@bongos/core 1.19.1050 → 1.19.1052

package/scripts/gds/seed-bv2-tweak-mode-tasks.js

@@ -0,0 +1,277 @@
+// scripts/gds/seed-bv2-tweak-mode-tasks.js — seed the Tweak Mode chain into goal 1000095 (planning session, task 1004312)
+//
+// WHY. The 2026-09-27 planning session settled Tweak Mode — an artist takes a
+// whole page from the lofi studio, rewrites every word of it as one document
+// (or offline in Word and uploads it back), submits, and approves the applied
+// page before it ships — as a dependency CHAIN inside the existing
+// working-area-6 goal. Tweak Mode REPLACES the per-ship artist review (same
+// payouts), text only for now. Source of truth: docs/specs/bongos-v2-tweak-mode.md
+// (final); the approved screens: docs/design/mocks/tweak-mode/.
+//
+// Lands: one criterion, the scope widening the chain needs, the new tasks, the
+// rescope of 1003971 (1004238 merged into it), 1004078 merged into TW14, a
+// split-off backlog task for ARTIST MODE's photo half, and every edge.
+//
+// Idempotent: tasks on (source, source_ref) — a reused ref returns 200 with the
+// FIRST row, so a 200 whose title is not ours is reported, not trusted; the
+// criterion on criterion_id (409 = already seeded); scope is a set-union; edges
+// and criterion links are idempotent server-side; merge reports already_merged.
+//
+// Ends with verifySeedCriteriaLinks. The goal already carries other criteria, so
+// the expected counts are the goal's PRE-seed linked_tasks plus this seed's plan
+// (re-running after a full success therefore reports a mismatch on wa6-tweak-mode:
+// that is the plan being counted twice, not a mislink).
+//
+// Run: node scripts/gds/seed-bv2-tweak-mode-tasks.js [--dry-run]
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const { verifySeedCriteriaLinks } = require('./seed-verify-criteria');
+// cliExit, never process.exit after a request: a hard exit mid-teardown aborts
+// natively on Windows + Node 24 and reports a false exit code (task 1002734).
+const { cliExit } = require('./cli-lib');
+
+function loadSession() {
+  const candidates = [
+    path.join(os.homedir(), '.config', 'cloudbongos', 'gds-session.json'),
+    path.join(os.homedir(), '.config', 'otb', 'gds-session.json'),
+  ];
+  for (const p of candidates) if (fs.existsSync(p)) return JSON.parse(fs.readFileSync(p, 'utf8'));
+  throw new Error('no Bongos session found — run /builder-setup');
+}
+const sess = loadSession();
+const BASE = (process.env.GDS_API_BASE || sess.api_base).replace(/\/$/, '');
+const H = { Authorization: `Bearer ${sess.token}`, 'Content-Type': 'application/json' };
+const DRY = process.argv.includes('--dry-run');
+
+const VER = 'BONGOS-V2';
+const GOAL = 1000095;
+const SRC = 'planning-session';
+const REF = 'bv2-tweak-mode';
+const CRIT = 'wa6-tweak-mode';
+const SPEC = 'docs/specs/bongos-v2-tweak-mode.md';
+const MOCKS = 'docs/design/mocks/tweak-mode/';
+const ARTIST_MODE = 1003971;   // rescoped into TW16
+const LOFI_PAGE = 1004238;     // merged into 1003971
+const STUDIO_COPY = 1004078;   // merged into TW14
+const SCOPE_ADD = ['copy-desk', 'ui-design', 'public-landing', 'status-ui', 'economy'];
+
+const CRITERION_MD = `**An artist can take any page of their project from untweaked to tweaked without leaving the studio or touching a terminal.**
+
+Today an artist's work arrives as one review task per ship and one flag per string, which cannot keep up with how much the project ships; most of it was abandoned unread. When this is true, the page is the unit of an artist's work, and it all happens from one calm place:
+
+- The studio is a lofi home with four doors: Resume, Tweak/CopyWrite Flow, Approval queue and Artist Review Status. The last three open in place as glass panels, and the studio's own words can be rewritten where they stand. The artist's credit tally sits in the corner.
+- Every page on every surface (landing, builders hall, status) has a tweak status with a count ("text tweaked 2x"), a changelog and a changed-since-last-tweak marker. Artist Review Status sums it per surface in three lines.
+- The Tweak/CopyWrite Flow recommends the next page (asked-for first, then changed, then untweaked) and lets the artist pick another; taking it claims the page for them alone.
+- The artist sees every word the rendered page shows as one document and types over it, or downloads it as a .docx, works offline, and uploads it back into the draft. The draft survives closing the tab. One submit, then "next up".
+- The applied page is rendered in the Approval queue, flipped between before and after with the changed words highlighted; nothing ships until the artist approves or sends it back with a note.
+- Text only: nothing structural can change, and shared text changes only on the page being tweaked unless it is literally the same UI element. Text the tool cannot place in the source goes to an engineer as its own task.
+- Tweak Mode replaces the per-ship artist review, and the artist is paid for an approved page what the reviews paid.
+- It works on any Bongos project.
+
+*Written 2026-09-27 by the area owner (planning session, task 1004312). Spec: ${SPEC}. Screens: ${MOCKS}.*`;
+
+const S = `Spec: ${SPEC} (Tweak Mode chain, goal 1000095). Prototype: ${MOCKS} (README maps each screen).`;
+// The prototype is the MASTER: screens are built 1:1 on it, and the proof is a
+// side-by-side, not a claim.
