@bongos/core 1.19.454 → 1.19.456

package/docs/module-api-changelog.md

@@ -1345,5 +1345,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.452 with no explicit bump. run 33553290345. (task 1002620)
   1.19.454 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.453 with no explicit bump. run 33554965618. (task 1002620)
+  1.19.455 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.454 with no explicit bump. run 33558738299. (task 1002620)
+  1.19.456 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.455 with no explicit bump. run 33560584235. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/discord/db.js

@@ -143,9 +143,6 @@ module.exports = {
   markBoardMessageEdited,
   // kernel db helpers, re-exported off the doorway (one `db.*` namespace)
   insertAuditLog: (...a) => api.insertAuditLog(...a),
-  // createTask is a LIFECYCLE write — resolve the `lifecycle` kernel port at call
-  // time (the doorway leak retired at BV1.R86); used by discord-bugs (#bugs → task).
-  createTask: (...a) => api.resolveOptional('lifecycle').createTask(...a),
   getBuilderById: (...a) => api.getBuilderById(...a),
   get LIVE_RANK_LADDER() { return api.LIVE_RANK_LADDER; },
   // the shared pool, for any module file that wants it via db.pool

package/modules/discord/discord-bot.js

@@ -348,7 +348,14 @@ async function start() {
     // real filing path (recordInboundBug). Built once at startup.
     const bugAggregator = bugs.createBugAggregator({
       onFlush: (combined) => bugs.recordInboundBug(combined).then((result) => {
-        log.info(`[discord-bot] #bugs burst → ${result.outcome}${result.taskId ? ` (task #${result.taskId}, ${result.status}, ${result.images || 0} img)` : (result.reason ? ` (${result.reason})` : '')}`);
+        // task 1003067: a filing now always yields an IDEA; whether it also became
+        // a task depends on the landing matrix. Log both, so a homeless report is
+        // traceable instead of showing as a bare "filed" with no id to chase.
+        log.info(`[discord-bot] #bugs burst → ${result.outcome}${
+          result.ideaId
+            ? ` (idea ${result.ideaId}${result.taskId ? `, task ${result.taskId}, ${result.status}` : ', inbox'}, ${result.images || 0} img)`
+            : (result.reason ? ` (${result.reason})` : '')
+        }`);
         return result;
       }),
     });

package/modules/discord/discord-bugs.js

@@ -1,28 +1,45 @@
 'use strict';
 
