@bongos/core 1.19.714 → 1.19.724

package/modules/hall-ui/public/watch.css

@@ -21,6 +21,12 @@
 /* Row actions inside a ledger cell: ghost pills in a row. */
 .watch-actions { display: flex; gap: 6px; flex-wrap: wrap; align-items: center; }
 
+/* The reader's own roster row (task 1003720). Nobody may change their own rank
+   or standing — the server refuses both outright — so that row states a fact
+   where the others carry a control, and a fact is written in the faint ink, not
+   painted as a disabled pill. The foot line under the table says why. */
+.watch-self { color: var(--ink-faint); }
+
 /* A sealed or failed section says so in place. Three states, three sentences:
    "nothing here" is the kit's empty state, this is "you may not see this" and
    "could not load". */

package/modules/hall-ui/public/watch.js

@@ -745,6 +745,13 @@
   // sits at a rank outside this set, we inject it so the select still shows it.
   const RANK_OPTIONS = ['xenos', 'thetes', 'metic', 'archon'];
 
+  // Who is reading this roster (task 1003720). `load()` already fetches /me to
+  // resolve the page's floor and then threw the id away, so the roster — which
+  // returns EVERY builder, the viewer included — could not tell which row was
+  // the reader's own. See renderRoster for why that mattered.
+  let viewerId = null;
+  const isViewer = (b) => viewerId != null && b && b.id != null && String(b.id) === String(viewerId);
+
   function renderRoster(data, target) {
     const builders = Array.isArray(data.builders) ? data.builders : [];
     setAttention('att-stale', builders.filter((b) => b.stale_claim).length);
@@ -762,16 +769,39 @@
       ],
       pager: makePager('watch-roster', 'otb.watch.rosterPerPage'),
       rowHtml: (b) => {
+        // THE VIEWER'S OWN ROW OFFERS NOTHING (task 1003720, re-filed from 1002951
+        // — "I cannot press offboard", reported by the owner from Discord).
+        //
+        // The roster returns every builder, so the reader's own row is in it. Both
+        // routes behind that row refuse a self-change OUTRIGHT and always will:
+        // PATCH /builders/:id/rank answers cannot_change_own_rank and
+        // /builders/:id/status answers cannot_change_own_status — the guard that
+        // stops the last Archon demoting or offboarding themselves and locking
+        // everyone out. The row painted a live rank <select> and a live Offboard
+        // pill anyway, so from the owner's seat the page carried a control that
+        // could only ever answer with a raw refusal slug in a toast. That is what
+        // "I cannot press offboard" describes.
+        //
+        // This is not a SOFT gate (the primer's acknowledge control, which opens
+        // once you have read enough and so stays in the tab order as
+        // aria-disabled) — it is an action that can never open for this reader.
+        // So the row renders no control at all and the section's foot line says
+        // why, rather than painting a dead one.
+        const self = isViewer(b);
         const opts = RANK_OPTIONS.slice();
         if (b.rank && !opts.includes(b.rank)) opts.unshift(b.rank);
-        const rankSelect =
-          `<select data-roster-rank data-id="${escapeHtml(b.id)}" data-current="${escapeHtml(b.rank || '')}" aria-label="Rank">` +
-          opts.map((rk) => `<option value="${escapeHtml(rk)}"${rk === b.rank ? ' selected' : ''}>${escapeHtml(rankLabel(rk))}</option>`).join('') +
-          '</select>';
+        const rankCell = self
+          ? `<span class="watch-self">${escapeHtml(rankLabel(b.rank))}</span>`
+          : `<select data-roster-rank data-id="${escapeHtml(b.id)}" data-current="${escapeHtml(b.rank || '')}" aria-label="Rank">` +
+            opts.map((rk) => `<option value="${escapeHtml(rk)}"${rk === b.rank ? ' selected' : ''}>${escapeHtml(rankLabel(rk))}</option>`).join('') +
+            '</select>';
         const isInactive = String(b.status) === 'inactive';
         const statusBtn = isInactive
           ? ghost(`data-roster-status="active" data-id="${escapeHtml(b.id)}"`, 'Reactivate')
           : ghost(`data-roster-status="inactive" data-id="${escapeHtml(b.id)}"`, 'Offboard', true);
+        const actionCell = self
+          ? '<span class="watch-self">That\'s you</span>'
+          : `<div class="watch-actions">${statusBtn}</div>`;
         const claims = num(b.active_claim_count);
         const staleFlag = b.stale_claim ? ' <span class="badge badge--sev-medium">stale</span>' : '';
         // task 1467: the roster name links to the builder's public profile page.
@@ -784,17 +814,28 @@
           `<td>${rosterNameCell}` +
           (b.github_login ? ` <span class="ov-mono">@${escapeHtml(b.github_login)}</span>` : '') +
           '</td>' +
-          `<td>${rankSelect}</td>` +
+          `<td>${rankCell}</td>` +
           `<td class="num">${fmtInt(b.total_credits)}</td>` +
           `<td class="num">${fmtInt(b.karma)}</td>` +
           `<td class="num${b.stale_claim ? ' warn' : ''}">${fmtInt(claims)}${staleFlag}</td>` +
           `<td><span class="badge badge--status">${escapeHtml(b.status || '—')}</span></td>` +
-          `<td><div class="watch-actions">${statusBtn}</div></td>` +
+          `<td>${actionCell}</td>` +
           '</tr>'
         );
       },
     }).render(builders);
 
