@bongos/core 1.19.524 → 1.19.526

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.524",
-  "core_contract": "1.19.524",
-  "source_commit": "2bcf689e8a274d2d6fe6d95f0ae0cc94d8de9ad2",
+  "core_version": "1.19.526",
+  "core_contract": "1.19.526",
+  "source_commit": "cc35e48eb6199ca46a1e5f5b6cc20fc9cfd6db6f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T23:36:45.727Z",
+  "built_at": "2026-09-04T01:15:34.422Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 431,
+    "docs_redacted": 433,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1969,
+    "functional_verbatim": 1971,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2424,
-  "tree_sha256": "5b603403c990cba86562e75005310c23fd6ec06bfc6934190cb2f7b1edd8f596",
+  "file_count": 2428,
+  "tree_sha256": "412b4c1a07121e150e646b60c72b020a57acab43ae48d35a0f35cde0c328f224",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1709,10 +1709,20 @@
       "mode": "0000644",
       "sha256": "d8bffd4c66cfddfeadd3c734d029e357f05a8eb804a79e5c3cad4014c9417b56"
     },
+    {
+      "path": "docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md",
+      "mode": "0000644",
+      "sha256": "30cf04604592423e7520fc3e0e7ea8bd020747bcf1b8e712ae339e1e9a5eb324"
+    },
+    {
+      "path": "docs/adr/0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md",
+      "mode": "0000644",
+      "sha256": "4c6f98c2362a5b61e294f1b3b9b055d44a9e47743ef8a71e5cb0f40ddd187e98"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "e3bb2c282df45ec41150fd041df3c2525d653184858c2bb0a6c7fff670f4b85c"
+      "sha256": "b03da1a3085e208b68ab5728e97b0e06b7cfb399e74d776ecc32c29074cd2a79"
     },
     {
       "path": "docs/api-reference.md",
@@ -1747,12 +1757,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "804238f39cba79b0503aee0079bde0272398c96b713e26c4f32298cd1db0fc06"
+      "sha256": "e848eaf9b035df899cc6f6d80f98cb8b01c2e9079fc5f32db0dd7b3a73d107ef"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "2df6e1780324aa67c25e347010082441d8267ff754ca3bb76c4071228f0c579d"
+      "sha256": "d4fefb8fce99e3903eec6f0796c9e61b81732a9784fb95fa4a3299fa9da3278a"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2597,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "dc3cb8274947a5bed3315b467d104b852e5ef4a9aea5642763765e2c3bfc5650"
+      "sha256": "645d63e339e5392d92422641d77d4942713e1aa5fd4d06b8d8714fdc76e18759"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4527,7 +4537,7 @@
     {
       "path": "modules/hall-ui/public/collab-lib.js",
       "mode": "0000644",
-      "sha256": "e92bc2c42efc40d1d9f0feed680e4363a6698bb82fcceab119765fcdea0a26f5"
+      "sha256": "5930395c551506e374c3e7ff89347f4151612ae336a18d8c13c6a725a3e844b4"
     },
     {
       "path": "modules/hall-ui/public/collab.css",
@@ -4542,7 +4552,7 @@
     {
       "path": "modules/hall-ui/public/collab.js",
       "mode": "0000644",
-      "sha256": "5a5de2593a47336fa82f1919bb904d02a42ed19d1420eaddafaf831312a50541"
+      "sha256": "3e953b00bbd57a248ed233b98b2451d8f49760bd066d5a58466860495c4d2e35"
     },
     {
       "path": "modules/hall-ui/public/collab.states.json",
@@ -5239,6 +5249,11 @@
       "mode": "0000644",
       "sha256": "38bbb1b0f0992c655cd48f95476fbbdac11381bb929999b6da0f68fbbf802b16"
     },
+    {
+      "path": "modules/lifecycle/cascade.js",
+      "mode": "0000644",
+      "sha256": "dcfbe3bf4cb7fc2731991d94cfac509ccd25f56f3c14c81aada1680c907bb0fb"
+    },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
       "mode": "0000644",
@@ -5527,7 +5542,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "637c442875fbe297e3aba54f4b6b16f9d06b740782e3506f65c58f34b67ea81d"
+      "sha256": "006868d0c47d0b134ce0a1773c61fc92b19dd15a6aae7517477ec5cc620d7ace"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -5604,6 +5619,11 @@
       "mode": "0000644",
       "sha256": "f5133f1a27404712a7cce9e9fa43ff016ba2342571fd8e109228e46486941c47"
     },
+    {
+      "path": "modules/lifecycle/tests/cascade.mjs",
+      "mode": "0000644",
+      "sha256": "e932d203a4306a7d8dfe16301a6481a31f34b431a6eaa44c055c3d1a2a67c4b0"
+    },
     {
       "path": "modules/lifecycle/version-close.js",
       "mode": "0000644",
@@ -7297,12 +7317,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bc7bbba6148fa9d568b64a75b65ef180df5552277546b777ffdee8316f72105c"
+      "sha256": "ffc21421efa292da210129a95802bcff3a22555742015ec7898127f73806d87e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f9383e8ec30bfc6a70fc13c2484732cbe20e97caac115737fb4942dd2e6c3588"
+      "sha256": "b5027375f7ecd4aed2e7e4764dab95828a9648a81860f5a9a459ddf55e56ddd0"
     },
     {
       "path": "public-docs/index.html",
@@ -8972,7 +8992,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "40fd7f7332ab9375d8078e846d565e282b7daf64abfdb6b22eb21380e7cdae17"
+      "sha256": "f3ff5d629ae2e24b8e9358d2da8059ce156643f666246e2f264c6cec6c8906cc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9557,7 +9577,7 @@
     {
       "path": "tests/collab_page.mjs",
       "mode": "0000644",
-      "sha256": "5b2872cd852218e4af5c6002318a1f72c677c417bcc43bf47a9fa8e23edb14f2"
+      "sha256": "98408d2e16e0ca596a31e9e97588584717dae126e863323088b5457dfef24420"
     },
     {
       "path": "tests/conductor.mjs",
@@ -10372,7 +10392,7 @@
     {
       "path": "tests/hall_collab_world.mjs",
       "mode": "0000644",
-      "sha256": "b597173a0d280286f0f5ff5d13e0065b2c1dc311024d1f13b5c2d0c3915daf45"