-// Discord #bugs → GDS tasks (kind='bug') — Phase 3 F8 (ADR 0033 §F8, ADR 0047).
+// Discord #bugs → a routed filing — Phase 3 F8 (ADR 0033 §F8, ADR 0047),
+// retired onto the capture-time routing path by task 1003067 (BV1.R11).
 //
-// The bot turns a message posted in the designated #bugs channel into a GDS
-// task with kind='bug', STRAIGHT THROUGH — no idea_inbox, no triage step. This
-// is the deliberate difference from #ideas (discord-inbound.js): a bug is a
-// small fix a builder wants to drop without context-switching, and it becomes
-// claimable work directly.
+// WHAT CHANGED AND WHY. This path used to call createTask DIRECTLY, against a
+// hardcoded version id. Two things followed from that, and both were bugs:
 //
-// ANTI-ABUSE GUARD (ADR 0047 — the red-team resolution). Creating claimable
-// work with no triage gate is an injection surface, so this path is guarded in
-// depth, all server-side, all fail-closed:
-//   1. LINKED-BUILDER-ONLY. An unlinked Discord author cannot create a task —
-//      their message is ignored (not filed). Unlike #ideas (which captures
-//      unattributed), making *claimable work* requires being an accountable,
-//      known builder. This is the single biggest lever.
-//   2. RANK-AWARE LANDING. A linked Metic+ builder's bug lands 'ready'
-//      (instantly claimable — the true straight-through path their trust earns).
-//      A linked Xenos/Thetes builder's bug lands 'backlog' (needs a one-click
-//      Metic+ promote, like any other backlog task). Mirrors the trust ladder
-//      used everywhere else in the GDS.
-//   3. PER-BUILDER RATE-LIMIT. At most N bug-tasks per builder per rolling hour
-//      (counted from audit_log). Over-limit filings are ignored AND audited so
-//      a spammer surfaces in forensics / the red-team view.
+//   * The hardcoded id was GDS-V3, a SHIPPED version. Every bug reported through
+//     Discord resolved into that version's catch-all goal — a bucket nobody ever
+//     opens again. That is idea 1000771, the report goal 1000071 was filed over.
+//   * Creating the task directly meant NO idea row and NO lineage, so the person
+//     who reported the bug vanished from the record the moment it became work.
+//     The ideator credit lane (goal 1000067) pays against that lineage, so this
+//     vector was quietly minting unattributable work.
+//
+// Now the message becomes a CAPTURE (ideas.capture, the same port #ideas uses)
+// with a suggested goal, and the ideas module's landing matrix decides the rest.
+// The version is no longer named here at all: the goal carries it, and lifecycle
+// resolves which version is open to work (suggestGoalForCapture). A vector that
+// does not know a version id cannot hardcode a dead one.
+//
+// ANTI-ABUSE GUARD (ADR 0047 — the red-team resolution), as it stands now:
+//   1. AN UNLINKED AUTHOR CANNOT CREATE WORK. The original lever was
+//      linked-builder-ONLY: an unlinked message was dropped entirely, because
+//      this path minted claimable work with no triage gate. It no longer mints
+//      anything — an unlinked author's report becomes an idea_inbox row with
+//      captured_by NULL and NO goal, which is precisely what #ideas has always
+//      done for the same person. The security property ADR 0047 actually bought
+//      ("an unlinked author cannot inject claimable work") is intact and now
+//      structural; what is gone is the silent drop of a real bug report, which
+//      only ever protected us from reading it.
+//   2. RANK-AWARE LANDING, now the ideas landing matrix rather than a local
+//      copy of it: a linked Metic+ builder's bug lands 'ready', a linked
+//      sub-Metic builder's lands 'backlog' awaiting a nod. Same outcomes as
+//      before, one definition instead of two (pinned in
+//      tests/filing_abuse_matrix.mjs).
+//   3. PER-BUILDER RATE-LIMIT. At most N filings per LINKED builder per rolling
+//      hour (counted from audit_log). Over-limit filings are ignored AND audited
+//      so a spammer surfaces in forensics / the red-team view. An unlinked author
+//      has no builder id to count against, so they are held to the #ideas posture
+//      — an inbox row, never a task — rather than a cap this table cannot express.
 //   4. BODY SCREEN. Empty / too-short / text-free messages are ignored before
 //      any DB write; title + body are capped to the GDS limits.
 //
@@ -40,11 +57,15 @@ const { auditDiscordBot } = require('./discord-audit');
 const auth = require('./auth');
 const attachments = require('./bug-attachments');
 const { combineParts, createMessageAggregator } = require('./discord-message-buffer');
-const { LIMITS } = require('../../src/module-api');
+const api = require('../../src/module-api');
+const { LIMITS } = api;
+const log = api.logger('discord');
 
-// Ranks whose bugs land 'ready' (instantly claimable). Everyone else linked
-// lands 'backlog'. Metic+ — matches REQUIRES_RANK_TIER >= metic in db.js.
-const READY_RANKS = new Set(['metic', 'archon']);
+// NO LOCAL RANK RULE LIVES HERE (task 1003067). READY_RANKS + decideBugLanding
+// used to decide ready-vs-backlog for this channel alone. The ideas landing matrix
+// (modules/ideas/routing.js) now decides it for EVERY filing vector, so a second
+// copy here could only ever drift from it — which is what
+// tests/filing_abuse_matrix.mjs exists to prevent.
 
 // Smallest message we'll treat as a real bug report. Anything shorter is noise.
 const MIN_BUG_CHARS = 8;
@@ -53,13 +74,11 @@ const MIN_BUG_CHARS = 8;
 // DISCORD_BUGS_RATE_PER_HOUR overrides (a number); falls back to this.
 const DEFAULT_RATE_PER_HOUR = 5;
 
-// Default GDS version a filed bug is filed under. Most builder-filed bugs are
-// about the dev system; an Archon can re-home a game bug to a product version.
-// Env DISCORD_BUGS_VERSION_ID overrides.
-const DEFAULT_BUGS_VERSION_ID = 'GDS-V3';
-
-// Modest reward for fixing a drive-by bug. Env DISCORD_BUGS_CREDITS overrides.
-const DEFAULT_BUGS_CREDITS = 10;
+// NO DEFAULT VERSION LIVES HERE ANY MORE (task 1003067). DEFAULT_BUGS_VERSION_ID
+// used to be 'GDS-V3' and DISCORD_BUGS_CREDITS set a per-task reward. The version
+// is now carried by the goal the filing routes into — a vector that cannot name a
+// version cannot name a dead one, which is idea 1000771 in one sentence — and the
+// reward auto-assigns at the lowest create layer like every other vector (ADR 0096).
 
