@bongos/core 1.19.660 → 1.19.662

package/modules/government/catalog.js

@@ -201,7 +201,7 @@ const PERMISSIONS = [
   { key: 'criterion.unsatisfy', system: false, floor: 'metic', guards: 'POST /done-when/:id/unsatisfy (ADR 0157, was archon)' },
   { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
   { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
-  { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
+  { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', verb: 'manage', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
   { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon)' },
   { key: 'discord.channels.manage', system: false, floor: 'metic', guards: 'GET /discord/channels/plan, POST .../reconcile (ADR 0157, was archon)' },
   // Metic by the discord.channels.manage analogue — configuring a project-wide
@@ -213,7 +213,7 @@ const PERMISSIONS = [
   { key: 'project.settings.manage', system: false, floor: 'metic', guards: "PATCH /project-settings/* — the project's own live knobs (the rot timer today) and the work-category set's shape (PATCH /work-categories/:id). Metic, matching goal.create's reasoning that extending the project's vocabulary is a planning act rather than an administrative one — task 1003280, goal 1000072" },
   { key: 'project.curate', system: false, floor: 'metic', guards: 'platform-identity: GET/POST /projects, /projects/invite, PATCH /projects/:id/featured, PATCH /projects/:id/status (the takedown lever — ADR 0252 §5.1), GET /scouting (ADR 0157, was archon)' },
   { key: 'override_request.decide', system: false, floor: 'metic', guards: 'GET /override-requests, POST .../:id/decide (ADR 0157, was archon)' },
-  { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
+  { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', verb: 'release', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
   { key: 'idea.ratify', system: false, floor: 'metic', guards: 'POST /inbox/:id/ratify (ADR 0157, was archon)' },
   // ── the Board Room (ADR 0175, goal 1000069) ──────────────────────────────────
   // Declared BEFORE their routes exist (R07/R08 add them), and deliberately so:
@@ -236,7 +236,7 @@ const PERMISSIONS = [
   { key: 'goal.reorder', system: false, floor: 'metic', guards: 'POST /goals/reorder (ADR 0157, was archon)' },
   { key: 'builder.roster.read', system: false, floor: 'metic', guards: 'GET /builders/roster, /grades/by-builder, /builders/:id/active-claims (ADR 0157, was archon)' },
   { key: 'session.search', system: false, floor: 'metic', guards: 'GET /sessions/search (ADR 0157, was archon)' },
-  { key: 'memory.read.any', system: false, floor: 'metic', scope: 'any', resource: 'memory', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read (ADR 0157, was archon)' },
+  { key: 'memory.read.any', system: false, floor: 'metic', scope: 'any', resource: 'memory', verb: 'read', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read (ADR 0157, was archon)' },
   { key: 'audit_log.read', system: false, floor: 'metic', guards: 'GET /audit-log (ADR 0157, was archon)' },
   // ADR 0157 §4. Split from `gate_approval.decide` (system, archon) so the Gate PAGE
   // can open to Metic while APPROVING a held PR stays Archon. Without the split, a
@@ -265,20 +265,32 @@ const PERMISSIONS = [
   // deliberately NOT lowered to xenos here (the board.vote.cast option): a floor
   // feeds RANK_SEED and the live reset route, so widening it is an authority change
   // that wants its own decision, not a note in a hardening batch.
-  { key: 'goal.manage.own', system: false, floor: 'metic', scope: 'own', resource: 'goal', guards: 'PATCH /goals/:id/members/:b, POST /goals/:id/transfer — requireBuilder + in-handler owner|manager|Archon (ADR 0106); floor is not the whole gate, and sub-metic owners/managers hold it today' },
+  { key: 'goal.manage.own', system: false, floor: 'metic', scope: 'own', resource: 'goal', verb: 'manage', counterpart: [], guards: 'PATCH /goals/:id/members/:b, POST /goals/:id/transfer — requireBuilder + in-handler owner|manager|Archon (ADR 0106); floor is not the whole gate, and sub-metic owners/managers hold it today' },
   { key: 'task.claim.newcomer', system: false, floor: 'xenos', guards: 'claim a newcomer_friendly task (xenosClaimAllowed; xenos = one active claim)' },
   { key: 'task.ship', system: false, floor: 'xenos', guards: '/builder-ship own claim' },
-  { key: 'task.act.own', system: false, floor: 'xenos', scope: 'own', resource: 'claim', guards: 'act on OWN active claim (release, cost, notes) — ownership-scoped' },
-  { key: 'box.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'box', guards: 'own dev-box lifecycle — ownership-scoped' },
-  { key: 'memory.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'memory', guards: 'own builder memory — ownership-scoped' },
+  // counterpart is EMPTY, and that is the fix of task 1003195, not an omission.
+  // `act` is a BUNDLE — release + cost + notes — and the family's only cross-owner
+  // key, `claim.release.any`, carries just the release third. It is therefore not a
+  // counterpart: admitting on it would let a release-only grant post costs and notes
+  // against another builder's claim. A future `claim.manage.any` (verb `manage`)
+  // would dominate `act` and belongs here; `claim.release.any` never does.
+  { key: 'task.act.own', system: false, floor: 'xenos', scope: 'own', resource: 'claim', verb: 'act', counterpart: [], guards: 'act on OWN active claim (release, cost, notes) — ownership-scoped' },
+  // The one family whose counterpart is REAL: `box.fleet.manage` is the same `manage`
+  // verb over every owner's box, so it genuinely subsumes managing your own.
+  { key: 'box.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'box', verb: 'manage', counterpart: ['box.fleet.manage'], guards: 'own dev-box lifecycle — ownership-scoped' },
+  // Empty for the same reason as task.act.own: `memory.read.any` READS every
+  // builder's memory, which is not the authority to MANAGE one. This is the pair the
+  // task-1002671 verification probed (finding 12) — a read grant was admitting a
+  // write. A future `memory.manage.any` would belong here.
+  { key: 'memory.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'memory', verb: 'manage', counterpart: [], guards: 'own builder memory — ownership-scoped' },
   // No cross-owner counterpart, deliberately: nobody manages another builder's
   // credential, Archon included. A `credential.manage.any` would be a key no route
