@bongos/core 1.19.714 → 1.19.715

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.714",
-  "core_contract": "1.19.714",
-  "source_commit": "a5a66a5abc084908ffbcb70583aa9effa9bc86d7",
+  "core_version": "1.19.715",
+  "core_contract": "1.19.715",
+  "source_commit": "b62e25ab61b1f2c4994e6b53ae9958cd34596927",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T07:48:24.895Z",
+  "built_at": "2026-09-13T08:14:55.124Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 478,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2147,
+    "functional_verbatim": 2149,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2649,
-  "tree_sha256": "51e98dc1aa5041914570019a3903f1b1c0cce050fff1b530c41da04241a719a7",
+  "file_count": 2651,
+  "tree_sha256": "7ec11a13e61036eaa680d8780521289c206117336ca95013e22bddde2dc83a1f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1957,12 +1957,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "ab5c4798a75b2278e0fefd99d80cb5e5ce2be07034cc95f14d35abe1a458e2cf"
+      "sha256": "8a54b0082d0eddeb63878440f6b42fb0a701e65284c54b7e4475a0685e943c88"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "708114251e3317f48d581da8ab3df316a5a6e4300afb87749296cfa8f767fc7b"
+      "sha256": "fe218fd29cc8f03ceb3ff3ea8dd2bcb36df81a75a73bcdfe73e7af90fa6e3ad0"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2807,7 +2807,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3484277ad5363b99cffe978b168fcdadd40051cb9fc45c51a2aab58dd43fe601"
+      "sha256": "b057c7c856c96a08e25c433ae816ac6ff9762da2f510ee74defdefbf6151ca14"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5522,7 +5522,7 @@
     {
       "path": "modules/hall-ui/public/watch.css",
       "mode": "0000644",
-      "sha256": "ea2f7870bdd9383cfded8b2b09724486faa0793438dfa17bc52af189c8a81c6f"
+      "sha256": "f11f73ec3649c7547cb59b7d5fdf090a1e52ad96f6fb28bdb3b5a14691153de1"
     },
     {
       "path": "modules/hall-ui/public/watch.html",
@@ -5532,7 +5532,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "e6808a692963759ca0942bcf28f4ee1479ba0b0ef727c2ace010bbcf5159043c"
+      "sha256": "671cce72893d85971cc81ed7a64f7c3796bcb1f3bbdf7b28ab68e7e4e1d5b11c"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -7817,12 +7817,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "732fe7dc9bc6b9c48aabb5fb6dcf35aa9a71f50fcf16d6548e183a1092c40853"
+      "sha256": "76f1c9e8c1f6a12a9857eff4b538e700c337252afd4ecb40536088a7c967f81b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6543f1d328faab7d974585c1ad7f0f1b79ba653563bf5d75b7948f01501ce322"
+      "sha256": "c65aae0250d7c1c324a3355a81d0bb5004a1bf7b339e0c6b69f819640e33eac4"
     },
     {
       "path": "public-docs/index.html",
@@ -7982,7 +7982,7 @@
     {
       "path": "scripts/gds/backfill-task-rewards.js",
       "mode": "0000644",
-      "sha256": "a9f1064fbb683297e775c455ef65249cf809018a38a5aa2f975a62cbba16cd9c"
+      "sha256": "6328a73f8ce38754280d8f7b6234c0eea83c5e5061534550f44b0f7d78b12224"
     },
     {
       "path": "scripts/gds/backlog-review.js",
@@ -9602,7 +9602,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e836253fa5b1c1b117c308430b19b2129a19904b21371ad2c033f0613951d0c2"
+      "sha256": "b0482a0410f077b4c9a41a19cf85a46dc527a20d7a897023cddff8d89787e39f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10384,6 +10384,11 @@
       "mode": "0000644",
       "sha256": "d7c96a67f1eda974a9387a47d12bf70d7f2125ea77c1ddb313e5a3feb47ae04f"
     },
+    {
+      "path": "tests/credit_log_single_writer.mjs",
+      "mode": "0000644",
+      "sha256": "e1ce127d39f8f6aad3f819ab828d66de3d211484174849b1a0ce6a6ab7546b36"
+    },
     {
       "path": "tests/criterion_authoring_gate.mjs",
       "mode": "0000644",
@@ -11312,7 +11317,7 @@
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "6a2360675b70ff2b32ca514e2baafa2aecb10e397a2f88630928ee93b351b34b"
+      "sha256": "2c5ffa3ed447fdbbbc1b44e553f493bf05ab2848b154836defe3fe40e1909592"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -13199,6 +13204,11 @@
       "mode": "0000644",
       "sha256": "bca521caccef7c1c147bfa678203369b246f786d4d8cb5a485f15a9d11f925ba"
     },
+    {
+      "path": "tests/watch_roster_self_row.mjs",
+      "mode": "0000644",
+      "sha256": "a582a7dc1490038b9d5fed9551b00d6cc1ded2758f06d4c2f21c36e4aea12a9c"
+    },
     {
       "path": "tests/watch_sealed_floor.mjs",
       "mode": "0000644",

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1749 strings** across 3 surfaces · 1513 distinct pieces of copy · 1749 certain, 0 heuristic · 164 shown in more than one place.
+**1751 strings** across 3 surfaces · 1515 distinct pieces of copy · 1751 certain, 0 heuristic · 164 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 80 | 1270 |
+| `builders-hall` | `modules/hall-ui/public` | 80 | 1272 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 379 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a072071b893c` | 2x | All time | modules/status-ui/public/index.html:286, modules/status-ui/public/index.html:313 |
 | … | | _124 more in the JSON registry_ | |
 