+const PIXEL = (board, part) => `\n\nPIXEL CONTRACT (1:1): ${MOCKS}${board}${part ? ` (${part})` : ''} is the master design, approved by the owner. Build it 1:1: the same layout, words, sizes, colours, glass and states. Before shipping, render the built page with modules/ui-design/kit at 1440 and 390 wide, in light and dark, and put each render beside the artboard with scripts/gds/review-sheet.js. Every difference is either fixed or listed in the ship notes with the gate or route that forced it. An unlisted difference is a defect.`;
+
+const TASKS = [
+  { ref: 'TW01', kind: 'infra', disc: 'engineer', prio: 5, est: 30, deps: [],
+    title: 'BV2.TW01 · Turn the artist gate off on the Cloud Bongos instance',
+    desc: `Owner decision 2026-09-27: the artist gate (ADR 0241) is off for now; approval of page tweaks moves into the studio's Approval queue (TW12).\n\nSet the Cloud Bongos instance's artistGate to 'off' through the provisioning settings path (modules/provisioning, the artistGate vocabulary key), not by hand-editing a host file. Record the before/after value on this task. Task 1004107 (the gate's contradiction) stays open for when the gate returns.\n\nDONE WHEN: the live instance reports artistGate 'off' and a deploy is no longer held by an unresolved artist review. ${S}` },
+  { ref: 'TW02', kind: 'feature', disc: 'engineer', prio: 5, est: 150, deps: [],
+    title: 'BV2.TW02 · Page inventory: every page of every surface gets a stable id',
+    desc: `The PAGE is Tweak Mode's unit, and pages are implicit today (body[data-page] in the hall, file names on landing and status). Generate an inventory: for each surface (builders hall, landing, status) every page with a stable id, title, live url, the files that render it, and its .states.json states where present. Portable: derived from the modules an instance has enabled. Freshness-checked like the copy registry (a --check the ship pipeline runs).\n\nDONE WHEN: the inventory lists every hall, landing and status page with stable ids and a --check fails on drift. ${S}` },
+  { ref: 'TW03', kind: 'feature', disc: 'engineer', prio: 5, est: 120, deps: ['TW02'],
+    title: 'BV2.TW03 · ADR: write down the page tweak model',
+    desc: `The owner has already made these decisions (spec, "Design decisions"); this task WRITES THEM DOWN as one ADR so every later task builds on the same model. It is not a design pass: where the spec is genuinely silent, file a blocker for the owner rather than choosing. The ADR records:\n- page status DERIVED from the ledger (approved, shipped tweak tasks per page id; text and ui counts), the changelog, drift ("changed since last tweak"), and the per-surface Artist Review Status sums;\n- one active tweak per page, the claim, page asks, and the recommendation order (asked-for, then changed, then untweaked);\n- the draft kept on the tweak task and the page-batch proposal (amends ADR 0233), with copy_no_cms.mjs staying green;\n- the .docx round trip: the file's shape, how an upload maps back to lines, and what an upload that changes structure is refused with;\n- the waiting-for-artist state and send-back;\n- REPLACING the artist-review-on-ship cascade (lifecycle/cascade.js), and paying an approved page what the reviews paid.\nConfirm or re-cut TW04–TW16 against it.\n\nDONE WHEN: the ADR is merged and TW04–TW16 match it. ${S}` },
+  { ref: 'TW04', kind: 'feature', disc: 'engineer', prio: 5, est: 240, deps: ['TW02'],
+    title: 'BV2.TW04 · Page reader: every string a rendered page shows',
+    desc: `The copy registry (docs/copy-registry.json) is keyed by FILE, includes comment text no one sees, and misses runtime-built and server-sent text. The page reader answers "what does this page actually show": render each inventory page in each state (scripts/hall-preview/server.js fixtures + modules/ui-design/kit; landing and status the same way) and list every visible string in page order, grouped by section. Map each to a registry entry (file + line), or mark it UNPLACED; mark shared-shell text (top bar, footer) as a SHARED ELEMENT.\n\nDONE WHEN: every inventory page has a reading with placed / unplaced / shared marked, and a test proves an unplaced string is listed, not dropped. ${S}` },
+  { ref: 'TW05', kind: 'feature', disc: 'engineer', prio: 5, est: 180, deps: ['TW03', 'TW04'],
+    title: 'BV2.TW05 · Page tweak status, Artist Review Status and the artist tally (the reads)',
+    desc: `Per TW03, derived from the ledger, no status table:\n- per page: status (Untweaked / Text tweaked / UI tweaked / Both), counts ("2x"), changelog (artist, date, lines, before/after), and changed-since-last-tweak lines;\n- per surface (Artist Review Status): "N of M tweaked";\n- per artist (the studio's corner tally): credits earned from page tweaks, pages tweaked, and this week's gain.\n\nDONE WHEN: all three reads are correct for a fixture with an untweaked page, a page tweaked twice, and a tweaked page whose text changed afterwards. ${S}` },
+  { ref: 'TW06', kind: 'feature', disc: 'engineer', prio: 5, est: 120, deps: ['TW03'],
+    title: 'BV2.TW06 · Claim a page, and ask for one',
+    desc: `A builder holding the Artist role claims a page's tweak in one call, which creates (or reuses) the page's tweak task and claims it for them; a second claim while one is held is refused and names the holder. Anyone can ask for a page with a one-line reason; asks feed the recommendation (TW07). The page ask replaces per-string flags as the main signal.\n\nDONE WHEN: an artist claims a page; a second artist is refused with the holder named; a non-artist can ask but not claim. ${S}` },
+  { ref: 'TW07', kind: 'feature', disc: 'engineer', prio: 5, est: 90, deps: ['TW05', 'TW06'],
