboard, not the hall; (2) no authority moves, and hub actions still land as the project's own rows; (3) hall `/people` retires, ADR 0334's recruiting directory moves unchanged to the hub community page, `/roster` is the in-project directory; (4) owner calls: the hidden-builder recruiter panel is recruiter-only while public search is unchanged (amends community-tab spec D8); platform-account settings get a new hub page; **guild totals count hidden and private members by default, with a notice on the join card and a per-guild off switch (`counted_in_totals`), rounded to a 1–2–5 band, only once a guild has at least 3 of them, refreshed weekly; size stays the public roster length** (supersedes ADR 0336 D5; relaxes the privacy spec's "`hide_stats` beats everything" for guild totals only, for a member who was told), with the fake-account padding limit stated and accepted; (5) amended 2026-09-25 evening ([task 1003444](https://cloudbongos.com/builders#/task/1003444)): hall `/people` is deleted now rather than when the hub community page ships (it redirects to `/roster`, and cross-project search plus the recruiter name-only panel wait for task 1003363), a builder's invitations and the join-a-project field get their own hub page, "Projects you build on" moves to the builder's own profile (own view only), and connections live on the hub first while a hall's connections tab shows only connections who build on that project.](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) | platform identity / placement / privacy |
 | 0338 | [**Modules travel through a Bongos-hosted store, and an acquired module keeps working forever** ([task 1003782](https://cloudbongos.com/builders#/task/1003782), goal 1000091 — working area 5, owner Will). A module had no transport of its own: it reached an instance only inside the core (ADR 0107 §6) or in the instance's repo. Weighed npm packages, a Bongos-hosted store and git refs against the four things area 5's criteria require — entitlement before install, a per-version score, a tester channel, and a delist that stops distribution. npm and git refs fail entitlement and delist by construction. **D1:** Cloud Bongos hosts the store; a module version is a tarball + hash manifest in the same format `package-core.js` already emits (same `isPublishable()` gate), registry rows on the control-plane DB, artifacts in the already-paid DO Spaces bucket, served by the control plane only after an entitlement + channel check; free modules take the same path at price zero; install/update verify hashes on arrival; modules' own npm deps still travel via npm (ADR 0138). No new fixed cost. **D2 (owner):** delisting, author withdrawal or deletion removes a module from the catalog and stops new acquisitions and updates, but **an acquired module keeps working forever** — the store never disables or removes an installed copy and a delist never revokes an entitlement; the holder is told no more updates will come. Security issues are not a special case; a remote kill switch would need a superseding ADR. Rejected: npm, git refs, remote disable on delist.](0338-modules-travel-through-a-bongos-hosted-store.md) | modules / distribution / economy |
 | 0339 | [**A project's owner upgrades it, and a hosted project hands off to the hub's door** ([task 1004174](https://cloudbongos.com/builders#/task/1004174), goal 1000090 — the owner's ruling of 2026-09-26 that only a project's owner upgrades it). Amends ADR 0293 D5. **D1:** the deploy door's preview and move routes admit the OWNER of a tenant row (`co-tenant`/`cloud-host`) for that row, asked first; every other caller meets the unmodified `core.pin.move` gate, so a non-owner's refusal is unchanged whether or not the id exists and the widening can only admit. **D2:** the platform's own row stays atom-only. **D3:** `GET /core-update` names `<hub>/deploy?project=<slug>` on a federated project, and the hosted hall's banner and rail hand off there (the dead local Deploy item is gone); the hub's `/deploy` shell admits a project owner through `alsoAdmits: 'isProjectOwner'`. **D4:** the intent's actor records the door (`api:owner:<id>` / `api:archon:<id>`), both attributed on the `core_upgrades` ledger. Rejected: a tenant-side API that performs the upgrade, granting the system atom to owners, owners moving the platform row. ADR 0328 Phase 1 (task 1004159) should fold this gate into `requireProjectOwner`.](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) | provisioning / deploy door / permissions |