+    // The one asymmetry in the table, stated once under it rather than repeated
+    // on the row. Appended as an ELEMENT, not with `innerHTML +=`: re-parsing the
+    // body would drop the pager's own wiring. The rank is written from
+    // rankLabel(), never a hardcoded "Archon", so the floor cannot drift.
+    if (builders.some(isViewer)) {
+      const note = document.createElement('p');
+      note.className = 'ov-foot';
+      note.textContent = `Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last ${rankLabel('archon')} locking everyone out — so another ${rankLabel('archon')} does it.`;
+      target.appendChild(note);
+    }
+
     // Rank change via the <select>. Bespoke: a 'change' listener that rolls the
     // select back to its previous value on failure, delegated so a page flip
     // cannot strand a row without one.
@@ -1305,6 +1346,11 @@
       if (!res.ok) throw new Error(`me → ${res.status}`);
       const payload = res.data;
       builder = (payload && payload.builder) ? payload.builder : payload;
+      // Kept for the roster, which must know which row is the reader's own
+      // (task 1003720). Null when /me answered without one — isViewer then
+      // matches nothing, so the roster degrades to the old every-row-acts shape
+      // rather than marking the wrong row as yours.
+      viewerId = (builder && builder.id != null) ? builder.id : null;
     } catch (err) {
       console.error('[watch] failed to read viewer', err);
       $('#watch-sub').textContent = 'Could not verify your access. Go back and try again.';

package/modules/lifecycle/cascade.js

@@ -73,9 +73,13 @@
 //               'engineer'). This is the whole point of the mechanism: the
 //               discipline of the generated task is not the discipline of the
 //               ship that caused it.
-//   when(task)  a predicate over the shipped task row. Must be pure and total —
-//               a throw is caught and treated as "no match", because a broken
-//               predicate must not stop the other rules.
+//   when(task, ctx)  a predicate over the shipped task row and the run CONTEXT.
+//               Must be pure and total — a throw is caught and treated as "no
+//               match", because a broken predicate must not stop the other
+//               rules. `ctx` is the per-run policy the runner resolved (today:
+//               `{ artistGate }`), injected rather than read, so this file keeps
+//               its "importable with nothing behind it" property. A rule that
+//               does not care about policy simply ignores the second argument.
 //   title(task) / body(task)  the generated task's title and description.
 //   kind        optional task kind; must be one the classifier knows
 //               (task-classifier.VALID_KINDS). Defaults to 'unclassified' —
@@ -151,7 +155,14 @@ const CASCADES = Object.freeze([
     kind: 'unclassified',
     // The anti-recursion guard (source !== CASCADE_SOURCE) is FIRST so a
     // cascade-generated task is rejected before any other test runs.
-    when: (t) => t.source !== CASCADE_SOURCE && hasCopyOrVisualWork(t),
+    //
+    // The project's artist_gate at 'off' means "not generated" (ADR 0241 §2's
+    // table, task 1003575) — the one level at which this rule files nothing. It
+    // is read from ctx, never from branding, so the predicate stays pure; an
+    // absent ctx (a caller that resolved no policy) files, because the gate's
+    // default is 'strict' and silence must not be read as an opt-out.
+    when: (t, ctx) => (ctx || {}).artistGate !== 'off'
+      && t.source !== CASCADE_SOURCE && hasCopyOrVisualWork(t),
     title: (t) => `Artist review: the copy and visuals that shipped in task ${t.id}`,
     body: artistReviewBody,
   }),
@@ -201,13 +212,13 @@ function validateCascades(rules = CASCADES) {
 // ---------------------------------------------------------------------------
 
