@bongos/core 1.19.249 → 1.19.251

package/scripts/gds/publish-manifest.js

@@ -62,6 +62,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/autonomy/',
   'modules/security/',
   'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
+  'modules/copy-desk/',      // the artist's loop over user-facing TEXT (goal 1000074, ADR 0178). default:true, so it MUST be here — and note the ASYMMETRY that makes omitting it worse than useless: its hall surface ships regardless, because modules/hall-ui/ is allowlisted as one subtree. A released core carrying the page and the nav entry but not the routes behind them puts a tab in every instance's hall whose every call 404s. The module and its page are only ever added or removed together; tests/publish_manifest.mjs holds that pair.
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/dev-box/',
@@ -104,6 +105,14 @@ const PUBLISH_ALLOWLIST = [
   'docs/branding-contract.md',
   'docs/branding-fill-prompt.md',
   'docs/design-contract.md',
+  // RUNTIME DATA that happens to live under docs/, not documentation (ADR 0178).
+  // modules/copy-desk reads the registry on EVERY queue load, and nothing on a
+  // deployed box regenerates it — copy-inventory.js is a commit-it generator run
+  // against a source tree, which an instance does not have. Omit these and a
+  // released instance answers 503 registry_missing forever. They sit under docs/
+  // only because that is where their generator has always written them.
+  'docs/copy-registry.json',
+  'docs/copy-inventory.md',          // the human twin, generated in the same pass
   'docs/file-map.md',
   'docs/repo-map.md',
   'docs/handoff-template.md',         // the portable session-handoff format (methodology)

package/scripts/gds/run-unit-tests.js

@@ -73,7 +73,17 @@ const INTEGRATION = new Set([
   // platform-server — network + package build + a spawned server, run by its own
   // .github/workflows/consumer-layout-boot.yml, not this DB-free gate (task 2142).
   'consumer_layout_boot',
-  'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
+  'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog',
+  // task 1003113: the copy_desk_flags schema half. The module's own tests are
+  // DB-free and cover the pure layer; the rules that MATTER here live in the
+  // schema — a CHECK-constraint reason floor whose whole argument is that no
+  // future write path evades it, a PARTIAL unique index whose partiality is the
+  // design, and a close guarded on the open status so two closers cannot both
+  // win. None of those are testable without a real transaction engine.
+  // (Prose here avoids single-quoted tokens: the pairing guard below parses this
+  // set out of the source, so a quoted word in a comment reads as an entry.)
+  'copy_desk_flags_db',
+  'discord_autojoin', 'discord_oauth',
   // RENAMED by ADR 0174 (goal 1000068) — these entries said governance_* until task
   // 1003091. A curated set keyed by a stem that no longer exists silently stops
   // covering its file: both of these dropped OUT of the integration set and INTO the

package/src/bongos/module-scope-map.js

@@ -216,6 +216,23 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- the COPY half of the design contract: the artist's loop over user-facing
+  //     TEXT (goal 1000074). ADR 0081 gave design TOKENS a repo-owned source of
+  //     truth; text had none. R01 built the inventory (the copy-inventory
+  //     generator + its committed registry under docs/), R02 the flag + queue on
+  //     top of it. The generator travels with the domain but stays under
+  //     scripts/gds/ — the memory/ideas precedent (a command travels with its
+  //     domain, design 02§1). The generated artifacts are listed as exact paths
+  //     so a copy task's touches[] can name them without claiming all of docs/.
+  //     KEY IS 'copy-desk', NOT 'copy': the branding contract already owns a
+  //     `copy` block (branding.copy.tagline/hallName/notFound), so the bare word
+  //     collides with kernel code and reds the "core carries no module code"
+  //     fitness check on the English word alone.
+  'copy-desk': [
+    'modules/copy-desk/',
+    'scripts/gds/copy-inventory.js',
+    'docs/copy-registry.json', 'docs/copy-inventory.md',
+  ],
   // --- the declarative agent registry (goal 1000038, ADR 0083 default:false):
   //     agent definitions reconciled at deploy into agents_definitions + a per-fire
   //     agents_runs ledger. Carved to modules/agents/ at foundation time, so the