 | 0340 | [**Every hall takes its update from Settings, and /deploy is the platform hall's page** ([task 1004296](https://cloudbongos.com/builders#/task/1004296), goal 1000090 — the owner's 2026-09-25 asks: a Settings version panel "just like iOS", and /deploy only in the Bongos hall). Amends ADR 0339 D3 and the reach of ADR 0293's page. **D1:** Settings → Software update in the core — the running core, the newest release the runner's own channel rule allows, and what each version in between carries from the newest package's release notes; every signed-in builder reads it, and "up to date" is said only from an answer. **D2:** its Update button leads to the door (local /deploy, the hub's /deploy?project=, or a `bongos upgrade` sentence), drawn only for holders of core.pin.move. **D3:** /deploy 302s to Settings on a hall without the provisioning module. **D4:** the banner links Settings everywhere but the platform; the rail is no longer re-pointed; /core-update drops deploy_url. **D5:** the registry reader moved into the core (module-api readPackageRegistry). Rejected: a second copy of the two-step door, gating the panel on the atom, a "moved" page.](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) | deploy door / settings / core update |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2063 strings** across 3 surfaces · 1771 distinct pieces of copy · 2063 certain, 0 heuristic · 208 shown in more than one place.
+**2056 strings** across 3 surfaces · 1765 distinct pieces of copy · 2056 certain, 0 heuristic · 207 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 104 | 1562 |
+| `builders-hall` | `modules/hall-ui/public` | 102 | 1555 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 401 |
 
@@ -76,9 +76,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7926e30955d2` | 3x | ← Back to goal | modules/hall-ui/public/goals.html:199, modules/hall-ui/public/goals.html:210, modules/hall-ui/public/goals.html:222 |
 | `07f422cbdb7e` | 2x | ) and capture-resistant by design. | modules/public-landing/public/projects.html:1056, modules/public-landing/public/projects.html:1083 |
 | `22825067f4c5` | 2x | 1 builder | modules/public-landing/public/index.html:747, modules/public-landing/public/index.html:752 |
-| … | | _168 more in the JSON registry_ | |
+| … | | _167 more in the JSON registry_ | |
 
-## `builders-hall` — 1562 strings
+## `builders-hall` — 1555 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -216,7 +216,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2b8ad43383de` | certain | Board Room — {{worldName}} | `modules/hall-ui/public/board-room.html:6` |
 | `da910fee01d7` | certain | Browse goals → | `modules/hall-ui/public/goals.js:83` |
 | `1596210cea76` | certain | Build from your own machine — clone the repository, run the platform locally, and sign in from the terminal. | `modules/hall-ui/public/hall-render.js:864` |
-| `29bd516ad17e` | certain | Builder directory | `modules/hall-ui/public/people.html:37` |
 | `08bfcc9198ba` | certain | Builder id | `modules/hall-ui/public/government.html:109` |
 | `306bc316184d` | certain | Builders you may know | `modules/hall-ui/public/profile-connections.js:158` |
 | `60b248791dc3` | certain | Builders — {{worldName}} | `modules/hall-ui/public/roster.html:6` |
@@ -441,7 +440,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bc481184a282` | certain | Every place you are currently signed in — this browser, your terminal, any dev box. A session refreshes for an | `modules/hall-ui/public/settings.html:163` |
 | `47be006e5ad5` | certain | Every sitting since has been decided under the constitution below, not the ratified one. Nothing is re-applied | `modules/hall-ui/public/government.js:633` |
 | `efafe5ce29ed` | certain | Every task linked to this criterion has shipped — a Metic can confirm it | `modules/hall-ui/public/goals-render.js:707` |
-| `ddebbccd4b37` | certain | Everyone building across hosted projects, ranked by track record. Descriptive only — cross-project numbers nev | `modules/hall-ui/public/people.html:29` |
 | `04bbccfe7465` | certain | Everything a new builder needs before claiming their first task. About a ten-minute read. | `modules/hall-ui/public/primer.html:42` |
 | `89d9c0962048` | certain | Everything that fell out of it | `modules/hall-ui/public/idea.js:393` |
 | `37110f7e2b27` | certain | Everything this builder has shipped. Seen one role at a time, with goals and ideas, under | `modules/hall-ui/public/profile.html:108` |
@@ -588,7 +586,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a21788f84e29` | certain | Its author gave no scope recommendation. | `modules/hall-ui/public/board-room.js:295` |
