@bongos/core 1.19.249 → 1.19.251

package/docs/file-map.md

@@ -124,6 +124,7 @@
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav.
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js.
+│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.

package/modules/copy-desk/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/copy-desk/flags.js

@@ -0,0 +1,245 @@
+// modules/copy-desk/flags.js — the copy_desk_flags domain (task 1003113 / R02 of goal
+// 1000074, the artist's loop).
+//
+// The SOURCING half of the loop: anyone in any role marks a string — or a whole
+// surface — as needing an artist's attention, with a reason. The artist reads
+// the queue built from those rows (registry.js composes it).
+//
+// THE REASON FLOOR IS ENFORCED TWICE, ON PURPOSE. `normalizeFlagPayload` below
+// rejects a thin reason with a named 400, and copy_desk_001_flags.sql rejects it
+// again with a CHECK constraint. That is not belt-and-braces for its own sake:
+// the route layer gives a person a usable error, and the constraint means no
+// future write path — a backfill, a CLI, a later module — can quietly create the
+// reasonless flag this queue exists to not contain.
+//
+// NO LIVE CMS (the goal's hard non-goal). Nothing in this file writes a
+// user-facing string, and no function here returns one to a renderer as
+// authoritative copy. `text_at_flag` is a historical snapshot for a human
+// reading the flag later; the live text always comes from the registry.
+// See modules/copy-desk/tests/copy_no_cms.mjs, which pins that as a test.
+//
+// The PURE seam (normalizeFlagPayload / normalizeResolution) is exported for the
+// DB-free unit gate; the SQL below it is deliberately thin.
+
+'use strict';
+
+const { pool } = require('../../src/module-api');
+
+// Mirrors of the DB CHECK constraints — enforced here first so a bad payload
+// gets a clean, named 400 instead of a raw constraint violation surfacing as a
+// 500. The DB stays the backstop; this is the error message.
+const SCOPES = Object.freeze(['string', 'surface']);
+const STATUSES = Object.freeze(['open', 'resolved', 'dismissed']);
+const KINDS = Object.freeze(['slop', 'off-voice', 'stale', 'unclear', 'duplicate', 'typo', 'other']);
+// The closing verdicts a person can apply to an open flag. 'open' is not among
+// them — a flag is opened by filing it, not by resolving it to open.
+const CLOSING_STATUSES = Object.freeze(['resolved', 'dismissed']);
+
+// The floor, matching copy_desk_flags_reason_chk. Not a quality bar — a quality bar
+// cannot be a number. This rejects "", "bad", "fix" and nothing more.
+const MIN_REASON_CHARS = 10;
+const MAX_REASON_CHARS = 2000;
+const MAX_NOTE_CHARS = 2000;
+
+const fail = (code, detail) => ({ ok: false, code, detail: detail ?? null });
+
+// Collapse runs of whitespace and trim, so the length floor measures CONTENT and
+// not spacebar. "   f   i   x   " is 3 characters of reason, not 15.
+function tidy(raw) {
+  return String(raw == null ? '' : raw).replace(/\s+/g, ' ').trim();
+}
+
+// Validate + normalize one POSTed flag into the exact column shape insertFlag
+// writes. PURE — no DB, no fs — so the whole contract is unit-testable.
+//
+// `registryIndex` is the loaded registry's index (registry.js). It is REQUIRED:
+// a flag that points at a surface or string the registry does not contain is a
+// dangling pointer, and the artist inherits it. Validating against the live
+// registry rather than a hardcoded list means the generator stays the single
+// place a surface is defined.
+//
+// The SNAPSHOT is taken from the registry here, never from the body — a
+// caller-supplied "this is what it currently says" is a caller-supplied claim,
+// and the snapshot's entire value is that it can be trusted later.
