@bongos/core 1.19.491 → 1.19.493

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.491",
-  "core_contract": "1.19.491",
-  "source_commit": "7c6f9058ca961e49439235e4aec6dd39a3ffe68a",
+  "core_version": "1.19.493",
+  "core_contract": "1.19.493",
+  "source_commit": "555a6e26ed0d472d1349e2897e3c4d652822aad4",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T22:49:35.926Z",
+  "built_at": "2026-09-02T23:20:09.143Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 422,
+    "docs_redacted": 423,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1855,
+    "functional_verbatim": 1859,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2301,
-  "tree_sha256": "f8d28b162d783a50b0d62ba88bf1ac779f94f646c0b53e4d58b7553bc1385804",
+  "file_count": 2306,
+  "tree_sha256": "73851bac69c6ce46da2367b50f0b5d00c2b76bf12efdce650349ef737305b318",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "8713ee79dc2598ff009c061fd3ba3078e26138a5ffe59377531b1fcd468bcbdc"
+      "sha256": "7904ca2bfec8710c90bd846edb4c0b50436eebc29fcb87897eea69fea09d1001"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "f7eb7547af970135ddc0ba95e5fcb0d90c00c7a4d419d233bd205597ec490af6"
+      "sha256": "4f6b441e36573c71d391a24b76247df79db02a46bf719965bee22051a90c916f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "1ebe647295155290431dd30de7f725b8ae14f6a0f5f992a9934fc1e9691adfaa"
+      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c7de731aac661fc6af71177c150d0ab5c6df7d443001af6f9c493822fff50340"
+      "sha256": "8def1c72bdee7bed83886ed5d0eb5f0bd185f1661ee5613c431cd6106e3f49dc"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "3403c459b72b36c20e13a9db9660da3b52bb3599617fe25d65df4b4952c46179"
+      "sha256": "1bf4942a3074fa90887b3efdcff39bde587abc6d8b70b4b83a2dea149beaa85a"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1669,20 +1669,25 @@
       "mode": "0000644",
       "sha256": "240b71442e189fd1167ad0b339dc389d55b77d83aa45c676a7e29f573645b681"
     },
+    {
+      "path": "docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md",
+      "mode": "0000644",
+      "sha256": "69db7f69b30eb87a8b8e921ea664344faf7b953c7a85ce9d788282a0e181dbd1"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "ae62470871555cc058b9045eb261c5ec27fb3a124eaa8293f47c894a7d1c4b37"
+      "sha256": "8c8285dcd86e937c0f09b18839fe9628ae845cd4f4f9d332d723cf216e88deac"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "ac663f05ab9f10410c950e2dc55d5bd87f214ae641bcb6cafa4e8865f5580796"
+      "sha256": "1388440a16b1563120683f32ad285c9234c636f54c49a293bc7c1e9aabe55b53"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "02a898c6b9f95eadef6bcfb900298e71e9e9bacc99003126e05824ef354de2ca"
+      "sha256": "32f6db18d82e0bd79d2346f9fb5c9176473eae3beaf6c4f34ffca958a5790bc6"
     },
     {
       "path": "docs/architecture.md",
@@ -1707,12 +1712,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "86eb1bbcd8457069f957c6d46244481450e177ead7dff06bfb4db0e81eab7ee3"
+      "sha256": "ff30c55a613e2a81c1b03114810d73e6fb5e8c4ea9dd2071171e749ebecfc4f6"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "0fe9dc2df8e22113b9d5ae7d18b762be3e0f05d546989905e6ba2cd37c72049b"
+      "sha256": "0fe0ea407c373ba9ef054a29bbfe16e3d76a53e3bc51391073615a73d9d42aab"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -1832,7 +1837,7 @@
     {
       "path": "docs/design/mocks/hall/task/v1.html",
       "mode": "0000644",
-      "sha256": "be56f2ed76913527567f32647b86ee166f6fba257d2343c101f43047e8ffca5a"
+      "sha256": "17424d5f6a26f9bc0281d733104701668efd4019ab66df1f9623b7e850adf7a3"
     },
     {
       "path": "docs/design/mocks/hall/task/v2.html",
@@ -1842,7 +1847,7 @@
     {
       "path": "docs/design/mocks/hall/task/v3.html",
       "mode": "0000644",
-      "sha256": "95bf5ad5ad864b8b12df0b7b0f5f27ed9f4d67a9b722745b0c1e1b0c4a997b0f"
+      "sha256": "e7e5614c0b6250a1d3e7746659654c5b26827119709171032e166cc5ed701f06"
     },
     {
       "path": "docs/design/mocks/hub/assets/r3-space-deepfield-half.jpg",
@@ -2152,7 +2157,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "278f6b28c464c05735307b791bcdfe60319c87c7d1d2295286174dd84b09bfdd"