-## `builders-hall` — 1270 strings
+## `builders-hall` — 1272 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -285,8 +285,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7bcaeffb742f` | certain | Could not approve: {…} | `modules/hall-ui/public/gate.js:108` |
 | `c922293e668c` | certain | Could not assign: {…} | `modules/hall-ui/public/government.js:468` |
 | `94763c4d5a94` | certain | Could not block: {…} | `modules/hall-ui/public/harbor.js:167` |
-| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:819` |
-| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:845` |
+| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:860` |
+| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:886` |
 | `1ef1efc15b6c` | certain | Could not change that just now. | `modules/hall-ui/public/goals-render.js:1235` |
 | `78e18ea59b9f` | certain | Could not close: {…} | `modules/hall-ui/public/harbor.js:136` |
 | `c3f99e7c6e6b` | certain | Could not copy automatically — select and copy manually. ({…}) | `modules/hall-ui/public/settings.js:1017` |
@@ -310,7 +310,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:244` |
 | `edd5bafbe075` | certain | Could not load the queue just now. | `modules/hall-ui/public/ideas.js:565` |
 | `02bb0570996a` | certain | Could not load the ranks. | `modules/hall-ui/public/ranks.js:197` |
-| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1311` |
+| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1357` |
 | `4b0c8d94541c` | certain | Could not load your account. Reload the page to try again. | `modules/hall-ui/public/settings.js:1396` |
 | `2a9fb4046bc4` | certain | Could not load your rank. Return to the hall and try again. | `modules/hall-ui/public/ranks.js:196` |
 | `9d533e811dec` | certain | Could not load your sessions: {…} | `modules/hall-ui/public/settings-sessions.js:114` |
@@ -348,7 +348,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d4601887a058` | certain | Could not sign out everywhere: {…} | `modules/hall-ui/public/settings-sessions.js:102` |
 | `b1602d01f4bb` | certain | Could not unblock: {…} | `modules/hall-ui/public/harbor.js:187` |
 | `3db890b074a7` | certain | Could not update visibility just now. | `modules/hall-ui/public/goals-render.js:1219` |
-| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1310` |
+| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1356` |
 | `6bd74fd20311` | certain | Could not verify your access. Try again. | `modules/hall-ui/public/sessions.js:280` |
 | `278e8281c82f` | certain | Could not vote: {…} | `modules/hall-ui/public/board-room.js:304` |
 | `a48e9f098392` | certain | Could not {…} just now. | `modules/hall-ui/public/goals-render.js:1205` |
@@ -691,7 +691,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d9c802f5d85e` | certain | Opening the studio… | `modules/hall-ui/public/studio.html:45` |
 | `569980a263ae` | certain | Optional. This is the ledger link — a copy change ships as a task like every other change. | `modules/hall-ui/public/copy-desk.html:130` |
 | `c78d7388ffd7` | certain | Or just stay in the online terminal | `modules/hall-ui/public/hall-render.js:779` |
-| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1153` |
+| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1194` |
 | `695ffff13730` | certain | Over time | `modules/hall-ui/public/profile.html:72` |
 | `5ded44da0cc5` | certain | Override requests | `modules/hall-ui/public/watch.html:143` |
 | `15a49bf15007` | certain | Page {…} of {…} | `modules/hall-ui/public/hall-kit.js:112` |
@@ -737,7 +737,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3f85bdc47099` | certain | Protected module scope — join by request; an Archon admits members | `modules/hall-ui/public/goals-render.js:848` |
 | `e5c292c8b361` | certain | Provides (seams) | `modules/hall-ui/public/atlas.js:288` |
 | `4de232a05888` | certain | Raise after | `modules/hall-ui/public/project-settings.js:113` |
-| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:813` |
+| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:854` |
 | `ff50a1395cbc` | certain | Rank: {…} | `modules/hall-ui/public/profile.js:50` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
@@ -745,7 +745,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `101a51902f53` | certain | Re-issue failed: {…} | `modules/hall-ui/public/settings.js:1021` |
 | `fae2f90927bd` | certain | Read an idea, then decide. An objection needs a reason and the section it faults. | `modules/hall-ui/public/board-room.html:51` |
 | `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/drachmae.js:148` |
-| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1126` |
+| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1167` |
 | `b6fcfdd652a7` | certain | Read it here | `modules/hall-ui/public/work.html:45` |
 | `c5f19a888a15` | certain | Read the handoff notes | `modules/hall-ui/public/task.js:441` |
 | `f9e998f4af3d` | certain | Read to the end and the button below unlocks. It is an honour system — nothing here checks your comprehension. | `modules/hall-ui/public/primer.html:100` |
@@ -798,7 +798,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/gate.js:219` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/government.js:879` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/harbor.js:337` |
-| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1265` |
+| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1306` |
 | `b33dde402434` | certain | Retire this goal — you will be asked what happens to any unfinished work | `modules/hall-ui/public/goals-render.js:927` |
 | `feb48b0d462c` | certain | Return to the Dev Box app and click “Connect” again for a fresh code. | `modules/hall-ui/public/pair.js:32` |
 | `908a0d5d0685` | certain | Review how it judged this work, and teach it what good looked like. | `modules/hall-ui/public/studio.js:181` |
@@ -884,7 +884,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:88` |
 | `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:461` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:74` |
-| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1324` |
+| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1370` |
 | `dfc967a63d57` | certain | Task lifecycle from backlog to shipped, showing states and transitions and the edge where credits are awarded. | `modules/hall-ui/public/diagrams.html:51` |
 | `10cc12f37636` | certain | Task sections | `modules/hall-ui/public/work.html:53` |
 | `0e636ea41b29` | certain | Task status | `modules/hall-ui/public/goals-render.js:340` |
@@ -905,6 +905,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `282c3fa2d456` | certain | That is the wording it already has. Change something, or file a flag instead if you only want to mark it. | `modules/hall-ui/public/copy-desk.js:438` |