+function normalizeFlagPayload(body, registryIndex, registryHelpers) {
+  const b = body || {};
+
+  const scope = String(b.scope || 'string');
+  if (!SCOPES.includes(scope)) return fail('bad_scope', { allowed: SCOPES });
+
+  const surface = String(b.surface || '');
+  if (!surface) return fail('surface_required');
+  if (!registryHelpers.hasSurface(registryIndex, surface)) {
+    return fail('unknown_surface', { surface, known: [...registryIndex.surfaces] });
+  }
+
+  const kind = String(b.kind || 'other');
+  if (!KINDS.includes(kind)) return fail('bad_kind', { allowed: KINDS });
+
+  const reason = tidy(b.reason);
+  if (reason.length < MIN_REASON_CHARS) {
+    // The message says WHY, not just that a rule fired — this refusal is read by
+    // someone who is trying to help, and "reason too short" without the reason
+    // for the reason reads as bureaucracy.
+    return fail('reason_too_thin', {
+      min_chars: MIN_REASON_CHARS,
+      got: reason.length,
+      why: 'A flag hands an artist a pointer and a judgement. Without the judgement it costs them a look and tells them nothing — which is worse than not flagging it.',
+    });
+  }
+  if (reason.length > MAX_REASON_CHARS) return fail('reason_too_long', { max_chars: MAX_REASON_CHARS });
+
+  let stringId = null;
+  let snapshot = null;
+  if (scope === 'string') {
+    stringId = String(b.string_id || '');
+    if (!stringId) return fail('string_id_required', { why: "scope 'string' names one registry row; use scope 'surface' to flag a whole surface." });
+    snapshot = registryHelpers.snapshotFor(registryIndex, stringId);
+    if (!snapshot) return fail('unknown_string_id', { string_id: stringId, at: registryHelpers.REGISTRY_REL });
+    // The id encodes its surface, so a body claiming a different one is either a
+    // stale client or a confused one. Trust the registry, refuse the mismatch —
+    // silently overwriting it would file the flag onto a surface the reporter
+    // did not choose, and they would never see where it went.
+    if (snapshot.surface && snapshot.surface !== surface) {
+      return fail('surface_mismatch', { string_id: stringId, body_surface: surface, registry_surface: snapshot.surface });
+    }
+  }
+
+  return {
+    ok: true,
+    value: {
+      scope,
+      surface,
+      string_id: stringId,
+      reason,
+      kind,
+      text_at_flag: snapshot ? snapshot.text : null,
+      file_at_flag: snapshot ? snapshot.file : null,
+      line_at_flag: snapshot ? snapshot.line : null,
+      registry_schema: snapshot ? snapshot.schema : (registryIndex.schema ?? null),
+    },
+  };
+}
+
+// Validate a close (resolve / dismiss). PURE.
+//
+// A NOTE IS REQUIRED TO CLOSE, for the same reason one is required to open. The
+// symmetry is the point: "someone looked at this and decided" is the record the
+// NEXT person needs when they hit the same sentence, and an unexplained close is
+// indistinguishable from a queue being cleared to make a number go down.
+function normalizeResolution(body) {
+  const b = body || {};
+  const status = String(b.status || '');
+  if (!CLOSING_STATUSES.includes(status)) return fail('bad_status', { allowed: CLOSING_STATUSES });
+
+  const note = tidy(b.resolution_note);
+  if (note.length < MIN_REASON_CHARS) {
+    return fail('resolution_note_too_thin', {
+      min_chars: MIN_REASON_CHARS,
+      got: note.length,
+      why: 'Closing a flag is a judgement too. The next person to notice this sentence reads your note instead of re-litigating it.',
+    });
+  }
+  if (note.length > MAX_NOTE_CHARS) return fail('resolution_note_too_long', { max_chars: MAX_NOTE_CHARS });
+
+  let taskId = null;
+  if (b.resolved_task_id !== undefined && b.resolved_task_id !== null && b.resolved_task_id !== '') {
+    taskId = Number(b.resolved_task_id);
+    if (!Number.isInteger(taskId) || taskId <= 0) return fail('bad_resolved_task_id');
+  }
+  // A 'resolved' close SHOULD name the task that carried the fix — that link is
+  // the ledger proof R03 hangs its proposals on. It is not REQUIRED, because a
+  // string can legitimately be fixed by a task filed before this flag existed,
+  // and refusing the close would leave a false open flag standing. Absence is
+  // recorded (the column stays NULL) rather than being papered over.
+  return { ok: true, value: { status, resolution_note: note, resolved_task_id: taskId } };
+}
+
+// ---------------------------------------------------------------------------
+// SQL. Thin by design — the rules live above and in the migration's constraints.
