@bongos/core 1.19.523 → 1.19.525

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.523",
-  "core_contract": "1.19.523",
-  "source_commit": "4d6bf53e6443bf737775e277080d2f14f574edad",
+  "core_version": "1.19.525",
+  "core_contract": "1.19.525",
+  "source_commit": "05d381d80b50bdf77128d21d9dbe8b99006aff91",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T23:12:58.339Z",
+  "built_at": "2026-09-04T00:50:39.702Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 431,
+    "docs_redacted": 432,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 1969,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2424,
-  "tree_sha256": "baf1d9a541cc968505997bdc199995e36491ed289791585d1d3dcf1bb66ff004",
+  "file_count": 2425,
+  "tree_sha256": "cd090a2014e8d8d8f09333158a652163b425ad11fef0c4c578802dbd63f91ddf",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1709,10 +1709,15 @@
       "mode": "0000644",
       "sha256": "d8bffd4c66cfddfeadd3c734d029e357f05a8eb804a79e5c3cad4014c9417b56"
     },
+    {
+      "path": "docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md",
+      "mode": "0000644",
+      "sha256": "30cf04604592423e7520fc3e0e7ea8bd020747bcf1b8e712ae339e1e9a5eb324"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "e3bb2c282df45ec41150fd041df3c2525d653184858c2bb0a6c7fff670f4b85c"
+      "sha256": "880547e3bd6629f52c07a17e1d38b70c7f8f80f3bc3984735f13d02effb56b2f"
     },
     {
       "path": "docs/api-reference.md",
@@ -1747,12 +1752,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "804238f39cba79b0503aee0079bde0272398c96b713e26c4f32298cd1db0fc06"
+      "sha256": "e848eaf9b035df899cc6f6d80f98cb8b01c2e9079fc5f32db0dd7b3a73d107ef"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "2df6e1780324aa67c25e347010082441d8267ff754ca3bb76c4071228f0c579d"
+      "sha256": "d4fefb8fce99e3903eec6f0796c9e61b81732a9784fb95fa4a3299fa9da3278a"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2597,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "595be3b748b8664a50fcde28667fbe25e1cf43894753499e9f7b0bbf30518e89"
+      "sha256": "5b4103ec2cd85e4ab6dd6f2906c069b02f90248d37e7bc0b5de3a4408648667f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4527,7 +4532,7 @@
     {
       "path": "modules/hall-ui/public/collab-lib.js",
       "mode": "0000644",
-      "sha256": "e92bc2c42efc40d1d9f0feed680e4363a6698bb82fcceab119765fcdea0a26f5"
+      "sha256": "5930395c551506e374c3e7ff89347f4151612ae336a18d8c13c6a725a3e844b4"
     },
     {
       "path": "modules/hall-ui/public/collab.css",
@@ -4542,7 +4547,7 @@
     {
       "path": "modules/hall-ui/public/collab.js",
       "mode": "0000644",
-      "sha256": "5a5de2593a47336fa82f1919bb904d02a42ed19d1420eaddafaf831312a50541"
+      "sha256": "3e953b00bbd57a248ed233b98b2451d8f49760bd066d5a58466860495c4d2e35"
     },
     {
       "path": "modules/hall-ui/public/collab.states.json",
@@ -4847,7 +4852,7 @@
     {
       "path": "modules/hall-ui/public/oversight.css",
       "mode": "0000644",
-      "sha256": "7c6c29c37950665c90606b846afb6381628d2ab4c362be604bcf359831525051"
+      "sha256": "9aa3fd3f662274571e049eb9931f8dd575eef527a624bc6a5d57102061f54936"
     },
     {
       "path": "modules/hall-ui/public/pair.css",
@@ -5077,7 +5082,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "f3d877972513fa23f2819a91f34c4901ca5e692faad6dcf096377a6b1d5b1be4"
+      "sha256": "b37fa5714da911e20f1cab9bca3e4a76314065dd27cc59fad3bbb7ad9314370b"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -7297,12 +7302,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "36fb0fa1abd3d8ec9b1bee4457ec3a8541e1b753aaaf9fcf93780ac65e3efc9a"
+      "sha256": "a874a97765e31f2c3f6c022d648a27336ae780b1506d065c8f96ea6ddbc017cc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "51c3aef45b0e71569102672d27df52abaff4814663a45da0731ac8b3e9557e0e"
+      "sha256": "4713013d945cec19710bc535aef5a8908151dadc624afb2253378958a0de7d8e"
     },
     {
       "path": "public-docs/index.html",
@@ -8972,7 +8977,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aaf11ce9202e128bdcdd317e26a27a2d1f1ff1a7f73d6d996dc0a79f879ad3b6"
+      "sha256": "122875c28651704555d439dbfec3e148dd9fe3b230e5adaa82b921787ecf508d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9557,7 +9562,7 @@
     {
       "path": "tests/collab_page.mjs",
       "mode": "0000644",
-      "sha256": "5b2872cd852218e4af5c6002318a1f72c677c417bcc43bf47a9fa8e23edb14f2"
+      "sha256": "98408d2e16e0ca596a31e9e97588584717dae126e863323088b5457dfef24420"
     },
     {
       "path": "tests/conductor.mjs",
@@ -10357,12 +10362,12 @@
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",
-      "sha256": "de4b33fd78de12daf1b6e07eeb3834ffd19e912ea81c1d2ba91a129a19e7382a"
+      "sha256": "7e73863dba1bb570f61e3415af6ba84ba74207d9efd11c9032873b2cc1734ee9"
     },
     {
       "path": "tests/hall_board_world.mjs",
       "mode": "0000644",
-      "sha256": "196742bcff58511c21c891011a48448ef95a292bd84dc164d3fccb2620de838a"
+      "sha256": "31013c61fa0099ae2195148aeef5c810996edafc667ea5bc2e4c7176570e4ee7"
     },
     {
       "path": "tests/hall_catalog_world.mjs",
@@ -10372,7 +10377,7 @@
     {
       "path": "tests/hall_collab_world.mjs",
       "mode": "0000644",
-      "sha256": "b597173a0d280286f0f5ff5d13e0065b2c1dc311024d1f13b5c2d0c3915daf45"
+      "sha256": "051bf806c90c8d62f4ab38b25cb0c8c7b49f68858ab223d74b174cedecc13ac6"
     },
     {
       "path": "tests/hall_error_envelope.mjs",

