@bongos/core 1.19.509 → 1.19.511

package/modules/copy-desk/proposals.js

@@ -260,8 +260,21 @@ function proposalSourceRef(patch) {
   return `copy-proposal-${patch.string_id}-${hash.toString(36)}`;
 }
 
+// Which version a proposal's task lands in — the version currently BEING BUILT,
+// and nothing else (task 1003493). There is deliberately no fallback: the route
+// used to take `versions[0]` when nothing was building, which is whatever row
+// the query ordered first and may be a shipped version — sealed history that
+// cannot take new tasks. A proposal that lands on a closed version is worse than
+// one that was not accepted, so the caller's answer here is a refusal, not a
+// guess. Pure, so the rule is pinned in copy_proposals.mjs rather than only
+// reachable through a live route.
+function resolveTargetVersion(versions) {
+  return (versions || []).find((v) => v && v.status === 'building') || null;
+}
+
 module.exports = {
   PROPOSAL_SCHEMA,
+  resolveTargetVersion,
   FENCE,
   PLACEHOLDER,
   MIN_WHY_CHARS,

package/modules/copy-desk/routes/copy-desk.js

@@ -391,9 +391,16 @@ module.exports = function buildCopyDeskRouter() {
       // how every other unattributed create-vector picks. `createTask` then
       // defaults the goal to that version's catch-all, so a copy change is
       // ordinary work on the board rather than a special case.
+      // No `|| versions[0]` fallback (task 1003493) — see resolveTargetVersion:
+      // with nothing building, the first row back is whatever the query ordered
+      // first, possibly a shipped version, which is sealed history.
       const versions = await lifecycle.listVersions();
-      const building = (versions || []).find((v) => v.status === 'building') || (versions || [])[0];
-      if (!building) return res.fail('no_open_version', 503);
+      const building = proposals.resolveTargetVersion(versions);
+      if (!building) {
+        return res.fail('no_open_version', 503, {
+          what_this_means: 'No version is currently being built, so there is nowhere for a copy change to land. Nothing was recorded.',
+        });
+      }
 
       const sourceRef = proposals.proposalSourceRef(patch);
       const existing = lifecycle.findTaskBySourceRef

package/modules/copy-desk/tests/copy_proposals.mjs

@@ -275,5 +275,46 @@ await test('the applier re-checks the placeholder arithmetic against the real so
   assert.equal(r.code, 'placeholder_mismatch');
 });
 
+// --- task 1003493: the two rules the grader found stated but not enforced ----
+
+await test('--task proves the claim it names instead of standing in for one', () => {
+  const held = [{ task_id: '1003114' }, { task_id: 1003493 }];
+
+  const wrong = applier.claimGateFor(1003112, held);
+  assert.equal(wrong.ok, false);
+  assert.equal(wrong.code, 'claim_not_held');
+  assert.deepEqual(wrong.detail.held, ['1003114', '1003493'], 'the refusal names the claims you DO hold');
+  assert.ok(/claim.js 1003112/.test(wrong.detail.what_this_means), 'and the line that fixes it');
+
+  // A held claim passes, and an id given as a number matches a claim stored as
+  // a string — the ids arrive as both, and a type mismatch here would refuse
+  // the legitimate call, which is the failure mode that gets a check removed.
+  assert.equal(applier.claimGateFor(1003493, held).ok, true);
+  assert.equal(applier.claimGateFor('1003114', held).ok, true);
+
+  // Holding nothing at all cannot pass, whatever id is named.
+  assert.equal(applier.claimGateFor(1003114, []).ok, false);
+  assert.equal(applier.claimGateFor(1003114, undefined).ok, false);
+});
+
+await test('a proposal refuses rather than landing on an arbitrary version', () => {
+  const shipped = { id: 'BONGOS-V0', status: 'shipped' };
+  const building = { id: 'BONGOS-V1', status: 'building' };
+  const planning = { id: 'BONGOS-V2', status: 'planning' };
+
+  // The version being built wins wherever it sits in the list.
+  assert.equal(proposals.resolveTargetVersion([shipped, building, planning]).id, 'BONGOS-V1');
+  assert.equal(proposals.resolveTargetVersion([building]).id, 'BONGOS-V1');
+
+  // With nothing building there is NO fallback — not the first row, not a
+  // shipped version, not a planning one. null is what makes the route's
+  // no_open_version refusal reachable.
+  assert.equal(proposals.resolveTargetVersion([shipped, planning]), null);
+  assert.equal(proposals.resolveTargetVersion([shipped]), null);
+  assert.equal(proposals.resolveTargetVersion([]), null);
+  assert.equal(proposals.resolveTargetVersion(null), null);
+  assert.equal(proposals.resolveTargetVersion([null, undefined]), null);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -670,6 +670,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/modules/lifecycle/conflict-resolve.js

