@bongos/core 1.19.249 → 1.19.250

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.249",
-  "core_contract": "1.19.249",
-  "source_commit": "992220580b9a449998b6c24f857cf0e770bb05cb",
+  "core_version": "1.19.250",
+  "core_contract": "1.19.250",
+  "source_commit": "f59cb8a3e16573333ac81a1b37976b46909d7f49",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T23:57:42.981Z",
+  "built_at": "2026-08-19T01:00:55.130Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 312,
+    "docs_redacted": 313,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1330,
+    "functional_verbatim": 1334,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1663,
-  "tree_sha256": "b7562afed829bda45658ec0e21c2c045fd7d4828b7074f2d4834937bb15d0121",
+  "file_count": 1668,
+  "tree_sha256": "dff668aafc72a07d98fd1370bf3ad744a895c6336703607bbab6944e967e9518",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "5084f59df8019560f49971f00b40e9b8d1d6eb9511a9a78fc136ecaff025e57d"
+      "sha256": "687cc799954164a882f70587922fa313a836eb90aae32f99a4e0c3a0e7333e9c"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "84050a82e7dc6f855b6b02a4c89b1321717b1fcf45fdc426ac6c53961f10012f"
+      "sha256": "2985a6dfb923b6b974aed3da0d6fe0915ae1d439a48c4ee7607062e4fbdc182f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "5c99db7b6b1b59e595c3c6a7002cf7baa3b130a198213b007448d02a427883f1"
+      "sha256": "9ec1876369ac9d53ebf9f742b276314c8731cad32b17e8ed068dc180074098c9"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "dee98bb9b25e4cf7b2f4644298caa77b1bb9f7ef29560228333131b107be01dd"
+      "sha256": "14023727fa9eea325fb6ae784d9edea291c228d19e4966618a3d953191a8ef2d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "d5de9d514dc1515fab89430301550566fe5c8c5941026c58eb107800746fb63c"
+      "sha256": "c6d64e8c7efbad95471f0d68a07e5ee4b83d8122ca1d68cf3ea6a614f3fa396f"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1369,20 +1369,25 @@
       "mode": "0000644",
       "sha256": "922dc12e699d3631907292e0a5550806ac88a160394c65c8223f65e58a46bc6f"
     },
+    {
+      "path": "docs/adr/0178-the-copy-desk-flag-and-queue.md",
+      "mode": "0000644",
+      "sha256": "36f95e2bd77c310e1be3632e9b9d84bf014d4d51ae73b450365ed353fefa8923"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "a8a408b4f15d3d4aca0d0e864bd14984a73e1801b74e36962a7cb8f4db04233d"
+      "sha256": "745dc09cea4db07614901e6744eeb11c12a7f45711a40cf35c777315452baf2e"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "c0f20beba35a91ba5f06a1accf3b5df15832d719f14af729824295da60d33e30"
+      "sha256": "b99be08b4c6f2e81b12e3ddf80f4cfaa39423e0c87ff2790857ae16ad755fdc7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "50e9b99155cd83e625f1e0289a4e8ab6a2817b2701dc3d62cfb3d902c3acf3bd"
+      "sha256": "1c59dad7ce9c5d20bf2ce8671308b5e66a48516c30dc7b48677b0f0382c39e4b"
     },
     {
       "path": "docs/architecture.md",
@@ -1507,7 +1512,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "ffea58fedd395431492f6f9120c98b11403a37988722e5fa3f43bfdc05709922"
+      "sha256": "fcba56f057bbfa22c5586075fab70ae5559137880ab6886e5f9c990f4801edd7"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2697,7 +2702,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "5c99db7b6b1b59e595c3c6a7002cf7baa3b130a198213b007448d02a427883f1"
+      "sha256": "9ec1876369ac9d53ebf9f742b276314c8731cad32b17e8ed068dc180074098c9"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3189,6 +3194,21 @@
       "mode": "0000644",
       "sha256": "daeaef3932c592d2f9eb7fcd97e99b5eb761d7af9115718fc432360c7d7de0e1"
     },
+    {
+      "path": "modules/hall-ui/public/copy-desk.css",
