@bongos/core 1.19.510 → 1.19.512

package/docs/module-api-changelog.md

@@ -1457,5 +1457,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.508 with no explicit bump. run 33790542026. (task 1002620)
   1.19.510 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.509 with no explicit bump. run 33791237400. (task 1002620)
+  1.19.511 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.510 with no explicit bump. run 33792868990. (task 1002620)
+  1.19.512 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.511 with no explicit bump. run 33793208383. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/copy-desk/proposals.js

@@ -260,8 +260,21 @@ function proposalSourceRef(patch) {
   return `copy-proposal-${patch.string_id}-${hash.toString(36)}`;
 }
 
+// Which version a proposal's task lands in — the version currently BEING BUILT,
+// and nothing else (task 1003493). There is deliberately no fallback: the route
+// used to take `versions[0]` when nothing was building, which is whatever row
+// the query ordered first and may be a shipped version — sealed history that
+// cannot take new tasks. A proposal that lands on a closed version is worse than
+// one that was not accepted, so the caller's answer here is a refusal, not a
+// guess. Pure, so the rule is pinned in copy_proposals.mjs rather than only
+// reachable through a live route.
+function resolveTargetVersion(versions) {
+  return (versions || []).find((v) => v && v.status === 'building') || null;
+}
+
 module.exports = {
   PROPOSAL_SCHEMA,
+  resolveTargetVersion,
   FENCE,
   PLACEHOLDER,
   MIN_WHY_CHARS,

package/modules/copy-desk/routes/copy-desk.js

@@ -391,9 +391,16 @@ module.exports = function buildCopyDeskRouter() {
       // how every other unattributed create-vector picks. `createTask` then
       // defaults the goal to that version's catch-all, so a copy change is
       // ordinary work on the board rather than a special case.
+      // No `|| versions[0]` fallback (task 1003493) — see resolveTargetVersion:
+      // with nothing building, the first row back is whatever the query ordered
+      // first, possibly a shipped version, which is sealed history.
       const versions = await lifecycle.listVersions();
-      const building = (versions || []).find((v) => v.status === 'building') || (versions || [])[0];
-      if (!building) return res.fail('no_open_version', 503);
+      const building = proposals.resolveTargetVersion(versions);
+      if (!building) {
+        return res.fail('no_open_version', 503, {
+          what_this_means: 'No version is currently being built, so there is nowhere for a copy change to land. Nothing was recorded.',
+        });
+      }
 
       const sourceRef = proposals.proposalSourceRef(patch);
       const existing = lifecycle.findTaskBySourceRef

package/modules/copy-desk/tests/copy_proposals.mjs

@@ -275,5 +275,46 @@ await test('the applier re-checks the placeholder arithmetic against the real so
   assert.equal(r.code, 'placeholder_mismatch');
 });
 
+// --- task 1003493: the two rules the grader found stated but not enforced ----
+
+await test('--task proves the claim it names instead of standing in for one', () => {
+  const held = [{ task_id: '1003114' }, { task_id: 1003493 }];
+
+  const wrong = applier.claimGateFor(1003112, held);
+  assert.equal(wrong.ok, false);
+  assert.equal(wrong.code, 'claim_not_held');
+  assert.deepEqual(wrong.detail.held, ['1003114', '1003493'], 'the refusal names the claims you DO hold');
+  assert.ok(/claim.js 1003112/.test(wrong.detail.what_this_means), 'and the line that fixes it');
+
+  // A held claim passes, and an id given as a number matches a claim stored as
+  // a string — the ids arrive as both, and a type mismatch here would refuse
+  // the legitimate call, which is the failure mode that gets a check removed.
+  assert.equal(applier.claimGateFor(1003493, held).ok, true);
+  assert.equal(applier.claimGateFor('1003114', held).ok, true);
+
+  // Holding nothing at all cannot pass, whatever id is named.
+  assert.equal(applier.claimGateFor(1003114, []).ok, false);
+  assert.equal(applier.claimGateFor(1003114, undefined).ok, false);
+});
+
+await test('a proposal refuses rather than landing on an arbitrary version', () => {
+  const shipped = { id: 'BONGOS-V0', status: 'shipped' };
+  const building = { id: 'BONGOS-V1', status: 'building' };
+  const planning = { id: 'BONGOS-V2', status: 'planning' };
+
+  // The version being built wins wherever it sits in the list.
+  assert.equal(proposals.resolveTargetVersion([shipped, building, planning]).id, 'BONGOS-V1');
+  assert.equal(proposals.resolveTargetVersion([building]).id, 'BONGOS-V1');
+
+  // With nothing building there is NO fallback — not the first row, not a
+  // shipped version, not a planning one. null is what makes the route's
+  // no_open_version refusal reachable.
+  assert.equal(proposals.resolveTargetVersion([shipped, planning]), null);
+  assert.equal(proposals.resolveTargetVersion([shipped]), null);
+  assert.equal(proposals.resolveTargetVersion([]), null);
+  assert.equal(proposals.resolveTargetVersion(null), null);
+  assert.equal(proposals.resolveTargetVersion([null, undefined]), null);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/modules/lifecycle/conflict-resolve.js