+      "sha256": "051bf806c90c8d62f4ab38b25cb0c8c7b49f68858ab223d74b174cedecc13ac6"
     },
     {
       "path": "tests/hall_error_envelope.mjs",

package/docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md

@@ -0,0 +1,185 @@
+# 0241 — The artist gate holds the DEPLOY, not the ship, and it reads a state rather than a judgement
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1003116](https://cloudbongos.com/builders#/task/1003116) (R05 of goal 1000074, the artist's loop) — the decision task the goal placed BEFORE [#1003115](https://cloudbongos.com/builders#/task/1003115) (R04, the review task), so that no code is wired to a gate whose authority is unsettled
+- **Reconciles:** [ADR 0162](<redacted>.md) — review gates retired on `main`; a verdict is advisory and never self-executing
+- **Related:** 0178 (the copy desk flag + queue, which deliberately blocked nothing and named this decision as the one that would settle it), 0233 (a copy proposal is a task carrying a patch), 0016 (authority is resolved server-side, never from a local file), 0120 (pay on land), 0137 (land → release → deploy are three separate gates)
+
+## Context
+
+Goal 1000074 gives the artist real authority over what ships — the owner's ABI brief hands them
+the project's text, its story and ideology, its purpose and gravitas. The goal also carries the
+owner's constraint, verbatim: **blocking strictness is per project, not global.** A project whose
+outputs must be closely monitored should be strict; a project where visuals and copy come
+afterwards can run loose.
+
+And it carries the collision that constraint creates. ADR 0162 retired review gates: after a
+code-owner review requirement stranded two graded-PASS ships inside a day, review requirements on
+`main` were removed permanently, and the principle recorded was that **no human click sits in the
+land path**. An artist who can block a ship is a new human click in the land path. Two rules, one
+of them about to contradict the other, which is exactly the condition R05 exists to end.
+
+## What ADR 0162 actually forbids
+
+This matters, because the shorthand it is usually cited by — "a verdict is advisory, never
+self-executing" — is a paraphrase, and reading the paraphrase instead of the ADR would rule out
+things 0162 explicitly keeps.
+
+0162's own table of what still guards the safety machinery lists four controls and marks three of
+them **fails closed** — including the subagent grader panel, which runs on every GDS ship and parks
+a failing task at `completed`. So 0162 plainly permits an automatic gate that stops work. What it
+retired was something narrower and structural: a gate GitHub could only express as **accounts**.
+Its reasoning is worth restating because it is the test this ADR applies:
+
+1. **Identity-pinned, not rank-based.** GitHub has no concept of GDS ranks, so "code-owner review"
+   degenerated into "one specific account must click." That collides with ADR 0016.
+2. **It stranded work with no escape hatch.** A blocked PR had nowhere to go, including the PRs that
+   fixed the strand.
+
+So the rule 0162 leaves behind is not "nothing may ever block". It is:
+
+> A gate is admissible when it is evaluated automatically, from state the system can read,
+> consistently for every builder, with a named escape hatch. A gate is inadmissible when it
+> requires a particular person to act before work can move, and stalls indefinitely when they
+> do not.
+
+The grader passes that test. A CODEOWNERS review does not. The artist gate has to be built to pass
+it too, and everything below is that shape.
+
+## Decision
+
+### 1. The gate reads a STATE, never an opinion
+
+The blocking condition is **"is there an unresolved artist review task attached to this work?"** —
+not "did the artist approve it?".
+
+That distinction is the whole reconciliation, so it is worth being exact about. An artist's verdict
+never moves anything by itself: an artist saying the copy is bad does not stop a deploy, and an
+artist saying it is fine does not release one. What the system reads is the review task's *status*,
+which is ordinary GDS state that any rank can see and that moves by the ordinary means — the task
+is resolved, dismissed, or shipped. The artist's judgement is what they write **into** that task;
+it stays advisory in precisely 0162's sense.
+
+This is not a technicality to route around the rule. It is what makes the gate rank-consistent and
+machine-checkable rather than identity-pinned: a status is a fact, a judgement is a person.
+
+### 2. Strictness is a per-project setting, and it holds the DEPLOY
+
+Three ordered levels, a project setting like any other:
+
+| Level | Artist review tasks | What is held |
+|---|---|---|
+| `off` | not generated | nothing |
+| `advisory` | generated | nothing |
+| `strict` | generated | **the deploy** — the instance's pin may not move while one is unresolved |
+
+**`strict` holds the deploy, not the ship** (owner ruling, 2026-09-03). This is the load-bearing
+choice, and it is what lets a real gate coexist with 0162 rather than merely arguing with it:
+
+- **No builder is ever stranded.** Their work is graded, merged, credited and landed on `main` on
+  CI alone, exactly as today. The wave-4 strand class that forced 0162 cannot recur, because
+  nothing an artist does can hold a builder's ship at `completed` or their credits at unpaid.