+      "mode": "0000644",
+      "sha256": "b8b7c26156fba8662068b1c393229aac58e35daba1589be708876aa3edc133c6"
+    },
+    {
+      "path": "modules/hall-ui/public/copy-desk.html",
+      "mode": "0000644",
+      "sha256": "54863e10419f1fdf0e0aa9c22bd3144d8015e736e177adb33f016be502f17e85"
+    },
+    {
+      "path": "modules/hall-ui/public/copy-desk.js",
+      "mode": "0000644",
+      "sha256": "f14378218081172f37a2dec8bcc879832686138bbf191d1d8fec5b9db30e0543"
+    },
     {
       "path": "modules/hall-ui/public/copy-on-click.js",
       "mode": "0000644",
@@ -3492,7 +3512,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "f9b6d2ddd7b27e37a4be64dea8e767de43ad89a2d9999a566245a42d1d6196e1"
+      "sha256": "bfaa74784ee0578fe8e950f55585522a39c892c58f663330a3b724f34a8a0603"
     },
     {
       "path": "modules/hall-ui/public/style.css",
@@ -4347,12 +4367,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "72b91522dadad774aa718d0b832f77d942d427175b52285eb15416e4f95a1337"
+      "sha256": "d42566d923e50fa60869beed4e57bdf9549f87f83101c54558a29ca9bd848aab"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "480de6ffb6a5f6da702e74843627d5083d9dec4a76e9efcb6a1e49f97ade8cbb"
+      "sha256": "4fea4f30c5b2be65786e08dd645d614bb198bcac4c21c7d11190457a4aa1f566"
     },
     {
       "path": "public-docs/index.html",
@@ -5342,7 +5362,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "192350d9d65934a1af724d0f285cc74a89a842e75d0fdec37037d34ded5db546"
+      "sha256": "dd83af498409b0891ed6cd4de5906a182215040733aae677cee6f26e39d81177"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5802,7 +5822,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "e0c20565bb59c93fa9fff0aafa5eb246a0b16564604d18b5ae9ca350dd9e1a44"
+      "sha256": "39fe7b2e08a64d038a2f4b5b0807a6803bf19196fe8b43d0c3ec4989fe9cbb6b"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5937,7 +5957,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "885076ed4dce0676735055df3f841a72ac41846568d39434a80d48eacced3e16"
+      "sha256": "785c83fa3bb4a12ea33b528d70e030cffd44fb3ffaecbdb90f7c558621118f3e"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -5972,7 +5992,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "79234cc30c410a215492f897139bf042c2ff58f778e490d18ec3f65a6fd860f8"
+      "sha256": "817ba3170d6f4b3132d26c50b25ccb769c8b99b9d436f886bae1ca4bddec6a3d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6494,6 +6514,11 @@
       "mode": "0000644",
       "sha256": "55bd70efd8067e39d6220d14f78c743ce80d8a8ff37988acf00136b5108dc004"
     },
+    {
+      "path": "tests/copy_desk_flags_db.mjs",
+      "mode": "0000644",
+      "sha256": "5ffe8f556f30f00f8489ca0922dc45fef4695a022b0ccee379fe6bd11e7870d5"
+    },
     {
       "path": "tests/copy_inventory.mjs",
       "mode": "0000644",
@@ -7127,7 +7152,7 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "1a8d9bffb258d8338fd5367796bd19d4a31265f591b6d0e941bc1bcf5e2dc4cc"
+      "sha256": "7ab365a19909a0a73b446339d5109f8f1f818dd6fdc49c8792a42bde5757e5ed"
     },
     {
       "path": "tests/hall_page_gate_map.mjs",
@@ -7467,7 +7492,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "a4616843e5bdd5ff4101c6a3d0b350f574b66d9bfb608c64edc62a2e9bfea445"
+      "sha256": "c768beda710cc8446023d95cf5736cb70364403ed6412c41eef7c3c5039c1604"
     },
     {
       "path": "tests/module_manifest.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 285 operations across 46 resource groups
+- 289 operations across 47 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -252,6 +252,16 @@ function createClient(opts = {}) {