package/src/bongos/serve-internal.js

@@ -922,8 +922,18 @@ function mountInternalSurfaces(app) {
   // thetes redirected exactly that reader to /builders/not-ready. Owner's call
   // (task 1002710) — the RANK floor is gone; sign-in is unchanged.
   // The link-hiding in shell.js is only cosmetic; these are the real gates.
+  // task 1003113: copy-desk joins this tier rather than a higher one. Filing a
+  // flag is open to every rank by design (see the nav comment in shell.js), so
+  // the page's only real gate is sign-in — the writes behind it self-gate, and
+  // closing someone else's flag is checked server-side at metic-or-author.
+  //
+  // NB the assignment below must stay `const NAME_RE = /…/;` with NOTHING between
+  // the `=` and the literal: tests/hall_page_gate_map.mjs reconstructs the whole
+  // URL→gate map by parsing this file statically, and a comment in that gap drops
+  // the regex out of its map — which reads as "every page on this tier is
+  // ungated". It fails loudly by design; keep prose above the const.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -925,8 +925,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.247 with no explicit bump. run 32198208766. (task 1002620)
 //   1.19.249 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.248 with no explicit bump. run 32199293372. (task 1002620)
+//   1.19.250 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.249 with no explicit bump. run 32203357427. (task 1002620)
+//   1.19.251 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.250 with no explicit bump. run 32204008770. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.249'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.251'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/copy_desk_flags_db.mjs