+- **It gates what the artist was actually given.** The ABI brief hands the artist what users see —
+  no slop appearance, the project's text, whether story and gravitas land. Users see the deployed
+  instance, not `main`. ADR 0137 already separates land, release and deploy into three gates; the
+  artist's authority attaches to the third one, which is the one their mandate is about.
+- **Nothing is ever un-shipped.** The gate can only delay a pin move, an action that is already
+  deliberate, already owner-initiated, and already reversible by doing it later.
+
+### 3. The escape hatch is the project owner, and it is never quiet
+
+At `strict`, an unresolved review can be released past by the **project owner only** — not the
+builder, not any Metic+, and not the artist (owner ruling, 2026-09-03). The owner's reason is
+recorded because it constrains the implementation: *people can be both artist and builder, so they
+could potentially pass their own work; they should care about passing the grade, or improving the
+grader.*
+
+Two things follow, and the second is a reading of that reason rather than a literal instruction —
+flagged as such so it can be corrected:
+
+- The right answer to being gated is to **fix the work or fix the grader**, not to wave it through.
+  The release valve exists so a project never deadlocks, not as a routine step.
+- A solo instance would deadlock under a strict self-approval bar — on this instance the owner is
+  frequently also the builder and the artist. So a self-release is **permitted and recorded as
+  such**: releasing past a gate on your own work is allowed, is written to the audit log as a
+  self-override with a required rationale, and is visible in the ledger. It costs visibility rather
+  than being impossible. If the owner meant the harder rule — that you may never release your own
+  work, and a solo project must resolve the review properly or stay undeployed — that is a
+  one-line change here and in R04's implementation.
+
+The mechanism is the one that already exists for a failed grader verdict: the override-request
+(`POST /tasks/:id/override-request`, rationale required, audit-logged). No new machinery, no second
+authority path, and the escape hatch 0162's incident found missing is present from the first day.
+
+### 4. The default is `strict`
+
+Owner ruling, 2026-09-03, against the recommendation this ADR's author put forward (`advisory`, on
+the grounds that a gate arriving by default is how 0162's incident happened).
+
+The ruling is coherent with §2 and is recorded with its consequence stated plainly: because
+`strict` holds only the deploy, a default-strict project cannot strand a builder — the worst case
+is a project whose pin waits on a review nobody has done yet. That is a visible, owner-fixable
+state, not a silent one, and the owner holds the release valve. **This instance is included**: once
+R04 ships, moving cloudbongos.com's pin will require the artist reviews on that release's copy and
+visual work to be resolved or released.
+
+Two guards on that, which R04 must implement rather than assume:
+
+- A project at `strict` with **no artist** must still be able to deploy. The review task exists, it
+  is unresolved, and the owner releases it — a project with nobody in the role is the normal case
+  for a new instance, and a default that bricks new instances is not a default.
+- The gate must say **what** is holding the deploy and **which** control releases it, in one line
+  at the point of refusal. 0162's incident was made worse by a blocked state that did not explain
+  itself.
+
+### 5. Tightening the setting is not retroactive
+
+When a project raises its strictness, the new level applies to work that ships **after** the
+change. Already-shipped work is not retroactively gated, and an already-moved pin is never rolled
+back.
+
+The alternative — re-gating history — would mean a single setting change could strand a project's
+next deploy behind a backlog of review tasks for work nobody remembers, and would make the setting
+frightening to raise. A project that genuinely wants its existing surface reviewed has a better
+tool already: R02's flag queue, which is exactly the mechanism for "someone should look at this
+copy that already shipped."
+
+Loosening is symmetric and immediate: unresolved review tasks stay on the board as ordinary work,
+they simply stop holding the pin.
+
+## Consequences
+
+- **R04 ([#1003115](https://cloudbongos.com/builders#/task/1003115)) is now buildable**, and its
+  brief is narrowed by this ADR: it generates the review task and attaches it, and the gate it
+  wires is a state check at the deploy step. It does not build an approval UI, and it must not
+  make a verdict self-executing.
+- **A new project setting** is added to the project settings vocabulary
+  (`artist_gate ∈ off | advisory | strict`, default `strict`). It is a policy key the running
+  instance obeys, the same shape as the join door (ADR 0238).
+- **ADR 0162 is reconciled, not amended.** Nothing in it changes: `main` still carries required
+  status checks only, no human click sits in the land path, and no CODEOWNERS file returns. This
+  ADR adds a gate on a *different* boundary — the deploy — and adopts 0162's own admissibility
+  test to do it.
+- **The paraphrase is corrected.** Several surfaces cite 0162 as "verdicts are advisory, never
+  self-executing" (this project's skills and ADRs 0178 and 0233 among them). That shorthand is
+  true of *verdicts* and false as a blanket claim about gates — 0162's own table has three
+  controls that fail closed. Cite the test in §1 above rather than the slogan.
+- **Accepted trade:** an artist who never does the work can delay a project's deploys. That is the
+  point of `strict`, it is per project, it is owner-releasable, and the owner chose it as the
+  default with that consequence stated.
+
+## Rejected
+
+- **Blocking the ship instead of the deploy.** The strongest version of the artist's authority, and
+  the one that recreates 0162's incident exactly: a builder's graded, merged work parked behind
+  another person's queue, with their credits unpaid (ADR 0120 pays on land).
