@bongos/core 1.19.491 → 1.19.492

package/modules/hall-ui/public/task.js

@@ -330,7 +330,107 @@
       `Task description:\n${desc}`;
   }
 
-  function renderTask(t, lastClaim, viewer, goal) {
+  // ---- the grade panel (task 1003437) ------------------------------------
+  // The adversarial panel's verdict on THIS task, on the task's own page rather
+  // than only on Standing's #recent-grades. Verification state wears the fixed
+  // vocabulary (ok / warn / danger / info) through .rec-pill, never the accent —
+  // a verdict is a fact about the work, not a control. The four workers ride
+  // grade.signals.workers[] (task_grades has no columns for them); score,
+  // verdict and threshold are the row's own; panel version and model come from
+  // the signals. A task with no grade row draws NOTHING (the ship-visual
+  // precedent — no placeholder, no "no grade yet" line); a row whose panel could
+  // not run is data, not absence, and says so in one line.
+  const WORKER_ORDER = ['narc', 'quality', 'hacker', 'efficiency'];
+  const VERDICT_TONE = { pass: 'ok', concerns: 'warn', fail: 'danger', error: 'danger' };
+  function verdictPill(verdict, small) {
+    const v = String(verdict || 'error').toLowerCase();
+    const tone = VERDICT_TONE[v] || 'info';
+    return `<span class="rec-pill rec-pill--${tone}${small ? ' rec-pill--sm' : ''}">${escapeHtml(v)}</span>`;
+  }
+  function gradePanelHtml(grade) {
+    if (!grade || typeof grade !== 'object') return '';
+    const sig = grade.signals && typeof grade.signals === 'object' ? grade.signals : {};
+    const head = `<section class="rec-sec" id="task-grade"><p class="rec-sec__h">Grade</p>`;
+    if (sig.panel_outcome === 'unavailable') {
+      return `${head}<p class="rec-body">The grading panel could not run when this task was shipped, so no quality signal was recorded — an outage, not a verdict.</p></section>`;
+    }
+    const workers = Array.isArray(sig.workers) ? sig.workers : [];
+    const kindOf = (w) => String((w && w.kind) || '').toLowerCase();
+    const known = WORKER_ORDER.filter((k) => workers.some((w) => kindOf(w) === k));
+    const extra = workers.map(kindOf).filter((k) => k && !WORKER_ORDER.includes(k));
+    const axes = known.concat(extra).map((k) => {
+      const w = workers.find((x) => kindOf(x) === k);
+      return `<div class="tk-axis"><span class="tk-axis__n">${escapeHtml(k)}</span>${verdictPill(w.error ? 'error' : w.verdict, true)}</div>`;
+    }).join('');
+    const score = grade.score == null || !Number.isFinite(Number(grade.score)) ? null : Number(grade.score);
+    const verdict = grade.passed === true ? 'pass' : grade.passed === false ? 'fail' : String(sig.panel_outcome || 'pending');
+    const models = [...new Set(workers.map((w) => w && w.model).filter(Boolean))];
+    const crumb = [
+      grade.threshold != null && Number.isFinite(Number(grade.threshold)) ? `threshold ${Number(grade.threshold)}` : '',
+      grade.grader_version ? `panel ${String(grade.grader_version)}` : '',
+      models.join(', '),
+    ].filter(Boolean).map(escapeHtml).join(' · ');
+    return `${head}
+      <p class="rec-body">The adversarial panel. Each worker reports pass, concerns or fail on its own; the gating workers must all pass before confirmed becomes ${escapeHtml(curLabel())}, and one concerns falls the task through to the manual confirm path.</p>
+      ${axes ? `<div class="tk-axes">${axes}</div>` : ''}
+      <div class="tk-score">
+        ${score == null ? '' : `<span class="tk-score__v">${escapeHtml(String(score))}<small class="tk-score__of">/10</small></span>`}
+        <span class="rec-pill rec-pill--${VERDICT_TONE[verdict] || 'info'}">verdict ${escapeHtml(verdict)}</span>
+        ${crumb ? `<span class="tk-crumb">${crumb}</span>` : ''}
+      </div>
+    </section>`;
+  }
+
+  // ---- the session log (task 1003437) ----------------------------------------
+  // Every session that worked THIS task — a claim seals one session_logs row at
+  // ship or release — on the task's own page rather than only on /sessions.
+  // Newest first; each is a small ledger: when and who, how long, the outcome,
+  // what the task paid, the handoff. The handoff is the template markdown and
+  // renders through the shared reader behind a disclosure, so a long note does
+  // not push the actions off the page. No sessions → nothing, like the visual.
+  // /sessions has no per-session address today, so "Full log" opens the room.
+  const OUTCOME_TONE = { shipped: 'ok', partial: 'warn', abandoned: 'danger' };
+  function fmtDuration(startIso, endIso) {
+    const ms = Date.parse(endIso) - Date.parse(startIso);
+    if (!Number.isFinite(ms) || ms < 0) return '';
+    const min = Math.round(ms / 60000);
+    if (min < 60) return `${min}m`;
+    const h = Math.floor(min / 60);
+    const m = min % 60;
+    return m ? `${h}h ${String(m).padStart(2, '0')}m` : `${h}h`;
+  }
+  function builderLink(row) {
+    const who = (row && (row.display_name || row.github_login)) || 'a builder';
+    if (!row || row.builder_id == null) return escapeHtml(who);
+    return `<a class="rec-dep" href="${hallBase()}/profile?id=${encodeURIComponent(String(row.builder_id))}">${escapeHtml(who)}</a>`;
+  }
+  function sessionLogHtml(logs, t) {
+    if (!Array.isArray(logs) || !logs.length) return '';
+    const label = curLabel();
+    const paidLabel = label.charAt(0).toUpperCase() + label.slice(1);
+    const blocks = logs.map((s) => {
+      const when = s.ended_at ? fmtDate(s.ended_at) : '';
+      const dur = fmtDuration(s.started_at, s.ended_at);
+      const outcome = String(s.outcome || 'unknown').toLowerCase();
+      const rows = [
+        `<div class="tk-lrow"><span class="tk-lk">Session</span><span class="tk-lv">${[escapeHtml(when), builderLink(s), escapeHtml(dur)].filter(Boolean).join(', ')}</span></div>`,
+        `<div class="tk-lrow"><span class="tk-lk">Outcome</span><span class="tk-lv"><span class="rec-pill rec-pill--sm rec-pill--${OUTCOME_TONE[outcome] || 'info'}">${escapeHtml(outcome)}</span></span></div>`,
+      ];
+      if (outcome === 'shipped' && t && t.credits_awarded != null) {
+        rows.push(`<div class="tk-lrow"><span class="tk-lk">${escapeHtml(paidLabel)} awarded</span><span class="tk-lv">${escapeHtml(String(t.credits_awarded))}</span></div>`);
+      }
+      if (s.notes_md) {
+        rows.push(`<div class="tk-lrow"><span class="tk-lk">Handoff</span><details class="tk-handoff"><summary>Read the handoff notes</summary><div class="rec-desc rec-md">${descriptionHtml(s.notes_md)}</div></details></div>`);
+      }
+      rows.push(`<div class="tk-lrow"><span class="tk-lk">Full log</span><span class="tk-lv"><a class="rec-dep" href="${hallBase()}/sessions">Open in Sessions</a></span></div>`);
+      return `<div class="tk-ledger">${rows.join('')}</div>`;
+    });
+    const count = logs.length > 1 ? ` <em>${logs.length} sessions</em>` : '';
+    return `<section class="rec-sec" id="task-sessions"><p class="rec-sec__h">Session log${count}</p>${blocks.join('')}</section>`;
+  }
+
+  function renderTask(t, lastClaim, viewer, goal, extras) {
+    const { grade = null, sessionLogs = null, claims = null } = extras || {};
     document.title = `#${t.id} — ${t.title || 'Task'} — ${document.title.split(' — ').pop()}`;
     const sub = $('#task-sub');
     if (sub) sub.textContent = `Task ${t.id}`;
@@ -382,17 +482,26 @@
     ]));
     parts.push(lifecycleRail(t, creditVal));
 
