@bongos/core 1.19.374 → 1.19.376

package/modules/hall-ui/public/work.js

@@ -46,6 +46,45 @@
   } = window.OTBTaskLib;   // deHashRefs is not called here — it is used inside buildPromptForTask
   // Shared component kit (hall-kit.js, task 2166): tabs, pager, filter bar.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar } = window.OTBKit;
+  // task 1003278 — the shared staleness vocabulary + activity clock (task-lib.js,
+  // one definition for both tiers) and the creator axis.
+  const { taskActivityMs, STALE_CHOICES, isStale } = window.OTBTaskLib;
+  // task 1003278 — Creator and Age are SERVER-side axes: the board asks the feed
+  // a narrower question rather than downloading it and reducing it here. That is
+  // the criterion's explicit branch ("if it does, the new axes filter and page
+  // SERVER-side"), and it is why changing either control re-fetches instead of
+  // just re-rendering. Every other control stays client-side over what came
+  // back, exactly as before — those narrow an already-loaded page, this narrows
+  // what gets loaded.
+  // The Backlog group, BOUNDED and server-filtered. This read measured 690,625
+  // bytes for ~298 rows on 2026-08-25 and had no ceiling at all — it is
+  // `SELECT * FROM tasks WHERE status='backlog'`, so it grew with the project
+  // forever. Its own function because Creator/Age re-fetch it, same as the
+  // claimable feed. Best-effort: on failure the section stays as it was.
+  function loadBacklog() {
+    const q = serverFilterQuery().replace(/^\?/, '&');
+    return getJSON(`${API}/tasks?status=backlog&limit=${BACKLOG_LIMIT}${q}`)
+      .then((r) => { taskState.backlog = r.tasks || []; renderBacklog(taskState.backlog); })
+      .catch(() => { /* backlog stays as it was */ });
+  }
+
+  // The last server-facing filter query we actually fetched with. Compared on
+  // every filter change to decide re-fetch vs re-render.
+  let lastServerFilterQuery = '';
+
+  function serverFilterQuery() {
+    const parts = [];
+    const creator = $('#f-creator') ? $('#f-creator').value : '';
+    const stale = $('#f-stale') ? $('#f-stale').value : '';
+    if (creator) parts.push(`created_by=${encodeURIComponent(creator === '__none__' ? 'none' : creator)}`);
+    if (stale) parts.push(`stale_days=${encodeURIComponent(stale)}`);
+    return parts.length ? `?${parts.join('&')}` : '';
+  }
+
+  // task 1003278 — the ceiling on the Backlog read. Comfortably above today's
+  // ~300 rows so nothing visibly changes now, and low enough that the page can
+  // never be asked to hold the whole table as the project grows.
+  const BACKLOG_LIMIT = 500;
   const fmtDate = (iso) => window.OTB.fmtDate(iso);
   const toast = (msg) => window.OTB.toast(msg, { duration: 2200, clear: true });
   const curLabel = (caps) => { const l = (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits'; return caps ? l.charAt(0).toUpperCase() + l.slice(1) : l; };
@@ -255,6 +294,11 @@
     const kFilter = $('#f-kind').value;
     const dFilter = $('#f-discipline').value;
     const nFilter = $('#f-newcomer') ? $('#f-newcomer').value : '';
+    // task 1003278 — creator + staleness. '__none__' on Creator isolates the
+    // unattributed (created before tasks.created_by existed, or by a system path)
+    // — the goals owner filter's 'system / unattributed' convention.
+    const cFilter = $('#f-creator') ? $('#f-creator').value : '';
+    const staleFilter = $('#f-stale') ? $('#f-stale').value : '';
     const sortBy = $('#f-sort').value;
     const sQuery = searchQuery();
 
