@bongos/core 1.19.491 → 1.19.493

package/docs/design/mocks/hall/task/v3.html

@@ -185,8 +185,6 @@ h1.recTitle{margin:0 0 18px;font-family:var(--font-display);font-weight:300;font
 .btn--primary:hover{background:var(--accent-lift);border-color:var(--accent-lift);}
 .actNote{margin:0;font-size:14.5px;color:var(--ink-soft);flex:1;min-width:240px;}
 
-/* the proposed regions: their own panel, edged dashed, with a mono eyebrow */
-.proposed{border-style:dashed;}
 .axes{display:grid;grid-template-columns:repeat(4,1fr);border-top:1px solid var(--rule-soft);}
 .axis{padding:16px 18px 18px;border-left:1px solid var(--rule-soft);}
 .axis:first-child{border-left:0;padding-left:0;}
@@ -291,7 +289,7 @@ document.documentElement.setAttribute('data-theme',m);}catch(e){}})();
   THESIS      the hall gets a ground and a chrome: in dark the hall's own rendered plate sits behind the whole shell under its veil, the sidebar and topbar are glass over it, and the record is one calm bg-card panel at 16px radius with the loosest air of the three.
   COMPOSITION first viewport at 1440: a 64px glass rail at the far left that opens to 248px over the content on hover or focus-within, a glass topbar, then one panel holding the TASK eyebrow with its pill, the title at 38px, the meta and goal lines, four figures on hairlines, and the five beat lifecycle rail with credit lit. Everything below is one column at 64ch inside the same panel.
   LIGHT       there is no plate in light and the veil resolves to none, so the ground is plain paper, the glass drops to a 5% ink tint with zero blur (a tint, not a frost), and the page becomes the same composition with the atmosphere removed. Light is the same room on paper, never a black panel.
-  RISK        the plate token ships as none until the hall shoots its own, so today v3's atmosphere is theoretical and the version reads as v2 with rounder corners and more air; once a plate lands, a photographic ground under twenty seven dense pages costs legibility and adds a per page cost the other two do not have. The rail by default trades discoverability for calm: a newcomer sees twenty two unlabelled icons. Regions 15 and 16 (grade, session log) do NOT exist on the shipped page and carry a "proposed" eyebrow; region 9 (the ship visual) draws nothing because task 1003322 shipped without one.
+  RISK        the plate token ships as none until the hall shoots its own, so today v3's atmosphere is theoretical and the version reads as v2 with rounder corners and more air; once a plate lands, a photographic ground under twenty seven dense pages costs legibility and adds a per page cost the other two do not have. The rail by default trades discoverability for calm: a newcomer sees twenty two unlabelled icons. Regions 15 and 16 (grade, session log) were proposed in this round and built by task 1003437; region 9 (the ship visual) draws nothing because task 1003322 shipped without one.
   ?state=populated  the page with real data
   ?state=loading    skeletons in the SHAPE of the final content
   ?state=empty      a real URL for a task that does not exist
@@ -604,10 +602,9 @@ Ships with: the manifest, the apex-root web surface, a nested CLAUDE.md a newcom
       </section>
     </section>
 
-    <!-- region 15: PROPOSED. There is no grade panel on the shipped page. Grades live on
-         Standing (#recent-grades). This round asks for the task's own grade to sit here. -->
-    <section class="panel proposed">
-      <p class="secH">Grade <em>proposed</em></p>
+    <!-- region 15: the grade panel — proposed in this round, built by task 1003437. -->
+    <section class="panel">
+      <p class="secH">Grade</p>
       <p class="body" style="margin-bottom:20px">The adversarial panel of four workers. Every worker must independently report pass before confirmed becomes credits; one concerns falls the task through to the manual confirm path.</p>
       <div class="axes">
         <div class="axis"><span class="axisN">narc</span><span class="pill pill--sm pill--ok">pass</span></div>
@@ -622,10 +619,9 @@ Ships with: the manifest, the apex-root web surface, a nested CLAUDE.md a newcom
       </div>
     </section>
 