+- **Advisory at every level.** Consistent with 0162 by doing nothing, but then "blocking strictness
+  is per project" configures nothing and the owner's rule is unimplemented.
+- **Any Metic+ as the escape hatch.** Lowest friction, and it makes `strict` indistinguishable from
+  `advisory` in practice.
+- **Making the artist's verdict itself the gate.** The direct reading of "artist blocking", and the
+  one thing 0162 genuinely forbids: it pins the gate to a person, and stalls indefinitely when that
+  person is unavailable.
+- **Retroactive tightening.** See §5.
+- **A global strictness constant.** The owner's constraint rules it out by name.

package/docs/adr/0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md

@@ -0,0 +1,107 @@
+# 0242 — A cross-role cascade is a declaration table on the event that already exists
+
+- **Status:** Accepted
+- **Date:** 2026-09-04
+- **Tasks:** [#1003549](https://cloudbongos.com/builders#/task/1003549) (goal 1000074, the artist's loop) — the split [#1003115](https://cloudbongos.com/builders#/task/1003115) (R04) invited in its own brief: *"if that generalisation is bigger than this task, split it — a cascade mechanism is its own task and possibly its own goal."* Encoded as a real dependency edge by [#1003264](https://cloudbongos.com/builders#/task/1003264).
+- **Related:** 0241 (the artist gate — why a cascade may never fail a ship), 0083 (the module system's one-way rule and the kernel seams), 0233 (a proposal is a task carrying a patch — the same `(source, source_ref)` idempotency), 0086 (goals), 0120 (pay on land)
+
+## Context
+
+R04 needs "every ship with copy or visuals generates one [review task]" — automatic on ship, never
+hand-filed. Its brief said plainly that the infrastructure for that **did not exist**, and named the
+spark queue as the prototype to extend. Reading both surfaces closely shows the prototype is the
+wrong half of the problem:
+
+- The **spark queue** (goal 1000062 / [task 1002921](https://cloudbongos.com/builders#/task/1002921))
+  returns open Big Idea Sparks not yet developed.
+- The **copy-desk flag queue** (R02 / [task 1003113](https://cloudbongos.com/builders#/task/1003113))
+  returns surfaces anyone flagged as needing touch-up.
+
+Both are **PULL**: a filtered listing of rows another role had already created. They are how one role
+*finds* work another role left. Nothing anywhere **generated** work on a state transition, which is
+the **PUSH** R04 actually asks for. (`cascade-dispatch.js` is model-cost routing and unrelated —
+named here only because its name has sent more than one reader down the wrong path.)
+
+## Decision
+
+### 1. No new bus — `task.shipped` already exists
+
+The kernel seam registry's own header uses this exact scenario as its worked example: *"the lifecycle
+emits `task.shipped` and the discord module may want to react."* The event is emitted post-commit by
+both ship paths (the publish reconciler and the ship routes), and already has two consumers —
+discord's ship broadcast and sessions' deferred reward.
+
+So a cascade is **one more listener on the event that already says a ship happened**, registered in
+`routes/lifecycle.js` beside the kernel port, for the reason that file already documents: the route
+mount is the one boot hook that runs both in the live server and whenever a test rebuilds the router.
+Building a second notification path would have been a parallel spine to keep in sync with this one.
+
+### 2. A declaration table, not a rules engine
+
+A cascade is one frozen entry: `{ key, discipline, when(task), title(task), body(task) }`. There is
+no condition language, no stored rules, no per-project configuration, no UI, and no priority
+ordering. Adding a cascade means appending an entry; the runner does not change.
+
+This is the [ADR 0237](<redacted>.md)
+/ [ADR 0239](<redacted>.md) shape applied to a
+different problem, and for the same reason: the generalisations worth building are the ones two or
+three real entries have shown they share. With one consumer in existence, a rules engine would be
+inventing the requirements it then satisfied.
+
+### 3. `CASCADES` ships EMPTY, and R04 writes the first rule
+
+The mechanism lands with no production cascade. Its four properties are proved against the tests'
+own declarations rather than against one example — which is the stronger proof, because a mechanism
+pinned to its first consumer's shape tends to fit only that shape.
+
+This is deliberate and is asserted, so the emptiness is a decision on the record rather than
+something nobody noticed. The artist review cascade is R04's content: this task built the thing R04
+said was missing, and stopped there.
+
+### 4. Four properties, all of them load-bearing
+
+- **It can never fail the ship it reacts to.** The event fires post-commit, both emitters already
+  wrap it, listener errors are isolated by the seam, and `runCascadesForShip` catches everything and
+  returns a report. Every failure shape — a predicate that throws, a malformed rule, a database that
+  is down, a junk payload — is a logged report and nothing else. This is not defensive habit: ADR
+  0241 settled that an artist's review may hold a **deploy** and never a builder's **ship**, and a
+  generator that could fail a ship would smuggle that gate back in through the back door. Verified
+  against a real failure, not a stub: with no database reachable, emitting `task.shipped` logs one
+  error line and resolves.
+- **It is idempotent, on machinery that already exists.** Generated tasks carry `source: 'cascade'`
+  and `source_ref: cascade-<key>-<taskId>`, so `createTask`'s `(source, source_ref)` read — the same
+  one a copy proposal uses (ADR 0233) — makes a reconciler re-sweep, a re-ship, or both emitters
+  firing a no-op. The runner checks first, so the ordinary case is a read.