@@ -0,0 +1,250 @@
+// tests/copy_desk_flags_db.mjs — the copy_desk_flags schema + SQL against a REAL
+// Postgres (task 1003113 / R02 of goal 1000074).
+//
+// WHY THIS EXISTS SEPARATELY FROM modules/copy-desk/tests/. Those three files are
+// DB-free by contract and cover the PURE layer — the validators, the queue
+// composition, the no-CMS shape. They cannot cover the half of this feature that
+// lives in the schema, and that half is where the load-bearing rules are:
+//
+//   * the REASON FLOOR is a CHECK constraint, not just a route check. The whole
+//     argument for putting it there is that no future write path can get around
+//     it — which is a claim about Postgres, and can only be tested against
+//     Postgres.
+//   * the ONE-OPEN-FLAG-PER-(builder, target) rule is a PARTIAL unique index. Its
+//     partiality is the design (two builders flagging one sentence is signal; the
+//     same builder twice is a double-click; and a closed flag must not block a
+//     re-flag when the copy regresses). A fake client cannot exercise that.
+//   * the CLOSE IS GUARDED on `status='open'` inside the UPDATE so two people
+//     closing at once cannot both win. That is a race, and a race needs a real
+//     transaction engine to demonstrate.
+//   * the FK on resolved_task_id is what turns a typo'd task number into a named
+//     400 instead of an opaque 500.
+//
+// It SELF-SKIPS (exit 0) when no Postgres is reachable, so it is safe on a bare
+// worktree, and it is listed in run-unit-tests.js's INTEGRATION set so the
+// default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=postgres://... node tests/copy_desk_flags_db.mjs
+//
+// It creates its OWN minimal `builders`/`tasks` stand-ins if they are absent, so
+// it works against a throwaway container as well as a full migrated database, and
+// it cleans up every row it writes.
+
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`copy_desk_flags_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// --- fixtures -------------------------------------------------------------
+// Minimal stand-ins ONLY if the real tables are absent (throwaway container).
+// Against a fully migrated DB these are no-ops and the real tables are used.
+await pool.query(`
+  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
+  CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text, display_name text);
+  CREATE TABLE IF NOT EXISTS tasks (id bigserial PRIMARY KEY);
+`);
+
+// Two throwaway builders + one task, at ids far above any real row.
+const A = 900000001;
+const B = 900000002;
+const T = 900000003;
+await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES ($1,$2,$3),($4,$5,$6) ON CONFLICT (id) DO NOTHING',
+  [A, 'cdtest-a', 'Copy Desk Test A', B, 'cdtest-b', 'Copy Desk Test B']);
+await pool.query('INSERT INTO tasks (id) VALUES ($1) ON CONFLICT (id) DO NOTHING', [T]);
+
+// Apply the migration verbatim — this also proves it is idempotent, since a
+// migrated DB has already run it.
+const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/copy-desk/migrations/copy_desk_001_flags.sql'), 'utf8');
+await pool.query(MIGRATION);
+
+// Every row this test writes carries a surface nothing else uses, so cleanup is
+// exact and it can never delete a real flag.
+const SURF = '__copy_desk_test__';
+const clean = () => pool.query('DELETE FROM copy_desk_flags WHERE surface = $1', [SURF]);
+await clean();
+
+const REASON = 'Reads like a stack trace, not a sentence a person would say.';
+// `string_id` uses an `in` check, not `??` — an explicit null is the POINT of
+// several cases below, and `??` would silently substitute the default.
+function ins(o = {}) {
+  return pool.query(
+    `INSERT INTO copy_desk_flags
+       (scope, surface, string_id, reason, kind, text_at_flag, file_at_flag, line_at_flag, registry_schema, flagged_by)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10) RETURNING *`,
+    [o.scope ?? 'string', SURF, ('string_id' in o ? o.string_id : 'abc123'), o.reason ?? REASON,
+      o.kind ?? 'other', 'Could not save.', 'a.js', 1, 1, o.by ?? A]
+  );
+}
+
+console.log('copy_desk_flags — the constraints hold in Postgres, not just in JS');
+
+await test('the migration is idempotent (re-running is clean)', async () => {
+  await pool.query(MIGRATION);
+});
+
+await test('a well-formed flag inserts and defaults to open + unstamped', async () => {
+  const { rows } = await ins();
+  assert.equal(rows[0].status, 'open');
+  assert.equal(rows[0].resolved_at, null);
+  assert.equal(rows[0].resolved_by, null);
+  assert.ok(rows[0].flagged_at);
+});
+
+await test('THE REASON FLOOR fires in the DB, not only in the route', async () => {
+  await assert.rejects(() => ins({ reason: 'bad', string_id: 'r1' }), (e) => e.code === '23514');
+});
+
+await test('a whitespace-only reason is refused (btrim in the CHECK)', async () => {
+  await assert.rejects(() => ins({ reason: '              ', string_id: 'r2' }), (e) => e.code === '23514');
+});
+
+await test("scope 'string' with a NULL string_id is refused — it points nowhere", async () => {
+  await assert.rejects(() => ins({ scope: 'string', string_id: null }), (e) => e.code === '23514');
+});
+
+await test("scope 'surface' WITH a string_id is refused — it would be silently narrower than it claims", async () => {
+  await assert.rejects(() => ins({ scope: 'surface', string_id: 'x1' }), (e) => e.code === '23514');
+});
+
+await test("scope 'surface' with a NULL string_id inserts", async () => {
+  const { rows } = await ins({ scope: 'surface', string_id: null, by: B });
+  assert.equal(rows[0].scope, 'surface');
+  assert.equal(rows[0].string_id, null);
+});
+
+await test('an unknown kind is refused', async () => {
+  await assert.rejects(() => ins({ kind: 'vibes', string_id: 'k1' }), (e) => e.code === '23514');
+});
