@bongos/core 1.19.388 → 1.19.390

package/modules/grading/grader-score.js

@@ -19,18 +19,23 @@ function isNum(n) {
   return Number.isFinite(n);
 }
 
-// #1002653 corroboration helpers for validateAndScore's null-ff lens branch.
-// A worker entry is untrusted input — w.issues may be any shape. Absent issues
-// on an errored worker is the normal outage shape (treated as none); a truthy
-// NON-ARRAY issues is malformed and must DISQUALIFY corroboration (fail-closed
-// schema_error downstream), never TypeError into a 500 on grade submission.
-const isNarcErroredClean = (w) => {
-  if (!w || w.kind !== 'narc' || !w.error) return false;
+// #1002653 / task 1003318 corroboration helpers for validateAndScore's null-axis
+// lens branches (Narc → ff, Quality → cq). A worker entry is untrusted input —
+// w.issues may be any shape. Absent issues on an errored worker is the normal
+// outage shape (treated as none); a truthy NON-ARRAY issues is malformed and
+// must DISQUALIFY corroboration (fail-closed schema_error downstream), never
+// TypeError into a 500 on grade submission.
+const isWorkerErroredClean = (kind) => (w) => {
+  if (!w || w.kind !== kind || !w.error) return false;
   const issues = w.issues == null ? [] : w.issues;
   if (!Array.isArray(issues)) return false;
   return !issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
 };
-const isNarcHealthy = (w) => !!w && w.kind === 'narc' && !w.error;
+const isWorkerHealthy = (kind) => (w) => !!w && w.kind === kind && !w.error;
+const isNarcErroredClean = isWorkerErroredClean('narc');
+const isNarcHealthy = isWorkerHealthy('narc');
+const isQualityErroredClean = isWorkerErroredClean('quality');
+const isQualityHealthy = isWorkerHealthy('quality');
 
 // task 1002658 (ADR 0164): a SUBSTANTIVE issue is one a real panel emits — a
 // known severity + a non-empty summary. The old plausibility guard counted raw
@@ -95,8 +100,8 @@ function validateAndScore(rawSubagent, meta = {}) {
   // needs POSITIVE corroboration: workers[] carries an errored
   // no-substantive-finding Narc (#473 missing-signal semantics) and no healthy
   // Narc. Empty/narc-less/absent workers, ABSENT ff, and every other shape
-  // fall through to the fail-closed schema_error below. Quality has no such
-  // branch — gating lens, absence stays fail-closed.
+  // fall through to the fail-closed schema_error below. Quality's twin branch
+  // (task 1003318, below) is gating, so it never passes.
   // Trust note: workers[] is client-supplied like every SR-9 grade input — a
   // forger gains nothing here they cannot get by sending ff:9 directly; the
   // server-derivable-signals redesign is tracked separately (SR-9 residual).
@@ -105,8 +110,23 @@ function validateAndScore(rawSubagent, meta = {}) {
     metaWorkers.some(isNarcErroredClean) && !metaWorkers.some(isNarcHealthy);
   const ffExplicitNull = parsed.functional_fidelity === null;
   const ffLensUnavailable = ffExplicitNull && narcMissingSignal;
+  // task 1003318: the same shape for the GATING Quality lens. The haiku-tier
+  // Quality worker died on a context-window overflow (`Prompt is too long`)
+  // before it started; aggregatePanel forwarded code_quality: null and
+  // Number(null) === 0 fabricated "FAIL — code_quality below 6" at (9+0)/2.
+  // Unlike the advisory ff branch this NEVER passes: a gating lens that did not
+  // run is recorded as unavailable (json-null axis, score on the axis that ran,
+  // signals.cq_lens_unavailable) and the task parks at completed for
+  // manual-confirm — fail-closed, and a forger gains nothing they could not get
+  // by sending cq:9 outright. Same corroboration: an errored no-finding Quality
+  // in workers[] and no healthy one; every other null shape is schema_error.
+  const qualityMissingSignal = !!metaWorkers &&
+    metaWorkers.some(isQualityErroredClean) && !metaWorkers.some(isQualityHealthy);
+  const cqExplicitNull = parsed.code_quality === null;
+  const cqLensUnavailable = cqExplicitNull && qualityMissingSignal;
+  const qualityErrorTag = cqLensUnavailable ? String(metaWorkers.find(isQualityErroredClean).error) : null;
   const ff = ffExplicitNull ? null : Number(parsed.functional_fidelity);
-  const cq = Number(parsed.code_quality);
+  const cq = cqExplicitNull ? null : Number(parsed.code_quality);
   const economyRaw = Number(parsed.economy);
   const economy =
     isNum(economyRaw) && economyRaw >= 0 && economyRaw <= 10 ? economyRaw : null;
@@ -138,9 +158,13 @@ function validateAndScore(rawSubagent, meta = {}) {
 