@@ -138,11 +138,13 @@ async function hasConflictMarkers(gitIn) {
 // resolveBranchConflicts — attempt to auto-resolve a generated-file / append-index
 // merge conflict on `branch` against origin/main, server-side. Returns a structured
 // result (never throws for the expected outcomes; throws only on misconfiguration):
-//   { resolved: true,  head_sha, branch }                         — merged + pushed
+//   { resolved: true,  head_sha, branch, regenerated }            — merged + pushed
 //   { resolved: false, skipped: '<why>' [, conflicted: [...] ] }  — left as-is
 // skipped reasons: disabled | unconfigured | already_up_to_date | clone_failed |
 //   fetch_failed | checkout_failed | markers_remain | push_failed |
-//   unresolvable_conflict (with conflicted[]).
+//   unresolvable_conflict (with conflicted[]) | generator_failed | commit_failed.
+// `regenerated` says whether step 7b had to commit post-merge generator drift on top
+// of the merge (task 1003546) — head_sha is that commit when it did.
 async function resolveBranchConflicts({ branch } = {}, deps = {}) {
   // Kill-switch: deps.disabled wins for tests; otherwise the env flag (matches the
   // publish-reconciler's PUBLISH_RECONCILER_DISABLED idiom).
@@ -163,6 +165,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
   const exec = deps.exec || defaultExec;
   const repoRoot = deps.repoRoot || REPO_ROOT;
   const register = deps.registerMergeDriver || registerMergeDriver;
+  const runGenerators = deps.runGenerators || defaultRunGenerators;
   const tmp = (deps.mkdtemp || (() => fs.mkdtempSync(path.join(os.tmpdir(), 'otb-resolve-'))))();
   const work = path.join(tmp, 'work');
   const git = (args, opts) => exec(['-C', work, ...args], opts);
@@ -225,6 +228,49 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //    not our case (mergeIfGreen reported a conflict), so report a no-op.
     const after = (await git(['rev-parse', 'HEAD'])).stdout.trim();
     if (after === before) return { resolved: false, skipped: 'already_up_to_date' };
+    let head = after;
+
+    // 7b. REGENERATE ON THE MERGED TREE — the step that makes step 6 trustworthy
+    //     (task 1003546). The `otb-regen` driver is invoked BY git, DURING the merge,
+    //     and every artifact it rebuilds is produced by SCANNING THE WORKING TREE
+    //     (copy-inventory.js, gen-repo-map.js, gen-file-map.js). At driver time that
+    //     tree is still the PRE-merge (ours) tree, so the driver writes an artifact
+    //     describing the branch, git then completes the merge underneath it, and the
+    //     result is a clean merge — exit 0, no unmerged paths, no markers — carrying a
+    //     generated file that matches NEITHER side nor the merged tree. Nothing
+    //     downstream can catch it: it is only detectable by regenerating again.
+    //
+    //     Measured on the real repo (task 1003546): two branches each shifting lines
+    //     in modules/hall-ui/public/task-detail.js merge clean, and the merge commit's
+    //     docs/copy-registry.json is byte-identical to ours — the other side's line
+    //     numbers are silently DISCARDED (`"line": 464` where the merged tree says
+    //     466). That is the PR #536 / task 1003544 strand exactly. Task 1003543 had
+    //     given these files the driver, which converted the loud CONFLICT they used to
+    //     throw into this silent staleness — strictly harder to see.
+    //
+    //     A line-numbered or aggregate-carrying artifact cannot be resolved from the
+    //     three merge sides by construction; the only correct value is a fresh scan of
+    //     the FINAL tree. So we rebuild here, after the merge commit exists, and
+    //     commit any drift on top. Ordinary case is a no-op (the driver's guess was
+    //     right, or nothing generated moved) and we push the merge alone.
+    const gen = await runGenerators({ work });
+    if (gen && gen.code !== 0) {
+      // A generator hard-error / a missing hand-written note (gen-file-map exit 2).
+      // We cannot certify the merged tree, and pushing an uncertifiable one is what
+      // stranded #536 — leave it, exactly the module's "any failure is a no-op for
+      // the strand" posture. The reconciler's attempt cap still escalates to a human.
+      return { resolved: false, skipped: 'generator_failed' };
+    }
+    const drift = (await git(['status', '--porcelain'])).stdout.trim();
+    if (drift) {
+      await git(['add', '-A']);
+      const c = await git([
+        'commit', '-m',
+        'chore(gds): regenerate generated artifacts from the merged tree (conflict-resolve self-heal, task 1003546)',
+      ]);
+      if (c.code !== 0) return { resolved: false, skipped: 'commit_failed' };
+      head = (await git(['rev-parse', 'HEAD'])).stdout.trim();
+    }
 