-    // Claim history (task 751 — best-effort: the API surfaces the most recent
-    // claim holder, not the full ledger of every past claim).
-    if (lastClaim) {
-      const who = escapeHtml(lastClaim.github_login || 'a builder');
-      const when = lastClaim.claimed_at ? fmtDate(lastClaim.claimed_at, { time: true }) : '';
-      const state = lastClaim.released_at
-        ? (lastClaim.outcome ? `released, outcome ${escapeHtml(lastClaim.outcome)}` : 'released')
+    // Claim history (task 751). The most recent holder leads; since task 1003437
+    // the read also carries the FULL claim ledger (?include=claims), so a task
+    // worked across several claims lists the earlier ones beneath. The old
+    // "most recent only" caveat is gone because it is no longer true.
+    const ledger = Array.isArray(claims) ? claims : [];
+    if (lastClaim || ledger.length) {
+      const head = lastClaim || ledger[0];
+      const who = escapeHtml(head.github_login || head.display_name || 'a builder');
+      const when = head.claimed_at ? fmtDate(head.claimed_at, { time: true }) : '';
+      const state = head.released_at
+        ? (head.outcome ? `released, outcome ${escapeHtml(head.outcome)}` : 'released')
         : 'holding this claim';
-      parts.push(`<section class="rec-sec"><p class="rec-sec__h">Claim</p>` +
-        `<p class="rec-body">Last claimed by <b>${who}</b>${when ? ' on ' + escapeHtml(when) : ''}. ${state}.` +
-        ` The task feed carries the most recent claim only, never the full ledger.</p></section>`);
+      const prior = ledger.slice(1).map((c) => {
+        const cWhen = c.claimed_at ? fmtDate(c.claimed_at, { time: true }) : '';
+        const cState = c.released_at ? escapeHtml(c.outcome || 'released') : 'holding';
+        return `<li>${builderLink(c)}${cWhen ? ' · ' + escapeHtml(cWhen) : ''} · ${cState}</li>`;
+      }).join('');
+      parts.push(`<section class="rec-sec"><p class="rec-sec__h">Claim${ledger.length > 1 ? ` <em>${ledger.length} claims</em>` : ''}</p>` +
+        `<p class="rec-body">Last claimed by <b>${who}</b>${when ? ' on ' + escapeHtml(when) : ''}. ${state}.</p>` +
+        (prior ? `<ul class="rec-files tk-claims">${prior}</ul>` : '') + '</section>');
     }
 