 // The task rows a shipped task cascades into. Pure: no database, no clock, no
-// side effect — hand it a task-shaped object and a rule table and it returns
-// the specs that would be filed.
+// side effect — hand it a task-shaped object, a rule table and the run's policy
+// context and it returns the specs that would be filed.
 //
 // A rule whose `when` THROWS is treated as no-match and reported in `errors`,
 // never propagated: one broken predicate must not cost the other rules their
 // tasks, and it certainly must not reach the ship.
-function cascadesFor(task, rules = CASCADES) {
+function cascadesFor(task, rules = CASCADES, ctx = {}) {
   const matched = [];
   const errors = [];
   if (!task || task.id == null) return { matched, errors: ['no task'] };
@@ -216,7 +227,7 @@ function cascadesFor(task, rules = CASCADES) {
     if (shape.length) { errors.push(`cascade "${rule && rule.key}": ${shape.join('; ')}`); continue; }
     let hit = false;
     try {
-      hit = rule.when(task) === true;
+      hit = rule.when(task, ctx) === true;
     } catch (e) {
       errors.push(`cascade "${rule.key}": when() threw (${e && e.message}) — treated as no match`);
       continue;
@@ -281,6 +292,14 @@ function cascadeTaskSpec(rule, task) {
 //                                       goal_id / version_id / discipline)
 //   deps.findTaskBySourceRef({...})  -> an existing row or null
 //   deps.createTask(spec)            -> the created row
+//   deps.artistGateMode()            -> 'off' | 'advisory' | 'strict' — the
+//                                       project's artist gate (ADR 0241). Injected
+//                                       so this file reads no branding pack; a
+//                                       reader that throws leaves the context key
+//                                       undefined, which FILES (the gate's own
+//                                       default is 'strict', and a policy read
+//                                       that failed must not silently behave like
+//                                       'off').
 //   deps.log                         -> optional { info, error }
 async function runCascadesForShip(shipped, deps = {}) {
   const report = { created: [], skipped: [], errors: [] };
@@ -292,7 +311,16 @@ async function runCascadesForShip(shipped, deps = {}) {
     const task = deps.getTask ? await deps.getTask(id) : null;
     if (!task) { report.errors.push(`cascade: task ${id} not readable after ship`); return report; }
 
-    const { matched, errors } = cascadesFor(task, deps.rules || CASCADES);
+    // The per-run policy context. Resolved once, outside the rule loop, and
+    // never allowed to cost the run: a reader that throws is reported and leaves
+    // the key undefined rather than suppressing every rule that consults it.
+    const ctx = {};
+    if (typeof deps.artistGateMode === 'function') {
+      try { ctx.artistGate = deps.artistGateMode(); }
+      catch (e) { report.errors.push(`cascade: artistGateMode() threw (${e && e.message}) — policy unread`); }
+    }
+
+    const { matched, errors } = cascadesFor(task, deps.rules || CASCADES, ctx);
     report.errors.push(...errors);
 
     for (const { rule, spec } of matched) {

package/modules/lifecycle/db-claims.js

@@ -94,8 +94,11 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
 
     // ADR 0120 part 3: the needs_rebase claim gate. A builder who owes a rebase
     // on any un-landed confirmed task (flagged by the reconciler, part 2) is
-    // blocked from taking on NEW work until they LAND it (rebase the branch +
-    // re-ship → reconciler) or RELEASE it — both clear the flag. Their
+    // blocked from taking on NEW work until they LAND it (`git merge origin/main`
+    // + re-ship — task 1002788: MERGE, never rebase, because the branch is already
+    // published and server-mediated publish is append-only, so rewriting it makes
+    // the task permanently un-landable while the gate keeps their queue shut)
+    // or RELEASE it — both clear the flag. Their
     // already-active claims are untouched (we only refuse fresh claims, never
     // freeze in-flight work). Since the reward now lands only on ship (part 1),
     // the builder is motivated to clear it; since it gates their queue, they

package/modules/lifecycle/db-goals.js

@@ -527,9 +527,10 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 // precedent). membershipKind defaults to 'member'.
 