     // 8. Belt-and-braces: a clean `git merge` already implies no unmerged paths and
     //    no markers, but assert both before we push anything.
@@ -238,7 +284,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     const p = await git(['push', authUrl, `HEAD:refs/heads/${branch}`]);
     if (p.code !== 0) return { resolved: false, skipped: 'push_failed' };
 
-    return { resolved: true, head_sha: after, branch };
+    return { resolved: true, head_sha: head, branch, regenerated: Boolean(drift) };
   } finally {
     try {
       (deps.rmtmp || ((d) => fs.rmSync(d, { recursive: true, force: true })))(tmp);
@@ -255,6 +301,16 @@ const GENERATOR_SCRIPTS = [
   'scripts/gds/gen-repo-map.js',
   'scripts/gds/gen-file-map.js',
   'scripts/gds/gen-session-index.js',
+  // task 1003546: copy-inventory.js writes docs/copy-registry.json +
+  // docs/copy-inventory.md, and its rows carry a `line` per copy string — so ANY
+  // merge that shifts lines in a scanned UI file re-stales it and `unit`
+  // (tests/copy_inventory.mjs) goes red on the merge ref. Its absence here did not
+  // merely fail to heal that: with the other three producing no diff, the caller
+  // returns `no_regen_diff`, whose documented meaning is "a REAL check failure, not
+  // staleness" — so copy-registry staleness was MISDIAGNOSED as a genuine failure,
+  // burned the attempt cap, and announceStrand flagged the task needs_rebase
+  // (PR #536 / task 1003544).
+  'scripts/gds/copy-inventory.js',
 ];
 
 // Run the CLONE's generator scripts in WRITE mode against the merged working tree.