 | `b0bcb3f844ec` | certain | Its author marked this as needing development — anyone can turn it into a Full Idea, and they keep the credit  | `modules/hall-ui/public/idea.js:445` |
 | `680491549e47` | certain | Its author recommends this becomes | `modules/hall-ui/public/board-room.js:294` |
-| `5e62ee5addf1` | certain | Its details are below. | `modules/hall-ui/public/shell.js:682` |
+| `5e62ee5addf1` | certain | Its details are below. | `modules/hall-ui/public/shell.js:675` |
 | `d42a078838bf` | certain | Its notes could not be read. | `modules/hall-ui/public/settings-software-update.js:101` |
 | `b7719e855009` | certain | Join goal | `modules/hall-ui/public/goals-render.js:953` |
 | `9f9424a5100b` | certain | Join our Discord | `modules/hall-ui/public/hall-render.js:823` |
@@ -597,8 +595,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:227` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:81` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/thinking.html:80` |
-| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:501` |
-| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:503` |
+| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:494` |
+| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:496` |
 | `bc779353aa0c` | certain | Karma — peer recognition and approvals, a separate counter from {…}. | `modules/hall-ui/public/profile.js:94` |
 | `de0e1590667f` | certain | Keep all {…} {…} — they are the values the code drops in, and the change cannot land without them. | `modules/hall-ui/public/copy-desk.js:442` |
 | `fbe40b5818a3` | certain | Key removed. | `modules/hall-ui/public/settings.js:1128` |
@@ -623,7 +621,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a53e0cde7ff7` | certain | Link first — your rank role is set the moment you join. | `modules/hall-ui/public/settings.js:840` |
 | `64e85f1691f9` | certain | Link your Discord account and you're added to the {{worldName}} server with your rank role already set — no in | `modules/hall-ui/public/settings.html:61` |
 | `9a31cf5fe05b` | certain | Linking opens Discord's consent screen; unlinking applies at once. | `modules/hall-ui/public/settings.html:66` |
-| `8e067a257eed` | certain | Listed by name only | `modules/hall-ui/public/people.html:53` |
 | `daf84bba41b1` | certain | Loading goals… | `modules/hall-ui/public/goals.html:44` |
 | `93ceeaa4e226` | certain | Loading idea | `modules/hall-ui/public/idea.html:32` |
 | `2b5826012538` | certain | Loading profile… | `modules/hall-ui/public/profile.html:34` |
@@ -633,7 +630,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `20d8552e13db` | certain | Loading tasks… | `modules/hall-ui/public/work.html:32` |
 | `217f64ef8667` | certain | Loading the catalog… | `modules/hall-ui/public/modules.html:59` |
 | `a8b3b04b0b4d` | certain | Loading the copy desk… | `modules/hall-ui/public/copy-desk.html:28` |
-| `2bde9c630fd2` | certain | Loading the directory… | `modules/hall-ui/public/people.html:40` |
 | `fcd755e8dd30` | certain | Loading the five questions… | `modules/hall-ui/public/ideas.html:183` |
 | `e201b4962858` | certain | Loading the idea | `modules/hall-ui/public/idea.html:43` |
 | `9972fc9b4727` | certain | Loading the map… | `modules/hall-ui/public/atlas.html:51` |
@@ -782,7 +778,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `261d123970e8` | certain | Open goal #{…} | `modules/hall-ui/public/roadmap.js:112` |
 | `5f3e0b179839` | certain | Open in Sessions | `modules/hall-ui/public/task.js:483` |
 | `9f55e4674ebb` | certain | Open in the copy desk | `modules/hall-ui/public/studio.js:219` |
-| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:492` |
+| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:485` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/goals-render.js:415` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/work.js:1036` |
 | `99c630009152` | certain | Open tasks whose declared files overlap — sequence these before two builders collide. | `modules/hall-ui/public/goals.html:125` |
@@ -811,8 +807,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `54fa47e421a5` | certain | Peer recognition | `modules/hall-ui/public/hall-widgets.js:168` |
 | `47d609ece51c` | certain | Pending invitations | `modules/hall-ui/public/goals-render.js:1412` |
 | `a69aff719f1a` | certain | People asking to join. Approve or dismiss each request, re-read the ones you already decided, and take back an | `modules/hall-ui/public/watch.html:62` |
-| `b95918d421ae` | certain | People — {{worldName}} | `modules/hall-ui/public/people.html:6` |