@@ -267,6 +311,13 @@
       if (kFilter && t.kind !== kFilter) return false;
       if (dFilter && (t.discipline || 'unclassified') !== dFilter) return false;
       if (nFilter === 'yes' && !t.newcomer_friendly) return false;
+      // Creator + Age were applied by the SERVER (serverFilterQuery), so they are
+      // re-checked here only as a belt on a stale render — never as the primary
+      // filter. Re-applying them is cheap and keeps the view honest if a poll
+      // lands between a control change and its re-fetch.
+      if (cFilter === '__none__' && t.created_by != null) return false;
+      if (cFilter && cFilter !== '__none__' && String(t.created_by) !== cFilter) return false;
+      if (staleFilter && !isStale(taskActivityMs(t), staleFilter)) return false;
       return true;
     });
 
@@ -295,6 +346,10 @@
     } else if (sortBy === 'id') {
       // task 1830: sort by task number, ascending (lowest/oldest first).
       list = list.slice().sort((a, b) => Number(a.id) - Number(b.id));
+    } else if (sortBy === 'stale') {
+      // task 1003278: what is rotting — least-recently-touched first, on the
+      // shared activity clock (updated_at ∨ shipped_at, task-lib.js).
+      list = list.slice().sort((a, b) => taskActivityMs(a) - taskActivityMs(b));
     }
 
     const count = $('#claim-count');
@@ -405,6 +460,44 @@
     }
   }
 
+  // task 1003278: the Creator filter — options are the builders who created the
+  // tasks on the board (claimable + backlog), labelled via the directory the
+  // goals page also reads (GET /builders/directory, best-effort — 'builder #id'
+  // until it lands). '__none__' isolates the unattributed: every task created
+  // before tasks.created_by existed (core_227 deliberately backfills nothing —
+  // a guessed attribution is a confident lie), plus system paths like the
+  // newcomer restock.
+  async function populateCreatorFilter() {
+    const sel = $('#f-creator');
+    if (!sel) return;
+    const rows = [...taskState.all, ...(taskState.backlog || [])];
+    const ids = [...new Set(rows.filter((t) => t.created_by != null).map((t) => String(t.created_by)))];
+    let byId = new Map();
+    if (ids.length) {
+      try {
+        const d = await getJSON(`${API}/builders/directory`);
+        byId = new Map((d.builders || []).map((b) => [String(b.id), b]));
+      } catch (_) { /* labels fall back to builder #id */ }
+    }
+    const label = (id) => {
+      const b = byId.get(id);
+      return b ? (b.display_name || '@' + b.github_login) : `builder #${id}`;
+    };
+    sel.length = 1; // keep the leading "— any —" option
+    for (const id of ids.sort((a, b) => label(a).localeCompare(label(b)))) {
+      const opt = document.createElement('option');
+      opt.value = id;
+      opt.textContent = label(id);
+      sel.appendChild(opt);
+    }
+    if (rows.some((t) => t.created_by == null)) {
+      const opt = document.createElement('option');
+      opt.value = '__none__';
+      opt.textContent = 'system / unattributed';
+      sel.appendChild(opt);
+    }
+  }
+
   // task 1755: the Goal filter — options are the goals present on the claimable
   // feed, labeled by title (falls back to 'Goal #id' before titles load).
   // '__none__' isolates ungoaled tasks. Populated once after the feed loads.
@@ -983,7 +1076,7 @@
   // the same way loadAll does so a transient failure doesn't blank the board.
   async function refreshLive() {
     try {
-      const claimResp = await getJSON(`${API}/tasks/claimable`);
+      const claimResp = await getJSON(`${API}/tasks/claimable${serverFilterQuery()}`);
       renderInFlight(claimResp.active_claims || []);
       taskState.all = claimResp.claimable || [];
       renderClaimable();
@@ -1072,9 +1165,7 @@
 
     // task 1754: the Backlog group — not-yet-ready tasks. Best-effort + independent
     // of the claimable feed; leaves the section hidden on failure.
-    getJSON(`${API}/tasks?status=backlog`)
-      .then((r) => { taskState.backlog = r.tasks || []; renderBacklog(taskState.backlog); })
-      .catch(() => { /* backlog stays hidden */ });
+    loadBacklog();
 
