@bongos/core 1.19.485 → 1.19.487

package/modules/lifecycle/rot.js

@@ -0,0 +1,210 @@
+'use strict';
+
+// modules/lifecycle/rot.js — what is quietly rotting, and the one write that says
+// "leave it alone" (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// WHY THIS EXISTS. The goal's rotting half: "Untouched-for-X triggers a configured
+// action rather than a silent decay." The owner's decision (2026-08-25) fixed what
+// the action is — a NEEDS-ATTENTION ITEM, not an automatic status change and not a
+// nightly digest. A goal or task past the timer raises one line in the hall's
+// existing inbox, addressed to whoever created it and to the owner, offering the
+// four verbs the goal's own prose asks for: prune, kill, prioritise, water.
+// Rejected, and why: auto-demoting mutates real work with no human in the loop, and
+// a wrong timer then silently freezes it; a digest is a notification, not an action,
+// and gets scrolled past.
+//
+// THERE IS NO SWEEP, AND THAT IS THE DESIGN. Every line here is DERIVED on read from
+// the rot clock against the timer. Nothing is stored, so "exactly one open item per
+// stale thing, not one per sweep" is true by construction rather than by a
+// deduplicating poller that has to be written correctly and then stay correct. The
+// three consequences the owner's note asks for all fall out of the same fact:
+//   • acting on a line (prune/kill/prioritise) changes status → the row stops matching
+//   • watering pushes attention_watered_at forward → the row stops matching
+//   • a real edit moves updated_at → the row stops matching
+// Nothing to reconcile, nothing to garbage-collect, no way to accrete duplicates,
+// and no window in which the inbox and the database disagree.
+//
+// WHAT CAN ROT, AND WHAT DELIBERATELY CANNOT. Rot is *work nobody has picked up* —
+// not work in flight. Each exclusion below is excluded because some OTHER surface
+// already owns that question, and two surfaces asking the same question with two
+// different timers is the ADR 0226 failure:
+//   'active'                → the CLAIM-silence timer owns it (src/stale-timer.js);
+//                             the sweeper releases it and the Archon roster reports it.
+//   'blocked'               → a blocker owns it; /blocker-review is its cadence.
+//   'completed','confirmed' → the ship pipeline owns it; the publish reconciler and
+//                             the "Stranded ships" line report it.
+//   'shipped','abandoned'   → terminal. Nothing rots after it is done.
+// That leaves the queue nobody is working, which is exactly the pile the four verbs
+// are verbs for.
+
+const api = require('../../src/module-api');
+
+const { pool } = api;
+
+// The statuses that can rot, per tier. Exported so the tests assert against the same
+// set the query reads — a second copy of this list is how the inbox and its tests
+// drift into disagreeing about what rot even is.
+const TASK_ROTTABLE_STATUSES = Object.freeze(['backlog', 'ready']);
+const GOAL_ROTTABLE_STATUSES = Object.freeze(['open']);
+
+// The rot clock, spelled once. Both strings are duplicated VERBATIM in the index
+// expressions in migration core_231 — if you change one, change both, or the query
+// silently stops using the index. See that migration's header for why the first two
+// terms are shaped the way they are (they are task-lib.js's published definition of
+// "touched"; the water mark is the third term this task adds).
+const TASK_ROT_CLOCK = 'GREATEST(t.updated_at, COALESCE(t.shipped_at, t.updated_at), COALESCE(t.attention_watered_at, t.updated_at))';
+const GOAL_ROT_CLOCK = 'GREATEST(g.updated_at, COALESCE(g.attention_watered_at, g.updated_at))';
+
+// The verbs a line offers, per tier — served WITH the rows so the client renders
+// what the server will actually accept, instead of a button list that can drift out
+// of step with the routes behind it.
+//
+// Three of the four are EXISTING routes, on purpose: the nod slice in this same card
+// established the precedent (task 1003066 reused POST /tasks/:id/promote rather than
+// inventing an endpoint), and a verb that reuses a route also reuses its permission,
+// so this feature adds no new authority. Only `water` is new, because nothing in the
+// system could previously say "I looked at this, it is fine, ask me again later".
+//
+// A GOAL gets two verbs, not four, and the omission is honest rather than lazy:
+// promote/demote are task-lifecycle transitions that a goal has no equivalent of
+// (a goal is open, achieved or archived). Rendering a dead "prioritise" button on a
+// goal row would be worse than not offering it.
+const TASK_VERBS = Object.freeze([
+  Object.freeze({ verb: 'prioritise', label: 'Prioritise', method: 'POST', path: '/tasks/:id/promote', hint: 'make it claimable now' }),
+  Object.freeze({ verb: 'prune', label: 'Prune', method: 'POST', path: '/tasks/:id/demote', hint: 'back to the backlog, not dead' }),
+  Object.freeze({ verb: 'kill', label: 'Kill', method: 'POST', path: '/tasks/:id/abandon', hint: 'it is not going to happen' }),
+  Object.freeze({ verb: 'water', label: 'Water', method: 'POST', path: '/tasks/:id/water', hint: 'leave it — reset the clock' }),
+]);
+const GOAL_VERBS = Object.freeze([
+  Object.freeze({ verb: 'kill', label: 'Archive', method: 'POST', path: '/goals/:id/archive', hint: 'close it out' }),
+  Object.freeze({ verb: 'water', label: 'Water', method: 'POST', path: '/goals/:id/water', hint: 'leave it — reset the clock' }),
+]);
+
+const MAX_ROT_ROWS = 200;
+
+// rottingFor({ builderId, canSeeAll, rotDays, limit }) — the rot lines this caller