+      "sha256": "60398ae5544a8af7d591d59e7efd5b95614350d53933b98ce133daf6788c9c5b"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2162,7 +2167,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "946a1c2234ae65a5474c6c60871c5c82e0ca9e3726cf02f099b7c43fa3c22c02"
+      "sha256": "f08b4a0d71d24c26c48f74dd177c4e165d689931d8c140ccfe3f7386a778aa17"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3272,7 +3277,12 @@
     {
       "path": "modules/copy-desk/module.json",
       "mode": "0000644",
-      "sha256": "fab0432813f79c3db41d8d7a4859d7173b93170af6b482978d3d4785602c03aa"
+      "sha256": "6bbfd4ff3aec4fbd5692747b734ae9bc683ad47b0743aea60d937c7e646bc43e"
+    },
+    {
+      "path": "modules/copy-desk/proposals.js",
+      "mode": "0000644",
+      "sha256": "b05aefb7fb7f965b92389986b6e53991823abb8c1e8a03e88637ef3d065100c0"
     },
     {
       "path": "modules/copy-desk/registry.js",
@@ -3282,7 +3292,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "a0b61896134bbd60d9aa6146ed3fb2623de37a400043e4165867436d60374cd4"
+      "sha256": "1d371bc5e850f12a1e261eb1d4409cb4462943ad0020ae629a3858d2f7063235"
     },
     {
       "path": "modules/copy-desk/tests/copy_flags.mjs",
@@ -3292,7 +3302,12 @@
     {
       "path": "modules/copy-desk/tests/copy_no_cms.mjs",
       "mode": "0000644",
-      "sha256": "ddd1e59deaa737950b564436b670118e52c91050620cb034bb76a95d7cb13176"
+      "sha256": "2da96945940ab8e27164913e520a0cbe7ba5291967f9cc7e524feed8d26eb082"
+    },
+    {
+      "path": "modules/copy-desk/tests/copy_proposals.mjs",
+      "mode": "0000644",
+      "sha256": "86b7f54494e94407745e46290263ed4463fdb10e5d320276bcb199667ca52097"
     },
     {
       "path": "modules/copy-desk/tests/copy_queue.mjs",
@@ -3522,7 +3537,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "1ebe647295155290431dd30de7f725b8ae14f6a0f5f992a9934fc1e9691adfaa"
+      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4097,22 +4112,22 @@
     {
       "path": "modules/hall-ui/public/copy-desk.css",
       "mode": "0000644",
-      "sha256": "93221e477392f2a9fc131b53ba66a7c41b4dc2fc6fab6ce796c0d072a58a0d29"
+      "sha256": "8c44e1147a48d906d354cbd87a196c805c6aa813ce8b8d658402d6d1681622ef"
     },
     {
       "path": "modules/hall-ui/public/copy-desk.html",
       "mode": "0000644",
-      "sha256": "fb2aa38810c78e6285268588b1f9c2f3dc705683557f820606a3f392af2f805d"
+      "sha256": "96b2dac4c916f1912bd5b5b954bbdea598581e4213cc905ea2ee4db7583d115d"
     },
     {
       "path": "modules/hall-ui/public/copy-desk.js",
       "mode": "0000644",
-      "sha256": "c39d18bc798ff6a084092a63b3d684079720c8864bd42c2f631d602bfe78e570"
+      "sha256": "a9943681bde027ba6fba7623d6ae0f07ea710f52c2bf111453b9ed9c4ecfef03"
     },
     {
       "path": "modules/hall-ui/public/copy-desk.states.json",
       "mode": "0000644",
-      "sha256": "fb39c8d4ecdf3f36ac74560df924400237573a9be483e9e3b6163153d7d5c8b1"
+      "sha256": "d820ae78793fb58dccd497a1ad3e5668f184b134a2addd053f49cb5e43716d82"
     },
     {
       "path": "modules/hall-ui/public/copy-on-click.js",
@@ -4637,7 +4652,7 @@
     {
       "path": "modules/hall-ui/public/task.css",
       "mode": "0000644",
-      "sha256": "3b83e71024d268146d72bbef7c15d071056a5e537896fb82239707ecb0d55764"
+      "sha256": "c811a3aafeb8e792315b5ac77c637f31d00169e9ba9e4007f897c276f418f935"
     },
     {
       "path": "modules/hall-ui/public/task.html",
@@ -4647,12 +4662,12 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "8410d1236a0d990566e1d840a21526ad0baf57344dda469b8faadfc0daaab1ef"
+      "sha256": "58776fd75f82144019b4e94fb31e32a7ba75dad991be6a95c56c9682317abe47"
     },
     {
       "path": "modules/hall-ui/public/task.states.json",
       "mode": "0000644",
-      "sha256": "befd2edcf337712426f900ed7619ffc5a41b3559d34fb98d2dcaf7268e96b5ad"
+      "sha256": "fb7112aff3834f88305e9705335dd6b0527cc1cea8f4a1b7d5842b377437da9e"
     },
     {
       "path": "modules/hall-ui/public/triumph.wav",
@@ -4817,7 +4832,7 @@
     {
       "path": "modules/lifecycle/db-claim-reads.js",
       "mode": "0000644",
-      "sha256": "f927a56ba06659ffb51bf744edd80352da52fd0e7eac9c705cfaa00aaaba2ec7"
+      "sha256": "9c8f0af3a00c0b9844196cc94b89bf3dd6fd04bf2f5a8d135fe4e43267ac0d7a"
