@bongos/core 1.19.534 → 1.19.536

package/docs/module-api-changelog.md

@@ -1517,5 +1517,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         joinabilityMode did at 1.19.374.
   1.19.534 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.533 with no explicit bump. run 33885355024. (task 1002620)
+  1.19.535 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.534 with no explicit bump. run 33886686350. (task 1002620)
+  1.19.536 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.535 with no explicit bump. run 33888048777. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -633,6 +633,12 @@ function createClient(opts = {}) {
       // GET /profiles/{handle} — rank: public — GET /profiles/:handle
       getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
     },
+    "projectSettings": {
+      // GET /project-settings — rank: metic+archon — GET /project-settings
+      getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
+      // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
+      patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
@@ -894,6 +900,8 @@ function createClient(opts = {}) {
       getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
       // POST /work-categories — rank: metic+archon — POST /work-categories
       postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+      // PATCH /work-categories/{id} — rank: metic+archon — PATCH /work-categories/:id
+      patchWorkCategoriesId: (args) => request("PATCH", "/work-categories/{id}", { hasBody: true }, args),
     },
   };
 }

package/modules/government/catalog.js

@@ -200,6 +200,7 @@ const PERMISSIONS = [
   // personally opted in (task 1003177, ADR 0187 §5), so this atom cannot put
   // anyone in a room with a stranger on its own.
   { key: 'mingle.manage', system: false, floor: 'metic', guards: 'PUT /mingle/project (the project half of mingle consent), POST /mingle/round (run a pairing round) — task 1003177, goal 1000075' },
+  { key: 'project.settings.manage', system: false, floor: 'metic', guards: "PATCH /project-settings/* — the project's own live knobs (the rot timer today) and the work-category set's shape (PATCH /work-categories/:id). Metic, matching goal.create's reasoning that extending the project's vocabulary is a planning act rather than an administrative one — task 1003280, goal 1000072" },
   { key: 'project.curate', system: false, floor: 'metic', guards: 'platform-identity: GET/POST /projects, /projects/invite, PATCH /projects/:id/featured, GET /scouting (ADR 0157, was archon)' },
   { key: 'override_request.decide', system: false, floor: 'metic', guards: 'GET /override-requests, POST .../:id/decide (ADR 0157, was archon)' },
   { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },

package/modules/government/migrations/government_010_project_settings_manage.sql

@@ -0,0 +1,58 @@
+-- government_010_project_settings_manage.sql — grant the new `project.settings.manage`
+-- atom to the Metic and Archon rank-roles (task 1003280, goal 1000072, criterion
+-- legibility-project-settings).
+--
+-- The project-settings page carries the five fundamentals of a project, and TWO of
+-- them are live knobs a person may turn: the rot timer (project_settings, migration
+-- core_231) and the shape of the work-category set (work_categories, core_226). Both
+-- writes need a gate, and BV1.R105 says a modules/*/routes gate is a permission atom
+-- and never a rank — tests/government_require_permission.mjs fails the build on a new
+-- `requireRank`.
+--
+-- FLOOR `metic`, by the `goal.create` analogue rather than archon. `goal.create`
+-- already gates POST /work-categories on the reasoning that "extending the project's
+-- vocabulary is a planning act", and this atom governs the same vocabulary's SHAPE
+-- (label, order, whether it is still offered) plus one reporting timer. What makes
+-- that safe is the ADR 0192 wall the category set already stands behind: a category
+-- is ADVISORY — no gate, route guard, rank check, feed filter or dependency rule may
+-- read it (scripts/gds/category-advisory-guard.js fails the build if that changes) —
+-- so this atom cannot alter who may do what. The rot timer is the reporting half of
+-- ADR 0226's asymmetry: it only ever ASKS a human, and the timer that ENFORCES
+-- (src/stale-timer.js, which auto-releases claims) is deliberately NOT reachable
+-- from here.
+--
+-- A BRAND-NEW key: no rank holds it yet, so BOTH rungs the floor implies are granted
+-- here. RANK_SEED is a cumulative superset — floor `metic` means {metic, archon} —
+-- and the drift guard (tests/government_seed.mjs) compares the UNION of the run-once
+-- seed plus every later grant migration against that floor-derived seed, per rank.
+-- Minting the catalog row WITHOUT this migration is exactly what that guard caught
+-- on this task, as it did on task 1003177.
+--
+-- COPIES government_009_mingle_manage.sql, NOT a `governance_*` file. Those predate
+-- government_001_rename_from_governance, which renamed `governance_role_permissions`
+-- → `government_rank_permissions` and `role_key` → `rank_key` with no compatibility
+-- shim, so copying one writes to a table that no longer exists and errors at apply
+-- time on any fresh install.
+--
+-- Additive only: one new permission key granted to two ranks; nothing is revoked.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- One block PER RANK, in the government_004/009 shape: the drift guard scans for
+-- `SELECT '<rank>', unnest(ARRAY[…])` literally, so a combined
+-- `unnest(ARRAY['metic','archon']), 'key'` form parses as zero grants and reds it.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'project.settings.manage'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'project.settings.manage'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/hall-kit.js

@@ -737,13 +737,25 @@
       + '</svg>';
   }
 
-  // Horizontal labelled bars. rows: [{ label, value, valueLabel }].
+  // Horizontal labelled bars. rows: [{ label, value, start, valueLabel }].
   // opts: { max, tone: 'accent'|'neutral', labelWidth, valueWidth, barHeight,
   //         pill, ariaLabel, list }
   //
   // `max` is the caller's when several series must share one scale; otherwise
   // the largest value here. It floors at 1 so an all-zero set draws empty
   // tracks instead of dividing by zero.
+  //
+  // A row's optional `start` OFFSETS its bar instead of beginning it at the
+  // track's left edge, which turns the same primitive into a SPAN series — a
+  // timeline. It arrived with the roadmap's versions (task 1003447): each one
+  // holds a `started_at` and a `shipped_at`, and the series those two dates
+  // support is "when did each version run", every bar on one shared axis. That
+  // is a bar with a left offset and nothing else, so it is an OPTION here
+  // rather than a second class family — the same seam every other difference
+  // between call sites rides. `start` is in the SAME units as `value` and
+  // measured from the axis origin, so the kit still never learns what a date
+  // is: a caller passes `max` as the axis span and `start` as the offset into
+  // it, exactly as it already passes x0/x1/yMax to the plot.
   function barSeriesHtml(rows, opts = {}) {
     const list = (rows || []).filter((r) => r && r.label !== undefined && r.label !== null);
     if (!list.length) return '';
@@ -775,14 +787,34 @@
       + (opts.ariaLabel ? ` aria-label="${esc(opts.ariaLabel)}"` : '')
       + '>'
       + list.map((r, i) => {
-        const w = Math.round((vals[i] / max) * 100);
+        // A POSITIVE value always draws at least a sliver. Rounding alone sends
+        // anything under half a percent of the max to `width:0%`, which reads as
+        // "none" — the one thing it is not. Zero stays zero: an empty track is
+        // the honest picture of nothing, and the column series makes the
+        // opposite choice for the opposite reason (a zero bucket there is a week
+        // that happened). Load-bearing for a span: a version that started and
+        // shipped inside one day is a real span half a pixel wide.
+        const raw = Math.round((vals[i] / max) * 100);
+        const w = vals[i] > 0 ? Math.max(1, raw) : raw;
+        // The offset takes the SAME floor, and for the same reason: a span that
+        // begins just after the axis origin but rounds to 0% draws flush against
+        // the track edge, which is the picture of "started first" — and on a
+        // timeline that is a claim about ordering, not a rounding artefact.
+        const start = Number(r.start);
+        const rawOff = Number.isFinite(start) && start > 0 ? Math.round((start / max) * 100) : 0;
+        const off = Number.isFinite(start) && start > 0 ? Math.max(1, rawOff) : 0;
+        // Offset by MARGIN, not `left`: the fill is an ordinary block inside the
+        // track, so absolute positioning would need a positioned ancestor the
+        // track does not declare. Omitted entirely at zero, so every existing
+        // caller's markup is byte-identical to what it was.
+        const geom = off > 0 ? `margin-left:${off}%;width:${w}%` : `width:${w}%`;
         const val = r.valueLabel === undefined || r.valueLabel === null
           ? String(vals[i])
           : String(r.valueLabel);
         return `<div class="kit-bars__row"${rowRole}>`
           + `<span class="kit-bars__label">${esc(r.label)}</span>`
           + `<span class="kit-bars__track" aria-hidden="true">`
-          + `<span class="kit-bars__fill" style="width:${w}%"></span></span>`
+          + `<span class="kit-bars__fill" style="${geom}"></span></span>`
           + `<span class="kit-bars__val">${esc(val)}</span>`
           + '</div>';
       }).join('')
@@ -818,10 +850,60 @@
     return { width, height, pad, base: height - pad.b };
   }
 
+  // The VERTICAL window a series should be drawn in — the companion to
+  // timeStepGeometry's yMin/yMax, and geometry rather than date semantics, which
+  // is why it lives here rather than at the call site (task 1003447).
+  //
+  // `zeroBased` (the default) is right whenever zero is a state the series can
+  // actually reach: a count of dead exports sitting at zero for a week is the
+  // reading, and lifting the floor off it would invent a change. Pass false for
+  // a LEVEL — repo-health's total_loc — where zero is unreachable and a zero
+  // floor squashes a month of real movement into a flat band across the top.
+  // A fitted floor magnifies every wiggle, so a caller that passes false owes
+  // the reader the range in words somewhere on the page.
+  //
+  // `air` is the fraction of the range left as breathing room (12% by default)
+  // so the line neither rides the top edge nor welds itself to the axis. A FLAT
+  // series has no range to take a fraction of, so the air falls back to the
+  // value's own magnitude — and, for a series flat at zero, to 1, which leaves
+  // it drawn honestly along the axis.
+  //
+  // A MISSING entry is dropped, not read as zero: a null from a snapshot that
+  // predates a column would otherwise drag `lo` to zero and draw a cliff nothing
+  // recorded. Note this is the one place in the kit that must NOT go through
+  // `chartNums` — that maps a null to 0 on purpose, because a gap-filled DAILY
+  // feed really does mean "nothing happened that day". Here a null means "not
+  // measured", and the two are opposite readings of the same byte. `Number(null)`
+  // and `Number('')` are both a finite 0, so the emptiness has to be tested for
+  // before the coercion, never after it.
+  function plotWindow(values, opts = {}) {
+    const nums = (values || [])
+      .filter((v) => v !== null && v !== undefined && v !== '')
+      .map(Number)
+      .filter((n) => Number.isFinite(n));
+    if (!nums.length) return { lo: 0, hi: 0, yMin: 0, yMax: 1, n: 0 };
+    const lo = Math.min(...nums);
+    const hi = Math.max(...nums);
+    const frac = Number.isFinite(Number(opts.air)) ? Number(opts.air) : 0.12;
+    const air = ((hi - lo) || Math.abs(hi) || 1) * frac;
+    const zeroBased = opts.zeroBased !== false;
+    return { lo, hi, yMin: zeroBased ? 0 : lo - air, yMax: hi + air, n: nums.length };
+  }
+
   // A STEP line over a time axis: the value holds until the next recorded
   // point, then rises — which is what a cumulative "how much by now" series
   // means, and why this is not a straight polyline between samples.
   // points: [{ x, value }] in data space, sorted. Returns { d, area, xs }.
+  //
+  // `yMin` (default 0) is the value the AXIS sits at, and it exists because the
+  // second kind of series this plot draws is not cumulative. A cumulative line
+  // starts at nothing and every reading is "how much by now", so zero is the
+  // only honest floor. A LEVEL — repo-health's total_loc, task 1003447 — is a
+  // large number that moves a little: on a zero floor its whole month of change
+  // is a flat band across the top, and the chart says nothing the headline
+  // figure did not. A caller that fits the floor to the data MUST say so on the
+  // page (watch.js puts the range in the figure's foot), because a non-zero
+  // baseline silently multiplies how big every wiggle looks.
   function timeStepGeometry(points, opts = {}) {
     const { width, height, pad, base } = plotBox(opts);
     const list = points || [];
@@ -829,11 +911,14 @@
     const x0 = Number(opts.x0 ?? list[0].x);
     const x1 = Number(opts.x1 ?? list[list.length - 1].x);
     const last = list[list.length - 1];
-    // A span of 0 (one point, no window) would divide by zero; yMax 0 likewise.
+    // A span of 0 (one point, no window) would divide by zero; a flat series
+    // whose yMin and yMax are equal likewise.
     const spanX = (x1 - x0) || 1;
-    const yMax = Number(opts.yMax ?? last.value) || 1;
+    const yMin = Number.isFinite(Number(opts.yMin)) ? Number(opts.yMin) : 0;
+    const yMax = Number(opts.yMax ?? last.value);
+    const spanY = ((Number.isFinite(yMax) ? yMax : 0) - yMin) || 1;
     const px = (t) => pad.l + ((t - x0) / spanX) * (width - pad.l - pad.r);
-    const py = (v) => height - pad.b - (v / yMax) * (height - pad.t - pad.b);
+    const py = (v) => height - pad.b - ((v - yMin) / spanY) * (height - pad.t - pad.b);
     let d = `M${px(list[0].x).toFixed(1)},${py(list[0].value).toFixed(1)}`;
     list.forEach((p, i) => {
       if (i === 0) return;
@@ -961,7 +1046,8 @@
     plotSvgHtml, plotValueLabelHtml, timeStepSeriesHtml, timeStepGeometry, columnSeriesHtml,
     // plotBox is exported so a caller mapping pointer x back into viewBox
     // space reads the plot's width instead of re-declaring the number.
-    plotBox,
+    // plotWindow fits the vertical axis to a level series (task 1003447).
+    plotBox, plotWindow,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
     // ship-time task visual (task 1003109)

package/modules/hall-ui/public/project-settings.css

@@ -0,0 +1,90 @@
+/* project-settings.css — the five-fundamentals page (task 1003280, goal 1000072).
+   The ROW is oversight.css's .ov-row and the panel is style.css's .scroll; what
+   lives here is only what those two do not already say: the state pill that marks a
+   row unwritable, the small control cluster a knob row carries, and the provenance
+   foot that names the file a value resolves from. */
+
+/* The provenance line. Every row has one — it is the point of the page — so it is
+   quiet by default and never competes with the value above it. */
+.ps-prov {
+  margin: 6px 0 0;
+  font-size: 12px;
+  line-height: 1.5;
+  color: var(--ink-soft);
+}
+.ps-prov code {
+  font-size: 11px;
+  overflow-wrap: anywhere; /* a table[key] path must wrap on a phone, never widen the page */
+}
+
+/* The state pill: what kind of value this is. A reader must be able to tell "you
+   cannot type here" from "this is empty" at a glance, which is why absent and
+   not-yet-real do not share a colour with live. */
+.ps-pill {
+  display: inline-block;
+  padding: 1px 8px;
+  border-radius: 999px;
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  border: 1px solid currentColor;
+  vertical-align: middle;
+}
+.ps-pill--live { color: var(--ok); }
+.ps-pill--readonly { color: var(--ink-soft); }
+.ps-pill--absent { color: var(--warn); }
+
+/* A knob's controls. Wraps rather than widening: the page never scrolls sideways
+   (hall-ui/CLAUDE.md), and this cluster is the only thing on the page wide enough
+   to threaten that at 390px. */
+.ps-controls {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-top: 10px;
+}
+.ps-controls input[type="number"] { width: 7em; }
+.ps-controls input[type="text"] { min-width: 0; flex: 1 1 12em; }
+
+/* The category list inside its row. A plain list, not a nested ledger: it is edited
+   in place and a table would put a horizontal scrollport inside a card that already
+   is one. */
+.ps-cats { margin: 10px 0 0; padding: 0; list-style: none; }
+.ps-cat {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 0;
+  border-top: var(--line) solid var(--rule-soft);
+}
+.ps-cat--off { opacity: 0.6; }
+.ps-cat__slug {
+  font-size: 11px;
+  color: var(--ink-soft);
+  flex: 0 0 auto;
+}
+
+/* The invalid-value note: a configured value the resolver could not use. It renders
+   on the screen of the person who can fix it rather than 500-ing the page — the
+   reporting half of ADR 0226's asymmetric fail posture. */
+.ps-invalid {
+  margin: 8px 0 0;
+  padding: 8px 10px;
+  border-radius: 6px;
+  font-size: 12px;
+  color: var(--warn);
+  border: 1px solid currentColor;
+}
+
+/* The sibling note on the stale-timer row — the OTHER timer, the one that enforces.
+   Indented and quiet: it is context that stops a misreading, not a second setting. */
+.ps-sibling {
+  margin: 10px 0 0;
+  padding-left: 10px;
+  border-left: var(--line) solid var(--rule);
+  font-size: 12px;
+  color: var(--ink-soft);
+}
+.ps-sibling strong { color: inherit; font-weight: 600; }

package/modules/hall-ui/public/project-settings.html

@@ -0,0 +1,68 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Project settings — {{worldName}}</title>
+  <meta name="description" content="The fundamentals of this project in one place — the stale timer, the category set, how credits are calculated, whether equity is real, and what share of upmarket revenue is paid on credits.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <link rel="stylesheet" href="/builders/oversight.css">
+  <link rel="stylesheet" href="/builders/project-settings.css">
+</head>
+<body data-page="project-settings" data-page-title="Project settings">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <!-- The LABEL voice (the page-head--board idiom, task 1003307): on a working
+           surface the page's own name is the least interesting thing on it. -->
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Project settings</h1>
+        <p class="page-head__sub" id="ps-sub">Loading…</p>
+      </div>
+
+      <main id="hall-main">
+        <!-- The sealed state is a panel with a heading, not a bare line on the ground
+             (task 1003469). The page gate is the real wall; this is what a reader who
+             followed a link sees instead of an empty page. -->
+        <section class="scroll" id="ps-sealed" aria-labelledby="ps-sealed-h" hidden>
+          <h2 class="scroll__h" id="ps-sealed-h">Restricted</h2>
+          <p class="scroll__lede" id="ps-sealed-body">This page opens at a higher rank.</p>
+        </section>
+
+        <section class="scroll" id="ps-body" aria-labelledby="ps-body-h" hidden>
+          <h2 class="scroll__h" id="ps-body-h">The fundamentals</h2>
+          <p class="scroll__lede">
+            Five things every project settles. Two of them are knobs you can turn here;
+            the other three are decided in committed configuration, and each says which
+            file decides it.
+          </p>
+          <!-- One mount, five rows, written by project-settings.js. The rows are NOT
+               authored in this file: each carries a value plus the provenance the
+               server resolved it through, and markup that could drift from that is the
+               thing this page exists to end. -->
+          <div id="ps-rows"><span class="kit-skel"></span></div>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
+<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
+<script src="/builders/hall-kit.js"></script>
+<script src="/builders/project-settings.js?v=2026-09-04-ps1"></script>
+</body>
+</html>