+// ---------------------------------------------------------------------------
+
+// One list of columns, rendered two ways: qualified for the joined reads, bare
+// for RETURNING (which has no alias in scope). Derived from the single array so
+// the two can never drift — the reads and the write always project the same row
+// shape, which is what lets the hall render an insert response and a queue row
+// with one function.
+const FLAG_COL_NAMES = Object.freeze([
+  'id', 'scope', 'surface', 'string_id', 'reason', 'kind',
+  'text_at_flag', 'file_at_flag', 'line_at_flag', 'registry_schema',
+  'flagged_by', 'flagged_at', 'status', 'resolution_note',
+  'resolved_task_id', 'resolved_by', 'resolved_at',
+]);
+const FLAG_COLS = FLAG_COL_NAMES.map((c) => `f.${c}`).join(', ');
+const FLAG_COLS_BARE = FLAG_COL_NAMES.join(', ');
+
+async function insertFlag(value, builderId) {
+  const { rows } = await pool.query(
+    `INSERT INTO copy_desk_flags
+       (scope, surface, string_id, reason, kind, text_at_flag, file_at_flag, line_at_flag, registry_schema, flagged_by)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
+     RETURNING ${FLAG_COLS_BARE}`,
+    [value.scope, value.surface, value.string_id, value.reason, value.kind,
+      value.text_at_flag, value.file_at_flag, value.line_at_flag, value.registry_schema, builderId]
+  );
+  return rows[0];
+}
+
+// The queue read. `status` defaults to 'open' — the queue is what is OUTSTANDING;
+// history is available by asking for it, never mixed into the working list by
+// default.
+//
+// Joined to builders for the display name: a flag is a judgement by a PERSON,
+// and an artist deciding how much weight to give it needs to know whose it is.
+async function listFlags({ status = 'open', surface = null, stringId = null, limit = 200 } = {}) {
+  const where = [];
+  const args = [];
+  if (status && status !== 'all') { args.push(status); where.push(`f.status = $${args.length}`); }
+  if (surface) { args.push(surface); where.push(`f.surface = $${args.length}`); }
+  if (stringId) { args.push(stringId); where.push(`f.string_id = $${args.length}`); }
+  // Same clamp rule as registry.searchEntries: nonsense in, default out — never
+  // a single row, which would read as an almost-empty queue.
+  const asked = Number(limit);
+  args.push(Math.min(Number.isFinite(asked) && asked > 0 ? Math.floor(asked) : 200, 500));
+
+  const { rows } = await pool.query(
+    `SELECT ${FLAG_COLS},
+            b.github_login  AS flagged_by_login,
+            b.display_name  AS flagged_by_name,
+            r.github_login  AS resolved_by_login
+       FROM copy_desk_flags f
+       JOIN builders b ON b.id = f.flagged_by
+       LEFT JOIN builders r ON r.id = f.resolved_by
+      ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+      ORDER BY f.status = 'open' DESC, f.flagged_at DESC
+      LIMIT $${args.length}`,
+    args
+  );
+  return rows;
+}
+
+async function getFlag(id) {
+  const { rows } = await pool.query(`SELECT ${FLAG_COLS} FROM copy_desk_flags f WHERE f.id = $1`, [id]);
+  return rows[0] || null;
+}
+
+// Close a flag. Guarded on `status = 'open'` IN THE UPDATE so two people closing
+// the same flag at once cannot both win — the second gets zero rows and a named
+// 409, rather than silently overwriting the first person's verdict and note.
+async function closeFlag(id, value, builderId) {
+  const { rows } = await pool.query(
+    `UPDATE copy_desk_flags
+        SET status = $2, resolution_note = $3, resolved_task_id = $4,
+            resolved_by = $5, resolved_at = now()
+      WHERE id = $1 AND status = 'open'
+      RETURNING ${FLAG_COLS_BARE}`,
+    [id, value.status, value.resolution_note, value.resolved_task_id, builderId]
+  );
+  return rows[0] || null;
+}
+
+module.exports = {
+  SCOPES, STATUSES, KINDS, CLOSING_STATUSES, MIN_REASON_CHARS, MAX_REASON_CHARS, MAX_NOTE_CHARS,
+  tidy, normalizeFlagPayload, normalizeResolution,
+  insertFlag, listFlags, getFlag, closeFlag,
+};

package/modules/copy-desk/migrations/copy_desk_001_flags.sql

@@ -0,0 +1,128 @@
+-- copy_desk_001_flags.sql — the COPY FLAG: a first-class request that an artist look
+-- at one string, or at a whole surface (task 1003113 / R02 of goal 1000074).