 // Auto-pairing window: consecutive #bugs messages from the SAME author within
 // this window are combined into ONE bug-task (so "screenshot" + "here's what
@@ -75,27 +94,11 @@ function rateLimitPerHour(env = process.env) {
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_RATE_PER_HOUR;
 }
 
-function bugsVersionId(env = process.env) {
-  return env.DISCORD_BUGS_VERSION_ID || DEFAULT_BUGS_VERSION_ID;
-}
-
-function bugsCredits(env = process.env) {
-  const n = Number(env.DISCORD_BUGS_CREDITS);
-  return Number.isFinite(n) && n >= 0 ? Math.floor(n) : DEFAULT_BUGS_CREDITS;
-}
-
 function pairWindowMs(env = process.env) {
   const n = Number(env.DISCORD_BUGS_PAIR_WINDOW_MS);
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_PAIR_WINDOW_MS;
 }
 
-// PURE — decide where a bug lands from the reporter's LIVE rank. Metic+ →
-// 'ready' (straight-through, claimable now); any other linked rank → 'backlog'
-// (a Metic+ promotes it, the lightweight confirm gate). Unit-tested.
-function decideBugLanding(rank) {
-  return READY_RANKS.has(String(rank || '').toLowerCase()) ? 'ready' : 'backlog';
-}
-
 // PURE — screen + shape a raw message into { ok, title, bodyMd } or
 // { ok:false, reason }. The body screen rejects blank / too-short / text-free
 // (no letters) messages before any DB write — UNLESS the message carries
@@ -127,7 +130,18 @@ function screenBug(content, { hasImages = false } = {}) {
 const realDeps = {
   getBuilderByDiscordUserId: db.getBuilderByDiscordUserId,
   countRecentDiscordBugFilings: db.countRecentDiscordBugFilings,
-  createTask: db.createTask,
+  // The two kernel ports this vector files through (never an import — the one-way
+  // module rule, ADR 0083/0093). `ideas.capture` is the same door #ideas uses;
+  // `lifecycle` answers which goal, on which still-open version.
+  captureIdea: (...a) => api.resolve('ideas.capture')(...a),
+  // resolveOptional, not resolve: an instance running without the lifecycle module
+  // has no goals to suggest, and that is a reason to file the report WITHOUT a
+  // home — never a reason to lose it. Returns null, which lands it in the inbox.
+  suggestGoalForCapture: async (...a) => {
+    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+    if (!lifecycle || !lifecycle.suggestGoalForCapture) return null;
+    return lifecycle.suggestGoalForCapture(...a);
+  },
   insertAuditLog: db.insertAuditLog,
   persistImages: attachments.persistImages,
 };
@@ -144,14 +158,13 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
   if (!screened.ok) return { outcome: 'ignored', reason: screened.reason };
 
   const limit = config.rateLimitPerHour ?? rateLimitPerHour();
-  const versionId = config.versionId ?? bugsVersionId();
-  const credits = config.credits ?? bugsCredits();
 
   try {
-    // (1) LINKED-BUILDER-ONLY. No linked builder → reject (do not file). An
-    // unlinked author cannot inject claimable work.
+    // (1) WHO POSTED. A linked builder files with their rank and is rate-limited;
+    // an unlinked author still gets their report recorded, but only ever as an
+    // inbox row (no goal, no rank ⇒ the matrix cannot route it into work). See
+    // the guard note in the header for why this replaced the outright drop.
     const builder = await deps.getBuilderByDiscordUserId(discordUserId);
-    if (!builder) return { outcome: 'ignored', reason: 'unlinked' };
 