+
+await test('THE PARTIAL UNIQUE INDEX: the same builder on the same target twice → 23505', async () => {
+  await ins({ string_id: 'dup-target', by: A });
+  await assert.rejects(() => ins({ string_id: 'dup-target', by: A }), (e) => e.code === '23505');
+});
+
+await test('a DIFFERENT builder may flag the same target — that agreement is signal', async () => {
+  const { rows } = await ins({ string_id: 'dup-target', by: B });
+  assert.ok(rows[0].id);
+});
+
+await test('the guarded close stamps exactly one row', async () => {
+  const { rows: [f] } = await ins({ string_id: 'close-me', by: A });
+  const upd = await pool.query(
+    `UPDATE copy_desk_flags SET status=$2, resolution_note=$3, resolved_task_id=$4, resolved_by=$5, resolved_at=now()
+      WHERE id=$1 AND status='open' RETURNING *`,
+    [f.id, 'resolved', 'Rewritten in the ship below.', T, B]);
+  assert.equal(upd.rowCount, 1);
+  assert.equal(upd.rows[0].status, 'resolved');
+  assert.equal(String(upd.rows[0].resolved_task_id), String(T));
+  assert.ok(upd.rows[0].resolved_at);
+});
+
+await test('A SECOND CLOSE LOSES THE RACE — 0 rows, never an overwrite of the first verdict', async () => {
+  const { rows: [f] } = await ins({ string_id: 'race', by: A });
+  const first = await pool.query(
+    `UPDATE copy_desk_flags SET status='resolved', resolution_note='first verdict stands', resolved_by=$2, resolved_at=now()
+      WHERE id=$1 AND status='open' RETURNING *`, [f.id, A]);
+  const second = await pool.query(
+    `UPDATE copy_desk_flags SET status='dismissed', resolution_note='second must not win', resolved_by=$2, resolved_at=now()
+      WHERE id=$1 AND status='open' RETURNING *`, [f.id, B]);
+  assert.equal(first.rowCount, 1);
+  assert.equal(second.rowCount, 0);
+  const { rows } = await pool.query('SELECT resolution_note FROM copy_desk_flags WHERE id=$1', [f.id]);
+  assert.equal(rows[0].resolution_note, 'first verdict stands');
+});
+
+await test('after a close, the SAME builder may flag that target again (the index is partial)', async () => {
+  const { rows } = await ins({ string_id: 'close-me', by: A });
+  assert.ok(rows[0].id, 'a sentence that regresses must be re-flaggable by the person who caught it before');
+});
+
+await test('a closed row with no resolved_at is refused — "resolved by nobody at no time" is impossible', async () => {
+  const { rows: [f] } = await ins({ string_id: 'halfclosed', by: A });
+  await assert.rejects(
+    () => pool.query("UPDATE copy_desk_flags SET status='resolved' WHERE id=$1", [f.id]),
+    (e) => e.code === '23514');
+});
+
+await test('THE FK: a nonexistent resolved_task_id raises 23503 — the route\'s named 400', async () => {
+  const { rows: [f] } = await ins({ string_id: 'fk-test', by: A });
+  await assert.rejects(
+    () => pool.query(
+      `UPDATE copy_desk_flags SET status='resolved', resolution_note='names a task that does not exist',
+              resolved_by=$2, resolved_at=now(), resolved_task_id=999999999 WHERE id=$1`, [f.id, A]),
+    (e) => e.code === '23503');
+});
+
+console.log("\nthe module's own SQL functions (flags.js), not hand-written queries");
+
+// Point the doorway's shared pool at THIS connection so flags.js runs its real
+// queries against the test database.
+const api = require(path.join(ROOT, 'src/module-api.js'));
+api.pool.query = (...a) => pool.query(...a);
+const flagsLib = require(path.join(ROOT, 'modules/copy-desk/flags.js'));
+
+await test('insertFlag writes and projects the full row shape', async () => {
+  const row = await flagsLib.insertFlag({
+    scope: 'string', surface: SURF, string_id: 'lib-1', reason: 'Says nothing a reader can act on.',
+    kind: 'unclear', text_at_flag: 'Enter.', file_at_flag: 'i.html', line_at_flag: 4, registry_schema: 1,
+  }, A);
+  assert.equal(row.status, 'open');
+  assert.equal(row.kind, 'unclear');
+  assert.equal(row.string_id, 'lib-1');
+  assert.ok('resolution_note' in row, 'the RETURNING projection matches the read projection');
+});
+
+await test('listFlags resolves the flagger join and sorts open ahead of closed', async () => {
+  const rows = await flagsLib.listFlags({ status: 'all', surface: SURF });
+  assert.ok(rows.length > 0);
+  assert.ok(rows.some((r) => r.flagged_by_login === 'cdtest-a'), 'the builders join resolves a display name');
+  const firstClosed = rows.findIndex((r) => r.status !== 'open');
+  if (firstClosed !== -1) {
+    assert.ok(rows.slice(firstClosed).every((r) => r.status !== 'open'), 'open rows sort ahead of closed ones');
+  }
+});
+
+await test('listFlags honours the status + surface filters', async () => {
+  const open = await flagsLib.listFlags({ status: 'open', surface: SURF });
+  assert.ok(open.length > 0);
+  assert.ok(open.every((r) => r.status === 'open' && r.surface === SURF));
+});
+
+await test('closeFlag returns null on a second call — the route answers 409 from that', async () => {
+  const row = await flagsLib.insertFlag({
+    scope: 'string', surface: SURF, string_id: 'lib-close', reason: 'Off voice for the front door.',
+    kind: 'off-voice', text_at_flag: 'x', file_at_flag: 'i.html', line_at_flag: 9, registry_schema: 1,
+  }, B);
+  const first = await flagsLib.closeFlag(row.id, { status: 'dismissed', resolution_note: 'Deliberate house style.', resolved_task_id: null }, A);
+  assert.ok(first, 'the first close returns the row');
+  const second = await flagsLib.closeFlag(row.id, { status: 'resolved', resolution_note: 'must not win', resolved_task_id: null }, B);
+  assert.equal(second, null);
+});
+
+// --- cleanup --------------------------------------------------------------
+await clean();
+await pool.query('DELETE FROM builders WHERE id = ANY($1)', [[A, B]]).catch(() => {});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+await pool.end();
+process.exit(failed ? 1 : 0);