-    <!-- region 16: PROPOSED. There is no session log on the shipped page either. Session logs
-         live on /sessions. This round asks for the session that shipped this task to sit here. -->
-    <section class="panel proposed">
-      <p class="secH">Session log <em>proposed</em></p>
+    <!-- region 16: the session log — proposed in this round, built by task 1003437. -->
+    <section class="panel">
+      <p class="secH">Session log</p>
       <div class="ledger">
         <div class="lrow"><span class="lk">Session</span><span class="lv">30 August 2026, Percy Jackson, 37m</span></div>
         <div class="lrow"><span class="lk">Credits awarded</span><span class="lv">60</span></div>

package/docs/file-map.md

@@ -132,7 +132,7 @@
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, pair, not-ready, task 1003308: the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `pair.css` the device row, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
-│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
+│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
@@ -194,6 +194,7 @@
 │       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`
 │       ├── doc-comment-coverage.js ← ADR 0095 / task 1001654: the ADVISORY doc-comment nudge (fitness Check 28) — reports source files under src/·scripts/·modules/ that open with no module header. Never hard-fails: a doc-comment gate that blocks a ship buys filler prose, and making it blocking needs owner sign-off + its own ADR. CRLF-safe (unlike docs-entropy.js); an empty enumeration throws as a scan defect
 │       ├── copy-inventory.js  ← R01 of goal 1000074 (the artist's loop): the COPY REGISTRY — every user-facing string across the hall / status / landing surfaces, each row naming the render path that shows it (html-text · html-attr · js-markup · js-notice · js-text-assign) + a stable id that survives a move. Writes docs/copy-registry.json + docs/copy-inventory.md; `--check` fails on drift. Precision over recall: a JS literal with no render path is not listed
+│       ├── copy-apply.js     ← R03 of goal 1000074 (ADR 0233): lands a copy proposal as a REAL DIFF under a claim — the design half’s adapter.export() applied to text. Reads the fenced copy-proposal patch off a task (--task N; --dry-run, --patch-file), RE-DERIVES the string’s position by re-running copy-inventory’s own extractor over the working tree (the registry commits no offsets — they go stale, the id does not), re-injects the source’s own ${expr} into the proposal’s {…} holes, writes, regenerates the registry and verifies its own edit. Refuses BY NAME on target_gone / ambiguous_target / no_exact_span / placeholder_mismatch / path_outside_surface. The ONLY writer in the copy feature, and deliberately a command rather than a route
 │       ├── gen-diagrams.js      ← generates the 5 onboarding diagrams (`.mmd`/`.svg`/`.png` + `assertions.json`) from templates in this file — never hand-edit a `.mmd`/assertions.json; runs on deploy
 │       ├── gen-api-docs.js      ← ADR 0109: generates `docs/api/openapi.json` + `docs/api-reference.md` from the live route files via `route-rank-check.js` introspection, so the API reference cannot drift from what the server actually mounts
 │       ├── architect-audit.js   ← MAS Phase 5 (ADR 0024): the Architect's bounded first-principles `--scope`/`--paths` audit CLI → `docs/audits/`

package/docs/module-api-changelog.md

@@ -1419,5 +1419,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.489 with no explicit bump. run 33691767867. (task 1002620)
   1.19.491 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.490 with no explicit bump. run 33692191645. (task 1002620)
+  1.19.492 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.491 with no explicit bump. run 33693742388. (task 1002620)
+  1.19.493 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.492 with no explicit bump. run 33694576680. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/copy-desk/module.json

@@ -1,11 +1,11 @@
 {
   "key": "copy-desk",
   "title": "Copy desk (the artist's loop over user-facing text)",
-  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
+  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/gds/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["copy-desk"], "migrations": true },
   "provides": [],
-  "consumes": []
+  "consumes": ["lifecycle"]
 }