       // POST /claims/batch/validate — rank: any-builder — POST /claims/batch/validate
       postClaimsBatchValidate: (args) => request("POST", "/claims/batch/validate", { hasBody: true }, args),
     },
+    "copyDesk": {
+      // POST /copy-desk/flags — rank: any-builder — POST /copy-desk/flags
+      postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
+      // POST /copy-desk/flags/{id}/close — rank: any-builder — POST /copy-desk/flags/:id/close
+      postCopyDeskFlagsIdClose: (args) => request("POST", "/copy-desk/flags/{id}/close", { hasBody: true }, args),
+      // GET /copy-desk/queue — rank: any-builder — GET /copy-desk/queue
+      getCopyDeskQueue: (args) => request("GET", "/copy-desk/queue", { hasBody: false }, args),
+      // GET /copy-desk/strings — rank: any-builder — GET /copy-desk/strings
+      getCopyDeskStrings: (args) => request("GET", "/copy-desk/strings", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/clients/bongos-client/index.cjs

@@ -251,6 +251,16 @@ function createClient(opts = {}) {
       // POST /claims/batch/validate — rank: any-builder — POST /claims/batch/validate
       postClaimsBatchValidate: (args) => request("POST", "/claims/batch/validate", { hasBody: true }, args),
     },
+    "copyDesk": {
+      // POST /copy-desk/flags — rank: any-builder — POST /copy-desk/flags
+      postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
+      // POST /copy-desk/flags/{id}/close — rank: any-builder — POST /copy-desk/flags/:id/close
+      postCopyDeskFlagsIdClose: (args) => request("POST", "/copy-desk/flags/{id}/close", { hasBody: true }, args),
+      // GET /copy-desk/queue — rank: any-builder — GET /copy-desk/queue
+      getCopyDeskQueue: (args) => request("GET", "/copy-desk/queue", { hasBody: false }, args),
+      // GET /copy-desk/strings — rank: any-builder — GET /copy-desk/strings
+      getCopyDeskStrings: (args) => request("GET", "/copy-desk/strings", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/clients/bongos-client/index.d.ts

@@ -192,6 +192,10 @@ export interface PostClaimsIdReleaseOnBehalfRequest { reason: string }
 export interface PostClaimsIdResolveRequest { outcome: "shipped" | "abandoned" | "partial"; notes_md?: string; value_summary?: string; verification?: Record<string, unknown>; force?: boolean; committed_files?: string[]; sandbox_review?: Record<string, unknown> }
 export interface PostClaimsRequest { task_id: StringifiableId; worktree_name?: string; head_sha?: string; bind_session?: boolean; enforce_touches?: boolean }
 export interface PostClaimsResponse { claim: unknown; task: unknown; just_unlocked: unknown; overlap_warning: unknown; reward: unknown }
+export interface PostCopyDeskFlagsIdCloseRequest { status: string; resolution_note: string; resolved_task_id?: number }
+export interface PostCopyDeskFlagsIdCloseResponse { ok: boolean; flag: unknown }
+export interface PostCopyDeskFlagsRequest { scope?: string; surface: string; string_id?: string; reason: string; kind?: string }
+export interface PostCopyDeskFlagsResponse { ok: boolean; flag: unknown }
 export interface PostCostRequest { task_id?: number; amount_usd: number; category: string; description?: string; source?: string; source_ref?: string; recorded_at?: string; fresh_input_usd?: number; cache_read_usd?: number; cache_write_usd?: number; output_usd?: number; builder_id?: number; skill_name?: string }
 export interface PostCostResponse { skipped?: boolean; reason?: unknown; id?: unknown; recorded_at?: unknown }
 export interface PostDependenciesResponse { ok: boolean; dependency: unknown }
@@ -506,6 +510,16 @@ export interface BongosClient {