+// should see, oldest first.
+//
+// SCOPE. The owner's note addresses the item "to its creator, and to the owner", so:
+// a builder sees what they created; a caller with `canSeeAll` (the owner) sees
+// everything. A thing whose creator is NULL — created before attribution existed, or
+// by a system path (the core_227 convention) — is visible ONLY to canSeeAll, because
+// there is no person it could honestly be addressed to. Silently showing orphaned
+// rot to every builder would make the inbox everyone's problem and therefore
+// nobody's.
+//
+// Returns { rows, rotDays, cutoff } — `cutoff` is the timestamp the clock was
+// compared against, echoed so a reader can tell WHY a row is here without redoing
+// the arithmetic.
+async function rottingFor({ builderId, canSeeAll = false, rotDays, limit = 50 } = {}) {
+  const days = Number(rotDays);
+  if (!Number.isInteger(days) || days <= 0) {
+    throw new Error('rottingFor: rotDays must be a positive whole number of days');
+  }
+  const id = Number(builderId);
+  if (!Number.isInteger(id) || id <= 0) return { rows: [], rotDays: days, cutoff: null };
+  const cap = Math.max(1, Math.min(MAX_ROT_ROWS, Number(limit) || 50));
+
+  // One round trip for both tiers. The UNION arms are shaped to the same column list
+  // so the client renders one list of lines, not two lists it has to interleave.
+  const { rows } = await pool.query(
+    `WITH cutoff AS (SELECT now() - make_interval(days => $1::int) AS at)
+     SELECT * FROM (
+       SELECT 'task'::text                AS tier,
+              t.id::text                  AS id,
+              t.title                     AS title,
+              t.status                    AS status,
+              t.goal_id::text             AS goal_id,
+              g.title                     AS goal_title,
+              t.created_by::text          AS created_by,
+              ${TASK_ROT_CLOCK}           AS last_touched_at,
+              (t.attention_watered_at IS NOT NULL) AS ever_watered
+         FROM tasks t
+         LEFT JOIN goals g ON g.id = t.goal_id
+        WHERE t.status = ANY($2::text[])
+          AND ${TASK_ROT_CLOCK} < (SELECT at FROM cutoff)
+          AND ($4::boolean OR t.created_by = $3::bigint)
+       UNION ALL
+       SELECT 'goal'::text                AS tier,
+              g.id::text                  AS id,
+              g.title                     AS title,
+              g.status                    AS status,
+              NULL::text                  AS goal_id,
+              NULL::text                  AS goal_title,
+              g.created_by::text          AS created_by,
+              ${GOAL_ROT_CLOCK}           AS last_touched_at,
+              (g.attention_watered_at IS NOT NULL) AS ever_watered
+         FROM goals g
+        WHERE g.status = ANY($5::text[])
+          AND ${GOAL_ROT_CLOCK} < (SELECT at FROM cutoff)
+          AND ($4::boolean OR g.created_by = $3::bigint)
+     ) rot
+     ORDER BY last_touched_at ASC, tier ASC, id ASC
+     LIMIT $6`,
+    [days, TASK_ROTTABLE_STATUSES, id, canSeeAll, GOAL_ROTTABLE_STATUSES, cap]
+  );
+
+  const cutoffAt = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
+  return {
+    rows: rows.map((r) => ({ ...r, verbs: r.tier === 'task' ? TASK_VERBS : GOAL_VERBS })),
+    rotDays: days,
+    cutoff: cutoffAt,
+  };
+}
+
+// water(tier, id, builderId) — the clock reset, and the only write this file makes.
+//
+// IDEMPOTENT BY NATURE: watering an already-watered thing just moves the mark
+// forward again. There is no "already watered" error to handle, because a second
+// watering is a perfectly sensible thing for a human to do.
+//
+// Returns the new mark, or null when no such open row exists — the caller turns that
+// into a 404. Note the status filter: watering something that is already shipped,
+// abandoned or archived is refused, because the clock on a finished thing means
+// nothing and silently succeeding would tell the caller a lie.
+async function water(tier, id, builderId) {
+  const rowId = Number(id);
+  if (!Number.isInteger(rowId) || rowId <= 0) return null;
+  const by = Number.isInteger(Number(builderId)) && Number(builderId) > 0 ? Number(builderId) : null;
+
+  const table = tier === 'goal' ? 'goals' : 'tasks';
+  const statuses = tier === 'goal' ? GOAL_ROTTABLE_STATUSES : TASK_ROTTABLE_STATUSES;
+  const { rows } = await pool.query(
+    `UPDATE ${table}
+        SET attention_watered_at = now(),
+            attention_watered_by = $2
+      WHERE id = $1
+        AND status = ANY($3::text[])
+      RETURNING id::text AS id, attention_watered_at, attention_watered_by::text AS attention_watered_by`,
+    [rowId, by, statuses]
+  );
+  return rows[0] || null;
+}
+
+// createdBy(tier, id) — who a rot line is addressed to, for the authorization check
+// on `water`. Returns { created_by, status } or null. Separate from water() so the
+// route can refuse BEFORE writing, rather than writing and then discovering it
+// should not have.
+async function createdBy(tier, id) {
+  const rowId = Number(id);
+  if (!Number.isInteger(rowId) || rowId <= 0) return null;
+  const table = tier === 'goal' ? 'goals' : 'tasks';
+  const { rows } = await pool.query(
+    `SELECT created_by::text AS created_by, status FROM ${table} WHERE id = $1`,
+    [rowId]
+  );
+  return rows[0] || null;
+}
+
+module.exports = {
+  TASK_ROTTABLE_STATUSES,
+  GOAL_ROTTABLE_STATUSES,
+  TASK_ROT_CLOCK,
+  GOAL_ROT_CLOCK,
+  TASK_VERBS,
+  GOAL_VERBS,
+  MAX_ROT_ROWS,
+  rottingFor,
+  water,
+  createdBy,
+};

