@bongos/core 1.19.659 → 1.19.661

package/modules/government/catalog.js

@@ -221,7 +221,7 @@ const PERMISSIONS = [
   // route reads is INERT; a route reading a key with no grant rows 403s everyone.
   // ADR 0174's Consequences record that failure landing on the Government tab
   // itself. So grants lead, routes follow — inside this goal, not across releases.
-  { key: 'board.item.open', system: false, floor: 'metic', guards: 'POST /board/items — put a subject to the board (ADR 0175; a Full Idea window opens automatically on grade pass, so in practice this guards an amendment)' },
+  { key: 'board.item.open', system: false, floor: 'metic', guards: 'POST /government/board/items — put a subject to the board (ADR 0175; a Full Idea window opens automatically on grade pass, so in practice this guards an amendment)' },
   // floor 'xenos' is NOT a mistake and must not be "tightened". Who may vote is
   // the CONSTITUTION's membership predicate, resolved per request from config
   // (ADR 0175 §6) — today `rank:archon`. Encoding that rank here too would fork
@@ -230,7 +230,7 @@ const PERMISSIONS = [
   // is. So the atom says only "this route exists for authenticated builders" and
   // the predicate does the real gating — the `criterion.create` pattern above,
   // where the floor is real but explicitly not the whole gate.
-  { key: 'board.vote.cast', system: false, floor: 'xenos', guards: 'POST /board/items/:id/vote — floor is the coarse gate; board membership is the configured predicate (ADR 0175 §6), checked in-handler' },
+  { key: 'board.vote.cast', system: false, floor: 'xenos', guards: 'POST /government/board/items/:itemId/votes — floor is the coarse gate; board membership is the configured predicate (ADR 0175 §6), checked in-handler' },
   { key: 'task.newcomer_restock', system: false, floor: 'metic', guards: 'POST /tasks/newcomer-restock (ADR 0157, was archon)' },
   { key: 'task.peer_votes.tally', system: false, floor: 'metic', guards: 'POST /tasks/peer-votes/tally (ADR 0157, was archon)' },
   { key: 'goal.reorder', system: false, floor: 'metic', guards: 'POST /goals/reorder (ADR 0157, was archon)' },
@@ -247,7 +247,25 @@ const PERMISSIONS = [
   // ── ownership-scoped + baseline own-work (floor thetes / xenos) ───────────────
   { key: 'task.claim.any', system: false, floor: 'thetes', guards: 'claim the general queue (per-task requires_rank floor still applies)' },
   { key: 'page.view.builder', system: false, floor: 'thetes', guards: 'authenticated hall pages (requireNonXenosPage / requireBuilderPage)' },
-  { key: 'goal.manage.own', system: false, floor: 'metic', scope: 'own', resource: 'goal', guards: 'PATCH /goals/:id/members/:b, POST /goals/:id/transfer — owner/manager, in-handler (ADR 0106)' },
+  // floor 'metic' is real but NOT the whole gate — the `criterion.create` pattern
+  // above, and here the floor is the LOOSER half. Both routes carry requireBuilder
+  // and decide in-handler (authorizeMembershipKindChange / authorizeOwnershipTransfer,
+  // modules/lifecycle/routes/goal-route-authz.js): rank is consulted ONLY as an
+  // Archon bypass, so `actorIsOwner || actorIsManager` admits at ANY rank.
+  //
+  // THE LIVE POPULATION, recorded because a migration must not silently evict it:
+  // a goal's owner is its `created_by` (goal-authz.js isGoalOwner), so a builder
+  // DEMOTED below metic keeps owner authority over goals they created; and a
+  // sub-metic member can be promoted to manager ('lead') on any unprotected goal,
+  // reaching this permission without ever holding metic.
+  //
+  // So when R104-R107 migrates these routes, the gate stays requireBuilder +
+  // resolver.authorizeOwned(key, owner) — a bare permission gate on this key would
+  // 403 exactly the owners and managers the routes admit today. The floor is
+  // deliberately NOT lowered to xenos here (the board.vote.cast option): a floor
+  // feeds RANK_SEED and the live reset route, so widening it is an authority change
+  // that wants its own decision, not a note in a hardening batch.
+  { key: 'goal.manage.own', system: false, floor: 'metic', scope: 'own', resource: 'goal', guards: 'PATCH /goals/:id/members/:b, POST /goals/:id/transfer — requireBuilder + in-handler owner|manager|Archon (ADR 0106); floor is not the whole gate, and sub-metic owners/managers hold it today' },