package/tests/hall_nav.mjs

@@ -131,7 +131,13 @@ test('sidebar groups read by audience, in order', () => {
   // naming the top rank was wrong), then → 'Government' by ADR 0174: a header
   // reading "Archon" over items a Metic can open would misdescribe the ladder.
   assert.deepEqual(nav.map((g) => g.label), ['', 'You', 'Community', 'Docs', 'Government']);
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work'],
+  // task 1003113 (R02 of goal 1000074): 'copy-desk' joins the unlabeled group,
+  // after Tasks. It belongs with the project's own work and not in Docs — it is a
+  // QUEUE somebody acts on, not reference material — and not in You or Community,
+  // whose subject is a person rather than the product. Deliberate addition to
+  // this oracle: the group is pinned exactly so a new tab in the hall's most
+  // valuable nav real estate is a reviewed decision, not a drift.
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'copy-desk'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.

package/tests/module_loader.mjs

@@ -173,7 +173,10 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // configurable roles/permissions module; and agents (ADR 0083 / goal 1000038) the
   // declarative agent registry — the first module to ship default:false, which is
   // why it is DISCOVERED here (discovery is enablement-independent) while staying
-  // off in enabledModules(). All are discovered; none has validation
+  // off in enabledModules(). And copy-desk (task 1003113 / R02 of goal 1000074) —
+  // the copy half of the design contract: the flag + the artist's queue over
+  // user-facing text, default-on because every instance shows a person words.
+  // All are discovered; none has validation
   // errors or coreVersion mismatches. Order is the readdir sort.
   //
   // NB this is the CORE package tree: game / art-pipeline / character-anim / demo are
@@ -197,7 +200,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/publish_manifest.mjs

@@ -15,7 +15,15 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+// fs/path/ROOT serve the disk-DERIVED guards at the bottom of this file (task
+// 1003132). They must read the tree rather than a list: an enumerated assertion
+// would miss the next unclassified module exactly as the enumerated allowlist
+// missed the one that prompted them.
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
 