package/modules/lifecycle/routes/rot.js

@@ -0,0 +1,160 @@
+'use strict';
+
+// modules/lifecycle/routes/rot.js — GET /inbox/rotting + the two water writes
+// (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// WHY. Goal 1000072's rotting half: work must not decay in silence. This is the read
+// the hall's needs-attention inbox calls to find out what is rotting, plus the one
+// write the owner's fourth verb needs — "water": leave it alone and reset its clock.
+//
+// The other three verbs (prune, kill, prioritise) are NOT here, and their absence is
+// the design. They reuse the routes that already do those jobs — promote, demote,
+// abandon, archive — which is the precedent the nod slice set in this same card
+// (task 1003066). A verb that reuses a route reuses its permission, so three
+// quarters of this feature adds no new authority to the system at all.
+//
+// The route is only the doorway; ../rot.js owns the SQL and the definition of rot.
+// Keep it that way — this file must never grow a query.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../../src/module-api`; `../rot` is an intra-module sibling.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const rot = require('../rot');
+
+// The module's namespaced pino child (task 1003208) rather than console.* — a
+// structured line is attributable and rides ADR 0022's redaction; a bare console
+// call is neither, which is why the quality ratchet counts them.
+const log = api.logger('lifecycle');
+
+// Who may see rot that is addressed to someone else.
+//
+// The owner's note addresses each item "to its creator, and to the owner". The
+// creator half is an ownership fact the query already applies. This atom is the
+// other half — `builder.roster.read` is "may read another builder's record off the
+// roster", which is exactly what seeing someone else's rot is, and it is the atom
+// /builders/:id/active-claims and /builders/:id/credits already carry for the same
+// act. ADR 0157 delegated it archon→metic; the owner holds it a fortiori, so
+// "addressed to the owner" is satisfied without hardcoding an Archon identity
+// anywhere (the rule audit-authorship.sh enforces).
+const SEE_ALL_ROT = 'builder.roster.read';
+
+// Programmatic permission check — the middleware form cannot be used here because a
+// CREATOR with no atom at all must still be allowed through, and a gate mounted in
+// front of the handler would refuse them before the ownership fact is known.
+// Returns false when the governance port is absent or throws: authority that cannot
+// be established is a denial, never a pass (ADR 0016 fail-closed).
+async function holdsSeeAll(builderId) {
+  try {
+    const governance = api.resolveOptional('government');
+    if (!governance || typeof governance.builderHasPermissions !== 'function') return false;
+    return await governance.builderHasPermissions(Number(builderId), [SEE_ALL_ROT]);
+  } catch (err) {
+    log.error(`rot: permission resolve failed — denying fail-closed: ${err && err.message}`);
+    return false;
+  }
+}
+
+module.exports = function buildRotRouter() {
+  const router = express.Router();
+
+  // GET /inbox/rotting — what is quietly rotting, for this caller.
+  //
+  // rank: any-builder — own-scoped by default. The builder id comes from the
+  // authenticated session and is never read off the request, so a caller can only
+  // ever widen the result by HOLDING an atom, never by naming a different builder.
+  // A Xenos sees exactly the things they created and nothing else.
+  //
+  // ?rot_days= is a LENS, not a setting: it answers "what would 7 days show me?"
+  // without reconfiguring the project, and is never written back. The response
+  // reports the timer and where the number came from, so a reader can always tell a
+  // lens apart from the project's real answer (the src/stale-timer.js receipt
+  // convention — a number with no provenance is what let 6h and 24h coexist).
+  router.get('/inbox/rotting', api.requireBuilder, async (req, res) => {
+    try {
+      const builderId = Number(req.builder.id);