     // task 1755: goal id → title map for the Goal filter (best-effort).
     taskState.goalTitles = {};
@@ -1096,7 +1187,7 @@
     // empty-but-honest (the gate also blocks active_claims, so say so).
     try {
       const [claimResp, versionsResp] = await Promise.all([
-        getJSON(`${API}/tasks/claimable`),
+        getJSON(`${API}/tasks/claimable${serverFilterQuery()}`),
         getJSON(`${API}/versions`).catch(() => ({ versions: [] })),
       ]);
       taskState.versions = versionsResp.versions || [];
@@ -1106,6 +1197,7 @@
       taskState.all = claimResp.claimable || [];
       renderClaimable();
       populateGoalFilter(); // task 1755
+      populateCreatorFilter().catch(() => {}); // task 1003278 — fire-and-forget, the owner-filter posture
       // task 2170: a shared URL's goal filter can only apply once the options
       // exist — restore it now and re-render if it changed anything.
       if (restoreUrlFilter('f-goal')) renderClaimable();
@@ -1168,6 +1260,7 @@
             { value: 'minutes', label: 'minutes (low → high)' },
             { value: 'priority', label: 'priority (P0 first)' },
             { value: 'id', label: 'task number (low → high)' },
+            { value: 'stale', label: 'stalest first (untouched longest)' },
           ],
         },
         { id: 'f-version', label: 'Version', options: [{ value: '', label: '— any —' }] },
@@ -1191,6 +1284,11 @@
           label: 'Newcomer',
           options: [{ value: '', label: '— any —' }, { value: 'yes', label: 'newcomer-friendly only' }],
         },
+        // task 1003278 — Creator options fill after the feeds land
+        // (populateCreatorFilter, the f-goal pattern); staleness buckets are the
+        // shared STALE_CHOICES so both tiers offer the same lenses.
+        { id: 'f-creator', label: 'Creator', options: [{ value: '', label: '— any —' }] },
+        { id: 'f-stale', label: 'Age', options: STALE_CHOICES },
         {
           id: 'f-fit',
           label: 'Run mode',
@@ -1203,6 +1301,20 @@
       onChange: () => {
         pagers.ready.page = 1;
         pagers.backlog.page = 1;
+        // task 1003278 — Creator and Age are answered by the SERVER, so a change
+        // to either re-fetches a narrower feed instead of re-reducing the wide
+        // one. The test is whether the SERVER-FACING QUESTION changed, not which
+        // control fired: makeFilterBar's onChange is handed every value, not the
+        // changed id (hall-kit.js:269), and comparing the query is the direct
+        // question anyway — a control that does not appear in it can never cost
+        // a round-trip, which is what keeps the other filters instant.
+        const q = serverFilterQuery();
+        if (q !== lastServerFilterQuery) {
+          lastServerFilterQuery = q;
+          refreshLive();
+          loadBacklog();
+          return;
+        }
         renderClaimable();
         renderBacklog();
       },

package/modules/ideas/inbox.js

@@ -429,6 +429,10 @@ async function routeIdeaToGoal({
       // (db.findTaskBySourceRef): one idea can only ever mint one routed task.
       source: 'idea-route',
       sourceRef: `idea-${idea.id}`,
+      // task 1003278 — the filer created this task, via the route. capturedBy is
+      // already the authenticated filer's id (never body-supplied), so routing an
+      // idea attributes the task to the person whose idea it was.
+      createdBy: capturedBy ?? null,
     }, { client });
 