 // THE COLUMN IS `membership_kind` (task 1003013, ADR 0177 — ADR 0174 reserves the
-// other word for the three crafts). The legacy column still EXISTS for one
-// release, kept in lockstep by core_220's trigger so a rolled-back deploy still
-// reads a schema it understands: write the new name only, step 2 drops the old.
+// other word for the three crafts). The rename is COMPLETE: core_240 (task
+// 1003089) dropped the legacy column and its lockstep trigger, and the new column
+// now carries NOT NULL + DEFAULT 'member' itself rather than resting on that
+// trigger. There is no second spelling left to keep in step.
 //
 // ARRIVING AS A MEMBER CLOSES ANY PENDING ASK (task 1002888 / idea 1000688).
 // The membership write used to be a bare upsert that never looked at

package/modules/lifecycle/db-overrides.js

@@ -19,15 +19,66 @@ const { mostRecentClaimHolderId } = require('./db-shared.js');
 // believes the grader was wrong and asks an Archon to confirm anyway.
 
 
+// THE SECOND THING AN OVERRIDE REQUEST CAN BE (task 1003575, ADR 0241 §3).
+//
+// The original request is a GRADER BYPASS: a `completed` task whose ship the
+// subagent panel rejected, flipped to `confirmed` and paid. ADR 0241 needed an
+// escape hatch for a different refusal — a deploy held by an unresolved artist
+// review — and was explicit that it must be "the mechanism that already exists…
+// no new machinery, no second authority path". So it is the SAME table, the same
+// request flow and the same decide endpoint; only the target class and the effect
+// of an approval differ.
+//
+// A GATE RELEASE differs from a grader bypass in three ways, and each one is the
+// reason it could not simply reuse the existing path unchanged:
+//
+//   • Its target is NOT at 'completed'. An artist review sits at `backlog` and
+//     usually always will — ADR 0241 guard #4 calls "a strict project with no
+//     artist" the normal case for a new instance. The completed-only check below
+//     would have made the one documented escape hatch unusable for the exact
+//     scenario it was written for.
+//   • Approving it CONFIRMS NOTHING AND PAYS NOTHING. A released review is still
+//     an open request on the board; what the release buys is that it stops
+//     holding the pin. Flipping it to `confirmed` and crediting it would pay for
+//     work nobody did and erase the request.
+//   • Only the PROJECT OWNER may decide it (§3, owner ruling: not the builder,
+//     not any Metic+, not the artist) — a narrower gate than the Archon floor the
+//     grader bypass carries, enforced here rather than only at the route so no
+//     second caller can widen it.
+//
+// Whether a task is in this class is asked of core's ONE artist-gate reader, so
+// "is this an unresolved artist review" has the same answer here, at the deploy
+// gate and in the cascade that files them.
+function gateReleaseTarget(taskRow) {
+  const gate = api.artistGate;
+  return gate.isArtistReview(taskRow) && !gate.isReviewResolved(taskRow);
+}
+
+// WHO is asked "who owns this project?" — and the answer is the doorway unless we
+// are demonstrably in a test. Same NODE_ENV gate as the `deps.pool` seam below,
+// and for a sharper version of its reason (#538): this reader decides who may
+// release a deploy-blocking review, so a future caller that forwarded an options
+// object carrying a `getFoundingBuilder` key — a batch decide path, a CLI helper,
+// a careless refactor — would otherwise silently swap out the owner check in
+// production. Pure over its inputs, so the gate itself is unit-testable without a
+// database (which the decide path, holding a transaction, is not).
+function resolveOwnerReader(deps = {}, env = process.env) {
+  return (typeof deps.getFoundingBuilder === 'function' && env.NODE_ENV === 'test')
+    ? deps.getFoundingBuilder
+    : api.getFoundingBuilder;
+}
+
+const OVERRIDE_TASK_COLUMNS = 'id, status, source, source_ref, merged_into_task_id';
+
 async function createOverrideRequest({ taskId, requesterId, rationale }) {
   const { rows: taskRows } = await pool.query(
-    `SELECT id, status FROM tasks WHERE id = $1`,
+    `SELECT ${OVERRIDE_TASK_COLUMNS} FROM tasks WHERE id = $1`,
     [taskId]
   );
   if (taskRows.length === 0) {
     throw Object.assign(new Error('task not found'), { code: 'TASK_NOT_FOUND' });
   }
-  if (taskRows[0].status !== 'completed') {
+  if (taskRows[0].status !== 'completed' && !gateReleaseTarget(taskRows[0])) {
     throw Object.assign(new Error('task not in completed state'), {
       code: 'TASK_NOT_COMPLETED',
       currentStatus: taskRows[0].status,
@@ -83,6 +134,30 @@ async function decideOverrideRequest({ requestId, archonId, decision, note }, de
   // (same pattern as credit_grant.mjs). Production callers omit it → module pool.
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   return withTx(async (client) => {
+    // Which KIND of override this is — decided from the target task, before the
+    // request row is touched, because the two classes differ in who may decide
+    // them and in what an approval does. See gateReleaseTarget above.
+    const { rows: targetRows } = await client.query(
+      `SELECT ${OVERRIDE_TASK_COLUMNS} FROM tasks
+         WHERE id = (SELECT task_id FROM task_override_requests WHERE id = $1)`,
+      [requestId]
+    );
+    const isGateRelease = targetRows.length > 0 && gateReleaseTarget(targetRows[0]);
+
+    // THE NARROWER GATE (ADR 0241 §3). The grader bypass admits any Archon; a
+    // gate release admits the PROJECT OWNER and nobody else — "not the builder,
+    // not any Metic+, and not the artist" is the owner's own wording, and the
+    // reason it is here rather than only at the route is that a second caller
+    // (a CLI, a future surface) would otherwise inherit the wider Archon floor.
+    if (isGateRelease) {
+      const owner = await resolveOwnerReader(deps)();
+      if (!owner || String(owner.id) !== String(archonId)) {
+        throw Object.assign(new Error('only the project owner may release an artist gate'), {
+          code: 'OVERRIDE_OWNER_ONLY',
+        });
+      }
+    }
+
     // RETURNING requested_by_builder_id so the approve path doesn't re-read the
     // row it just locked (#538): the work was the ORIGINAL REQUESTER's, and both
     // the credit AND the ship attribution must go to them.
@@ -102,7 +177,41 @@ async function decideOverrideRequest({ requestId, archonId, decision, note }, de
     const row = rows[0];
 