+      const timer = await api.resolveRotDays({ override: req.query.rot_days });
+      const canSeeAll = await holdsSeeAll(builderId);
+      const { limit } = api.parsePagination(req, { defaultLimit: 50, maxLimit: rot.MAX_ROT_ROWS });
+      const found = await rot.rottingFor({ builderId, canSeeAll, rotDays: timer.days, limit });
+
+      // A rot read is a clock comparison — a cached one is a wrong one the moment
+      // somebody waters a row.
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        rows: found.rows,
+        count: found.rows.length,
+        scope: canSeeAll ? 'all' : 'mine',
+        timer: {
+          rot_days: timer.days,
+          source: timer.source,
+          // Present ONLY when a configured value could not be used. The inbox shows
+          // it to the person who can fix it rather than 500-ing (the reporting-
+          // degrades half of ADR 0226's asymmetric fail posture).
+          invalid: timer.invalid,
+          describe: api.projectSettings.describeRotTimer(timer),
+        },
+        cutoff: found.cutoff,
+      });
+    } catch (err) {
+      log.error(`GET /inbox/rotting: ${err && err.message}`);
+      res.fail('rot_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The two water writes share everything but their tier, so they share a handler.
+  // Two separate routes rather than one /:tier/ route on purpose: an explicit path
+  // per tier is what lets the route-rank auditor and the generated OpenAPI describe
+  // each one, and it keeps a tier name out of the URL where a typo would 404 into
+  // something confusing.
+  //
+  // rank: any-builder + an ownership-or-atom check in the handler. Watering is the
+  // gentlest of the four verbs — it changes no status and destroys nothing; it says
+  // "I looked, it is fine, ask me later". Gating it any harder than seeing the line
+  // would mean showing a builder a button they are not allowed to press.
+  function waterHandler(tier) {
+    return async (req, res) => {
+      const id = api.parseId(req, res, { code: tier === 'goal' ? 'bad_goal_id' : 'bad_task_id', positiveInt: true });
+      if (id === null) return;
+      try {
+        const row = await rot.createdBy(tier, id);
+        if (!row) return res.fail(tier === 'goal' ? 'goal_not_found' : 'task_not_found', 404);
+
+        // Authorized iff the line was addressed to you: you created the thing, or you
+        // hold the atom that lets you see other people's rot.
+        const mine = row.created_by != null && String(row.created_by) === String(req.builder.id);
+        if (!mine && !(await holdsSeeAll(Number(req.builder.id)))) {
+          return res.fail('permission_forbidden', {
+            status: 403,
+            message: `only the ${tier}'s creator, or a builder holding ${SEE_ALL_ROT}, can water it`,
+          });
+        }
+
+        const watered = await rot.water(tier, id, Number(req.builder.id));
+        if (!watered) {
+          // The row exists but is not in a rottable status — already shipped,
+          // abandoned or archived. Say so rather than succeeding vacuously: a clock
+          // on a finished thing means nothing, and a silent 200 would tell the caller
+          // their click did something it did not.
+          return res.fail('not_rottable', {
+            status: 409,
+            message: `${tier} ${id} is '${row.status}' — a finished ${tier} has no rot clock to reset`,
+          });
+        }
+        res.json({ ok: true, tier, id: watered.id, watered_at: watered.attention_watered_at });
+      } catch (err) {
+        log.error(`POST /${tier}s/:id/water: ${err && err.message}`);
+        res.fail('water_failed', { status: 500, message: 'internal error' });
+      }
+    };
+  }
+
+  // POST /tasks/:id/water — reset a rotting task's clock.
+  router.post('/tasks/:id/water', api.requireBuilder, waterHandler('task'));
+
+  // POST /goals/:id/water — reset a rotting goal's clock.
+  router.post('/goals/:id/water', api.requireBuilder, waterHandler('goal'));
+
+  return router;
+};