@@ -138,11 +138,13 @@ async function hasConflictMarkers(gitIn) {
 // resolveBranchConflicts — attempt to auto-resolve a generated-file / append-index
 // merge conflict on `branch` against origin/main, server-side. Returns a structured
 // result (never throws for the expected outcomes; throws only on misconfiguration):
-//   { resolved: true,  head_sha, branch }                         — merged + pushed
+//   { resolved: true,  head_sha, branch, regenerated }            — merged + pushed
 //   { resolved: false, skipped: '<why>' [, conflicted: [...] ] }  — left as-is
 // skipped reasons: disabled | unconfigured | already_up_to_date | clone_failed |
 //   fetch_failed | checkout_failed | markers_remain | push_failed |
-//   unresolvable_conflict (with conflicted[]).
+//   unresolvable_conflict (with conflicted[]) | generator_failed | commit_failed.
+// `regenerated` says whether step 7b had to commit post-merge generator drift on top
+// of the merge (task 1003546) — head_sha is that commit when it did.
 async function resolveBranchConflicts({ branch } = {}, deps = {}) {
   // Kill-switch: deps.disabled wins for tests; otherwise the env flag (matches the
   // publish-reconciler's PUBLISH_RECONCILER_DISABLED idiom).
@@ -163,6 +165,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
   const exec = deps.exec || defaultExec;
   const repoRoot = deps.repoRoot || REPO_ROOT;
   const register = deps.registerMergeDriver || registerMergeDriver;
+  const runGenerators = deps.runGenerators || defaultRunGenerators;
   const tmp = (deps.mkdtemp || (() => fs.mkdtempSync(path.join(os.tmpdir(), 'otb-resolve-'))))();
   const work = path.join(tmp, 'work');
   const git = (args, opts) => exec(['-C', work, ...args], opts);
@@ -225,6 +228,49 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //    not our case (mergeIfGreen reported a conflict), so report a no-op.
     const after = (await git(['rev-parse', 'HEAD'])).stdout.trim();
     if (after === before) return { resolved: false, skipped: 'already_up_to_date' };
+    let head = after;
+
+    // 7b. REGENERATE ON THE MERGED TREE — the step that makes step 6 trustworthy
+    //     (task 1003546). The `otb-regen` driver is invoked BY git, DURING the merge,
+    //     and every artifact it rebuilds is produced by SCANNING THE WORKING TREE
+    //     (copy-inventory.js, gen-repo-map.js, gen-file-map.js). At driver time that
+    //     tree is still the PRE-merge (ours) tree, so the driver writes an artifact
+    //     describing the branch, git then completes the merge underneath it, and the
+    //     result is a clean merge — exit 0, no unmerged paths, no markers — carrying a
+    //     generated file that matches NEITHER side nor the merged tree. Nothing
+    //     downstream can catch it: it is only detectable by regenerating again.
+    //
+    //     Measured on the real repo (task 1003546): two branches each shifting lines
+    //     in modules/hall-ui/public/task-detail.js merge clean, and the merge commit's
+    //     docs/copy-registry.json is byte-identical to ours — the other side's line
+    //     numbers are silently DISCARDED (`"line": 464` where the merged tree says
+    //     466). That is the PR #536 / task 1003544 strand exactly. Task 1003543 had
+    //     given these files the driver, which converted the loud CONFLICT they used to
+    //     throw into this silent staleness — strictly harder to see.
+    //
+    //     A line-numbered or aggregate-carrying artifact cannot be resolved from the
+    //     three merge sides by construction; the only correct value is a fresh scan of
+    //     the FINAL tree. So we rebuild here, after the merge commit exists, and
+    //     commit any drift on top. Ordinary case is a no-op (the driver's guess was
+    //     right, or nothing generated moved) and we push the merge alone.
+    const gen = await runGenerators({ work });
+    if (gen && gen.code !== 0) {
+      // A generator hard-error / a missing hand-written note (gen-file-map exit 2).
+      // We cannot certify the merged tree, and pushing an uncertifiable one is what
+      // stranded #536 — leave it, exactly the module's "any failure is a no-op for
+      // the strand" posture. The reconciler's attempt cap still escalates to a human.
+      return { resolved: false, skipped: 'generator_failed' };
+    }
+    const drift = (await git(['status', '--porcelain'])).stdout.trim();
+    if (drift) {
+      await git(['add', '-A']);
+      const c = await git([
+        'commit', '-m',
+        'chore(gds): regenerate generated artifacts from the merged tree (conflict-resolve self-heal, task 1003546)',
+      ]);
+      if (c.code !== 0) return { resolved: false, skipped: 'commit_failed' };
+      head = (await git(['rev-parse', 'HEAD'])).stdout.trim();
+    }
 