package/modules/copy-desk/proposals.js

@@ -0,0 +1,278 @@
+// modules/copy-desk/proposals.js — the PROPOSAL: an artist's replacement wording
+// for one string, carried as a patch on a GDS task (task 1003114 / R03 of goal
+// 1000074, the artist's loop).
+//
+// WHY THIS FILE EXISTS. R02 gave the artist a way to say "this sentence is
+// wrong" (the flag). It deliberately gave them no way to say what it should say
+// instead, because the obvious place to put that — a column next to the flag —
+// is the exact shape goal 1000074 forbids: "NO LIVE CMS ... never a write path
+// that bypasses the ledger" (and ADR 0178 §3, which pins that copy_desk_flags
+// has no column that could hold replacement text and must never gain one).
+//
+// THE SHAPE THAT SATISFIES BOTH HALVES, and it is borrowed rather than invented:
+// ADR 0081 already solved this problem for the DESIGN half. A tool authors, an
+// adapter EXPORTS its output into the repo as a committed diff under a claimed
+// task, and the repo stays the source of truth (modules/ui-design/adapters/*,
+// `adapter.export()`). This is that contract for TEXT. The artist is the tool;
+// the copy desk is where they author; the proposal is the export. So a proposal
+// is not a row this module keeps — it is a PATCH, rendered into the description
+// of a task, which is the ledger the methodology already requires every change
+// to pass through. Nothing renders from it; scripts/gds/copy-apply.js is the
+// only reader, and it runs under a claim.
+//
+// WHERE THE PATCH LIVES, AND WHY IT IS A FENCED BLOCK. It has to be readable by
+// a person reviewing the task (the whole point is that the change is arguable
+// before it lands) and parseable by the applier. A fenced ```copy-proposal block
+// in the task description is both, renders as itself in the hall, and survives a
+// person editing the prose around it. It is deliberately NOT a database column
+// anywhere: a column is one join away from being read as copy, which is the
+// erosion ADR 0178 describes.
+//
+// PURE — no DB, no fs, no clock. Both callers import it: the route
+// (routes/copy-desk.js) composes, the applier (scripts/gds/copy-apply.js)
+// parses, and neither owns a second copy of the format.
+
+'use strict';
+
+// The patch format's version. The applier refuses anything else BY NAME rather
+// than doing its best with a shape it does not know — a half-understood patch
+// edits the wrong characters of a real file.
+const PROPOSAL_SCHEMA = 1;
+
+// The fence tag. Chosen to be unmistakable in a task description and impossible
+// to produce by accident.
+const FENCE = 'copy-proposal';
+
+// The same judgement floor R02 put on a flag's reason, for the same reason
+// (ADR 0178 §2): a proposal with no argument hands a reviewer a diff and no way
+// to decide it, which costs them more than not proposing. The DB CHECK that
+// backs the flag's floor has no equivalent here because there is no row — the
+// floor is enforced at the one write vector, which is this file's caller.
+const MIN_WHY_CHARS = 10;
+const MAX_WHY_CHARS = 2000;
+
+// 400 is the registry's own upper bound on what counts as one string
+// (`looksLikeCopy` in scripts/gds/copy-inventory.js). Proposing something longer
+// than the inventory can hold would produce a patch that lands and then vanishes
+// from the next registry — a change that silently un-inventories itself.
+const MAX_TEXT_CHARS = 400;
+
+// The interpolation hole the inventory writes for `${...}`. A proposal must keep
+// exactly as many as the current text has, in the same order: the applier maps
+// the k-th hole back to the k-th expression it found in the source. Reordering
+// or dropping one is a code change, not a copy change, and is refused by name.
+const PLACEHOLDER = '{…}';
+
+const fail = (code, detail) => ({ ok: false, code, detail: detail ?? null });
+
+// Collapse whitespace runs and trim — the same normalization the inventory
+// applies when it records a string, so a proposal is measured and stored in the
+// form it will actually be compared against.
+function tidy(raw) {
+  return String(raw == null ? '' : raw).replace(/\s+/g, ' ').trim();
+}
+
+function placeholderCount(text) {