 | `c0e28f30524d` | certain | That project's own standing, as reported by that project. | `modules/hall-ui/public/profile.js:314` |
 | `e99d4a811e92` | certain | That request is no longer available. | `modules/hall-ui/public/profile-connections.js:270` |
+| `6e5a324b2972` | certain | That's you | `modules/hall-ui/public/watch.js:803` |
 | `50198c465225` | certain | The 16-value rank enum in three bands, which ranks are live, and the permissions each rank holds. | `modules/hall-ui/public/diagrams.html:59` |
 | `c5e6bdd32fe3` | certain | The Board Room is open to the builders this project’s constitution seats on its board. | `modules/hall-ui/public/board-room.js:436` |
 | `1569b8838862` | certain | The Dev Box app now acts as | `modules/hall-ui/public/pair.js:40` |
@@ -1087,6 +1088,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6dadadffa36e` | certain | Your name cannot be blank. | `modules/hall-ui/public/settings.js:832` |
 | `bd77210a8c90` | certain | Your name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:837` |
 | `c0a01a95e97e` | certain | Your own idea. You may vote, but it can’t be decided by your vote alone, and a vote on your own idea earns no  | `modules/hall-ui/public/board-room.js:274` |
+| `5e0ec4cd1cfe` | certain | Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the  | `modules/hall-ui/public/watch.js:835` |
 | `8fc605026acf` | certain | Your pending join {…}: {…} — awaiting approval. | `modules/hall-ui/public/goal-inbox.js:88` |
 | `e91418db3962` | certain | Your preferences, {…}. | `modules/hall-ui/public/settings.js:856` |
 | `e91418db3962` | certain | Your preferences, {…}. | `modules/hall-ui/public/settings.js:1413` |
@@ -1231,7 +1233,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/hall-render.js:623` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/idea.js:207` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/ideas.js:476` |
-| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1236` |
+| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1277` |
 | `a41659dc2bee` | certain | tasks remaining | `modules/hall-ui/public/roadmap.js:305` |
 | `bd3402efa59e` | certain | task{…} shipped | `modules/hall-ui/public/goals-render.js:793` |
 | `95854f8315ca` | certain | the page everyone else reads | `modules/hall-ui/public/profile.html:32` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1749,
-    "unique_ids": 1513,
-    "certain": 1749,
+    "strings": 1751,
+    "unique_ids": 1515,
+    "certain": 1751,
     "heuristic": 0,
     "duplicate_ids": 164
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 80,
-      "strings": 1270
+      "strings": 1272
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -147,7 +147,7 @@
         "modules/hall-ui/public/gate.js:219",
         "modules/hall-ui/public/government.js:879",
         "modules/hall-ui/public/harbor.js:337",
-        "modules/hall-ui/public/watch.js:1265"
+        "modules/hall-ui/public/watch.js:1306"
       ]
     },
     {
@@ -173,7 +173,7 @@
         "modules/hall-ui/public/hall-render.js:623",
         "modules/hall-ui/public/idea.js:207",
         "modules/hall-ui/public/ideas.js:476",
-        "modules/hall-ui/public/watch.js:1236"
+        "modules/hall-ui/public/watch.js:1277"
       ]
     },
     {
@@ -1167,7 +1167,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/drachmae.js:148",
-        "modules/hall-ui/public/watch.js:1126"
+        "modules/hall-ui/public/watch.js:1167"
       ]
     },
     {
@@ -3584,7 +3584,7 @@
       "surface": "builders-hall",
       "text": "Could not change rank: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 819,
+      "line": 860,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3593,7 +3593,7 @@
       "surface": "builders-hall",
       "text": "Could not change standing: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 845,
+      "line": 886,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3809,7 +3809,7 @@
       "surface": "builders-hall",
       "text": "Could not load this page.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1311,
+      "line": 1357,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4151,7 +4151,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Go back and try again.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1310,
+      "line": 1356,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7238,7 +7238,7 @@
       "surface": "builders-hall",
       "text": "Over the last {…} days",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1153,
+      "line": 1194,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7652,7 +7652,7 @@
       "surface": "builders-hall",
       "text": "Rank set to {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 813,
+      "line": 854,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7724,7 +7724,7 @@
       "surface": "builders-hall",
       "text": "Read it as a table",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1126,
+      "line": 1167,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8201,7 +8201,7 @@
       "surface": "builders-hall",
       "text": "Restricted.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1265,
+      "line": 1306,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8975,7 +8975,7 @@
       "surface": "builders-hall",
       "text": "System oversight: people, operations and security.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1324,
+      "line": 1370,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9159,6 +9159,15 @@
       "origin": "js-notice",
       "confidence": "certain"
     },
+    {
+      "id": "6e5a324b2972",
+      "surface": "builders-hall",
+      "text": "That's you",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 803,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "50198c465225",
       "surface": "builders-hall",
@@ -10797,6 +10806,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "5e0ec4cd1cfe",
+      "surface": "builders-hall",
+      "text": "Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last {…} locking everyone out — so another {…} does it.",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 835,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "8fc605026acf",
       "surface": "builders-hall",
@@ -12098,7 +12116,7 @@
       "surface": "builders-hall",
       "text": "task {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1236,
+      "line": 1277,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1887,5 +1887,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.712 with no explicit bump. run 34745667268. (task 1002620)
   1.19.714 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.713 with no explicit bump. run 34746102135. (task 1002620)
+  1.19.715 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.714 with no explicit bump. run 34747181910. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/watch.css