     // d. The lineage row — origin='route' (ideas_003 widened the CHECK for

package/modules/lifecycle/db-tasks.js

@@ -72,6 +72,11 @@ async function createTask({
   // (requiresRank stays null for the goal vector → derived purely from touches +
   // sensitivity), so goal_id never influences the requires_rank clamp.
   goalId = null,
+  // task 1003278: WHO created it — the builder id from the authenticated request.
+  // Nullable, appended at the end (the goals bind-order convention): a system
+  // path with no builder in the request (a seed, a migration backfill) passes
+  // nothing and the row honestly reads unattributed, never guessed.
+  createdBy = null,
 }, deps = {}) { // deps.client enlists this INSERT in the CALLER'S transaction (task 1003065, BV1.R01); the argument for it is at modules/ideas/inbox.js routeIdeaToGoal
   // task 1498 / ADR 0085: every task carries a deliberate rank floor. Derive it
   // from touches + sensitivity, then let an explicit requiresRank override only
@@ -112,12 +117,12 @@ async function createTask({
                         est_minutes, est_cost_usd, manual_degree, priority,
                         automation_tag, credits_reward, source, source_ref, value_summary,
                         kind, discipline, parallel_safe, newcomer_friendly, needs_migration,
-                        security_sensitive, requires_rank, module_key, goal_id, promoted_at)
+                        security_sensitive, requires_rank, module_key, goal_id, created_by, promoted_at)
      VALUES ($1, $2, $3, $4, $5,
              $6, $7, $8, $9,
              $10, $11, $12, $13, $14,
              $15, $16, $17, $18, $19,
-             $20, $21, $22, $23,
+             $20, $21, $22, $23, $24,
              CASE WHEN $4 IN ('ready','active') THEN now() ELSE NULL END)
      RETURNING *`,
     [
@@ -144,6 +149,7 @@ async function createTask({
       requiresRankEffective,
       moduleKey ?? null,
       goalIdEffective ?? null,
+      createdBy ?? null,
     ]
   );
   // task 1677 / ADR 0096: audit each creation-time auto-assignment so the trail is
@@ -473,7 +479,7 @@ async function getTask(id) {
 }
 
 
-async function listTasks({ versionId, status, kind, discipline, goalId } = {}) {
+async function listTasks({ versionId, status, kind, discipline, goalId, createdBy, staleDays, limit, offset } = {}) {
   const params = [];
   const where = [];
   if (versionId) {
@@ -496,13 +502,44 @@ async function listTasks({ versionId, status, kind, discipline, goalId } = {}) {
     params.push(goalId);
     where.push(`goal_id = $${params.length}`);
   }
+  // task 1003278 — the creator + staleness axes, server-side. They exist HERE and
+  // not only in the browser because the board was reducing the whole table to
+  // answer them: GET /tasks?status=backlog measured 690,625 bytes on 2026-08-25,
+  // and the Goals page's whole-version read 5.2 MB. `'none'` selects the
+  // unattributed (created before tasks.created_by existed, or by a system path) —
+  // the goals owner-filter convention, and a real question ("what has no owner").
+  if (createdBy === 'none') {
+    where.push('created_by IS NULL');
+  } else if (createdBy) {
+    params.push(createdBy);
+    where.push(`created_by = $${params.length}`);
+  }
+  // Untouched for N days, on the SAME clock the clients use: max(updated_at,
+  // shipped_at) — a ship path can stamp shipped_at without touching updated_at.
+  // A row with neither is stale by construction (GREATEST of two epochs), which
+  // matches isStale()'s treatment of an undated row: a row nobody can date is
+  // what a rot-hunt must not hide.
+  if (staleDays) {
+    params.push(staleDays);
+    where.push(
+      `GREATEST(COALESCE(updated_at, 'epoch'::timestamptz), COALESCE(shipped_at, 'epoch'::timestamptz))
+         <= now() - ($${params.length}::int * INTERVAL '1 day')`
+    );
+  }
   const sql =
     `SELECT t.*, ${CREDITS_AWARDED_SUBQUERY} AS credits_awarded,
             pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
        FROM tasks t` +
     (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
     ` ORDER BY priority NULLS LAST, created_at`;
-  const { rows } = await pool.query(sql, params);
+  // BOUND, not interpolated. Both call sites validate to a finite non-negative
+  // integer today, so string interpolation would not be exploitable — but a
+  // query builder that is only safe because of who happens to call it is one
+  // careless caller away from not being safe at all (raised in review).
+  let tail = '';
+  if (limit) { params.push(Number(limit)); tail += ` LIMIT $${params.length}`; }
+  if (offset) { params.push(Number(offset)); tail += ` OFFSET $${params.length}`; }
+  const { rows } = await pool.query(sql + tail, params);
   return rows;
 }
 
@@ -571,7 +608,7 @@ const SESSION_FIT_SQL = `
     END AS fits_session_modes
     FROM tasks t`;
 
-async function listClaimableTasks({ versionId = null, builderId = null, discipline = null, fit = null } = {}) {
+async function listClaimableTasks({ versionId = null, builderId = null, discipline = null, fit = null, createdBy = null, staleDays = null } = {}) {
   const params = [];
   const where = [];
   let goalJoin = '';
@@ -584,6 +621,25 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
     params.push(discipline);
     where.push(`v.discipline = $${params.length}`);
   }
+  // task 1003278 — the SAME creator + staleness axes GET /tasks offers, so the
+  // Work Board asks the server a narrow question instead of pulling the feed and
+  // reducing it in the browser. 'none' selects the unattributed; the staleness
+  // clock is max(updated_at, shipped_at), identical to listTasks, the rollup SQL
+  // and task-lib.js — four expressions of one rule, pinned against each other by
+  // tests/goal_sort_staleness.mjs.
+  if (createdBy === 'none') {
+    where.push('v.created_by IS NULL');
+  } else if (createdBy) {
+    params.push(createdBy);
+    where.push(`v.created_by = $${params.length}`);
+  }
+  if (staleDays) {
+    params.push(staleDays);
+    where.push(
+      `GREATEST(COALESCE(v.updated_at, 'epoch'::timestamptz), COALESCE(v.shipped_at, 'epoch'::timestamptz))
+         <= now() - ($${params.length}::int * INTERVAL '1 day')`
+    );
+  }
   if (builderId) {
     params.push(builderId);
     where.push(`NOT EXISTS (