package/docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md

@@ -0,0 +1,185 @@
+# 0241 — The artist gate holds the DEPLOY, not the ship, and it reads a state rather than a judgement
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1003116](https://cloudbongos.com/builders#/task/1003116) (R05 of goal 1000074, the artist's loop) — the decision task the goal placed BEFORE [#1003115](https://cloudbongos.com/builders#/task/1003115) (R04, the review task), so that no code is wired to a gate whose authority is unsettled
+- **Reconciles:** [ADR 0162](<redacted>.md) — review gates retired on `main`; a verdict is advisory and never self-executing
+- **Related:** 0178 (the copy desk flag + queue, which deliberately blocked nothing and named this decision as the one that would settle it), 0233 (a copy proposal is a task carrying a patch), 0016 (authority is resolved server-side, never from a local file), 0120 (pay on land), 0137 (land → release → deploy are three separate gates)
+
+## Context
+
+Goal 1000074 gives the artist real authority over what ships — the owner's ABI brief hands them
+the project's text, its story and ideology, its purpose and gravitas. The goal also carries the
+owner's constraint, verbatim: **blocking strictness is per project, not global.** A project whose
+outputs must be closely monitored should be strict; a project where visuals and copy come
+afterwards can run loose.
+
+And it carries the collision that constraint creates. ADR 0162 retired review gates: after a
+code-owner review requirement stranded two graded-PASS ships inside a day, review requirements on
+`main` were removed permanently, and the principle recorded was that **no human click sits in the
+land path**. An artist who can block a ship is a new human click in the land path. Two rules, one
+of them about to contradict the other, which is exactly the condition R05 exists to end.
+
+## What ADR 0162 actually forbids
+
+This matters, because the shorthand it is usually cited by — "a verdict is advisory, never
+self-executing" — is a paraphrase, and reading the paraphrase instead of the ADR would rule out
+things 0162 explicitly keeps.
+
+0162's own table of what still guards the safety machinery lists four controls and marks three of
+them **fails closed** — including the subagent grader panel, which runs on every GDS ship and parks
+a failing task at `completed`. So 0162 plainly permits an automatic gate that stops work. What it
+retired was something narrower and structural: a gate GitHub could only express as **accounts**.
+Its reasoning is worth restating because it is the test this ADR applies:
+
+1. **Identity-pinned, not rank-based.** GitHub has no concept of GDS ranks, so "code-owner review"
+   degenerated into "one specific account must click." That collides with ADR 0016.
+2. **It stranded work with no escape hatch.** A blocked PR had nowhere to go, including the PRs that
+   fixed the strand.
+
+So the rule 0162 leaves behind is not "nothing may ever block". It is:
+
+> A gate is admissible when it is evaluated automatically, from state the system can read,
+> consistently for every builder, with a named escape hatch. A gate is inadmissible when it
+> requires a particular person to act before work can move, and stalls indefinitely when they
+> do not.
+
+The grader passes that test. A CODEOWNERS review does not. The artist gate has to be built to pass
+it too, and everything below is that shape.
+
+## Decision
+
+### 1. The gate reads a STATE, never an opinion
+
+The blocking condition is **"is there an unresolved artist review task attached to this work?"** —
+not "did the artist approve it?".
+
+That distinction is the whole reconciliation, so it is worth being exact about. An artist's verdict
+never moves anything by itself: an artist saying the copy is bad does not stop a deploy, and an
+artist saying it is fine does not release one. What the system reads is the review task's *status*,
+which is ordinary GDS state that any rank can see and that moves by the ordinary means — the task
+is resolved, dismissed, or shipped. The artist's judgement is what they write **into** that task;
+it stays advisory in precisely 0162's sense.
+
+This is not a technicality to route around the rule. It is what makes the gate rank-consistent and
+machine-checkable rather than identity-pinned: a status is a fact, a judgement is a person.
+
+### 2. Strictness is a per-project setting, and it holds the DEPLOY
+
+Three ordered levels, a project setting like any other:
+
+| Level | Artist review tasks | What is held |
+|---|---|---|
+| `off` | not generated | nothing |
+| `advisory` | generated | nothing |
+| `strict` | generated | **the deploy** — the instance's pin may not move while one is unresolved |
+
+**`strict` holds the deploy, not the ship** (owner ruling, 2026-09-03). This is the load-bearing
+choice, and it is what lets a real gate coexist with 0162 rather than merely arguing with it:
+
+- **No builder is ever stranded.** Their work is graded, merged, credited and landed on `main` on
+  CI alone, exactly as today. The wave-4 strand class that forced 0162 cannot recur, because
+  nothing an artist does can hold a builder's ship at `completed` or their credits at unpaid.
+- **It gates what the artist was actually given.** The ABI brief hands the artist what users see —
+  no slop appearance, the project's text, whether story and gravitas land. Users see the deployed
+  instance, not `main`. ADR 0137 already separates land, release and deploy into three gates; the
+  artist's authority attaches to the third one, which is the one their mandate is about.
+- **Nothing is ever un-shipped.** The gate can only delay a pin move, an action that is already
+  deliberate, already owner-initiated, and already reversible by doing it later.
+
+### 3. The escape hatch is the project owner, and it is never quiet
+
+At `strict`, an unresolved review can be released past by the **project owner only** — not the
+builder, not any Metic+, and not the artist (owner ruling, 2026-09-03). The owner's reason is
+recorded because it constrains the implementation: *people can be both artist and builder, so they
+could potentially pass their own work; they should care about passing the grade, or improving the
+grader.*
+
+Two things follow, and the second is a reading of that reason rather than a literal instruction —
+flagged as such so it can be corrected:
+
+- The right answer to being gated is to **fix the work or fix the grader**, not to wave it through.
+  The release valve exists so a project never deadlocks, not as a routine step.
+- A solo instance would deadlock under a strict self-approval bar — on this instance the owner is
+  frequently also the builder and the artist. So a self-release is **permitted and recorded as
+  such**: releasing past a gate on your own work is allowed, is written to the audit log as a
+  self-override with a required rationale, and is visible in the ledger. It costs visibility rather
+  than being impossible. If the owner meant the harder rule — that you may never release your own
+  work, and a solo project must resolve the review properly or stay undeployed — that is a
+  one-line change here and in R04's implementation.
+
+The mechanism is the one that already exists for a failed grader verdict: the override-request
+(`POST /tasks/:id/override-request`, rationale required, audit-logged). No new machinery, no second
+authority path, and the escape hatch 0162's incident found missing is present from the first day.
+
+### 4. The default is `strict`
+
+Owner ruling, 2026-09-03, against the recommendation this ADR's author put forward (`advisory`, on
+the grounds that a gate arriving by default is how 0162's incident happened).
+
+The ruling is coherent with §2 and is recorded with its consequence stated plainly: because
+`strict` holds only the deploy, a default-strict project cannot strand a builder — the worst case
+is a project whose pin waits on a review nobody has done yet. That is a visible, owner-fixable
+state, not a silent one, and the owner holds the release valve. **This instance is included**: once
+R04 ships, moving cloudbongos.com's pin will require the artist reviews on that release's copy and
+visual work to be resolved or released.
+
+Two guards on that, which R04 must implement rather than assume:
+
+- A project at `strict` with **no artist** must still be able to deploy. The review task exists, it
+  is unresolved, and the owner releases it — a project with nobody in the role is the normal case
+  for a new instance, and a default that bricks new instances is not a default.
+- The gate must say **what** is holding the deploy and **which** control releases it, in one line
+  at the point of refusal. 0162's incident was made worse by a blocked state that did not explain
+  itself.
+
+### 5. Tightening the setting is not retroactive
+
+When a project raises its strictness, the new level applies to work that ships **after** the
+change. Already-shipped work is not retroactively gated, and an already-moved pin is never rolled
+back.
+
+The alternative — re-gating history — would mean a single setting change could strand a project's
+next deploy behind a backlog of review tasks for work nobody remembers, and would make the setting
+frightening to raise. A project that genuinely wants its existing surface reviewed has a better
+tool already: R02's flag queue, which is exactly the mechanism for "someone should look at this
+copy that already shipped."
+
+Loosening is symmetric and immediate: unresolved review tasks stay on the board as ordinary work,
+they simply stop holding the pin.
+
+## Consequences
+
+- **R04 ([#1003115](https://cloudbongos.com/builders#/task/1003115)) is now buildable**, and its
+  brief is narrowed by this ADR: it generates the review task and attaches it, and the gate it
+  wires is a state check at the deploy step. It does not build an approval UI, and it must not
+  make a verdict self-executing.
+- **A new project setting** is added to the project settings vocabulary
+  (`artist_gate ∈ off | advisory | strict`, default `strict`). It is a policy key the running
+  instance obeys, the same shape as the join door (ADR 0238).
+- **ADR 0162 is reconciled, not amended.** Nothing in it changes: `main` still carries required
+  status checks only, no human click sits in the land path, and no CODEOWNERS file returns. This
+  ADR adds a gate on a *different* boundary — the deploy — and adopts 0162's own admissibility
+  test to do it.
+- **The paraphrase is corrected.** Several surfaces cite 0162 as "verdicts are advisory, never
+  self-executing" (this project's skills and ADRs 0178 and 0233 among them). That shorthand is
+  true of *verdicts* and false as a blanket claim about gates — 0162's own table has three
+  controls that fail closed. Cite the test in §1 above rather than the slogan.
+- **Accepted trade:** an artist who never does the work can delay a project's deploys. That is the
+  point of `strict`, it is per project, it is owner-releasable, and the owner chose it as the
+  default with that consequence stated.
+
+## Rejected
+
+- **Blocking the ship instead of the deploy.** The strongest version of the artist's authority, and
+  the one that recreates 0162's incident exactly: a builder's graded, merged work parked behind
+  another person's queue, with their credits unpaid (ADR 0120 pays on land).
+- **Advisory at every level.** Consistent with 0162 by doing nothing, but then "blocking strictness
+  is per project" configures nothing and the owner's rule is unimplemented.
+- **Any Metic+ as the escape hatch.** Lowest friction, and it makes `strict` indistinguishable from
+  `advisory` in practice.
+- **Making the artist's verdict itself the gate.** The direct reading of "artist blocking", and the
+  one thing 0162 genuinely forbids: it pins the gate to a person, and stalls indefinitely when that
+  person is unavailable.
+- **Retroactive tightening.** See §5.
+- **A global strictness constant.** The owner's constraint rules it out by name.

package/docs/adr/README.md

@@ -328,5 +328,6 @@ This keeps the decision history honest and traceable.
 | 0237 | [**A starter bundle is a preset over the always-on core, keyed by the declared project type** ([task 1002338](https://cloudbongos.com/builders#/task/1002338) · goal 1000046, criterion `proj-module-select`). "During setup a default set of modules is pre-selected" can only mean the OPT-IN modules, since every instance already boots with the same sixteen `default: true` core-domain ones — so a bundle is a short list of opt-in module keys layered on that floor, preselected and freely toggled off by R20's picker ([task 1002339](https://cloudbongos.com/builders#/task/1002339)). **The key is the DECLARED type, and the seeded vocabulary is stale:** the task text (2026-07-17) names *Game / SaaS-Tool / Community*, but task [1002772](https://cloudbongos.com/builders#/task/1002772)'s owner decision (2026-08-13) fixed the live closed set as `game · research · business · non-profit · not-sure` — two CHECK constraints, two `PROJECT_TYPES` constants and five wizard buttons — and "community" survives only as a `team_shape`. Two constraints ride the key: the arrow runs **type → modules, never back** (1002772 rejected inferring type from module flags, which flip all through setup), and the R15 interview must **not re-ask** what `type` declares, so R19 adds no `PROJECT_DETAIL_VOCAB` key and no migration. `not-sure` and *undeclared* resolve to the same modules but are deliberately different answers — `type` is nullable precisely so "nobody said" is never back-filled with a guess, and the resolver returns `type: null` with its own copy. **The declaration is pinned by a test, not a runtime catalog read:** a module may not import `src/module-loader/catalog.js` (the one-way rule, [ADR 0083](<redacted>.md)), so `modules/provisioning/starter-bundles.js` stays PURE like `onboard-plan.js` beside it and `tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off disk — failing the build if a bundle names a module that does not exist, if `ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names an always-on module (a preselect that toggles nothing), or if it names one of the two hub-only modules. The bundles are `game → dev-box, discord`; `research → agents`; `business → agents, dev-box`; `non-profit → discord`; `not-sure → —`, and they are SHORT because today's opt-in catalog is three modules wide and a preselect an owner must audit is worse than none. Served whole at public `GET /provisioning/starter-bundles` (`{ core, bundles }`, same absent gate as `onboard-plan`) so the picker re-preselects without a refetch and R17's recommendations read the same shape. A bundle is **never a publish precondition** — [ADR 0182](<redacted>.md) D4 fixes that bar at name + description alone. Rejected: a runtime catalog read, a `bundle` key in the interview vocabulary, inferring the bundle from the description (the deferred AI layer, [task 1003500](https://cloudbongos.com/builders#/task/1003500)), and keeping the seeded Game/SaaS-Tool/Community triple.](<redacted>.md) | provisioning / project creation |
 | 0239 | [**A recommendation is a table that carries its own reason; governance is a preview and invites are a seam** ([task 1002336](https://cloudbongos.com/builders#/task/1002336) · goal 1000046, criteria `proj-module-select` / `proj-governance-reco` / `proj-invite-builders`). R19 ([ADR 0237](<redacted>.md)) declared the per-type starter bundle and said outright it is "a declaration and not a rule engine — R17/R22 own the layer that reasons"; this is that layer, and the goal pins it **rule-based**, with the AI/embeddings pass deferred ([task 1003500](https://cloudbongos.com/builders#/task/1003500), idea 1000552). **Two inputs, and the free-text description is not one of them:** the DECLARED `type` (a column) and `team_shape` (the one closed-answer key the R15 interview collects, [task 1002334](https://cloudbongos.com/builders#/task/1002334)) — inferring from prose is the deferred layer ADR 0237 §7 already rejected once. The engine is three frozen tables (`TEAM_SHAPE_RULES` add/remove ONE opt-in module; `GOVERNANCE_RULES` name a preset; `INVITE_RULES` emit a seek) and **every row carries its own `reason` sentence**, shipped with the effect rather than reconstructed by whichever surface renders it — a recommendation an owner cannot be told the reason for is one they cannot disagree with. `bundle.adjustments` is a **DELTA**: a rule whose condition matched but whose module the bundle already carried records NOTHING, because "we switched discord on because you said community" over a module a game would have had anyway is a claim the owner can check and find false. **Governance is a named preview, never a setting** — the governance module is planned and unbuilt (goal 1000030), so a preset is a name plus one sentence of what it feels like (`owner-only` / `trusted-team` / `open-contribution`) and every result carries `applied: false`, one flag instead of the same fact hardcoded in R25, R18, the wizard and the project page. **Invites are a SEAM**: `suggested` is always `[]` because ranking builders means querying the leaderboard in the sibling `economy` module, which the one-way rule ([ADR 0083](<redacted>.md)) forbids importing — the engine emits `seeking: { kind: 'top-builders', limit }` (or `null` = suggest nobody, a real answer) and R28 ([task 1002347](https://cloudbongos.com/builders#/task/1002347)) turns it into names. **Skipping is an answer:** every table states a default and each is the NARROWEST option (widening later costs one setting; a role granted to strangers is not recovered by setting it back), an off-vocabulary `team_shape` reads as no answer exactly as `normalizeProjectDetail` drops it, and the route answers 200-with-defaults rather than 400 — refusing would make the supported path ([ADR 0182](<redacted>.md) D4) an error. `tailored: boolean` is the machine-readable half of `proj-detail-interview`'s details-vs-skip split that R18 ([task 1002337](https://cloudbongos.com/builders#/task/1002337)) proves. Served at public `GET /provisioning/recommendations?type=&team_shape=` (same absent gate as `starter-bundles`; no database, pinned by a `pool`-throws stub), returning ADR 0237 §5's bundle shape plus `adjustments` so a recommendation and R20's preselect can never name different modules. Rejected: reading the description, filling `suggested` from `GET /public/leaderboard`, a weighted scoring function, a reason per matched condition, and a 400 on an unknown shape.](<redacted>.md) | provisioning / project creation |
 | 0240 | [**A skipped module picker stores nothing, and the bundle is resolved on read** ([task 1002339](https://cloudbongos.com/builders#/task/1002339) · goal 1000046, criterion `proj-module-select`). [ADR 0237](<redacted>.md) declared the starter bundles and closed with "where a chosen selection lands is R20's decision". It lands in a new **nullable** `modules jsonb` column on `provisioning_instances` (`provisioning_014`), read through `starter-bundles.effectiveModules(row)` and **three-valued**: `NULL` = nobody answered (the picker was skipped, or the caller does not ask) and the declared type's bundle is resolved AT READ TIME; `[]` = the owner switched them all off, a real answer; `["dev-box",…]` = what they picked. `NOT NULL DEFAULT '[]'` was rejected because it collapses the first two forever — the `PROJECT_DETAIL_VOCAB` rule ("absent stays absent, skipped stays skipped") applied to a list. **Skipping is safe because the preselect and the fallback are the same function**, `bundleForProjectType`, called twice — not two lists kept in agreement — so `bongos onboard` and any API caller inherit the bundle by omitting the field, and the canonical sequence in `onboard-plan.js` grows **no new step** (the picker refines `type`, an answer already in it). NOT `detail` (its vocabulary is closed + scalar by construction, and [ADR 0237](<redacted>.md) §2 ruled the interview must not ask this) and NOT `settings` (a setting is a policy the RUNNING instance obeys — web.env, a settings-apply intent, a restart). The picker's catalog copy (`OPTIONAL_MODULES`) is **declared beside the bundles**, because `module.json` descriptions are written for builders, `GET /modules` needs a session the signed-out wizard has not got, and `GET /public/modules` serves booleans — pinned the ADR 0237 way, so a new `default: false` module cannot ship without owner-facing copy. `GET /provisioning/starter-bundles` gains `optional` so the preselect and the catalog arrive in **one** read. The route **refuses** an unknown / always-on / hub-only key (`400 bad_modules`) rather than dropping it silently (`badProjectDetail`'s rule), and a re-request reports `modules_ignored`. The column is a DECLARATION, not yet an input to the control-plane runner. Rejected: storing the preselect on a skip (it writes down an answer nobody gave), a new `onboardPlan` step, and rendering the always-on core as sixteen disabled toggles (a disabled control reads as a choice the owner failed to make).](<redacted>.md) | provisioning / project creation |
+| 0241 | [**The artist gate holds the DEPLOY, not the ship, and it reads a state rather than a judgement** ([task 1003116](https://cloudbongos.com/builders#/task/1003116) · goal 1000074, criterion `artist-blocking-is-per-project` — R05, the DECISION task the goal placed before R04 so no code would be wired to an unsettled gate). Goal 1000074 carries two rules on a collision course: the owner's "blocking strictness is PER PROJECT, not global", and [ADR 0162](<redacted>.md), which retired review gates on `main` after a code-owner requirement stranded two graded-PASS ships in a day. **0162 is usually cited by a paraphrase — "a verdict is advisory, never self-executing" — and the paraphrase is wrong as a blanket claim:** 0162's own table of compensating controls marks three of four as *fails closed*, the subagent grader among them. What it actually retired was a gate GitHub could only express as ACCOUNTS — identity-pinned against [ADR 0016](<redacted>.md), and stranding with no escape hatch. So the surviving test is: **a gate is admissible when it is evaluated automatically from readable state, consistently for every builder, with a named escape hatch; inadmissible when a particular person must act and it stalls when they do not.** Decision: (1) the gate reads a **STATE** — "is there an unresolved artist review task?" — never an opinion, so the artist's judgement is what they write INTO the task and stays advisory in exactly 0162's sense, while what the system reads is ordinary GDS status; (2) strictness is a project setting `artist_gate ∈ off | advisory | strict` and at `strict` it holds the **DEPLOY, not the ship** (owner ruling) — the builder's work is graded, merged, credited and landed on CI alone exactly as today, so 0162's strand class cannot recur, and the gate attaches to the boundary the artist's ABI mandate is actually about (users see the deployed instance, not `main`; [ADR 0137](<redacted>.md) already splits land/release/deploy); (3) the escape hatch is the **project OWNER only** — not the builder, not any Metic+, not the artist — via the existing `POST /tasks/:id/override-request`, because a person can be both artist and builder and could pass their own work; a self-release is permitted but never quiet (required rationale, audit-logged as a self-override) so a solo instance cannot deadlock; (4) the default is **`strict`** (owner ruling, against the author's `advisory` recommendation), which is safe only because §2 holds the deploy — the worst case is a pin that waits, and this instance is included once R04 ships; a project with no artist must still be able to deploy, and the refusal must name what holds it and which control releases it; (5) tightening is **not retroactive** — re-gating history would strand the next deploy behind reviews for work nobody remembers and make the setting frightening to raise; R02's flag queue is the right tool for already-shipped copy. Rejected: blocking the ship (recreates 0162's incident exactly, with credits unpaid — [ADR 0120](<redacted>.md)); advisory at every level (configures nothing); any Metic+ as the hatch (makes `strict` indistinguishable from `advisory`); making the artist's VERDICT the gate (the one thing 0162 genuinely forbids); retroactive tightening; a global constant (ruled out by the owner's constraint by name).](<redacted>.md) | goal 1000074 / the artist's loop |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1646 strings** across 3 surfaces · 1428 distinct pieces of copy · 1646 certain, 0 heuristic · 154 shown in more than one place.
+**1645 strings** across 3 surfaces · 1427 distinct pieces of copy · 1645 certain, 0 heuristic · 154 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 73 | 1188 |
+| `builders-hall` | `modules/hall-ui/public` | 73 | 1187 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
 | `landing` | `modules/public-landing/public` | 5 | 360 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `60b248791dc3` | 2x | Builders — {{worldName}} | modules/hall-ui/public/roster.html:6, modules/hall-ui/public/roster.html:6 |
 | … | | _114 more in the JSON registry_ | |
 
-## `builders-hall` — 1188 strings
+## `builders-hall` — 1187 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -129,7 +129,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a3185a43c230` | certain | A sound plays at each turn of your work — a gentle chime when Claude finishes, a flourish when a task ships or | `modules/hall-ui/public/settings.html:312` |
 | `83b1274f9088` | certain | A tally of recorded work sessions, and the latest five. The full record lives on the Sessions page. | `modules/hall-ui/public/watch.html:103` |
 | `daf73127afff` | certain | A word on why | `modules/hall-ui/public/hall-render.js:284` |
-| `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:173` |
+| `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:196` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
 | `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1154` |
@@ -284,7 +284,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/task.js:710` |
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:629` |
 | `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:318` |
-| `8a4b590fa1a0` | certain | Could not load requests. | `modules/hall-ui/public/collab.js:251` |
+| `8a4b590fa1a0` | certain | Could not load requests. | `modules/hall-ui/public/collab.js:274` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:243` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:281` |
 | `b2147cc90e36` | certain | Could not load the idea template. Reload, or file from the terminal with capture.js. | `modules/hall-ui/public/ideas.js:611` |
@@ -608,7 +608,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c72e0bdb834a` | certain | Not declared in module.json — this is who ships the module. | `modules/hall-ui/public/modules.js:62` |
 | `361b353ded5e` | certain | Not enough shipped work yet to chart. | `modules/hall-ui/public/hall-widgets.js:184` |
 | `90230572d017` | certain | Not found | `modules/hall-ui/public/task.js:698` |
-| `8226c979db4d` | certain | Not now | `modules/hall-ui/public/collab.js:173` |
+| `8226c979db4d` | certain | Not now | `modules/hall-ui/public/collab.js:196` |
 | `61250b49a90b` | certain | Not scored. | `modules/hall-ui/public/idea.js:84` |
 | `8d6afe6def47` | certain | Not signed in | `modules/hall-ui/public/settings.html:40` |
 | `a290f6c14df9` | certain | Not taking requests | `modules/hall-ui/public/goals-render.js:859` |
@@ -761,7 +761,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e8e4e49fe8f4` | certain | Saves when you press Save; shows everywhere at once. | `modules/hall-ui/public/settings.html:88` |
 | `42cbc20a6ec8` | certain | Saves when you press Save; your next | `modules/hall-ui/public/settings.html:136` |
 | `fc9d783ed0f5` | certain | Say why it is better. Whoever reviews this decides it from your reason, without asking you. | `modules/hall-ui/public/copy-desk.js:446` |
-| `12c1ec21a2c6` | certain | Say yes | `modules/hall-ui/public/collab.js:173` |
+| `12c1ec21a2c6` | certain | Say yes | `modules/hall-ui/public/collab.js:196` |
 | `46711f7bc3df` | certain | Search every string the product shows a person, by what it says or the file it lives in. | `modules/hall-ui/public/copy-desk.html:65` |
 | `5d2ba8e72fa1` | certain | Search failed. | `modules/hall-ui/public/copy-desk.js:343` |
 | `373a7639bcb9` | certain | Sections in this primer | `modules/hall-ui/public/primer.html:52` |
@@ -815,7 +815,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:490` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:284` |
-| `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:90` |
+| `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:113` |
 | `867df58c9aaa` | certain | Something else | `modules/hall-ui/public/copy-desk.html:95` |
 | `c377d8ed744b` | certain | Something went wrong. Try again. | `modules/hall-ui/public/profile-connections.js:275` |
 | `e0767e80206c` | certain | Sound for {…} | `modules/hall-ui/public/settings.js:311` |
@@ -1044,7 +1044,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b867876e8b6c` | certain | and press Enter. | `modules/hall-ui/public/hall-render.js:750` |
 | `b4033000c537` | certain | as a table | `modules/hall-ui/public/profile-charts.js:202` |
 | `d7c511423bc0` | certain | as configuration: {…} | `modules/hall-ui/public/government.js:707` |
-| `09db3fd4355b` | certain | asked by {…} | `modules/hall-ui/public/collab.js:69` |
 | `63bd14f73960` | certain | author trusted | `modules/hall-ui/public/gate.js:141` |
 | `93438b9ffa98` | certain | below or type | `modules/hall-ui/public/box-panel.js:226` |
 | `1f5e924adf9d` | certain | box — | `modules/hall-ui/public/box-panel.js:336` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1646,
-    "unique_ids": 1428,
-    "certain": 1646,
+    "strings": 1645,
+    "unique_ids": 1427,
+    "certain": 1645,
     "heuristic": 0,
     "duplicate_ids": 154
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 73,
-      "strings": 1188
+      "strings": 1187
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -2072,7 +2072,7 @@
       "surface": "builders-hall",
       "text": "A {…} — you are a {…}. Mingle pairs across crafts.",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 173,
+      "line": 196,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3467,7 +3467,7 @@
       "surface": "builders-hall",
       "text": "Could not load requests.",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 251,
+      "line": 274,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6383,7 +6383,7 @@
       "surface": "builders-hall",
       "text": "Not now",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 173,
+      "line": 196,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7760,7 +7760,7 @@
       "surface": "builders-hall",
       "text": "Say yes",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 173,
+      "line": 196,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8246,7 +8246,7 @@
       "surface": "builders-hall",
       "text": "Someone helped",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 90,
+      "line": 113,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10302,15 +10302,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "09db3fd4355b",
-      "surface": "builders-hall",
-      "text": "asked by {…}",
-      "file": "modules/hall-ui/public/collab.js",
-      "line": 69,
-      "origin": "js-markup",
-      "confidence": "certain"
-    },
     {
       "id": "63bd14f73960",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -1483,5 +1483,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.521 with no explicit bump. run 33815020928. (task 1002620)
   1.19.523 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.522 with no explicit bump. run 33816191865. (task 1002620)
+  1.19.524 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.523 with no explicit bump. run 33818285201. (task 1002620)
+  1.19.525 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.524 with no explicit bump. run 33823218193. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/collab-lib.js

@@ -51,19 +51,42 @@
     return (ta || 0) - (tb || 0);
   }
 
-  // Who a request is addressed to, in words. A craft request and a by-name
-  // request read differently on purpose: "asked of builders" is a call anyone of
-  // that craft may take, "asked of you" is personal and should feel it. A
-  // by-name ask that is not yours names the person when the server joined a
-  // name, and says "one person" when it did not.
-  function addressedTo(req, viewerId) {
-    if (req && req.needs_builder_id != null) {
-      if (String(req.needs_builder_id) === String(viewerId)) return 'asked of you by name';
-      var name = req.needs_builder_name || req.needs_builder_login;
-      return name ? 'asked of ' + name + ' by name' : 'asked of one person';
+  // `addressedTo(req, viewerId)` WAS HERE and is gone (task 1003274). It named
+  // the addressee only when the VIEWER was the addressee, which is why the
+  // asker's own list — the most common case for that branch — rendered "asked of
+  // one person" and produced the owner's report. directionLine below supersedes
+  // it on both axes (it names the person AND says which way the ask points), and
+  // it had no other caller, so keeping it would have left a second, wronger
+  // answer to the same question sitting exported next to the right one.
+
+  // DIRECTION, in words (owner report, task 1003274). The report is the whole
+  // reason this exists: the owner read their own outgoing ask, addressed to Lars,
+  // sitting under "Your asks", and concluded it had been sent to the wrong person.
+  // Nothing was misrouted — the row simply never said WHO, and never said which
+  // way it pointed.
+  //
+  // DIRECTION IS THE LIST, NOT A COMPARISON. `dir` is 'out' for your own asks and
+  // 'in' for what was asked of you, because the two server reads already answer
+  // that question by construction (GET /help-requests/mine vs /for-me). Deriving
+  // it instead from `requested_by === viewerId` is what the old code did, and it
+  // is how a page with no viewer id in hand ends up rendering the anonymous
+  // fallback for the single most common case — the asker reading their own list.
+  //
+  // The tonal split the report asks to KEEP: a craft ask is a call anyone of that
+  // craft may take; a by-name ask is personal and says so.
+  function directionLine(req, dir) {
+    if (!req) return '';
+    var craft = req.needs_craft;
+    if (dir === 'out') {
+      if (req.needs_builder_id != null) {
+        var to = req.needs_builder_name || req.needs_builder_login;
+        return to ? 'You asked ' + to + ' by name' : 'You asked one person';
+      }
+      return craft ? 'You asked ' + craft + 's' : 'You asked';
     }
-    if (req && req.needs_craft) return 'asked of ' + req.needs_craft + 's';
-    return 'asked';
+    var who = askerOf(req) || 'Someone';
+    if (req.needs_builder_id != null) return who + ' asked you by name';
+    return craft ? who + ' asked ' + craft + 's' : who + ' asked';
   }
 
   // Who is ASKING, in words — the fact a helper needs to answer. The name the
@@ -107,7 +130,8 @@
 
   window.OTBCollabLib = {
     BANDS: BANDS, ageBand: ageBand, byAgeOldestFirst: byAgeOldestFirst,
-    addressedTo: addressedTo, askerOf: askerOf, contextOf: contextOf,
+    askerOf: askerOf, contextOf: contextOf,
+    directionLine: directionLine,
     titleOf: titleOf, groupOf: groupOf,
   };
 })();

package/modules/hall-ui/public/collab.js

@@ -59,14 +59,37 @@
     return `<a class="fact-chip" href="${escapeHtml(ctx.href)}">${escapeHtml(ctx.kind)} #${escapeHtml(String(ctx.id))}</a>`;
   }
 
-  // Who to answer: the asker's name, as a door to their profile.
-  function askerFact(req) {
-    const name = L.askerOf(req);
+  // A name as a door to that builder's profile, or plain text when the server
+  // sent no id to link to.
+  function personLink(id, name) {
     if (!name) return '';
-    const who = req.requested_by != null
-      ? `<a href="/builders/profile?id=${escapeHtml(String(req.requested_by))}">${escapeHtml(name)}</a>`
+    return id != null
+      ? `<a href="/builders/profile?id=${escapeHtml(String(id))}">${escapeHtml(name)}</a>`
       : escapeHtml(name);
-    return `<span class="ov-fact">asked by ${who}</span>`;
+  }
+
+  // DIRECTION, on the row (owner report, task 1003274): "<name> asked you by
+  // name" incoming, "You asked <name> by name" outgoing — so an outgoing ask can
+  // never be mistaken for an incoming one, which is exactly the mistake the
+  // report describes. The sentence itself is L.directionLine (pure, tested); this
+  // only splices the profile link over the person's name inside it, so the words
+  // a test asserts and the words a builder reads cannot drift.
+  function directionFact(req, dir) {
+    const line = L.directionLine(req, dir);
+    if (!line) return '';
+    const name = dir === 'in' ? L.askerOf(req) : (req.needs_builder_name || req.needs_builder_login);
+    const id = dir === 'in' ? req.requested_by : req.needs_builder_id;
+    const link = personLink(id, name);
+    // The replacement is a FUNCTION, not a string. String.prototype.replace
+    // treats `$&`, `$$`, "$`" and `$'` specially in a string replacement, and the
+    // name here is builder-controlled (a display_name or login) — so a display
+    // name containing `$&` would duplicate or mangle the sentence around it. Not
+    // an injection (both halves are escaped either way), but a real way to
+    // corrupt someone else's row by choosing your own name.
+    const html = (name && link)
+      ? escapeHtml(line).replace(escapeHtml(name), () => link)
+      : escapeHtml(line);
+    return `<span class="ov-fact">${html}</span>`;
   }
 
   // A row for the "asked of you" list. There is deliberately NO "claim this"
@@ -77,7 +100,7 @@
   function forMeRow(req, nowMs) {
     return `<li class="ov-row" data-id="${escapeHtml(String(req.id))}">
       <div class="ov-row__main">${titleHtml(req)}
-        <div class="ov-row__facts">${askerFact(req)}${contextChip(req)}</div>
+        <div class="ov-row__facts">${directionFact(req, 'in')}${contextChip(req)}</div>
       </div>
       <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
     </li>`;
@@ -89,7 +112,7 @@
     const id = escapeHtml(String(req.id));
     return `<li class="ov-row" data-id="${id}">
       <div class="ov-row__main">${titleHtml(req)}
-        <div class="ov-row__facts"><span class="ov-fact">${escapeHtml(L.addressedTo(req, null))}</span>${contextChip(req)}</div>
+        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}</div>
       </div>
       <div class="ov-row__right">${ageChip(req, nowMs)}
         <div class="ov-row__actions">

package/modules/hall-ui/public/oversight.css

@@ -284,7 +284,7 @@ a.fact-chip:hover { color: var(--accent-ink); border-color: var(--accent-ink); t
   align-items: center;
   justify-content: center;
   padding: 20px;
-  background: color-mix(in srgb, var(--ink) 40%, transparent);
+  background: var(--scrim);
 }
 .ov-modal {
   width: 100%;

package/modules/hall-ui/public/style.css

@@ -963,7 +963,7 @@ main:focus { outline: none; }
   position: fixed;
   inset: 0;
   z-index: var(--z-scrim);
-  background: rgba(0, 0, 0, .55);
+  background: var(--scrim);
 }
 
 /* Focus: the world's two-tone ring — a 2px accent-derived outline at 3px offset
@@ -2695,7 +2695,7 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   position: fixed;
   inset: 0;
   z-index: 2000;
-  background: rgba(0, 0, 0, .55);
+  background: var(--scrim);
   display: flex;
   align-items: center;
   justify-content: center;
@@ -3190,7 +3190,7 @@ a.stat-tile:hover .stat-tile__sub { color: var(--ink-soft); }
 }
 
 .palette { position: fixed; inset: 0; z-index: 2100; }
-.palette__scrim { position: absolute; inset: 0; background: color-mix(in srgb, var(--ink) 45%, transparent); }
+.palette__scrim { position: absolute; inset: 0; background: var(--scrim); }
 .palette__panel {
   position: relative;
   margin: 10vh auto 0;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.523",
+  "version": "1.19.525",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.523",
+      "version": "1.19.525",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.523",
+  "version": "1.19.525",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.523'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.525'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/collab_page.mjs