   // consumes — the catalog's first rule forbids minting one for symmetry.
-  { key: 'credential.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'credential', guards: 'own API key / credential — ownership-scoped' },
+  { key: 'credential.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'credential', verb: 'manage', counterpart: [], guards: 'own API key / credential — ownership-scoped' },
   // Own-scoped WITHOUT a `.own` suffix — the `me.` namespace is the ownership
   // marker here. Exactly why scope is declared data: the suffix rule only runs the
   // safe direction ('.own' ⇒ scope 'own'), never the converse.
-  { key: 'me.wandering.set', system: false, floor: 'xenos', scope: 'own', resource: 'builder_prefs', guards: 'PATCH /me/wandering (clamped by maxLevelForRank) — ownership-scoped' },
+  { key: 'me.wandering.set', system: false, floor: 'xenos', scope: 'own', resource: 'builder_prefs', verb: 'set', counterpart: [], guards: 'PATCH /me/wandering (clamped by maxLevelForRank) — ownership-scoped' },
   { key: 'cost.log', system: false, floor: 'xenos', guards: 'POST /cost' },
   { key: 'learning.create', system: false, floor: 'xenos', guards: 'POST /learnings' },
   { key: 'blocker.file', system: false, floor: 'xenos', guards: 'POST /blockers' },
@@ -296,6 +308,31 @@ const PERMISSIONS = [
 const PRINCIPAL_KEY_PREFIX = 'principal.';
 const OWN_KEY_SUFFIX = '.own';
 const OWNERSHIP_SCOPES = Object.freeze(['own', 'any']);
+
+// ── the VERB axis of an ownership-scoped key (task 1003195) ────────────────────
+// Scope answers "whose row"; VERB answers "how much of it". They are independent,
+// and conflating them is exactly the bug this vocabulary closes: `crossOwnerKeysFor`
+// used to hand back the resource family's whole `any` list VERB-BLIND, so holding
+// only `memory.read.any` satisfied a `memory.manage.own` decision on someone else's
+// row — a read grant admitting a write.
+//
+// The verb is DECLARED, never parsed out of the key string. A positional parse is
+// wrong on the live population (`box.fleet.manage` is resource `box`, verb `manage`
+// — the middle segment is not the verb), and the same reason `scope` is data:
+// "the namespace can never outrun the data".
+const OWNERSHIP_VERBS = Object.freeze(['read', 'set', 'release', 'act', 'manage']);
+// Which verbs a verb SUBSUMES, beyond itself (every verb dominates itself). Kept
+// deliberately small and explicit: `manage` is the full-control verb, so it covers
+// every narrower slice; nothing else subsumes anything. A future pair that needs a
+// wider relation adds one entry here and states why — it does not get inferred.
+const VERB_DOMINANCE = Object.freeze({
+  manage: Object.freeze(['read', 'set', 'release', 'act']),
+});
+// Does `wide` carry at least everything `narrow` carries? Unknown verbs fail closed.
+function verbDominates(wide, narrow) {
+  if (!OWNERSHIP_VERBS.includes(wide) || !OWNERSHIP_VERBS.includes(narrow)) return false;
+  return wide === narrow || (VERB_DOMINANCE[wide] || []).includes(narrow);
+}
 const _byKey = new Map();
 const _byPrincipal = new Map();
 const _byResource = new Map();
@@ -376,6 +413,36 @@ for (let i = 0; i < PERMISSIONS.length; i++) {
   if (scope !== null && p.floor === null) {
     throw new Error(`government catalog: ${p.key} is ownership-scoped but has no rank floor — the ownership axis narrows a RANK permission, never an identity one`);
   }
+  // ── the VERB axis (task 1003195) ──────────────────────────────────────────
+  // Same partition posture as scope ⟺ resource: an ownership-scoped key declares
+  // HOW MUCH of the row it reaches, and an unscoped key has no owner axis to
+  // qualify. Both directions throw, so neither field can be added without the other.
+  const verb = p.verb ?? null;
+  if ((scope === null) !== (verb === null)) {
+    throw new Error(`government catalog: ${p.key} — scope and verb must come together (an ownership scope always names the verb it reaches the row with)`);
+  }
+  if (verb !== null && !OWNERSHIP_VERBS.includes(verb)) {
+    throw new Error(`government catalog: ${p.key} has unknown verb "${verb}" (expected one of ${OWNERSHIP_VERBS.join(', ')})`);
+  }
+  // ── the COUNTERPART declaration (task 1003195) ────────────────────────────
+  // REQUIRED on every own-scoped key and forbidden everywhere else. Required,
+  // because the bug being fixed was a silent DERIVATION: crossOwnerKeysFor fell
+  // back to the resource family's whole `any` list, so a new own key inherited
+  // every cross-owner key in its family — verbs unchecked — merely by existing.
+  // Making the escalation path an explicit per-key statement means a new own key
+  // fails LOUD at load until its author decides what may escalate past it, and
+  // `counterpart: []` is that decision written down, not its absence.
+  const hasCounterpart = p.counterpart !== undefined;
+  if (scope === 'own' && !hasCounterpart) {
+    throw new Error(`government catalog: ${p.key} is own-scoped and must declare counterpart: [] explicitly — the cross-owner escalation path is never derived from the resource family (task 1003195)`);
+  }
+  if (scope !== 'own' && hasCounterpart) {
+    throw new Error(`government catalog: ${p.key} declares a counterpart but is not own-scoped — only an ownership-scoped key has an escalation path`);
+  }
+  if (hasCounterpart && (!Array.isArray(p.counterpart) || p.counterpart.some((k) => typeof k !== 'string' || !k))) {
+    throw new Error(`government catalog: ${p.key} — counterpart must be an array of permission keys`);
+  }
+  const counterpart = hasCounterpart ? Object.freeze([...p.counterpart]) : null;
   // ONE object per permission, shared by every reader. The frozen copy goes back
   // into PERMISSIONS[i] as well as the lookup maps, because the alternative —
   // freezing a COPY and leaving the original mutable in the array — splits the
@@ -383,7 +450,7 @@ for (let i = 0; i < PERMISSIONS.length; i++) {
   // seals the array's SHAPE but not its entries, so a runtime mutation of
   // PERMISSIONS[i] would change the floor seedForRank() reads (and with it the
   // live POST /government/ranks/:rankKey/reset) while byKey() kept the old value.
-  const frozen = Object.freeze({ ...p, principal, scope, resource, substrate });
+  const frozen = Object.freeze({ ...p, principal, scope, resource, verb, counterpart, substrate });
   PERMISSIONS[i] = frozen;
   _byKey.set(p.key, frozen);
   if (principal !== null) _byPrincipal.set(principal, frozen);
@@ -416,6 +483,32 @@ for (const [resource, fam] of _byResource) {
   }
 }
 