@@ -21,6 +21,12 @@
 /* Row actions inside a ledger cell: ghost pills in a row. */
 .watch-actions { display: flex; gap: 6px; flex-wrap: wrap; align-items: center; }
 
+/* The reader's own roster row (task 1003720). Nobody may change their own rank
+   or standing — the server refuses both outright — so that row states a fact
+   where the others carry a control, and a fact is written in the faint ink, not
+   painted as a disabled pill. The foot line under the table says why. */
+.watch-self { color: var(--ink-faint); }
+
 /* A sealed or failed section says so in place. Three states, three sentences:
    "nothing here" is the kit's empty state, this is "you may not see this" and
    "could not load". */

package/modules/hall-ui/public/watch.js

@@ -745,6 +745,13 @@
   // sits at a rank outside this set, we inject it so the select still shows it.
   const RANK_OPTIONS = ['xenos', 'thetes', 'metic', 'archon'];
 
+  // Who is reading this roster (task 1003720). `load()` already fetches /me to
+  // resolve the page's floor and then threw the id away, so the roster — which
+  // returns EVERY builder, the viewer included — could not tell which row was
+  // the reader's own. See renderRoster for why that mattered.
+  let viewerId = null;
+  const isViewer = (b) => viewerId != null && b && b.id != null && String(b.id) === String(viewerId);
+
   function renderRoster(data, target) {
     const builders = Array.isArray(data.builders) ? data.builders : [];
     setAttention('att-stale', builders.filter((b) => b.stale_claim).length);
@@ -762,16 +769,39 @@
       ],
       pager: makePager('watch-roster', 'otb.watch.rosterPerPage'),
       rowHtml: (b) => {
+        // THE VIEWER'S OWN ROW OFFERS NOTHING (task 1003720, re-filed from 1002951
+        // — "I cannot press offboard", reported by the owner from Discord).
+        //
+        // The roster returns every builder, so the reader's own row is in it. Both
+        // routes behind that row refuse a self-change OUTRIGHT and always will:
+        // PATCH /builders/:id/rank answers cannot_change_own_rank and
+        // /builders/:id/status answers cannot_change_own_status — the guard that
+        // stops the last Archon demoting or offboarding themselves and locking
+        // everyone out. The row painted a live rank <select> and a live Offboard
+        // pill anyway, so from the owner's seat the page carried a control that
+        // could only ever answer with a raw refusal slug in a toast. That is what
+        // "I cannot press offboard" describes.
+        //
+        // This is not a SOFT gate (the primer's acknowledge control, which opens
+        // once you have read enough and so stays in the tab order as
+        // aria-disabled) — it is an action that can never open for this reader.
+        // So the row renders no control at all and the section's foot line says
+        // why, rather than painting a dead one.
+        const self = isViewer(b);
         const opts = RANK_OPTIONS.slice();
         if (b.rank && !opts.includes(b.rank)) opts.unshift(b.rank);
-        const rankSelect =
-          `<select data-roster-rank data-id="${escapeHtml(b.id)}" data-current="${escapeHtml(b.rank || '')}" aria-label="Rank">` +
-          opts.map((rk) => `<option value="${escapeHtml(rk)}"${rk === b.rank ? ' selected' : ''}>${escapeHtml(rankLabel(rk))}</option>`).join('') +
-          '</select>';
+        const rankCell = self
+          ? `<span class="watch-self">${escapeHtml(rankLabel(b.rank))}</span>`
+          : `<select data-roster-rank data-id="${escapeHtml(b.id)}" data-current="${escapeHtml(b.rank || '')}" aria-label="Rank">` +
+            opts.map((rk) => `<option value="${escapeHtml(rk)}"${rk === b.rank ? ' selected' : ''}>${escapeHtml(rankLabel(rk))}</option>`).join('') +
+            '</select>';
         const isInactive = String(b.status) === 'inactive';
         const statusBtn = isInactive
           ? ghost(`data-roster-status="active" data-id="${escapeHtml(b.id)}"`, 'Reactivate')
           : ghost(`data-roster-status="inactive" data-id="${escapeHtml(b.id)}"`, 'Offboard', true);
+        const actionCell = self
+          ? '<span class="watch-self">That\'s you</span>'
+          : `<div class="watch-actions">${statusBtn}</div>`;
         const claims = num(b.active_claim_count);
         const staleFlag = b.stale_claim ? ' <span class="badge badge--sev-medium">stale</span>' : '';
         // task 1467: the roster name links to the builder's public profile page.
@@ -784,17 +814,28 @@
           `<td>${rosterNameCell}` +
           (b.github_login ? ` <span class="ov-mono">@${escapeHtml(b.github_login)}</span>` : '') +
           '</td>' +
-          `<td>${rankSelect}</td>` +
+          `<td>${rankCell}</td>` +
           `<td class="num">${fmtInt(b.total_credits)}</td>` +
           `<td class="num">${fmtInt(b.karma)}</td>` +
           `<td class="num${b.stale_claim ? ' warn' : ''}">${fmtInt(claims)}${staleFlag}</td>` +
           `<td><span class="badge badge--status">${escapeHtml(b.status || '—')}</span></td>` +
-          `<td><div class="watch-actions">${statusBtn}</div></td>` +
+          `<td>${actionCell}</td>` +
           '</tr>'
         );
       },
     }).render(builders);
 