+- **It says where it came from.** Every generated task inherits the source task's `goal_id` and
+  `version_id`, carries the originating id in its ref, and opens with the source task and the rule
+  key. NOT `parent_task_id`: that column models a **subtask**, and cascaded work is not part of the
+  ship that triggered it — it is separate work, for a different role, that outlives its trigger.
+- **It files at `backlog`, never `ready`.** Generated work is a request and goes through ordinary
+  triage, like a copy proposal or a capture. Auto-filing claimable work would let a rule nobody
+  re-read mint claims.
+
+## Consequences
+
+- **R04 is unblocked**, and narrowed: it appends one entry to `CASCADES` and writes the review task's
+  content and the ADR 0241 gate. It does not build a generation mechanism.
+- **A rule key is permanent.** It is half the `source_ref`, so renaming one re-files every task that
+  rule ever generated. Stated in the file and pinned by the duplicate-key check.
+- **The mechanism is discipline-agnostic.** Nothing about it is artist-specific; an ideator or
+  engineer cascade is the same entry with a different `discipline`. That is the generalisation the
+  brief asked for, and the reason this is not simply part of R04.
+- **Accepted limit:** cascades are declared in code, not configured per project. A project that
+  wants a cascade the platform does not declare cannot have one. That is the right trade while the
+  count is zero, and the point at which it stops being right is when the second and third entries
+  disagree about what they need.
+
+## Rejected
+
+- **Extending the spark queue.** The brief's own suggestion, and the wrong half: the queue is a
+  read-side filter over rows that already exist. Nothing in it generates anything.
+- **A new event or a poller.** `task.shipped` exists, is post-commit, and has two consumers already.
+- **A rules engine, or per-project cascade configuration.** See §2 — both are generalisations ahead
+  of their evidence.
+- **Filing generated work at `ready`.** See §4.
+- **`parent_task_id` as the link.** See §4 — it would claim a subtask relationship that is not true.
+- **Running the cascade inside the ship transaction.** It would make a generation failure a ship
+  failure, which is exactly the coupling ADR 0241 rules out.

package/docs/adr/README.md

@@ -328,5 +328,7 @@ This keeps the decision history honest and traceable.
 | 0237 | [**A starter bundle is a preset over the always-on core, keyed by the declared project type** ([task 1002338](https://cloudbongos.com/builders#/task/1002338) · goal 1000046, criterion `proj-module-select`). "During setup a default set of modules is pre-selected" can only mean the OPT-IN modules, since every instance already boots with the same sixteen `default: true` core-domain ones — so a bundle is a short list of opt-in module keys layered on that floor, preselected and freely toggled off by R20's picker ([task 1002339](https://cloudbongos.com/builders#/task/1002339)). **The key is the DECLARED type, and the seeded vocabulary is stale:** the task text (2026-07-17) names *Game / SaaS-Tool / Community*, but task [1002772](https://cloudbongos.com/builders#/task/1002772)'s owner decision (2026-08-13) fixed the live closed set as `game · research · business · non-profit · not-sure` — two CHECK constraints, two `PROJECT_TYPES` constants and five wizard buttons — and "community" survives only as a `team_shape`. Two constraints ride the key: the arrow runs **type → modules, never back** (1002772 rejected inferring type from module flags, which flip all through setup), and the R15 interview must **not re-ask** what `type` declares, so R19 adds no `PROJECT_DETAIL_VOCAB` key and no migration. `not-sure` and *undeclared* resolve to the same modules but are deliberately different answers — `type` is nullable precisely so "nobody said" is never back-filled with a guess, and the resolver returns `type: null` with its own copy. **The declaration is pinned by a test, not a runtime catalog read:** a module may not import `src/module-loader/catalog.js` (the one-way rule, [ADR 0083](<redacted>.md)), so `modules/provisioning/starter-bundles.js` stays PURE like `onboard-plan.js` beside it and `tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off disk — failing the build if a bundle names a module that does not exist, if `ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names an always-on module (a preselect that toggles nothing), or if it names one of the two hub-only modules. The bundles are `game → dev-box, discord`; `research → agents`; `business → agents, dev-box`; `non-profit → discord`; `not-sure → —`, and they are SHORT because today's opt-in catalog is three modules wide and a preselect an owner must audit is worse than none. Served whole at public `GET /provisioning/starter-bundles` (`{ core, bundles }`, same absent gate as `onboard-plan`) so the picker re-preselects without a refetch and R17's recommendations read the same shape. A bundle is **never a publish precondition** — [ADR 0182](<redacted>.md) D4 fixes that bar at name + description alone. Rejected: a runtime catalog read, a `bundle` key in the interview vocabulary, inferring the bundle from the description (the deferred AI layer, [task 1003500](https://cloudbongos.com/builders#/task/1003500)), and keeping the seeded Game/SaaS-Tool/Community triple.](<redacted>.md) | provisioning / project creation |