     // 8. Belt-and-braces: a clean `git merge` already implies no unmerged paths and
     //    no markers, but assert both before we push anything.
@@ -238,7 +284,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     const p = await git(['push', authUrl, `HEAD:refs/heads/${branch}`]);
     if (p.code !== 0) return { resolved: false, skipped: 'push_failed' };
 
-    return { resolved: true, head_sha: after, branch };
+    return { resolved: true, head_sha: head, branch, regenerated: Boolean(drift) };
   } finally {
     try {
       (deps.rmtmp || ((d) => fs.rmSync(d, { recursive: true, force: true })))(tmp);
@@ -255,6 +301,16 @@ const GENERATOR_SCRIPTS = [
   'scripts/gds/gen-repo-map.js',
   'scripts/gds/gen-file-map.js',
   'scripts/gds/gen-session-index.js',
+  // task 1003546: copy-inventory.js writes docs/copy-registry.json +
+  // docs/copy-inventory.md, and its rows carry a `line` per copy string — so ANY
+  // merge that shifts lines in a scanned UI file re-stales it and `unit`
+  // (tests/copy_inventory.mjs) goes red on the merge ref. Its absence here did not
+  // merely fail to heal that: with the other three producing no diff, the caller
+  // returns `no_regen_diff`, whose documented meaning is "a REAL check failure, not
+  // staleness" — so copy-registry staleness was MISDIAGNOSED as a genuine failure,
+  // burned the attempt cap, and announceStrand flagged the task needs_rebase
+  // (PR #536 / task 1003544).
+  'scripts/gds/copy-inventory.js',
 ];
 
 // Run the CLONE's generator scripts in WRITE mode against the merged working tree.

package/modules/provisioning/routes/provisioning.js

@@ -21,6 +21,8 @@
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
 //   public:
 //     GET    /provisioning/health                   — liveness + core version
+//     GET    /provisioning/onboard-plan             — the canonical onboarding step sequence
+//     GET    /provisioning/starter-bundles          — the curated module preset per project type
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
@@ -33,6 +35,7 @@ const auth = api;
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
+const { ALWAYS_ON_CORE, allStarterBundles } = require('../starter-bundles');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -1263,6 +1266,22 @@ module.exports = function provisioningRoutes() {
     res.json({ mode, steps: stepsForShape(onboardPlan(mode, { domain }), shape) });
   });
 