   signals.confidence = confidence;
   signals.issue_count = issues.length;
-  if (ffLensUnavailable) signals.ff_lens_unavailable = true;
+  // Set AND cleared: `signals` spreads the client's own blob, so a forged
+  // `*_lens_unavailable: true` on a judged grade must not survive into the row
+  // (the ship card keys its outage reading on these).
+  if (ffLensUnavailable) signals.ff_lens_unavailable = true; else delete signals.ff_lens_unavailable;
+  if (cqLensUnavailable) signals.cq_lens_unavailable = true; else delete signals.cq_lens_unavailable;
 
-  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || !isNum(cq) || cq < 0 || cq > 10) {
+  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || (!cqLensUnavailable && (!isNum(cq) || cq < 0 || cq > 10))) {
     return {
       score: 0,
       passed: false,
@@ -152,22 +176,34 @@ function validateAndScore(rawSubagent, meta = {}) {
       notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`
         + (ffExplicitNull && !narcMissingSignal
           ? ' Explicit null functional_fidelity without a corroborated Narc outage in signals.workers is fail-closed.'
+          : '')
+        + (cqExplicitNull && !qualityMissingSignal
+          ? ' Explicit null code_quality without a corroborated Quality outage in signals.workers is fail-closed.'
           : ''),
       issues,
     };
   }
 
   const ffR = ffLensUnavailable ? null : r1(clamp(ff, 0, 10));
-  const cqR = r1(clamp(cq, 0, 10));
+  const cqR = cqLensUnavailable ? null : r1(clamp(cq, 0, 10));
   const economyR = economy != null ? r1(clamp(economy, 0, 10)) : null;
   const securityR = securityScore != null ? r1(clamp(securityScore, 0, 10)) : null;
   const efficiencyR = efficiencyScore != null ? r1(clamp(efficiencyScore, 0, 10)) : null;
   const economyPenalty =
     economyR != null ? Math.max(0, (THRESHOLD - economyR) / 2) : 0;
-  const cqEffective = economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
-  // With the ff lens out, the score reflects only the axis that ran — never a
-  // blend with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold.
-  const blended = ffLensUnavailable ? cqR : r1((ffR + cqR) / 2);
+  const cqEffective = cqLensUnavailable
+    ? null
+    : economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
+  // With a lens out, the score reflects only the axis that ran — never a blend
+  // with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold. Both
+  // out → 0: nothing was judged.
+  const blended = ffLensUnavailable && cqLensUnavailable
+    ? 0
+    : ffLensUnavailable
+      ? cqR
+      : cqLensUnavailable
+        ? ffR
+        : r1((ffR + cqR) / 2);
 