 | 0239 | [**A recommendation is a table that carries its own reason; governance is a preview and invites are a seam** ([task 1002336](https://cloudbongos.com/builders#/task/1002336) · goal 1000046, criteria `proj-module-select` / `proj-governance-reco` / `proj-invite-builders`). R19 ([ADR 0237](<redacted>.md)) declared the per-type starter bundle and said outright it is "a declaration and not a rule engine — R17/R22 own the layer that reasons"; this is that layer, and the goal pins it **rule-based**, with the AI/embeddings pass deferred ([task 1003500](https://cloudbongos.com/builders#/task/1003500), idea 1000552). **Two inputs, and the free-text description is not one of them:** the DECLARED `type` (a column) and `team_shape` (the one closed-answer key the R15 interview collects, [task 1002334](https://cloudbongos.com/builders#/task/1002334)) — inferring from prose is the deferred layer ADR 0237 §7 already rejected once. The engine is three frozen tables (`TEAM_SHAPE_RULES` add/remove ONE opt-in module; `GOVERNANCE_RULES` name a preset; `INVITE_RULES` emit a seek) and **every row carries its own `reason` sentence**, shipped with the effect rather than reconstructed by whichever surface renders it — a recommendation an owner cannot be told the reason for is one they cannot disagree with. `bundle.adjustments` is a **DELTA**: a rule whose condition matched but whose module the bundle already carried records NOTHING, because "we switched discord on because you said community" over a module a game would have had anyway is a claim the owner can check and find false. **Governance is a named preview, never a setting** — the governance module is planned and unbuilt (goal 1000030), so a preset is a name plus one sentence of what it feels like (`owner-only` / `trusted-team` / `open-contribution`) and every result carries `applied: false`, one flag instead of the same fact hardcoded in R25, R18, the wizard and the project page. **Invites are a SEAM**: `suggested` is always `[]` because ranking builders means querying the leaderboard in the sibling `economy` module, which the one-way rule ([ADR 0083](<redacted>.md)) forbids importing — the engine emits `seeking: { kind: 'top-builders', limit }` (or `null` = suggest nobody, a real answer) and R28 ([task 1002347](https://cloudbongos.com/builders#/task/1002347)) turns it into names. **Skipping is an answer:** every table states a default and each is the NARROWEST option (widening later costs one setting; a role granted to strangers is not recovered by setting it back), an off-vocabulary `team_shape` reads as no answer exactly as `normalizeProjectDetail` drops it, and the route answers 200-with-defaults rather than 400 — refusing would make the supported path ([ADR 0182](<redacted>.md) D4) an error. `tailored: boolean` is the machine-readable half of `proj-detail-interview`'s details-vs-skip split that R18 ([task 1002337](https://cloudbongos.com/builders#/task/1002337)) proves. Served at public `GET /provisioning/recommendations?type=&team_shape=` (same absent gate as `starter-bundles`; no database, pinned by a `pool`-throws stub), returning ADR 0237 §5's bundle shape plus `adjustments` so a recommendation and R20's preselect can never name different modules. Rejected: reading the description, filling `suggested` from `GET /public/leaderboard`, a weighted scoring function, a reason per matched condition, and a 400 on an unknown shape.](<redacted>.md) | provisioning / project creation |
 | 0240 | [**A skipped module picker stores nothing, and the bundle is resolved on read** ([task 1002339](https://cloudbongos.com/builders#/task/1002339) · goal 1000046, criterion `proj-module-select`). [ADR 0237](<redacted>.md) declared the starter bundles and closed with "where a chosen selection lands is R20's decision". It lands in a new **nullable** `modules jsonb` column on `provisioning_instances` (`provisioning_014`), read through `starter-bundles.effectiveModules(row)` and **three-valued**: `NULL` = nobody answered (the picker was skipped, or the caller does not ask) and the declared type's bundle is resolved AT READ TIME; `[]` = the owner switched them all off, a real answer; `["dev-box",…]` = what they picked. `NOT NULL DEFAULT '[]'` was rejected because it collapses the first two forever — the `PROJECT_DETAIL_VOCAB` rule ("absent stays absent, skipped stays skipped") applied to a list. **Skipping is safe because the preselect and the fallback are the same function**, `bundleForProjectType`, called twice — not two lists kept in agreement — so `bongos onboard` and any API caller inherit the bundle by omitting the field, and the canonical sequence in `onboard-plan.js` grows **no new step** (the picker refines `type`, an answer already in it). NOT `detail` (its vocabulary is closed + scalar by construction, and [ADR 0237](<redacted>.md) §2 ruled the interview must not ask this) and NOT `settings` (a setting is a policy the RUNNING instance obeys — web.env, a settings-apply intent, a restart). The picker's catalog copy (`OPTIONAL_MODULES`) is **declared beside the bundles**, because `module.json` descriptions are written for builders, `GET /modules` needs a session the signed-out wizard has not got, and `GET /public/modules` serves booleans — pinned the ADR 0237 way, so a new `default: false` module cannot ship without owner-facing copy. `GET /provisioning/starter-bundles` gains `optional` so the preselect and the catalog arrive in **one** read. The route **refuses** an unknown / always-on / hub-only key (`400 bad_modules`) rather than dropping it silently (`badProjectDetail`'s rule), and a re-request reports `modules_ignored`. The column is a DECLARATION, not yet an input to the control-plane runner. Rejected: storing the preselect on a skip (it writes down an answer nobody gave), a new `onboardPlan` step, and rendering the always-on core as sixteen disabled toggles (a disabled control reads as a choice the owner failed to make).](<redacted>.md) | provisioning / project creation |
+| 0241 | [**The artist gate holds the DEPLOY, not the ship, and it reads a state rather than a judgement** ([task 1003116](https://cloudbongos.com/builders#/task/1003116) · goal 1000074, criterion `artist-blocking-is-per-project` — R05, the DECISION task the goal placed before R04 so no code would be wired to an unsettled gate). Goal 1000074 carries two rules on a collision course: the owner's "blocking strictness is PER PROJECT, not global", and [ADR 0162](<redacted>.md), which retired review gates on `main` after a code-owner requirement stranded two graded-PASS ships in a day. **0162 is usually cited by a paraphrase — "a verdict is advisory, never self-executing" — and the paraphrase is wrong as a blanket claim:** 0162's own table of compensating controls marks three of four as *fails closed*, the subagent grader among them. What it actually retired was a gate GitHub could only express as ACCOUNTS — identity-pinned against [ADR 0016](<redacted>.md), and stranding with no escape hatch. So the surviving test is: **a gate is admissible when it is evaluated automatically from readable state, consistently for every builder, with a named escape hatch; inadmissible when a particular person must act and it stalls when they do not.