@bongos/core 1.19.695 → 1.19.696

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1759,
-    "unique_ids": 1521,
-    "certain": 1759,
+    "strings": 1749,
+    "unique_ids": 1513,
+    "certain": 1749,
     "heuristic": 0,
-    "duplicate_ids": 165
+    "duplicate_ids": 164
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 81,
-      "strings": 1280
+      "files": 80,
+      "strings": 1270
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -176,18 +176,6 @@
         "modules/hall-ui/public/watch.js:1236"
       ]
     },
-    {
-      "id": "08afb1257b71",
-      "surface": "builders-hall",
-      "text": "Back to home",
-      "occurrences": 4,
-      "at": [
-        "modules/hall-ui/public/drachmae.html:87",
-        "modules/hall-ui/public/not-ready.html:38",
-        "modules/hall-ui/public/primer.html:90",
-        "modules/hall-ui/public/primer.js:283"
-      ]
-    },
     {
       "id": "90a128c97eae",
       "surface": "landing",
@@ -257,7 +245,7 @@
         "modules/hall-ui/public/hall-render.js:275",
         "modules/hall-ui/public/hall-render.js:346",
         "modules/hall-ui/public/hall-render.js:415",
-        "modules/hall-ui/public/shell.js:413"
+        "modules/hall-ui/public/shell.js:416"
       ]
     },
     {
@@ -307,6 +295,17 @@
         "modules/hall-ui/public/harbor.js:340"
       ]
     },
+    {
+      "id": "08afb1257b71",
+      "surface": "builders-hall",
+      "text": "Back to home",
+      "occurrences": 3,
+      "at": [
+        "modules/hall-ui/public/drachmae.html:87",
+        "modules/hall-ui/public/primer.html:90",
+        "modules/hall-ui/public/primer.js:283"
+      ]
+    },
     {
       "id": "118026595c16",
       "surface": "builders-hall",
@@ -1011,16 +1010,6 @@
         "modules/hall-ui/public/profile.js:144"
       ]
     },
-    {
-      "id": "2c19f41704b9",
-      "surface": "builders-hall",
-      "text": "Not yet available — {{worldName}}",
-      "occurrences": 2,
-      "at": [
-        "modules/hall-ui/public/not-ready.html:6",
-        "modules/hall-ui/public/not-ready.html:6"
-      ]
-    },
     {
       "id": "ad9a17a8a5eb",
       "surface": "builders-hall",
@@ -1327,8 +1316,8 @@
       "text": "Sign out",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/shell.js:431",
-        "modules/hall-ui/public/shell.js:588"
+        "modules/hall-ui/public/shell.js:434",
+        "modules/hall-ui/public/shell.js:591"
       ]
     },
     {
@@ -2654,15 +2643,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "08afb1257b71",
-      "surface": "builders-hall",
-      "text": "Back to home",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 38,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "08afb1257b71",
       "surface": "builders-hall",
@@ -5791,7 +5771,7 @@
       "surface": "builders-hall",
       "text": "Jump to a page or record",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 452,
+      "line": 455,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5800,7 +5780,7 @@
       "surface": "builders-hall",
       "text": "Jump to…",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 454,
+      "line": 457,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6848,33 +6828,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "19adac0efed1",
-      "surface": "builders-hall",
-      "text": "Not yet available",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 30,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
-    {
-      "id": "2c19f41704b9",
-      "surface": "builders-hall",
-      "text": "Not yet available — {{worldName}}",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 6,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
-    {
-      "id": "2c19f41704b9",
-      "surface": "builders-hall",
-      "text": "Not yet available — {{worldName}}",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 6,
-      "origin": "html-title",
-      "confidence": "certain"
-    },
     {
       "id": "571b9b22dbda",
       "surface": "builders-hall",
@@ -7141,7 +7094,7 @@
       "surface": "builders-hall",
       "text": "Open navigation",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 443,
+      "line": 446,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8450,15 +8403,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "fa1f021dbe21",
-      "surface": "builders-hall",
-      "text": "See how ranks work",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 37,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "a9c398651862",
       "surface": "builders-hall",
@@ -8788,7 +8732,7 @@
       "surface": "builders-hall",
       "text": "Sign in with GitHub",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 413,
+      "line": 416,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8797,7 +8741,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 431,
+      "line": 434,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8806,7 +8750,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 588,
+      "line": 591,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8833,7 +8777,7 @@
       "surface": "builders-hall",
       "text": "Skip to content",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 579,
+      "line": 582,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9013,7 +8957,7 @@
       "surface": "builders-hall",
       "text": "Switch theme",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 458,
+      "line": 461,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9175,7 +9119,7 @@
       "surface": "builders-hall",
       "text": "Text size",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 457,
+      "line": 460,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9953,15 +9897,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "87f1c2e07790",
-      "surface": "builders-hall",
-      "text": "This page unlocks as you advance.",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 26,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "69e8beced2ff",
       "surface": "builders-hall",
@@ -10601,15 +10536,6 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
-    {
-      "id": "c368b56ecf40",
-      "surface": "builders-hall",
-      "text": "Xenos builders start with a focused set of pages — ship your first",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 31,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "b6b0fcb2bcee",
       "surface": "builders-hall",
@@ -11825,15 +11751,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "b5567b42fa52",
-      "surface": "builders-hall",
-      "text": "not yet",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 25,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "8ca0a499ec86",
       "surface": "builders-hall",
@@ -12221,15 +12138,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "ee431f143549",
-      "surface": "builders-hall",
-      "text": "three tasks",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 33,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "d70c287bcd7f",
       "surface": "builders-hall",
@@ -12257,15 +12165,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "b8e12f871044",
-      "surface": "builders-hall",
-      "text": "to graduate and open the rest of {{worldName}}'s builder hub.",
-      "file": "modules/hall-ui/public/not-ready.html",
-      "line": 33,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "7d54a818850d",
       "surface": "builders-hall",