     let confirmResult = null;
-    if (decision === 'approve') {
+    let gateRelease = null;
+    if (decision === 'approve' && isGateRelease) {
+      // A RELEASE CONFIRMS NOTHING AND PAYS NOTHING. The approved request row IS
+      // the release — the deploy gate reads it and stops holding — and the review
+      // stays an ordinary open request on the board, because the work it asks for
+      // has not been done. Anything else here would pay for work nobody did.
+      //
+      // And it is NEVER QUIET (ADR 0241 §3). A self-release — the owner releasing
+      // a review filed against their own work, which on a solo instance is the
+      // normal case and is deliberately PERMITTED rather than impossible — is
+      // recorded as such, so the ledger shows who waved what through and why.
+      // The rationale already lives on the request row; this names the act.
+      const selfOverride = String(row.requested_by_builder_id) === String(archonId);
+      gateRelease = { taskId: String(row.task_id), selfOverride };
+      const writeAudit = deps.insertAuditLog || api.insertAuditLog;
+      // Best-effort: the release is durable in the request row, and losing the
+      // audit line must not roll back a decision the owner made. A failure here
+      // is loud in the logs rather than silent.
+      try {
+        await writeAudit({
+          builderId: archonId,
+          route: '/api/bongos/override-requests/:id/decide',
+          method: 'POST',
+          requestBodyRedacted: {
+            override_kind: 'artist_gate_release',
+            self_override: selfOverride,
+            task_id: String(row.task_id),
+            request_id: String(row.id),
+          },
+          responseStatus: 200,
+        });
+      } catch (e) {
+        api.logger('lifecycle').error(`[override] artist-gate release ${row.id}: audit write failed — ${e && e.message}`);
+      }
+    } else if (decision === 'approve') {
       // BOTH the credit AND the ship attribution (shipped_by, which drives the
       // builders' hall + peer-vote feed) go to the builder who actually DID the
       // work — the task's most-recent claim holder — never the approving Archon.
@@ -162,7 +271,7 @@ async function decideOverrideRequest({ requestId, archonId, decision, note }, de
       }
     }
 
-    return { request: row, confirmResult };
+    return { request: row, confirmResult, gateRelease };
   }, { pool: activePool });
 }
 