     },
     {
       "path": "modules/lifecycle/db-claims.js",
@@ -4872,7 +4887,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "1bcdab1b402f5222b7e05824fee64f3fbab895f3bd4f8ab17c1c0a5438353c53"
+      "sha256": "fb179db8a33c20f06e2805fe4d813efd91ac0eb80fdedc701671fde50e884ad2"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -4952,7 +4967,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "8631c6ce8a2d33631f9dc549a47102cdb8121484b98cb759151e10e2be9af4c5"
+      "sha256": "d65493ef08cb6373a7f8d22d27e12b5990bc0a60bc4d734fd9df41591d6374a1"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -5082,7 +5097,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "87b2e23ceedac103b61007348976c257a2961954a4853ce5ff3be0e2f74a4ede"
+      "sha256": "0bbf26870c5959ef6101c535e9a3987d2177d2a8d1b6c91bded9c31350836165"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -6797,12 +6812,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ca75c416a0104e2e57e5b9c45d2b74b1c6ddbf5de524ff487df095134634b53d"
+      "sha256": "cf38af2ed94e3c8e0e37ad7ccb13c1d0be2229a46541b72b149807554ba09f47"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "91a2d397dca70394d2ca4d7f40e942f18672449781d8f08446ab8fdd8ddd9437"
+      "sha256": "2214a9bca120dfe87c3b7b611c1733c86ed95f5d715ab25aa6b46a7d4305dd89"
     },
     {
       "path": "public-docs/index.html",
@@ -7084,10 +7099,15 @@
       "mode": "0000644",
       "sha256": "270101b46772cc8e280bc5a36f66cfae578a901f07b4b5e1f959c9a566ebb5fd"
     },
+    {
+      "path": "scripts/gds/copy-apply.js",
+      "mode": "0000644",
+      "sha256": "4b99eabcfcb8c6c472a2161427fc22a43b3208b5fbfc1ffe097e8f1926a44216"
+    },
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
-      "sha256": "c799e9be90b437d83795e13a28f3f22eabc46d27b1a1331f41decced20a21be2"
+      "sha256": "8c798359b51abdd749233e65aa5906732bccc5b9088dae32513cde7949404b6c"
     },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
@@ -8462,7 +8482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ad32edff429153aa8a1231a90be444f349bdbcd38b4940011a10f41c86b2e2fb"
+      "sha256": "175a69332addde58537530b703f16d57631da7a935d3c9ff362ded4ac574da0d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9852,7 +9872,7 @@
     {
       "path": "tests/hall_collab_world.mjs",
       "mode": "0000644",
-      "sha256": "b477954a1c691c367e566ddaa7f3c7c877e6ac61670c1d817da4dbff9b5efbff"
+      "sha256": "d5608c37de6e17a7ec4c0bb48e0815b7df2726609933baebad8975739a343d2d"
     },
     {
       "path": "tests/hall_error_envelope.mjs",
@@ -9897,7 +9917,7 @@
     {
       "path": "tests/hall_record_world.mjs",
       "mode": "0000644",
-      "sha256": "e58c1f81f68fe6266dfb44d96b0ff1f01f3b1f7fa759cf26b10d8c3ee0ea1344"
+      "sha256": "a810f02a8a82968a4d4742caa2b2c43608f69cee1d3442dd83a8faaec307ebd4"
     },
     {
       "path": "tests/hall_reference_world.mjs",
@@ -11329,6 +11349,11 @@
       "mode": "0000644",
       "sha256": "fd2fe04c41ee6c739c338b04eb33b8e37ef634b3e2e25f0c041358fcab209bf0"
     },
+    {
+      "path": "tests/task_detail_includes.mjs",
+      "mode": "0000644",
+      "sha256": "1e4d480e64d915be750d5bb9581f2da83767800daa7769a551103bc00ca79497"
+    },
     {
       "path": "tests/task_goal_link.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 344 operations across 53 resource groups
+- 345 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -287,6 +287,8 @@ function createClient(opts = {}) {
       postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
       // POST /copy-desk/flags/{id}/close — rank: any-builder — POST /copy-desk/flags/:id/close
       postCopyDeskFlagsIdClose: (args) => request("POST", "/copy-desk/flags/{id}/close", { hasBody: true }, args),
+      // POST /copy-desk/proposals — rank: any-builder — POST /copy-desk/proposals
+      postCopyDeskProposals: (args) => request("POST", "/copy-desk/proposals", { hasBody: true }, args),
       // GET /copy-desk/queue — rank: any-builder — GET /copy-desk/queue
       getCopyDeskQueue: (args) => request("GET", "/copy-desk/queue", { hasBody: false }, args),
       // GET /copy-desk/strings — rank: any-builder — GET /copy-desk/strings

package/clients/bongos-client/index.cjs