     // (3) PER-BUILDER RATE-LIMIT. Count this builder's bug filings in the last
     // hour; over the cap → reject AND audit (so a spammer is visible in
@@ -160,7 +173,7 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     let recent = 0;
     let countFailed = false;
     try {
-      recent = await deps.countRecentDiscordBugFilings(builder.id, sinceIso);
+      if (builder) recent = await deps.countRecentDiscordBugFilings(builder.id, sinceIso);
     } catch (e) {
       // L4 (red-team 2026-06-12): FAIL CLOSED on a count error. The old behaviour
       // proceeded ("fail-open"), which let a DB error be used to slip past the
@@ -170,7 +183,7 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       console.error('[discord-bot] bug rate-limit count failed (denying — fail-closed):', e.message);
       countFailed = true;
     }
-    if (countFailed || recent >= limit) {
+    if (builder && (countFailed || recent >= limit)) {
       const reason = countFailed ? 'rate_limit_count_error' : 'rate_limited';
       await auditDiscordBot(deps, {
         builderId: builder.id,
@@ -182,8 +195,11 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       return { outcome: 'ignored', reason, recent };
     }
 
-    // (2) RANK-AWARE LANDING — decided from the LIVE rank, never the message.
-    const status = decideBugLanding(builder.rank);
+    // (2) RANK-AWARE LANDING is no longer decided here. The rank still comes from
+    // the LIVE builder row and never from the message — it is simply handed to the
+    // ideas landing matrix, which owns the ready-vs-backlog split for every filing
+    // vector. One definition, so this channel cannot drift from the others.
+    const filerRank = builder ? builder.rank : null;
 
     // Re-host any images on our server (durable — Discord CDN links expire). The
     // guard (host allowlist + content-type + magic-byte sniff + size/count caps)
@@ -201,7 +217,9 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     // Provenance footer so a claimer knows where the bug came from + who to ask.
     // The raw Discord snowflake is NOT embedded (it lives in the Archon-only
     // audit_log); only the builder login. Then the durable attachment links.
-    const origin = `\n\n— reported from Discord #bugs by ${builder.github_login}`;
+    const origin = builder
+      ? `\n\n— reported from Discord #bugs by ${builder.github_login}`
+      : '\n\n— reported from Discord #bugs (unlinked author)';
     let description = `${screened.bodyMd}${origin}`;
     if (stored.length > 0) {
       const imgs = stored.map((s, i) => `![attachment ${i + 1}](${s.url})`).join('\n');
@@ -209,27 +227,71 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     }
     description = description.slice(0, LIMITS.DESCRIPTION);
 
-    const task = await deps.createTask({
-      versionId,
+    // THE HOME. Only a linked builder's report is offered one: an unlinked author
+    // stays strictly less privileged than any signed-in builder (the #ideas rule),
+    // and with no goal the matrix files them to the inbox, which is the point.
+    // A null suggestion is the ordinary case and lands in the inbox too.
+    let goal = null;
+    if (builder) {
+      goal = await deps.suggestGoalForCapture({ title: screened.title, body: screened.bodyMd });
+    }
+
+    // The capture. One transaction inside the ideas module writes the idea row,
+    // the task (when the matrix routes it) and the lineage that keeps the reporter
+    // attached to the work — the whole reason this vector stopped calling
+    // createTask. kind is forced to 'bug' because the channel IS the classification.
+    const capture = {
       title: screened.title,
-      description,
-      status,
+      bodyMd: description,
       kind: 'bug',
-      priority: 3,
-      creditsReward: credits,
-      source: 'discord:bugs',
-      sourceRef: `discord:${messageId}`,
-    });
+      capturedBy: builder ? builder.id : null,
+      filerRank,
+      goalId: goal ? goal.id : null,
+      suggestedPriority: 3,
+    };
+
+    // THE HOME IS A SUGGESTION, NOT A CONDITION OF BEING HEARD. routeIdeaToGoal is
+    // ONE transaction, so a goal that refuses the landing — protected scope, a
+    // scope-wall verdict, a goal archived mid-flight — rolls the idea row back too
+    // and the report is gone. That is the exact failure this task exists to end, and
+    // it would be caused by a goal WE guessed at, not by anything the reporter did.
+    // So a refusal drops the guess and files the report homeless: it lands in the
+    // inbox for triage, which is strictly what would have happened before we tried.
+    let idea;
+    try {
+      idea = await deps.captureIdea(capture);
+    } catch (routeErr) {
+      if (!capture.goalId) throw routeErr; // nothing to drop — a real failure
+      log.warn({ err: routeErr && (routeErr.code || routeErr.message), goalId: capture.goalId },
+        'routed capture refused — filing the report to the inbox instead');
+      idea = await deps.captureIdea({ ...capture, goalId: null });
+    }
 