package/modules/lifecycle/goal-rollup.js

@@ -0,0 +1,118 @@
+'use strict';
+
+// modules/lifecycle/goal-rollup.js — per-goal task rollups, computed in Postgres
+// instead of in the browser (task 1003278, goal 1000072, criterion
+// legibility-sort-and-staleness).
+//
+// THE MEASUREMENT THAT FORCED THIS. The Goals page derived each goal's readiness
+// counters, its last-activity timestamp and (task 1003278) its craft set by
+// FETCHING EVERY TASK IN THE VERSION — `GET /tasks?version=BONGOS-V1&include=deps`
+// — and reducing them client-side. On the real corpus that request is
+// **5,229,455 bytes for ~1,400 tasks**, measured 2026-08-25, to produce roughly
+// forty small counter objects. The criterion's own words: "~1,357 tasks on
+// BONGOS-V1 alone. A view that does not survive that number is not a solution."
+// It did not survive it; it merely did not fall over.
+//
+// So the reduction moves to where the rows already are. One query per version
+// returns one row per goal, and the payload stops scaling with the task count.
+//
+// THE BUCKETS ARE THE CLIENT'S, VERBATIM. goals-lib.js `readinessOf` is the
+// definition of record and this SQL mirrors it exactly — done (shipped |
+// confirmed | completed) · cut (abandoned | dropped, excluded from the total the
+// way migration 017 keeps them out of version_progress) · active · ready ·
+// blocked (backlog with >=1 unshipped dependency) · backlog. A divergence here
+// would show a person different numbers depending on which surface they opened,
+// so tests/goal_sort_staleness.mjs pins the two against each other.
+//
+// LAST ACTIVITY is `max(updated_at, shipped_at)` — the same "any task activity
+// counts" rule the client uses (task 1002965, the owner's call), now expressed
+// once in SQL and once in task-lib.js because the browser still needs it for
+// rows it holds itself.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+
+// The status vocabularies, kept beside the SQL that uses them so a reader can
+// check them against goals-lib.js in one glance.
+const DONE_STATUSES = ['shipped', 'confirmed', 'completed'];
+const CUT_STATUSES = ['abandoned', 'dropped'];
+
+// goalRollups — one row per goal that has at least one task in `versionId`.
+// Returns [{ goal_id, done, active, ready, blocked, backlog, cut, total,
+//            last_activity_at, disciplines[], next_ready_id, next_ready_title }].
+//
+// `blocked` needs the dependency edges, so the CTE resolves each backlog task's
+// unshipped-dependency count once rather than per row. deps.pool honors the #538
+// test seam (NODE_ENV==='test' only), like every other helper in this module.
+// VISIBILITY. A rollup is a COUNT, and counts on a private goal are not the
+// secret — its prose is (ADR 0112's leak rule: a non-member must not learn a
+// private goal's title or scope). But `next_ready_title` is a real task title
+// off a real goal, so this returns it ONLY to a member or an Archon. Everyone
+// else gets the counters and a null title: the board still renders the ring and
+// the readiness line, and the "Claim next" affordance simply has no name to show
+// — which is correct, because they cannot claim it either (task 1003137's
+// membership gate). Raised in review; the pre-existing GET /goals listing has
+// the same unfiltered shape, and tightening THAT is its own task, not something
+// to smuggle in here.
+async function goalRollups({ versionId = null, viewerId = null, viewerIsArchon = false } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `WITH scoped AS (
+       SELECT t.id, t.goal_id, t.status, t.title, t.priority, t.discipline,
+              GREATEST(COALESCE(t.updated_at, 'epoch'::timestamptz),
+                       COALESCE(t.shipped_at, 'epoch'::timestamptz)) AS activity_at,
+              EXISTS (
+                SELECT 1 FROM dependencies d
+                  JOIN tasks dep ON dep.id = d.to_id
+                 WHERE d.from_kind = 'task' AND d.from_id = t.id
+                   AND d.to_kind = 'task' AND dep.status <> 'shipped'
+              ) AS has_unshipped_dep
+         FROM tasks t
+        WHERE t.goal_id IS NOT NULL
+          AND ($1::text IS NULL OR t.version_id = $1)
+     ), bucketed AS (
+       SELECT s.*,
+              CASE
+                WHEN s.status = ANY($2::text[]) THEN 'done'
+                WHEN s.status = ANY($3::text[]) THEN 'cut'
+                WHEN s.status = 'active'  THEN 'active'
+                WHEN s.status = 'ready'   THEN 'ready'
+                WHEN s.status = 'backlog' AND s.has_unshipped_dep THEN 'blocked'
+                ELSE 'backlog'
+              END AS bucket
+         FROM scoped s
+     ), next_ready AS (
+       -- The goal's next claimable task, picked the way the board orders work:
+       -- priority first (NULLS LAST), then oldest id. DISTINCT ON gives one row
+       -- per goal without a second round trip.
+       SELECT DISTINCT ON (goal_id) goal_id, id, title
+         FROM bucketed
+        WHERE bucket = 'ready'
+        ORDER BY goal_id, priority NULLS LAST, id
+     )
+     SELECT b.goal_id::text                                          AS goal_id,
+            COUNT(*) FILTER (WHERE b.bucket = 'done')::int           AS done,
+            COUNT(*) FILTER (WHERE b.bucket = 'active')::int         AS active,
+            COUNT(*) FILTER (WHERE b.bucket = 'ready')::int          AS ready,
+            COUNT(*) FILTER (WHERE b.bucket = 'blocked')::int        AS blocked,
+            COUNT(*) FILTER (WHERE b.bucket = 'backlog')::int        AS backlog,
+            COUNT(*) FILTER (WHERE b.bucket = 'cut')::int            AS cut,
+            COUNT(*) FILTER (WHERE b.bucket <> 'cut')::int           AS total,
+            MAX(b.activity_at)                                       AS last_activity_at,
+            ARRAY_AGG(DISTINCT COALESCE(b.discipline, 'unclassified')) AS disciplines,
+            MAX(nr.id)::text                                         AS next_ready_id,
+            CASE WHEN bool_or(g.visibility IS DISTINCT FROM 'private')
+                   OR $4::boolean
+                   OR bool_or(gm.builder_id IS NOT NULL)
+                 THEN MAX(nr.title) END                              AS next_ready_title
+       FROM bucketed b
+       JOIN goals g ON g.id = b.goal_id
+       LEFT JOIN next_ready nr ON nr.goal_id = b.goal_id
+       LEFT JOIN goal_members gm ON gm.goal_id = b.goal_id AND gm.builder_id = $5::bigint
+      GROUP BY b.goal_id`,
+    [versionId, DONE_STATUSES, CUT_STATUSES, viewerIsArchon === true, viewerId]
+  );
+  return rows;
+}
+
+module.exports = { goalRollups, DONE_STATUSES, CUT_STATUSES };