+--
+-- WHAT A FLAG IS. R01 built the inventory (docs/copy-registry.json): every
+-- user-facing string, with a stable id and the render path that shows it. An
+-- inventory answers "what does the product say". It cannot answer "what is
+-- WRONG with what the product says" — that is a judgement someone has to make
+-- and record. This table is that record, and it is the sourcing half of the
+-- artist's loop: anyone in any role files a flag, and the artist reads a queue
+-- built from them.
+--
+-- THE REASON IS REQUIRED, IN THE SCHEMA. A flag with no reason is worthless —
+-- it hands the artist a pointer and no judgement, which is strictly worse than
+-- not flagging, because it still costs them a look. The board's objection flow
+-- makes the same call for the same reason (ADR 0175), so the floor lives in a
+-- CHECK constraint here and not only in the route: a flag with an empty or
+-- one-word reason must be impossible to store, not merely hard to POST.
+--
+-- WHAT A FLAG POINTS AT, AND WHY THE SNAPSHOT COLUMNS EXIST. `string_id` is the
+-- registry's stable id — a content hash over (surface, text, render path), so it
+-- is stable across a file MOVE but NOT across an edit to the text itself. That is
+-- the right behaviour (editing the copy is what resolves the flag) but it means a
+-- flag can outlive the string it names. So every flag also carries a SNAPSHOT of
+-- what was flagged: the text, the file and the line as they read at flag time.
+-- Without that, a resolved flag is unreadable a month later ("what did this say
+-- before?"), and an open flag whose string has since changed looks like a
+-- pointer into nothing rather than what it is — a judgement about a specific
+-- sentence that someone has since edited. The queue reads the snapshot beside
+-- the live registry and reports when they diverge.
+--
+-- NO LIVE CMS — the goal's hard non-goal, and this schema is a load-bearing part
+-- of holding it. There is deliberately NO column here that a renderer would ever
+-- read. A flag carries a judgement and a pointer; it can never carry replacement
+-- text, because a "proposed new string" column is one join away from being a
+-- production copy source, and the ledger rule (every change is a claimed, graded,
+-- shipped task) would be dead. R03 attaches proposals to TASKS; `resolved_task_id`
+-- below is the seam it lands on. Do not add a `new_text` column here.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is copy_desk_-prefixed, there is no down path, and the filename is
+-- copy_desk_-prefixed (ADR 0108 §5) so its stem never collides across repos.
+-- Idempotent: safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS copy_desk_flags (
+  id                bigserial PRIMARY KEY,
+
+  -- WHAT is flagged. 'string' names one registry row; 'surface' flags a whole
+  -- surface ("the landing page reads like a brochure") — a judgement that has no
+  -- single string to hang on, and would otherwise be filed as a misleading flag
+  -- against whichever line the reporter happened to be looking at.
+  scope             text NOT NULL,
+  -- The registry surface id ('builders-hall', 'status-dashboard', 'landing').
+  -- Text, not an FK: surfaces live in the generated registry, not in a table, and
+  -- a scope-wall-crossing lookup table would put the file and the DB in a race.
+  -- The route validates it against the live registry before insert.
+  surface           text NOT NULL,
+  -- The registry's stable string id. NULL exactly when scope = 'surface'.
+  string_id         text,
+
+  -- The judgement. REQUIRED — see the header.
+  reason            text NOT NULL,
+  -- What KIND of wrong, so the artist can sort a long queue by the work it
+  -- implies (a typo and an off-voice paragraph are different sittings). Text +
+  -- CHECK rather than an enum TYPE: widening is a one-line constraint change in
+  -- a later copy_* migration.