+    // The one asymmetry in the table, stated once under it rather than repeated
+    // on the row. Appended as an ELEMENT, not with `innerHTML +=`: re-parsing the
+    // body would drop the pager's own wiring. The rank is written from
+    // rankLabel(), never a hardcoded "Archon", so the floor cannot drift.
+    if (builders.some(isViewer)) {
+      const note = document.createElement('p');
+      note.className = 'ov-foot';
+      note.textContent = `Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last ${rankLabel('archon')} locking everyone out — so another ${rankLabel('archon')} does it.`;
+      target.appendChild(note);
+    }
+
     // Rank change via the <select>. Bespoke: a 'change' listener that rolls the
     // select back to its previous value on failure, delegated so a page flip
     // cannot strand a row without one.
@@ -1305,6 +1346,11 @@
       if (!res.ok) throw new Error(`me → ${res.status}`);
       const payload = res.data;
       builder = (payload && payload.builder) ? payload.builder : payload;
+      // Kept for the roster, which must know which row is the reader's own
+      // (task 1003720). Null when /me answered without one — isViewer then
+      // matches nothing, so the roster degrades to the old every-row-acts shape
+      // rather than marking the wrong row as yours.
+      viewerId = (builder && builder.id != null) ? builder.id : null;
     } catch (err) {
       console.error('[watch] failed to read viewer', err);
       $('#watch-sub').textContent = 'Could not verify your access. Go back and try again.';

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.714",
+  "version": "1.19.715",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.714",
+      "version": "1.19.715",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.714",
+  "version": "1.19.715",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/backfill-task-rewards.js

@@ -295,10 +295,15 @@ async function applyPlan(pool, plans) {
           [p.builderId, r.taskId, delta, BACKFILL_REASON,
             `${r.description} (net-capped ${delta} of ${r.effective}; builder cost-plus already paid ${p.costPlusAlreadyPaid})`]
         );
-        await client.query(
-          `UPDATE builders SET total_credits = total_credits + $1 WHERE id = $2`,
-          [delta, p.builderId]
-        );
+        // NO `UPDATE builders SET total_credits = ...` HERE, DELIBERATELY.
+        // trg_credit_log_apply applies the delta (migrations/003_pms.sql:169 —
+        // pms_apply_credit, AFTER INSERT ON credit_log, total_credits += NEW.delta),
+        // so the INSERT above has ALREADY moved the balance. This function used to
+        // add it a second time, doubling every credit it minted — a real
+        // financial-ledger bug (task 1003641). Every other credit_log writer in the
+        // repo relies on the trigger alone; backfill-subagent-rewards.js is the
+        // sibling exemplar. If you are adding a balance update here, the trigger is
+        // the thing to change, once, not this call site.
         remaining -= delta;
         mintedRows++;
         mintedDrachmae += delta;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.714'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.715'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/credit_log_single_writer.mjs

@@ -0,0 +1,94 @@
+// tests/credit_log_single_writer.mjs
+//
+// Task 1003641 — the balance is moved by the TRIGGER, and by nothing else.
+//
+// THE BUG. scripts/gds/backfill-task-rewards.js applyPlan() did both: INSERT INTO
+// credit_log (which fires trg_credit_log_apply AFTER INSERT) *and* a separate
+// `UPDATE builders SET total_credits = total_credits + $1`. The trigger had already
+// applied that delta, so every credit the script minted landed twice. A real
+// financial-ledger bug, and the kind that is invisible in review because each half
+// looks correct on its own.
+//
+// WHY THIS FILE IS NOT JUST A TEST OF THAT ONE LINE. The invariant is repo-wide:
+// exactly one place applies a credit_log delta to builders.total_credits. Every
+// other writer already relied on the trigger; only the backfill script double-wrote.
+// So the durable guard is "no credit_log writer also updates the balance", which
+// catches the NEXT script someone writes as well as this one.
+//
+// The existing tests/backfill_task_rewards.mjs never referenced applyPlan,
+// total_credits or the trigger at all, which is how this survived. Source
+// assertions, because the DB-free gate cannot run SQL; runtime behaviour is proven
+// against real Postgres at deploy.
+//
+// Run:  node tests/credit_log_single_writer.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+// Comments carry the rationale; strip them before asserting on the executable body
+// so a comment ABOUT the bug can never satisfy an assertion against it.
+const code = (src) => src
+  .replace(/^\s*\/\/.*$/gm, '')
+  .replace(/\/\*[\s\S]*?\*\//g, '');
+
+// Every file in the repo that inserts a credit_log row.
+const WRITERS = [
+  ['scripts', 'gds', 'backfill-task-rewards.js'],
+  ['scripts', 'gds', 'backfill-subagent-rewards.js'],
+  ['modules', 'economy', 'achievements.js'],
+  ['modules', 'economy', 'credits.js'],
+  ['modules', 'lifecycle', 'db-rank-authz.js'],
+  ['src', 'bongos', 'db.js'],
+];
+
+test('the trigger is the ONE place a credit_log delta reaches total_credits', () => {
+  const mig = read('migrations', '003_pms.sql');
+  assert.match(mig, /CREATE OR REPLACE FUNCTION pms_apply_credit\(\)/);
+  assert.match(mig, /SET total_credits = total_credits \+ NEW\.delta/,
+    'the trigger applies the delta');
+  assert.match(mig, /AFTER INSERT ON credit_log/,
+    'on insert, so any INSERT has already moved the balance');
+});
+
+test('no credit_log writer ALSO updates builders.total_credits', () => {
+  // The invariant. A writer that does both double-credits, silently.
+  const offenders = [];
+  for (const parts of WRITERS) {
+    const src = code(read(...parts));
+    if (!/INSERT INTO credit_log/i.test(src)) continue; // moved on; not our business
+    // Match an ASSIGNMENT, not a mention. `UPDATE builders SET rank = $2 ...
+    // RETURNING id, ..., total_credits, ...` READS the column and must not trip
+    // this — two files do exactly that, and an earlier draft of this test flagged
+    // both as double-writers. The two shapes that actually move a balance are the
+    // self-referential increment and a direct set.
+    const writesBalance = /\btotal_credits\s*=\s*total_credits/i.test(src)
+      || /SET\s+total_credits\s*=/i.test(src);
+    if (writesBalance) offenders.push(parts.join('/'));
+  }
+  assert.deepEqual(offenders, [],
+    `these insert a credit_log row AND move the balance themselves, so every credit lands twice: ${offenders.join(', ')}`);
+});
+
+test('backfill-task-rewards.js specifically — the regression that cost real credits', () => {
+  const src = read('scripts', 'gds', 'backfill-task-rewards.js');
+  assert.match(src, /INSERT INTO credit_log/, 'it still mints the audit row');
+  assert.doesNotMatch(code(src), /\btotal_credits\s*=/i,
+    'and must never assign total_credits — the trigger owns the balance');
+  // The reason WHY must survive too, or the next reader re-adds it.
+  assert.match(src, /trg_credit_log_apply applies the delta/,
+    'the call site explains why there is no balance update here');
+});
+
+test('the idempotency key still guards re-runs', () => {
+  // Removing the double-write must not disturb the other half of this script's
+  // safety: a second run of the same backfill must mint nothing.
+  const src = code(read('scripts', 'gds', 'backfill-task-rewards.js'));
+  assert.match(src, /SELECT 1 FROM credit_log WHERE task_id = \$1 AND reason = \$2/,
+    'the per-task idempotency re-check inside the transaction');
+  assert.match(src, /BACKFILL_REASON/, 'keyed on the backfill reason');
+});