package/docs/file-map.md

@@ -134,7 +134,7 @@
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
-│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, pair, not-ready, task 1003308: the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `pair.css` the device row, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
+│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, pair, task 1003308: the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `pair.css` the device row, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).

package/docs/module-api-changelog.md

@@ -1849,5 +1849,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.693 with no explicit bump. run 34731674808. (task 1002620)
   1.19.695 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.694 with no explicit bump. run 34732266878. (task 1002620)
+  1.19.696 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.695 with no explicit bump. run 34733145358. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/catalog.js

@@ -246,7 +246,15 @@ const PERMISSIONS = [
 
   // ── ownership-scoped + baseline own-work (floor thetes / xenos) ───────────────
   { key: 'task.claim.any', system: false, floor: 'thetes', guards: 'claim the general queue (per-task requires_rank floor still applies)' },
-  { key: 'page.view.builder', system: false, floor: 'thetes', guards: 'authenticated hall pages (requireNonXenosPage / requireBuilderPage)' },
+  // Guards NOTHING in the core, and that is recorded rather than hidden. It floored
+  // the hall's thetes+ page tier until task 1002710 moved the orientation reading
+  // rooms down to signed-in, and task 1003450 then deleted the emptied gate. The
+  // atom stays because governance_002 seeds it at thetes, metic and archon in the
+  // live DB and an Archon can still grant it — so a module or instance can floor a
+  // surface at thetes with `requirePermission('page.view.builder')`. Naming a
+  // deleted gate function here is what this string used to do; if the core gates
+  // something on it again, say WHICH surface.
+  { key: 'page.view.builder', system: false, floor: 'thetes', guards: 'nothing in the core today — seeded and attachable, for a module or instance that wants a thetes+ floor' },
   // floor 'metic' is real but NOT the whole gate — the `criterion.create` pattern
   // above, and here the floor is the LOOSER half. Both routes carry requireBuilder
   // and decide in-handler (authorizeMembershipKindChange / authorizeOwnershipTransfer,
@@ -301,7 +309,7 @@ const PERMISSIONS = [
   // `requireGovernmentPage`) once the floor moved. Viewing is all this grants: every
   // write those pages reach is its own atom, and `government.manage` (the
   // ranks/permissions tab) stayed archon.
-  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the government/monitoring pages — /watch, /harbor, /gate (requireGovernmentPage; write = government.manage, archon)' },
+  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the government/monitoring pages — /watch, /harbor, /gate, /government (requireGovernmentPage; write = government.manage, archon)' },
 ];
 