     /** POST /claims/batch/validate — rank: any-builder */
     postClaimsBatchValidate(args: RequestArgs & { body: PostClaimsBatchValidateRequest }): Promise<ApiResponse>;
   };
+  "copyDesk": {
+    /** POST /copy-desk/flags — rank: any-builder */
+    postCopyDeskFlags(args: RequestArgs & { body: PostCopyDeskFlagsRequest }): Promise<PostCopyDeskFlagsResponse>;
+    /** POST /copy-desk/flags/{id}/close — rank: any-builder */
+    postCopyDeskFlagsIdClose(args: RequestArgs & { body: PostCopyDeskFlagsIdCloseRequest }): Promise<PostCopyDeskFlagsIdCloseResponse>;
+    /** GET /copy-desk/queue — rank: any-builder */
+    getCopyDeskQueue(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /copy-desk/strings — rank: any-builder */
+    getCopyDeskStrings(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "cost": {
     /** POST /cost — rank: any-builder */
     postCost(args: RequestArgs & { body: PostCostRequest }): Promise<PostCostResponse>;

package/clients/bongos-client/index.mjs

@@ -248,6 +248,16 @@ export function createClient(opts = {}) {
       // POST /claims/batch/validate — rank: any-builder — POST /claims/batch/validate
       postClaimsBatchValidate: (args) => request("POST", "/claims/batch/validate", { hasBody: true }, args),
     },
+    "copyDesk": {
+      // POST /copy-desk/flags — rank: any-builder — POST /copy-desk/flags
+      postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
+      // POST /copy-desk/flags/{id}/close — rank: any-builder — POST /copy-desk/flags/:id/close
+      postCopyDeskFlagsIdClose: (args) => request("POST", "/copy-desk/flags/{id}/close", { hasBody: true }, args),
+      // GET /copy-desk/queue — rank: any-builder — GET /copy-desk/queue
+      getCopyDeskQueue: (args) => request("GET", "/copy-desk/queue", { hasBody: false }, args),
+      // GET /copy-desk/strings — rank: any-builder — GET /copy-desk/strings
+      getCopyDeskStrings: (args) => request("GET", "/copy-desk/strings", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/docs/adr/0178-the-copy-desk-flag-and-queue.md

@@ -0,0 +1,131 @@
+# 0178 — The copy desk: a flag carries a judgement, and no column here could ever hold copy
+
+- **Status:** Accepted
+- **Date:** 2026-08-19
+- **Tasks:** [#1003113](https://cloudbongos.com/builders#/task/1003113) (R02 of goal 1000074, the artist's loop) — builds on [#1003112](https://cloudbongos.com/builders#/task/1003112) (R01, the copy registry)
+- **Extends:** [ADR 0081](<redacted>.md) — the repo is the source of truth for design, with swappable tool adapters. This is the same claim for TEXT.
+- **Related:** ADR 0083 (module system, module-owned migrations), 0086 (goals + scope walls), 0016 (authority resolved server-side), 0162 (grader verdicts are advisory, never self-executing), 0175 (an objection requires a reason)
+
+## Context
+
+Goal 1000074 gives the artist real authority over what ships, and the owner's ABI brief gives them the
+project's **text**: no slop, story and ideology communicated, purpose and gravitas, re-text-writing.
+None of that was exercisable. Copy was scattered across 57 hall files, the status dashboard and a
+server-rendered landing template, and nothing routed work to an artist.
+
+R01 built the inventory: `scripts/gds/copy-inventory.js` emits `docs/copy-registry.json` — every
+user-facing string with a stable id and the render path that shows it. An inventory answers *what does
+the product say*. It cannot answer *what is wrong with what the product says*, which is a judgement a
+person has to make and record. R02 is that record, plus the queue an artist reads it from.