@@ -97,10 +97,67 @@ test('the page NEVER sends a craft — matching is the server\'s job', () => {
 });
 
 test('a craft request and a by-name request read differently', () => {
+  // `addressedTo` is GONE (task 1003274) — it named the addressee only when the
+  // viewer WAS the addressee, so the asker's own list rendered anonymously, which
+  // is the whole owner report. directionLine replaced it on both axes and had to
+  // take the tonal split with it, which is what this now asserts.
   const L = lib();
-  assert.match(L.addressedTo({ needs_craft: 'artist' }, 1), /artists/);
-  assert.match(L.addressedTo({ needs_builder_id: 7 }, 7), /by name/);
-  assert.match(L.addressedTo({ needs_builder_id: 7 }, 9), /one person/);
+  assert.equal(L.addressedTo, undefined, 'the superseded helper is not left exported');
+  assert.match(L.directionLine({ needs_craft: 'artist' }, 'out'), /artists/);
+  assert.match(L.directionLine({ needs_builder_id: 7, needs_builder_name: 'Ada' }, 'out'), /by name/);
+});
+
+// ── DIRECTION: the owner's report (task 1003274) ────────────────────────────
+//
+// "the ask went to me, not Lars it seems... It says Lars- as your asks but I am
+// not Lars." Nothing was misrouted: the owner was reading their OWN outgoing ask,
+// addressed to Lars, under "Your asks" — and the row said neither who it went to
+// nor which way it pointed. The label read "asked of one person".
+//
+// The reason the old code could not name them is worth keeping: it named the
+// addressee only when the VIEWER was the addressee, so the single most common
+// case for that branch — the asker reading their own list — was the one case it
+// rendered anonymously.
+
+test('THE REPORTED CASE: your own by-name ask names the person you asked', () => {
+  const L = lib();
+  const req = { needs_builder_id: 3, needs_builder_name: 'Lars', requested_by: 1000025 };
+  const line = L.directionLine(req, 'out');
+  assert.match(line, /Lars/, 'the addressee is named — this is the whole bug');
+  assert.match(line, /^You asked/, 'and it says which way it points');
+});
+
+test('DIRECTION cannot be mistaken: outgoing and incoming read as opposites', () => {
+  const L = lib();
+  const out = L.directionLine({ needs_builder_id: 3, needs_builder_name: 'Lars' }, 'out');
+  const inc = L.directionLine({ needs_builder_id: 9, requested_by_name: 'Lars' }, 'in');
+  assert.match(out, /^You asked Lars by name$/);
+  assert.match(inc, /^Lars asked you by name$/);
+});
+
+test('direction comes from the LIST, not from comparing ids', () => {
+  // The two server reads already answer the question by construction
+  // (/help-requests/mine vs /for-me), so directionLine takes no viewer id. That
+  // is what makes the asker's own list impossible to render anonymously — there
+  // is no comparison left to get wrong.
+  const L = lib();
+  assert.equal(L.directionLine.length, 2, 'req + dir, and no viewerId');
+});
+
+test('the craft tone survives — a craft ask is not a personal one', () => {
+  // ADR 0187 §3's split, which the fix was told to keep: "asked of builders" is a
+  // call anyone of that craft may take; a by-name ask is personal and says so.
+  const L = lib();
+  assert.match(L.directionLine({ needs_craft: 'artist' }, 'out'), /^You asked artists$/);
+  assert.match(L.directionLine({ needs_craft: 'artist', requested_by_name: 'Lars' }, 'in'),
+    /^Lars asked artists$/, 'incoming craft asks say the craft, not "you"');
+});
+
+test('an unnamed addressee still says which way it points', () => {
+  // An older server sends no join. Losing the name must not lose the direction.
+  const L = lib();
+  assert.match(L.directionLine({ needs_builder_id: 3 }, 'out'), /^You asked one person$/);
+  assert.match(L.directionLine({ needs_builder_id: 3 }, 'in'), /^Someone asked you by name$/);
 });
 
 test('context links to the task or goal, and to neither when absent', () => {

package/tests/hall_audit.mjs

@@ -527,3 +527,69 @@ test('the command palette input rings from the token tier, inside its own box',
   assert.match(css, /\.palette__panel\s*\{[^}]*overflow:\s*hidden/, 'the panel still clips, so the inset form is still the right one');
   assert.match(rule[1], /outline-offset:\s*-|inset/, 'the indication sits inside the input, not outside it');
 });
+
+// ---- 11. the world has ONE scrim (task 1003568) ---------------------------
+
+// A scrim darkens what is behind it — in BOTH modes. That is why it cannot be
+// mixed from a ground token: `--ink` is near-black in light and #ffffff in
+// dark, so `color-mix(in srgb, var(--ink) N%, transparent)` paints a WHITE wash
+// over a dark page. `.palette__scrim` did exactly that, unnoticed, while three
+// other scrims in the same sheet each carried their own copy of the same
+// black-with-alpha literal. Task 1003495 gave the value a home as `--scrim`;
+// this pins that every scrim now spends it.
+const SCRIM_VALUE = 'rgba(0, 0, 0, .55)';
+
+test('every scrim in the hall spends --scrim, and none is mixed from a ground token', () => {
+  const sheets = fs.readdirSync(HALL).filter((f) => f.endsWith('.css'));
+  const offenders = [];
+  for (const f of sheets) {
+    const css = read(f).replace(/\/\*[\s\S]*?\*\//g, '');
+    for (const m of css.matchAll(/([^{}]*(?:scrim|::backdrop)[^{}]*)\{([^{}]*)\}/gi)) {
+      const [sel, body] = [m[1].trim().replace(/\s+/g, ' '), m[2]];
+      if (!/background(-color)?\s*:/.test(body)) continue; // not the painting rule
+      if (!/background(-color)?\s*:\s*var\(--scrim\)/.test(body)) {
+        offenders.push(`${f}: \`${sel}\` paints a scrim without var(--scrim)`);
+      }
+    }
+  }
+  assert.deepEqual(offenders, [], 'a scrim spends the token, never its own value');
+});
+
+test('no rule washes a whole surface with a ground token — the dark-mode inversion', () => {
+  // Mixing --ink into a SURFACE (var(--bg-card)) is the design system working —
+  // --surface-2 and --skeleton are meant to flip with the mode. Mixing it into
+  // `transparent` as a FLAT WASH over everything behind it is the bug: --ink is
+  // #ffffff in dark, so the wash turns white and lifts the page instead of
+  // dimming it. That is what .palette__scrim and .ov-modal-bg both did.
+  //
+  // The same mix INSIDE a gradient is not a wash — the diagram viewer's dotted
+  // "drawing board" texture spends it as one colour stop over the card's own
+  // ground, and there flipping with the mode is exactly right. So this matches
+  // only a mix that is the ENTIRE value of a background declaration.
+  const FLAT_INK_WASH = /background(?:-color)?\s*:\s*color-mix\(in srgb,\s*var\(--ink\)\s*\d+%\s*,\s*transparent\s*\)\s*;/g;
+  const bad = [];
+  for (const f of fs.readdirSync(HALL).filter((x) => x.endsWith('.css'))) {
+    const css = read(f).replace(/\/\*[\s\S]*?\*\//g, '');
+    for (const m of css.matchAll(FLAT_INK_WASH)) bad.push(`${f}: ${m[0].trim()}`);
+  }
+  assert.deepEqual(bad, [], 'a full-surface wash mixed from --ink inverts between modes — use var(--scrim)');
+});
+
+test('the wash guard CATCHES a scrim but spares a texture', () => {
+  const FLAT_INK_WASH = /background(?:-color)?\s*:\s*color-mix\(in srgb,\s*var\(--ink\)\s*\d+%\s*,\s*transparent\s*\)\s*;/;
+  assert.ok(FLAT_INK_WASH.test('.x { background: color-mix(in srgb, var(--ink) 40%, transparent); }'),
+    'a flat wash is caught');
+  assert.equal(FLAT_INK_WASH.test('.y { background: radial-gradient(circle, color-mix(in srgb, var(--ink) 5%, transparent) 1px, transparent 1.4px) 0 0 / 22px 22px, var(--bg-card); }'), false,
+    'the same mix as a gradient STOP is a texture over a ground, and flips correctly');
+  assert.equal(FLAT_INK_WASH.test('.z { background: color-mix(in srgb, var(--ink) 6%, var(--bg-card)); }'), false,
+    'mixing into a surface is the design system working as intended');
+});
+
+test('--scrim is defined once and does NOT flip with the mode', () => {
+  const css = read('style.css');
+  const defs = [...css.matchAll(/--scrim\s*:/g)];
+  assert.equal(defs.length, 1, '--scrim is declared exactly once; a per-mode override would defeat its whole purpose');
+  // And no sheet keeps a second copy of the value it holds.
+  const copies = [...css.matchAll(new RegExp(SCRIM_VALUE.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'))];
+  assert.equal(copies.length, 1, `${SCRIM_VALUE} appears only in the --scrim declaration`);
+});