package/modules/lifecycle/ship-card.js

@@ -159,7 +159,10 @@ function fmtMins(n) {
   return m ? `~${h}h${m}m` : `~${h}h`;
 }
 
-const DISCIPLINE_SKILL = { engineer: 'dev', artist: 'paint', ideator: 'ideate' };
+// Mirrors scripts/gds/discipline-modes.json, which is what claim.js prints. 'ui'
+// was missing here, so a UI task's card sent the builder to /dev while the claim
+// had just sent them to /design (task 1003487).
+const DISCIPLINE_SKILL = { engineer: 'dev', artist: 'paint', ideator: 'ideate', ui: 'design' };
 
 // The next-action per stage: { kind:'prompt', label, cmd } or { kind:'link', label, url }.
 function nextActionFor(stage, { taskId, discipline, sandboxUrl } = {}) {

package/modules/onboarding/newcomer-restock.js

@@ -32,22 +32,48 @@ const TEMPLATES_PATH = path.join(REPO_ROOT, 'scripts/gds/newcomer-floor.template
 const CONFIG_PATH = path.join(REPO_ROOT, 'scripts/gds/newcomer-floor.config.json');
 const SOURCE_TAG = 'newcomer-template';
 const HARD_MAX_MINUTES = 60;
-const VALID_DISCIPLINES = new Set(['engineer', 'artist', 'ideator']);
+// The crafts THIS instance offers, read through the published doorway (the one
+// core file a module may require, ADR 0083). This was a hardcoded Set that did not
+// track enabledDisciplines(), so it silently diverged the moment a module
+// contributed a craft: the picker could offer it, a builder could save it, and
+// restock would still never stamp its chores — a newcomer whose only craft was that
+// one saw an empty board with nothing to self-heal it (task 1003487).
+function validDisciplines() {
+  const { enabledDisciplines } = require('../../src/module-api');
+  return new Set(enabledDisciplines());
+}
 