+    title: 'BV2.TW07 · The Tweak/CopyWrite Flow: recommend the next page',
+    desc: `The chain the owner asked for: finish a page, get the next one. One read returns the recommended next page for this artist and why ("2 people asked for it"), plus a short list of alternatives for "pick another". Order per TW03: asked-for first, then changed since last tweak, then untweaked; never a page someone else holds. Taking it is TW06's claim.\n\nDONE WHEN: the recommendation follows the order on a fixture, skips held pages, and "take next" claims the recommended page in one call. ${S}` },
+  { ref: 'TW08', kind: 'feature', disc: 'engineer', prio: 5, est: 180, deps: ['TW03', 'TW04', 'TW06'],
+    title: 'BV2.TW08 · Page-batch proposal with a saved draft',
+    desc: `Extend the copy-desk proposal (ADR 0233, amended by TW03) from one occurrence to a whole page. The artist's draft saves onto the page's tweak task as they write; submit freezes it into the page-batch patch and queues it for /tweak. A rewrite of an UNPLACED line files its own engineer task carrying the wording and does not block the page. Targets resolve server-side from the page reading, never from the request body.\n\nDONE WHEN: draft save, submit and the unplaced split work end to end, and modules/copy-desk/tests/copy_no_cms.mjs stays green. ${S}` },
+  { ref: 'TW09', kind: 'feature', disc: 'engineer', prio: 5, est: 180, deps: ['TW08'],
+    title: 'BV2.TW09 · Work offline: download a page as .docx and upload it back',
+    desc: `Owner decision: an artist can download the page's words as a Word document, work offline, and upload it back into the draft. Download renders the page reading as a .docx (sections as headings, one paragraph per line, shared and engineer lines marked). Upload maps paragraphs back to lines per TW03 and merges them into the draft (never straight to the site). An upload that adds, drops or reorders lines is refused with a plain explanation of which lines moved. Cheapest viable library, no paid service.\n\nDONE WHEN: a round trip with edits lands those edits in the draft, and a structure-changing upload is refused by name. ${S}` },
+  { ref: 'TW10', kind: 'feature', disc: 'ui', prio: 5, est: 240, deps: ['TW04', 'TW06', 'TW08', 'TW09'],
+    title: 'BV2.TW10 · The tweak editor: the whole page as one document',
+    desc: `The artist's own flow, not Claude's. Over the dimmed studio: a glass top bar (back to studio, page name, lines rewritten + saved, open the page in a new tab, download .docx, upload .docx, submit page) and one paper document holding every word of the page in page order, typed over in place, autosaving (TW08). A changed line carries a small accent mark and a faint "was:"; shared and engineer lines carry a margin note. Submit opens "<page> is in" with the next recommended page (TW07): take next, pick another, back to the studio. No terminal anywhere; /design floors apply.\n\nDONE WHEN: an artist rewrites a page, closes the tab, returns to the draft, round-trips it through Word, submits, and takes the next page, at desktop and phone width in light and dark. ${S}${PIXEL('Editor.dc.html')}` },
+  { ref: 'TW11', kind: 'feature', disc: 'engineer', prio: 5, est: 240, deps: ['TW08'],
+    title: 'BV2.TW11 · /tweak skill + batch applier',
+    desc: `A new skill, /tweak: a builder or agent session takes the next submitted page, claims it, and applies every line via scripts/gds/copy-apply.js in a new --batch mode (keeps \${expr} holes; names each refusal). It renders the applied page before and after (desktop + phone, light + dark) through the ui-design kit, attaches both to the task, and parks it at waiting-for-artist (TW03). It never ships without the artist's approval (TW12).\n\nDONE WHEN: /tweak applies a multi-line page batch, attaches the renders and parks; a refused line is named, not skipped. ${S}` },
+  { ref: 'TW12', kind: 'feature', disc: 'ui', prio: 5, est: 180, deps: ['TW11'],
+    title: 'BV2.TW12 · The Approval queue: the applied page, rendered, before and after',
+    desc: `A glass panel opened from the studio. It shows the applied page ITSELF, rendered with its new words (not a list of strings), with a before/after switch, the changed words highlighted, and the queue position ("1 of 2"). Approve and ship (the ship proceeds, the page's count goes up, the next page in the queue is named), or send it back with a one-line note (it returns to the tweak queue). Added to the studio's WRITE_ROUTES allowlist; still no live string write.\n\nDONE WHEN: approve ships the page and advances its status; send-back re-queues it with the note; both from the studio with no terminal. ${S}${PIXEL('Main.dc.html', 'its Approval queue panel')}` },
+  { ref: 'TW13', kind: 'feature', disc: 'engineer', prio: 4, est: 150, deps: ['TW03', 'TW11'],
+    title: 'BV2.TW13 · Pay the artist for an approved page, as the artist reviews paid',
+    desc: `Owner decision: Tweak Mode replaces the per-ship artist review with the same payouts. On an approved page tweak's ship, the artist who wrote it is paid what completing the replaced artist review paid them; the applying session keeps its normal build reward. Payees resolved server-side from the task (the ADR 0185 pattern in modules/economy/credits.js), never from the caller; a self-applied tweak is one payee; the total is conserved. Feeds the studio tally (TW05).\n\nDONE WHEN: a shipped page tweak pays the artist and the applier as above, with tests for the self-applied and rounding cases. ${S}` },
+  { ref: 'TW14', kind: 'refactor', disc: 'engineer', prio: 4, est: 150, deps: ['TW05'],
+    title: 'BV2.TW14 · Tweak Mode replaces the per-ship artist review',