-| `b95918d421ae` | certain | People — {{worldName}} | `modules/hall-ui/public/people.html:6` |
 | `4a46b478edaf` | certain | Per page | `modules/hall-ui/public/hall-kit.js:74` |
 | `e1e10dc5e357` | certain | Permissions is the Archon administration surface. The Constitution and the Board Room are yours to read. | `modules/hall-ui/public/government.js:896` |
 | `6bc03d97457b` | certain | Pick a priority first. | `modules/hall-ui/public/task.js:878` |
@@ -989,12 +983,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:367` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:391` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:461` |
-| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:462` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:480` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:724` |
+| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:455` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:473` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:717` |
 | `8ad669ab2565` | certain | Sign out everywhere | `modules/hall-ui/public/settings.html:171` |
 | `ecc12c1dd4de` | certain | Skill voices | `modules/hall-ui/public/settings.html:350` |
-| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:715` |
+| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:708` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:294` |
 | `207af7ce6828` | certain | Software update | `modules/hall-ui/public/settings.html:409` |
@@ -1022,7 +1016,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5831de503015` | certain | Studio — {{worldName}} | `modules/hall-ui/public/studio.html:10` |
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:84` |
 | `a1482eff4ead` | certain | Suggested for you | `modules/hall-ui/public/settings-specialities.js:137` |
-| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:507` |
+| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:500` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
 | `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1335` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:139` |
@@ -1043,7 +1037,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fc66e722e33` | certain | Tasks open once you have read the builder primer. | `modules/hall-ui/public/work.html:43` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
-| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:506` |
+| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:499` |
 | `f420429f942e` | certain | That builder no longer exists. | `modules/hall-ui/public/goals-render.js:1284` |
 | `545c59c1deb7` | certain | That is the session you are using right now. Ending it signs you out of this page. | `modules/hall-ui/public/settings-sessions.js:74` |
 | `282c3fa2d456` | certain | That is the wording it already has. Change something, or file a flag instead if you only want to mark it. | `modules/hall-ui/public/copy-desk.js:438` |
@@ -1126,7 +1120,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1404` |
 | `25794c439321` | certain | Then copy the project onto your machine and run the one-shot bootstrap (it checks your setup, installs depende | `modules/hall-ui/public/hall-render.js:890` |
 | `df316c3484de` | certain | Then drive it however you like: | `modules/hall-ui/public/hall-render.js:825` |
-| `bc3e5d620247` | certain | These builders are open to recruiting but keep their cross-project record hidden, so only who they are is show | `modules/hall-ui/public/people.html:54` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1282` |
 | `5151cf635644` | certain | They have asked to connect. | `modules/hall-ui/public/profile-connections.js:236` |
 | `10219b02433e` | certain | They join as a member once they accept — you can change that afterwards. Nobody is added until they do. | `modules/hall-ui/public/goals-render.js:1214` |
@@ -1180,7 +1173,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `13ced9b2fa12` | certain | Update ready | `modules/hall-ui/public/settings-software-update.js:145` |
 | `55fde21d907b` | certain | Update to {…}{…} | `modules/hall-ui/public/settings-software-update.js:85` |
 | `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:777` |
-| `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:679` |
+| `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:672` |
 | `e7e2a99a2bea` | certain | Use this | `modules/hall-ui/public/settings-specialities.js:148` |
 | `e1ecd543a2ca` | certain | Using this speciality. | `modules/hall-ui/public/settings-specialities.js:199` |
 | `6200bac6bdca` | certain | View all sessions | `modules/hall-ui/public/watch.html:99` |