@@ -178,4 +287,8 @@ module.exports = {
   createOverrideRequest,
   decideOverrideRequest,
   listOverrideRequests,
+  // pure — exported so the release class and its authority seam can be asserted
+  // without a database (the decide path itself holds a transaction and cannot be)
+  gateReleaseTarget,
+  resolveOwnerReader,
 };

package/modules/lifecycle/db-tasks.js

@@ -1037,6 +1037,68 @@ async function updateTaskStatus(id, status) {
   await pool.query(`UPDATE tasks SET status = $2 WHERE id = $1`, [id, status]);
 }
 
+// The cascade-filed ARTIST REVIEW rows that are still open (ADR 0241, task
+// 1003575) — the state the deploy gate reads. Narrow projection on purpose: the
+// caller needs an id and a filing date to name what holds a deploy and to apply
+// the non-retroactivity cutoff, and nothing else belongs on that wire. The TITLE
+// is deliberately absent: it is builder-written text, nothing consumes it, and a
+// value that is safe as JSON today is an injection vector the first time a
+// surface renders it as HTML.
+//
+// THIS IS A PRE-FILTER, NOT THE RULE. The SQL narrows to "cascade artist reviews
+// that are not obviously finished"; the authoritative verdict — including ADR
+// 0241 §5's non-retroactivity cutoff — is src/bongos/artist-gate.js's pure
+// `unresolvedArtistReviews`, so the definition of "unresolved" lives in exactly
+// one place and a change to it cannot land in the JS and miss the SQL. The
+// pre-filter is deliberately the LOOSER of the two: a row it lets through is
+// re-judged, a row it drops is never seen again.
+//
+// The (source, source_ref) shape is the cascade's own (modules/lifecycle/
+// cascade.js `cascadeSourceRef`) and is passed IN rather than spelled here, so
+// this query cannot drift from the rule that files the rows.
+//
+// AN APPROVED OVERRIDE REQUEST IS A RELEASE (ADR 0241 §3, db-overrides.js): the
+// project owner has waved this review past, with a rationale and an audit line,
+// so it no longer holds a deploy. It is still an open request on the board — the
+// release buys the pin, not the work — which is why this is excluded HERE rather
+// than by changing the task's status.
+//
+// Indexed by `idx_tasks_source_ref` (core_240): without it this is a
+// sequential scan of `tasks` on a route any builder can call and every deploy
+// does call.
+//
+// THE CAP CANNOT WEAKEN THE GATE, and it is worth saying why rather than leaving
+// a reader to work it out. Every row this returns is a HOLDER — resolved and
+// released reviews are excluded in SQL — so a project with more open reviews than
+// the cap still gets a held verdict from the first one. What truncation can
+// affect is the COUNT in the refusal, so the caller is told when it happened
+// (`truncated`) and says "200+" rather than a number it cannot stand behind.
+// Oldest-first is the right order for the same reason: the cutoff is a date, so
+// the rows nearest the gate's own boundary are the ones kept.
+const ARTIST_REVIEW_SCAN_LIMIT = 200;
+
+async function listOpenArtistReviews({ source, refPrefix, resolvedStatuses = [], limit = ARTIST_REVIEW_SCAN_LIMIT } = {}) {
+  if (!source || !refPrefix) return { reviews: [], truncated: false };
+  const cap = Math.max(1, Math.min(1000, Number(limit) || ARTIST_REVIEW_SCAN_LIMIT));
+  const { rows } = await pool.query(
+    `SELECT id, status, source, source_ref, created_at, merged_into_task_id
+       FROM tasks t
+      WHERE t.source = $1
+        AND t.source_ref LIKE $2
+        AND t.merged_into_task_id IS NULL
+        AND NOT (t.status = ANY($3::text[]))
+        AND NOT EXISTS (
+              SELECT 1 FROM task_override_requests r
+               WHERE r.task_id = t.id AND r.status = 'approved')
+      ORDER BY t.created_at ASC
+      LIMIT $4`,
+    // cap + 1: one row past the cap is how "there are more" is learned without a
+    // second COUNT query that could disagree with the page it describes.
+    [source, `${refPrefix}%`, resolvedStatuses, cap + 1]
+  );
+  return { reviews: rows.slice(0, cap), truncated: rows.length > cap };
+}
+
 module.exports = {
   CREDITS_AWARDED_SUBQUERY,
   REWARD_SUGGESTION_CAP,
@@ -1047,6 +1109,7 @@ module.exports = {
   getTask,
   listActiveClaims,
   listClaimableTasks,
+  listOpenArtistReviews,
   listTasks,
   rankCrossDisciplineRecommendations,
   rewardGateAssignment,