package/modules/lifecycle/routes/goals.js

@@ -29,6 +29,7 @@ const hierarchy = require('../hierarchy');
 const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creation goal suggester
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
+const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const { suggestCriteria } = require('../criterion-suggest');
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
@@ -145,6 +146,29 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // GET /goals/rollups?version= — one small row per goal: readiness counters, the
+  // last-activity timestamp, the craft set, and the next claimable task
+  // (task 1003278). It replaces the Goals page's whole-version task fetch, which
+  // measured 5,229,455 bytes for ~1,400 tasks on 2026-08-25 to produce ~40 counter
+  // objects. Registered BEFORE /goals/:id or Express routes 'rollups' to the param.
+  // rank: any-builder — the same read as the goal board it feeds.
+  router.get('/goals/rollups', auth.requireBuilder, async (req, res) => {
+    try {
+      // The viewer decides whether a PRIVATE goal's next-ready task TITLE comes
+      // back (counters always do — a count is not the secret, the prose is;
+      // ADR 0112). Identity from the authenticated request, never the query.
+      const rollups = await goalRollup.goalRollups({
+        versionId: req.query.version || null,
+        viewerId: req.builder.id,
+        viewerIsArchon: req.builder.rank === 'archon',
+      });
+      return res.json({ rollups });
+    } catch (err) {
+      log.error('[gds] GET /goals/rollups', err);
+      return res.fail('rollups_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // GET /goals?version=&status= — list goals (read).
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {
@@ -1150,6 +1174,8 @@ module.exports = function buildGoalsRouter() {
         discipline,
         source: 'goal-authored',
         goalId: goal.id,
+        // task 1003278 — attribution from the authenticated request (never the body).
+        createdBy: req.builder.id,
       });
 
       // Attach the sub-task parent (validated above; attachParent re-checks the

package/modules/lifecycle/routes/task-write-routes.js

@@ -195,6 +195,9 @@ module.exports = function registerTaskWriteRoutes(router) {
         requiresRank: body.requires_rank ?? null,
         moduleKey: body.module_key ?? null,
         goalId: body.goal_id ?? null,
+        // task 1003278 — attribution, from the AUTHENTICATED request, never the
+        // body: who created a task is a fact about the caller, not an input.
+        createdBy: req.builder.id,
       });
       // task 438: link resolved criteria (source='planning' — task-create is the
       // planning vector). The ids were version-checked above, so this is a single

package/modules/lifecycle/routes/tasks.js

@@ -71,6 +71,25 @@ module.exports = function buildTasksRouter() {
   const router = express.Router();
 
   // rank: any-builder — reads (filtered task list); preserved per CRITICAL §4.
+  // task 1003278 — shared by GET /tasks and GET /tasks/claimable, so the two
+  // surfaces cannot drift on what a valid creator id or age window is. Returns
+  // undefined (absent), a number, or { bad } for the caller to turn into a 400.
+  const posInt = (raw, code, max) => {
+    if (raw === undefined || raw === '') return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0 || (max && n > max)) return { bad: code };
+    return n;
+  };
+  // 'none' is a REAL value here — the unattributed set ("what has no owner"), not
+  // a missing filter. Anything else must be a positive builder id.
+  function parseCreatedBy(raw) {
+    if (raw === undefined || raw === '') return undefined;
+    if (raw === 'none') return 'none';
+    const n = Number(raw);
+    return (Number.isInteger(n) && n > 0) ? n : { bad: 'bad_created_by' };
+  }
+  const CREATED_BY_MSG = "created_by must be a positive builder id, or 'none' for the unattributed.";
+
   router.get('/tasks', auth.requireBuilder, async (req, res) => {
     const { version, status, kind, discipline, goal_id } = req.query;
     if (kind && !VALID_KINDS.has(kind)) {
@@ -88,7 +107,25 @@ module.exports = function buildTasksRouter() {
         return res.fail('bad_goal_id', { status: 400, message: 'goal_id must be a positive integer.' });
       }
     }
-    const tasks = await db.listTasks({ versionId: version, status, kind, discipline, goalId });
+    // task 1003278 — created_by / stale_days / limit / offset, so a board can ask
+    // the server a narrow question instead of reducing the whole table in the
+    // browser. All four are optional; omitting them is exactly today's behaviour.
+    const { created_by: createdByRaw, stale_days: staleRaw, limit: limitRaw, offset: offsetRaw } = req.query;
+    const createdBy = parseCreatedBy(createdByRaw);
+    if (createdBy && createdBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
+    const staleDays = posInt(staleRaw, 'bad_stale_days', 3650);
+    if (staleDays && staleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
+    // The cap is the point of the parameter: an unbounded limit would be the
+    // whole-table read this axis exists to stop.
+    const limit = posInt(limitRaw, 'bad_limit', 1000);
+    if (limit && limit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer up to 1000.' });
+    const offset = posInt(offsetRaw, 'bad_offset');
+    if (offset && offset.bad) return res.fail('bad_offset', { status: 400, message: 'offset must be a positive integer.' });
+
+    const tasks = await db.listTasks({
+      versionId: version, status, kind, discipline, goalId,
+      createdBy, staleDays, limit, offset,
+    });
     // ?include=deps (hall redesign task 1002439) — enrich each task with its
     // dependency summary (`blocked_by[]` with per-target satisfied state, and a
     // `blocks` count) so the Goals rollup + Tasks dependency view can paint
@@ -117,12 +154,21 @@ module.exports = function buildTasksRouter() {
     if (fit && !VALID_FITS.has(fit)) {
       return res.fail('bad_fit', 400, { valid: Array.from(VALID_FITS) });
     }
+    // task 1003278 — the creator + staleness axes, so the Work Board narrows the
+    // feed at the SOURCE instead of downloading it and reducing it in the browser.
+    // Same validators as GET /tasks: one vocabulary, two surfaces.
+    const claimCreatedBy = parseCreatedBy(req.query.created_by);
+    if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
+    const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
+    if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
     const [claimable, active] = await Promise.all([
       db.listClaimableTasks({
         versionId: version || null,
         builderId: req.builder.id,
         discipline: discipline || null,
         fit: fit || null,
+        createdBy: claimCreatedBy ?? null,
+        staleDays: claimStaleDays ?? null,
       }),
       db.listActiveClaims(),
     ]);

package/modules/onboarding/module.json

@@ -2,7 +2,7 @@
   "key": "onboarding",
   "title": "Onboarding (admission · setup · newcomer floor)",
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
-  "coreVersion": "^1.9.0",
+  "coreVersion": "^1.19.374",
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["onboarding"] },