+    const routed = idea && idea.routing && idea.routing.routed ? idea.routing : null;
     await auditDiscordBot(deps, {
-      builderId: builder.id,
+      builderId: builder ? builder.id : null,
       route: 'discord:bugs',
-      requestBodyRedacted: { discord_user_id: discordUserId, message_id: messageId, task_id: task.id, status, images: stored.length },
+      requestBodyRedacted: {
+        discord_user_id: discordUserId,
+        message_id: messageId,
+        idea_id: idea.id,
+        task_id: routed ? routed.task_id : null,
+        goal_id: routed ? routed.goal_id : null,
+        status: routed ? routed.status : null,
+        images: stored.length,
+      },
       responseStatus: 201,
       logLabel: 'bug audit-log write failed',
     });
 
-    return { outcome: 'filed', taskId: task.id, status, builderId: builder.id, images: stored.length };
+    return {
+      outcome: 'filed',
+      ideaId: idea.id,
+      taskId: routed ? routed.task_id : null,
+      status: routed ? routed.status : null,
+      builderId: builder ? builder.id : null,
+      images: stored.length,
+    };
   } catch (err) {
     console.error('[discord-bot] recordInboundBug failed:', err.message);
     return { outcome: 'error', error: err.message };
@@ -245,13 +307,10 @@ function createBugAggregator({ onFlush, windowMs = pairWindowMs(), timers = glob
 
 module.exports = {
   screenBug,
-  decideBugLanding,
   recordInboundBug,
   combineParts,
   createBugAggregator,
   realDeps,
   rateLimitPerHour,
-  bugsVersionId,
-  bugsCredits,
   pairWindowMs,
 };

package/modules/discord/module.json

@@ -12,6 +12,6 @@
     "uiSections": []
   },
   "provides": ["discord.isLinked"],
-  "consumes": ["ideas.capture", "government"],
+  "consumes": ["ideas.capture", "government", "lifecycle"],
   "dependencies": { "discord.js": "^14.26.4" }
 }