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
 const m = require('../scripts/gds/publish-manifest.js');
 const {
@@ -179,6 +187,80 @@ t('every PROTECTED_GLOB is either topology-excluded or publishable (the methodol
     assert.ok(isPublishable(g), `protected surface "${g}" is neither denied nor publishable — re-decide the carve-out`);
   }
 });
+// ── the publish question, asked of the tree itself (task 1003132) ───────────────────
+//
+// THE GAP THESE CLOSE. modules/copy-desk/ was designed, built, tested against a real
+// Postgres, graded, merged and very nearly RELEASED while publishing nothing. Not one
+// of the 429 unit tests, 20+ fitness checks, or the adversarial grader asks the publish
+// question, and the assertions above enumerate representative paths — so a brand-new
+// module key appears in no list and is simply invisible.
+//
+// The failure is worse than "the feature does not ship", because it is ASYMMETRIC: the
+// module's hall page ships anyway (modules/hall-ui/ is one allowlisted subtree), so a
+// release delivers a nav tab and a page whose every API call 404s.
+//
+// Both guards DERIVE from disk. A list here would rot the same way the allowlist did.
+//
+// Modules deliberately not published, on the record. An entry here is a decision
+// someone made, not a gap someone forgot — and every entry needs the task or idea that
+// records the decision, so this can never become a quiet parking lot.
+const KNOWN_UNPUBLISHED_MODULES = new Map([
+  // Same gap as copy-desk, found by the guard below the moment it was written. LATENT
+  // rather than live only because agents is default:false — the day a released instance
+  // enables it, the loader MODULE_NOT_FOUNDs, which is exactly what the provisioning
+  // (task 2135) and platform-identity (task 1002235) allowlist entries exist to prevent.
+  // Left for goal 1000038 rather than fixed here: deciding what the published core
+  // contains for the agents module is that goal's call, not a drive-by from a copy-desk
+  // task. Filed as idea 1000797 with the one-line fix.
+  ['agents', 'idea 1000797'],
+]);
+
+t('every module on disk is either publishable or deliberately unpublished (a new module cannot be silently invisible)', () => {
+  const modulesDir = path.join(ROOT, 'modules');
+  const keys = fs.readdirSync(modulesDir, { withFileTypes: true })
+    .filter((d) => d.isDirectory() && fs.existsSync(path.join(modulesDir, d.name, 'module.json')))
+    .map((d) => d.name);
+  assert.ok(keys.length > 5, `sanity: only ${keys.length} modules found on disk — the scan is broken, not the tree`);
+
+  const unclassified = keys.filter((k) => {
+    const manifest = `modules/${k}/module.json`;
+    return !isPublishable(manifest) && !matchesDeny(manifest) && !KNOWN_UNPUBLISHED_MODULES.has(k);
+  });
+  assert.deepEqual(unclassified, [],
+    'these modules are in neither the allowlist nor a deny list, so they publish NOTHING. Add each to PUBLISH_ALLOWLIST, deny it on the record, or register it in KNOWN_UNPUBLISHED_MODULES with the task that decided it.');
+});
+
+t('every KNOWN_UNPUBLISHED_MODULES entry names a real module and a real decision', () => {
+  // Two ways this exception list rots: an entry outlives the module (and silently
+  // exempts nothing), or an entry outlives the fix (and silently exempts something
+  // already fixed). Both make the guard above weaker than it looks.
+  for (const [key, ref] of KNOWN_UNPUBLISHED_MODULES) {
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', key, 'module.json')),
+      `KNOWN_UNPUBLISHED_MODULES names "${key}", which is not a module on disk — drop the entry`);
+    assert.ok(/\b(task|idea)\s+\d+/.test(ref),
+      `KNOWN_UNPUBLISHED_MODULES["${key}"] must cite the task or idea that decided it, got "${ref}"`);
+    assert.equal(isPublishable(`modules/${key}/module.json`), false,
+      `"${key}" is now publishable — delete its KNOWN_UNPUBLISHED_MODULES entry so the guard covers it again`);
+  }
+});
+
+t('a hall page named for a module ships only if that module ships (never a tab whose API 404s)', () => {
+  const hallDir = path.join(ROOT, 'modules/hall-ui/public');
+  const modulesDir = path.join(ROOT, 'modules');
+  if (!fs.existsSync(hallDir)) return;
+  const orphans = [];
+  for (const f of fs.readdirSync(hallDir)) {
+    if (!f.endsWith('.html')) continue;
+    const key = f.replace(/\.html$/, '');
+    // Only pages that NAME a module are paired — the hall's own pages (work, goals,
+    // settings…) have no module and are not the subject of this rule.
+    if (!fs.existsSync(path.join(modulesDir, key, 'module.json'))) continue;
+    if (!isPublishable(`modules/${key}/module.json`)) orphans.push(f);
+  }
+  assert.deepEqual(orphans, [],
+    'these hall pages would ship to instances whose backing module does not — a nav tab and a page whose every call 404s. Publish the module, or stop publishing the page.');
+});
+
 t('the topology subset of the protected surfaces is never publishable', () => {
   for (const g of PROTECTED_TOPOLOGY_EXCLUDE) {
     assert.equal(isPublishable(g), false, `topology surface "${g}" must not publish`);