+// ── the counterpart invariant: a declared escalation path must DOMINATE ────────
+// The floor check above orders the two keys by PRICE; this one orders them by
+// POWER, and only the pair together is the wall. A counterpart is an admit: the
+// resolver returns true on it WITHOUT consulting the owner at all, so whatever it
+// names must carry at least everything the own key carries. Naming a narrower verb
+// converts the own key into that verb's cross-owner form for free — which is
+// precisely how `memory.read.any` came to satisfy `memory.manage.own`.
+for (const p of PERMISSIONS) {
+  if (p.scope !== 'own') continue;
+  for (const key of p.counterpart) {
+    const c = _byKey.get(key);
+    if (!c) {
+      throw new Error(`government catalog: ${p.key} names counterpart "${key}", which is not a permission in this catalog`);
+    }
+    if (c.scope !== 'any') {
+      throw new Error(`government catalog: ${p.key} names counterpart ${key}, which is not cross-owner (scope "${c.scope ?? 'none'}") — only an 'any' key reaches another owner's row`);
+    }
+    if (c.resource !== p.resource) {
+      throw new Error(`government catalog: ${p.key} (resource ${p.resource}) names counterpart ${key} from resource ${c.resource} — an escalation path never crosses resource families`);
+    }
+    if (!verbDominates(c.verb, p.verb)) {
+      throw new Error(`government catalog: ${p.key} names counterpart ${key}, but verb "${c.verb}" does not dominate "${p.verb}" — a cross-owner key may only satisfy an own key it carries at least as much authority as (task 1003195)`);
+    }
+  }
+}
+
 // resource → { own: [keys], any: [keys] }. The pairing data a gate, a test, or the
 // Archon tab reads to relate "act on own X" to "act on any X"; DERIVED from the
 // rows above so it cannot drift from them.
@@ -547,6 +640,12 @@ function resourceOf(key) {
   const p = _byKey.get(key);
   return p ? p.resource : null;
 }
+// How much of the row this key reaches. Null for an unscoped or unknown key — the
+// verb only means anything alongside an ownership scope.
+function verbOf(key) {
+  const p = _byKey.get(key);
+  return p ? p.verb : null;
+}
 // Does holding this key require an ownership predicate against the concrete row?
 // This is the question a gate must ask BEFORE treating a held permission as an
 // admit — an ownership-scoped key is never sufficient on its own.
@@ -563,14 +662,21 @@ function ownershipScopedKeys() {
 function crossOwnerKeys() {
   return PERMISSIONS.filter((p) => p.scope === 'any').map((p) => p.key);
 }
-// The cross-owner keys over the SAME resource as `key` — what a route offers as
-// the escalation path ("your own claim, or claim.release.any"). Empty when the
-// resource has no cross-owner form by design.
+// The DECLARED escalation path for `key` — what a route offers as the alternative
+// to owning the row ("your own box, or box.fleet.manage"). Empty when nothing may
+// escalate past it, which is the common case.
+//
+// Read straight off the key's own `counterpart`, NOT derived from its resource
+// family (task 1003195). The family form was verb-blind: it handed back every `any`
+// key over the resource, so `memory.read.any` — a READ grant — satisfied a
+// `memory.manage.own` WRITE decision on another builder's row. Every entry returned
+// here has been checked at load to be cross-owner, same-resource, and carrying a
+// verb that dominates this key's, so the resolver can admit on one without
+// consulting the owner. An unknown or non-own key has no path at all.
 const NO_KEYS = Object.freeze([]);
 function crossOwnerKeysFor(key) {
-  const resource = resourceOf(key);
-  const fam = resource === null ? null : RESOURCE_FAMILIES[resource];
-  return fam ? fam.any : NO_KEYS;
+  const p = _byKey.get(key);
+  return p && p.counterpart ? p.counterpart : NO_KEYS;
 }
 