package/modules/hall-ui/public/atlas.css

@@ -13,40 +13,49 @@
    renderer reads at draw time, with dark variants, so the scene adapts to
    the theme without the pack touching the encoding. */
 .atlas-page{
-  /* semantic map palette — FIXED (never pack-driven), tuned for both themes */
+  /* THE SEMANTIC MAP PALETTE — the sanctioned exception, alongside the shell's
+     status vocabulary. ADR 0094's invariant is that a pack's colours must never
+     scramble the map's colour-coded MEANING, so these nine are fixed literals on
+     purpose and are not the Fifteen Rule's business. Everything BELOW them is
+     chrome, and chrome is the world's (task 1003307). */
   --ab-sun:#6366f1; --ab-sky:#0ea5e9; --ab-coral:#f43f5e; --ab-paper:#b3a284;
   --ab-good:#10b981; --ab-core:#f59e0b; --ab-db:#ef4444; --ab-ghost:#94a3b8; --ab-danger:#dc2626;
   /* theme-dependent, non-semantic scene values (read by atlas.js) */
   --ab-label-ink: var(--ink);
-  --ab-label-halo: var(--surface);
+  --ab-label-halo: var(--bg-card);
+  /* Pure white with alpha as an ambient wash — the Fifteen Rule's one legal
+     literal shape (a scrim, a mask or a halo). */
   --ab-ambient: rgba(255,255,255,.5);
-  --ab-glow: #c7cdf7;
-  --ab-b-good-bg:#dcfce7; --ab-b-good-fg:#166534;
-  --ab-b-warn-bg:#fef3c7; --ab-b-warn-fg:#92400e;
-  --ab-b-danger-bg:#fee2e2; --ab-b-danger-fg:#991b1b;
-  --ab-b-info-bg:#e0f2fe; --ab-b-info-fg:#075985;
+  /* Was #c7cdf7 / #3b418c, a private periwinkle nobody could re-theme. The world
+     already holds a second hue for exactly this: --sea, which the hall otherwise
+     never spends. */
+  --ab-glow: color-mix(in srgb, var(--sea) 30%, var(--bg-card));
+  /* The badge fills were eight literals plus eight dark twins. They are the
+     four-state vocabulary the shell already measures on both grounds in both
+     modes (tests/hall_tokens.mjs), so they are that vocabulary now — which is
+     also why this rule needs no dark block for them any more. */
+  --ab-b-good-bg:var(--ok-weak);     --ab-b-good-fg:var(--ok);
+  --ab-b-warn-bg:var(--warn-weak);   --ab-b-warn-fg:var(--warn);
+  --ab-b-danger-bg:var(--danger-weak); --ab-b-danger-fg:var(--danger);
+  --ab-b-info-bg:var(--info-weak);   --ab-b-info-fg:var(--info);
   color:var(--ink);
-  border:1px solid var(--border); border-radius:var(--radius);
+  border:var(--line) solid var(--rule-soft); border-radius:var(--radius);
   background:
     radial-gradient(ellipse 70% 55% at 50% 46%, color-mix(in srgb, var(--accent) 4%, transparent), transparent 70%),
-    var(--surface);
+    var(--bg-card);
 }
+/* The dark twin, still written twice and still byte-identical — that rule does
+   not bend. What shrank is what it has to SAY: the badge pairs flip themselves
+   now that they are the status vocabulary, so only the two genuinely scene-level
+   values are left (task 1003307). */
 html[data-theme="dark"] .atlas-page{
   --ab-ambient: rgba(255,255,255,.03);
-  --ab-glow: #3b418c;
-  --ab-b-good-bg:#123227; --ab-b-good-fg:#5eead4;
-  --ab-b-warn-bg:#33260d; --ab-b-warn-fg:#fcd34d;
-  --ab-b-danger-bg:#371616; --ab-b-danger-fg:#fca5a5;
-  --ab-b-info-bg:#0f2740; --ab-b-info-fg:#7dd3fc;
+  --ab-glow: color-mix(in srgb, var(--sea) 55%, var(--bg));
 }
 @media (prefers-color-scheme: dark){
   html:not([data-theme]) .atlas-page{
     --ab-ambient: rgba(255,255,255,.03);
-    --ab-glow: #3b418c;
-    --ab-b-good-bg:#123227; --ab-b-good-fg:#5eead4;
-    --ab-b-warn-bg:#33260d; --ab-b-warn-fg:#fcd34d;
-    --ab-b-danger-bg:#371616; --ab-b-danger-fg:#fca5a5;
-    --ab-b-info-bg:#0f2740; --ab-b-info-fg:#7dd3fc;
+    --ab-glow: color-mix(in srgb, var(--sea) 55%, var(--bg));
   }
 }
 .atlas-page *{box-sizing:border-box}
@@ -54,12 +63,12 @@ html[data-theme="dark"] .atlas-page{
 
 .atlas-toolbar{display:flex; align-items:center; gap:12px 16px; flex-wrap:wrap; padding:16px 20px 0}
 .ab-chip{font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.1em;
-  color:var(--accent-text); background:var(--accent-weak); border:1px solid color-mix(in srgb, var(--accent) 30%, transparent); padding:3px 9px; border-radius:999px}
-.ab-modes{display:inline-flex; gap:0; border:1px solid var(--border-strong); border-radius:var(--radius-sm); overflow:hidden}
+  color:var(--accent-ink); background:var(--accent-tint); border:var(--line) solid color-mix(in srgb, var(--accent) 30%, transparent); padding:3px 9px; border-radius: var(--radius-pill)}
+.ab-modes{display:inline-flex; gap:0; border:var(--line) solid var(--rule); border-radius:var(--radius-sm); overflow:hidden}
 .ab-modes button{font-family:var(--font-body); font-weight:500; font-size:12.5px; cursor:pointer; border:0;
-  background:var(--surface); color:var(--ink-soft); padding:6px 14px; transition:background .15s, color .15s}
-.ab-modes button + button{border-left:1px solid var(--border-strong)}
-.ab-modes button.active{background:var(--accent-weak); color:var(--accent-text)}
+  background:var(--bg-card); color:var(--ink-soft); padding:6px 14px; transition:background .15s, color .15s}
+.ab-modes button + button{border-left:var(--line) solid var(--rule)}
+.ab-modes button.active{background:var(--accent-tint); color:var(--accent-ink)}
 .ab-modes button:focus-visible{outline:2px solid var(--accent); outline-offset:-2px}
 