package/tests/helpers.mjs

@@ -330,6 +330,14 @@ export function makeEl(tagName, attrs = {}) {
       while (node) { if (matches(node, sel)) return node; node = node.parentNode; }
       return null;
     },
+    // Node.contains — true for the node itself and any descendant. A DELEGATED
+    // listener guards on it (`!root.contains(el)`), so without this a test that
+    // dispatches on the section throws instead of exercising the handler.
+    contains(node) {
+      let n = node;
+      while (n) { if (n === this) return true; n = n.parentNode; }
+      return false;
+    },
     addEventListener(type, fn) { (this.listeners[type] = this.listeners[type] || []).push(fn); },
     focus() {},
     fire(type, event) { (this.listeners[type] || []).forEach((fn) => fn(event)); },

package/tests/watch_roster_self_row.mjs

@@ -0,0 +1,289 @@
+// tests/watch_roster_self_row.mjs — the reader's OWN row on the Watch roster,
+// EXECUTED (task 1003720, re-filed from task 1002951).
+//
+// The bug, as the owner reported it from Discord #bugs: "I cannot press
+// offboard". GET /builders/roster returns EVERY builder — the reader included —
+// and the row painted a live rank <select> and a live Offboard pill on all of
+// them. But both routes behind that row refuse a self-change categorically and
+// always will:
+//
+//   PATCH /builders/:id/rank    → 403 cannot_change_own_rank
+//   PATCH /builders/:id/status  → 403 cannot_change_own_status
+//
+// (src/bongos/routes/builders.js — the guard that stops the last Archon demoting
+// or offboarding themselves and locking everyone out.) res.fail() defaults the
+// envelope's message to the CODE, so pressing your own Offboard produced a toast
+// reading "Could not change standing: cannot_change_own_status" and nothing else.
+// From the owner's seat that is a button that does not work.
+//
+// The page now renders no control on that row and states why once under the
+// table. These are assertions about what a human sees and clicks, so this runs
+// the real watch.js inside `vm` against the real watch.html, with a makeLedger
+// that actually calls rowHtml — a source-text grep cannot see which row got
+// which cell, and the no-op ledger stub in tests/watch_applications_queue.mjs
+// renders no roster rows at all.
+//
+// Run:  node tests/watch_roster_self_row.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner, makeEl, parseInto } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const SRC = fs.readFileSync(path.join(HALL, 'watch.js'), 'utf8');
+const PAGE = fs.readFileSync(path.join(HALL, 'watch.html'), 'utf8');
+
+const { test, summary } = makeRunner();
+
+const escapeHtml = (s) => String(s == null ? '' : s).replace(/[&<>"']/g,
+  (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+const tick = () => new Promise((r) => setTimeout(r, 0));
+async function settle() { for (let i = 0; i < 40; i++) await tick(); }
+
+const ok = (data) => ({ status: 200, ok: true, data });
+
+// The branding pack renames every rank (the neutral pack calls archon "Owner"),
+// which is why a hardcoded rank word in page copy is banned. This stub renames
+// them too, so a test for "the foot line does not spell Archon" is real.
+const RANK_LABELS = { xenos: 'Newcomer', thetes: 'Contributor', metic: 'Trusted', archon: 'Owner' };
+const rankLabel = (r) => RANK_LABELS[r] || String(r || '');
+
+// The viewer is builder 1. Rows as GET /builders/roster returns them — note the
+// viewer sits in the MIDDLE, which is where the live roster puts the owner: the
+// order is inactive-last, then still-onboarding, then created_at DESC.
+const VIEWER_ID = '1';
+const ROSTER = [
+  { id: '90', display_name: 'Alpha', github_login: 'alpha', rank: 'archon', total_credits: 9200, karma: 4, active_claim_count: 1, stale_claim: false, status: 'active' },
+  { id: '1', display_name: 'The Owner', github_login: 'theowner', rank: 'archon', total_credits: 6896, karma: 68, active_claim_count: 2, stale_claim: false, status: 'active' },
+  { id: '92', display_name: 'Gamma', github_login: 'gamma', rank: 'thetes', total_credits: 830, karma: 1, active_claim_count: 0, stale_claim: false, status: 'active' },
+  { id: '93', display_name: 'Delta', github_login: 'delta', rank: 'xenos', total_credits: 40, karma: 0, active_claim_count: 0, stale_claim: false, status: 'inactive' },
+];
+
+// ===========================================================================
+// Boot the real page against a scripted API and hand back handles.
+// ===========================================================================
+
+async function boot(opts = {}) {
+  const {
+    builders = ROSTER,
+    me = { id: VIEWER_ID, rank: 'archon', github_login: 'theowner' },
+    patchResult = null,
+  } = opts;
+
+  const requests = [];
+  const toasts = [];
+  const prompts = [];
+
+  const api = {
+    async request(method, p, init) {