** Decision: (1) the gate reads a **STATE** — "is there an unresolved artist review task?" — never an opinion, so the artist's judgement is what they write INTO the task and stays advisory in exactly 0162's sense, while what the system reads is ordinary GDS status; (2) strictness is a project setting `artist_gate ∈ off | advisory | strict` and at `strict` it holds the **DEPLOY, not the ship** (owner ruling) — the builder's work is graded, merged, credited and landed on CI alone exactly as today, so 0162's strand class cannot recur, and the gate attaches to the boundary the artist's ABI mandate is actually about (users see the deployed instance, not `main`; [ADR 0137](<redacted>.md) already splits land/release/deploy); (3) the escape hatch is the **project OWNER only** — not the builder, not any Metic+, not the artist — via the existing `POST /tasks/:id/override-request`, because a person can be both artist and builder and could pass their own work; a self-release is permitted but never quiet (required rationale, audit-logged as a self-override) so a solo instance cannot deadlock; (4) the default is **`strict`** (owner ruling, against the author's `advisory` recommendation), which is safe only because §2 holds the deploy — the worst case is a pin that waits, and this instance is included once R04 ships; a project with no artist must still be able to deploy, and the refusal must name what holds it and which control releases it; (5) tightening is **not retroactive** — re-gating history would strand the next deploy behind reviews for work nobody remembers and make the setting frightening to raise; R02's flag queue is the right tool for already-shipped copy. Rejected: blocking the ship (recreates 0162's incident exactly, with credits unpaid — [ADR 0120](<redacted>.md)); advisory at every level (configures nothing); any Metic+ as the hatch (makes `strict` indistinguishable from `advisory`); making the artist's VERDICT the gate (the one thing 0162 genuinely forbids); retroactive tightening; a global constant (ruled out by the owner's constraint by name).](<redacted>.md) | goal 1000074 / the artist's loop |
+| 0242 | [**A cross-role cascade is a declaration table on the event that already exists** ([task 1003549](https://cloudbongos.com/builders#/task/1003549) · goal 1000074, criterion `artist-review-task-on-ship` — the split R04 invited in its own brief and [ADR 0241](<redacted>.md)'s dependency). R04 needs "every ship with copy or visuals GENERATES one", and its brief said the infrastructure did not exist, naming the spark queue as the prototype. Reading both surfaces shows the prototype is the wrong half: the spark queue ([task 1002921](https://cloudbongos.com/builders#/task/1002921)) and the copy-desk flag queue ([task 1003113](https://cloudbongos.com/builders#/task/1003113)) are both **PULL** — filtered listings of rows another role already created — and nothing anywhere generated work on a state transition, which is the **PUSH** R04 asks for. (`cascade-dispatch.js` is model-cost routing; named only because its name has misled more than one reader.) **Decision: no new bus.** The kernel seam registry's own header uses this exact scenario as its worked example, `task.shipped` is already emitted post-commit by both ship paths and already has two consumers (discord's broadcast, sessions' deferred reward) — so a cascade is ONE MORE LISTENER on it, registered in `routes/lifecycle.js` beside the port because that mount is the one boot hook tests also run. A cascade is a frozen entry `{ key, discipline, when(task), title(task), body(task) }` — **a declaration table, not a rules engine**: no condition language, no stored rules, no per-project config, no priority ordering; adding one appends an entry and the runner does not change (the [ADR 0237](<redacted>.md)/[0239](<redacted>.md) shape, for their reason — the generalisations worth building are the ones two or three real entries have shown they share). **`CASCADES` ships EMPTY and R04 writes the first rule**, asserted so the emptiness is a decision on the record; the mechanism is proved against the tests' own declarations rather than against its first consumer's shape. Four load-bearing properties, all pinned: (1) **it can never fail the ship it reacts to** — post-commit event, isolated listeners, and a runner that catches everything and returns a report, because ADR 0241 settled that an artist may hold a DEPLOY and never a builder's SHIP and a generator that could fail a ship would smuggle that gate back in; verified against a real failure (no database reachable → one log line, resolves); (2) **idempotent on machinery that already exists** — `source: 'cascade'` + `source_ref: cascade-<key>-<taskId>` through `createTask`'s `(source, source_ref)` read, the same one a copy proposal uses ([ADR 0233](<redacted>.md)), so a reconciler re-sweep or a double emit is a no-op; (3) **it says where it came from** — inherits `goal_id`/`version_id`, carries the origin id in the ref and the prose, but NOT `parent_task_id`, which models a SUBTASK, and cascaded work is not part of the ship that triggered it; (4) **files at `backlog`, never `ready`** — generated work is a request, and auto-filing claimable work would let a rule nobody re-read mint claims. A rule key is PERMANENT (half the source_ref; renaming re-files everything it ever generated), pinned by a duplicate-key check. The mechanism is discipline-agnostic — an ideator or engineer cascade is the same entry with a different `discipline`, which is the generalisation that made this its own task. Accepted limit: cascades are declared in code, not configured per project. Rejected: extending the spark queue (a read-side filter that generates nothing), a new event or poller, a rules engine or per-project config, filing at `ready`, `parent_task_id` as the link, and running the cascade inside the ship transaction (which would make a generation failure a ship failure — the exact coupling ADR 0241 rules out).](<redacted>.md) | goal 1000074 / the artist's loop |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1646 strings** across 3 surfaces · 1428 distinct pieces of copy · 1646 certain, 0 heuristic · 154 shown in more than one place.