+  kind              text NOT NULL DEFAULT 'other',
+
+  -- The snapshot: what this flag was ABOUT, frozen at flag time. See the header.
+  text_at_flag      text,
+  file_at_flag      text,
+  line_at_flag      integer,
+  -- Which registry schema produced the snapshot, so a future schema change can
+  -- tell old rows from new ones instead of guessing.
+  registry_schema   integer,
+
+  flagged_by        bigint NOT NULL REFERENCES builders(id),
+  flagged_at        timestamptz NOT NULL DEFAULT now(),
+
+  -- open → the queue. resolved → the copy was changed. dismissed → looked at,
+  -- judged fine. Dismissal is a FIRST-CLASS outcome, not a soft delete: "an
+  -- artist read this and disagreed" is the answer to the next person who flags
+  -- the same sentence, and deleting the row throws that away.
+  status            text NOT NULL DEFAULT 'open',
+  resolution_note   text,
+  -- The task that carried the fix. The seam R03 lands its proposals on, and the
+  -- proof that a copy change went through the ledger rather than around it.
+  resolved_task_id  bigint REFERENCES tasks(id),
+  resolved_by       bigint REFERENCES builders(id),
+  resolved_at       timestamptz,
+
+  CONSTRAINT copy_desk_flags_scope_chk  CHECK (scope IN ('string', 'surface')),
+  CONSTRAINT copy_desk_flags_status_chk CHECK (status IN ('open', 'resolved', 'dismissed')),
+  CONSTRAINT copy_desk_flags_kind_chk   CHECK (kind IN ('slop', 'off-voice', 'stale', 'unclear', 'duplicate', 'typo', 'other')),
+  -- The required-reason floor, in the schema (see the header). 10 characters of
+  -- non-whitespace is not a quality bar — it is the "" / "bad" / "fix" floor.
+  CONSTRAINT copy_desk_flags_reason_chk CHECK (length(btrim(reason)) >= 10),
+  -- string_id is present exactly when scope = 'string'. Both halves matter: a
+  -- string-scoped flag with no id points nowhere, and a surface-scoped flag
+  -- WITH one would be silently narrower than it claims to be.
+  CONSTRAINT copy_desk_flags_target_chk CHECK ((scope = 'string') = (string_id IS NOT NULL)),
+  -- A closed flag is stamped and an open one is not — in both directions, so
+  -- "resolved" can never mean "resolved by nobody at no time".
+  CONSTRAINT copy_desk_flags_closed_chk CHECK ((status = 'open') = (resolved_at IS NULL AND resolved_by IS NULL))
+);
+
+-- The queue read: open flags, newest first, optionally per surface.
+CREATE INDEX IF NOT EXISTS copy_desk_flags_status_surface_idx
+  ON copy_desk_flags (status, surface, flagged_at DESC);
+
+-- "Is this string already flagged?" — asked once per rendered row when the hall
+-- marks up the registry, so it is worth an index of its own.
+CREATE INDEX IF NOT EXISTS copy_desk_flags_string_open_idx
+  ON copy_desk_flags (string_id) WHERE status = 'open';
+
+-- One OPEN flag per (target, builder). Two builders flagging the same sentence
+-- is SIGNAL and stays allowed — it is the cheapest agreement measure the queue
+-- has. The same builder filing twice is a double-click or a forgotten flag, and
+-- the artist should not pay for either. Closed rows are exempt, so a sentence
+-- that regresses can be flagged again by the same person.
+CREATE UNIQUE INDEX IF NOT EXISTS copy_desk_flags_one_open_per_target_idx
+  ON copy_desk_flags (flagged_by, surface, COALESCE(string_id, '')) WHERE status = 'open';
+
+INSERT INTO schema_migrations (version) VALUES ('copy_desk_001_flags')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/copy-desk/module.json

@@ -0,0 +1,11 @@
+{
+  "key": "copy-desk",
+  "title": "Copy desk (the artist's loop over user-facing text)",
+  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
+  "coreVersion": "^1.8.0",
+  "default": true,
+  "maintenance": { "status": "core-maintained" },
+  "contributes": { "routes": ["copy-desk"], "migrations": true },
+  "provides": [],
+  "consumes": []
+}