package/tests/hall_board_world.mjs

@@ -439,22 +439,18 @@ test('RUN: the three notices are inbox lines with a kind, a line and — where o
 // than scrolling in a row of their own (walk 1003309). The status tab strip
 // overflows too, but its row is overflow-x:auto and scrolls itself, which is
 // why the fix belongs on the control and not on the drawer.
-const ruleFor = (css, selector) => {
-  const re = new RegExp(`(?:^|\\r?\\n)${selector.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\{([^}]*)\\}`);
-  const m = re.exec(css);
-  assert.ok(m, `${selector} rule present in style.css`);
-  return m[1];
-};
 
 test('a filter control may shrink below its content, so the drawer never pushes the page', () => {
-  const filter = ruleFor(styleCss, '.filter');
+  const filter = rule(styleCss, '.filter');
+  assert.ok(filter, '.filter rule present in style.css');
   assert.match(filter, /min-width:\s*0\b/, '.filter is a flex item: min-width:auto is what pinned it to its content');
   assert.match(filter, /max-width:\s*100%/, 'and it may not exceed the row it sits in');
 
   // The select is the thing with the runaway intrinsic width. It keeps its
   // 150px floor for wide screens — a filter narrower than that is unreadable —
   // and gains a cap so a long option label cannot widen it past its cell.
-  const select = ruleFor(styleCss, '.filter select');
+  const select = rule(styleCss, '.filter select');
+  assert.ok(select, '.filter select rule present in style.css');
   assert.match(select, /max-width:\s*100%/, 'the select is capped to its cell');
   // The floor is expressed so it CANNOT itself pin the control: a bare 150px
   // would refuse to shrink in a cell narrower than 150px, which is the same
@@ -463,7 +459,9 @@ test('a filter control may shrink below its content, so the drawer never pushes
 
   // The free-text search box sits in the same wrapping row and would do the
   // same thing at 320 with its 200px floor.
-  assert.match(ruleFor(styleCss, '.filter input[type="search"]'), /max-width:\s*100%/,
+  const search = rule(styleCss, '.filter input[type="search"]');
+  assert.ok(search, '.filter input[type="search"] rule present in style.css');
+  assert.match(search, /max-width:\s*100%/,
     'the search box is capped the same way');
 });
 

package/tests/hall_collab_world.mjs

@@ -77,8 +77,25 @@ test('collab renders WHO IS ASKING, as a door to their profile', () => {
   assert.equal(L.askerOf({ requested_by: 92 }), 'builder 92', 'an older server\'s bare id is still a name, never nothing');
   const js = read('collab.js');
   assert.match(js, /L\.askerOf\(req\)/, 'the row asks the lib who is asking');
-  assert.match(js, /\/builders\/profile\?id=\$\{escapeHtml\(String\(req\.requested_by\)\)\}/, 'and links the hall\'s per-builder profile');
-  assert.match(js, /asked by \$\{who\}/, 'as a fact on the row');
+  // The link is built by personLink(id, name) now rather than inline per row —
+  // task 1003274 made BOTH people on a row a door (the asker on an incoming row,
+  // the addressee on your own), so the href moved to one helper taking an id.
+  assert.match(js, /\/builders\/profile\?id=\$\{escapeHtml\(String\(id\)\)\}/,
+    'and links the hall\'s per-builder profile');
+  // The wording is L.directionLine's, not this file's: task 1003274 replaced
+  // "asked by X" with a sentence that also says WHICH WAY the ask points, because
+  // the owner read their own outgoing ask as an incoming one. The sentence is
+  // asserted in tests/collab_page.mjs where the lib can be executed.
+  assert.match(js, /L\.directionLine\(req, dir\)/, 'as a fact on the row');
+  assert.ok(!/asked by \$\{who\}/.test(js), 'the direction-less wording is gone');
+
+  // The link is spliced with a REPLACER FUNCTION. As a replacement STRING,
+  // `$&`/`$$`/"$`"/`$'` inside it are special to String.prototype.replace — and
+  // the name it carries is builder-chosen. Measured: a display_name of `$&Bob`
+  // rendered as `$&Bobamp;Bob`. Not an injection (both halves are escaped),
+  // but a way to corrupt your own row by picking a name.
+  assert.match(js, /\.replace\(escapeHtml\(name\), \(\) => link\)/,
+    'the replacement is a function, so $-sequences in a name are literal');
 });
 
 test('the server names the people on a row through a join, and the writes stay bare', () => {
@@ -115,7 +132,9 @@ test('"asked of you" reads in runs — by name first, then each craft', () => {
   const L = lib();
   assert.equal(L.groupOf({ needs_builder_id: 95 }).id, 'you');
   assert.equal(L.groupOf({ needs_craft: 'artist' }).label, 'asked of artists');
-  assert.match(L.addressedTo({ needs_builder_id: 7, needs_builder_name: 'Preview Alpha' }, 9), /Preview Alpha by name/, 'a named addressee is named');
+  // task 1003274: the naming moved to directionLine, which also says WHICH WAY
+  // the ask points — the half the owner's report was actually about.
+  assert.match(L.directionLine({ needs_builder_id: 7, needs_builder_name: 'Preview Alpha' }, 'out'), /Preview Alpha by name/, 'a named addressee is named');
   const js = read('collab.js');
   assert.match(js, /ov-group__head/, 'each run has the family\'s group head');
   assert.match(js, /Number\(b\.id === 'you'\) - Number\(a\.id === 'you'\)/, 'and the personal run sorts first');