 // The compat seed, DERIVED from floors (cumulative supersets). A rank holds
@@ -615,4 +721,8 @@ module.exports = {
   ownershipScopedKeys,
   crossOwnerKeys,
   crossOwnerKeysFor,
+  OWNERSHIP_VERBS,
+  VERB_DOMINANCE,
+  verbDominates,
+  verbOf,
 };

package/modules/hall-ui/public/work.css

@@ -197,6 +197,12 @@
   font-variant-numeric: tabular-nums; min-width: 3.2em;
 }
 .history__title { flex: 1 1 auto; color: var(--ink); min-width: 0; }
+/* task 1003828 — the goal a backlog row belongs to, on its own line under the
+   title. The SUB-LINE voice (the .scroll__lede tone), not a tag: a tag would read
+   as one more equal chip beside version/discipline/rank, and where a task LIVES
+   is the parent fact those chips sit inside. Wraps rather than truncating —
+   a goal title a person cannot finish reading is the state this row is fixing. */
+.history__goal { display: inline-block; margin-top: 3px; color: var(--ink-soft); font-size: 12.5px; }
 .history__when { color: var(--ink-soft); font-size: 12.5px; white-space: nowrap; font-variant-numeric: tabular-nums; }
 
 @media (max-width: 640px) {

package/modules/hall-ui/public/work.html

@@ -52,6 +52,24 @@
              Deep links: /work#in-progress etc. -->
         <nav id="work-tabs" aria-label="Task sections"></nav>
 
+        <!-- task 2170: the filter bar is built by OTBKit.makeFilterBar —
+             Search / Sort / Version / Discipline primary (task 1003828 promoted
+             Discipline out of the overflow: a craft is the axis this platform
+             organises work by), the rest behind a "Filters" disclosure; state
+             rides the URL query. Control ids are unchanged (f-search, f-sort,
+             f-version, f-goal, f-kind, f-discipline, f-newcomer, f-fit) so
+             work.js reads stay stable.
+
+             task 1003828 moved it OUT of #claim-scroll and above the panels. It
+             lived inside the Ready section, which makeTabs hides — so on the
+             Backlog tab the filters were not merely inert, they were not on the
+             screen at all. It drives the two QUEUE tabs (Ready, Backlog) through
+             the one matchesBoardFilters predicate, and work.js hides it on In
+             Progress and Completed, which render different objects (live claims,
+             shipped history) that these lenses do not describe. A filter bar
+             above a list it cannot narrow is the bug this task is fixing. -->
+        <div id="work-filters"></div>
+
         <!-- READY — the claimable queue: the page's primary object, above the
              fold as the default tab. -->
         <!-- task 1003304: BARE, and that is the whole re-skin. In v3 a claimable
@@ -64,12 +82,6 @@
           <h2 id="claim-h" class="scroll__h">Ready — tasks to do<span class="count-pill" id="ready-count" hidden></span></h2>
           <p class="scroll__lede">Click <span class="kbd">Claim</span> to take a task right here — no terminal needed. Then click <span class="kbd">📋</span> to copy the task prompt and paste it into a fresh Claude Code session to begin.</p>
 