 // ── invariants asserted at module load (fail loud on an authoring typo) ─────────

package/modules/hall-ui/public/panel.css

@@ -1,7 +1,7 @@
 /* panel.css — the PANEL archetype: a titled panel that holds a form, read top
-   to bottom (task 1003308, goal 1000081). Shared by settings, profile, pair,
-   and not-ready — the pages where the builder reads a label, a
-   sentence of consequence, and then acts on ONE control.
+   to bottom (task 1003308, goal 1000081). Shared by settings, profile and pair —
+   the pages where the builder reads a label, a sentence of consequence, and then
+   acts on ONE control. (not-ready was a fourth until task 1003450 deleted it.)
 
    THE ARCHETYPE is v3 "the glass hall", the owner's pick from the composition
    round — docs/design/hall-direction-v2.md §6, mock

package/modules/hall-ui/public/settings.html

@@ -10,8 +10,8 @@
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
   <!-- The PANEL archetype (task 1003308): the row, the switch, the field, the
-       chip control and the family's voices, shared with profile, pair and
-       not-ready. settings.css then holds only what this page
+       chip control and the family's voices, shared with profile and pair.
+       settings.css then holds only what this page
        has — the rail layout, the group head, the token ladder, the voices grid. -->
   <link rel="stylesheet" href="/builders/panel.css">
   <link rel="stylesheet" href="/builders/settings.css">

package/modules/hall-ui/public/shell.js

@@ -311,7 +311,10 @@
       { id: 'project-settings', label: 'Project settings', icon: 'admin', href: '/project-settings', gate: 'government' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'government' gate comment anticipated — cosmetic
-      // only; requireGovernmentManagePage (the government.manage atom) is the wall.
+      // only. The wall is the `government.manage` atom checked on each of the
+      // tab's nine data routes (route-rank-check.js); the page SHELL itself is
+      // metic+, because R16 made /government three rooms and only this one is
+      // the archon surface.
       { id: 'government', label: 'Permissions', icon: 'admin', href: '/government', gate: 'archon' }  // NOT 'Ranks': /ranks is the signed-in ladder explainer and two nav items
       //   reading 'Ranks' is the confusion this rename exists to remove. This tab
       //   is where a rank's permissions are granted, so it says what it does.,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.695",
+  "version": "1.19.696",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.695",
+      "version": "1.19.696",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.695",
+  "version": "1.19.696",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth.js