   { key: 'task.claim.newcomer', system: false, floor: 'xenos', guards: 'claim a newcomer_friendly task (xenosClaimAllowed; xenos = one active claim)' },
   { key: 'task.ship', system: false, floor: 'xenos', guards: '/builder-ship own claim' },
   { key: 'task.act.own', system: false, floor: 'xenos', scope: 'own', resource: 'claim', guards: 'act on OWN active claim (release, cost, notes) — ownership-scoped' },
@@ -261,7 +279,7 @@ const PERMISSIONS = [
   // marker here. Exactly why scope is declared data: the suffix rule only runs the
   // safe direction ('.own' ⇒ scope 'own'), never the converse.
   { key: 'me.wandering.set', system: false, floor: 'xenos', scope: 'own', resource: 'builder_prefs', guards: 'PATCH /me/wandering (clamped by maxLevelForRank) — ownership-scoped' },
-  { key: 'cost.log', system: false, floor: 'xenos', guards: 'POST /costs' },
+  { key: 'cost.log', system: false, floor: 'xenos', guards: 'POST /cost' },
   { key: 'learning.create', system: false, floor: 'xenos', guards: 'POST /learnings' },
   { key: 'blocker.file', system: false, floor: 'xenos', guards: 'POST /blockers' },
   { key: 'idea.file', system: false, floor: 'xenos', guards: 'POST /inbox (own idea capture)' },
@@ -281,7 +299,8 @@ const OWNERSHIP_SCOPES = Object.freeze(['own', 'any']);
 const _byKey = new Map();
 const _byPrincipal = new Map();
 const _byResource = new Map();
-for (const p of PERMISSIONS) {
+for (let i = 0; i < PERMISSIONS.length; i++) {
+  const p = PERMISSIONS[i];
   if (typeof p.key !== 'string' || !p.key) throw new Error(`government catalog: permission missing a key`);
   if (typeof p.system !== 'boolean') throw new Error(`government catalog: ${p.key} missing boolean 'system'`);
   if (p.floor !== null && !RANK_ORDER.includes(p.floor)) throw new Error(`government catalog: ${p.key} has invalid floor "${p.floor}"`);
@@ -320,6 +339,16 @@ for (const p of PERMISSIONS) {
     // floor would seed the key into a rank that the substrate then still denies.
     if (p.floor !== 'archon') throw new Error(`government catalog: ${p.key} is substrate-enforced and must floor at 'archon' (the substrate compares against the top of the ladder)`);
   }
+  // A system:true key is trust-boundary authority (ADR 0016): it is never grantable
+  // to a custom rank, so the ONLY way a builder holds it is by sitting on a seeded
+  // rank at or above its floor. That makes the floor the whole wall, and the wall
+  // belongs at the top of the ladder. Without this, {system:true, floor:'metic'}
+  // loads clean and governance_002's reset route seeds Archon-only power to Metic.
+  // The two floor:null shapes are the exception and are already partitioned above:
+  // a machine principal is held by NO rank at all.
+  if (p.system && principal === null && p.floor !== 'archon') {
+    throw new Error(`government catalog: ${p.key} is system:true and must floor at 'archon' (a system key is not grantable, so its floor is the whole wall) — got "${p.floor}"`);
+  }
   // ── the OWNERSHIP axis (R100) ─────────────────────────────────────────────
   const scope = p.scope ?? null;
   const resource = p.resource ?? null;
@@ -347,7 +376,15 @@ for (const p of PERMISSIONS) {
   if (scope !== null && p.floor === null) {
     throw new Error(`government catalog: ${p.key} is ownership-scoped but has no rank floor — the ownership axis narrows a RANK permission, never an identity one`);
   }
+  // ONE object per permission, shared by every reader. The frozen copy goes back
+  // into PERMISSIONS[i] as well as the lookup maps, because the alternative —
+  // freezing a COPY and leaving the original mutable in the array — splits the
+  // catalog into two views that can disagree: `Object.freeze(PERMISSIONS)` below
+  // seals the array's SHAPE but not its entries, so a runtime mutation of
+  // PERMISSIONS[i] would change the floor seedForRank() reads (and with it the
+  // live POST /government/ranks/:rankKey/reset) while byKey() kept the old value.
   const frozen = Object.freeze({ ...p, principal, scope, resource, substrate });
+  PERMISSIONS[i] = frozen;
   _byKey.set(p.key, frozen);
   if (principal !== null) _byPrincipal.set(principal, frozen);
   if (resource !== null) {