+  // GET /provisioning/starter-bundles — the curated module preset for each declared
+  // project type (BV1.R19, task 1002338; goal 1000046 criterion `proj-module-select`).
+  // Returns the always-on core once, then one resolved bundle per type:
+  // `{ type, label, summary, core, bundle, modules }`. The whole table in one read,
+  // because the creation picker (R20, task 1002339) re-preselects as the owner flips
+  // the type question and must not refetch to do it; R17's rule engine reads the same
+  // shape so a recommendation and a preselect can never name different modules.
+  // A DECLARATION, not a query — modules/provisioning/starter-bundles.js is pure, so
+  // this route touches no database and no per-request state.
+  // rank: public — the signed-out hub wizard (/projects?view=new) reads it while
+  // choosing a type, exactly like onboard-plan above; no write, no secret, and the
+  // module catalog it names is already public at GET /public/modules.
+  router.get('/provisioning/starter-bundles', (req, res) => {
+    res.json({ core: [...ALWAYS_ON_CORE], bundles: allStarterBundles() });
+  });
+
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST
   // (ADR 0111 §4, task P4 #1945). Caddy's global `on_demand_tls { ask … }` calls
   // this before fetching a Let's Encrypt cert for an SNI it doesn't already have:

package/modules/provisioning/starter-bundles.js

@@ -0,0 +1,159 @@
+// modules/provisioning/starter-bundles.js — the curated STARTER BUNDLE for each
+// declared project type (BV1.R19, task 1002338; goal 1000046 criterion
+// `proj-module-select`).
+//
+// WHY. Every Cloud Bongos instance boots with the same always-on core — the
+// methodology modules a project cannot sensibly run without. What differs between
+// a game, a research project and a business is the handful of OPT-IN modules on
+// top, and an owner creating their first project has no way to know which of
+// those they want before they have used any of them. A bundle is that opinion,
+// written down once: a project type maps to a short list of opt-in module keys,
+// PRESELECTED for the owner and freely toggled off in the creation picker (R20,
+// task 1002339). It is the answer the flow STARTS from, never a decision it makes
+// on the owner's behalf, and never a thing an owner is stuck with — modules are
+// added and removed after creation too (R23, task 1002342).
+//
+// THE ARROW RUNS TYPE -> MODULES, NEVER BACK. Task 1002772 rejected inferring a
+// project's type from its enabled module set: flags flip all through setup, so a
+// half-configured project would show a confidently wrong type. The type is
+// DECLARED at creation and everything downstream reads off that declaration. R15
+// wrote the same rule into the interview's vocabulary — "the module bundle R19
+// recommends comes off the separately-declared `type`, so the interview
+// deliberately does not ask it a second time" (PROJECT_DETAIL_VOCAB in
+// provisioning.js beside this file).
+//
+// A BUNDLE IS NOT A PUBLISH PRECONDITION. ADR 0182 D4 fixes the publish bar at
+// identity alone — a name and a description, "not tagline, art, modules,
+// governance, or a completed interview" — so taking or declining a bundle must
+// never change whether a project is on the map.
+//
+// PURE — no I/O, no core imports, no sibling-module imports; safe to require from
+// a route, a script or a test, exactly like onboard-plan.js beside it. That purity
+// is why the module keys below are DECLARED here rather than read off the live
+// catalog (src/module-loader/catalog.js, which a module may not import — the
+// one-way rule, ADR 0083). tests/provisioning_starter_bundles.mjs is the pin that
+// keeps the declaration true: it reads every modules/*/module.json off disk and
+// fails the build if a bundle names a module that does not exist, if a bundle
+// names an always-on module (a preselect that toggles nothing), or if
+// ALWAYS_ON_CORE drifts from the manifests' `default: true` set.
+
+'use strict';
+
+// The modules every instance gets whichever type it declares — the manifests'
+// `default: true` set (docs/modules-contract.md: "core-domain modules that are
+// `default: true` (always on unless disabled)"). They are the FLOOR a bundle
+// layers on, not part of any bundle, and they are listed here so a creation form
+// can show an owner what they already have without a second round trip.
+const ALWAYS_ON_CORE = Object.freeze([
+  'autonomy',
+  'builder-settings',
+  'copy-desk',
+  'economy',
+  'government',
+  'grading',
+  'hall-ui',
+  'ideas',
+  'lifecycle',
+  'memory',
+  'onboarding',
+  'public-landing',
+  'security',
+  'sessions',
+  'status-ui',
+  'ui-design',
+]);
+
+// The control plane's own modules. `platform-identity` is the hub identity
+// provider ("enabled ONLY on the hub instance") and `provisioning` is the surface
+// that stands other instances up — a project created THROUGH the hub is a
+// consumer of both, never a second copy of them. Named so the integrity test can
+// refuse them by construction rather than by anyone remembering.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning']);
+
+// The curated presets, keyed by the declared project type (the closed vocabulary
+// owner-decided 2026-08-13 and mirrored in provisioning.PROJECT_TYPES + the
+// provisioning_007 CHECK). `label` and `summary` are the owner-facing copy the
+// picker renders — plain language, no module jargon, because the owner choosing
+// here has not met any of these modules yet.
+//
+// The lists are SHORT on purpose. A preselect an owner has to audit is worse than
+// none, and today's opt-in catalog is genuinely small (`agents`, `dev-box`,
+// `discord`); a bundle grows as the catalog does, which is exactly why this is a
+// declaration and not a rule engine. Enabling `dev-box` opens the door to a cloud
+// dev environment — it provisions nothing and bills nothing until a builder asks
+// for a box — so preselecting it costs the owner nothing but a toggle.
+const STARTER_BUNDLES = Object.freeze({
+  game: Object.freeze({
+    label: 'Game starter',
+    summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
+    modules: Object.freeze(['dev-box', 'discord']),
+  }),
+  research: Object.freeze({
+    label: 'Research starter',
+    summary: 'Extra agents to run the reading and the experiments the question needs.',
+    modules: Object.freeze(['agents']),
+  }),
+  business: Object.freeze({
+    label: 'Business starter',
+    summary: 'A place to try a change before customers see it, and agents to look it over first.',
+    modules: Object.freeze(['agents', 'dev-box']),
+  }),
+  'non-profit': Object.freeze({
+    label: 'Non-profit starter',
+    summary: 'Somewhere the community around the cause can gather and be heard.',
+    modules: Object.freeze(['discord']),
+  }),
+  'not-sure': Object.freeze({
+    label: 'Core only',
+    summary: 'Just the core, and nothing else to decide today. Add modules whenever you know what you need.',
+    modules: Object.freeze([]),
+  }),
+});
+
+// The copy an undeclared project gets. Deliberately NOT one of the bundles above:
+// `type` is nullable because every row predates the field and must never be
+// back-filled with a guess (migration provisioning_007), so "nobody said" has to
+// read differently from "the owner said not sure".
+const UNDECLARED = Object.freeze({
+  label: 'Core only',
+  summary: 'No project type yet, so nothing is preselected — every project starts with the core.',
+});
+
+// Resolve one project type to what the creation flow should preselect:
+// `{ type, label, summary, core, bundle, modules }`, where `bundle` is the type's
+// opt-in additions, `core` the always-on floor, and `modules` the union in that
+// order — what the owner ends up with if they change nothing. An unknown or
+// absent type resolves to the core with `type: null`; this never throws and never
+// invents a type, because a recommendation built on an answer nobody gave is
+// worse than no recommendation. Arrays are fresh copies, so a caller may sort or
+// splice its result without corrupting the frozen declaration.
+function bundleForProjectType(type) {
+  const declared = typeof type === 'string' && Object.prototype.hasOwnProperty.call(STARTER_BUNDLES, type)
+    ? type
+    : null;
+  const preset = declared ? STARTER_BUNDLES[declared] : UNDECLARED;
+  const bundle = declared ? [...STARTER_BUNDLES[declared].modules] : [];
+  return {
+    type: declared,
+    label: preset.label,
+    summary: preset.summary,
+    core: [...ALWAYS_ON_CORE],
+    bundle,
+    modules: [...ALWAYS_ON_CORE, ...bundle],
+  };
+}
+
+// Every curated bundle, resolved, in declaration order — the whole table in one
+// read. The creation picker wants all of them up front so flipping the type
+// question re-preselects without another round trip.
+function allStarterBundles() {
+  return Object.keys(STARTER_BUNDLES).map(bundleForProjectType);
+}
+
+module.exports = {
+  ALWAYS_ON_CORE,
+  HUB_ONLY_MODULES,
+  STARTER_BUNDLES,
+  bundleForProjectType,
+  allStarterBundles,
+};