@@ -398,8 +398,10 @@ function signInWithReturn(req) {
 // that gate's EXISTING rank floor, so the audience is unchanged over the four live
 // ranks (catalog.RANK_ORDER):
 //   requireBuilderPage     was "any session"      floor xenos  → page.view.public
-//   requireNonXenosPage    was rank !== 'xenos'   floor thetes → page.view.builder
 //   requireGovernmentPage  was rank === 'archon'  floor archon → page.view.government
+// (R107 migrated a third, `requireNonXenosPage` → page.view.builder, thetes+. It
+// guarded the orientation reading rooms until task 1002710 moved them down a tier,
+// and task 1003450 deleted the gate once nothing had dispatched it for a release.)
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
 // page.view.government's floor archon→metic and the name stopped being true; the
 // floor now lives in modules/government/catalog.js, not in the function's name.
@@ -410,16 +412,19 @@ function signInWithReturn(req) {
 //
 // `deniedTo` is NEVER the sign-in flow. A visitor on that branch already HAS a
 // session, so bouncing them into sign-in returns them to the same gate — an
-// infinite loop. Every destination below is an ungated hall page:
+// infinite loop. Every destination below is an ungated hall page — and it is
+// /builders for every gate, because the REFUSAL ITSELF is carried in the query
+// string: the redirect appends ?denied=<permission>, and the hall shell renders
+// "you're signed in, but that page needs <permission>" on whatever page it lands
+// on (shell.js renderDeniedNotice, task 1002613). A bespoke refusal PAGE per tier
+// is the thing that mechanism replaced — /builders/not-ready was the last one, and
+// task 1003450 deleted it: it hard-coded one tier's remedy ("ship three tasks"),
+// could not name the permission actually missing, and by then nothing reached it.
 //   - /builders          the hall home. A signed-in builder who lacks the page's
 //                        permission IS still a citizen, so send them home.
-//   - /builders/not-ready the friendly notice for the orientation reading rooms;
-//                        it shows the rank ladder and a way back to the hall.
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
-  requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
   requireGovernmentPage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
-  requireGovernmentManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
   // `alsoAdmits` — a SECOND, non-rank audience this page's DATA ROUTE admits, so
   // the page can follow it (ADR 0210, task 1002290). /people fronts GET /scouting,
   // which since R14 admits a `project.curate` holder OR a PROJECT OWNER; a page
@@ -593,15 +598,6 @@ async function requireGovernmentPage(req, res, next) {
   return runPageGate('requireGovernmentPage', req, res, next);
 }
 
-// The /governance roles-and-permissions tab (BV1.R113) — gated on the
-// `government.manage` ATOM itself (system, archon floor), the same key every
-// /governance/* data route checks, so the page layer can never drift wider than
-// the API it fronts. Defense-in-depth as above: the data endpoints are all
-// independently gated; this keeps the tab shell from rendering for anyone else.
-async function requireGovernmentManagePage(req, res, next) {
-  return runPageGate('requireGovernmentManagePage', req, res, next);
-}
-
 // The /people builder-directory page (task 1002577) — gated on the
 // `project.curate` ATOM, the same key its one data route (GET /scouting,
 // modules/platform-identity) checks, so the page layer can never drift wider
@@ -624,14 +620,6 @@ async function requireBoardVotePage(req, res, next) {
   return runPageGate('requireBoardVotePage', req, res, next);
 }
 
-// The orientation reading rooms (the citizen's primer, the system-maps/diagrams)
-// that #766 closed to newcomers and #770 enforces at the URL. A Xenos's path is
-// action-only — find work, claim, ship three — so these pages are reserved for
-// graduated citizens (Thetes+).
-async function requireNonXenosPage(req, res, next) {
-  return runPageGate('requireNonXenosPage', req, res, next);
-}
-
 // ---------------------------------------------------------------------------
 // Route-gate inventory (V3.R06 #231) — the canonical "who can call what" list.
 // Derived from ADR 0016's fail-closed rule: privileged routes that mutate
@@ -919,8 +907,6 @@ module.exports = {
   requireBuilder,
   requireBuilderPage,
   requireGovernmentPage,
-  requireGovernmentManagePage,
-  requireNonXenosPage,
   requireProjectCuratePage,
   requireBoardVotePage,
   requireRank,