package/modules/hall-ui/public/work.css

@@ -197,6 +197,12 @@
   font-variant-numeric: tabular-nums; min-width: 3.2em;
 }
 .history__title { flex: 1 1 auto; color: var(--ink); min-width: 0; }
+/* task 1003828 — the goal a backlog row belongs to, on its own line under the
+   title. The SUB-LINE voice (the .scroll__lede tone), not a tag: a tag would read
+   as one more equal chip beside version/discipline/rank, and where a task LIVES
+   is the parent fact those chips sit inside. Wraps rather than truncating —
+   a goal title a person cannot finish reading is the state this row is fixing. */
+.history__goal { display: inline-block; margin-top: 3px; color: var(--ink-soft); font-size: 12.5px; }
 .history__when { color: var(--ink-soft); font-size: 12.5px; white-space: nowrap; font-variant-numeric: tabular-nums; }
 
 @media (max-width: 640px) {

package/modules/hall-ui/public/work.html

@@ -52,6 +52,24 @@
              Deep links: /work#in-progress etc. -->
         <nav id="work-tabs" aria-label="Task sections"></nav>
 
+        <!-- task 2170: the filter bar is built by OTBKit.makeFilterBar —
+             Search / Sort / Version / Discipline primary (task 1003828 promoted
+             Discipline out of the overflow: a craft is the axis this platform
+             organises work by), the rest behind a "Filters" disclosure; state
+             rides the URL query. Control ids are unchanged (f-search, f-sort,
+             f-version, f-goal, f-kind, f-discipline, f-newcomer, f-fit) so
+             work.js reads stay stable.
+
+             task 1003828 moved it OUT of #claim-scroll and above the panels. It
+             lived inside the Ready section, which makeTabs hides — so on the
+             Backlog tab the filters were not merely inert, they were not on the
+             screen at all. It drives the two QUEUE tabs (Ready, Backlog) through
+             the one matchesBoardFilters predicate, and work.js hides it on In
+             Progress and Completed, which render different objects (live claims,
+             shipped history) that these lenses do not describe. A filter bar
+             above a list it cannot narrow is the bug this task is fixing. -->
+        <div id="work-filters"></div>
+
         <!-- READY — the claimable queue: the page's primary object, above the
              fold as the default tab. -->
         <!-- task 1003304: BARE, and that is the whole re-skin. In v3 a claimable
@@ -64,12 +82,6 @@
           <h2 id="claim-h" class="scroll__h">Ready — tasks to do<span class="count-pill" id="ready-count" hidden></span></h2>
           <p class="scroll__lede">Click <span class="kbd">Claim</span> to take a task right here — no terminal needed. Then click <span class="kbd">📋</span> to copy the task prompt and paste it into a fresh Claude Code session to begin.</p>
 
-          <!-- task 2170: the filter bar is built by OTBKit.makeFilterBar —
-               Search / Sort / Version primary, the rest behind a "Filters"
-               disclosure; state rides the URL query. Control ids are unchanged
-               (f-search, f-sort, f-version, f-goal, f-kind, f-discipline,
-               f-newcomer, f-fit) so work.js reads stay stable. -->
-          <div id="work-filters"></div>
           <p class="claim-count-line" id="claim-count" aria-live="polite"></p>
 
           <div class="task-list" id="task-list">

package/modules/hall-ui/public/work.js

@@ -62,15 +62,23 @@
   // forever. Its own function because Creator/Age re-fetch it, same as the
   // claimable feed. Best-effort: on failure the section stays as it was.
   function loadBacklog() {
-    const q = serverFilterQuery().replace(/^\?/, '&');
+    const q = backlogFilterQuery().replace(/^\?/, '&');
     return getJSON(`${API}/tasks?status=backlog&limit=${BACKLOG_LIMIT}${q}`)
-      .then((r) => { taskState.backlog = r.tasks || []; renderBacklog(taskState.backlog); })
+      .then((r) => {
+        taskState.backlog = r.tasks || [];
+        renderBacklog(taskState.backlog);
+        // task 1003828 — the Goal filter draws on this feed too and races it.
+        // Re-offer the options now; populateGoalFilter keeps the selection.
+        populateGoalFilter();
+      })
       .catch(() => { /* backlog stays as it was */ });
   }
 
-  // The last server-facing filter query we actually fetched with. Compared on
-  // every filter change to decide re-fetch vs re-render.
+  // The last server-facing filter queries we actually fetched with — one per
+  // feed, because the two routes answer DIFFERENT questions (see below).
+  // Compared on every filter change to decide re-fetch vs re-render.
   let lastServerFilterQuery = '';
+  let lastBacklogQuery = '';
 
   function serverFilterQuery() {
     const parts = [];
@@ -81,6 +89,24 @@
     return parts.length ? `?${parts.join('&')}` : '';
   }
 