package/modules/public-landing/public/assets/cosmos.css

@@ -1501,7 +1501,9 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-new #wizSignin:hover{background:color-mix(in srgb,var(--ink) 88%,var(--bg));}
 /* the error alert: the error ink between two hairlines, no plate */
 #view-new .alert{background:none;border:0;border-top:1px solid var(--err);border-bottom:1px solid var(--err);border-radius:0;padding:12px 0;font-weight:400;}
-@media (max-width:900px){
+/* one fold for the whole wizard: 840 is where the page's bands and ledger stack
+   (cosmos's createSplit collapse), so the rail folds with them, not before them */
+@media (max-width:840px){
   #view-new .steps{grid-template-columns:repeat(3,1fr);gap:18px 10px;margin-bottom:30px;}
   #view-new .steps .snum{font-size:18px;}
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.509",
+  "version": "1.19.511",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.509",
+      "version": "1.19.511",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.509",
+  "version": "1.19.511",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-apply.js

@@ -32,7 +32,7 @@
 //
 // Run:  node scripts/gds/copy-apply.js                    (the task you are HOLDING — the normal call)
 //       node scripts/gds/copy-apply.js --dry-run          (say what would change, write nothing)
-//       node scripts/gds/copy-apply.js --task 1234        (a named task, when you hold more than one)
+//       node scripts/gds/copy-apply.js --task 1234        (a claim you hold, when you hold more than one)
 //       node scripts/gds/copy-apply.js --patch-file p.json  (a local patch — used by the tests)
 //
 // WHY THE BARE FORM DEFAULTS TO YOUR CLAIM rather than taking an id. The task a
@@ -43,6 +43,13 @@
 // task. So the bare call reads the claim, and holding no claim is a refusal that
 // says to go and claim the task — the methodology's own rule, enforced by the
 // command instead of restated in its output.
+//
+// --task DOES NOT OPT OUT OF THAT (task 1003493). It selects which of your
+// claims to act under when you hold several; it is checked against the same
+// /me claim list the bare call reads, and refuses `claim_not_held` for a task
+// you do not hold. The one path that never touches a task is --patch-file,
+// which reads a local JSON patch and is the tests' entry point — it lands
+// nothing a proposal task authorised, so there is no claim for it to prove.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -208,13 +215,50 @@ function refuse(result) {
   return 2;
 }
 