   // confidence must be present (not null) for a PASS. A subagent that omits
   // confidence entirely silently bypassed the low-confidence gate under the
@@ -182,26 +218,40 @@ function validateAndScore(rawSubagent, meta = {}) {
   // (null < THRESHOLD is true via JS coercion), and must not appear in the
   // verdict's below-threshold branches.
   const ffBelow = !ffLensUnavailable && ffR < THRESHOLD;
-  const bothPass = !ffBelow && cqR >= THRESHOLD;
-  const passed = bothPass && !lowConfidence && !confidenceAbsent;
-
+  const cqBelow = !cqLensUnavailable && cqR < THRESHOLD;
+  const bothPass = !ffBelow && !cqBelow;
+  // A GATING lens that did not run is never a PASS (ff is advisory since #481;
+  // cq is not) — manual-confirm is the only way past it (task 1003318).
+  const passed = bothPass && !lowConfidence && !confidenceAbsent && !cqLensUnavailable;
+
+  // The UNAVAILABLE reading is only honest when the lenses that DID run found
+  // nothing substantive: a Hacker blocker beside a dead Quality is a rejection
+  // with a missing axis, not an outage, and must keep the ordinary FAIL chain
+  // (the #574 posture — a dark lens hardens the outcome, never softens it).
+  const hasSubstantiveFinding = issues.some((i) => i.severity === 'blocker' || i.severity === 'major');
   const verdict = passed
     ? 'PASS'
-    : confidenceAbsent
-      ? 'FAIL — confidence absent'
-      : lowConfidence
-        ? 'FAIL — low confidence'
-        : bothPass
-          ? 'FAIL'
-          : ffBelow && cqR < THRESHOLD
-            ? `FAIL — both axes below ${THRESHOLD}`
-            : ffBelow
-              ? `FAIL — functional_fidelity below ${THRESHOLD}`
-              : `FAIL — code_quality below ${THRESHOLD}`;
+    : cqLensUnavailable && !hasSubstantiveFinding
+      ? `UNAVAILABLE — the code_quality lens did not run (Quality worker errored: ${qualityErrorTag}); not a quality rejection — manual-confirm available`
+        + (ffBelow ? ` (functional_fidelity below ${THRESHOLD})` : '')
+        // the confidence reasons the chain below would have named — kept as a
+        // tail so the #489 gate-walk signal is never hidden by the outage line
+        + (confidenceAbsent ? '; confidence absent' : lowConfidence ? `; low confidence ${confidence}` : '')
+      : confidenceAbsent
+        ? 'FAIL — confidence absent'
+        : lowConfidence
+          ? 'FAIL — low confidence'
+          : bothPass
+            ? 'FAIL'
+            : ffBelow && cqBelow
+              ? `FAIL — both axes below ${THRESHOLD}`
+              : ffBelow
+                ? `FAIL — functional_fidelity below ${THRESHOLD}`
+                : `FAIL — code_quality below ${THRESHOLD}`;
 
   const notesLines = [];
   notesLines.push(`Shot ${signals.shot_index != null ? signals.shot_index : '?'} (${signals.model}) — ${verdict}`);
-  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
+  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqLensUnavailable ? 'n/a (lens unavailable)' : `${cqR}/10`}${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
   if (notesFromSubagent) {
     notesLines.push('');
     notesLines.push(notesFromSubagent.trim());
@@ -559,6 +609,9 @@ function aggregateShots(shotResults, meta = {}) {
   const cq = median(verdicts.map((v) => v.cq));
   const economy = median(verdicts.map((v) => v.economy));
   const cqEffective = median(verdicts.map((v) => v.cq_effective));
+  // NB (task 1003318): this v3 multi-shot path still collapses a null axis to
+  // 0 — it serves the trivial-diff single shot, which cannot overflow a window;
+  // the panel path's lens-outage handling lives in validateAndScore.
   const blended = ff != null && cq != null ? r1((ff + cq) / 2) : 0;
   // Top-level aggregated confidence = median of per-shot confidences. Without
   // this, ship.js forwards a null top-level confidence to /tasks/:id/grade,

package/modules/grading/grader-workers/index.js

@@ -45,6 +45,17 @@ const TRANSIENT_WORKER_ERRORS = new Set([
   'SUBAGENT_NONZERO_EXIT',
 ]);
 
+// task 1003318: a context-window overflow is NOT transient. The CLI refuses the
+// request before the worker starts (`Prompt is too long: the request is ~251248
+// tokens (limit 200000)`) and refuses the retry identically, so the #465 retry
+// only burns another round. Its own tag names the cause on the grade row and
+// in the server's verdict line (grader-score.js keys the lens outage on ANY
+// errored no-finding Quality — the tag is the diagnosis, not the trigger).
+// The pattern is the API's exact sentence, so a diff that merely mentions the
+// phrase cannot trip it.
+const PROMPT_TOO_LONG_RE = /prompt is too long: the request is ~?\d+ tokens/i;
+const PROMPT_TOO_LONG = 'PROMPT_TOO_LONG';
+
 // #467: per-worker subagent timeout. The global 240s applied to EVERY worker,
 // which timed out the Read-heavy ones (Narc walks ACs + reads files — hence
 // Phase 2.0.5's 5-read workaround; Quality is next-heaviest). Per-worker budgets
@@ -176,6 +187,14 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
       // (`claude` prints its "not logged in" line there) — fall back so the tail
       // is never empty when the subprocess did explain itself.
       stderrTail = redactStderrTail(err.stderr) ?? redactStderrTail(err.stdout);
+      // Matched on the RAW stream (the redacted tail keeps only the last 400
+      // chars), stderr first and stdout only when stderr is silent — stdout
+      // carries the model's own text. A SUBAGENT_TIMEOUT keeps its tag: it is
+      // the #467 budget signal, never a refusal.
+      if (err.code !== 'SUBAGENT_TIMEOUT') {
+        const said = String(err.stderr || '').trim() || String(err.stdout || '');
+        if (PROMPT_TOO_LONG_RE.test(said)) subprocessError = PROMPT_TOO_LONG;
+      }
     }
     const parsed = subprocessError
       ? null