+    desc: `The artist-review-on-ship cascade (modules/lifecycle/cascade.js) files one task per ship; 34 of the 39 it filed were abandoned, 33 with no note. Per TW03: a ship that changes a page's words no longer files a review task. It marks that page "changed since last tweak", which raises it in the Tweak/CopyWrite Flow and shows in Artist Review Status. Task 1004078 (the studio's review card never showing the copy) is merged into this one: with no per-ship review cards, it has nothing left to fix.\n\nDONE WHEN: a ship changing a page's text files no artist review and the page reads changed-since; the cascade's tests are updated to the new rule. ${S}` },
+  { ref: 'TW15', kind: 'cleanup', disc: 'ui', prio: 3, est: 60, deps: ['TW16'],
+    title: 'BV2.TW15 · Archive the Copy desk and Ideas tabs',
+    desc: `Owner decision 2026-09-27: the Copy desk and the Ideas board come off the hall's tab groups. ARCHIVED, not deleted: remove both entries from the nav (modules/hall-ui/public/shell.js), keep the pages and routes reachable by link so old bookmarks and links still land, and delete no data. Ideas are still filed from Your thinking (its filing form covers quick and Full Ideas); artist work lives in the studio (TW16). Update the page-gate map and any test that pins the nav list.\n\nDONE WHEN: neither tab shows in the nav, both URLs still load, and the hall tests are green. ${S}` },
+  { ref: 'TW20', kind: 'feature', disc: 'ui', prio: 5, est: 180, deps: [],
+    title: 'BV2.TW20 · The studio and Your thinking sit in the hall, with a full-screen switch',
+    desc: `Owner decision 2026-09-27: the Studio (/studio) and Your thinking (/thinking) join the normal hall chrome, the sidebar and the top bar, like every other hall page. Your thinking deliberately carries none today (its header comment says so). Each page gets one button that goes FULL SCREEN, hiding the sidebar and top bar so the page fills the window (the prototype's studio is what full screen looks like), and a button in full screen to come back. Shared, not per page: one switch in shell.js that any page can opt into, remembered per page in localStorage (try/catch), reachable by keyboard, with Esc leaving full screen. Both pages must still pass the kit floors in both states (header, main, 24px targets, reduced motion).\n\nDONE WHEN: both pages render inside the hall chrome, the switch hides and restores it, the choice survives a reload, and the kit floors pass in both states at 1440 and 390, light and dark. ${S}` },
+  { ref: 'TW21', kind: 'refactor', disc: 'ui', prio: 4, est: 150, deps: ['TW20'],
+    title: 'BV2.TW21 · Your thinking is only your thinking; the project views live on the project map',
+    desc: `Owner decision 2026-09-27. Today /thinking and /goal-map are one sky with a lens switcher ("simple", "your thinking", "the whole project"); "the whole project" hands off to /goal-map, and "my ideas" lays your thoughts over the project map. Disconnect them. /thinking keeps only YOUR thinking and its own tools. The whole-project views and features, including the "the whole project" lens and the "my ideas" overlay, live only on the goals/project map page (/goal-map), which stops offering "your thinking" as a lens. Keep the shared sky-*.js code shared where it is only drawing. It is the lens and the features that separate, not the renderer.\n\nCONFIRMED BY THE OWNER (2026-09-27): "the your projects tab" means the whole-project lens, the "the whole project" switch and the project-map features on Your thinking. They move to the goals/project map page only.\n\nDONE WHEN: /thinking shows no whole-project lens or project-map features, /goal-map holds them all, neither links to the other as a lens, and the sky tests are updated to the split. ${S}` },
+  { ref: 'TW17', kind: 'feature', disc: 'engineer', prio: 2, est: 60, deps: ['TW16'],
+    title: 'BV2.TW17 · The artist pack teaches Tweak Mode',
+    desc: `docs/packs/artist.md leads with the studio: Resume, the Tweak/CopyWrite Flow, the editor and the Word round trip, the Approval queue. The per-ship review and the copy-desk flag flow are gone from the artist's loop. Keep the pack inside its CI budget.\n\nDONE WHEN: an artist session reading only the pack can take a page through Tweak Mode. ${S}` },
+  { ref: 'TW18', kind: 'verify', disc: 'artist', prio: 4, est: 90, deps: ['TW09', 'TW10', 'TW12', 'TW13', 'TW16'],
+    title: 'BV2.TW18 · Proof: an artist tweaks a landing page and a hall page end to end',
+    desc: `The live demonstration that wa6-tweak-mode holds. A non-technical artist, with no terminal, from the studio: takes a landing page from the Tweak/CopyWrite Flow and rewrites it in the editor, takes next and rewrites a hall page offline in Word and uploads it; a session runs /tweak; the artist approves both in the Approval queue. Both pages then read "text tweaked 1x", Artist Review Status moves, and the tally shows the payout.\n\nDONE WHEN: the above happens on the live instance and is recorded (screens + the two shipped tasks) on this task. ${S}` },
+  { ref: 'TW19', kind: 'spike', disc: 'engineer', prio: 2, est: 120, deps: ['TW18'],
+    title: 'BV2.TW19 · Auto-pickup: an agent takes submitted tweaks with no session started',
+    desc: `"Queue now, auto later" (owner, 2026-09-27). Today agents fire only on task.shipped and may only report (modules/agents/CLAUDE.md, the event path), and the autonomy runner is off. Design an agent that claims and applies a submitted page on its own: the trigger, who pays (spend caps), the loop guard, the rank it runs at. Output: an ADR plus the tasks to build it.\n\nDONE WHEN: the ADR is written and its build tasks are filed in this goal. ${S}` },
+];
+
+// Existing task folded into the chain at TW16.