package/modules/provisioning/provisioning.js

@@ -118,11 +118,37 @@ const RESTART_SHAPES = new Set(['co-tenant', 'standalone']);
 // (migration provisioning_009) is a dumb store with room for future keys.
 // DEFAULT_SETTINGS is TODAY's behavior (public surfaces, apply-to-join),
 // applied at read time so pre-existing rows need no data backfill.
+//
+// `visibility` is ADR 0182's STORED JOIN DOOR (BV1.R05, task 1002324) and it is a
+// third axis, not a synonym of its neighbours — the three answer three different
+// questions and an owner may set them independently:
+//
+//   platform_visibility  who may READ this project's own pages (its sign-in door)
+//   joinability          HOW someone becomes a member (self-join / apply / invite)
+//   visibility           how the project stands on the PLATFORM's map: named and
+//                        open (public), named and closed (private), or present but
+//                        anonymous (stealth)
+//
+// The name is ADR 0182 D1's deliberate choice — `goals.visibility` established the
+// word and one word across both planes beat an accurate name used in one place —
+// and D1 also records that it is a mild lie: this key does NOT decide whether the
+// project is on the map. PUBLISHABILITY does (a name + a description, ADR 0182 D4),
+// it is derived and never stored, and no value here can put a husk on the map.
+//
+// It is a POLICY, not a platform-drawn key: ADR 0182 D6 makes the door the CEILING
+// that `joinability` may only narrow, and D1/D5 put that authority on the instance —
+// so it rides web.env like its two neighbours and a restart applies it. The instance
+// reads it back as `project.visibility` (src/branding.js), which is what lets a later
+// task enforce the door there and report the value to the hub catalog (R08).
 const SETTINGS_VOCAB = Object.freeze({
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
+  visibility: ['public', 'private', 'stealth'],
 });
-const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply' });
+// Default = today's behavior on every axis, including the join door: ADR 0182's
+// migration gives the hub column the same `public` default, "existing rows keep
+// today's behaviour".
+const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
 
 // The project's PLANET (task 1003347, direction record §16): how the platform
 // DRAWS it on the sky, in the owner's list and on the card — its template

package/modules/provisioning/tests/provisioning.mjs

@@ -263,21 +263,24 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
-    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x' } }),
-    { platform_visibility: 'public', joinability: 'invite_only' },
+    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted' } }),
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'a non-object settings value reads as defaults');
+  // the join door reads back like any other policy key (task 1002324)
+  assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' }, 'a stored door overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {
@@ -336,7 +339,7 @@ t('the planet (task 1003347): PLANET_TEMPLATES mirrors platform-identity\'s PROJ
   assert.equal(P.PLANET_TEMPLATES.length, 36);
   assert.deepEqual([...P.PLANET_ACCENTS], ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent']);
   for (const a of P.PLANET_ACCENTS) assert.doesNotMatch(a, /^#|rgb|hsl/, 'a name, never a colour (the Fifteen Rule)');
-  assert.deepEqual(Object.keys(P.PLANET_VOCAB), ['planet_template', 'planet_accent']);
+  assert.deepEqual(Object.keys(P.PLANET_VOCAB), ['planet_template', 'planet_accent', 'card_backdrop']);
   // the deliberate asymmetry: the planet is NOT a setting — no default, never in SETTINGS_VOCAB
   for (const k of Object.keys(P.PLANET_VOCAB)) {
     assert.ok(!(k in P.SETTINGS_VOCAB), `${k} is not a policy the instance obeys`);
@@ -345,12 +348,12 @@ t('the planet (task 1003347): PLANET_TEMPLATES mirrors platform-identity\'s PROJ
 });
 
 t('planetChoice: null for a bare row or an unset key; a stored on-vocabulary value reads back; junk reads null, never leaks', () => {
-  assert.deepEqual(P.planetChoice(null), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({}), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: { platform_visibility: 'gated' } }), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' } }), { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' });
-  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'cube', planet_accent: '#fff' } }), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: ['nope'] }), { planet_template: null, planet_accent: null });
+  assert.deepEqual(P.planetChoice(null), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({}), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { platform_visibility: 'gated' } }), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' } }), { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit', card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'cube', planet_accent: '#fff' } }), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: ['nope'] }), { planet_template: null, planet_accent: null, card_backdrop: null });
 });
 
 t('publicInstance carries the planet — both keys, null when unset — so the list and the manage page read it off the row', () => {

package/modules/public-landing/public/assets/cosmos.css

@@ -1501,7 +1501,9 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-new #wizSignin:hover{background:color-mix(in srgb,var(--ink) 88%,var(--bg));}
 /* the error alert: the error ink between two hairlines, no plate */
 #view-new .alert{background:none;border:0;border-top:1px solid var(--err);border-bottom:1px solid var(--err);border-radius:0;padding:12px 0;font-weight:400;}
-@media (max-width:900px){
+/* one fold for the whole wizard: 840 is where the page's bands and ledger stack
+   (cosmos's createSplit collapse), so the rail folds with them, not before them */
+@media (max-width:840px){
   #view-new .steps{grid-template-columns:repeat(3,1fr);gap:18px 10px;margin-bottom:30px;}
   #view-new .steps .snum{font-size:18px;}
 }

package/modules/public-landing/public/projects.html

@@ -792,6 +792,25 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002324: the join door (ADR 0182 D1) — how the project
+           stands on the platform's map. The third axis, deliberately its own
+           section: the two above are about the project's OWN pages and its OWN
+           membership; this one is about the map everyone else reads. Same two
+           reads, key for key, as its siblings: the choice shown is the platform's
+           REQUEST (its settings row) and the save's reply is a receipt, never a
+           claim the project already runs it. Plain labels only — Public, Private,
+           Stealth — because the space words are the drawn orb's, not the copy's
+           (the goal's interview decision). The fold is a SIBLING of the volatile
+           slot so no re-render can drop it. -->
+      <div class="card mSec" id="mDoorState">
+        <h2>On the map</h2>
+        <div id="mDoor"><p class="finePrint">Reading the project’s settings…</p></div>
+        <details class="finePrint" id="mDoorWhat">
+          <summary>What each choice changes</summary>
+          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
+        </details>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -5168,6 +5187,7 @@ summary{min-height:24px;padding:3px 0;}
            the GitHub read: entry + tab return, never the in-flight tick */
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
+        if (!keepRepo) loadDoor();
         /* the publish gate (task 1002335) needs no second read — the verdict
            rode in on the instance itself. It sits behind the same keepRepo
            guard because its card holds a textarea the in-flight tick must
@@ -5953,6 +5973,111 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-join-save')) doJoinSave();
   });
 
+  /* ── on the map (task 1002324): the join door, ADR 0182 D1 — the third axis,
+     beside "who can see it" (the project's own sign-in door) and "how people
+     join" (its membership door). The two reads above, key for key: the CHOICE
+     comes from the platform's settings row and the save's reply is a RECEIPT —
+     its push.message is shown verbatim and never painted as the live state,
+     because the value reaches a running project only by the restart the runner
+     performs. Unlike its siblings this section asks the project's manifest
+     nothing: an already-deployed project reports no door yet, and a line that
+     could only ever say "your project doesn't report this" is worse than no
+     line. The read-back arrives with the enforcement (BV1.R11/R12).
+     Labels are PLAIN — Public / Private / Stealth — per the goal's interview:
+     the space metaphor is the drawn orb's, never the copy's. ── */
+
+  var DOOR_OPTIONS = {
+    public: { label: 'Public', blurb: 'The project is on the map under its name, and anyone who finds it can join.' },
+    private: { label: 'Private', blurb: 'On the map under its name, but nobody joins on their own — people ask, and you decide.' },
+    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join.' }
+  };
+  var mDoorSettings = null;  /* the platform row's last answer: { value, options } */
+
+  function doorMsg(html) { $('mDoor').innerHTML = html; }
+
+  function renderDoor() {
+    var s = mDoorSettings;
+    if (!s) return;
+    var opts = (s.options || []).filter(function (v) { return !!DOOR_OPTIONS[v]; });
+    doorMsg('<div role="radiogroup" aria-label="On the map">' + opts.map(function (v) {
+      var o = DOOR_OPTIONS[v];
+      return '<label class="visOpt"><input type="radio" name="mDoorPick" value="' + esc(v) + '"' +
+        (v === s.value ? ' checked' : '') + '><span><b>' + esc(o.label) + '</b>' + esc(o.blurb) + '</span></label>';
+    }).join('') + '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-door-save>Save</button></div>' +
+      '<div class="projMsg" id="mDoorMsg" role="status" aria-live="polite"></div>');
+  }
+
+  function loadDoor() {
+    mDoorSettings = null;
+    doorMsg('<p class="finePrint">Reading the project’s settings…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) {
+            mDoorSettings = {
+              value: (data.settings || {}).visibility,
+              options: (data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
+            };
+            renderDoor();
+            return;
+          }
+          doorMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        doorMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* the save sends the CHOICE and shows the platform's receipt verbatim */
+  function doDoorSave() {
+    if (!manageInst || !mDoorSettings) return;
+    var picked = document.querySelector('#mDoor input[name="mDoorPick"]:checked');
+    if (!picked) return;
+    var value = picked.value;
+    var box = $('mDoorMsg');
+    var btn = document.querySelector('#mDoor [data-door-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ visibility: value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice — the radio follows it, and nothing
+             here claims the project is already running it */
+          mDoorSettings.value = (data.saved || {}).visibility || value;
+          box.className = 'projMsg ok';
+          box.textContent = (data.push && data.push.message) || 'Saved.';
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        /* 409 intent_conflict: the change IS saved (recorded) — the server's
+           sentence says so and names the run holding the slot; show it as is */
+        box.className = e.code === 'intent_conflict' ? 'projMsg' : 'projMsg err';
+        box.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      if (btn) btn.disabled = false;
+      /* the strip + the sibling sections read open_intent — re-read it */
+      loadManage(true, true);
+    });
+  }
+
+  $('mDoor').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-door-save')) doDoorSave();
+  });
+
   /* ── delete the project (task 1003042): the manage page's teardown control.
      It renders from status + open_intent only — no second request — so the
      minute tick can repaint it and a queued teardown appears without a reload.

package/modules/ui-design/kit/serve.js

@@ -134,7 +134,7 @@ const FLOW_RECEIPTS = {
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
   // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
   provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
-  settings: { settings: { platform_visibility: 'public', joinability: 'open' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
+  settings: { settings: { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
 };
 // a teardown or restart ask is REMEMBERED for the run: the page re-reads the project right
 // after a receipt (doDelete → loadManage), and what it must then see is the queued intent —
@@ -160,6 +160,7 @@ function readBody(req, cb) {
 const STUB_VOCAB = {
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
+  visibility: ['public', 'private', 'stealth'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],
@@ -178,7 +179,7 @@ function settingsPatch(res, id, body) {
   const bad = settingsRejection(body);
   if (bad) return json(res, 400, { error: { code: 'validation_failed', message: bad } });
   if (PLANET_KEYS.some((k) => k in body)) PLANETS.set(String(id), Object.fromEntries(PLANET_KEYS.map((k) => [k, body[k] || null])));
-  const policy = ['platform_visibility', 'joinability'].some((k) => k in body);
+  const policy = ['platform_visibility', 'joinability', 'visibility'].some((k) => k in body);
   const push = policy ? FLOW_RECEIPTS.settings.push
     : { queued: false, restart: false, message: 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.' };
   return json(res, 200, { ok: true, saved: FLOW_RECEIPTS.settings.settings, planet: PLANETS.get(String(id)) || NO_PLANET, push });
@@ -209,7 +210,7 @@ function instances(res, id, settings) {
   if (id === null) return json(res, 200, { instances: list });
   const inst = list.find((i) => String(i.id) === String(id));
   if (!inst) return json(res, 404, { error: { code: 'not_found', message: 'no such instance' } });
-  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open' }, planet: PLANETS.get(String(id)) || NO_PLANET, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] } });
+  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, planet: PLANETS.get(String(id)) || NO_PLANET, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'], visibility: ['public', 'private', 'stealth'] } });
   return json(res, 200, { instance: inst, open_intent: inst.open_intent || null });
 }
 // A project's art in the featured fixture may be root-relative (the surface's

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.510",
+  "version": "1.19.512",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.510",
+      "version": "1.19.512",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.510",
+  "version": "1.19.512",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-apply.js