+  return String(text || '').split(PLACEHOLDER).length - 1;
+}
+
+// Validate one POSTed proposal into the patch the task will carry.
+//
+// `entry` is the registry occurrence being changed, and it is REQUIRED and
+// server-side. Every fact about the TARGET — surface, file, line, render path,
+// and the current wording — is copied from it and never from the request body,
+// which is R02's rule for a flag's snapshot (ADR 0178 §6) and matters more here:
+// a caller-supplied "current text" would let a proposal describe a change to a
+// sentence that does not exist, and the applier would then be editing a file on
+// the strength of a claim nobody checked.
+//
+// PURE. The caller resolves `entry` from the loaded registry first.
+function normalizeProposalPayload({ body = {}, entry, builderId = null } = {}) {
+  if (!entry || !entry.file || !entry.text) return fail('unknown_target');
+
+  const proposed = tidy(body.proposed_text);
+  const why = tidy(body.why);
+  const current = tidy(entry.text);
+
+  if (!proposed) {
+    return fail('proposed_text_missing', {
+      what_this_means: 'A proposal is a replacement wording. Without one there is nothing to land — file a flag instead if you only want to mark this as wrong.',
+    });
+  }
+  if (proposed.length > MAX_TEXT_CHARS) {
+    return fail('proposed_text_too_long', { max: MAX_TEXT_CHARS, was: proposed.length });
+  }
+  if (proposed === current) {
+    return fail('proposed_text_unchanged', {
+      what_this_means: 'The proposed wording is the current wording. Nothing would change.',
+    });
+  }
+  if (why.length < MIN_WHY_CHARS) {
+    return fail('why_too_thin', {
+      min: MIN_WHY_CHARS,
+      what_this_means: 'A reviewer has to be able to decide this without asking you. Say what is wrong with the current wording and what the new one does better — the same floor a flag’s reason carries.',
+    });
+  }
+  if (why.length > MAX_WHY_CHARS) {
+    return fail('why_too_long', { max: MAX_WHY_CHARS, was: why.length });
+  }
+
+  // The placeholder arithmetic. This is the one rule that makes the patch
+  // MECHANICALLY applicable rather than a note for an engineer: the applier
+  // re-injects the source's own interpolations into the holes, so the count has
+  // to match and the order has to be the author's intent.
+  const want = placeholderCount(current);
+  const got = placeholderCount(proposed);
+  if (want !== got) {
+    return fail('placeholder_mismatch', {
+      expected: want,
+      got,
+      placeholder: PLACEHOLDER,
+      what_this_means: want === 0
+        ? `This string has no ${PLACEHOLDER} holes, so the new wording must not introduce any.`
+        : `This string is assembled at render time and has ${want} ${PLACEHOLDER} hole(s) where a value is dropped in. Keep all ${want}, in the order the sentence needs them — moving or removing one is a code change, not a copy change.`,
+    });
+  }
+
+  return {
+    ok: true,
+    patch: {
+      schema: PROPOSAL_SCHEMA,
+      string_id: entry.id,
+      surface: entry.surface,
+      file: entry.file,
+      line: entry.line,
+      origin: entry.origin,
+      current,
+      proposed,
+      why,
+      proposed_by: builderId ?? null,
+    },
+  };
+}
+
+// Render the patch as the fenced block that goes in the task's description.
+// JSON with a stable key order and two-space indent: a reviewer reads it, and a
+// diff of two proposals against the same string lines up.
+function composeProposalBlock(patch) {
+  const ordered = {
+    schema: patch.schema,
+    string_id: patch.string_id,
+    surface: patch.surface,
+    file: patch.file,
+    line: patch.line,
+    origin: patch.origin,
+    current: patch.current,
+    proposed: patch.proposed,
+  };
+  return ['```' + FENCE, JSON.stringify(ordered, null, 2), '```'].join('\n');
+}
+
+// The reverse. Returns the FIRST block in the text: a task description carries
+// exactly one proposal, and if someone has pasted a second the applier must not
+// silently pick one — so a second block is a named refusal, not a coin flip.
+function parseProposalBlock(markdown) {
+  const src = String(markdown || '');
+  const re = new RegExp('```' + FENCE + '\\s*\\n([\\s\\S]*?)\\n```', 'g');