+// Every claim this session holds. One reader, so the bare call and --task are
+// answered from the same source of truth — the shape of bug where a rule is
+// enforced on one path and merely stated on the other (task 1003493).
+async function activeClaims() {
+  const me = await apiCall('GET', '/api/gds/me');
+  if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
+  return { ok: true, claims: me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []) };
+}
+
+// --task <id> names a task; this proves the caller actually HOLDS it. Without
+// this the header's "may only be run under a claim" was true of the bare call
+// and false of the named one — a rule stated three times in prose (here, ADR
+// 0233, modules/copy-desk/CLAUDE.md) and enforced on one of two paths. The
+// refusal names the claims you do hold, because the usual cause is a typo'd id.
+// Pure so the gate is testable without a session: given the id asked for and
+// the claims held, either accept or produce the named refusal.
+function claimGateFor(taskId, claims) {
+  const wanted = String(taskId);
+  const held = (claims || []).map((c) => String(c.task_id));
+  if (held.includes(wanted)) return { ok: true, taskId: wanted };
+  return {
+    ok: false,
+    code: 'claim_not_held',
+    detail: {
+      task: wanted,
+      held,
+      what_this_means: `A copy change lands under a claim like every other change, and you do not hold one on #${wanted}. Claim it first (node scripts/gds/claim.js ${wanted}), then run this again.`,
+    },
+  };
+}
+
+async function claimOnTask(taskId) {
+  const held = await activeClaims();
+  if (!held.ok) return held;
+  return claimGateFor(taskId, held.claims);
+}
+
 // The task this session is holding. Returns a named refusal rather than an id
 // when there is nothing to act under — "claim it first" is the correct answer,
 // not an inconvenience to route around.
 async function claimedTaskId() {
-  const me = await apiCall('GET', '/api/gds/me');
-  if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
-  const claims = me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []);
+  const held = await activeClaims();
+  if (!held.ok) return held;
+  const claims = held.claims;
   if (!claims.length) {
     return {
       ok: false,
@@ -271,6 +315,11 @@ async function main() {
     if (!held.ok) return cliExit(refuse(held));
     taskId = held.taskId;
     console.log(`copy-apply: the task you are holding — #${taskId}`);
+  } else if (taskId) {
+    // --task picks WHICH claim to act under; it never substitutes for holding one.
+    const held = await claimOnTask(taskId);
+    if (!held.ok) return cliExit(refuse(held));
+    taskId = held.taskId;
   }
 
   const loaded = await loadPatch({ taskId, patchFile });
@@ -335,4 +384,5 @@ module.exports = {
   locateOccurrence,
   reinjectInterpolations,
   applyPatchToSource,
+  claimGateFor,
 };

package/scripts/gds/git-merge-regen.js

@@ -20,6 +20,24 @@
 // parts of nested docs; it succeeds ONLY if no conflict markers remain. A genuine
 // hand-written conflict falls through to a normal git conflict — it never invents a
 // resolution or clobbers a real edit.
+//
+// ⚠ THE DRIVER'S OUTPUT IS PROVISIONAL FOR ANY TREE-SCANNING ARTIFACT (task 1003546).
+// Every rule below that rebuilds by SCANNING THE WORKING TREE — copy-inventory.js's
+// registry pair, gen-repo-map's map + nested blocks, gen-file-map's sections — is
+// invoked BY git, DURING the merge, when that tree is still the PRE-merge (ours)
+// tree. So the driver writes an artifact describing the branch, git completes the
+// merge underneath it, and the merge lands CLEAN (exit 0, no unmerged paths, no
+// markers) carrying content that matches neither side nor the merged tree. Measured:
+// two branches each shifting lines in one scanned UI file merge clean and the merge
+// commit's docs/copy-registry.json is byte-identical to ours, silently dropping the
+// other side's line numbers (PR #536 / task 1003544).
+// It is still worth running — it clears the markers so the merge completes at all —
+// but it is NOT the authority. Whoever OWNS the merge must regenerate afterwards, on
+// the final tree, and commit the drift: the server does it in conflict-resolve.js
+// step 7b, and a post-merge `resolveInWorktree` call (ship-preflight-steps.js) is
+// correct for the same reason — by then git has written every cleanly-merged path.
+// Do NOT add a rule here and assume the merge is thereby correct; a line-numbered or
+// aggregate-carrying artifact cannot be resolved from the three merge sides at all.
 
 const fs = require('node:fs');
 const os = require('node:os');

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.509'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.511'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');