+const TW16_TITLE = 'BV2.TW16 · ARTIST MODE: the lofi studio home, with Tweak Mode as its four doors';
+const TW16_DESC = `RESCOPED 2026-09-27 (planning session, task 1004312; spec ${SPEC}). Task 1004238 ("the artist page is simple and lofi") is merged into this one. The photo-to-asset half split out to its own backlog task, because the core has no image path yet (see the correction in the original text below).
+
+**Now:** the Studio (/builders/studio) becomes a lofi home an artist wants to be in. The owner likes the prototype's lofi design for now: a night window, a lamp and a desk, over the project's Chrome World tokens. On it:
+- the studio's own words are editable in place (that edit is itself a tweak of the studio page, through TW08);
+- the artist's tally in the top right: credits, pages tweaked, this week (TW05);
+- **Resume** goes back into the page the artist holds (TW10);
+- three quick actions open glass panels in place, so the artist never flips pages: **Tweak/CopyWrite Flow** (TW07), **Approval queue** (TW12) and **Artist Review Status** (TW05's three surface lines).
+The old review/flag queue on this page goes: Tweak Mode replaces it (TW14).
+
+DONE WHEN: an artist opening the studio can do all of Tweak Mode from it, approved by the owner at desktop and phone width in light and dark.${PIXEL('Main.dc.html')}
+
+---
+ORIGINAL DESCRIPTION (kept for provenance):
+
+`;
+
+const PHOTO_TASK = {
+  kind: 'feature', disc: 'artist', prio: 2, est: 240,
+  title: 'ARTIST MODE part 2: from a photo of physical work to a usable asset',
+  desc: `Split from task 1003971 at the 2026-09-27 planning session (task 1004312). An artist uploads photos of physical work and digitises them into whatever they are meant for, keeping their personal style continuous with the project's design rules.\n\nBlocked in substance: the core has no image-generation path (modules/art-pipeline is excluded from the published core). First decide between bringing an image path into the core cleanly (its own ADR) or scoping to the parts that need no model. See 1003971's original description.\n\nNot part of the Tweak Mode chain.`,
+};
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let dryId = 0;
+async function api(method, p, body, tries = 0) {
+  if (DRY && method !== 'GET') {
+    console.log(`  [dry] ${method} ${p}`);
+    return { ok: true, status: 0, json: { task: { id: `dry${++dryId}`, title: body && body.title } } };
+  }
+  await sleep(400);
+  const res = await fetch(`${BASE}/api/bongos${p}`, { method, headers: H, body: body ? JSON.stringify(body) : undefined });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, p, body, tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+const note = (r) => JSON.stringify(r.json).slice(0, 200);
+
+(async () => {
+  let failed = 0;
+  const pre = await api('GET', `/goals/${GOAL}`);
+  if (!pre.ok) { console.log(`cannot read goal ${GOAL}: ${pre.status}`); cliExit(1); return; }
+  const baseline = {};
+  for (const c of pre.json.criteria || []) baseline[c.criterion_id] = Number(c.linked_tasks) || 0;
+
+  console.log('Criterion…');
+  const c = await api('POST', `/versions/${VER}/done-when`, { criterion_id: CRIT, criterion_md: CRITERION_MD, goal_id: GOAL });
+  console.log(`  ${CRIT}: ${c.ok ? 'created' : c.status === 409 ? 'already seeded' : 'FAILED ' + note(c)}`);
+  if (!c.ok && c.status !== 409) { cliExit(1); return; }
+
+  console.log('Scope…');
+  const sc = await api('POST', `/goals/${GOAL}/scope`, { add: SCOPE_ADD });
+  console.log(`  +${SCOPE_ADD.join(', ')}: ${sc.ok ? 'ok' : 'FAILED ' + note(sc)}`);
+  if (!sc.ok) failed++;
+
+  console.log(`Tasks (${TASKS.length})…`);
+  const idByRef = { TW16: ARTIST_MODE };
+  const plan = [];
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc, kind: t.kind,
+      discipline: t.disc, priority: t.prio, est_minutes: t.est, criterion_ids: [CRIT],
+      source: SRC, source_ref: `${REF}-${t.ref}`,
+    });
+    const task = r.json.task || r.json;
+    if (!r.ok || !task.id) { console.log(`  ${t.ref}: FAILED ${r.status} ${note(r)}`); failed++; continue; }
+    if (!DRY && task.title !== t.title) { console.log(`  ${t.ref}: source_ref collision — got task ${task.id} "${task.title}"`); failed++; continue; }
+    idByRef[t.ref] = task.id;
+    plan.push([CRIT]);
+    console.log(`  ${t.ref} → task ${task.id} (${r.status})`);
+  }
+
+  console.log('Existing tasks…');
+  const am = await api('GET', `/tasks/${ARTIST_MODE}`);
+  const amTask = am.json.task || am.json;
+  if (!String(amTask.title || '').startsWith('BV2.TW16')) {