-          <!-- task 2170: the filter bar is built by OTBKit.makeFilterBar —
-               Search / Sort / Version primary, the rest behind a "Filters"
-               disclosure; state rides the URL query. Control ids are unchanged
-               (f-search, f-sort, f-version, f-goal, f-kind, f-discipline,
-               f-newcomer, f-fit) so work.js reads stay stable. -->
-          <div id="work-filters"></div>
           <p class="claim-count-line" id="claim-count" aria-live="polite"></p>
 
           <div class="task-list" id="task-list">

package/modules/hall-ui/public/work.js

@@ -62,15 +62,23 @@
   // forever. Its own function because Creator/Age re-fetch it, same as the
   // claimable feed. Best-effort: on failure the section stays as it was.
   function loadBacklog() {
-    const q = serverFilterQuery().replace(/^\?/, '&');
+    const q = backlogFilterQuery().replace(/^\?/, '&');
     return getJSON(`${API}/tasks?status=backlog&limit=${BACKLOG_LIMIT}${q}`)
-      .then((r) => { taskState.backlog = r.tasks || []; renderBacklog(taskState.backlog); })
+      .then((r) => {
+        taskState.backlog = r.tasks || [];
+        renderBacklog(taskState.backlog);
+        // task 1003828 — the Goal filter draws on this feed too and races it.
+        // Re-offer the options now; populateGoalFilter keeps the selection.
+        populateGoalFilter();
+      })
       .catch(() => { /* backlog stays as it was */ });
   }
 
-  // The last server-facing filter query we actually fetched with. Compared on
-  // every filter change to decide re-fetch vs re-render.
+  // The last server-facing filter queries we actually fetched with — one per
+  // feed, because the two routes answer DIFFERENT questions (see below).
+  // Compared on every filter change to decide re-fetch vs re-render.
   let lastServerFilterQuery = '';
+  let lastBacklogQuery = '';
 
   function serverFilterQuery() {
     const parts = [];
@@ -81,6 +89,24 @@
     return parts.length ? `?${parts.join('&')}` : '';
   }
 
+  // task 1003828 — the BACKLOG's server query, deliberately NOT shared with the
+  // claimable feed's. The routes differ (GET /tasks answers version/kind/
+  // discipline/goal_id; /tasks/claimable answers only version+discipline), and the
+  // backlog read is CAPPED at BACKLOG_LIMIT while the Ready feed is not — so a
+  // client-only narrow here would lie, hiding the artist tasks at row 501.
+  // '__none__' on Goal has no server predicate and is never sent.
+  function backlogFilterQuery() {
+    const f = boardFilterValues();
+    const parts = [];
+    if (f.creator) parts.push(`created_by=${encodeURIComponent(f.creator === '__none__' ? 'none' : f.creator)}`);
+    if (f.stale) parts.push(`stale_days=${encodeURIComponent(f.stale)}`);
+    if (f.version) parts.push(`version=${encodeURIComponent(f.version)}`);
+    if (f.kind) parts.push(`kind=${encodeURIComponent(f.kind)}`);
+    if (f.discipline) parts.push(`discipline=${encodeURIComponent(f.discipline)}`);
+    if (f.goal && f.goal !== '__none__') parts.push(`goal_id=${encodeURIComponent(f.goal)}`);
+    return parts.length ? `?${parts.join('&')}` : '';
+  }
+
   // task 1003278 — the ceiling on the Backlog read. Comfortably above today's
   // ~300 rows so nothing visibly changes now, and low enough that the page can
   // never be asked to hold the whole table as the project grows.
@@ -289,54 +315,76 @@
     return false;
   }
 