@@ -286,6 +286,8 @@ function createClient(opts = {}) {
       postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
       // POST /copy-desk/flags/{id}/close — rank: any-builder — POST /copy-desk/flags/:id/close
       postCopyDeskFlagsIdClose: (args) => request("POST", "/copy-desk/flags/{id}/close", { hasBody: true }, args),
+      // POST /copy-desk/proposals — rank: any-builder — POST /copy-desk/proposals
+      postCopyDeskProposals: (args) => request("POST", "/copy-desk/proposals", { hasBody: true }, args),
       // GET /copy-desk/queue — rank: any-builder — GET /copy-desk/queue
       getCopyDeskQueue: (args) => request("GET", "/copy-desk/queue", { hasBody: false }, args),
       // GET /copy-desk/strings — rank: any-builder — GET /copy-desk/strings

package/clients/bongos-client/index.d.ts

@@ -230,6 +230,8 @@ export interface PostCopyDeskFlagsIdCloseRequest { status: string; resolution_no
 export interface PostCopyDeskFlagsIdCloseResponse { ok: boolean; flag: unknown }
 export interface PostCopyDeskFlagsRequest { scope?: string; surface: string; string_id?: string; reason: string; kind?: string }
 export interface PostCopyDeskFlagsResponse { ok: boolean; flag: unknown }
+export interface PostCopyDeskProposalsRequest { string_id: string; proposed_text: string; why: string; file?: string; line?: number; flag_id?: number }
+export interface PostCopyDeskProposalsResponse { ok: boolean; task: unknown; created: boolean; patch?: unknown }
 export interface PostCostRequest { task_id?: number; amount_usd: number; category: string; description?: string; source?: string; source_ref?: string; recorded_at?: string; fresh_input_usd?: number; cache_read_usd?: number; cache_write_usd?: number; output_usd?: number; builder_id?: number; skill_name?: string }
 export interface PostCostResponse { skipped?: boolean; reason?: unknown; id?: unknown; recorded_at?: unknown }
 export interface PostDependenciesResponse { ok: boolean; dependency: unknown }
@@ -595,6 +597,8 @@ export interface BongosClient {
     postCopyDeskFlags(args: RequestArgs & { body: PostCopyDeskFlagsRequest }): Promise<PostCopyDeskFlagsResponse>;
     /** POST /copy-desk/flags/{id}/close — rank: any-builder */
     postCopyDeskFlagsIdClose(args: RequestArgs & { body: PostCopyDeskFlagsIdCloseRequest }): Promise<PostCopyDeskFlagsIdCloseResponse>;
+    /** POST /copy-desk/proposals — rank: any-builder */
+    postCopyDeskProposals(args: RequestArgs & { body: PostCopyDeskProposalsRequest }): Promise<PostCopyDeskProposalsResponse>;
     /** GET /copy-desk/queue — rank: any-builder */
     getCopyDeskQueue(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /copy-desk/strings — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -283,6 +283,8 @@ export function createClient(opts = {}) {
       postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
       // POST /copy-desk/flags/{id}/close — rank: any-builder — POST /copy-desk/flags/:id/close
       postCopyDeskFlagsIdClose: (args) => request("POST", "/copy-desk/flags/{id}/close", { hasBody: true }, args),
+      // POST /copy-desk/proposals — rank: any-builder — POST /copy-desk/proposals
+      postCopyDeskProposals: (args) => request("POST", "/copy-desk/proposals", { hasBody: true }, args),
       // GET /copy-desk/queue — rank: any-builder — GET /copy-desk/queue
       getCopyDeskQueue: (args) => request("GET", "/copy-desk/queue", { hasBody: false }, args),
       // GET /copy-desk/strings — rank: any-builder — GET /copy-desk/strings

package/docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md

@@ -0,0 +1,151 @@
+# 0233 — A copy proposal is a task carrying a patch, and the applier is the only writer
+
+- **Status:** Accepted
+- **Date:** 2026-09-02
+- **Tasks:** [#1003114](https://cloudbongos.com/builders#/task/1003114) (R03 of goal 1000074, the artist's loop) — builds on [#1003112](https://cloudbongos.com/builders#/task/1003112) (R01, the registry) and [#1003113](https://cloudbongos.com/builders#/task/1003113) (R02, the flag and the queue)
+- **Extends:** [ADR 0081](<redacted>.md) — the repo is the source of truth, with swappable tool adapters that land their output as a committed diff. This applies that contract to TEXT.