+    const r = await api('PATCH', `/tasks/${ARTIST_MODE}`, { title: TW16_TITLE, description: TW16_DESC + (amTask.description || ''), priority: 4 });
+    console.log(`  1003971 rescoped: ${r.ok ? 'ok' : 'FAILED ' + note(r)}`); if (!r.ok) failed++;
+  } else console.log('  1003971 already rescoped');
+  const link = await api('POST', `/tasks/${ARTIST_MODE}/criteria`, { criterion_ids: [CRIT] });
+  console.log(`  1003971 → ${CRIT}: ${link.ok ? 'linked' : 'FAILED ' + note(link)}`);
+  if (link.ok) plan.push([CRIT]); else failed++;
+  for (const [from, into, why] of [
+    [LOFI_PAGE, ARTIST_MODE, 'Merged into 1003971 at the Tweak Mode planning session (task 1004312): the lofi artist page IS the rescoped ARTIST MODE studio home.'],
+    [STUDIO_COPY, idByRef.TW14, 'Merged into BV2.TW14 at the Tweak Mode planning session (task 1004312): Tweak Mode replaces the per-ship artist review, so there are no review cards left whose copy needs showing.'],
+  ]) {
+    if (!into) { console.log(`  ${from}: merge target missing`); failed++; continue; }
+    const mg = await api('POST', `/tasks/${from}/merge`, { into_task_id: Number(into) || into, reason: why });
+    console.log(`  ${from} merged into ${into}: ${mg.ok ? 'ok' : mg.status === 409 ? 'already merged' : 'FAILED ' + note(mg)}`);
+    if (!mg.ok && mg.status !== 409) failed++;
+  }
+
+  console.log('Dependencies…');
+  const EDGES = [...TASKS.map((t) => [t.ref, t.deps]), ['TW16', ['TW05', 'TW07', 'TW10', 'TW12', 'TW20']]];
+  for (const [ref, deps] of EDGES) {
+    if (!deps.length) continue;
+    const id = idByRef[ref];
+    const depIds = deps.map((d) => idByRef[d]).filter(Boolean);
+    if (!id || depIds.length !== deps.length) { console.log(`  ${ref}: dep resolve gap`); failed++; continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    console.log(`  ${ref} ← ${deps.join(', ')}: ${r.ok ? 'ok' : 'FAILED ' + note(r)}`); if (!r.ok) failed++;
+  }
+
+  console.log('Split-off task…');
+  const ph = await api('POST', '/tasks', {
+    version_id: VER, goal_id: GOAL, title: PHOTO_TASK.title, description: PHOTO_TASK.desc, kind: PHOTO_TASK.kind,
+    discipline: PHOTO_TASK.disc, priority: PHOTO_TASK.prio, est_minutes: PHOTO_TASK.est,
+    source: SRC, source_ref: `${REF}-photo-split`,
+  });
+  console.log(`  photo half → ${ph.ok ? 'task ' + (ph.json.task || ph.json).id : 'FAILED ' + note(ph)}`); if (!ph.ok) failed++;
+
+  console.log('Opening the zero-dep layer…');
+  for (const ref of ['TW01', 'TW02', 'TW20']) {
+    const id = idByRef[ref]; if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'note ' + note(r)}`);
+  }
+
+  console.log('\nref→id:', JSON.stringify(idByRef));
+  if (DRY) return;
+  const expected = { ...baseline };
+  for (const ids of plan) for (const s of ids) expected[s] = (expected[s] || 0) + 1;
+  // A merge abandons its task, and 1004078 was linked to other criteria on this
+  // goal; if the goal's linked_tasks counts only live tasks, that criterion drops
+  // by one. Report it rather than fail on it.
+  await verifySeedCriteriaLinks({ goalId: GOAL, expectedCounts: expected, fetchGoal: (id) => api('GET', `/goals/${id}`),
+    exit: (code) => { if (code) console.log('(check the mismatch above: a drop of 1 on a criterion 1004078 or 1004238 was linked to is the merge, not a mislink)'); failed += code ? 1 : 0; } });
+  if (failed) { console.log(`${failed} step(s) FAILED — see above.`); cliExit(1); }
+})();

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1050'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1052'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_map_page.mjs

@@ -401,12 +401,14 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<body data-page="goal-map" data-page-title="The sky" data-sky-lens="all">/);
   assert.match(html, /<title>The sky — \{\{worldName\}\}<\/title>/);
   assert.match(html, /<h1>the sky <em id="lensWord">— the whole project<\/em><\/h1>/, 'the h1 is in static markup, so every state has one');
-  assert.equal(/shell\.js|style\.css/.test(html), false, 'no hall chrome, like /thinking');
+  assert.equal(/shell\.js|style\.css/.test(html), false, 'no hall chrome yet — /thinking joined it (task 1004327), the project sky did not');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
   assert.deepEqual(scripts(html).map((s) => s[0]), ['idea-objects.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
-  assert.deepEqual(scripts(html), scripts(thinking), 'the two doors load the same files at the same stamp');
+  // /thinking also loads the shell (task 1004327); the SKY's files are the same.