+  // task 1003828 — the BACKLOG's server query, deliberately NOT shared with the
+  // claimable feed's. The routes differ (GET /tasks answers version/kind/
+  // discipline/goal_id; /tasks/claimable answers only version+discipline), and the
+  // backlog read is CAPPED at BACKLOG_LIMIT while the Ready feed is not — so a
+  // client-only narrow here would lie, hiding the artist tasks at row 501.
+  // '__none__' on Goal has no server predicate and is never sent.
+  function backlogFilterQuery() {
+    const f = boardFilterValues();
+    const parts = [];
+    if (f.creator) parts.push(`created_by=${encodeURIComponent(f.creator === '__none__' ? 'none' : f.creator)}`);
+    if (f.stale) parts.push(`stale_days=${encodeURIComponent(f.stale)}`);
+    if (f.version) parts.push(`version=${encodeURIComponent(f.version)}`);
+    if (f.kind) parts.push(`kind=${encodeURIComponent(f.kind)}`);
+    if (f.discipline) parts.push(`discipline=${encodeURIComponent(f.discipline)}`);
+    if (f.goal && f.goal !== '__none__') parts.push(`goal_id=${encodeURIComponent(f.goal)}`);
+    return parts.length ? `?${parts.join('&')}` : '';
+  }
+
   // task 1003278 — the ceiling on the Backlog read. Comfortably above today's
   // ~300 rows so nothing visibly changes now, and low enough that the page can
   // never be asked to hold the whole table as the project grows.
@@ -289,54 +315,76 @@
     return false;
   }
 
+  // task 1003828 — the board's filter lenses, read once from the DOM. ONE reader,
+  // so a control that exists can never be one a tab forgot to consult: before
+  // this, every dropdown was read inside renderClaimable and nowhere else, which
+  // left all six silently inert on the Backlog tab. ('__none__' on Creator
+  // isolates the unattributed — task 1003278.)
+  function boardFilterValues() {
+    const val = (id) => ($(id) ? $(id).value : '');
+    return {
+      search: searchQuery(),
+      version: val('#f-version'),
+      goal: val('#f-goal'),
+      kind: val('#f-kind'),
+      discipline: val('#f-discipline'),
+      newcomer: val('#f-newcomer'),
+      creator: val('#f-creator'),
+      stale: val('#f-stale'),
+    };
+  }
+
+  // Does one task survive the current lenses? Pure over (task, values) so both
+  // feeds narrow alike and a new filter cannot reach one tab alone.
+  function matchesBoardFilters(t, f) {
+    if (!matchesSearch(t, f.search)) return false;
+    if (f.version && t.version_id !== f.version) return false;
+    // task 1755: goal filter. '__none__' isolates tasks with no goal.
+    if (f.goal === '__none__' && t.goal_id != null) return false;
+    if (f.goal && f.goal !== '__none__' && String(t.goal_id) !== f.goal) return false;
+    if (f.kind && t.kind !== f.kind) return false;
+    if (f.discipline && (t.discipline || 'unclassified') !== f.discipline) return false;
+    if (f.newcomer === 'yes' && !t.newcomer_friendly) return false;
+    // Creator + Age were applied by the SERVER, so they are re-checked here only
+    // as a belt on a stale render — cheap, and it keeps the view honest if a poll
+    // lands between a control change and its re-fetch.
+    if (f.creator === '__none__' && t.created_by != null) return false;
+    if (f.creator && f.creator !== '__none__' && String(t.created_by) !== f.creator) return false;