+      const body = init && init.body;
+      requests.push({ method, path: p, body });
+      const route = String(p).replace('/api/bongos', '').split('?')[0];
+      if (method === 'GET' && route === '/me') return ok({ builder: me });
+      if (method === 'GET' && route === '/builders/roster') return ok({ builders });
+      if (method === 'PATCH' && route.startsWith('/builders/')) {
+        return patchResult || ok({ builder: { id: route.split('/')[2] } });
+      }
+      // Every other panel on this page loads independently and degrades on its
+      // own; an unscripted shape is exactly the failure `section` swallows.
+      return ok({});
+    },
+  };
+
+  const documentObj = {
+    readyState: 'complete',
+    body: makeEl('body'),
+    documentElement: makeEl('html'),
+    createElement: (tag) => makeEl(tag),
+    getElementById(id) { return this.body.querySelector(`#${id}`); },
+    querySelector(sel) { return this.body.querySelector(sel); },
+    querySelectorAll(sel) { return this.body.querySelectorAll(sel); },
+    addEventListener() {},
+  };
+  parseInto(documentObj.body, PAGE);
+
+  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search: '', hash: '', assign() {} };
+
+  const kit = {
+    makeTabs: () => ({}),
+    // A ledger that REALLY renders: the whole question here is which row got
+    // which cell, and a no-op render answers none of it.
+    makeLedger: ({ mount, columns, rowHtml }) => ({
+      render(rows) {
+        mount.innerHTML =
+          '<table class="ledger"><thead><tr>' +
+          columns.map((c) => `<th>${escapeHtml(typeof c === 'string' ? c : c.label)}</th>`).join('') +
+          '</tr></thead><tbody>' + rows.map((r) => rowHtml(r)).join('') + '</tbody></table>';
+      },
+    }),
+    makePager: () => ({ page: 1, perPage: 25 }),
+    emptyStateHtml: (msg) => `<div class="empty-state"><p>${escapeHtml(msg)}</p></div>`,
+    makeFilterBar: (o) => { o.mount.innerHTML = '<div class="filters"></div>'; return { el: o.mount, values: () => ({}) }; },
+  };
+
+  const windowObj = {
+    __BRANDING__: { project: { joinability: 'apply' } },
+    OTB: {
+      escapeHtml,
+      $: (sel) => documentObj.querySelector(sel),
+      num: (v) => Number(v),
+      fmtInt: (n) => String(n),
+      fmtCompact: (n) => String(n),
+      fmtDate: (iso) => String(iso).slice(0, 10),
+      rankLabel,
+      toast: (m) => toasts.push(m),
+    },
+    OTBKit: kit,
+    OTBBranding: { currencyLabel: () => 'Credits' },
+    BongosClient: { createClient: () => api },
+    location: locationObj,
+    prompt: (msg) => { prompts.push(msg); return 'left for a new job'; },
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: locationObj,
+    console: { log() {}, warn() {}, error() {} },
+    setTimeout, clearTimeout, Promise, Date, Math, JSON, Error, isNaN,
+    Number, String, Object, Array, Boolean, Set, Map, RegExp,
+    encodeURIComponent, decodeURIComponent, parseInt, parseFloat,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'watch.js' });
+  await settle();
+
+  const rosterBody = () => documentObj.getElementById('roster-body');
+  const rows = () => rosterBody().querySelectorAll('tr').filter((tr) => tr.querySelectorAll('td').length);
+  const rowFor = (login) => rows().find((tr) => tr.querySelectorAll('td')[0].textContent.includes('@' + login));
+  const patches = () => requests.filter((r) => r.method === 'PATCH');
+  const footText = () => rosterBody().querySelectorAll('p').map((p) => p.textContent).join(' ');
+
+  return { requests, toasts, prompts, documentObj, rosterBody, rows, rowFor, patches, footText, settle };
+}
+
+const cells = (tr) => tr.querySelectorAll('td');
+
+// ===========================================================================
+// 1. The viewer's own row offers neither control.
+// ===========================================================================
+
+await test('the viewer\'s own row renders no Offboard button', async () => {
+  const h = await boot();
+  const mine = h.rowFor('theowner');
+  assert.ok(mine, 'the roster did not render the viewer\'s own row');
+  assert.equal(mine.querySelectorAll('[data-roster-status]').length, 0,
+    'the viewer\'s own row still carries a status button the server refuses outright');
+});
+
+await test('the viewer\'s own row renders no rank select', async () => {
+  const h = await boot();
+  const mine = h.rowFor('theowner');
+  assert.equal(mine.querySelectorAll('[data-roster-rank]').length, 0,
+    'the viewer\'s own row still carries a rank select the server refuses outright');
+});
+
+await test('the own row still SHOWS the rank and says whose row it is', async () => {
+  const h = await boot();
+  const c = cells(h.rowFor('theowner'));
+  assert.equal(c[1].textContent.trim(), 'Owner', 'the own row lost the rank it should still state');