+  const skyScripts = (h) => scripts(h).filter((s) => s[0] !== 'shell.js');
+  assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');
   assert.equal(html.match(/thinking\.css\?v=([^"]+)/)[1], thinking.match(/thinking\.css\?v=([^"]+)/)[1]);
-  assert.match(read('thinking.css'), /body\[data-page="thinking"\], body\[data-page="goal-map"\] \{/, 'the sheet names both bodies');
+  assert.match(read('thinking.css'), /body\[data-page="goal-map"\], body\[data-page="thinking"\] \.sky-stage \{/, 'the sheet names both doors: the project sky\'s body, and the stage /thinking draws in inside the hall');
   for (const f of ['goal-map.css', 'goal-map.js', 'goal-map-lib.js']) assert.equal(fs.existsSync(path.join(HALL, f)), false, `${f} is retired`);
   assert.equal(fs.existsSync(path.join(ROOT, 'tests/goal_map_lib.mjs')), false, 'and so is the lib\'s test');
   assert.equal(/goal-map-lib|goal-map\.js|goal-map\.css/.test(html), false);

package/tests/hall_audit.mjs

@@ -362,8 +362,9 @@ test('the module doc still records where the 2179 density pass landed', () => {
 // private copy of the hall's, it is a different surface's own, pinned by
 // tests/hall_sky.mjs against the template. It still stamps the branding token
 // and the pack's font links like every hall page (the server injects them).
+// /thinking left this list in task 1004327 (owner decision 2026-09-27): it sits
+// in the hall chrome now, with the shell's full-screen switch to hide it.
 const STANDALONE_EXEMPT = {
-  'thinking.html': 'the sky (task 1004231, ADR 0331) — the design of record is its own surface, not the hall chrome',
   'goal-map.html': 'the project sky (task 1004232) — the same surface as thinking.html, opened in its whole-project lens',
 };
 

package/tests/hall_fullscreen.mjs

@@ -0,0 +1,196 @@
+// tests/hall_fullscreen.mjs — the hall's shared full-screen switch (task 1004327,
+// BV2.TW20, goal 1000095; owner decision 2026-09-27).
+//
+// The studio and Your thinking sit in the hall chrome, and each carries ONE
+// switch that hides the sidebar and the top bar so the page fills the window.
+// The switch is the shell's, not a page's: a page opts in with
+// <body data-fullscreen-switch>, and the shell renders the button, keeps the
+// state on html[data-fullscreen="on"], remembers it PER PAGE in localStorage and
+// lets Escape leave. These cases boot the REAL shell.js in a DOM stub and drive
+// it the way a reader does — press the button, reload, press Escape — so a
+// switch that renders but does not remember, or an Escape that fights the sky's
+// own use of the key, fails here. The two source assertions at the end are
+// labelled as such: the CSS half (what "hidden" means) is proven by the kit
+// renders in the ship notes, not by a regex.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const SHELL = fs.readFileSync(path.join(HALL, 'shell.js'), 'utf8');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+
+// Boot the shell once — one page load. `store` is the browser's localStorage and
+// is SHARED across boots on purpose: a second boot over the same store is a reload.
+function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = false } = {}) {
+  const els = new Map();
+  const windowListeners = {};
+  const timers = [];
+  const makeEl = (id) => {
+    const attrs = {};
+    return {
+      id, dataset: {}, style: {}, textContent: '', hidden: false, _html: '', title: '',
+      classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+      setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; }, removeAttribute(k) { delete attrs[k]; },
+      addEventListener(ev, fn) { (this._on ||= {})[ev] = fn; },
+      querySelector() { return null; }, querySelectorAll() { return []; },
+      appendChild() {}, focus() {}, click() { if (this._on && this._on.click) this._on.click({ target: this }); },
+      insertAdjacentElement() {}, remove() {},
+      set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+    };
+  };
+  // The topbar's innerHTML is the shell's own markup; an id the shell rendered
+  // into it resolves only if that markup really carries it, so a button the
+  // shell forgot to render cannot be clicked into existence by the stub.
+  const topbar = makeEl('app-topbar');
+  const getElementById = (id) => {
+    if (id === 'app-topbar') return topbar;
+    if (/^(fullscreen-toggle|theme-toggle|zoom-toggle|topbar-menu|topbar-title|topbar-jump)$/.test(id)
+      && !topbar._html.includes(`id="${id}"`)) return null;
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const body = {
+    dataset: { page },
+    hasAttribute: (k) => optIn && k === 'data-fullscreen-switch',
+  };
+  const documentObj = {
+    body,
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById,
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(null); },
+    addEventListener() {}, dispatchEvent() {},
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+  const location = { hostname: 'h', origin: 'https://h', pathname: '/' + page, hash: '', search: '', assign() {}, replace() {} };
+  const localStorage = {
+    getItem: (k) => { if (storageThrows) throw new Error('SecurityError'); return k in store ? store[k] : null; },
+    setItem: (k, v) => { if (storageThrows) throw new Error('SecurityError'); store[k] = String(v); },
+  };
+  let resizes = 0;
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage, location,
+    requestAnimationFrame() {}, scrollTo() {},
+    addEventListener(type, fn) { (windowListeners[type] ||= []).push(fn); },
+    dispatchEvent(ev) { if (ev && ev.type === 'resize') resizes += 1; return true; },
+    setTimeout: (fn) => { timers.push(fn); return timers.length; },
+  };
+  const sandbox = {
+    window: windowObj, document: documentObj, location, console, clearTimeout() {}, queueMicrotask,
+    setTimeout: windowObj.setTimeout,
+    Event: class { constructor(t) { this.type = t; } },
+    CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
+  const root = documentObj.documentElement;
+  return {
+    store,
+    button: () => getElementById('fullscreen-toggle'),
+    on: () => root.dataset.fullscreen === 'on',
+    resizes: () => resizes,
+    // Press a key the way the browser dispatches it: every window listener,
+    // then the page may mark the press used, then the queued timers run.