package/modules/hall-ui/public/builders.js

@@ -550,17 +550,22 @@
       // A grader OUTAGE row (panel_outcome 'unavailable') carries a placeholder
       // score of 0 — label it, never render it as a 0.0 fail (task 1002652).
       const isOutage = g.panel_outcome === 'unavailable';
-      const score = isOutage ? '—' : Number(g.score).toFixed(1);
+      // A json-null gating axis (task 1003318 — the Quality worker never ran)
+      // is likewise not a judgment: the score is the surviving axis, not a fail.
+      const isLensOut = !isOutage && !!g.rubric_scores && g.rubric_scores.code_quality === null;
+      const score = isOutage || isLensOut ? '—' : Number(g.score).toFixed(1);
       const verdict = isOutage
         ? `<span style="color:var(--ink-soft,#8a8577)">not graded (grader outage)</span>`
-        : g.passed
+        : isLensOut
+          ? `<span style="color:var(--ink-soft,#8a8577)">not graded (quality lens unavailable)</span>`
+          : g.passed
           ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
           : `<span style="color:#a04040;font-weight:600">fell short</span>`;
       return `
         <tr>
           <td class="ledger__num">#${g.task_id}</td>
           <td>${escapeHtml(g.title || '')}</td>
-          <td class="ledger__drachmae">${isOutage ? '—' : `${score} / 10`}</td>
+          <td class="ledger__drachmae">${isOutage || isLensOut ? '—' : `${score} / 10`}</td>
           <td>${verdict}</td>
           <td class="ledger__date">${fmtDate(g.graded_at)}</td>
         </tr>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.388",
+  "version": "1.19.390",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.388",
+      "version": "1.19.390",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.388",
+  "version": "1.19.390",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-grade-steps.js

@@ -306,6 +306,33 @@ function formatGradeOutcome(g, taskId, cliFinding = null) {
     return out.join('\n');
   }
 
+  // task 1003318: ONE gating lens went dark (the Quality worker died on a
+  // context-window overflow before it started) while the rest of the panel
+  // judged the diff and found nothing substantive. The server records that axis
+  // as unavailable instead of fabricating a 0 (validateAndScore
+  // cq_lens_unavailable); present it the way #943 presents a total outage —
+  // there are no findings to fix, and the paths forward are re-grade or
+  // manual-confirm. Sits BELOW the authorization wall (a refusal is never an
+  // outage) and steps aside when any lens raised a blocker/major (then the
+  // ordinary FAIL block prints the findings). The task stays at completed.
+  const cqLensOutage = !g.passed
+    && g.signals?.cq_lens_unavailable === true
+    && g.rubric_scores?.code_quality === null
+    && !(g.issues || []).some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+  if (cqLensOutage) {
+    out.push('');
+    out.push('Subagent grade: QUALITY LENS UNAVAILABLE  ·  the Quality worker did not run — NOT a quality rejection');
+    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
+    out.push(...formatOutageDiagnostic(g, null));
+    out.push('');
+    out.push('The other lenses judged the diff and found nothing substantive; code_quality is recorded as unavailable, not 0. Task stays at completed.');
+    out.push('When the grader is healthy again, re-grade:');
+    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
+    out.push('Or land it now via manual-confirm:');
+    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/gds/tasks/${taskId}/confirm`);
+    return out.join('\n');
+  }
+
   const verdict = g.passed ? 'PASS' : 'FAIL';
   out.push('');
   out.push(`Subagent grade: ${verdict}  ·  blended ${g.score}/10  ·  threshold ${g.threshold} (both axes)`);

package/scripts/hall-preview/README.md

@@ -21,11 +21,43 @@ node scripts/hall-preview/server.js                 # neutral pack, port 4600
 | `--brand config/branding.json` | serve the instance pack (default: `config/branding.neutral.json`, the vanilla skin) |
 | `--modules-off dev-box,provisioning` | report those modules disabled in `window.__MODULES__` — verifies `moduleOn()` gating (Harbor nav item, Instances/Start-a-project widgets must vanish) |
 | `--empty` | drain every array in every fixture — the empty-state screenshot pass |
+| `--fixture-me` | don't read your own account live — serve the checked-in `me.json` snapshot (see below) |
 
 Writes are not wired: any `POST/PATCH/DELETE` answers `501 preview_readonly`.
 A GET with no fixture answers 404 and logs
 `no fixture: <path>` — that log line names the exact file to add.
 