package/src/bongos/serve-internal.js

@@ -840,9 +840,10 @@ function mountInternalSurfaces(app) {
   // parsing this file statically, and a comment in that gap drops the regex out of
   // the map. Prose goes above the const, as here.
   const PROJECT_SETTINGS_PAGE_RE = /^\/builders\/project-settings(?:\.html)?\/?$/;
-  // The /government ranks-and-permissions tab (BV1.R113) sits one floor higher:
-  // the `government.manage` atom itself (archon), the same key its data routes
-  // check — requireGovernmentManagePage, not the metic-floored gate above.
+  // The /government page. Its SHELL takes the same metic+ gate as the branch
+  // above (R16 widened it there — see the dispatch comment below); the archon
+  // wall for the ranks-and-permissions room is `government.manage`, checked per
+  // route in route-rank-check.js, never at this layer.
   const GOVERNMENT_PAGE_RE = /^\/builders\/government(?:\.html)?\/?$/;
   // /board-room — the Board Room, carved out of the /government tab strip onto
   // its own page (ADR 0266). It does NOT take the gate above. Its atom is
@@ -1015,8 +1016,8 @@ function mountInternalSurfaces(app) {
   // is only cosmetic.
   //
   // Scope is deliberately narrow: the hall index (/builders), the shared assets
-  // (style.css, *.js, fonts, cursors), the not-ready notice, and the sign-in flow
-  // itself stay PUBLIC so the landing card + GitHub button render for a stranger.
+  // (style.css, *.js, fonts, cursors) and the sign-in flow itself stay PUBLIC so
+  // the landing card + GitHub button render for a stranger.
   //
   // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
   // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
@@ -1028,12 +1029,13 @@ function mountInternalSurfaces(app) {
   // (task 1291) — while still staying behind sign-in: it shows personal prefs
   // and mints CLI tokens.
   //
-  // The reading rooms USED to sit a tier above this, behind requireNonXenosPage
-  // (page.view.builder, thetes+), on #770's reasoning that a Xenos's path is
-  // action-only. That got it backwards: the citizen's primer and the onboarding
-  // diagrams are written FOR the first-session newcomer, and gating them at
-  // thetes redirected exactly that reader to /builders/not-ready. Owner's call
-  // (task 1002710) — the RANK floor is gone; sign-in is unchanged.
+  // The reading rooms USED to sit a tier above this, behind a thetes+ gate
+  // (page.view.builder), on #770's reasoning that a Xenos's path is action-only.
+  // That got it backwards: the citizen's primer and the onboarding diagrams are
+  // written FOR the first-session newcomer, and gating them at thetes redirected
+  // exactly that reader away. Owner's call (task 1002710) — the RANK floor is
+  // gone; sign-in is unchanged. Task 1003450 then deleted the emptied gate and
+  // the bespoke refusal page it pointed at, neither of which anything reached.
   // The link-hiding in shell.js is only cosmetic; these are the real gates.
   // task 1003113: copy-desk joins this tier rather than a higher one. Filing a
   // flag is open to every rank by design (see the nav comment in shell.js), so

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.695'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.696'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_resolve_failure.mjs

@@ -92,19 +92,20 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   // The enumeration, kept as an executable assertion rather than prose so it cannot
   // rot: a NEW bare `async function require*` added later fails this test.
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
-  //   requireBuilderPage         \
-  //   requireGovernmentPage       \
-  //   requireGovernmentManagePage  \ all SIX delegate to runPageGate, guarded by BV1.R107.
-  //   requireNonXenosPage          /  (the R113 roles-tab gate; the /people curate
-  //   requireProjectCuratePage    /    gate; the ADR 0266 /board-room vote gate)
-  //   requireBoardVotePage       /
+  //   requireBuilderPage        \
+  //   requireGovernmentPage      \ all FOUR delegate to runPageGate, guarded by
+  //   requireProjectCuratePage   /  BV1.R107 (the /people curate gate; the
+  //   requireBoardVotePage      /   ADR 0266 /board-room vote gate)
+  // Task 1003450 removed two more — requireNonXenosPage and the R113
+  // requireGovernmentManagePage — which had both ended up dispatched from no
+  // route at all; tests/hall_page_gate_map.mjs now fails if that recurs.
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage', 'requireBoardVotePage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage', 'requireBoardVotePage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }