@bongos/core 1.19.570 → 1.19.572

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.570",
-  "core_contract": "1.19.570",
-  "source_commit": "7f686cc8bf351a08ac85f77eea54525fa067509b",
+  "core_version": "1.19.572",
+  "core_contract": "1.19.572",
+  "source_commit": "31894c826b1cb16600f02046b2e17a09f78f3712",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T21:14:46.455Z",
+  "built_at": "2026-09-07T00:51:07.099Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 449,
+    "docs_redacted": 450,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2039,
+    "functional_verbatim": 2042,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2512,
-  "tree_sha256": "e0096a8f2ab3ba5363c72d452787c803202d6f43c78964e74a36a079ff086f2e",
+  "file_count": 2516,
+  "tree_sha256": "dc4746621684478bdfcc20dba9ccc094ed1722956378f38939e11ff3f83e35d5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -392,7 +392,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2b37686507b5ea701c19a1086352a2f0c84eae46510ef12b3a601c18812610c6"
+      "sha256": "adaa20c8ce6bee76dc289f10929014382aa89d7373f94ddafc84f4c87eeb0ed4"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1799,20 +1799,25 @@
       "mode": "0000644",
       "sha256": "4b7d5b4ca5ad92a128235a6c3407617f2d8b34c26ed6e1c8b2a72e63eed7adac"
     },
+    {
+      "path": "docs/adr/0257-auth-resolves-before-the-hall-mounts-anything.md",
+      "mode": "0000644",
+      "sha256": "5ebfaa564a125f2c5bb0b391b8ff01914f147c15c9ef3f4caa91bafa8bd2e8ed"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "52422b934d0b3245605ec0913049be65768a814a6f9aee5f7ad8149c4221a093"
+      "sha256": "e9b47055a52c284035c201fae3f172215c746caabf938922821f4efcda2e8980"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "33d4d9b7530ebeebffc8c7200a137f5624b8319ff9a26e8b7b1e3209acb413ae"
+      "sha256": "0a622847ab68980279beba2e1a54813b2393107144f88dd31228fe4dfd248b90"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "9148616a367b2f7486a8f14c0f7ecf9ed367bd552075b15c4f2b0f3dd40712db"
+      "sha256": "60ca0b131c661df16fb993182d2085d0b04ea15a4d91bec4318c3413fb8dc311"
     },
     {
       "path": "docs/architecture.md",
@@ -1837,12 +1842,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "375801be3c0c325da208e3f95fb6aa04e5a0136297673a562d143f61e4ca4c83"
+      "sha256": "8bdf39ea0b8ed9583f9ef68b0edae767eec9c2825f8ef355d678b3db3d08b5e1"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5a2ff67ac4a1cf8edf959b02db2a1c226de24c16a8b7b98762cfc1863d1a8f52"
+      "sha256": "cd51497ccca735bf1f8178291b427f4166aff79870a080a4a9d036238f0ff90c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2687,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bfa90a0b7ff77b9befa37207824797d0268260fd83f960fb8e2f5ff52bf97e63"
+      "sha256": "d7acc0617ab16007150c0f733248576e5c285286f22b32ec722fa061748994f9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4642,7 +4647,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "876c4f21b3aaa77fad298915afe7cc481a39b5235e846f61bcc7657a270dd227"
+      "sha256": "ac1252ef25e0fe8b5774ef3d6566970657437de1151cd3e9e194859067fee789"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4822,7 +4827,7 @@
     {
       "path": "modules/hall-ui/public/goals.js",
       "mode": "0000644",
-      "sha256": "9cdbc14c1709dcc26fe9b8c85b2bfd08685a2925c9855758ca8e758455d1bc5c"
+      "sha256": "7800d109e109d61772edcf9fdd1f01dcd079a0937358f2ed8da6cbed361c1e9c"
     },
     {
       "path": "modules/hall-ui/public/goals.states.json",
@@ -5462,7 +5467,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "16c5f2ed9ae4b70a30eb47a4864c4ad6273afbe19e925edcac5f9d965e670f24"
+      "sha256": "31f39ea088b03feb217af4ce2fbf0b4dba0d8dad3e8eec625cf11e0dd4cb4228"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5502,7 +5507,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "c6ab8ace534687d1989e4b192809a373294e539f7fb8624f512fda4ceea884ba"
+      "sha256": "61ed58e2d0dbe9aa0b889d27b6a9c38df024a40bc797f22b0ff766fedf85a9de"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5619,6 +5624,11 @@
       "mode": "0000644",
       "sha256": "0d17971d88c2f75a61a5646325ebab121fd4406cdd39324a1128a5e610ce6d7d"
     },
+    {
+      "path": "modules/lifecycle/migrations/lifecycle_008_goal_version_admissions.sql",
+      "mode": "0000644",
+      "sha256": "4e4099764712b6ac8ad322cb846eb1e4b1118e936d03628e01a6a04adb4d4ebf"
+    },
     {
       "path": "modules/lifecycle/mingle.js",
       "mode": "0000644",
@@ -5677,12 +5687,12 @@
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
-      "sha256": "c380ad664c18beff53dd50e9bd5ad9ba78c05c18fae182cc0b0cc8ea41ee1a75"
+      "sha256": "5022ec9cdd2ba5087bc0b4607691c21d361f4a4edbf029ff3dea37ade373e890"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "9d3079d7f3f610aa5893f02fb4858f73ec98718d6096c423cd52c15d2b30d1ec"
+      "sha256": "d408d89cf736a7d4cdf45ccff44c2038bbc64b13be42dd1b460198dfc8112535"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -5742,7 +5752,7 @@
     {
       "path": "modules/lifecycle/routes/versions.js",
       "mode": "0000644",
-      "sha256": "a825191c1ef406ec4c0eb9455df5b65c5ecf25e23d2b9a9f78eeeae424fa2bf6"
+      "sha256": "5efe819220f9128844793a0c068babcd402860b434aab322fd9a99f8d2d26167"
     },
     {
       "path": "modules/lifecycle/routes/visuals.js",
@@ -7537,12 +7547,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6460f782c667dc03846bfbc1dbf299a80e2825488f4eafa664b39767a5c78c47"
+      "sha256": "439507cc695f5ef93f4fe1aa9a48556b4b9e11a023fa4e60912de1ed8befc5ee"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e0c2ff1988ca94bcc1f36b6defa3e098b12db1fdcbcc1b7616441e492628bffe"
+      "sha256": "bf5fe42d980095754ea4b13501ede3a559376dae4127a99915767ba4be0c27d2"
     },
     {
       "path": "public-docs/index.html",
@@ -9242,7 +9252,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2679c7764d5c874f7f1ecc546e552276b9e540bb66ee9f40fb3a281b9294543f"
+      "sha256": "be71a580784409ac5e4507201fbbf9915e16f0682098e3b9e98ec49a0af98216"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10324,6 +10334,11 @@
       "mode": "0000644",
       "sha256": "3e157d5bf44370e4935b70203fe59e40cf9120d12c472f24ed7bd85cb33cbe91"
     },
+    {
+      "path": "tests/goal_admission_override.mjs",
+      "mode": "0000644",
+      "sha256": "94b378fb96bbbb6285b61c4d00827f57e0b29d64d9036576670ffaf8ca233239"
+    },
     {
       "path": "tests/goal_advisory.mjs",
       "mode": "0000644",
@@ -10337,7 +10352,7 @@
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
-      "sha256": "05d46d4dcfd3a3b21ef0fc258263081cf4e624bdef4348daf84a90da589387c3"
+      "sha256": "dbdfd351d5edc3ac6adcb1a34e072fab0a8db9669030d7476bbf18aa1e81540d"
     },
     {
       "path": "tests/goal_category_ui.mjs",
@@ -10362,7 +10377,7 @@
     {
       "path": "tests/goal_create_version_gate.mjs",
       "mode": "0000644",
-      "sha256": "addd9fe7179236d24c316923fd47a60947c1a34f9e01eb1a4d47faa49b4fa18f"
+      "sha256": "28da055ccad13b327135dce6292df9c6bc53e2589648e0a4361ada0ddd21b863"
     },
     {
       "path": "tests/goal_criterion_confirm_ui.mjs",
@@ -10417,7 +10432,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "7d8c1b8300c99be22b42ff25e8ce25e25b5af28cd29c314f9aee7ddee11fc0d5"
+      "sha256": "3c420d28341a6e5aaeb5d4af978e72acefec3c9bd7d97f66fd11a72517118606"
     },
     {
       "path": "tests/goal_wall_proof.mjs",
@@ -10714,6 +10729,11 @@
       "mode": "0000644",
       "sha256": "5654f4366ddcfcb61848a119a2dba3827f3fe19c0151005558a803c2e09db573"
     },
+    {
+      "path": "tests/hall_landing_boot.mjs",
+      "mode": "0000644",
+      "sha256": "36711b8d885203ecb2f70ecd6aaf18359bc6796d50300bc8b062485a24ba49a4"
+    },
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -49,7 +49,7 @@ export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_dep
 export interface GetGithubReposResponse { repos: unknown }
 export interface GetGoalsIdConflictsResponse { ok: boolean; goal_id: unknown; conflicts: unknown; cross_goals_considered: unknown }
 export interface GetGoalsIdRequestsResponse { requests: unknown }
-export interface GetGoalsIdResponse { goal: unknown; members: unknown; criteria: unknown; dependencies: unknown; criterionless_task_count: unknown }
+export interface GetGoalsIdResponse { goal: unknown; members: unknown; criteria: unknown; dependencies: unknown; criterionless_task_count: unknown; admitted: unknown }
 export interface GetGoalsResponse { goals: unknown }
 export interface GetGoalsRollupsResponse { rollups: unknown }
 export interface GetGovernmentAssignmentsResponse { assignments: unknown }
@@ -278,8 +278,8 @@ export interface PostGoalsIdTransferRequest { builder_id?: StringifiableId }
 export interface PostGoalsIdTransferResponse { ok: boolean; goal: unknown; changed: boolean }
 export interface PostGoalsReorderRequest { version_id: string; ordered_ids: number[] }
 export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
-export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number }
-export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown }
+export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number; admit_reason?: string }
+export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown; admitted: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
 export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }

package/docs/adr/0257-auth-resolves-before-the-hall-mounts-anything.md

@@ -0,0 +1,84 @@
+# ADR 0257 — Auth resolves before the hall mounts anything, and a widget's boot read may never navigate
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1003673](https://cloudbongos.com/builders#/task/1003673) (BONGOS-V1, goal 1000063 — *The front door*)
+- **Deciders:** Claude, under the Archon's standing scope
+- **Related:** [ADR 0050](<redacted>.md) (admission is invite-gated by default — the posture this defect made unusable) · [ADR 0194](<redacted>.md) + [ADR 0247](<redacted>.md) (the door the landing form renders) · [ADR 0062 §4](<redacted>.md) (the hall-widget registry)
+
+---
+
+## Context
+
+An owner stood up an instance, invited a colleague, and watched them sign in with
+GitHub. They got *"Sign-in failed — this account is not approved yet. New here?
+Request access first"*, whose one button goes to `/builders`. The owner then went
+looking for the approval queue and found nothing to approve: `GET /access-requests`
+answered `{"requests": []}`, and the hall hides the Access-requests panel when the
+queue is empty. Both halves are working as designed — **signing in does not file a
+request**; only the landing page's *Request access* form does.
+
+The landing page could not be reached. A signed-out visitor to `/builders` was
+bounced to GitHub, refused as a first-timer, and pointed back at `/builders` to be
+bounced again. A closed loop, and the form sat inside it. Every invite-only
+instance — the default posture since ADR 0050 — therefore had **no way to admit its
+first builder**, and the symptom pointed at the approval UI rather than at the door.
+
+Reproduced against `main` (not only against an old pin) by serving
+`modules/hall-ui/public` statically with every authenticated route answering 401:
+
+```
+GET /api/bongos/me            401   (soft — builders.js would renderLanding())
+GET /api/bongos/goals         401   -> window.location.assign(/auth/web/start)
+GET /api/bongos/auth/web/start      the dead end
+```
+
+`builders.js` was already careful: `/me` is read with `softAuth`, and a 401 there
+renders the landing rather than bouncing. But its `DOMContentLoaded` handler called
+`mountHallWidgets()` **first**, synchronously. `goals.js`'s `mount()` reads `/goals`
+through a `getJSON` with no `softAuth`, and that helper answers 401 by *navigating*.
+The widget's read therefore raced `renderLanding()` — and won.
+
+## Decision
+
+**1. The front door settles which page this is before anything else runs.**
+`builders.js` boots through `boot()`: read `/me` (soft), and only then choose.
+Signed out → `renderLanding()` and stop; nothing else mounts, nothing else fetches.
+Signed in → mount widgets, wire events, render the hall. The resolved `/me` payload
+is handed to `loadAll()` rather than re-fetched, so the page still asks once.
+
+Widgets are member surfaces — `renderLanding()` already hid every one of them after
+the fact — so not mounting them for a signed-out visitor removes a whole class of
+races rather than the one instance of it that was found.
+
+**2. A widget's own boot read may never navigate.** `goals.js`'s mount-time read is
+`softAuth`, and answers "no session" by rendering nothing. A 401 during page boot is
+not an error and not an instruction to go and sign in; it is the answer *this visitor
+has no session*, which the landing already handles. Only a user action may send
+someone to the sign-in flow.
+
+## Consequences
+
+- An invite-only instance can admit its first builder: the landing renders, the
+  request form is reachable, the queue fills, and the owner has something to approve.
+- The "Sign-in failed" page's CTA now lands somewhere useful — the loop is closed at
+  both ends.
+- `tests/hall_landing_boot.mjs` executes the real `builders.js` in a DOM stub and
+  asserts the invariant three ways: a signed-out boot never navigates, renders the
+  landing, and mounts no widgets; it asks for `/me` and nothing else; and a signed-in
+  boot still mounts the hall on a single `/me`. The guard was confirmed to FAIL
+  against the pre-fix file — a regression test that passes both ways guards nothing.
+- A widget added later can still reintroduce the class if it hard-redirects at mount
+  AND something mounts it while signed out. The boot order is what makes that
+  unreachable; the `softAuth` rule is the belt beside it.
+
+## Rejected
+
+- **Patch `goals.js` alone.** It was the widget that happened to fire first. Any
+  mount-time authenticated read can steal the page, so the fix belongs at the boot
+  order, not at whichever widget was caught doing it.
+- **Make the 401 → redirect helper soft everywhere.** A signed-in builder whose
+  session expires mid-visit *should* be sent to sign in. The distinction that matters
+  is boot versus user action, not the status code.
+- **Open enrollment** (`OPEN_XENOS_ENROLLMENT`) as the cure. That removes the gate
+  instead of repairing the door, and ADR 0050 chose the gate deliberately.

package/docs/adr/README.md

@@ -348,3 +348,4 @@ This keeps the decision history honest and traceable.
 | 0246 | [**Catalog membership is a projection of the provisioning row, not a side effect of federation** ([task 1003576](https://cloudbongos.com/builders#/task/1003576) · goal 1000046, criterion `proj-detail-interview` / C3). The BV1.R18 proof ([task 1002337](https://cloudbongos.com/builders#/task/1002337)) demonstrated C3 against live and found its last clause — “then it publishes” — structurally false: the owner’s verdict reads `provisioning_instances` while the public map reads `platform_identity_projects`, and the ONLY bridge was `federateInstance → registerClient → upsertProject`, which `shouldFederate` refuses for anything but `co-tenant` (the wizard hard-codes `standalone`) and which runs ONCE, at provision time, through a COALESCE. So a wizard-made project was never catalogued at all and a co-tenant one that answered later never updated — `publishable: true`, `{"projects": []}`, forever. The same missing row is [task 1003580](https://cloudbongos.com/builders#/task/1003580)’s GAP 1: `POST /projects/invite` resolves against `platform_identity_sso_clients`, whose only writer is that same `registerClient`. Underneath is one conflation — federation mints CREDENTIALS and was incidentally the only thing that minted MEMBERSHIP, while [ADR 0182](<redacted>.md) D4 already fixed the map’s gate at IDENTITY, which has nothing to do with hosting topology. **Decision: the catalog row is a PROJECTION of the provisioning row, re-derived at every write that can change its inputs** — two halves, neither sufficient alone. (1) THE ROW SHAPE: every control-plane project gets both rows whatever its hosting shape, and the client row carries NO credential (`secret_hash = ''`, `redirect_uris = '{}'`), so **the shape is the enforcement** rather than a flag a caller could forget — `redirectUriAllowed` refuses `/sso/authorize`, `clientSecretValid` refuses `/sso/token`, `/sso/membership/check-in` and `/sso/activity/rollup`, and the one leg that checked NEITHER (`/sso/device/start`, which resolves a client from a user-typed origin) grew an explicit `clientIsCredentialed` guard. (2) THE TIMING: re-taken on create, on `PATCH …/detail`, on `PATCH …/settings` when the door changes, and on `POST …/domain` (which re-keys the row, retiring the abandoned origin — [ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2’s leak, in the catalog instead of DNS). **NO MIGRATION** — `secret_hash` is `NOT NULL` and `''` satisfies it while hashing to nothing. `description` and `visibility` are ASSIGNED, not COALESCEd (clearing a description must UN-publish); `featured`/`tagline`/`art_url`/`template` are curation and stay untouched, so [ADR 0182](<redacted>.md) D3 holds. It grants nothing — the row is attribution per [ADR 0238](<redacted>.md), ownership stays `provisioning_instances.owner_builder_id` — and because it writes rows keyed on owner-supplied values (a slug, a BYO domain) each write carries its **claim rule in the ON CONFLICT action’s own WHERE**: the client is refreshed only `WHERE secret_hash = ''` (a real client’s origin, which binds the CLI mint audience, can never be rewritten) and the project only `WHERE owner_github_id = EXCLUDED.owner_github_id` (`NULL = anything` is not true, so the hand-seeded rows cannot be claimed). Writing `visibility` does not contradict [ADR 0182](<redacted>.md) D5: the hub authorizes nothing — the authority already ran on the provisioning plane ([ADR 0238](<redacted>.md)’s own-scoped, audited PATCH), and a project the control plane does NOT own has no provisioning row, so D5’s instance report (R08) stays the only channel for those. `tearing_down`/`torn_down` project `hidden`; a `no_address` instance is not catalogued at all. Travels on the kernel port `project.catalog`, the `project.publishGate` seam in the other direction ([ADR 0083](<redacted>.md) forbids the import). Rejected: extending `shouldFederate` to every shape (hands a real secret to instances whose web.env the platform does not write, and keeps the once-at-standup bug); bridging only at the publish moment (leaves the invite with nothing to resolve); registering only at standup (the bug itself); a `catalog_only` boolean column (needs a migration and is weaker than the shape); letting the bridge write `featured`; and backfilling the three existing catalog rows from code.](<redacted>.md) | provisioning / project creation |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.
+| 0257 | [**Auth resolves before the hall mounts anything, and a widget's boot read may never navigate** ([task 1003673](https://cloudbongos.com/builders#/task/1003673) · goal 1000063 — *The front door*). An invite-only instance could not admit its FIRST builder, and the symptom lied about where the fault was: an owner saw an empty Access-requests queue and no approve button, because **signing in does not file a request** — only the landing's *Request access* form does, and that form was unreachable. A signed-out visitor to `/builders` was bounced to GitHub, refused as a first-timer ("request access first"), and pointed back at `/builders` to be bounced again. Reproduced against `main`, not just an old pin. `builders.js` was already careful — `/me` is read `softAuth` and a 401 there renders the landing — but `DOMContentLoaded` called `mountHallWidgets()` FIRST, synchronously, and `goals.js`'s mount-time read of `/goals` goes through a `getJSON` with no `softAuth`, which answers 401 by NAVIGATING. The widget's read raced `renderLanding()` and won. **Decision: the front door settles which page this is before anything else runs** — `boot()` reads `/me` (soft), then either renders the landing and stops (nothing mounts, nothing else fetches) or mounts the hall, handing the resolved payload to `loadAll()` so the page still asks once. Widgets are member surfaces (`renderLanding` hid them all after the fact anyway), so not mounting them while signed out removes the CLASS rather than the one instance of it that was found; **a widget's own boot read may never navigate** is the belt beside it (`goals.js` reads soft and renders nothing without a session). A 401 during boot is not an instruction to go and sign in — only a user action is. `tests/hall_landing_boot.mjs` executes the real `builders.js` in a DOM stub and was confirmed to FAIL against the pre-fix file. Rejected: patching `goals.js` alone (it was merely first); making the 401 redirect soft everywhere (an expired session mid-visit SHOULD be sent to sign in — the line is boot vs user action); open enrollment as the cure (removes the gate [ADR 0050](<redacted>.md) chose deliberately instead of repairing the door).](<redacted>.md) | hall-ui / admission / front door |

package/docs/api/openapi.json

@@ -16955,14 +16955,16 @@
           "members": {},
           "criteria": {},
           "dependencies": {},
-          "criterionless_task_count": {}
+          "criterionless_task_count": {},
+          "admitted": {}
         },
         "required": [
           "goal",
           "members",
           "criteria",
           "dependencies",
-          "criterionless_task_count"
+          "criterionless_task_count",
+          "admitted"
         ]
       },
       "GetGoalsResponse": {
@@ -20325,6 +20327,11 @@
           "category_id": {
             "type": "integer",
             "minimum": 1
+          },
+          "admit_reason": {
+            "type": "string",
+            "minLength": 8,
+            "maxLength": 500
           }
         },
         "required": [
@@ -20341,13 +20348,15 @@
           },
           "goal": {},
           "succeeds_goal_id": {},
-          "category_advisory": {}
+          "category_advisory": {},
+          "admitted": {}
         },
         "required": [
           "ok",
           "goal",
           "succeeds_goal_id",
-          "category_advisory"
+          "category_advisory",
+          "admitted"
         ]
       },
       "PostGovernmentAssignmentsRequest": {

package/docs/api-reference.md

@@ -226,7 +226,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/goals` | `any-builder` | — | GET /goals?version=&status= — list goals (read). |
-| POST | `/api/bongos/goals` | `metic+archon` | `version_id`, `title`, `subtitle`, `description`, `scope_modules`, `succeeds_goal_id`, `category_id` | POST /goals — create a goal. |
+| POST | `/api/bongos/goals` | `metic+archon` | `version_id`, `title`, `subtitle`, `description`, `scope_modules`, `succeeds_goal_id`, `category_id`, `admit_reason` | POST /goals — create a goal. |
 | GET | `/api/bongos/goals/:id` | `any-builder` | — | GET /goals/:id — one goal with its members + linked criteria (read). |
 | PATCH | `/api/bongos/goals/:id` | `any-builder` | — | PATCH /goals/:id — correct a goal's own title/subtitle/description (tasks 1003102, 1003224). |
 | PATCH | `/api/bongos/goals/:id/accepting-requests` | `any-builder` | — | PATCH /goals/:id/accepting-requests { accepting_requests } — a private goal's lead closes or re-opens it to join-requests (task 1002971, … |

package/docs/copy-inventory.md

@@ -135,7 +135,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:196` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
-| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1154` |
+| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1158` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:99` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:209` |
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:162` |
@@ -445,7 +445,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `529460e82058` | certain | Goal invitations to you | `modules/hall-ui/public/goal-inbox.js:113` |
 | `e2a9e33abe60` | certain | Goal tasks | `modules/hall-ui/public/goals.html:136` |
 | `e0bc28d10785` | certain | Goals could not be loaded. Refresh to try again. | `modules/hall-ui/public/goals-page.js:890` |
-| `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:112` |
+| `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:121` |
 | `6a85997bda21` | certain | Goals created | `modules/hall-ui/public/profile.html:145` |
 | `2ed2cb8fbffd` | certain | Goals page | `modules/hall-ui/public/goals.js:94` |
 | `320a0516a33e` | certain | Goals seeded — awaiting kickoff | `modules/hall-ui/public/roadmap.js:205` |
@@ -907,7 +907,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:108` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:75` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
-| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1396` |
+| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1425` |
 | `74bc22f38140` | certain | The platform confirmed this request came from the account it names. | `modules/hall-ui/public/watch.js:349` |
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:41` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:88` |

package/docs/copy-registry.json

@@ -2211,7 +2211,7 @@
       "surface": "builders-hall",
       "text": "Achievements could not be loaded.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1154,
+      "line": 1158,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5001,7 +5001,7 @@
       "surface": "builders-hall",
       "text": "Goals couldn’t be loaded just now. Refresh to try again.",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 112,
+      "line": 121,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9159,7 +9159,7 @@
       "surface": "builders-hall",
       "text": "The page could not be loaded. Try again.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1396,
+      "line": 1425,
       "origin": "js-notice",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1589,5 +1589,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.568 with no explicit bump. run 34058387853. (task 1002620)
   1.19.570 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.569 with no explicit bump. run 34060442118. (task 1002620)
+  1.19.571 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.570 with no explicit bump. run 34065943703. (task 1002620)
+  1.19.572 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.571 with no explicit bump. run 34071078624. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/builders.js

@@ -1044,16 +1044,20 @@
 
   // ---- bootstrap -----------------------------------------------------------
 
-  async function loadAll() {
+  // `prefetchedMe` is boot()'s already-resolved /me — the SAME payload, handed in
+  // so the page does not ask twice. Called with nothing (a re-render), it fetches.
+  async function loadAll(prefetchedMe) {
     // Profile first. If /me returns 401, render an unauth landing card with a
     // Sign-in button instead of bouncing straight to GitHub — gives the visitor
     // a beat of orientation about what they're walking into.
-    let me;
-    try {
-      me = await getJSON(`${API}/me`, { softAuth: true });
-    } catch (err) {
-      if (err && err.code === AUTH_NEEDED) { renderLanding(); return; }
-      throw err;
+    let me = prefetchedMe || null;
+    if (!me) {
+      try {
+        me = await getJSON(`${API}/me`, { softAuth: true });
+      } catch (err) {
+        if (err && err.code === AUTH_NEEDED) { renderLanding(); return; }
+        throw err;
+      }
     }
     // Signed in: drop the landing card if a previous unauth render left it up.
     const landingRoot = $('#landing-root');
@@ -1374,7 +1378,31 @@
     get newcomerGated() { return newcomerGated; },
   });
 
-  document.addEventListener('DOMContentLoaded', () => {
+  // boot — AUTH FIRST, then the page (task 1003673).
+  //
+  // The front door has exactly two shapes, and which one this is must be settled
+  // BEFORE anything else runs. A signed-out visitor gets the landing (the door:
+  // sign in, or request access) and nothing else; a builder gets the hall.
+  //
+  // Why the order is load-bearing: mountHallWidgets() mounts every registered
+  // widget, and a widget's mount() reads its own data. Any such read that treats
+  // a 401 as "go and sign in" NAVIGATES — and mounting before /me resolved gave
+  // those reads a head start on renderLanding(), so the signed-out visitor was
+  // bounced to GitHub, refused as a first-timer ("request access first"), and
+  // sent back here to be bounced again. A closed loop: the request form was
+  // unreachable, so an invite-only instance could never admit its first builder.
+  // Widgets are for members, so a signed-out visitor simply never mounts them
+  // (renderLanding hides those sections anyway) and nothing can steal the page.
+  async function boot() {
+    let me = null;
+    try {
+      me = await getJSON(`${API}/me`, { softAuth: true });
+    } catch (err) {
+      if (!(err && err.code === AUTH_NEEDED)) throw err;
+    }
+
+    if (!me) { renderLanding(); return; }
+
     // BV1.R75: stamp the registry's <section>s into <main> BEFORE wiring events —
     // wireEvents() + the data-render code address the widgets by their static ids,
     // which only exist once the registry has mounted them.
@@ -1386,11 +1414,12 @@
     // #731: the Discord connect/link card moved to /builders/settings, and the
     // OAuth callback now lands there — so the ?discord=joined|linked toast is
     // handled by settings.js, not here.
-    loadAll().then(() => {
-      // Only open the live channel once we're authenticated — loadAll() returns
-      // early (landing card) for an unauthenticated visitor, leaving selfId unset.
-      if (window.__buildersSelfId) startLiveUpdates();
-    }).catch((err) => {
+    await loadAll(me);
+    if (window.__buildersSelfId) startLiveUpdates();
+  }
+
+  document.addEventListener('DOMContentLoaded', () => {
+    boot().catch((err) => {
       if (err && err.message === 'redirecting to auth') return;
       console.error('[builders] load failed', err);
       toast('The page could not be loaded. Try again.');

package/modules/hall-ui/public/goals.js

@@ -101,7 +101,13 @@
         const me = await getJSON(`${API}/me`, { softAuth: true }).catch(() => null);
         myId = me && me.builder ? me.builder.id : null;
       }
-      const gres = await getJSON(`${API}/goals`);
+      // softAuth (task 1003673): a widget's own boot read may NEVER navigate.
+      // This ran at mount time and its 401 hard-redirected to GitHub, which is
+      // what stole the page from a signed-out visitor before the landing could
+      // paint. boot() no longer mounts widgets for a signed-out visitor; this
+      // keeps the widget itself harmless if it is ever mounted without a session
+      // (an expired cookie mid-visit), where the honest answer is to say nothing.
+      const gres = await getJSON(`${API}/goals`, { softAuth: true });
       const candidates = (gres.goals || []).filter((g) => g.status !== 'archived');
       const details = (await Promise.all(candidates.map((g) =>
         getJSON(`${API}/goals/${encodeURIComponent(g.id)}`).catch(() => null)))).filter(Boolean);
@@ -109,6 +115,9 @@
       render(joined);
     } catch (err) {
       const body = host.querySelector('#goals-body');
+      // Signed out is not a failure — it is simply nothing to show. Only a real
+      // error earns the retry line (and the console noise).
+      if (err && err.code === 'auth-needed') { if (body) body.innerHTML = ''; return; }
       if (body) body.innerHTML = '<p class="goal-empty">Goals couldn’t be loaded just now. Refresh to try again.</p>';
       console.error('[hall] goals load failed', err);
     }