+**1645 strings** across 3 surfaces · 1427 distinct pieces of copy · 1645 certain, 0 heuristic · 154 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 73 | 1188 |
+| `builders-hall` | `modules/hall-ui/public` | 73 | 1187 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
 | `landing` | `modules/public-landing/public` | 5 | 360 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `60b248791dc3` | 2x | Builders — {{worldName}} | modules/hall-ui/public/roster.html:6, modules/hall-ui/public/roster.html:6 |
 | … | | _114 more in the JSON registry_ | |
 
-## `builders-hall` — 1188 strings
+## `builders-hall` — 1187 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -129,7 +129,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a3185a43c230` | certain | A sound plays at each turn of your work — a gentle chime when Claude finishes, a flourish when a task ships or | `modules/hall-ui/public/settings.html:312` |
 | `83b1274f9088` | certain | A tally of recorded work sessions, and the latest five. The full record lives on the Sessions page. | `modules/hall-ui/public/watch.html:103` |
 | `daf73127afff` | certain | A word on why | `modules/hall-ui/public/hall-render.js:284` |
-| `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:173` |
+| `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:196` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
 | `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1154` |
@@ -284,7 +284,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/task.js:710` |
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:629` |
 | `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:318` |
-| `8a4b590fa1a0` | certain | Could not load requests. | `modules/hall-ui/public/collab.js:251` |
+| `8a4b590fa1a0` | certain | Could not load requests. | `modules/hall-ui/public/collab.js:274` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:243` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:281` |
 | `b2147cc90e36` | certain | Could not load the idea template. Reload, or file from the terminal with capture.js. | `modules/hall-ui/public/ideas.js:611` |
@@ -608,7 +608,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c72e0bdb834a` | certain | Not declared in module.json — this is who ships the module. | `modules/hall-ui/public/modules.js:62` |
 | `361b353ded5e` | certain | Not enough shipped work yet to chart. | `modules/hall-ui/public/hall-widgets.js:184` |
 | `90230572d017` | certain | Not found | `modules/hall-ui/public/task.js:698` |
-| `8226c979db4d` | certain | Not now | `modules/hall-ui/public/collab.js:173` |
+| `8226c979db4d` | certain | Not now | `modules/hall-ui/public/collab.js:196` |
 | `61250b49a90b` | certain | Not scored. | `modules/hall-ui/public/idea.js:84` |
 | `8d6afe6def47` | certain | Not signed in | `modules/hall-ui/public/settings.html:40` |
 | `a290f6c14df9` | certain | Not taking requests | `modules/hall-ui/public/goals-render.js:859` |
@@ -761,7 +761,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e8e4e49fe8f4` | certain | Saves when you press Save; shows everywhere at once. | `modules/hall-ui/public/settings.html:88` |
 | `42cbc20a6ec8` | certain | Saves when you press Save; your next | `modules/hall-ui/public/settings.html:136` |
 | `fc9d783ed0f5` | certain | Say why it is better. Whoever reviews this decides it from your reason, without asking you. | `modules/hall-ui/public/copy-desk.js:446` |
-| `12c1ec21a2c6` | certain | Say yes | `modules/hall-ui/public/collab.js:173` |
+| `12c1ec21a2c6` | certain | Say yes | `modules/hall-ui/public/collab.js:196` |
 | `46711f7bc3df` | certain | Search every string the product shows a person, by what it says or the file it lives in. | `modules/hall-ui/public/copy-desk.html:65` |
 | `5d2ba8e72fa1` | certain | Search failed. | `modules/hall-ui/public/copy-desk.js:343` |
 | `373a7639bcb9` | certain | Sections in this primer | `modules/hall-ui/public/primer.html:52` |
@@ -815,7 +815,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:490` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:284` |
-| `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:90` |
+| `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:113` |
 | `867df58c9aaa` | certain | Something else | `modules/hall-ui/public/copy-desk.html:95` |
 | `c377d8ed744b` | certain | Something went wrong. Try again. | `modules/hall-ui/public/profile-connections.js:275` |
 | `e0767e80206c` | certain | Sound for {…} | `modules/hall-ui/public/settings.js:311` |
@@ -1044,7 +1044,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b867876e8b6c` | certain | and press Enter. | `modules/hall-ui/public/hall-render.js:750` |
 | `b4033000c537` | certain | as a table | `modules/hall-ui/public/profile-charts.js:202` |
 | `d7c511423bc0` | certain | as configuration: {…} | `modules/hall-ui/public/government.js:707` |
-| `09db3fd4355b` | certain | asked by {…} | `modules/hall-ui/public/collab.js:69` |
 | `63bd14f73960` | certain | author trusted | `modules/hall-ui/public/gate.js:141` |
 | `93438b9ffa98` | certain | below or type | `modules/hall-ui/public/box-panel.js:226` |
 | `1f5e924adf9d` | certain | box — | `modules/hall-ui/public/box-panel.js:336` |