+  const found = [...src.matchAll(re)];
+  if (!found.length) return fail('no_proposal_block', { fence: FENCE });
+  if (found.length > 1) {
+    return fail('multiple_proposal_blocks', {
+      count: found.length,
+      what_this_means: 'This task carries more than one proposal. Split them: one task changes one string, so the grade and the diff are about one decision.',
+    });
+  }
+  let patch;
+  try {
+    patch = JSON.parse(found[0][1]);
+  } catch (err) {
+    return fail('proposal_block_unreadable', { reason: err.message });
+  }
+  if (Number(patch && patch.schema) !== PROPOSAL_SCHEMA) {
+    return fail('proposal_schema_unknown', { expected: PROPOSAL_SCHEMA, got: patch && patch.schema });
+  }
+  for (const field of ['string_id', 'surface', 'file', 'origin', 'current', 'proposed']) {
+    if (typeof patch[field] !== 'string' || !patch[field]) {
+      return fail('proposal_field_missing', { field });
+    }
+  }
+  if (!Number.isInteger(patch.line) || patch.line < 1) {
+    return fail('proposal_field_missing', { field: 'line' });
+  }
+  return { ok: true, patch };
+}
+
+// The task a proposal becomes. Title names the surface and quotes enough of the
+// current wording to be recognizable in a board list; the body carries the
+// artist's argument, the patch, and the one command that lands it.
+function proposalTaskTitle(patch) {
+  const snippet = patch.current.length > 60 ? `${patch.current.slice(0, 57)}…` : patch.current;
+  return `Copy: reword “${snippet}” on ${patch.surface}`;
+}
+
+// The task's own instructions. They must be RUNNABLE AS WRITTEN — a placeholder
+// a claimer has to substitute is a step to get wrong, and this is the one
+// handoff between the person who wrote the words and the person who lands them.
+//
+// The task cannot know its own id at the moment its description is composed, so
+// the command takes none: `copy-apply.js` with no argument acts on the task you
+// are HOLDING. That is not a convenience, it is the rule — a copy change lands
+// under a claim, and a claim already names a task.
+function proposalTaskBody(patch) {
+  return [
+    `An artist proposed new wording for one string on the \`${patch.surface}\` surface.`,
+    '',
+    '**Why**',
+    '',
+    patch.why,
+    '',
+    '**The change**',
+    '',
+    `- current: ${JSON.stringify(patch.current)}`,
+    `- proposed: ${JSON.stringify(patch.proposed)}`,
+    `- where: \`${patch.file}:${patch.line}\` (${patch.origin})`,
+    '',
+    '**How it lands**',
+    '',
+    'This is a proposal, not a change — nothing has been written. Claim this task and run:',
+    '',
+    '```bash',
+    'node scripts/gds/copy-apply.js',
+    '```',
+    '',
+    'That re-derives the string’s position in the working tree, replaces exactly those characters, regenerates the copy registry and prints the diff for review. Then ship it like any other change — the grader sees the real diff.',
+    '',
+    'If the applier refuses, it says why in one line; a refusal means the file moved on under the proposal and a person should look, not that the wording was wrong.',
+    '',
+    composeProposalBlock(patch),
+  ].join('\n');
+}
+
+// The (source, source_ref) pair the create-vector idempotency read keys on
+// (db.findTaskBySourceRef). Keyed on the string AND the proposed wording, so a
+// double-submitted proposal resolves to the task it already made, while a
+// genuinely different second attempt at the same string is a new task — which is
+// right: two people can disagree about the fix, and the board should hold both.
+function proposalSourceRef(patch) {
+  let hash = 5381;
+  const material = `${patch.string_id}${patch.file}${patch.line}${patch.proposed}`;
+  for (let i = 0; i < material.length; i += 1) hash = (((hash << 5) + hash) ^ material.charCodeAt(i)) >>> 0;
+  return `copy-proposal-${patch.string_id}-${hash.toString(36)}`;
+}
+
+module.exports = {
+  PROPOSAL_SCHEMA,
+  FENCE,
+  PLACEHOLDER,
+  MIN_WHY_CHARS,
+  MAX_WHY_CHARS,
+  MAX_TEXT_CHARS,
+  tidy,
+  placeholderCount,
+  normalizeProposalPayload,
+  composeProposalBlock,
+  parseProposalBlock,
+  proposalTaskTitle,
+  proposalTaskBody,
+  proposalSourceRef,
+};

package/modules/copy-desk/routes/copy-desk.js

@@ -1,12 +1,14 @@
 // modules/copy-desk/routes/copy.js — the copy-flag surface (task 1003113 / R02 of
 // goal 1000074, the artist's loop).
 //
-// Three jobs:
+// Four jobs (the fourth added by task 1003114 / R03 — see below):
 //   GET  /copy-desk/queue            — the artist's working list: open flags with
 //                                 live registry state attached, plus the
 //                                 deterministic duplicate candidates.
 //   POST /copy-desk/flags            — file a flag. ANY signed-in builder, any role.
 //   POST /copy-desk/flags/:id/close  — resolve or dismiss one, with a note.
+//   POST /copy-desk/proposals        — propose new wording. Creates a TASK carrying
+//                                 the patch; writes no file and stores no copy.
 //
 // THE RANK SHAPE, AND WHY IT IS ASYMMETRIC:
 //
@@ -24,10 +26,14 @@
 //   The refusal names both paths rather than dead-ending on a bare 403.
 //
 // WHAT DOES NOT EXIST HERE, AND MUST NOT: any route that writes a user-facing
-// string. NO LIVE CMS is the goal's hard non-goal (task 1003114 / R03 makes the
-// editing affordance produce a TASK, not a write). A flag is a work request.
-// modules/copy-desk/tests/copy_no_cms.mjs pins that by asserting this router's write
-// surface stays exactly these two verbs.
+// string. NO LIVE CMS is the goal's hard non-goal, and R03 kept it while adding
+// the editing affordance the goal also asked for — by making the affordance
+// produce a TASK carrying a patch, never a write. A flag is a work request; a
+// proposal is a work request with a suggested fix attached. Neither reaches a
+// reader. modules/copy-desk/tests/copy_no_cms.mjs pins that by asserting this
+// router's write surface stays exactly these three verbs, that none of them
+// touches the filesystem, and that the one place a proposed wording is allowed
+// to rest is the GDS ledger.
 //
 // Same idioms as modules/security/routes/*.js: doorway-only requires, res.fail
 // codes, factory export mounted from module.json contributes.
@@ -38,9 +44,16 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const flags = require('../flags');
 const registry = require('../registry');
+const proposals = require('../proposals');
 
 const { validateOrRespond } = api;
 
+// The doorway's namespaced logger, not console.error (task 1003114). Same seam
+// builder-settings / dev-box / ideas / government already use: a module's log
+// lines come out structured and attributable, and an error object logged as
+// `{ err }` keeps its stack instead of being stringified into one line.
+const log = api.logger('copy-desk');
+
 // The write schemas (ADR 0118): strict by default, so an unknown or typo'd field
 // is REJECTED rather than silently dropped. Built once at module scope — the
 // [...flags.KINDS] spreads mean a renamed export crashes at boot with a named
@@ -61,6 +74,19 @@ const CLOSE_BODY_SCHEMA = Object.freeze({
   resolution_note:  { required: true, type: 'string', maxLength: flags.MAX_NOTE_CHARS, minLength: 1 },
   resolved_task_id: { type: 'integer', min: 1 },
 });
+// The proposal body (task 1003114 / R03). `file` and `line` are OPTIONAL and only
+// disambiguate a string that appears at several sites — see the route. Notice
+// what is absent and must stay absent: nothing here names a destination. The
+// target is resolved from the registry by `string_id`, so a caller can propose a
+// change to a string the product actually shows and to nothing else.
+const PROPOSAL_BODY_SCHEMA = Object.freeze({
+  string_id:     { required: true, type: 'string', maxLength: 64, minLength: 1 },
+  proposed_text: { required: true, type: 'string', maxLength: proposals.MAX_TEXT_CHARS, minLength: 1 },
+  why:           { required: true, type: 'string', maxLength: proposals.MAX_WHY_CHARS, minLength: 1 },
+  file:          { type: 'string', maxLength: 400 },
+  line:          { type: 'integer', min: 1 },
+  flag_id:       { type: 'integer', min: 1 },
+});
 