+    if (f.stale && !isStale(taskActivityMs(t), f.stale)) return false;
+    return true;
+  }
+
+  // task 1756: run-mode — a task is "parallel-safe" when its touches[] don't
+  // overlap any OTHER task in the visible set. Set-RELATIVE, which is why it runs
+  // after matchesBoardFilters rather than inside it: it answers "of what I'm
+  // looking at, what can run together." O(n²) over touches — fine at board scale.
+  function applyRunMode(list, fitFilter) {
+    if (fitFilter !== 'parallel' && fitFilter !== 'conflict') return list;
+    return list.filter((t) => {
+      const conflicts = list.some((o) => o !== t && touchesConflict(t.touches, o.touches));
+      return fitFilter === 'parallel' ? !conflicts : conflicts;
+    });
+  }
+
+  // task 1003828 — the bar sits above the four panels now, so it must say which it
+  // speaks for. Ready and Backlog are the QUEUE tabs; In Progress (live claims)
+  // and Completed (shipped history) render other objects, so the bar hides there
+  // rather than offering a control that does nothing — this task's whole defect.
+  const FILTERED_TABS = new Set(['ready', 'backlog']);
+  function syncFilterBarVisibility(tabId) {
+    const bar = $('#work-filters');
+    if (bar) bar.hidden = !FILTERED_TABS.has(String(tabId));
+  }
+
   function renderClaimable() {
     const root = $('#task-list');
     if (!root) return;
-    const vFilter = $('#f-version').value;
-    const gFilter = $('#f-goal') ? $('#f-goal').value : '';
-    const kFilter = $('#f-kind').value;
-    const dFilter = $('#f-discipline').value;
-    const nFilter = $('#f-newcomer') ? $('#f-newcomer').value : '';
-    // task 1003278 — creator + staleness. '__none__' on Creator isolates the
-    // unattributed (created before tasks.created_by existed, or by a system path)
-    // — the goals owner filter's 'system / unattributed' convention.
-    const cFilter = $('#f-creator') ? $('#f-creator').value : '';
-    const staleFilter = $('#f-stale') ? $('#f-stale').value : '';
+    const filters = boardFilterValues();
     const sortBy = $('#f-sort').value;
-    const sQuery = searchQuery();
-
-    let list = taskState.all.filter((t) => {
-      if (!matchesSearch(t, sQuery)) return false;
-      if (vFilter && t.version_id !== vFilter) return false;
-      // task 1755: goal filter. '__none__' isolates tasks with no goal.
-      if (gFilter === '__none__' && t.goal_id != null) return false;
-      if (gFilter && gFilter !== '__none__' && String(t.goal_id) !== gFilter) return false;
-      if (kFilter && t.kind !== kFilter) return false;
-      if (dFilter && (t.discipline || 'unclassified') !== dFilter) return false;
-      if (nFilter === 'yes' && !t.newcomer_friendly) return false;
-      // Creator + Age were applied by the SERVER (serverFilterQuery), so they are
-      // re-checked here only as a belt on a stale render — never as the primary
-      // filter. Re-applying them is cheap and keeps the view honest if a poll
-      // lands between a control change and its re-fetch.
-      if (cFilter === '__none__' && t.created_by != null) return false;
-      if (cFilter && cFilter !== '__none__' && String(t.created_by) !== cFilter) return false;
-      if (staleFilter && !isStale(taskActivityMs(t), staleFilter)) return false;
-      return true;
-    });
 