@@ -1236,7 +1229,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d3a8b2b5b93f` | certain | Where {{currency}} and karma come from and where they go. | `modules/hall-ui/public/diagrams.html:67` |
 | `68da8cb13058` | certain | Which version of Cloud Bongos this project runs, whether a newer one is ready for it, and what each newer vers | `modules/hall-ui/public/settings.html:410` |
 | `f9ab9eb870a6` | certain | While you wait: install the Claude desktop app at | `modules/hall-ui/public/hall-render.js:437` |
-| `fe85463560e0` | certain | Who builds on this project, ranked by work shipped. This project's own ledger — unlike the cross-project direc | `modules/hall-ui/public/roster.html:28` |
+| `74d8c58ef235` | certain | Who builds on this project, ranked by work shipped. This project's own ledger — everyone who builds here is li | `modules/hall-ui/public/roster.html:28` |
 | `7dbdb882e967` | certain | Who can find you. Your profile page can be public or private, and recruiters looking for builders are allowed  | `modules/hall-ui/public/settings.html:111` |
 | `b79ea4077bc5` | certain | Who can use it | `modules/hall-ui/public/settings.html:288` |
 | `045c629729b7` | certain | Who’s on this goal, and what they’ve contributed to it. | `modules/hall-ui/public/goals.html:213` |
@@ -1293,7 +1286,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e25863ab2311` | certain | Your sky — {{worldName}} | `modules/hall-ui/public/thinking.html:6` |
 | `e25863ab2311` | certain | Your sky — {{worldName}} | `modules/hall-ui/public/thinking.html:6` |
 | `dd419ffd76f0` | certain | Your specialities | `modules/hall-ui/public/settings.html:252` |
-| `c16addf957d0` | certain | Your track record across every project you build on, shown on your public profile. Hiding it takes effect imme | `modules/hall-ui/public/settings.html:96` |
+| `cc066f023e9c` | certain | Your track record across every project you build on, shown on your public profile. Hiding it takes effect imme | `modules/hall-ui/public/settings.html:96` |
 | `a824e3e2057a` | certain | Your verdict on a review is recorded from the review itself — open it to dismiss it, note what you saw, or fil | `modules/hall-ui/public/studio.js:159` |
 | `f6b12676169b` | certain | Your vote | `modules/hall-ui/public/hall-widgets.js:170` |
 | `fe94ff29a2cc` | certain | Your wandering level could not be loaded. Reload the page to try again. | `modules/hall-ui/public/settings.js:484` |

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2063,
-    "unique_ids": 1771,
-    "certain": 2063,
+    "strings": 2056,
+    "unique_ids": 1765,
+    "certain": 2056,
     "heuristic": 0,
-    "duplicate_ids": 208
+    "duplicate_ids": 207
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 104,
-      "strings": 1562
+      "files": 102,
+      "strings": 1555
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -192,7 +192,7 @@
         "modules/hall-ui/public/hall-render.js:367",
         "modules/hall-ui/public/hall-render.js:391",
         "modules/hall-ui/public/hall-render.js:461",
-        "modules/hall-ui/public/shell.js:462"
+        "modules/hall-ui/public/shell.js:455"
       ]
     },
     {
@@ -1262,16 +1262,6 @@
         "modules/hall-ui/public/goals.html:202"
       ]
     },
-    {
-      "id": "b95918d421ae",
-      "surface": "builders-hall",
-      "text": "People — {{worldName}}",
-      "occurrences": 2,
-      "at": [
-        "modules/hall-ui/public/people.html:6",
-        "modules/hall-ui/public/people.html:6"
-      ]
-    },
     {
       "id": "5b08da0632c7",
       "surface": "builders-hall",
@@ -1548,8 +1538,8 @@
       "text": "Sign out",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/shell.js:480",
-        "modules/hall-ui/public/shell.js:724"
+        "modules/hall-ui/public/shell.js:473",
+        "modules/hall-ui/public/shell.js:717"
       ]
     },
     {
@@ -3410,15 +3400,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "29bd516ad17e",
-      "surface": "builders-hall",
-      "text": "Builder directory",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 37,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "08bfcc9198ba",
       "surface": "builders-hall",
@@ -5435,15 +5416,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "ddebbccd4b37",
-      "surface": "builders-hall",
-      "text": "Everyone building across hosted projects, ranked by track record. Descriptive only — cross-project numbers never carry authority here.",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 29,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "04bbccfe7465",
       "surface": "builders-hall",
@@ -6763,7 +6735,7 @@
       "surface": "builders-hall",
       "text": "Its details are below.",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 682,
+      "line": 675,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6844,7 +6816,7 @@
       "surface": "builders-hall",
       "text": "Jump to a page or record",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 501,
+      "line": 494,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6853,7 +6825,7 @@
       "surface": "builders-hall",
       "text": "Jump to…",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 503,
+      "line": 496,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7073,15 +7045,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "8e067a257eed",
-      "surface": "builders-hall",
-      "text": "Listed by name only",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 53,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "daf84bba41b1",
       "surface": "builders-hall",
@@ -7163,15 +7126,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "2bde9c630fd2",
-      "surface": "builders-hall",
-      "text": "Loading the directory…",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 40,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "fcd755e8dd30",
       "surface": "builders-hall",
@@ -8509,7 +8463,7 @@
       "surface": "builders-hall",
       "text": "Open navigation",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 492,
+      "line": 485,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8765,24 +8719,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "b95918d421ae",
-      "surface": "builders-hall",
-      "text": "People — {{worldName}}",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 6,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
-    {
-      "id": "b95918d421ae",
-      "surface": "builders-hall",
-      "text": "People — {{worldName}}",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 6,
-      "origin": "html-title",
-      "confidence": "certain"
-    },
     {
       "id": "4a46b478edaf",
       "surface": "builders-hall",
@@ -10372,7 +10308,7 @@
       "surface": "builders-hall",
       "text": "Sign in with GitHub",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 462,
+      "line": 455,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10381,7 +10317,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 480,
+      "line": 473,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10390,7 +10326,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 724,
+      "line": 717,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10417,7 +10353,7 @@
       "surface": "builders-hall",
       "text": "Skip to content",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 715,
+      "line": 708,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10669,7 +10605,7 @@
       "surface": "builders-hall",
       "text": "Switch theme",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 507,
+      "line": 500,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10858,7 +10794,7 @@
       "surface": "builders-hall",
       "text": "Text size",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 506,
+      "line": 499,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11600,15 +11536,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "bc3e5d620247",
-      "surface": "builders-hall",
-      "text": "These builders are open to recruiting but keep their cross-project record hidden, so only who they are is shown. They are never ranked, and a role filter never finds them.",
-      "file": "modules/hall-ui/public/people.html",
-      "line": 54,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "a0140098c0e0",
       "surface": "builders-hall",
@@ -12091,7 +12018,7 @@
       "surface": "builders-hall",
       "text": "Use the control below to take it.",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 679,
+      "line": 672,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12591,9 +12518,9 @@
       "confidence": "certain"
     },
     {
-      "id": "fe85463560e0",
+      "id": "74d8c58ef235",
       "surface": "builders-hall",
-      "text": "Who builds on this project, ranked by work shipped. This project's own ledger — unlike the cross-project directory, it lists everyone who builds here.",
+      "text": "Who builds on this project, ranked by work shipped. This project's own ledger — everyone who builds here is listed.",
       "file": "modules/hall-ui/public/roster.html",
       "line": 28,
       "origin": "html-text",
@@ -13104,9 +13031,9 @@
       "confidence": "certain"
     },
     {
-      "id": "c16addf957d0",
+      "id": "cc066f023e9c",
       "surface": "builders-hall",
-      "text": "Your track record across every project you build on, shown on your public profile. Hiding it takes effect immediately everywhere — your profile, the People directory, and recruiting views.",
+      "text": "Your track record across every project you build on, shown on your public profile. Hiding it takes effect immediately everywhere — your profile, the recruiting directory, and a recruiter's look-up of one builder.",
       "file": "modules/hall-ui/public/settings.html",
       "line": 96,
       "origin": "html-text",

package/docs/file-map.md

@@ -134,7 +134,7 @@
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
-│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
+│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `roster.css` the Builders roster's identity cell (was `people.css`, shared with the cross-project `/people` directory until task 1003444 deleted that page — `/people` and its legacy door `/scouting` now 302 to `/roster`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
@@ -377,8 +377,7 @@ tests/
 ├── canonical_profile_url.mjs      ← (task 1002804, goal 1000045 criterion C1, ADR 0214): the P08 proof — the canonical profile URL is resolved in ONE place, `handle` reaches `GET /builders/:id/profile` under the EXISTENCE predicate (so a hidden builder keeps their address), absent/provisional/private are BYTE-IDENTICAL so the numeric-id redirect cannot become an existence oracle, and the widened response still leaks no private column. Real core router over a WHERE-derived fake pool on a real socket; the real browser script in a vm above a stub DOM, run twice — as shipped (every surface dark, because `/u/<handle>` still 404s) and with the liveness constant flipped, so the three live behaviours are proved rather than deferred. Asserts its own DB-free lane membership. DB-free `unit` lane.
 ├── application_lifecycle.mjs     ← (task 1002284, goal 1000045, ADR 0201 D1/D3.2/D4 + ADR 0208): the application lifecycle EXECUTED — apply, list-pending, approve, decline, RESCIND (`invited → dismissed`), idempotency on the state already held, and the two things that must never happen: a builder without `access_request.review` moving the queue, and a VOUCH buying admission. Real router, REAL `requirePermission` resolving against the real government catalog's rank seed, and the REAL `hasInvitedAccessRequest` from `src/bongos/db-kernel.js` pointed at the same in-memory `access_requests` table (a stubbed `./pool`), whose filter is built from each statement's own WHERE clause and which refuses a predicate it cannot read. The no-authority proof seeds a vouched row and asserts the approve path and the admission read are byte-identical to the unvouched twin, and that no statement on either path names `applicant_github_id`/`vouched_at`. DB-free `unit` lane.
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
-├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Since task 1002291 (R15, ADR 0334) it also proves the directory's NAME-ONLY tier: a hidden, reachable builder is listed by login, name and avatar alone, never ranked, and none of their record reaches the body. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked five ways. DB-free `unit` lane. The page half is `people_name_only.mjs` (the real people.js + kit in a vm).
-├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
+├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting`, returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Since task 1002291 (R15, ADR 0334) it also proves the directory's NAME-ONLY tier: a hidden, reachable builder is listed by login, name and avatar alone, never ranked, and none of their record reaches the body. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked five ways. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 ├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.

package/docs/module-api-changelog.md

@@ -2577,5 +2577,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1043 with no explicit bump. run 36260641494. (task 1002620)
   1.19.1045 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1044 with no explicit bump. run 36263855490. (task 1002620)
+  1.19.1046 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1045 with no explicit bump. run 36265788618. (task 1002620)
 ---------------------------------------------------------------------------
 ```