 // Load the registry or answer the named "no registry" state. Returns null when
 // it has already responded, so every handler is `if (!reg) return;`.
@@ -127,7 +153,7 @@ module.exports = function buildCopyDeskRouter() {
       res.set('Cache-Control', 'no-store');
       res.json(queue);
     } catch (err) {
-      console.error('[gds] GET /copy-desk/queue', err);
+      log.error({ err }, 'GET /copy-desk/queue failed');
       if (!res.headersSent) res.fail('copy_queue_failed', 500);
     }
   });
@@ -163,7 +189,7 @@ module.exports = function buildCopyDeskRouter() {
       res.set('Cache-Control', 'no-store');
       res.json(result);
     } catch (err) {
-      console.error('[gds] GET /copy-desk/strings', err);
+      log.error({ err }, 'GET /copy-desk/strings failed');
       if (!res.headersSent) res.fail('copy_search_failed', 500);
     }
   });
@@ -200,7 +226,7 @@ module.exports = function buildCopyDeskRouter() {
       }
       res.status(201).json({ ok: true, flag });
     } catch (err) {
-      console.error('[gds] POST /copy-desk/flags', err);
+      log.error({ err }, 'POST /copy-desk/flags failed');
       if (!res.headersSent) res.fail('copy_flag_failed', 500);
     }
   });
@@ -263,10 +289,148 @@ module.exports = function buildCopyDeskRouter() {
 
       res.json({ ok: true, flag });
     } catch (err) {
-      console.error('[gds] POST /copy-desk/flags/:id/close', err);
+      log.error({ err }, 'POST /copy-desk/flags/:id/close failed');
       if (!res.headersSent) res.fail('copy_flag_close_failed', 500);
     }
   });
 