     if (t.value_summary) {
@@ -429,6 +538,12 @@
         `<p class="rec-body">Shipped ${escapeHtml(fmtDate(t.shipped_at))}${by}, ${escapeHtml(fmtRel(t.shipped_at))}.</p></section>`);
     }
 
+    // task 1003437: the grade panel and the session log — the owner's two net-new
+    // regions, between the record and its actions as the mocks compose them.
+    // Each draws nothing when it has nothing.
+    parts.push(gradePanelHtml(grade));
+    parts.push(sessionLogHtml(sessionLogs, t));
+
     // task 759: lifecycle action from the browser (no /builder-* CLI). The server
     // enforces every rank + ownership gate (ADR 0016); we only surface the control
     // the caller is actually allowed to use, and map any refusal to a friendly
@@ -529,7 +644,7 @@
     const id = taskIdFromPath();
     if (!id) { renderNotFound(''); return; }
     try {
-      const d = await getJSON(`${API}/tasks/${encodeURIComponent(id)}?include=last_claim`, { softAuth: true });
+      const d = await getJSON(`${API}/tasks/${encodeURIComponent(id)}?include=last_claim,grade,session_logs,claims`, { softAuth: true });
       if (!d || !d.task) { renderNotFound(id); return; }
       // Best-effort viewer probe so we know which lifecycle control (if any) the
       // caller is allowed to see. A failure just means no action buttons render —
@@ -556,7 +671,11 @@
         if (ri && typeof ri.blob_base === 'string') repoBlobBase = ri.blob_base;
         if (ri && typeof ri.tree_base === 'string') repoTreeBase = ri.tree_base;
       } catch (_) { /* links degrade to the original href */ }
-      renderTask(d.task, d.last_claim || null, viewer, goal);
+      renderTask(d.task, d.last_claim || null, viewer, goal, {
+        grade: d.grade || null,
+        sessionLogs: Array.isArray(d.session_logs) ? d.session_logs : null,
+        claims: Array.isArray(d.claims) ? d.claims : null,
+      });
     } catch (err) {
       if (err && err.code === AUTH_NEEDED) { toAuth(); return; }
       if (err && err.status === 404) { renderNotFound(id); return; }

