@bongos/core 1.19.262 → 1.19.264

package/modules/hall-ui/public/goals-page.js

@@ -23,6 +23,14 @@
 (function () {
   'use strict';
   const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+  // Shared task-domain helpers (task 1002463). These lived in two copies here and
+  // in the other board and had already drifted — goals-page.js had silently lost
+  // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
+  // below reads exactly as before; the single copy lives in task-lib.js.
+  const {
+    priorityRank, touchesConflict, rankTagHtml, deHashRefs,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  } = window.OTBTaskLib;
   // Shared component kit (hall-kit.js, task 2166): pager, filter bar, tabs,
   // empty/skeleton states — adopted here by task 2171.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar,
@@ -497,40 +505,10 @@
   // ===================================================================
 
   // Board-identical numeric helpers (work.js:214-240).
-  function creditsPerMinute(t) {
-    const c = Number(t.credits_reward); const m = Number(t.est_minutes);
-    if (!c || !m || m <= 0) return -Infinity;
-    return c / m;
-  }
-  function priorityRank(p) {
-    if (!p) return 99;
-    const m = /^P(\d+)/i.exec(String(p));
-    return m ? Number(m[1]) : 99;
-  }
   // Two tasks can't run in parallel if their touches[] overlap (exact path or a
   // directory-prefix either way); empty touches never conflict. Powers the
   // filter bar's "Run mode" control (work.js:230-239).
-  function touchesConflict(aList, bList) {
-    const norm = (p) => String(p).replace(/\/+$/, '');
-    for (const a of (Array.isArray(aList) ? aList : [])) {
-      const na = norm(a);
-      for (const b of (Array.isArray(bList) ? bList : [])) {
-        const nb = norm(b);
-        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
-      }
-    }
-    return false;
-  }
   // Per-task rank floor tag (work.js:247-254).
-  function rankTagHtml(requiresRank) {
-    const rr = (requiresRank || 'xenos').toLowerCase();
-    if (rr === 'xenos') {
-      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
-    }
-    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
-    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${escapeHtml(label)}</span>`;
-  }
-
   // Free-text search over the goal's todo list (work.js:261-274, minus the
   // goal-title match — a single goal makes that redundant).
   function todoSearchQuery() {
@@ -548,21 +526,6 @@
 
   // Copy-prompt (work.js:454-503). deHashRefs stops a bare #NNN autolinking to
   // GitHub in a pasted session; the prompt points the builder at the hall task URL.
-  function deHashRefs(text) {
-    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-  }
-  function buildPromptForTask(t) {
-    const desc = deHashRefs((t.description || '').trim());
-    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
-    const hallUrl = `${hallBase}#/task/${t.id}`;
-    return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
-      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
-      ``,
-      `Task description:`,
-      desc || '(no description)',
-    ].join('\n');
-  }
   async function copyPromptForTask(taskId, btn) {
     const t = state.work.todo.find((x) => String(x.id) === String(taskId));
     if (!t) return;
@@ -697,21 +660,6 @@
     }
   }
   // A single batch-item failure reason → a readable fragment (work.js:545-562).
-  function friendlyBatchReason(item) {
-    switch (item && item.reason) {
-      case 'TASK_NOT_FOUND': return 'no longer exists';
-      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
-      case 'ALREADY_CLAIMED': return 'already claimed';
-      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
-      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
-      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'rank too low';
-      case 'BUILDER_INACTIVE': return 'account inactive';
-      default: return (item && item.reason) || 'not claimable';
-    }
-  }
   // Bulk claim the selected ready cards (work.js doBulkClaim, claims/batch is
   // all-or-nothing: a 409 batch_failed means nothing was claimed). Reloads the
   // goal's tasks either way so the cards reflect fresh truth.

package/modules/hall-ui/public/goals.html

@@ -194,6 +194,8 @@
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- shared component kit (window.OTBKit) — pager, filter bar, tabs, empty/skeleton (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
+<!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
+<script src="/builders/task-lib.js"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
 <script src="/builders/goals-page.js?v=2026-07-10-goals5"></script>