-    // task 1756: run-mode filter — a task is "parallel-safe" when its touches[]
-    // don't overlap any OTHER task in the currently-visible set; "conflict" is the
-    // complement (would collide, so run them sequentially). Computed over the
-    // already-filtered list so it answers "of what I'm looking at, what can run
-    // together." O(n²) over touches — fine at board scale.
-    const fitFilter = $('#f-fit') ? $('#f-fit').value : '';
-    if (fitFilter === 'parallel' || fitFilter === 'conflict') {
-      const base = list;
-      list = base.filter((t) => {
-        const conflicts = base.some((o) => o !== t && touchesConflict(t.touches, o.touches));
-        return fitFilter === 'parallel' ? !conflicts : conflicts;
-      });
-    }
+    let list = taskState.all.filter((t) => matchesBoardFilters(t, filters));
+
+    list = applyRunMode(list, $('#f-fit') ? $('#f-fit').value : '');
 
     if (sortBy === 'cpm') {
       list = list.slice().sort((a, b) => creditsPerMinute(b) - creditsPerMinute(a));
@@ -508,7 +556,10 @@
     if (!sel) return;
     const cur = sel.value;
     const titles = taskState.goalTitles || {};
-    const ids = [...new Set(taskState.all.map((t) => t.goal_id).filter((x) => x != null).map(String))];
+    // task 1003828 — options come from BOTH feeds: built from the claimable one
+    // alone, a goal whose only work sits at backlog was unofferable.
+    const rows = [...taskState.all, ...(taskState.backlog || [])];
+    const ids = [...new Set(rows.map((t) => t.goal_id).filter((x) => x != null).map(String))];
     ids.sort((a, b) => String(titles[a] || `Goal #${a}`).localeCompare(String(titles[b] || `Goal #${b}`)));
     sel.length = 1; // keep the leading "— all goals —" option
     for (const id of ids) {
@@ -517,7 +568,7 @@
       opt.textContent = titles[id] || `Goal #${id}`;
       sel.appendChild(opt);
     }
-    if (taskState.all.some((t) => t.goal_id == null)) {
+    if (rows.some((t) => t.goal_id == null)) {
       const opt = document.createElement('option');
       opt.value = '__none__';
       opt.textContent = 'No goal';
@@ -1055,17 +1106,44 @@
       root.innerHTML = '<div class="profile__placeholder">Nothing in the backlog right now.</div>';
       return;
     }
-    const q = searchQuery();
-    const list = q ? backlogRows.filter((t) => matchesSearch(t, q)) : backlogRows;
+    // task 1003828 — the SAME lenses the Ready tab uses. This read used to be
+    // search-only, so six controls silently did nothing on the tab holding the
+    // most rows. The server already narrowed this feed; re-applying the predicate
+    // answers the two client-only lenses (search, Goal's '__none__') and keeps the
+    // view honest between a control change and its re-fetch.
+    const filters = boardFilterValues();
+    let list = backlogRows.filter((t) => matchesBoardFilters(t, filters));
+    list = applyRunMode(list, $('#f-fit') ? $('#f-fit').value : '');
     const countEl = $('#backlog-count');
     if (countEl) countEl.textContent = `${list.length} ${list.length === 1 ? 'task' : 'tasks'}`;
+    if (!list.length) {
+      root.innerHTML = '<div class="profile__placeholder">No backlog tasks match these filters. Try widening them.</div>';
+      pagers.backlog.page = 1;
+      return;
+    }
     const shown = paginate(list, pagers.backlog);
     root.innerHTML = shown.map((t) => {
       const ver = t.version_id ? `<span class="task__tag">${escapeHtml(t.version_id)}</span>` : '';
+      // task 1003828 — the row says WHOSE CRAFT and WHICH GOAL. A Ready card has
+      // carried its discipline tag since 1755; a backlog row carried neither, so a
+      // correctly-goaled task (an auto-filed artist review, say) read as
+      // uncategorised in the one place a person goes looking for it. Same
+      // vocabulary as the card, so the two tabs describe a task alike.
+      const discipline = t.discipline || 'unclassified';
+      const disciplineTag = discipline !== 'unclassified'
+        ? `<span class="task__tag">${escapeHtml(discipline)}</span>`
+        : '';
+      // The goal's TITLE, from the map the Goal filter already loads, falling back
+      // to its id before that resolves. A goal-less row says so rather than
+      // rendering a gap — "no goal" is a real, findable state.
+      const goalTitle = t.goal_id != null
+        ? ((taskState.goalTitles || {})[String(t.goal_id)] || `Goal #${t.goal_id}`)
+        : 'No goal';
+      const goalTag = `<span class="history__goal" title="${escapeHtml(`Goal: ${goalTitle}`)}">${escapeHtml(goalTitle)}</span>`;
       return `
         <div class="history__row" data-task-id="${escapeHtml(String(t.id))}" title="Open task #${escapeHtml(String(t.id))}">
           <span class="history__id">#${escapeHtml(String(t.id))}</span>
-          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver} ${rankTagHtml(t.requires_rank)}</span>
+          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver} ${disciplineTag} ${rankTagHtml(t.requires_rank)}<br>${goalTag}</span>
           <span class="history__when">${escapeHtml(t.kind || '')}</span>
         </div>`;
     }).join('');
@@ -1182,6 +1260,10 @@
         taskState.goalTitles[g.id] = g.title;
         taskState.goalCategories[g.id] = g.category || null;
       });
+      // task 1003828 — loadBacklog() fires ABOVE this await, so its first paint
+      // has no titles and every row would read "Goal #1000089" until something
+      // else repainted it. Harmless if the feed has not landed yet.
+      renderBacklog();
     } catch (_) { /* filter labels fall back to 'Goal #id' */ }
 
     // Claimable + active claims in one call. A 403 means the primer gate — show
@@ -1242,7 +1324,10 @@
         { id: 'backlog', label: 'Backlog', panel: 'backlog-scroll' },
         { id: 'completed', label: 'Completed', panel: 'history-scroll' },
       ],
-      onChange: () => { if (selectionTotal()) clearSelection(); },
+      onChange: (id) => {
+        if (selectionTotal()) clearSelection();
+        syncFilterBarVisibility(id);
+      },
     });
 