+  // task 1003828 — the board's filter lenses, read once from the DOM. ONE reader,
+  // so a control that exists can never be one a tab forgot to consult: before
+  // this, every dropdown was read inside renderClaimable and nowhere else, which
+  // left all six silently inert on the Backlog tab. ('__none__' on Creator
+  // isolates the unattributed — task 1003278.)
+  function boardFilterValues() {
+    const val = (id) => ($(id) ? $(id).value : '');
+    return {
+      search: searchQuery(),
+      version: val('#f-version'),
+      goal: val('#f-goal'),
+      kind: val('#f-kind'),
+      discipline: val('#f-discipline'),
+      newcomer: val('#f-newcomer'),
+      creator: val('#f-creator'),
+      stale: val('#f-stale'),
+    };
+  }
+
+  // Does one task survive the current lenses? Pure over (task, values) so both
+  // feeds narrow alike and a new filter cannot reach one tab alone.
+  function matchesBoardFilters(t, f) {
+    if (!matchesSearch(t, f.search)) return false;
+    if (f.version && t.version_id !== f.version) return false;
+    // task 1755: goal filter. '__none__' isolates tasks with no goal.
+    if (f.goal === '__none__' && t.goal_id != null) return false;
+    if (f.goal && f.goal !== '__none__' && String(t.goal_id) !== f.goal) return false;
+    if (f.kind && t.kind !== f.kind) return false;
+    if (f.discipline && (t.discipline || 'unclassified') !== f.discipline) return false;
+    if (f.newcomer === 'yes' && !t.newcomer_friendly) return false;
+    // Creator + Age were applied by the SERVER, so they are re-checked here only
+    // as a belt on a stale render — cheap, and it keeps the view honest if a poll
+    // lands between a control change and its re-fetch.
+    if (f.creator === '__none__' && t.created_by != null) return false;
+    if (f.creator && f.creator !== '__none__' && String(t.created_by) !== f.creator) return false;
+    if (f.stale && !isStale(taskActivityMs(t), f.stale)) return false;
+    return true;
+  }
+
+  // task 1756: run-mode — a task is "parallel-safe" when its touches[] don't
+  // overlap any OTHER task in the visible set. Set-RELATIVE, which is why it runs
+  // after matchesBoardFilters rather than inside it: it answers "of what I'm
+  // looking at, what can run together." O(n²) over touches — fine at board scale.
+  function applyRunMode(list, fitFilter) {
+    if (fitFilter !== 'parallel' && fitFilter !== 'conflict') return list;
+    return list.filter((t) => {
+      const conflicts = list.some((o) => o !== t && touchesConflict(t.touches, o.touches));
+      return fitFilter === 'parallel' ? !conflicts : conflicts;
+    });
+  }
+
+  // task 1003828 — the bar sits above the four panels now, so it must say which it
+  // speaks for. Ready and Backlog are the QUEUE tabs; In Progress (live claims)
+  // and Completed (shipped history) render other objects, so the bar hides there
+  // rather than offering a control that does nothing — this task's whole defect.
+  const FILTERED_TABS = new Set(['ready', 'backlog']);
+  function syncFilterBarVisibility(tabId) {
+    const bar = $('#work-filters');
+    if (bar) bar.hidden = !FILTERED_TABS.has(String(tabId));
+  }
+
   function renderClaimable() {
     const root = $('#task-list');
     if (!root) return;
-    const vFilter = $('#f-version').value;
-    const gFilter = $('#f-goal') ? $('#f-goal').value : '';
-    const kFilter = $('#f-kind').value;
-    const dFilter = $('#f-discipline').value;
-    const nFilter = $('#f-newcomer') ? $('#f-newcomer').value : '';
-    // task 1003278 — creator + staleness. '__none__' on Creator isolates the
-    // unattributed (created before tasks.created_by existed, or by a system path)
-    // — the goals owner filter's 'system / unattributed' convention.
-    const cFilter = $('#f-creator') ? $('#f-creator').value : '';
-    const staleFilter = $('#f-stale') ? $('#f-stale').value : '';
+    const filters = boardFilterValues();
     const sortBy = $('#f-sort').value;
-    const sQuery = searchQuery();
-
-    let list = taskState.all.filter((t) => {
-      if (!matchesSearch(t, sQuery)) return false;
-      if (vFilter && t.version_id !== vFilter) return false;
-      // task 1755: goal filter. '__none__' isolates tasks with no goal.
-      if (gFilter === '__none__' && t.goal_id != null) return false;
-      if (gFilter && gFilter !== '__none__' && String(t.goal_id) !== gFilter) return false;
-      if (kFilter && t.kind !== kFilter) return false;
-      if (dFilter && (t.discipline || 'unclassified') !== dFilter) return false;
-      if (nFilter === 'yes' && !t.newcomer_friendly) return false;
-      // Creator + Age were applied by the SERVER (serverFilterQuery), so they are
-      // re-checked here only as a belt on a stale render — never as the primary
-      // filter. Re-applying them is cheap and keeps the view honest if a poll
-      // lands between a control change and its re-fetch.
-      if (cFilter === '__none__' && t.created_by != null) return false;
-      if (cFilter && cFilter !== '__none__' && String(t.created_by) !== cFilter) return false;
-      if (staleFilter && !isStale(taskActivityMs(t), staleFilter)) return false;
-      return true;
-    });
 