+- **Extends:** [ADR 0178](<redacted>.md) — which pinned that `copy_desk_flags` may never hold replacement text, and named this task as the one that would have to keep that true while adding an editing affordance.
+- **Related:** 0083 (module system, ports), 0086 (goals), 0016 (authority resolved server-side), 0162 (a verdict is advisory, never self-executing), 0197 (the ui-design module)
+
+## Context
+
+Goal 1000074 asks for two things that pull against each other, and says so in its own text.
+
+The artist must be able to **change copy without an engineer** — that is the criterion
+`artist-edits-land-as-tasks`. And there must be **no live CMS**: "every copy change is a claimed,
+graded, shipped GDS task ... never a write path that bypasses the ledger."
+
+R02 built the half that needs no reconciliation: the **flag**, a judgement with a pointer. It
+deliberately shipped with no way to say what the copy *should* say, because the obvious place to put
+that — a column beside the flag — is one plausible read away from making the copy desk a copy source.
+ADR 0178 §3 pinned the absence and named the erosion path: not a dramatic "add a CMS" commit, but one
+plausible column, then one plausible read of it, and the ledger rule is dead with nobody having
+decided to kill it.
+
+So R03 is the load-bearing one. An affordance that edits, and a ledger that must record every edit,
+are one bad column apart from being incompatible.
+
+## Decision
+
+### 1. The shape is borrowed from the design half, not invented
+
+ADR 0081 already solved this exact problem for *form*. A tool authors; `adapter.export()` lands the
+tool's output into the repo as a committed diff under a claimed task, inside a path guard; the repo
+stays the source of truth and the tool never writes to production. The `ui-design` module has run
+that contract for design tokens and component surfaces since ADR 0197.
+
+**A copy proposal is that same contract for text.** The artist is the tool, the copy desk is where
+they author, and the proposal is the export. Nothing about this needed a new idea — it needed the
+existing one applied to the other half of the design contract, which is what makes the two halves
+read as one system rather than two features that happen to share a goal.
+
+### 2. The proposal lives on the TASK, as a fenced patch — not in a table
+
+`POST /copy-desk/proposals` creates a **GDS task** whose description carries a ```` ```copy-proposal ````
+block: schema, string id, surface, file, line, render path, the current wording and the proposed one.
+
+This is the whole answer to the tension, and every part of it is doing work:
+
+- **The ledger is where a proposal belongs anyway.** The methodology already requires every change to
+  be a claimed task. A proposal is a change that has not happened yet, so the task IS the record —
+  not a shadow of one kept somewhere else and reconciled later.
+- **Nothing renders a task description as product copy**, so the wording has no path to a reader that
+  does not pass through a claim, a diff and a grade.
+- **A fenced block is readable by the reviewer and parseable by the applier.** The point of a proposal
+  is that it is arguable before it lands; a reviewer has to be able to see the change without running
+  anything.
+- **`copy-desk` gains no migration.** `tests/copy_no_cms.mjs` asserts the module still has exactly one,
+  because the obvious-but-wrong implementation of R03 is a `copy_desk_proposals` table — which is
+  ADR 0178's forbidden column with extra steps.