package/modules/hall-ui/public/task-lib.js

@@ -0,0 +1,136 @@
+// modules/hall-ui/public/task-lib.js — the hall's shared TASK-DOMAIN helpers
+// (task 1002463, from idea 1000567).
+//
+// WHY A SIBLING OF hall-kit.js RATHER THAN PART OF IT. hall-kit.js is explicitly
+// "the SIX primitives every page redesign adopts" — pager, ledger, filter bar,
+// tabs, section rail, empty/skeleton/collapsible. Those are UI *markup* factories,
+// and modules/hall-ui/CLAUDE.md's "no bespoke pager / filter / tab / rail markup"
+// rule is scoped to exactly that. The functions below are task-DOMAIN logic
+// (how a task is ranked, whether two touches[] collide, what a refusal means in
+// English). Folding them into the kit would blur a contract that is currently
+// crisp, so they get their own namespace instead.
+//
+// Contract, mirrored from hall-kit.js so load order only needs "before the page
+// script": dependency-free (own esc(), no window.OTB use), no eval-time DOM, and
+// everything hangs off one global. Node-require-safe so it can be unit-tested.
+//
+// WHAT THIS FIXES. Before extraction these lived in TWO copies (work.js and
+// goals-page.js) and had already drifted: goals-page.js's friendlyBatchReason had
+// silently lost the MODULE_CONFLICT case that work.js handles, so a batch-claim
+// refused for a module collision showed the raw code "MODULE_CONFLICT" to the
+// builder on the Goals page and a sentence on the Tasks board. One copy, one
+// behaviour, and the drift cannot re-open.
+(() => {
+  'use strict';
+
+  // Local HTML-escape — deliberately NOT window.OTB.escapeHtml, so this file
+  // keeps hall-kit's dependency-free property (same reasoning, same duplication
+  // of ~4 lines being cheaper than a load-order constraint).
+  function esc(s) {
+    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
+      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+    }[c]));
+  }
+
+  // Sort key for a "P3"-style priority string. Unparseable/absent sorts last.
+  function priorityRank(p) {
+    if (!p) return 99;
+    const m = /^P(\d+)/i.exec(String(p));
+    return m ? Number(m[1]) : 99;
+  }
+
+  // Do two touches[] lists collide? A path collides with itself and with anything
+  // under it, so "src/" conflicts with "src/gds/db.js". Trailing slashes are
+  // normalised first so "src" and "src/" are the same path.
+  function touchesConflict(aList, bList) {
+    const norm = (p) => String(p).replace(/\/+$/, '');
+    for (const a of (Array.isArray(aList) ? aList : [])) {
+      const na = norm(a);
+      for (const b of (Array.isArray(bList) ? bList : [])) {
+        const nb = norm(b);
+        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
+      }
+    }
+    return false;
+  }
+
+  // The rank-floor chip. 'xenos' means no floor at all, which reads as an
+  // invitation ("Any rank") rather than a restriction.
+  function rankTagHtml(requiresRank) {
+    const rr = (requiresRank || 'xenos').toLowerCase();
+    if (rr === 'xenos') {
+      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
+    }
+    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
+    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${esc(label)}</span>`;
+  }
+
+  // Strip bare "#NNN" GDS refs from prose we are about to paste elsewhere: on
+  // GitHub a bare #NNN autolinks to an ISSUE, and our ids are not GitHub's, so
+  // the link 404s. (Same rule the repo enforces in committed markdown.)
+  // VERBATIM from the two originals — do not "tidy" either detail:
+  //  • `\d{1,5}` (not `\d+`) is load-bearing by omission: a 6+ digit run never
+  //    matches at all, so long numerics are left untouched rather than rewritten.
+  //  • `text == null ? '' : text` (not `text || ''`) keeps falsy-but-real inputs:
+  //    deHashRefs(0) must render "0", not "". `|| ''` would swallow it.
+  // Both were silently changed in an earlier draft of this extraction and the
+  // regression escaped an equivalence pass whose inputs were all strings/null.
+  function deHashRefs(text) {
+    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
+  }
+
+  // Reward density, for the "best value" sort. -Infinity (not 0) for anything
+  // unpriced or unestimated so those sink below every real ratio instead of
+  // tying with a genuinely zero-value task.
+  function creditsPerMinute(t) {
+    const c = Number(t.credits_reward);
+    const m = Number(t.est_minutes);
+    if (!c || !m || m <= 0) return -Infinity;
+    return c / m;
+  }
+
+  // The paste-into-your-agent prompt for one task.
+  function buildPromptForTask(t) {
+    const desc = deHashRefs((t.description || '').trim());
+    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
+    const hallUrl = `${hallBase}#/task/${t.id}`;
+    return [
+      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
+      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
+      ``,
+      `Task description:`,
+      desc || '(no description)',
+    ].join('\n');
+  }
+
+  // Turn a batch-claim refusal into a sentence. THE DEFAULT MATTERS: an unmapped
+  // code falls through to the raw string, which is how the missing MODULE_CONFLICT
+  // case leaked a machine code into the Goals page UI. Adding a server-side reason
+  // without adding it here degrades quietly rather than loudly, so keep this in
+  // step with the claim route's refusal codes.
+  function friendlyBatchReason(item) {
+    switch (item && item.reason) {
+      case 'TASK_NOT_FOUND': return 'no longer exists';
+      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
+      case 'ALREADY_CLAIMED': return 'already claimed';
+      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
+      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
+      case 'MODULE_CONFLICT': return item.conflictsWithTaskId
+        ? `shares module "${item.module_key}" with task #${item.conflictsWithTaskId} in this selection`
+        : `shares module "${item.module_key}" with an active claim`;
+      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
+      case 'rank_too_low_for_task':
+      case 'XENOS_RESTRICTED':
+      case 'INSUFFICIENT_RANK': return 'rank too low';
+      case 'BUILDER_INACTIVE': return 'account inactive';
+      default: return (item && item.reason) || 'not claimable';
+    }
+  }
+
+  const api = {
+    priorityRank, touchesConflict, rankTagHtml, deHashRefs,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  };
+  if (typeof window !== 'undefined') window.OTBTaskLib = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/work.html