+
+Two constraints came from the goal itself, and they pull against each other. **Blocking strictness is
+per project, not global** (R05's problem, not this one). And **NO LIVE CMS** — every copy change is a
+claimed, graded, shipped task, because the GDS is the complete ledger of what happened to this project.
+The tension: the goal also asks for "an editing affordance". An affordance that edits, and a ledger
+that must record every edit, are one bad column apart from being incompatible.
+
+## Decision
+
+### 1. Copy is its own module — `copy-desk`, not `copy`
+
+The domain has no home today. `ideas` owns intake queues and would have been the cheap answer, but its
+module-owned migrations must be `ideas_`-prefixed, so the table would have been `ideas_copy_flags` — a
+name that lies about the domain. `hall-ui` contributes no routes. `lifecycle` is the build state
+machine. So: a new default-on core-domain module, which the loader discovers with no core edits.
+
+**The key is `copy-desk` and not `copy` for a concrete reason, not a stylistic one.** The branding
+contract already owns a `copy` block (`branding.copy.tagline` / `hallName` / `notFound`). The
+`core carries no module code` fitness check greps kernel files for every discovered module key, so a
+module keyed `copy` reds the build on the English word appearing in `src/branding.js`. `copy-desk` is
+also the more accurate name: the copy desk is the editorial station copy passes over before it is
+published, which is exactly the job. SQL namespace `copy_desk_`, table `copy_desk_flags`.
+
+The generator stays at `scripts/gds/copy-inventory.js` and is listed in the module's scope-map globs —
+a command travels with its domain (the `memory`/`ideas` precedent), it does not move.
+
+### 2. A flag carries a JUDGEMENT, and the floor is in the schema
+
+A flag with no reason hands an artist a pointer and no judgement. That is strictly **worse** than not
+flagging, because it still costs them a look. So `reason` is required in the route (a named
+`reason_too_thin` whose payload explains why, since the person hitting it is trying to help) **and** in
+a CHECK constraint (`length(btrim(reason)) >= 10`).
+
+Both, deliberately. The route gives a person a usable error; the constraint means no future write path
+— a backfill, a CLI, a later module — can quietly create the reasonless flag the queue exists to not
+contain. Closing a flag requires a note for the same reason, and **the symmetry is the point**: an
+unexplained close is indistinguishable from a queue being cleared to make a number go down. ADR 0175
+made the same call for a board objection.
+
+### 3. NO LIVE CMS is enforced by the schema's SHAPE, and made testable
+
+This is the load-bearing decision. A non-goal that lives only in prose erodes — and it does not erode
+by someone committing "add a CMS". It erodes by one plausible column ("just store the suggested wording
+so the artist doesn't lose it"), then one plausible read of that column, and the ledger rule is dead
+with nobody having decided to kill it.
+
+So **`copy_desk_flags` has no column that could hold replacement text, and must never gain one.** A
+flag carries a judgement (`reason`, `kind`) and a pointer (`surface`, `string_id`). The editing
+affordance R03 builds produces a **task with a diff attached**, not a row here; `resolved_task_id` is
+the seam it lands on.
+
+`modules/copy-desk/tests/copy_no_cms.mjs` pins the shape: the write surface is exactly the two verbs
+R02 defines, no `new_text`-shaped column exists, this module performs no filesystem write, and the
+manifest provides no port another module could write copy through. When R03 adds its proposal path the
+expected route list changes **in a diff a reviewer can see**, rather than drifting.
+
+### 4. Filing is open to every rank; closing is Metic+ or the author
+
+Asymmetric on purpose. **"Sourced by everyone else" is the task's own framing** — the engineer who just
+wrote a toast, the newcomer who could not understand a button, and the ideator reading the landing page
+are the three people most likely to notice bad copy, and none of them is the artist. A rank floor on
+filing leaves the queue empty and the goal unmet. The reason floor is the quality gate; rank is not.