package/modules/hall-ui/public/task.states.json

@@ -7,7 +7,7 @@
   "ignoreRequests": ["/api/(gds|bongos)/"],
   "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
-    "record": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#task-body", "#copy-prompt-btn"] } },
+    "record": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#task-body", "#task-grade", "#task-sessions", "#copy-prompt-btn"] } },
     "from-goal": { "auth": true, "url": "/task/2166?from=%2Fgoals%23%2Fgoal%2F1000081", "actions": [["wait", 600]], "expect": { "visible": ["#task-back", "#copy-prompt-btn"], "attr": [["#task-back", "href", "/goals#/goal/1000081"]] } },
     "missing": { "auth": true, "url": "/task/1003999", "actions": [["wait", 600]], "expect": { "visible": ["#task-h"] } }
   },

package/modules/lifecycle/db-claim-reads.js

@@ -168,11 +168,51 @@ async function getTaskGrade(taskId) {
   return { ...row, issues: Array.isArray(fromSignals) ? fromSignals : [] };
 }
 
+// getTaskClaims — the FULL claim ledger for a task, newest first (task 1003437).
+// getLastClaimHolder is LIMIT 1 of this same read; the hall's task page shows
+// the whole ledger so a task worked by several builders across several claims
+// says so, instead of naming only the last hand. Same columns as the last-holder
+// read plus the claim id, the worktree and the display name; like that read,
+// deliberately NOT the holder's rank (#678). Pure read, builder-agnostic.
+async function getTaskClaims(taskId) {
+  const { rows } = await pool.query(
+    `SELECT c.id AS claim_id, c.builder_id, c.claimed_at, c.released_at, c.outcome,
+            c.worktree_name, b.github_login, b.display_name
+       FROM claims c
+       JOIN builders b ON b.id = c.builder_id
+      WHERE c.task_id = $1
+      ORDER BY c.claimed_at DESC, c.id DESC`,
+    [taskId]
+  );
+  return rows;
+}
+
+// getTaskSessionLogs — every sealed session on a task, newest first (task
+// 1003437). session_logs is keyed by task_id directly (a claim seals one row at
+// ship or release), so there is no claim hop; joined to the builder for the
+// name. notes_md is the handoff-template markdown the hall renders through its
+// reader. Until this read the table had no API surface at all — write-only.
+async function getTaskSessionLogs(taskId) {
+  const { rows } = await pool.query(
+    `SELECT s.id, s.builder_id, s.claim_id, s.worktree_name, s.started_at, s.ended_at,
+            s.outcome, s.notes_md, s.confidence,
+            b.github_login, b.display_name
+       FROM session_logs s
+       JOIN builders b ON b.id = s.builder_id
+      WHERE s.task_id = $1
+      ORDER BY s.ended_at DESC, s.id DESC`,
+    [taskId]
+  );
+  return rows;
+}
+
 module.exports = {
   activeClaimCountForBuilder,
   getActiveClaimsForBuilder,
   getActiveClaimsForSession,
   getLastClaimHolder,
+  getTaskClaims,
   getTaskGrade,
+  getTaskSessionLogs,
   moduleScopeForActiveClaims,
 };

package/modules/lifecycle/db.js

@@ -190,7 +190,9 @@ const {
   getActiveClaimsForBuilder,
   getActiveClaimsForSession,
   getLastClaimHolder,
+  getTaskClaims,
   getTaskGrade,
+  getTaskSessionLogs,
   moduleScopeForActiveClaims,
 } = require('./db-claim-reads.js');
 const {
@@ -330,6 +332,8 @@ module.exports = {
   getActiveClaimsForSession,
   getLastClaimHolder, // --regrade ownership guard (#678)
   getTaskGrade,       // V4.R08 — diff-hash reuse check before grading
+  getTaskClaims,      // task 1003437 — the task page's claim ledger (?include=claims)
+  getTaskSessionLogs, // task 1003437 — the task page's session log (?include=session_logs)
   getBuildersRoster,
   getActiveClaimsForBuilderWithStale,
   releaseClaimOnBehalf,

package/modules/lifecycle/routes/tasks.js

@@ -254,15 +254,26 @@ module.exports = function buildTasksRouter() {
     const includes = String(req.query.include || '').split(',');
     const wantLastClaim = includes.includes('last_claim');
     const wantGrade = includes.includes('grade');
-    const [dependencies, dependents, lastClaim, grade] = await Promise.all([
+    // task 1003437: the hall's task page draws a grade panel, a session log and
+    // the full claim ledger — two more opt-in siblings on this same read (the
+    // grade already rode it), so the hot path still pays for nothing it was not
+    // asked for. Each is ABSENT when not asked and an array (maybe empty) when
+    // asked, so a page can tell "none" from "not requested".
+    const wantSessionLogs = includes.includes('session_logs');
+    const wantClaims = includes.includes('claims');
+    const [dependencies, dependents, lastClaim, grade, sessionLogs, claims] = await Promise.all([
       db.getTaskDependencies(id),
       db.getTaskDependents(id),
       wantLastClaim ? db.getLastClaimHolder(id) : Promise.resolve(null),
       wantGrade ? db.getTaskGrade(id) : Promise.resolve(null),
+      wantSessionLogs ? db.getTaskSessionLogs(id) : Promise.resolve(null),
+      wantClaims ? db.getTaskClaims(id) : Promise.resolve(null),
     ]);
     const body = { task: { ...task, dependencies, dependents } };
     if (wantLastClaim) body.last_claim = lastClaim;
     if (wantGrade) body.grade = grade; // null when no grade exists yet
+    if (wantSessionLogs) body.session_logs = sessionLogs;
+    if (wantClaims) body.claims = claims;
     res.json(body);
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.491",
+  "version": "1.19.492",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.491",
+      "version": "1.19.492",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.491",
+  "version": "1.19.492",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.491'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.492'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_record_world.mjs

@@ -38,6 +38,10 @@
 // Reproduce the renders these came from (the RECORD pages need a loaded record,
 // which the kit's own stub has no feed for — so they run against the hall's
 // fixture harness):
+//   * THE GRADE PANEL AND THE SESSION LOG (task 1003437) ride the one task read
+//     behind ?include=, draw nothing when absent, and wear the fixed verification
+//     vocabulary — never the accent. The claim block shows the whole ledger.
+//
 //   node scripts/hall-preview/server.js --port 4612 --fixture-me
 //   node modules/ui-design/kit/render.js --states modules/hall-ui/public/task.states.json \
 //     --base-in http://builders.localhost:4612 --base-out http://builders.localhost:4612
@@ -262,7 +266,11 @@ const TASK_SRC = read('task.js');
 // does the same: the description renders through it.
 const MD_SRC = read('md-reader.js');
 
-function renderTask(task, { lastClaim = null, viewer = null, goal = null, status = 200, search = '', referrer = '', withReader = true } = {}) {
+// grade / sessionLogs / claims (task 1003437): left undefined, the stub answers
+// like a client that never asked (the key is absent); null or an array answers
+// like the read did. `requests` records every path the page asked for.
+function renderTask(task, { lastClaim = null, viewer = null, goal = null, status = 200, search = '', referrer = '', withReader = true, grade, sessionLogs, claims } = {}) {
+  const requests = [];
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, disabled: false, _html: '',
@@ -287,7 +295,15 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, status
   };
   const client = {
     request: async (method, p) => {
-      if (/\/tasks\/\d+/.test(p)) return { status, ok: status === 200, data: status === 200 ? { task, last_claim: lastClaim } : null };
+      requests.push(p);
+      if (/\/tasks\/\d+/.test(p)) {
+        if (status !== 200) return { status, ok: false, data: null };
+        const data = { task, last_claim: lastClaim };
+        if (grade !== undefined) data.grade = grade;
+        if (sessionLogs !== undefined) data.session_logs = sessionLogs;
+        if (claims !== undefined) data.claims = claims;
+        return { status: 200, ok: true, data };
+      }
       if (/\/me$/.test(p)) return { status: 200, ok: true, data: { builder: viewer } };
       if (/\/goals\//.test(p)) return { status: 200, ok: true, data: { goal } };
       return { status: 404, ok: false, data: null };
@@ -322,6 +338,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, status
     html: () => documentObj.getElementById('task-body').innerHTML,
     sub: () => documentObj.getElementById('task-sub').textContent,
     el: (id) => documentObj.getElementById(id),
+    requests,
   };
 }
 
@@ -569,3 +586,167 @@ test('the description still reads when the reader is absent', async () => {
   assert.match(r.html(), /<div class="rec-desc rec-md"><p>plain &lt;b&gt;text&lt;\/b&gt;<\/p><\/div>/,
     'escaped into one paragraph — a missing script must never blank the record');
 });
+
+// ---- the grade panel and the session log (task 1003437) ----------------------
+// Two NET-NEW regions the owner approved at the hall composition round (direction
+// doc §6 decision 4). Both ride the task read's ?include= opt-in, so the page asks
+// once; both draw NOTHING when absent (the ship-visual precedent), and a verdict
+// wears the fixed verification vocabulary, never the accent.
+
+const GRADE = {
+  passed: true, score: '8.5', threshold: '6.0', grader_kind: 'subagent', grader_version: 'v4.0',
+  rubric_scores: {}, notes_md: '', issues: [],
+  signals: {
+    grader_version: 'v4.0', threshold: 6, panel_outcome: 'pass',
+    workers: [
+      { kind: 'narc', name: 'Narc', verdict: 'pass', model: 'claude-sonnet-5' },
+      { kind: 'quality', name: 'Quality', verdict: 'pass', model: 'claude-sonnet-5' },
+      { kind: 'hacker', name: 'Hacker', verdict: 'pass', model: 'claude-sonnet-5' },
+      { kind: 'efficiency', name: 'Efficiency Monger', verdict: 'pass', model: 'claude-sonnet-5' },
+    ],
+  },
+};
+const SESSION = {
+  id: '1', builder_id: '95', github_login: 'jaxri', display_name: 'Percy Jackson',
+  started_at: '2026-08-30T17:41:00Z', ended_at: '2026-08-30T18:18:00Z', outcome: 'shipped',
+  notes_md: '**What shipped:**\n- the thing', confidence: 'verified-smoke',
+};
+
+test('the page asks the task feed for the grade, the session log and the claim ledger in the one read', async () => {
+  const r = renderTask(BASE_TASK);
+  await r.boot(); await settle();
+  const reads = r.requests.filter((p) => /\/tasks\/\d+/.test(p));
+  assert.equal(reads.length, 1, 'one read, not a fetch per region');
+  for (const k of ['last_claim', 'grade', 'session_logs', 'claims']) {
+    assert.match(reads[0], new RegExp(`include=[^&]*\\b${k}\\b`), `asks for ${k}`);
+  }
+});
+
+test('the grade panel: four workers as verification pills, the score out of ten, the verdict, the panel crumb', async () => {
+  const r = renderTask(BASE_TASK, { grade: GRADE });
+  await r.boot(); await settle();
+  const html = r.html();
+  const start = html.indexOf('id="task-grade"');
+  const end = html.indexOf('<p class="rec-sec__h">Actions');
+  assert.ok(start > 0 && end > start, 'the grade section renders, before the actions');
+  const sec = html.slice(start, end);
+  const axes = [...sec.matchAll(/<span class="tk-axis__n">([^<]+)<\/span><span class="rec-pill rec-pill--(\w+) rec-pill--sm">(\w+)<\/span>/g)].map((m) => [m[1], m[2], m[3]]);
+  assert.deepEqual(axes, [['narc', 'ok', 'pass'], ['quality', 'ok', 'pass'], ['hacker', 'ok', 'pass'], ['efficiency', 'ok', 'pass']],
+    'the four workers in the panel order, each a pass pill');
+  assert.match(sec, /<span class="tk-score__v">8\.5<small class="tk-score__of">\/10<\/small><\/span>/, 'the score out of ten');
+  assert.match(sec, /<span class="rec-pill rec-pill--ok">verdict pass<\/span>/, 'the verdict');
+  assert.match(sec, /<span class="tk-crumb">threshold 6 · panel v4\.0 · claude-sonnet-5<\/span>/, 'threshold, panel version, model');
+  assert.doesNotMatch(sec, /accent/, 'state never borrows the accent');
+});
+
+test('a failed or mixed panel wears warn and danger, never ok', async () => {
+  const grade = {
+    ...GRADE, passed: false, score: '4.5',
+    signals: {
+      ...GRADE.signals, panel_outcome: 'fail',
+      workers: [
+        { kind: 'narc', verdict: 'pass', model: 'claude-sonnet-5' },
+        { kind: 'quality', verdict: 'concerns', model: 'claude-sonnet-5' },
+        { kind: 'hacker', verdict: 'fail', model: 'claude-sonnet-5' },
+        { kind: 'efficiency', verdict: null, error: 'SUBAGENT_TIMEOUT', model: 'claude-sonnet-5' },
+      ],
+    },
+  };
+  const r = renderTask(BASE_TASK, { grade });
+  await r.boot(); await settle();
+  const html = r.html();
+  assert.match(html, /tk-axis__n">quality<\/span><span class="rec-pill rec-pill--warn rec-pill--sm">concerns</, 'concerns is amber');
+  assert.match(html, /tk-axis__n">hacker<\/span><span class="rec-pill rec-pill--danger rec-pill--sm">fail</, 'fail is red');
+  assert.match(html, /tk-axis__n">efficiency<\/span><span class="rec-pill rec-pill--danger rec-pill--sm">error</, 'an errored worker says so, in red');
+  assert.match(html, /<span class="rec-pill rec-pill--danger">verdict fail<\/span>/);
+  assert.match(html, /tk-score__v">4\.5</);
+});
+
+test('no grade draws no grade panel at all; an unavailable panel is one honest line', async () => {
+  for (const opts of [{}, { grade: null }]) {
+    const r = renderTask(BASE_TASK, opts);
+    await r.boot(); await settle();
+    assert.ok(!r.html().includes('id="task-grade"'), 'nothing — no placeholder, no "no grade yet"');
+    assert.ok(!/rec-sec__h">Grade</.test(r.html()), 'not even the heading');
+  }
+  const r = renderTask(BASE_TASK, { grade: { passed: false, score: null, signals: { panel_outcome: 'unavailable', workers: [] } } });
+  await r.boot(); await settle();
+  const html = r.html();
+  assert.match(html, /id="task-grade"/);
+  assert.match(html, /could not run when this task was shipped/, 'an outage is data, and reads as one');
+  assert.ok(!html.includes('tk-axis'), 'no empty worker cells');
+  assert.ok(!html.slice(html.indexOf('id="task-grade"')).split('<p class="rec-sec__h">Actions')[0].includes('<span class="rec-pill'), 'and no verdict pill where none was reached');
+});
+
+test('the session log: when, who, how long, the outcome, what it paid, the handoff, the way to Sessions — newest first', async () => {
+  const older = { ...SESSION, id: '0', builder_id: '7', display_name: 'Someone Else', started_at: '2026-08-29T10:00:00Z', ended_at: '2026-08-29T12:05:00Z', outcome: 'partial', notes_md: '' };
+  const r = renderTask({ ...BASE_TASK, credits_awarded: 60 }, { sessionLogs: [SESSION, older] });
+  await r.boot(); await settle();
+  const html = r.html();
+  const start = html.indexOf('id="task-sessions"');
+  const end = html.indexOf('<p class="rec-sec__h">Actions');
+  assert.ok(start > 0 && end > start, 'the session log renders, before the actions');
+  const sec = html.slice(start, end);
+  assert.match(sec, /<p class="rec-sec__h">Session log <em>2 sessions<\/em><\/p>/);
+  const ledgers = sec.split('<div class="tk-ledger">').slice(1);
+  assert.equal(ledgers.length, 2);
+  assert.match(ledgers[0], /<span class="tk-lk">Session<\/span><span class="tk-lv">2026-08-30, <a class="rec-dep" href="\/profile\?id=95">Percy Jackson<\/a>, 37m<\/span>/,
+    'date, the builder as a link to their profile, the duration');
+  assert.match(ledgers[0], /<span class="rec-pill rec-pill--sm rec-pill--ok">shipped<\/span>/, 'the outcome in the state vocabulary');
+  assert.match(ledgers[0], /<span class="tk-lk">Credits awarded<\/span><span class="tk-lv">60<\/span>/, 'what the task paid, on the session that shipped it');
+  assert.match(ledgers[0], /<details class="tk-handoff"><summary>Read the handoff notes<\/summary><div class="rec-desc rec-md"><p><strong>What shipped:<\/strong><\/p>/,