@@ -135,6 +135,8 @@
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- shared component kit (window.OTBKit) — tabs, pager, filter bar (task 2166). -->
 <script src="/builders/hall-kit.js" defer></script>
+<!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
+<script src="/builders/task-lib.js" defer></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/work.js?v=2026-07-03-workboard3" defer></script>

package/modules/hall-ui/public/work.js

@@ -36,6 +36,14 @@
   // file's exact variants (date-only fmtDate; a 2200ms clearing toast).
   // fmtAgo / toAuth / getJSON / postJSON stay local below.
   const { escapeHtml, $, fmtNum } = window.OTB;
+  // Shared task-domain helpers (task 1002463). These lived in two copies here and
+  // in the other board and had already drifted — goals-page.js had silently lost
+  // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
+  // below reads exactly as before; the single copy lives in task-lib.js.
+  const {
+    priorityRank, touchesConflict, rankTagHtml,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  } = window.OTBTaskLib;   // deHashRefs is not called here — it is used inside buildPromptForTask
   // Shared component kit (hall-kit.js, task 2166): tabs, pager, filter bar.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar } = window.OTBKit;
   const fmtDate = (iso) => window.OTB.fmtDate(iso);
@@ -211,48 +219,14 @@
   const sequentialCache = { key: '', order: null };
   let sequentialDebounce = null;
 