+
+Closing someone else's flag is a triage act at the same floor as idea triage and blocker resolution
+(Metic+). An author withdrawing their own flag is a correction, not triage, and should not require a
+promotion. **An artist is a craft, not a rank** (`builders.preferred_disciplines`), so nothing here
+gates on craft — that would hide the artist's own queue from a Xenos artist.
+
+### 5. Duplicates are the only automatic signal, and the count subtracts settled work
+
+The task asked the queue to surface copy that is **stale, duplicated or off-voice**. Only duplication
+needs no judgement layer, and R01 already computes it deterministically. This module does not recompute
+it — it **subtracts what has already been flagged or dismissed**, because a count that never moves
+however much work an artist does teaches them the queue is decorative. Stale and off-voice need either
+a person (the flag) or a judge, which is not built.
+
+### 6. A vanished target is reported, never auto-closed
+
+The registry id is a content hash over (surface, text, render path): stable across a file **move**, not
+across an **edit**. So a flag routinely outlives the sentence it names, and `annotateFlag` reports
+`target_state: 'gone'`.
+
+That is a **hint for a person**, not a verdict. Auto-closing on it would be the system deciding a human
+judgement is finished because a hash moved — the same family of error ADR 0162 rules out for grader
+verdicts. Every flag also stores a snapshot (text, file, line at flag time), taken server-side from the
+registry and never from the request body: a caller-supplied snapshot is a caller-supplied claim, and
+the snapshot's entire value is that it can be trusted later.
+
+## Consequences
+
+- **A new default-on module ships to every instance.** Justified: every instance shows a person words.
+- **The queue describes the committed registry** — the deployed tree, not a working copy. It therefore
+  names what it read and hands over `--check`, and **deliberately reports no `generated_at`**: R01 is in
+  the `gen-*` family and its contract is determinism, so a clock is the one field it cannot carry. The
+  file's mtime is the checkout's, and showing it as "generated" would be a plausible lie.
+- **The inventory is partial and says so.** R01's documented blind spots — server-side messages, skill
+  prose, runtime-composed strings — travel with the queue payload and render on the page, so "1332
+  strings" is never read as "every word the project says".
+- **Adding a hall page adds copy**, so `docs/copy-registry.json` must be regenerated when a surface file
+  changes. `tests/copy_inventory.mjs` already enforces this; this task tripped it, which is the system
+  working.
+- **Goal 1000074's `scope_modules` must gain `copy-desk`**, or R03–R06 cannot declare `touches[]` in the
+  module their work lives in. The mechanism is `POST /goals/:id/scope` with `{"add":["copy-desk"]}` —
+  the ADR 0086 §4 "ask to widen" route, Metic+ and member-or-Archon, Archon-only for a protected module.
+  **It cannot run until this change is deployed.** The route validates the key against `isModuleKey()`,
+  which reads the *running server's* `module-scope-map.js`; until the instance pin moves, the live
+  roster has no `copy-desk` and the call answers `400 unknown_module`. So this is an ordering
+  dependency, not a missing capability, and it is the one follow-up that must happen after the pin
+  moves rather than before.
+- **R05 still owns the hard question.** Nothing here blocks a ship. Whether an artist's flag can ever
+  gate a ship, and how that coexists with ADR 0162, is R05's to decide — this ADR deliberately does not
+  pre-empt it, and the flag is advisory by construction until it does.