-    // task 1756: run-mode filter — a task is "parallel-safe" when its touches[]
-    // don't overlap any OTHER task in the currently-visible set; "conflict" is the
-    // complement (would collide, so run them sequentially). Computed over the
-    // already-filtered list so it answers "of what I'm looking at, what can run
-    // together." O(n²) over touches — fine at board scale.
-    const fitFilter = $('#f-fit') ? $('#f-fit').value : '';
-    if (fitFilter === 'parallel' || fitFilter === 'conflict') {
-      const base = list;
-      list = base.filter((t) => {
-        const conflicts = base.some((o) => o !== t && touchesConflict(t.touches, o.touches));
-        return fitFilter === 'parallel' ? !conflicts : conflicts;
-      });
-    }
+    let list = taskState.all.filter((t) => matchesBoardFilters(t, filters));
+
+    list = applyRunMode(list, $('#f-fit') ? $('#f-fit').value : '');
 
     if (sortBy === 'cpm') {
       list = list.slice().sort((a, b) => creditsPerMinute(b) - creditsPerMinute(a));
@@ -508,7 +556,10 @@
     if (!sel) return;
     const cur = sel.value;
     const titles = taskState.goalTitles || {};
-    const ids = [...new Set(taskState.all.map((t) => t.goal_id).filter((x) => x != null).map(String))];
+    // task 1003828 — options come from BOTH feeds: built from the claimable one
+    // alone, a goal whose only work sits at backlog was unofferable.
+    const rows = [...taskState.all, ...(taskState.backlog || [])];
+    const ids = [...new Set(rows.map((t) => t.goal_id).filter((x) => x != null).map(String))];
     ids.sort((a, b) => String(titles[a] || `Goal #${a}`).localeCompare(String(titles[b] || `Goal #${b}`)));
     sel.length = 1; // keep the leading "— all goals —" option
     for (const id of ids) {
@@ -517,7 +568,7 @@
       opt.textContent = titles[id] || `Goal #${id}`;
       sel.appendChild(opt);
     }
-    if (taskState.all.some((t) => t.goal_id == null)) {
+    if (rows.some((t) => t.goal_id == null)) {
       const opt = document.createElement('option');
       opt.value = '__none__';
       opt.textContent = 'No goal';
@@ -1055,17 +1106,44 @@
       root.innerHTML = '<div class="profile__placeholder">Nothing in the backlog right now.</div>';
       return;
     }
-    const q = searchQuery();
-    const list = q ? backlogRows.filter((t) => matchesSearch(t, q)) : backlogRows;
+    // task 1003828 — the SAME lenses the Ready tab uses. This read used to be
+    // search-only, so six controls silently did nothing on the tab holding the
+    // most rows. The server already narrowed this feed; re-applying the predicate
+    // answers the two client-only lenses (search, Goal's '__none__') and keeps the
+    // view honest between a control change and its re-fetch.
+    const filters = boardFilterValues();
+    let list = backlogRows.filter((t) => matchesBoardFilters(t, filters));
+    list = applyRunMode(list, $('#f-fit') ? $('#f-fit').value : '');
     const countEl = $('#backlog-count');
     if (countEl) countEl.textContent = `${list.length} ${list.length === 1 ? 'task' : 'tasks'}`;
+    if (!list.length) {
+      root.innerHTML = '<div class="profile__placeholder">No backlog tasks match these filters. Try widening them.</div>';
+      pagers.backlog.page = 1;
+      return;
+    }
     const shown = paginate(list, pagers.backlog);
     root.innerHTML = shown.map((t) => {
       const ver = t.version_id ? `<span class="task__tag">${escapeHtml(t.version_id)}</span>` : '';
+      // task 1003828 — the row says WHOSE CRAFT and WHICH GOAL. A Ready card has
+      // carried its discipline tag since 1755; a backlog row carried neither, so a
+      // correctly-goaled task (an auto-filed artist review, say) read as
+      // uncategorised in the one place a person goes looking for it. Same
+      // vocabulary as the card, so the two tabs describe a task alike.
+      const discipline = t.discipline || 'unclassified';
+      const disciplineTag = discipline !== 'unclassified'
+        ? `<span class="task__tag">${escapeHtml(discipline)}</span>`
+        : '';
+      // The goal's TITLE, from the map the Goal filter already loads, falling back
+      // to its id before that resolves. A goal-less row says so rather than
+      // rendering a gap — "no goal" is a real, findable state.
+      const goalTitle = t.goal_id != null
+        ? ((taskState.goalTitles || {})[String(t.goal_id)] || `Goal #${t.goal_id}`)
+        : 'No goal';
+      const goalTag = `<span class="history__goal" title="${escapeHtml(`Goal: ${goalTitle}`)}">${escapeHtml(goalTitle)}</span>`;
       return `
         <div class="history__row" data-task-id="${escapeHtml(String(t.id))}" title="Open task #${escapeHtml(String(t.id))}">
           <span class="history__id">#${escapeHtml(String(t.id))}</span>
-          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver} ${rankTagHtml(t.requires_rank)}</span>
+          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver} ${disciplineTag} ${rankTagHtml(t.requires_rank)}<br>${goalTag}</span>
           <span class="history__when">${escapeHtml(t.kind || '')}</span>
         </div>`;
     }).join('');
@@ -1182,6 +1260,10 @@
         taskState.goalTitles[g.id] = g.title;
         taskState.goalCategories[g.id] = g.category || null;
       });
+      // task 1003828 — loadBacklog() fires ABOVE this await, so its first paint
+      // has no titles and every row would read "Goal #1000089" until something
+      // else repainted it. Harmless if the feed has not landed yet.
+      renderBacklog();
     } catch (_) { /* filter labels fall back to 'Goal #id' */ }
 