     // task 2170: filter diet — Search/Sort/Version primary, the rest behind
@@ -1266,6 +1351,16 @@
           ],
         },
         { id: 'f-version', label: 'Version', options: [{ value: '', label: '— any —' }] },
+        // task 1003828 — Discipline is PRIMARY, not overflow. A craft is the axis
+        // this platform organises people by (CLAUDE.md's role packs; a task's work
+        // type IS its discipline), so "show me my craft's work" is a first-class
+        // question, not one to find behind a disclosure. The mixed option form is
+        // kit-supported — pinned by tests/goal_sort_staleness.mjs against this id.
+        {
+          id: 'f-discipline',
+          label: 'Discipline',
+          options: [{ value: '', label: '— any —' }, 'engineer', 'artist', 'ideator', 'ui', 'unclassified'],
+        },
       ],
       overflow: [
         { id: 'f-goal', label: 'Goal', options: [{ value: '', label: '— all goals —' }] },
@@ -1276,11 +1371,6 @@
             'feature', 'bug', 'infra', 'refactor', 'spike', 'learning-capture',
             'cleanup', 'decision', 'blocker-resolution', 'unclassified'],
         },
-        {
-          id: 'f-discipline',
-          label: 'Discipline',
-          options: [{ value: '', label: '— any —' }, 'engineer', 'artist', 'ideator', 'ui', 'unclassified'],
-        },
         {
           id: 'f-newcomer',
           label: 'Newcomer',
@@ -1310,18 +1400,23 @@
         // changed id (hall-kit.js:269), and comparing the query is the direct
         // question anyway — a control that does not appear in it can never cost
         // a round-trip, which is what keeps the other filters instant.
+        //
+        // task 1003828 — decided SEPARATELY per feed now, because the backlog asks
+        // the server more than claimable can answer. Each side re-fetches (ending
+        // in its own render) or re-renders in place; the old early return left the
+        // other tab's client-side lenses unapplied until the next poll.
         const q = serverFilterQuery();
-        if (q !== lastServerFilterQuery) {
-          lastServerFilterQuery = q;
-          refreshLive();
-          loadBacklog();
-          return;
-        }
-        renderClaimable();
-        renderBacklog();
+        const bq = backlogFilterQuery();
+        if (q !== lastServerFilterQuery) { lastServerFilterQuery = q; refreshLive(); } else { renderClaimable(); }
+        if (bq !== lastBacklogQuery) { lastBacklogQuery = bq; loadBacklog(); } else { renderBacklog(); }
       },
     });
 
+    // task 1003828 — makeTabs fires onChange only on a CHANGE and restores a
+    // deep-linked tab before this point, so the opening state is set explicitly:
+    // without it, a reload onto #completed shows a filter bar over ship history.
+    syncFilterBarVisibility(workTabs && workTabs.active ? workTabs.active() : 'ready');
+
     $('#task-list')?.addEventListener('click', (e) => {
       // task 1759: the multi-select checkbox. Toggle the Set + the card's
       // highlight class directly (cheaper than a full renderClaimable) and

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.659",
+  "version": "1.19.661",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.659",
+      "version": "1.19.661",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.659",
+  "version": "1.19.661",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.659'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.661'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_sort_staleness.mjs

@@ -202,7 +202,18 @@ await test('a server-side filter change RE-FETCHES; every other filter stays ins
   // direct question anyway, and means a control absent from that query can never
   // cost a round-trip.
   assert.match(WORK_SRC, /let lastServerFilterQuery = '';/);
-  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{[\s\S]{0,200}refreshLive\(\);\s*\n\s*loadBacklog\(\);/);
+  // task 1003828 split this into ONE DECISION PER FEED. It used to be a single
+  // comparison that re-fetched both and returned early — which was fine while the
+  // two asked the server the same question, and wrong once the backlog started
+  // asking a narrower one (version/kind/discipline/goal_id, which GET /tasks
+  // answers and GET /tasks/claimable does not). The early return also meant a
+  // change to a CLIENT-side lens skipped the other tab's re-render until the next
+  // poll repainted it. Each side now re-fetches or re-renders on its own; the
+  // property under test is unchanged — a server-facing change costs a round-trip
+  // and nothing else does.
+  assert.match(WORK_SRC, /let lastBacklogQuery = '';/);
+  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{ lastServerFilterQuery = q; refreshLive\(\); \} else \{ renderClaimable\(\); \}/);
+  assert.match(WORK_SRC, /if \(bq !== lastBacklogQuery\) \{ lastBacklogQuery = bq; loadBacklog\(\); \} else \{ renderBacklog\(\); \}/);
   const kit = read('modules/hall-ui/public/hall-kit.js');
   assert.match(kit, /if \(onChange\) onChange\(values\(\)\);/,
     'the contract this decision depends on — if it ever hands the changed id instead, revisit');