package/docs/adr/README.md

@@ -251,5 +251,6 @@ This keeps the decision history honest and traceable.
 | 0175 | [**The Board Room: Full Idea ratification is the first upward-pointing gate** ([task 1003014](https://cloudbongos.com/builders#/task/1003014), R01 of goal 1000069). Every existing gate points DOWN the rank ladder; the owner asked for one that could slow THEM down — *"otherwise I can just ship and build as I want, finding loopholes."* The board's subjects are exactly **two**, both rare by construction: a **Full Idea** and a **change to the constitution itself** (`subject_type` from day one). Because the vote gates no build path, the **ADR 0162 tension dissolves rather than being compromised** — nothing self-executes because there is nothing downstream to execute; ratification confers legitimacy and does NOT auto-create the goal. A vote is a **timed sitting, not a quorum**: absent members are *nulled* (dropped from the denominator, never counted as a no), so the clock is the deadlock exit and no shotgun/fork-with-treasury clause is needed at this scale — default 90 minutes, closing early on full turnout, and yes, a short window means whoever is awake governs (the owner's explicit intent). **Consent, not majority**: silence is consent, one reasoned objection returns the idea, and a zero-vote close PASSES. A rejection must carry free text **plus one of the five Full Idea sections** — which is what **forces the hall to be the voting surface**, since a Discord reaction could only ever be feedback-free; Discord is therefore an outbound notification mirror that casts nothing, and its own mobile app is the mobile push (no mobile surface is built). The completeness grade is the **floor** (a window opens automatically on pass), the vote is the **merit**; concurrent windows are normal. Who governs is **configuration** — day one is monarchy expressed as config on the real machinery, never a separate code path — and **amendments are decided under whatever rule is currently in force**, so flipping out of monarchy is a legal monarchy act and no bootstrap exception is needed. Open ballot; an author may never vote on their own item. Franchise derives from **rank, not role**, and that is forced: `PATCH /me/disciplines` is deliberately ungated, so a craft-scoped chamber would be one-request privilege escalation. Unblocks goal 1000067 / IC5, which consumes the pass event and *"invents no parallel vote"*. Rejected: quadratic vote weighting and the attribution-economy knobs (γ, τ, the 30% stack cap — v1's franchise is not credit-weighted at all), eternity clauses, and any legal-entity integration.](<redacted>.md) | government / ideas / governance |
 | 0176 | [**Private-repo standup: a per-repo read-only deploy key, minted with the owner's token** ([task 1002735](https://cloudbongos.com/builders#/task/1002735), goal 1000032; walk finding N4, seen live on `mercury` 2026-08-17). A standalone instance's repo is cloned/pushed once with the owner's `repo`-scoped token (ADR 0155), but the durable `origin` rides the shared SSH deploy alias — which GitHub answers "Repository not found" for a private repo it isn't registered on, so every private standup failed at the recurring `git pull --ff-only origin main`, **token or not**. Fix: when the target repo answers *private* to the owner's stored token, provisioning mints the instance its OWN ed25519 deploy key beside the checkout (`.git/cloudbongos-deploy-key` — untracked, survives `git reset --hard`, dies with the checkout), registers it on the repo **read-only** as `cloudbongos-deploy-<slug>` (idempotent by title; a stale same-title key is replaced, never duplicated), then wires the CHECKOUT: `origin` re-pointed at plain `git@github.com` and `core.sshCommand` pinned to the key with `-F /dev/null` so no `~/.ssh/config` identity can shadow it. Public repos take the unchanged shared-alias path; pushes keep preferring the owner-token HTTPS URL (task 1002317), which is why read-only suffices; teardown best-effort revokes by title. Rejected: **GitHub App installation tokens** (hourly expiry means every unattended pull needs a minting sidecar or a hub round-trip) and **registering the shared platform key on the repo** (one shared secret granting the whole platform durable access to private code; per-repo keys keep the blast radius to one repo and are visible to the owner in their own repo settings). Follow-ups: the manage page's flip-to-private stays refused until already-provisioned instances get the same wiring, and builder dev boxes of a private-repo project need their own leg.](<redacted>.md) | provisioning / security |