+## The account is yours (task 1003315)
+
+The fixtures are one particular builder's snapshot, so the harness used to greet
+everyone as that builder — their name, credits, achievements, goals and **rank**.
+A metic snapshot also sealed the Archon-gated pages, so a UI change to Watch /
+Harbor / Gate / Permissions could not be reviewed at all.
+
+So at boot the harness reads **your** account: if this machine holds a GDS CLI
+session, the me-scoped endpoints (`/me`, `/me/*`, `/builders/<you>/…`,
+`/analytics/builder/<you>`, `/inbox/by-builder/<you>`, `/inbox/awaiting-nod`) are
+fetched live — read-only GETs — and layered over the fixtures in memory. The boot
+banner names whose hall you are looking at:
+
+```
+  account: @scootermack (archon) — your own, live
+```
+
+Nothing is written to `fixtures/` (that's `refresh-fixtures.js`'s job), so the
+checked-in snapshot stays the fallback. It serves whenever the live read can't
+happen — signed out, expired session, offline, or an endpoint your rank can't
+call (that one keeps its own fixture and the rest of your identity still lands).
+Every fallback says why, and says the hall is about to show you someone else:
+
+```
+  account: @jaxri (metic) — NOT YOURS, the checked-in fixture: this machine has no Bongos CLI session — run /builder-setup
+```
+
+**`--fixture-me` pins the snapshot.** Use it for the screenshot matrix below —
+a live account makes the images vary run to run — and to review the signed-out
+fallback deliberately. `--rank <rank>` still overrides whichever `/me` is served.
+
 ## Fixtures
 
 `fixtures/<path>.json`, slashes as `__` (`/me/recent-ships` → `me__recent-ships.json`).
@@ -46,7 +78,8 @@ Box/terminal endpoints are deliberately never snapshotted (connection details).
 
 Screenshot every changed page at **{light, dark} × {1280w, 390w}**, plus one
 instance-pack run (`--brand config/branding.json`) proving the theming contract
-survives. With the Playwright MCP (`npx playwright install chrome` once):
+survives. Run the harness with **`--fixture-me`** for these — the pinned snapshot
+is what makes two runs comparable. With the Playwright MCP (`npx playwright install chrome` once):
 
 1. `browser_navigate` → the page. `browser_console_messages` must show **0 errors**.
 2. 1280w: `browser_resize 1280×900` → `browser_take_screenshot` (fullPage for tall pages).

package/scripts/hall-preview/live-identity.js

@@ -0,0 +1,121 @@
+'use strict';
+// scripts/hall-preview/live-identity.js — serve the SIGNED-IN builder's own
+// account in the hall preview harness (task 1003315).
+//
+// The harness answers every read from checked-in fixtures, and fixtures/me.json
+// is one particular builder's snapshot. So every preview greeted whoever ran it
+// as somebody else ("Welcome back, Jackson Rini"), with that builder's credits,
+// achievements, goals and RANK — and because that snapshot is a metic, the
+// Archon-gated pages rendered their sealed notice, so a UI change to them could
+// not be reviewed at all. Reviewing your own UI change against someone else's
+// account is the bug.
+//
+// The fix: at boot, when the machine has a GDS CLI session, the me-scoped reads
+// are fetched LIVE (read-only GETs) and held in memory as overrides layered on
+// top of the fixtures. Nothing is ever written to fixtures/ — the checked-in
+// snapshot stays the signed-out fallback and the deterministic pass for the
+// screenshot matrix (`--fixture-me` pins it).
+//
+// Every dependency is injected, so this file is testable with no disk, no
+// network and no session (tests/hall_preview_identity.mjs).
+
+// The me-scoped reads — everything the hall renders as "you". ':id' expands to
+// the signed-in builder's id. Box/terminal endpoints are deliberately absent,
+// the same rule refresh-fixtures.js follows: they carry connection details.
+const ME_SCOPED_PATHS = [
+  'me',
+  'me/recent-ships?limit=30',
+  'me/cross-project',
+  'me/profile-nudge',
+  'me/render',
+  'me/wandering',
+  'me/skill-prefs',
+  'me/sound-prefs',
+  'me/event-sound-prefs',
+  'me/art-key/own',
+  'builders/:id/profile',
+  'builders/:id/active-claims',
+  'builders/:id/activity?section=tasks',
+  'builders/:id/activity?section=goals',
+  'analytics/builder/:id?days=90',
+  'inbox/by-builder/:id',
+  // Permission-gated (idea.triage, Metic+), so whether this queue exists at all
+  // is a fact about YOUR rank — the needs-attention inbox renders it or not.
+  'inbox/awaiting-nod?limit=20',
+];
+
+// The key an override is stored under, and the key a request looks itself up
+// by. The api path alone — EXCEPT where ?section= picks the row shape rather
+// than the path (the profile's activity log), which is the same discrimination
+// the harness's FIXTURE_FALLBACKS already makes for that one endpoint.
+function overrideKey(apiPath, query = {}) {
+  const p = String(apiPath || '').replace(/\/$/, '');
+  return query && query.section ? `${p}?section=${query.section}` : p;
+}
+
+// A ':id' template → the concrete request path plus the key it lands under.
+function expandPath(template, id) {
+  const [rawPath, search = ''] = String(template).split('?');
+  const p = rawPath.replace(':id', encodeURIComponent(String(id)));
+  const query = Object.fromEntries(new URLSearchParams(search));
+  return { key: overrideKey(p, query), url: search ? `${p}?${search}` : p };
+}
+
+// Why we fell back, in the builder's words rather than an HTTP status — this
+// line is printed in the boot banner and is the only signal that the hall is
+// about to greet them as someone else.
+function fallbackReason(status) {
+  if (status === 401 || status === 403) return 'your CLI session is no longer valid — run /builder-reauth';
+  return `the instance answered GET /me with ${status}`;
+}
+
+// resolveLiveIdentity — fetch the caller's own me-scoped reads, or explain why
+// not. NEVER throws and never exits: a preview harness that dies because the
+// laptop is offline is worse than one showing fixture data, so every failure
+// path degrades to { ok: false, why } and the fixtures keep serving.
+async function resolveLiveIdentity({
+  session,
+  fetchImpl = globalThis.fetch,
+  apiPrefix = '/api/bongos/v1',
+  timeoutMs = 8000,
+} = {}) {
+  if (!session || !session.token) {
+    return { ok: false, why: 'this machine has no Bongos CLI session — run /builder-setup' };
+  }
+  const base = String(session.apiBase || '').replace(/\/+$/, '');
+  if (!base) return { ok: false, why: 'the CLI session names no instance to read from' };
+
+  const get = async (url) => {
+    try {
+      const res = await fetchImpl(`${base}${apiPrefix}/${url}`, {
+        headers: { authorization: `Bearer ${session.token}`, accept: 'application/json' },
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+      if (!res.ok) return { ok: false, status: res.status };
+      return { ok: true, data: await res.json() };
+    } catch (e) {
+      return { ok: false, status: 0, error: e && e.message };
+    }
+  };
+
+  const me = await get('me');
+  if (!me.ok) return { ok: false, why: me.status ? fallbackReason(me.status) : `could not reach ${base} (${me.error || 'network error'})` };
+  const builder = me.data && me.data.builder;
+  if (!builder || !builder.id) return { ok: false, why: 'the instance returned no builder on GET /me' };
+
+  const overrides = new Map([['me', me.data]]);
+  const skipped = [];
+  const rest = ME_SCOPED_PATHS.filter((t) => t !== 'me').map((t) => expandPath(t, builder.id));
+  const results = await Promise.all(rest.map(({ url }) => get(url)));
+  rest.forEach(({ key }, i) => {
+    // A read this builder's rank can't make (or one this instance doesn't
+    // serve) simply keeps its fixture — a partial identity still shows YOUR
+    // name, rank and credits, which is the whole point.
+    if (results[i].ok) overrides.set(key, results[i].data);
+    else skipped.push(key);
+  });
+
+  return { ok: true, builder, base, overrides, skipped };
+}
+
+module.exports = { ME_SCOPED_PATHS, overrideKey, expandPath, fallbackReason, resolveLiveIdentity };

package/scripts/hall-preview/refresh-fixtures.js

@@ -24,6 +24,7 @@ const SNAPSHOTS = [
   ['versions', 'versions'],
   ['leaderboard', 'leaderboard'],
   ['inbox', 'inbox', trimList('ideas', 25)],
+  ['inbox/awaiting-nod?limit=20', 'inbox__awaiting-nod', trimList('awaiting', 25)],
   ['goals', 'goals'],
   ['goals/inbox', 'goals__inbox'],
   // goal details: a handful of REAL ids (exact-match fixtures) + goal 25

package/scripts/hall-preview/server.js

@@ -19,8 +19,16 @@
 //                  window.__MODULES__ (verifies moduleOn() gating)
 //   --empty        serve every fixture with its arrays emptied — the
 //                  empty-state screenshot pass
-//   --rank archon  override the /me fixture's builder.rank so the Archon-gated
-//                  pages (watch, harbor, gate) render their content in preview
+//   --rank archon  override the served /me builder.rank (live or fixture) so the
+//                  Archon-gated pages (watch, harbor, gate) render in preview
+//   --fixture-me   do NOT read your own account live; serve the checked-in
+//                  fixtures/me.json snapshot (deterministic screenshot passes,
+//                  and the offline/signed-out path) — task 1003315
+//
+// The account is YOURS: when this machine holds a GDS CLI session the me-scoped
+// reads are fetched live at boot and layered over the fixtures, so the hall
+// greets the builder previewing the change rather than whoever's snapshot is
+// checked in (task 1003315). Signed out, offline, or --fixture-me → fixtures.
 //
 // Browse http://builders.localhost:<port>/ — Chromium resolves *.localhost,
 // and the `builders.` host prefix exercises the real subdomain serving path.
@@ -41,9 +49,11 @@ function arg(name) {
 }
 const PORT = Number(arg('--port')) || 4600;
 const EMPTY = process.argv.includes('--empty');
-// --rank: view the hall as a different rank — the /me fixture's builder.rank is
+// --rank: view the hall as a different rank — the served /me builder.rank is
 // overridden in the response, so the Archon-gated pages (watch, harbor, gate)
-// render their real content instead of the sealed notice. Preview-only theatre:
+// render their real content instead of the sealed notice. Since task 1003315 the
+// served /me is normally your OWN account, so this is now only needed to view
+// the hall as a rank you are not. Preview-only theatre:
 // the real pages are server-gated (requireGovernmentPage / ADR 0016).
 const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
@@ -51,6 +61,10 @@ const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.t
 // often lacks prod's instance modules (provisioning, dev-box), and their
 // widgets can't be reviewed without it (task 2169).
 const MODULES_ON = String(arg('--modules-on') || '').split(',').map((s) => s.trim()).filter(Boolean);
+// --fixture-me: pin the checked-in /me snapshot instead of reading the caller's
+// own account live. The screenshot matrix in the README wants a stable subject,
+// and it is the explicit way to preview the signed-out fallback (task 1003315).
+const FIXTURE_ME = process.argv.includes('--fixture-me');
 const BRAND_FILE = arg('--brand') || 'config/branding.neutral.json';
 process.env.GDS_BRANDING_FILE = path.resolve(ROOT, BRAND_FILE);
 
@@ -65,6 +79,21 @@ catch (_) { express = require('express'); }
 const { buildStampedHtml } = require(path.join(ROOT, 'src', 'asset-version.js'));
 const { injectBrandingGlobal, mountInternalSurfaces } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
 const { clientModules } = require(path.join(ROOT, 'src', 'modules.js'));
+const { overrideKey, resolveLiveIdentity } = require('./live-identity');
+
+// The session is the ONE thing this harness reads from outside its own tree, and
+// it reads it through the FAIL-OPEN helper on purpose: apiCall/cliClient exit the
+// process on a 401, which would kill a preview over a cosmetic feature.
+function readSession() {
+  try { return require(path.join(ROOT, 'scripts', 'gds', 'cli-lib')).readSessionToken(); }
+  catch (_) { return null; }
+}
+
+// Live me-scoped payloads, keyed by overrideKey(); empty until boot resolves
+// them, and empty forever when signed out / offline / --fixture-me.
+let liveOverrides = new Map();
+let liveBuilder = null;
+let liveWhy = null;
 