 .ab-caption{padding:13px 20px 0; margin:0; font-size:13px; line-height:1.5; color:var(--ink-soft); max-width:90ch}
@@ -68,10 +77,10 @@ html[data-theme="dark"] .atlas-page{
 .ab-scene{position:relative; width:100%; min-height:500px; padding:6px 0}
 .ab-scene svg{display:block; width:100%; height:auto}
 .ab-hint{position:absolute; left:20px; bottom:12px; font-size:11.5px; color:var(--ink-soft);
-  background:color-mix(in srgb, var(--surface) 75%, transparent); backdrop-filter:blur(4px); padding:5px 11px; border-radius:999px; border:1px solid var(--border)}
+  background:color-mix(in srgb, var(--bg-card) 75%, transparent); backdrop-filter:blur(4px); padding:5px 11px; border-radius: var(--radius-pill); border:var(--line) solid var(--rule-soft)}
 .ab-empty{position:absolute; inset:0; display:none; align-items:center; justify-content:center; text-align:center; padding:40px}
 .ab-empty.show{display:flex}
-.ab-empty .card{background:var(--surface); border:1px solid var(--border); border-radius:var(--radius); padding:26px 30px; max-width:460px;
+.ab-empty .card{background:var(--bg-card); border:var(--line) solid var(--rule-soft); border-radius:var(--radius); padding:26px 30px; max-width:460px;
   box-shadow:var(--shadow-pop)}
 .ab-empty h2{margin:0 0 8px; font-size:16px; font-weight:650}
 .ab-empty p{margin:0; font-size:13.5px; line-height:1.55; color:var(--ink-soft)}
@@ -82,8 +91,8 @@ html[data-theme="dark"] .atlas-page{
 .ab-legend .ln{width:18px; border-top:3px solid}
 .ab-foot{padding:10px 20px 20px; font-size:11px; color:var(--ink-faint); font-variant-numeric:tabular-nums}
 
-.ab-popup{position:absolute; z-index:6; width:300px; max-width:88%; background:var(--surface);
-  border:1px solid var(--border); border-radius:var(--radius); padding:15px 16px; display:none;
+.ab-popup{position:absolute; z-index:6; width:300px; max-width:88%; background:var(--bg-card);
+  border:var(--line) solid var(--rule-soft); border-radius:var(--radius); padding:15px 16px; display:none;
   box-shadow:var(--shadow-pop)}
 .ab-popup.show{display:block}
 .ab-popup-close{position:absolute; top:8px; right:11px; cursor:pointer; border:0; background:transparent;
@@ -91,13 +100,13 @@ html[data-theme="dark"] .atlas-page{
 .ab-popup-close:hover{color:var(--ink)}
 .ab-ptitle{font-weight:650; font-size:15px; display:flex; align-items:center;
   gap:8px; flex-wrap:wrap; line-height:1.25; padding-right:18px}
-.ab-ppath{font-family:ui-monospace,"SF Mono",Menlo,Consolas,monospace; font-size:11.5px; color:var(--ink-soft); margin-top:4px; word-break:break-all}
+.ab-ppath{font-family: var(--font-mono); font-size:11.5px; color:var(--ink-soft); margin-top:4px; word-break:break-all}
 .ab-pdesc{font-size:12.8px; line-height:1.55; margin:11px 0 0; color:var(--ink-soft)}
 .ab-prow{margin-top:11px; font-size:10.5px; font-weight:600; color:var(--ink-faint); text-transform:uppercase; letter-spacing:.06em}
 .ab-chips{display:flex; flex-wrap:wrap; gap:6px; margin-top:6px}
-.ab-chip2{font-size:11px; font-weight:500; background:var(--surface-2); border:1px solid var(--border);
-  padding:4px 9px; border-radius:999px; font-variant-numeric:tabular-nums}
-.ab-badge{font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.05em; padding:3px 8px; border-radius:999px}
+.ab-chip2{font-size:11px; font-weight:500; background:var(--glass); border:var(--line) solid var(--rule-soft);
+  padding:4px 9px; border-radius: var(--radius-pill); font-variant-numeric:tabular-nums}
+.ab-badge{font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.05em; padding:3px 8px; border-radius: var(--radius-pill)}
 .ab-b-good{background:var(--ab-b-good-bg); color:var(--ab-b-good-fg)} .ab-b-warn{background:var(--ab-b-warn-bg); color:var(--ab-b-warn-fg)}
 .ab-b-danger{background:var(--ab-b-danger-bg); color:var(--ab-b-danger-fg)} .ab-b-info{background:var(--ab-b-info-bg); color:var(--ab-b-info-fg)}
 