+  assert.match(c[6].textContent, /you/i, 'the own row\'s action cell says nothing about why it is empty');
+});
+
+// ===========================================================================
+// 2. Every OTHER row keeps both controls — the fix must not disarm the roster.
+// ===========================================================================
+
+await test('every other row keeps its Offboard / Reactivate button', async () => {
+  const h = await boot();
+  for (const login of ['alpha', 'gamma', 'delta']) {
+    const tr = h.rowFor(login);
+    assert.equal(tr.querySelectorAll('[data-roster-status]').length, 1,
+      `row @${login} lost its status control`);
+  }
+  // The inactive builder offers the OTHER verb, as before.
+  assert.equal(h.rowFor('delta').querySelector('[data-roster-status]').getAttribute('data-roster-status'), 'active');
+  assert.equal(h.rowFor('alpha').querySelector('[data-roster-status]').getAttribute('data-roster-status'), 'inactive');
+});
+
+await test('every other row keeps its rank select', async () => {
+  const h = await boot();
+  for (const login of ['alpha', 'gamma', 'delta']) {
+    assert.equal(h.rowFor(login).querySelectorAll('[data-roster-rank]').length, 1,
+      `row @${login} lost its rank select`);
+  }
+});
+
+await test('another builder\'s Offboard still reaches the route', async () => {
+  const h = await boot();
+  const btn = h.rowFor('gamma').querySelector('[data-roster-status]');
+  // The roster DELEGATES: the listener is on #roster-body, not on the button, so
+  // a list that pages cannot strand a row without one. The DOM stub's fire()
+  // does not bubble, so firing on the button reaches nothing — dispatch on the
+  // section and name the button as the target, the way a real click arrives.
+  h.rosterBody().fire('click', { target: btn });
+  await h.settle();
+  const p = h.patches();
+  assert.equal(p.length, 1, `expected one PATCH, got ${p.length}`);
+  assert.match(p[0].path, /\/builders\/92\/status$/);
+  assert.equal(p[0].body.status, 'inactive');
+  assert.equal(p[0].body.reason, 'left for a new job', 'the offboarding reason was dropped');
+  assert.equal(h.prompts.length, 1, 'the reason prompt no longer runs');
+});
+
+// ===========================================================================
+// 3. The foot line says why, in the pack's own words.
+// ===========================================================================
+
+await test('a foot line under the roster explains the empty row', async () => {
+  const h = await boot();
+  assert.match(h.footText(), /your own row carries no controls/i,
+    'nothing under the roster explains why one row has no controls');
+});
+
+await test('the foot line names the rank from the pack, never a hardcoded "Archon"', async () => {
+  const h = await boot();
+  const foot = h.footText();
+  assert.match(foot, /Owner/, 'the foot line does not name the rank through rankLabel()');
+  assert.ok(!/archon/i.test(foot), `the foot line hardcodes a rank word: ${foot}`);
+});
+
+await test('no foot line when the viewer is not on the roster', async () => {
+  // A Metic reading the roster of a project they are not listed on: there is no
+  // own row, so there is nothing to explain.
+  const h = await boot({ builders: ROSTER.filter((b) => b.id !== VIEWER_ID) });
+  assert.ok(!/your own row/i.test(h.footText()), 'the foot line rendered with no own row on the table');
+});
+
+// ===========================================================================
+// 4. Degrade: an unidentifiable viewer must not mark the WRONG row.
+// ===========================================================================
+
+await test('no id from /me leaves every row exactly as it was', async () => {
+  const h = await boot({ me: { rank: 'archon', github_login: 'theowner' } });
+  assert.equal(h.rows().length, ROSTER.length);
+  for (const b of ROSTER) {
+    assert.equal(h.rowFor(b.github_login).querySelectorAll('[data-roster-status]').length, 1,
+      `row @${b.github_login} was disarmed although the viewer could not be identified`);
+  }
+  assert.ok(!/your own row/i.test(h.footText()));
+});
+
+await test('the match is by value, not by type — a numeric id still matches', async () => {
+  // node-postgres hands bigints back as TEXT, so /me may answer with a string
+  // where the roster answers with a number (or the reverse). A `===` comparison
+  // here is the same bug the /rank route's own guard was fixed for in #348.
+  const h = await boot({
+    me: { id: 1, rank: 'archon', github_login: 'theowner' },
+    builders: ROSTER.map((b) => (b.id === VIEWER_ID ? { ...b, id: '1' } : b)),
+  });
+  assert.equal(h.rowFor('theowner').querySelectorAll('[data-roster-status]').length, 0,
+    'a numeric /me id did not match the roster\'s string id — the own row is armed again');
+});
+
+summary('watch roster — the viewer\'s own row');