 // Each discipline -> ARRAY of chore templates. A bare object (the pre-1488 single-
 // chore shape) is tolerated and wrapped, so an older/other instance's templates.json
 // still loads. Only entries with the required fields survive.
+//
+// Keyed by whatever the FILE declares (a leading-underscore key is metadata, not a
+// craft) and deliberately NOT narrowed to what this instance offers: this is the
+// catalogue of chores that EXIST, and choosing which of them to restock is
+// restockAll's job. Narrowing here would drop a disabled craft's chores from the
+// catalogue outright, which is a different question from "should we stamp them".
 function loadTemplates() {
   const raw = JSON.parse(fs.readFileSync(TEMPLATES_PATH, 'utf8'));
   const out = {};
-  for (const d of VALID_DISCIPLINES) {
-    if (!raw[d]) continue;
-    const list = Array.isArray(raw[d]) ? raw[d] : [raw[d]];
+  for (const [d, v] of Object.entries(raw)) {
+    if (d.startsWith('_') || !v) continue;
+    const list = Array.isArray(v) ? v : [v];
     out[d] = list.filter((t) => t && t.template_id && t.version_id && t.title);
   }
   return out;
 }
 
+// The crafts that HAVE chores defined — the guard for "can this discipline be
+// restocked at all", as distinct from validDisciplines() ("does this instance
+// offer it"), which is what decides whether we actually stamp.
+//
+// Takes an ALREADY-LOADED map: every hot path reads the templates once and passes
+// it here and to restockDiscipline, so a single restock does one readFileSync of
+// newcomer-floor.templates.json rather than one per helper per call.
+function templateDisciplines(byDiscipline = loadTemplates()) {
+  return new Set(Object.keys(byDiscipline));
+}
+
 // Per-discipline DEFAULT floor from config (fallback when a template omits its own).
 function loadFloors() {
   try {
@@ -150,9 +176,9 @@ async function restockTemplate(discipline, template, floors) {
 
 // Restock EVERY chore of a discipline to its floor. Returns an ARRAY of per-template
 // results (so a discipline with several chores tops each one up independently).
-async function restockDiscipline(discipline) {
-  if (!VALID_DISCIPLINES.has(discipline)) return [{ discipline, skipped: 'invalid discipline' }];
-  const templates = loadTemplates()[discipline] || [];
+async function restockDiscipline(discipline, byDiscipline = loadTemplates()) {
+  const templates = byDiscipline[discipline];
+  if (!templates) return [{ discipline, skipped: 'invalid discipline' }];
   if (!templates.length) return [{ discipline, skipped: 'no usable template' }];
   const floors = loadFloors();
   const out = [];
@@ -166,31 +192,35 @@ async function restockDiscipline(discipline) {
 // be matched to a known template. Returns an array of per-template results, or
 // [{ skipped:true }] for any non-chore task (callers ignore the value).
 async function restockForClaim(task) {
-  if (!task || task.source !== SOURCE_TAG || !VALID_DISCIPLINES.has(task.discipline)) {
-    return [{ skipped: true }];
-  }
-  const templates = loadTemplates()[task.discipline] || [];
+  // The cheap rejections first: a non-chore task is the common case and must not
+  // pay a file read at all.
+  if (!task || task.source !== SOURCE_TAG) return [{ skipped: true }];
+  const byDiscipline = loadTemplates();
+  const templates = byDiscipline[task.discipline];
+  if (!templates || !templates.length) return [{ skipped: true }];
   const tid = templateIdFromRef(task.source_ref, task.discipline);
   const match = tid ? templates.find((t) => t.template_id === tid) : null;
   if (match) return [await restockTemplate(task.discipline, match, loadFloors())];
   // ref didn't resolve to a known template — top the whole discipline up (safe).
-  return restockDiscipline(task.discipline);
+  // Hand the map down: restockDiscipline's default param would otherwise re-read
+  // and re-parse the file we are already holding.
+  return restockDiscipline(task.discipline, byDiscipline);
 }
 