 // ---- fixtures ---------------------------------------------------------------
 // File naming: the API path with slashes as "__" — /me/recent-ships →
@@ -151,7 +180,11 @@ app.use((req, res, next) => {
   if (req.method !== 'GET') {
     return res.status(501).json({ error: { code: 'preview_readonly', message: 'the preview harness serves fixtures; writes are not wired' } });
   }
-  const fix = fixtureFor(apiPath, req.query || {});
+  // Your own account wins over the checked-in snapshot; a me-scoped read that
+  // wasn't resolved live falls through to its fixture exactly as before.
+  const q = req.query || {};
+  const live = liveOverrides.get(overrideKey(apiPath, q)) ?? liveOverrides.get(apiPath);
+  const fix = live !== undefined ? live : fixtureFor(apiPath, q);
   if (fix === undefined) {
     console.log(`  no fixture: ${apiPath}  (add scripts/hall-preview/fixtures/${apiPath.replace(/\//g, '__')}.json)`);
     return res.status(404).json({ error: { code: 'no_fixture', message: apiPath } });
@@ -197,10 +230,41 @@ app.get(/^\/([a-z-]+)$/, (req, res, next) => {
 // the page routes we already served.
 mountInternalSurfaces(app);
 
+// Whose hall this is, said plainly in the banner. When it is NOT yours, that is
+// the line that says so — the old harness printed nothing and the substitution
+// was only visible as a stranger's name on the page (task 1003315).
+function accountLine() {
+  if (liveBuilder) {
+    const who = liveBuilder.github_login ? `@${liveBuilder.github_login}` : liveBuilder.display_name;
+    return `  account: ${who} (${liveBuilder.rank}) — your own, live${RANK_OVERRIDE ? ` [rank forced to ${RANK_OVERRIDE}]` : ''}`;
+  }
+  const why = FIXTURE_ME ? '--fixture-me' : liveWhy;
+  // A published core carves fixtures/ out (publish-manifest.js) — there the
+  // fallback is not "someone else's account", it is NO account, and the hall
+  // will 404 its way through /me. Say which of the two this is.
+  const snap = (loadFixture('me') || {}).builder;
+  if (!snap) return `  account: NONE — no live read (${why}) and this checkout ships no me fixture`;
+  const who = snap.github_login ? `@${snap.github_login}` : (snap.display_name || 'a checked-in snapshot');
+  return `  account: ${who} (${RANK_OVERRIDE || snap.rank}) — NOT YOURS, the checked-in fixture: ${why}`;
+}
+
 // Loopback only — this is a pre-auth preview of hall pages with fixture data;
 // *.localhost resolves to 127.0.0.1 so nothing else is needed.
-app.listen(PORT, '127.0.0.1', () => {
-  console.log(`hall-preview: http://builders.localhost:${PORT}/`);
-  console.log(`  brand: ${BRAND_FILE}${EMPTY ? '  (EMPTY fixtures)' : ''}${MODULES_OFF.length ? `  modules off: ${MODULES_OFF.join(',')}` : ''}`);
-  console.log('  pages:', Object.keys(stamped).map((f) => f.replace(/\.html$/, '')).sort().join(' '));
-});
+(async () => {
+  if (!FIXTURE_ME) {
+    const res = await resolveLiveIdentity({ session: readSession() });
+    if (res.ok) {
+      liveOverrides = res.overrides;
+      liveBuilder = res.builder;
+      if (res.skipped.length) console.log(`  (kept fixtures for: ${res.skipped.join(', ')})`);
+    } else {
+      liveWhy = res.why;
+    }
+  }
+  app.listen(PORT, '127.0.0.1', () => {
+    console.log(`hall-preview: http://builders.localhost:${PORT}/`);
+    console.log(accountLine());
+    console.log(`  brand: ${BRAND_FILE}${EMPTY ? '  (EMPTY fixtures)' : ''}${MODULES_OFF.length ? `  modules off: ${MODULES_OFF.join(',')}` : ''}`);
+    console.log('  pages:', Object.keys(stamped).map((f) => f.replace(/\.html$/, '')).sort().join(' '));
+  });
+})();

package/src/module-api.js

@@ -1216,8 +1216,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.386 with no explicit bump. run 33121066592. (task 1002620)
 //   1.19.388 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.387 with no explicit bump. run 33125589814. (task 1002620)
+//   1.19.389 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.388 with no explicit bump. run 33126279278. (task 1002620)
+//   1.19.390 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.389 with no explicit bump. run 33133575931. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.388'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.390'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');