-  function creditsPerMinute(t) {
-    const c = Number(t.credits_reward);
-    const m = Number(t.est_minutes);
-    if (!c || !m || m <= 0) return -Infinity;
-    return c / m;
-  }
-
-  function priorityRank(p) {
-    if (!p) return 99;
-    const m = /^P(\d+)/i.exec(String(p));
-    return m ? Number(m[1]) : 99;
-  }
-
   // task 1756: two tasks can't run in parallel if their touches[] overlap — exact
   // path match or a directory-prefix either way (mirrors the server's touchesOverlap
   // / the goals-page conflict estimate). Empty touches never conflict.
-  function touchesConflict(aList, bList) {
-    const norm = (p) => String(p).replace(/\/+$/, '');
-    for (const a of (Array.isArray(aList) ? aList : [])) {
-      const na = norm(a);
-      for (const b of (Array.isArray(bList) ? bList : [])) {
-        const nb = norm(b);
-        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
-      }
-    }
-    return false;
-  }
-
   // task 1752 (+ 1498 / ADR 0084): the minimum rank to claim a task, as a tag shown
   // on EVERY task row. 'xenos' is the open default → a muted "Any rank" tag (open to
   // all, not a warning); 'archon' shows bare; other ranks show 'Rank+'. Kept here for
   // now; the shared task-detail view (task 1753) will lift this into the common
   // toolkit so every task surface renders rank identically.
-  function rankTagHtml(requiresRank) {
-    const rr = (requiresRank || 'xenos').toLowerCase();
-    if (rr === 'xenos') {
-      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
-    }
-    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
-    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${escapeHtml(label)}</span>`;
-  }
-
   // task 1829: free-text search over the claimable/backlog lists. Matches the
   // query (case-insensitive substring) against the task id (with or without a
   // leading '#'), the title, and the goal title (taskState.goalTitles — the
@@ -455,23 +429,6 @@
   // our records number tasks separately from GitHub. So the scroll we hand the
   // builder must never carry a bare "#NNN": write "task NNN" + the clickable hall
   // URL, and strip "#NNN" out of the (free-text) task description too.
-  function deHashRefs(text) {
-    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-  }
-
-  function buildPromptForTask(t) {
-    const desc = deHashRefs((t.description || '').trim());
-    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
-    const hallUrl = `${hallBase}#/task/${t.id}`;
-    return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
-      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
-      ``,
-      `Task description:`,
-      desc || '(no description)',
-    ].join('\n');
-  }
-
   async function copyPromptForTask(taskId, btn) {
     const t = taskState.all.find((x) => String(x.id) === String(taskId));
     if (!t) return;
@@ -546,25 +503,6 @@
   // /claims/batch/validate) to a builder-readable fragment. Distinct from
   // friendlyActionError above because a batch item's shape differs (reason,
   // not error; extra fields like conflictsWithTaskId/module_key).
-  function friendlyBatchReason(item) {
-    switch (item && item.reason) {
-      case 'TASK_NOT_FOUND': return 'no longer exists';
-      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
-      case 'ALREADY_CLAIMED': return 'already claimed';
-      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
-      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
-      case 'MODULE_CONFLICT': return item.conflictsWithTaskId
-        ? `shares module "${item.module_key}" with task #${item.conflictsWithTaskId} in this selection`
-        : `shares module "${item.module_key}" with an active claim`;
-      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'rank too low';
-      case 'BUILDER_INACTIVE': return 'account inactive';
-      default: return (item && item.reason) || 'not claimable';
-    }
-  }
-
   async function copyText(text) {
     try { await navigator.clipboard.writeText(text); return true; }
     catch (_) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.262",
+  "version": "1.19.264",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.262",
+      "version": "1.19.264",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.262",
+  "version": "1.19.264",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -729,7 +729,7 @@ async function uploadSessionOnShip(taskId) {
       recordUploadSkip(taskId, {
         code: `http_${r.status}`,
         reason:
-          `POST /api/gds/sessions returned ${r.status}${r.data && r.data.error ? ` (${r.data.error})` : ''} — ` +
+          `POST /api/gds/sessions returned ${r.status}${r.data && r.data.error ? ` (${apiErrorLine(r.data)})` : ''} — ` +
           'the API rejected or could not store the digest. This ship will NOT appear in the BFG session corpus.',
       });
     }
@@ -1268,7 +1268,7 @@ async function ciLandServer(taskId, branch, valueSummary) {
       id: taskId,
       body: { branch, head_sha: headSha, value_summary: valueSummary, bundle_b64: bundleB64 },
     });
-    if (r.status === 403 && r.data && r.data.error === 'box_scope') {
+    if (r.status === 403 && normalizeApiError(r.data).code === 'box_scope') {
       console.log('  ci-land: this session is BOX-SCOPED — run /builder-reauth (browser, no terminal) to mint a real session, then re-ship. Task stays at confirmed.');
       return landBailed('this CLI session is box-scoped', '/builder-reauth');
     }
@@ -3160,9 +3160,39 @@ function normalizeApiError(data) {
   return {
     code: isEnvelope ? errRaw.code : errRaw,
     message: isEnvelope ? errRaw.message : undefined,
+    // task 1002789: `details` is where the envelope carries the structured
+    // payload the flat shape used to put at the TOP level (claimWorktree,
+    // step/reason, floors). A site that reads `data.<field>` directly is
+    // reading a field that moved. Fall back to the body so a legacy flat
+    // response still resolves.
+    details: (isEnvelope && errRaw.details && typeof errRaw.details === 'object')
+      ? errRaw.details
+      : (data && typeof data === 'object' ? data : {}),
   };
 }
 