+    press(key, { target = { tagName: 'CANVAS' }, pageUses = false } = {}) {
+      const ev = { key, target, defaultPrevented: false, preventDefault() { this.defaultPrevented = true; } };
+      for (const fn of windowListeners.keydown || []) fn(ev);
+      if (pageUses) ev.preventDefault();
+      while (timers.length) timers.shift()();
+    },
+  };
+}
+
+test('a page that does not opt in gets no switch, and never goes full screen', () => {
+  const store = { 'hall-fullscreen:work': 'on' };
+  const p = boot({ page: 'work', optIn: false, store });
+  assert.equal(p.button(), null, 'no button rendered');
+  assert.equal(p.on(), false, 'a stored value for a page with no switch is ignored');
+});
+
+test('an opted-in page renders ONE switch in the top bar, off by default', () => {
+  const p = boot();
+  const btn = p.button();
+  assert.ok(btn, 'the switch is in the top bar');
+  assert.equal(p.on(), false);
+  assert.equal(btn.getAttribute('aria-pressed'), 'false');
+  assert.equal(btn.getAttribute('aria-label'), 'Full screen');
+});
+
+test('the switch hides the chrome, the same button brings it back', () => {
+  const p = boot();
+  p.button().click();
+  assert.equal(p.on(), true, 'html[data-fullscreen="on"]');
+  assert.equal(p.button().getAttribute('aria-pressed'), 'true');
+  assert.equal(p.button().getAttribute('aria-label'), 'Leave full screen');
+  assert.ok(p.resizes() >= 1, 'a page that sizes to its box is told to re-measure');
+  p.button().click();
+  assert.equal(p.on(), false, 'and back');
+});
+
+test('THE CHOICE SURVIVES A RELOAD — and it is remembered per page', () => {
+  const store = {};
+  boot({ page: 'thinking', store }).button().click();
+  assert.equal(store['hall-fullscreen:thinking'], 'on');
+  assert.equal(boot({ page: 'thinking', store }).on(), true, 'the reload opens in full screen');
+  assert.equal(boot({ page: 'studio', store }).on(), false, 'the studio did not follow the sky');
+  boot({ page: 'thinking', store }).button().click();
+  assert.equal(boot({ page: 'thinking', store }).on(), false, 'leaving is remembered too');
+});
+
+test('Escape leaves full screen', () => {
+  const p = boot({ store: { 'hall-fullscreen:thinking': 'on' } });
+  assert.equal(p.on(), true);
+  p.press('Escape');
+  assert.equal(p.on(), false);
+});
+
+test('an Escape the PAGE used (the sky\'s tour, menu or pick) does not also leave', () => {
+  const p = boot({ store: { 'hall-fullscreen:thinking': 'on' } });
+  p.press('Escape', { pageUses: true });
+  assert.equal(p.on(), true, 'the page marked the press used, after the shell heard it');
+});
+
+test('an Escape inside a text field belongs to the field', () => {
+  const p = boot({ store: { 'hall-fullscreen:thinking': 'on' } });
+  p.press('Escape', { target: { tagName: 'INPUT' } });
+  assert.equal(p.on(), true);
+  p.press('x');
+  assert.equal(p.on(), true, 'other keys are not the switch\'s');
+});
+
+test('storage that throws (a private window) leaves the chrome showing and the switch working', () => {
+  const p = boot({ storageThrows: true });
+  assert.equal(p.on(), false);
+  p.button().click();
+  assert.equal(p.on(), true, 'the switch still works for this page load');
+});
+
+test('the studio and Your thinking opt in, inside the hall chrome; the project sky does not (yet)', () => {
+  for (const f of ['studio.html', 'thinking.html']) {
+    const html = read(f);
+    assert.match(html, /<body[^>]*\bdata-fullscreen-switch\b/, `${f} opts in`);
+    for (const id of ['app-sidebar', 'app-topbar']) assert.match(html, new RegExp(`id="${id}"`), `${f} carries #${id}`);
+    assert.match(html, /<main id="hall-main"/, `${f}: the skip link's target`);
+    assert.equal((html.replace(/<!--[\s\S]*?-->/g, '').match(/<header\b/g) || []).length, 1, `${f}: the top bar is the one <header>`);
+  }
+  assert.doesNotMatch(read('goal-map.html'), /data-fullscreen-switch|shell\.js/, '/goal-map keeps its standalone form');
+});
+
+// SOURCE ASSERTION (the CSS half): full screen hides the sidebar and the foot
+// but keeps the top bar IN the document, collapsed to its switch — so the page
+// keeps one <header> and the way back is where the way in was.
+test('source: full screen hides the sidebar and foot, and collapses the top bar rather than removing it', () => {
+  const css = read('style.css');
+  assert.match(css, /html\[data-fullscreen="on"\] \.app-sidebar,\s*html\[data-fullscreen="on"\] \.app-scrim,\s*html\[data-fullscreen="on"\] \.app-foot \{ display: none; \}/);
+  assert.match(css, /html\[data-fullscreen="on"\] \.topbar-side > :not\(\.fullscreen-toggle\)/);
+  assert.doesNotMatch(css, /html\[data-fullscreen="on"\] \.app-topbar \{ display: none/);
+});

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '6b28297270d1e1f0';
+const SHELL_SHA = '7f66604d74d544e8';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);