+
+The module's manifest gains `consumes: ["lifecycle"]` and calls `lifecycle.createTask` through the
+kernel port. That direction is the safe one and is the point: this module can put a work request
+**into** the ledger, and nothing can pull copy **out** of this module. `provides` stays empty.
+
+### 3. The applier re-derives the position; the registry never stores one
+
+`scripts/gds/copy-apply.js` is what whoever claims the task runs. It does **not** trust the patch's
+line number. It re-runs R01's own extractor over the working tree, finds the occurrence there, and
+replaces exactly the characters that string occupies.
+
+That required teaching the extractor to record a **source span** alongside every string it finds —
+and deliberately **dropping it from the committed registry**. An offset goes stale the moment anything
+above it in the file changes, while the registry's id is designed to survive precisely that movement;
+a committed offset would be wrong far more often than the id ever is. So the span is a live fact,
+recomputed at the moment of the edit, by the same code that decided the string was copy in the first
+place. One set of matching rules, in one file, used by both the inventory and the applier — which is
+what stops the applier from editing a byte the inventory would never have called copy.
+
+The registry's committed bytes are unchanged by this; `--check` and `tests/copy_inventory.mjs` are
+what prove it.
+
+### 4. The placeholder arithmetic is the rule that makes a patch mechanical
+
+The registry writes `{…}` where the source has `${expr}`, so an artist edits a readable sentence with
+holes in it. The applier puts the source's **own** expressions back, the k-th hole taking the k-th
+expression — so an artist may move a value within a sentence (`Hello ${name}, welcome back` →
+`Good to see you, ${name} — welcome back`) but may not add or drop one. The count is checked when the
+proposal is made **and again against the real source** at apply time, because the source is what is
+about to be written.
+
+That single rule is what turns "a note for an engineer" into "a change that lands with one command",
+which is the difference between meeting the criterion and describing it.
+
+### 5. Every ambiguity is a named refusal, because a wrong edit is worse than no edit
+
+The applier refuses, by name and with the reason on one line, when: the wording is already gone
+(`target_gone`), the sentence appears at several sites and the line does not disambiguate
+(`ambiguous_target`), the literal is escaped so no exact span exists (`no_exact_span`), the
+placeholder count does not hold (`placeholder_mismatch`), or the file is outside the surface the
+registry defines (`path_outside_surface` — the direct analogue of the design adapter's path-escape
+guard, derived from R01's own `SURFACES` rather than a second list).
+
+None of these means the wording was wrong. They mean a person should look. And after writing, the
+applier regenerates the registry and **checks that what it wrote is what the inventory now reads** —
+an independent read of the file it just edited.
+
+### 6. The command takes no id, because the task cannot know its own
+
+A proposal task has to print the exact line that lands it, and its description is composed *before*
+the row exists. Every way of closing that gap is worse than the rule it would paper over — a
+placeholder is a step for the claimer to get wrong, and a second write to patch the description in
+afterwards buys a port widening and a failure mode for a string.
+
+So the bare call, `node scripts/gds/copy-apply.js`, acts on **the task the caller is holding**.
+Holding no claim is a named refusal that says to claim it first. The command may only run under a
+claim — that is the whole feature — and a claim already names a task, so the constraint and the
+ergonomics are the same fact. `--task <id>` remains for someone holding several.
+
+### 7. Proposing is open to every rank, and lands in `backlog`
+
+Same floor as filing, for ADR 0178 §4's reason: an artist is a craft, not a rank, and a rank floor
+would hide the loop from the people most likely to use it. The quality gates are the required `why`
+(the same judgement floor a flag's reason carries), the placeholder arithmetic, and the fact that the
+target is resolved **server-side from the registry** — a caller cannot describe a change to a
+sentence that does not exist.
+
+The task is created at `backlog`, so a proposal is a *request*: it needs the board's ordinary triage
+before anyone can claim it. Landing it `ready` would let anyone with an opinion mint claimable work.
+
+## Consequences
+
+- **The write surface of `copy-desk` is now three verbs, not two**, and `tests/copy_no_cms.mjs` says so
+  in a diff a reviewer can see — which is exactly what R02 built that list for.
+- **`scripts/gds/copy-apply.js` is the only thing in this feature that writes a surface file**, it is a
+  command rather than a route, and the test asserts no file in the module's request path imports it.
+  Naming it is fine and required: the task tells its claimer the exact line to run.
+- **The `lifecycle` port gained `findTaskBySourceRef`** so a double-submitted proposal resolves to the
+  task it already made. A genuinely different second attempt at the same string is a new task, which
+  is right — two people can disagree about the fix, and the board should hold both.
+- **A proposal targets ONE occurrence.** When a string is shown in several places the caller must say
+  which, and the refusal points at the duplicates the copy desk already surfaces. Rewording a sentence
+  said in seven places is usually the wrong answer to it being said seven times.
+- **A quoted literal containing an escape has no span**, so ~9 of ~1,600 inventoried strings cannot be
+  patched by command and are refused by name. Buying them would mean an escape-aware index map — a
+  second place for the escaping rules to be wrong, for nine strings.
+- **The copy desk route file moved off `console.error` to the doorway's `api.logger`**, the seam
+  builder-settings / dev-box / ideas / government already use. Structured, attributable, and it keeps
+  an error's stack instead of stringifying it.
+- **R05 still owns the hard question.** Nothing here gates a ship. Whether an artist's judgement can
+  ever block, and how that coexists with ADR 0162, is R05's to decide — a proposal is a work request
+  by construction until it does.

package/docs/adr/README.md

@@ -320,4 +320,6 @@ This keeps the decision history honest and traceable.
 | 0226 | [**One stale-claim timer; reporting degrades where enforcement refuses** ([task 1003476](https://cloudbongos.com/builders#/task/1003476), goal 1000072, criterion `legibility-sort-and-staleness`). "How long may a claim go silent" had FOUR answers and none of them was the project's: the sweeper that actually releases a claim read `GDS_STALE_CLAIM_HOURS` (else 6h); `GET /builders/roster` and `GET /builders/:id/active-claims` each hardcoded 24h in byte-identical blocks; and the two `session_pulses` helpers defaulted to 30 minutes. The 6-vs-24 pair is the harm: the roster is the screen an Archon opens to decide whether to intervene, and for **eighteen hours** after the sweeper had released a claim, stamped its session log `[auto-released:stale]` and returned the task to `ready`, that screen still showed it healthy — while the roster's own comment claimed to "mirror" the sweeper, true of the definition and false of the number. Decision: ONE resolver, `src/stale-timer.js` (a KERNEL file, the `instance-config.js`/`branding.js` category — host config a module reads, never hardcodes), reached by modules through the doorway and by core routes and the CLI directly. Precedence: explicit override (`--threshold-hours`, `?stale_hours=` — a LENS, labelled `query`, never a reconfiguration) → `<PREFIX>_STALE_CLAIM_HOURS` via `instance-config.resolveEnv`, whose legacy prefix chain still honours the live `GDS_STALE_CLAIM_HOURS` so **nothing in a running deployment has to change** (and which is the channel ADR 0190's runner already patches into `web.env`) → **6**, the SWEEP's historical number and deliberately not the roster's 24, because the sweep is the surface that acts and unifying on 24 would have made every project three times more patient with a dead claim under cover of a refactor. Bound 1..720h — the range `/builders/roster` has published since V3.R14; one timer, one bound. Every surface that prints the timer prints its PROVENANCE (`stale_hours_source`, the sweep header, the auto-release note): a number without it is exactly what let 6 and 24 coexist unnoticed. **The fail posture is asymmetric and that is the decision**: the resolver reports an unusable value rather than throwing, then a surface that only READS degrades to the default and names the bad var (500-ing the roster an Archon opened to find the problem would hide the problem), while the SWEEP refuses to run at all (it releases other people's claims and stamps their logs; no reload undoes that) — a surface that only reads may guess and say so, a surface that acts may not guess. Both routes now share one `staleHoursFor(req, res)`; two copies of a literal is how the drift happened twice inside one file. Rejected: a new `config/stale.json` tier (the env route already IS the per-project channel); making 24 the shared default; throwing from the resolver (forces a second reader — the original bug); folding in the boards' 14/30/60-DAY task buckets (a different question — days, about a task, a browsing lens with no enforcement behind it); a DB row + settings UI (a reasonable next step, but the defect was four numbers, not a missing knob — a row added before the readers agreed would have been a fifth).](<redacted>.md) | GDS / claims + ops |
 | 0232 | [**Rot is derived, not swept; and `water` is the only new verb** ([task 1003279](https://cloudbongos.com/builders#/task/1003279) · goal 1000072, criterion `legibility-sort-and-staleness`). The inbox half [ADR 0226](<redacted>.md) split out and left open. Owner decision (2026-08-25): a goal or task past the timer raises a **needs-attention line** — not an automatic status change (it mutates real work with no human in the loop, and a wrong timer then silently freezes it) and not a nightly digest (a notification is not an action, and one you scroll past is indistinguishable from the silent decay it was meant to fix). The build note asked for an idempotent poller; the decision is that **there is no poller and no items table** — a line is a `SELECT` comparing the thing's rot clock to the timer, so "exactly one item per stale thing, not one per sweep" is true by arithmetic rather than by deduplication code that must be written correctly and then stay correct, and clearing falls out for free (an edit moves `updated_at`, a decision moves `status`, watering moves the mark). A stored item would have been a cache of a query whose inputs it could not observe. **The exclusions are the load-bearing part**: rot is work nobody picked up (`backlog`/`ready`, and `open` goals), and `active` is deliberately excluded because the claim-silence timer already reports it in hours — listing it here in days would put one rot in two inboxes under two numbers, the 6h-vs-24h split one tier up; `blocked`, `completed`/`confirmed` and the terminal states are excluded for the same reason, each naming the surface that owns it. The clock is **not a new definition of touched** — it is `task-lib.js`'s published `max(updated_at, shipped_at)` (task 1003278) plus a water mark, pinned by a test asserting the domain expression appears verbatim in migration `core_231`'s index expressions, because drift there is silent. The timer is a **second** timer and defends itself as a different question (days vs hours, DB vs env, asks a human vs releases a claim), stored in a new unseeded generic `project_settings` table — no row means "never configured", which is what lets a settings page tell that apart from "set to the default" — with ADR 0226's precedence and its reporting-degrades fail posture, and an unreachable DB explicitly not treated as a bad value. Three of the four verbs (**prioritise/prune/kill**) reuse `promote`/`demote`/`abandon`/`archive`, the task-1003066 precedent, so they add no permission; only `water` is new, gated on ownership OR `builder.roster.read` inside the handler (a creator holding no atom must still get through). Verbs are **served with each row** rather than hardcoded, since a goal legitimately gets two where a task gets four. Rejected: an items table, a sweep, a digest, auto-demotion, and a fourth verb on goals that would render a dead button.](<redacted>.md) | GDS / legibility + hall |
 
+| 0233 | [**A copy proposal is a task carrying a patch, and the applier is the only writer** ([task 1003114](https://cloudbongos.com/builders#/task/1003114) · goal 1000074, criterion `artist-edits-land-as-tasks`). Goal 1000074 asks for two things that pull against each other in its own text: the artist must change copy WITHOUT an engineer, and there must be NO LIVE CMS because every copy change is a claimed, graded, shipped task. R02 shipped the half that needs no reconciliation (the flag) and [ADR 0178](<redacted>.md) §3 pinned the absence of any column that could hold replacement text, naming this task as the one that would have to keep it true. Decisions: (1) the shape is **borrowed from the design half, not invented** — ADR 0081 already has a tool authoring and an `adapter.export()` landing the output as a committed diff under a claim inside a path guard, so the artist is the tool, the copy desk is where they author, and the proposal is the export. (2) A proposal is a **TASK carrying a fenced `copy-proposal` patch**, never a row: the ledger is where a proposal belongs anyway, nothing renders a task description as product copy, a reviewer can read the change without running anything, and `copy-desk` gains NO migration (the obvious-but-wrong R03 is a `copy_desk_proposals` table, which is the forbidden column with extra steps). The module gains `consumes: ["lifecycle"]` and calls `createTask` through the port — it can put a request INTO the ledger and nothing can pull copy OUT of it. (3) `scripts/gds/copy-apply.js` **re-derives the position** rather than trusting the patch, which required teaching R01s extractor to record a source SPAN and deliberately dropping it from the committed registry: an offset goes stale the moment anything above it changes, while the id is designed to survive exactly that movement, so the span is recomputed at the moment of the edit by the same code that decided the string was copy. (4) The **placeholder arithmetic** is what makes a patch mechanical rather than a note for an engineer — the applier puts the sources own `${expr}` back, k-th hole to k-th expression, so an artist may MOVE a value within a sentence but never add or drop one, checked at proposal time and again against the real source. (5) Every ambiguity is a **named refusal** (`target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch`, `path_outside_surface` — the design adapters path guard, derived from R01s own SURFACES), because a wrong edit is worse than no edit; after writing, the applier regenerates the registry and checks that what it wrote is what the inventory now reads. (6) Proposing is **open to every rank** (an artist is a craft, not a rank) and lands at `backlog`, so a proposal is a request that passes ordinary triage. Rejected: a proposals table, a column beside the flag, trusting the patchs line number, an escape-aware index map to buy spans for nine strings, auto-closing the flag a proposal answers.](<redacted>.md) | copy-desk / the artist loop |
+
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.