@@ -32,7 +32,7 @@
 //
 // Run:  node scripts/gds/copy-apply.js                    (the task you are HOLDING — the normal call)
 //       node scripts/gds/copy-apply.js --dry-run          (say what would change, write nothing)
-//       node scripts/gds/copy-apply.js --task 1234        (a named task, when you hold more than one)
+//       node scripts/gds/copy-apply.js --task 1234        (a claim you hold, when you hold more than one)
 //       node scripts/gds/copy-apply.js --patch-file p.json  (a local patch — used by the tests)
 //
 // WHY THE BARE FORM DEFAULTS TO YOUR CLAIM rather than taking an id. The task a
@@ -43,6 +43,13 @@
 // task. So the bare call reads the claim, and holding no claim is a refusal that
 // says to go and claim the task — the methodology's own rule, enforced by the
 // command instead of restated in its output.
+//
+// --task DOES NOT OPT OUT OF THAT (task 1003493). It selects which of your
+// claims to act under when you hold several; it is checked against the same
+// /me claim list the bare call reads, and refuses `claim_not_held` for a task
+// you do not hold. The one path that never touches a task is --patch-file,
+// which reads a local JSON patch and is the tests' entry point — it lands
+// nothing a proposal task authorised, so there is no claim for it to prove.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -208,13 +215,50 @@ function refuse(result) {
   return 2;
 }
 
+// Every claim this session holds. One reader, so the bare call and --task are
+// answered from the same source of truth — the shape of bug where a rule is
+// enforced on one path and merely stated on the other (task 1003493).
+async function activeClaims() {
+  const me = await apiCall('GET', '/api/gds/me');
+  if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
+  return { ok: true, claims: me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []) };
+}
+
+// --task <id> names a task; this proves the caller actually HOLDS it. Without
+// this the header's "may only be run under a claim" was true of the bare call
+// and false of the named one — a rule stated three times in prose (here, ADR
+// 0233, modules/copy-desk/CLAUDE.md) and enforced on one of two paths. The
+// refusal names the claims you do hold, because the usual cause is a typo'd id.
+// Pure so the gate is testable without a session: given the id asked for and
+// the claims held, either accept or produce the named refusal.
+function claimGateFor(taskId, claims) {
+  const wanted = String(taskId);
+  const held = (claims || []).map((c) => String(c.task_id));
+  if (held.includes(wanted)) return { ok: true, taskId: wanted };
+  return {
+    ok: false,
+    code: 'claim_not_held',
+    detail: {
+      task: wanted,
+      held,
+      what_this_means: `A copy change lands under a claim like every other change, and you do not hold one on #${wanted}. Claim it first (node scripts/gds/claim.js ${wanted}), then run this again.`,
+    },
+  };
+}
+
+async function claimOnTask(taskId) {
+  const held = await activeClaims();
+  if (!held.ok) return held;
+  return claimGateFor(taskId, held.claims);
+}
+
 // The task this session is holding. Returns a named refusal rather than an id
 // when there is nothing to act under — "claim it first" is the correct answer,
 // not an inconvenience to route around.
 async function claimedTaskId() {
-  const me = await apiCall('GET', '/api/gds/me');
-  if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
-  const claims = me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []);
+  const held = await activeClaims();
+  if (!held.ok) return held;
+  const claims = held.claims;
   if (!claims.length) {
     return {
       ok: false,
@@ -271,6 +315,11 @@ async function main() {
     if (!held.ok) return cliExit(refuse(held));
     taskId = held.taskId;
     console.log(`copy-apply: the task you are holding — #${taskId}`);
+  } else if (taskId) {
+    // --task picks WHICH claim to act under; it never substitutes for holding one.
+    const held = await claimOnTask(taskId);
+    if (!held.ok) return cliExit(refuse(held));
+    taskId = held.taskId;
   }
 
   const loaded = await loadPatch({ taskId, patchFile });
@@ -335,4 +384,5 @@ module.exports = {
   locateOccurrence,
   reinjectInterpolations,
   applyPatchToSource,
+  claimGateFor,
 };