+    'the handoff renders through the reader, behind a disclosure');
+  assert.match(ledgers[0], /<a class="rec-dep" href="\/sessions">Open in Sessions<\/a>/, 'the way to the full log');
+  assert.match(ledgers[1], /Someone Else<\/a>, 2h 05m/, 'the earlier session follows, with its own duration');
+  assert.match(ledgers[1], /rec-pill--sm rec-pill--warn">partial</, 'partial is amber');
+  assert.ok(!ledgers[1].includes('Credits awarded'), 'no pay row on a session that did not ship');
+  assert.ok(!ledgers[1].includes('tk-handoff'), 'no handoff row without a note');
+});
+
+test('no session log draws nothing', async () => {
+  for (const opts of [{}, { sessionLogs: null }, { sessionLogs: [] }]) {
+    const r = renderTask(BASE_TASK, opts);
+    await r.boot(); await settle();
+    assert.ok(!r.html().includes('id="task-sessions"'), 'nothing at all');
+    assert.ok(!/Session log/.test(r.html()));
+  }
+});
+
+test('the claim ledger lists the earlier claims under the current one, and the "most recent only" caveat is gone', async () => {
+  const last = { builder_id: '95', github_login: 'jaxri', claimed_at: '2026-08-30T17:41:00Z', released_at: '2026-08-30T18:18:00Z', outcome: 'shipped' };
+  const claims = [
+    { ...last, claim_id: '2', display_name: 'Percy Jackson' },
+    { claim_id: '1', builder_id: '7', github_login: 'other', display_name: 'Someone Else', claimed_at: '2026-08-29T10:00:00Z', released_at: '2026-08-29T12:05:00Z', outcome: 'abandoned' },
+  ];
+  const r = renderTask(BASE_TASK, { lastClaim: last, claims });
+  await r.boot(); await settle();
+  const html = r.html();
+  assert.match(html, /<p class="rec-sec__h">Claim <em>2 claims<\/em><\/p>/);
+  assert.match(html, /Last claimed by <b>jaxri<\/b>/);
+  assert.match(html, /<ul class="rec-files tk-claims"><li><a class="rec-dep" href="\/profile\?id=7">Someone Else<\/a> · 2026-08-29 · abandoned<\/li><\/ul>/,
+    'the earlier claim: who, when, how it ended');
+  assert.ok(!html.includes('never the full ledger'), 'the caveat no longer holds, so it is gone');
+  // Without the ledger on the read (an older stub), the section reads as it did.
+  const r2 = renderTask(BASE_TASK, { lastClaim: last });
+  await r2.boot(); await settle();
+  assert.match(r2.html(), /<p class="rec-sec__h">Claim<\/p>/);
+  assert.ok(!r2.html().includes('tk-claims'));
+});
+
+test('task.css declares the new shapes with tokens only — no literal colour, no accent', () => {
+  const css = decomment(read('task.css'));
+  for (const sel of ['.tk-axes', '.tk-axis__n', '.tk-score__v', '.tk-crumb', '.tk-ledger', '.tk-lrow', '.tk-lk', '.tk-lv', '.tk-handoff > summary']) {
+    assert.ok(css.includes(sel), `${sel} is styled`);
+  }
+  assert.doesNotMatch(css, /#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(/, 'every colour is a token');
+  assert.doesNotMatch(css.slice(css.indexOf('.tk-axes')), /--accent/, 'the grade and session shapes never borrow the accent (the lifecycle rail above them lights its one beat with it, by design)');
+  assert.match(css, /\.tk-handoff > summary \{[^}]*min-height: 24px/, 'the disclosure is a 24px control');
+});
+
+test('the mocks no longer mark the two regions proposed — they are built', () => {
+  for (const v of ['v1', 'v3']) {
+    const mock = fs.readFileSync(path.join(ROOT, 'docs', 'design', 'mocks', 'hall', 'task', `${v}.html`), 'utf8');
+    assert.ok(!/class="(panel|sec) proposed"/.test(mock), `${v}: no dashed proposed panel`);
+    assert.ok(!mock.includes('<em>proposed</em>'), `${v}: no proposed eyebrow`);
+  }
+});