     // Claimable + active claims in one call. A 403 means the primer gate — show
@@ -1242,7 +1324,10 @@
         { id: 'backlog', label: 'Backlog', panel: 'backlog-scroll' },
         { id: 'completed', label: 'Completed', panel: 'history-scroll' },
       ],
-      onChange: () => { if (selectionTotal()) clearSelection(); },
+      onChange: (id) => {
+        if (selectionTotal()) clearSelection();
+        syncFilterBarVisibility(id);
+      },
     });
 
     // task 2170: filter diet — Search/Sort/Version primary, the rest behind
@@ -1266,6 +1351,16 @@
           ],
         },
         { id: 'f-version', label: 'Version', options: [{ value: '', label: '— any —' }] },
+        // task 1003828 — Discipline is PRIMARY, not overflow. A craft is the axis
+        // this platform organises people by (CLAUDE.md's role packs; a task's work
+        // type IS its discipline), so "show me my craft's work" is a first-class
+        // question, not one to find behind a disclosure. The mixed option form is
+        // kit-supported — pinned by tests/goal_sort_staleness.mjs against this id.
+        {
+          id: 'f-discipline',
+          label: 'Discipline',
+          options: [{ value: '', label: '— any —' }, 'engineer', 'artist', 'ideator', 'ui', 'unclassified'],
+        },
       ],
       overflow: [
         { id: 'f-goal', label: 'Goal', options: [{ value: '', label: '— all goals —' }] },
@@ -1276,11 +1371,6 @@
             'feature', 'bug', 'infra', 'refactor', 'spike', 'learning-capture',
             'cleanup', 'decision', 'blocker-resolution', 'unclassified'],
         },
-        {
-          id: 'f-discipline',
-          label: 'Discipline',
-          options: [{ value: '', label: '— any —' }, 'engineer', 'artist', 'ideator', 'ui', 'unclassified'],
-        },
         {
           id: 'f-newcomer',
           label: 'Newcomer',
@@ -1310,18 +1400,23 @@
         // changed id (hall-kit.js:269), and comparing the query is the direct
         // question anyway — a control that does not appear in it can never cost
         // a round-trip, which is what keeps the other filters instant.
+        //
+        // task 1003828 — decided SEPARATELY per feed now, because the backlog asks
+        // the server more than claimable can answer. Each side re-fetches (ending
+        // in its own render) or re-renders in place; the old early return left the
+        // other tab's client-side lenses unapplied until the next poll.
         const q = serverFilterQuery();
-        if (q !== lastServerFilterQuery) {
-          lastServerFilterQuery = q;
-          refreshLive();
-          loadBacklog();
-          return;
-        }
-        renderClaimable();
-        renderBacklog();
+        const bq = backlogFilterQuery();
+        if (q !== lastServerFilterQuery) { lastServerFilterQuery = q; refreshLive(); } else { renderClaimable(); }
+        if (bq !== lastBacklogQuery) { lastBacklogQuery = bq; loadBacklog(); } else { renderBacklog(); }
       },
     });
 
+    // task 1003828 — makeTabs fires onChange only on a CHANGE and restores a
+    // deep-linked tab before this point, so the opening state is set explicitly:
+    // without it, a reload onto #completed shows a filter bar over ship history.
+    syncFilterBarVisibility(workTabs && workTabs.active ? workTabs.active() : 'ready');
+
     $('#task-list')?.addEventListener('click', (e) => {
       // task 1759: the multi-select checkbox. Toggle the Set + the card's
       // highlight class directly (cheaper than a full renderClaimable) and

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.660",
+  "version": "1.19.662",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.660",
+      "version": "1.19.662",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.660",
+  "version": "1.19.662",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",