+  // -------------------------------------------------------------------------
+  // POST /copy-desk/proposals — an artist proposes new wording, and it becomes a
+  // TASK (task 1003114 / R03 of goal 1000074).
+  //
+  // Body: { string_id, proposed_text, why, file?, line?, flag_id? }
+  // rank: any signed-in builder — the same floor as filing, for the same reason
+  //       (an artist is a craft, not a rank; see the header).
+  //
+  // THIS IS THE ROUTE THE NON-GOAL IS ABOUT, so read what it does NOT do. It
+  // writes no file. It stores no wording in any table of this module — ADR 0178
+  // §3 pins that copy_desk_flags can never hold replacement text, and this
+  // route's whole design is what makes that pin survivable rather than merely
+  // strict. What it produces is a TASK carrying a patch, in the ledger every
+  // change already has to pass through, which nothing renders from. The wording
+  // reaches a person only after somebody claims that task, runs
+  // `node scripts/gds/copy-apply.js --task <id>`, and ships the resulting diff
+  // through the normal pipeline with the grader reading it.
+  //
+  // The shape is borrowed, not invented: it is `adapter.export()` from the
+  // design half (ADR 0081) applied to text. See modules/copy-desk/proposals.js.
+  // -------------------------------------------------------------------------
+  router.post('/copy-desk/proposals', api.requireBuilder, async (req, res) => {
+    try {
+      if (validateOrRespond(req, res, PROPOSAL_BODY_SCHEMA)) return;
+
+      const loaded = registryOrFail(res);
+      if (!loaded) return;
+
+      // Resolve the TARGET from the registry. Everything the patch says about
+      // what is being changed comes from here and never from the body — R02's
+      // snapshot rule (ADR 0178 §6), which matters more for a proposal than for
+      // a flag: a caller-supplied "current text" would let someone describe an
+      // edit to a sentence that does not exist, and the applier would then be
+      // editing a real file on the strength of a claim nobody checked.
+      const occurrences = registry.occurrencesOf(loaded.index, req.body.string_id);
+      if (!occurrences.length) {
+        return res.fail('unknown_string', 400, {
+          string_id: req.body.string_id,
+          what_this_means: 'The registry does not contain that string. It may have been reworded since this page loaded — reload the copy desk and look again.',
+        });
+      }
+
+      // One proposal changes ONE occurrence. When a string is shown in several
+      // places the caller must say which, because picking for them is exactly
+      // the silent wrong this goal exists to stop — and "the same sentence in
+      // seven places" is already its own signal on this page, with its own
+      // answer (change them all, deliberately, under a claim).
+      let entry = occurrences[0];
+      if (occurrences.length > 1) {
+        const file = req.body.file ? String(req.body.file) : null;
+        const line = Number.isInteger(req.body.line) ? req.body.line : null;
+        const picked = occurrences.filter((e) => e.file === file && e.line === line);
+        if (picked.length !== 1) {
+          return res.fail('ambiguous_string', 400, {
+            string_id: req.body.string_id,
+            occurrences: occurrences.map((e) => ({ file: e.file, line: e.line })),
+            what_this_means: 'This exact sentence is shown in more than one place, so a proposal has to name which one it means. That duplication is itself worth a look — the copy desk lists it under “Said more than once”.',
+          });
+        }
+        [entry] = picked;
+      }
+
+      const norm = proposals.normalizeProposalPayload({
+        body: req.body,
+        entry,
+        builderId: req.builder.id,
+      });
+      if (!norm.ok) return res.fail(norm.code, 400, norm.detail);
+      const { patch } = norm;
+
+      // An optional link back to the flag that prompted this. Validated so a
+      // typo'd id is a named 400 rather than a task quietly claiming a lineage
+      // it does not have. The flag is NOT auto-closed: closing is a person's
+      // verdict on someone else's judgement (ADR 0178 §4/§6), and a proposal is
+      // an argument for a change, not proof the change happened.
+      let flagRef = null;
+      if (Number.isInteger(req.body.flag_id)) {
+        const flag = await flags.getFlag(req.body.flag_id);
+        if (!flag) return res.fail('flag_not_found', 404, { flag_id: req.body.flag_id });
+        flagRef = flag.id;
+      }
+
+      const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+      if (!lifecycle || !lifecycle.createTask) {
+        // An instance without the lifecycle module has no tasks to land into, so
+        // there is no honest way to accept a proposal. Refuse loudly rather than
+        // take the wording and drop it — a proposal that vanishes is worse than
+        // one that was never accepted.
+        return res.fail('lifecycle_unavailable', 503, {
+          what_this_means: 'This instance cannot hold tasks, and a copy proposal is a task. Nothing was recorded.',
+        });
+      }
+
+      // The version the work lands in: the one currently being built, matching
+      // how every other unattributed create-vector picks. `createTask` then
+      // defaults the goal to that version's catch-all, so a copy change is
+      // ordinary work on the board rather than a special case.
+      const versions = await lifecycle.listVersions();
+      const building = (versions || []).find((v) => v.status === 'building') || (versions || [])[0];
+      if (!building) return res.fail('no_open_version', 503);
+
+      const sourceRef = proposals.proposalSourceRef(patch);
+      const existing = lifecycle.findTaskBySourceRef
+        ? await lifecycle.findTaskBySourceRef({ source: 'copy-proposal', sourceRef })
+        : null;
+      if (existing) {
+        // A double-submit resolves to the task it already made. 200, not 201:
+        // nothing was created this time, and the caller gets the same task back.
+        return res.json({ ok: true, task: existing, created: false });
+      }
+
+      const body = proposals.proposalTaskBody(patch);
+      const task = await lifecycle.createTask({
+        versionId: building.id,
+        title: proposals.proposalTaskTitle(patch),
+        description: flagRef
+          ? `${body}\n\nRaised from copy-desk flag ${flagRef}.`
+          : body,
+        // BACKLOG, deliberately. A proposal is a request, and the board's triage
+        // step is where a person decides it is worth doing — the same gate a
+        // captured idea passes. Landing it `ready` would let anyone with an
+        // opinion mint claimable work.
+        status: 'backlog',
+        kind: 'feature',
+        priority: 4,
+        touches: [patch.file],
+        source: 'copy-proposal',
+        sourceRef,
+        createdBy: req.builder.id,
+      });
+
+      res.status(201).json({ ok: true, task, created: true, patch });
+    } catch (err) {
+      log.error({ err }, 'POST /copy-desk/proposals failed');
+      if (!res.headersSent) res.fail('copy_proposal_failed', 500);
+    }
+  });
+
   return router;
 };