package/tests/government_catalog.mjs

@@ -178,3 +178,16 @@ test('byKey returns a frozen record or null', () => {
   assert.throws(() => { p.system = false; }, /Cannot assign|read only|frozen/i);
   assert.equal(byKey('nope'), null);
 });
+
+// Freezing the ARRAY only seals its shape. Before task 1003194 the entries inside it
+// stayed mutable and byKey() handed out a frozen COPY, so the catalog had two views
+// that could disagree: mutating PERMISSIONS[i].floor moved what seedForRank() reads —
+// and with it the live POST /government/ranks/:rankKey/reset — while byKey() kept the
+// old value. Identity is the assertion that actually forbids that, not depth.
+test('the catalog is ONE immutable object per permission — array, entries, and byKey identity', () => {
+  assert.equal(Object.isFrozen(PERMISSIONS), true, 'the PERMISSIONS array must be frozen');
+  for (const p of PERMISSIONS) {
+    assert.equal(Object.isFrozen(p), true, `PERMISSIONS entry ${p.key} must be frozen, not just the array`);
+    assert.equal(p, byKey(p.key), `${p.key}: PERMISSIONS[i] and byKey() must be the SAME object, not equal copies`);
+  }
+});

package/tests/government_parity.mjs

@@ -163,6 +163,13 @@ const normRoute = (key) => key.replace(/:[A-Za-z0-9_]+/g, ':p'); // :id vs :crit
 // Leading `METHOD /path` of a guards note. Deliberately conservative: a note that
 // lists several routes or wraps them in prose/braces simply doesn't participate.
 const GUARD_ROUTE_RE = /^(GET|POST|PATCH|PUT|DELETE)\s+(\/[^\s,(]+)/;
+// The conservative intent above is enforced HERE, not by the character class: a
+// path carrying `{a,b}` (a brace set), `[/x]` (an optional segment) or `*` (a
+// wildcard) is a PATTERN standing for several routes, not one concrete route, so
+// it cannot be looked up and does not participate. Without this the regex happily
+// captured `/blockers/:id/{resolve` and seven siblings, which then dangled in B0
+// and drowned the three real typos it exists to catch (task 1003194).
+const ROUTE_PATTERN_RE = /[{[*]/;
 // A route's middleware rank → the LOOSEST floor still consistent with it. Only the
 // two rank-gated classifications constrain a floor; 'any-builder' / 'public' /
 // 'unknown' / 'bfg-principal' carry no rank middleware to compare against.
@@ -190,12 +197,17 @@ function crossReference() {
   const live = liveRoutes();
   const floorPinned = [];
   const atomPinned = [];
+  const dangling = [];
   for (const p of FLOORED) {
     const m = GUARD_ROUTE_RE.exec(p.guards);
     if (!m) continue;
+    if (ROUTE_PATTERN_RE.test(m[2])) continue;
     const routeKey = `${m[1]} ${m[2]}`;
     const r = live.get(normRoute(routeKey));
-    if (!r) continue;
+    // A note that names ONE concrete route which does not exist is a typo, and a
+    // silent `continue` here is how it stayed invisible: the entry simply dropped
+    // out of B1 and B3 while all 27 tests stayed green. B0 asserts this is empty.
+    if (!r) { dangling.push(`${p.key} → ${routeKey}`); continue; }
     if (r.perms) {
       atomPinned.push({ permission: p.key, floor: p.floor, routeKey, perms: r.perms });
       continue;
@@ -204,9 +216,27 @@ function crossReference() {
     if (!minFloor) continue;
     floorPinned.push({ permission: p.key, floor: p.floor, routeKey, routeRank: r.rank, minFloor });
   }
-  return { floorPinned, atomPinned };
+  return { floorPinned, atomPinned, dangling };
 }
 
+// The oracles B1 and B3 can only judge a permission whose guards note RESOLVES to a
+// live route. A note naming a route that does not exist therefore fails open — it is
+// dropped, not reported, and the permission silently leaves both oracles while the
+// suite stays green. That is not hypothetical: `cost.log` said 'POST /costs' against
+// a real 'POST /cost', and both Board Room keys omitted the '/government' prefix, so
+// the two newest requirePermission routes sat outside B3 — the very oracle written
+// for them. This test is the fail-loud half (task 1003194).
+//
+// There is deliberately NO allowlist. A note that genuinely cannot name one concrete
+// route does not reach here at all: it either fails GUARD_ROUTE_RE (prose, a surface
+// name like 'planning-session surface') or is a pattern caught by ROUTE_PATTERN_RE.
+// An allowlist would be a place to park the next typo.
+test('B0: every guards note that names a concrete route names one that EXISTS', () => {
+  const { dangling } = crossReference();
+  assert.deepEqual(dangling, [],
+    `guards notes point at routes that do not exist — fix the note (or the route), never ignore it:\n  ${dangling.join('\n  ')}`);
+});
+
 // ONE-DIRECTIONAL, and deliberately so. A floor STRICTER than the route middleware
 // is legitimate and common: the wall lives in the handler (task.confirm.grade_bypass
 // on an any-builder POST /tasks/:id/confirm; goal.manage.own's owner|manager check;