package/modules/hall-ui/public/atlas.html

@@ -19,6 +19,14 @@
   <div class="app-body">
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
+      <!-- task 1003307: the atlas shipped with no page head and no <h1> — the
+           map filled the column and the page had no name in the document. The
+           board's label voice gives it one without competing with the map. -->
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Repo atlas</h1>
+        <p class="page-head__sub">A self-drawing map of the codebase: what each module is, and what depends on it.</p>
+      </div>
+
       <main id="hall-main">
         <!-- The atlas chrome rides the hall tokens (pack + dark aware, task 1737);
              only the semantic node/edge palette stays instance-independent so a

package/modules/hall-ui/public/atlas.states.json

@@ -0,0 +1,60 @@
+{
+  "_": "Repo atlas — the self-drawing module map. Its SEMANTIC node palette is fixed by ADR 0094 and is not the token tier's business; everything around it (toolbar, chips, legend, popup, badges) is chrome and rides the world. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once.",
+  "page": "/builders/atlas",
+  "surface": "hall-ui",
+  "stub": {
+    "prefix": "/builders/"
+  },
+  "modeQuery": false,
+  "_feeds": "The kit's own stub carries no feed for this page, so against it the page renders its EMPTY and SKELETON states — which is the point: those are states the floors must hold in. Against the hall-preview harness the same states render populated. Every declared 404 below is a fixture the harness does not carry, named rather than hidden.",
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/api/(gds|bongos)/me/",
+    "/api/(gds|bongos)/goals",
+    "/api/(gds|bongos)/inbox/",
+    "/api/(gds|bongos)/versions",
+    "/api/(gds|bongos)/atlas",
+    "/api/(gds|bongos)/public/repo",
+    "/builders/atlas.json"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/",
+    "\\b401\\b",
+    "\\b403\\b",
+    "\\b404\\b",
+    "\\b501\\b",
+    "Unauthorized",
+    "Forbidden",
+    "Not Found",
+    "Not Implemented",
+    "load failed"
+  ],
+  "states": {
+    "map": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          900
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#scene"
+        ]
+      }
+    },
+    "out": {
+      "auth": false
+    }
+  },
+  "reducedMotion": {
+    "auth": true,
+    "actions": [
+      [
+        "wait",
+        600
+      ]
+    ]
+  }
+}

package/modules/hall-ui/public/collab.css

@@ -5,10 +5,10 @@
 .cb-list { list-style: none; margin: 10px 0 0; padding: 0; display: flex; flex-direction: column; gap: 8px; }
 
 .cb-item {
-  border: 1px solid var(--rule);
+  border: var(--line) solid var(--rule);
   border-left: 3px solid var(--rule);
   border-radius: var(--radius-sm);
-  background: var(--surface);
+  background: var(--bg-card);
   padding: 10px 12px;
 }
 

package/modules/hall-ui/public/collab.html

@@ -19,7 +19,13 @@
   <div class="app-body">
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
-      <div class="page-head">
+      <!-- task 1003307: the board page head. Collab shipped with NO <h1> at all
+           (one-header-main-h1 measured 0 on every render), so the re-skin
+           carries the structural fix rather than porting the hole. The heading
+           is the LABEL voice, not a display line: on a working surface the
+           page's own name is the least interesting thing on it. -->
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Collab</h1>
         <p class="page-head__sub" id="cb-sub">Loading…</p>
       </div>