 // Seed / backstop: bring every chore THIS INSTANCE offers to floor in one shot.
-// R59 (task 1198): the restocked set is the intersection of the chore disciplines
-// with the modules this instance enables (a vanilla instance with the art pipeline
-// off offers no 'artist' discipline). Returns a FLAT array of per-template results.
+// R59 (task 1198): the restocked set is exactly the crafts this instance enables —
+// a vanilla instance with the art pipeline off offers no 'artist', one with
+// ui-design on offers 'ui'. A craft with no template in templates.json is simply
+// skipped by restockDiscipline. Returns a FLAT array of per-template results.
 async function restockAll() {
   // enabledDisciplines reaches through the published doorway (the one core file a
   // module may require, ADR 0083) — never a direct require of src/modules.js.
-  const { enabledDisciplines } = require('../../src/module-api');
-  const offered = new Set(enabledDisciplines());
+  const offered = validDisciplines();
+  const byDiscipline = loadTemplates(); // one read for the whole sweep, not one per craft
   const out = [];
-  for (const d of VALID_DISCIPLINES) {
-    if (offered.has(d)) {
-      for (const r of await restockDiscipline(d)) out.push(r);
-    }
+  for (const d of templateDisciplines(byDiscipline)) {
+    if (!offered.has(d)) continue;
+    for (const r of await restockDiscipline(d, byDiscipline)) out.push(r);
   }
   return out;
 }
@@ -207,6 +237,7 @@ module.exports = {
   templateIdFromRef,
   buildDescription,
   SOURCE_TAG,
-  VALID_DISCIPLINES,
+  validDisciplines,
+  templateDisciplines,
   HARD_MAX_MINUTES,
 };

package/modules/ui-design/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"] },
+  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"], "disciplines": ["ui"] },
   "provides": [],
   "consumes": []
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.485",
+  "version": "1.19.487",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.485",
+      "version": "1.19.487",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.485",
+  "version": "1.19.487",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -515,6 +515,15 @@ const KERNEL_FILES = [
   // this roster would read as a kernel->non-kernel leak; it imports only
   // instance-config + node built-ins, so joining costs nothing.
   'src/stale-timer.js',
+  // task 1003279 (goal 1000072, ADR 0232): the project's live knob store and the ROT
+  // timer resolver over it — the same category as stale-timer.js directly above (host
+  // configuration a module reads rather than hardcodes), differing only in living in
+  // the DB instead of the env, because task 1003280 requires that knob be changeable
+  // from a page without a redeploy. The doorway re-exports it, so leaving it off this
+  // roster reads as a kernel->non-kernel leak; it imports only pool.js (itself on this
+  // roster) + node built-ins, so joining costs nothing and buys the import-direction
+  // guarantee on the file every future project knob will be read through.
+  'src/bongos/project-settings.js',
   // BV1.R86: the git-remote/slug + publish-target identity the doorway exposes
   // (api.repoInfo) for the carved lifecycle github-push/conflict-resolve. It is
   // KERNEL (already in the module-scope-map kernel key) and imports only the

package/scripts/gds/newcomer-floor.config.json

@@ -8,6 +8,7 @@
   "disciplines": {
     "engineer": { "floor": 2 },
     "artist": { "floor": 3 },
-    "ideator": { "floor": 2 }
+    "ideator": { "floor": 2 },
+    "ui": { "floor": 2 }
   }
 }

package/scripts/gds/newcomer-floor.js

@@ -58,7 +58,13 @@ const { cliClient, requireSession } = require('./cli-lib');
 const DEFAULT_CONFIG_PATH = path.join(__dirname, 'newcomer-floor.config.json');
 const SOURCE_TAG = 'newcomer-template';
 const HARD_MAX_MINUTES = 60; // newcomer scope ceiling, never exceeded (task 614)
-const VALID_DISCIPLINES = new Set(['engineer', 'artist', 'ideator']);
+// The crafts this seeder will stamp chores for. Deliberately a literal and NOT
+// enabledDisciplines(): this CLI seeds a REMOTE instance, whose enabled modules are
+// not this checkout's, so gating on the local module set would seed the wrong shelf.
+// It is the craft VOCABULARY, which is why 'unclassified' is absent. Keep in step
+// with the keys in newcomer-floor.templates.json ('ui' added by task 1003487); the
+// server-side restock reads the live offered set instead (newcomer-restock.js).
+const VALID_DISCIPLINES = new Set(['engineer', 'artist', 'ideator', 'ui']);
 // Every status a copy's source_ref could occupy — scanned so `seq` is globally
 // monotonic and never recycles a ref already used by a shipped/abandoned copy.
 const ALL_STATUSES = ['backlog', 'ready', 'active', 'completed', 'confirmed', 'shipped', 'blocked', 'abandoned'];