 | 0177 | [**A goal membership is a `membership_kind`, and the rename ships expand-then-contract** ([task 1003013](https://cloudbongos.com/builders#/task/1003013), goal 1000068). ADR 0174 reserved `role` for the three crafts and enforced it on the GOVERNMENT surface only — by design, since `builders.system_role` and Discord's own noun are legitimate. That left a **fourth** use uncatalogued: `goal_members.role` (`'lead' | 'member'`), the MANAGER predicate behind goal authorization. Renamed to **`membership_kind`** — values unchanged, because the noun was the problem; `rank` is wrong (not a ladder position) and `position` is worse (ADR 0174 uses it as the prose word for a rank, recreating the "rank-role" qualifier collision). A boolean `is_lead` was seriously considered and rejected: the text rename keeps the copied CHECK and stays a reversible change on a live authz column, where `ADD boolean; UPDATE; DROP text` is data-destructive. The migration is **expand-then-contract, never `RENAME COLUMN`** — auto-rollback reverts the code pin and NOT the DB, so `core_220` ADDs the column and keeps the pair in lockstep with a BEFORE trigger (direction decided by which side changed), and a later task DROPs the old column with the `-- forward-unsafe` pragma, a backup, and its own window; no `SET NOT NULL` in step 1, because a static NOT NULL on a column the previous release never heard of is what the forward-safety gate rightly flags. The API field renames with it and carries **no `role` alias** (ADR 0174's Lineage lesson: a time-boxed shim outlives its release), pinned by the test of its absence. The reservation gains a **second narrow wall** rather than a widened first one — line-scoped inside the 5k-line `db.js` to the lines that name `goal_members`, so no allowlist is needed. A **fifth** use (`project_memberships.role`) is catalogued and filed, with this as its pattern.](<redacted>.md) | naming / lifecycle |
+| 0178 | [**The copy desk: a flag carries a judgement, and no column here could ever hold copy** ([task 1003113](https://cloudbongos.com/builders#/task/1003113), R02 of goal 1000074). [ADR 0081](<redacted>.md) made the repo the source of truth for design TOKENS; user-facing TEXT had no equivalent. R01 built the inventory (`copy-inventory.js` → `docs/copy-registry.json`), which answers *what does the product say* but cannot answer *what is wrong with it* — a judgement a person must record. This is that record plus the artist's queue. A new default-on module keyed **`copy-desk`, not `copy`**, for a concrete reason: the branding contract already owns a `copy` block, so the bare word reds the `core carries no module code` fitness check on the English word in `src/branding.js` — and the editorial "copy desk" is the more accurate name anyway. **The reason is required in the route AND in a CHECK constraint**: the route gives a person a usable error, the constraint means no future write path can create the reasonless flag the queue exists to not contain (a pointer with no judgement is *worse* than no flag — it still costs the artist a look). Closing requires a note by the same symmetry, since an unexplained close is indistinguishable from clearing a queue to move a number. The load-bearing decision is **NO LIVE CMS enforced by the schema's SHAPE**: `copy_desk_flags` has no column that could hold replacement text and must never gain one, because that non-goal does not erode via an "add a CMS" commit but via one plausible column, then one plausible read of it — `copy_no_cms.mjs` pins the write surface at exactly two verbs so R03's proposal path changes it in a reviewable diff. Rank is asymmetric: **filing is open to every rank** (the engineer who wrote the toast and the newcomer who could not read the button are the likeliest noticers, and neither is the artist — the reason floor is the quality gate, rank is not), closing is Metic+ **or the author** (withdrawing your own flag is a correction, not triage); nothing gates on craft, since an artist is a craft and not a rank. Duplicates are the only automatic signal (the one of stale/duplicated/off-voice needing no judgement layer) and the count **subtracts settled work**, or it never moves and teaches that the queue is decorative. A vanished target is **reported, never auto-closed** — the id is a hash over the text, so an edit routinely orphans a flag, and closing a human judgement because a hash moved is the family of error ADR 0162 rules out. Deliberately reports **no `generated_at`**: R01's contract is determinism, so a clock is the one field it cannot carry.](<redacted>.md) | design / artist loop |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)