+// task 1002789: the ONE renderer for a failed API call on the ship path.
+// Every generic bail site used to hand the raw body to console.error (or
+// interpolate `data.error` into a template, which stringifies the ADR 0116
+// envelope object to the literal "[object Object]"). Both hide a fully
+// diagnosable server error: console.error's util.inspect stops at depth 2, so
+// the `details` that names WHICH git step failed prints as "[Object]".
+// Collapse the body to one readable line instead, whichever shape it is.
+// Pure + exported for tests/ship_error_shape.mjs.
+function apiErrorLine(data, status) {
+  const { code, message, details } = normalizeApiError(data);
+  const head = code
+    ? (message && message !== code ? `${code}: ${message}` : code)
+    : (message || (status ? `HTTP ${status}` : 'unknown error'));
+  // Only the small scalar fields — a details blob can carry a whole bundle.
+  const extras = Object.entries(details || {})
+    .filter(([k, v]) => k !== 'code' && k !== 'message' && k !== 'error'
+      && (typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean'))
+    .map(([k, v]) => `${k}: ${String(v).replace(/\s+/g, ' ').trim()}`);
+  const line = extras.length ? `${head} (${extras.join('; ')})` : head;
+  return status ? `${line} [HTTP ${status}]` : line;
+}
+
 // task 1002809: classify a FAILED post-land POST /tasks/<id>/ship. The merge
 // already succeeded, so the server may simply have landed the task first
 // (reconcile-on-read — task 1049 — or the ~5-min reconciler racing this call).
@@ -4068,13 +4098,14 @@ async function shipMain() {
     },
   });
   if (!r.ok) {
-    if (r.data?.error === 'CLAIM_SESSION_MISMATCH') {
-      const wt = r.data.claimWorktree;
+    const resolveErr = normalizeApiError(r.data);
+    if (resolveErr.code === 'CLAIM_SESSION_MISMATCH') {
+      const wt = resolveErr.details.claimWorktree;
       console.error(`This claim was created in a different session${wt ? ` (worktree: ${wt})` : ''}.`);
       console.error('You can only ship from the session that originally claimed this task.');
       console.error(`To force-release from this session: node scripts/gds/release.js ${taskId} --force`);
     } else {
-      console.error(`resolve failed (${r.status}):`, r.data);
+      console.error(`resolve failed: ${apiErrorLine(r.data, r.status)}`);
     }
     process.exit(1);
   }
@@ -4110,7 +4141,7 @@ async function shipMain() {
     // verify ran). --verified is a no-op for every other kind.
     const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
     if (!confirm.ok) {
-      if (confirm.status === 409 && confirm.data && confirm.data.error === 'verify_attestation_required') {
+      if (confirm.status === 409 && normalizeApiError(confirm.data).code === 'verify_attestation_required') {
         console.error('');
         console.error(`This is a VERIFICATION task — it won't confirm until you attest the verify actually passed.`);
         console.error(`Run the verification, then re-ship with --verified:`);
@@ -4139,7 +4170,7 @@ async function shipMain() {
         console.error(`  task.confirm.grade_bypass${floorNote} to POST /api/gds/tasks/${taskId}/confirm.`);
         process.exit(1);
       }
-      console.error(`manual-confirm failed (${confirm.status}):`, confirm.data);
+      console.error(`manual-confirm failed: ${apiErrorLine(confirm.data, confirm.status)}`);
       process.exit(1);
     }
     postGradeStatus = confirm.data.taskStatus;
@@ -4490,6 +4521,9 @@ module.exports = {
   // 'pending' (success), not failure. Exported so the semantics are unit-tested.
   classifyLandOutcome,
   normalizeApiError,
+  // task 1002789: the single one-line renderer for a failed API call. Exported
+  // so the "[object Object]" regression is pinned against BOTH wire shapes.
+  apiErrorLine,
   postLandShipOutcome,
   // task 1718: pure poll-path decision — enable-failure polls the SERVER (not a
   // dead-end strand at confirmed), enable-success watches GitHub. Exported so the

package/src/module-api.js

@@ -951,8 +951,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.260 with no explicit bump. run 32295699354. (task 1002620)
 //   1.19.262 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.261 with no explicit bump. run 32298063660. (task 1002620)
+//   1.19.263 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.262 with no explicit bump. run 32305228786. (task 1002620)
+//   1.19.264 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.263 with no explicit bump. run 32396082154. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.262'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.264'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_criterion_confirm_ui.mjs

@@ -32,6 +32,11 @@ import { makeRunner } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-page.js'), 'utf8');
+// task 1002463: goals-page.js now pulls its task-domain helpers from the shared
+// window.OTBTaskLib (task-lib.js) instead of holding its own drifted copies. Run
+// the REAL file in the same context rather than stubbing it — stubbing would let
+// the extraction rot without this, the only test that executes either board.
+const TASK_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'), 'utf8');
 
 const { test, summary } = makeRunner();
 
@@ -126,6 +131,7 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(SRC, sandbox, { filename: 'goals-page.js' });
 
   // Let boot()'s promise chain settle (me → goals → details → route → render).