package/modules/lifecycle/migrations/lifecycle_001_goal_first_leads.sql

@@ -1,7 +1,7 @@
 -- lifecycle_001_goal_first_leads.sql — backfill goal OWNERS into the member list
 -- (task 1735). The goal authority model: the OWNER is goals.created_by (fixed at
--- create, moved only by POST /goals/:id/transfer); goal_members.role 'lead' is
--- the MANAGER tier the hall renders. From now on db.createGoal inserts the
+-- create, moved only by POST /goals/:id/transfer); goal_members.membership_kind
+-- 'lead' is the MANAGER tier the hall renders. From now on db.createGoal inserts the
 -- creator's lead row atomically; this brings the goals created before that rule
 -- up to the same shape so owners appear in their own member lists.
 --
@@ -13,14 +13,22 @@
 -- Data-only (no schema change), idempotent (the upsert converges), and
 -- replay-safe on a fresh DB (zero goals → zero rows; no builder id is
 -- hard-coded — learning 1238).
+--
+-- THE COLUMN IS `membership_kind` (task 1003089, ADR 0177). This file wrote the
+-- legacy `role` until core_240 dropped it, and it is the reason that DROP was not
+-- a pure deletion: module migrations run AFTER the core ones on every fresh
+-- install, so a stale name here would have broken `cloudbongos init` for new
+-- instances while staying invisible on existing ones (already recorded in
+-- `schema_migrations`, so never re-run). Zero-row on a fresh DB, but a missing
+-- column is a plan-time error, not a row-time one.
 
 BEGIN;
 
-INSERT INTO goal_members (goal_id, builder_id, role)
+INSERT INTO goal_members (goal_id, builder_id, membership_kind)
 SELECT g.id, g.created_by, 'lead'
   FROM goals g
  WHERE g.created_by IS NOT NULL
-ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = 'lead';
+ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = 'lead';
 
 INSERT INTO schema_migrations (version) VALUES ('lifecycle_001_goal_first_leads')
   ON CONFLICT (version) DO NOTHING;

package/modules/lifecycle/module.json

@@ -25,7 +25,8 @@
       "visuals",
       "kickoff-seed",
       "rot",
-      "project-settings"
+      "project-settings",
+      "artist-gate"
     ],
     "pollers": [
       "publish-reconciler"

package/modules/lifecycle/pg-constraint-fail.js

@@ -0,0 +1,49 @@
+// modules/lifecycle/pg-constraint-fail.js — turn a Postgres CHECK violation into a
+// 400 that names the constraint, instead of an opaque 500 (task 1002845).
+//
+// WHY. A range the route validator accepts but the DB CHECK rejects is a
+// self-inflicted wound: the INSERT raises SQLSTATE 23514, the generic catch logs
+// it server-side and answers `create_failed` / "internal error", and the caller —
+// an agent, usually — has no idea which field was wrong. Idea 1000456 records
+// roughly four blind retries spent on exactly that during task 1604, and task
+// 1002845 measured it still happening: POST /tasks {manual_degree:0} → 500
+// "internal error".
+//
+// The first fix is always to make the validator match the DB so the INSERT never
+// sees a bad value (task 1233 did that for `priority`; task 1002845 for
+// `manual_degree`). This is the BACKSTOP for the next mismatch nobody has found
+// yet — it cannot know which field is at fault, but the constraint name says so.
+//
+// WHAT IS SAFE TO ECHO. `err.constraint` only — a schema identifier the operator
+// wrote, carrying no request or row data. NEVER `err.detail`: Postgres puts the
+// offending ROW VALUES in it ("Failing row contains (1, secret, ...)"), so echoing
+// it would leak other columns of the caller's own record into an error body, and
+// on a shared instance potentially values the caller never sent.
+
+'use strict';
+
+// Postgres SQLSTATE for a CHECK constraint violation.
+const CHECK_VIOLATION = '23514';
+
+// describeCheckViolation(err) → { code, status, message, details } | null
+//
+// Pure. Returns null for anything that is not a CHECK violation, so a caller can
+// use it as a guard and fall through to its existing generic handling.
+function describeCheckViolation(err) {
+  if (!err || err.code !== CHECK_VIOLATION) return null;
+  const constraint = typeof err.constraint === 'string' && err.constraint.trim()
+    ? err.constraint.trim()
+    : null;
+  return {
+    code: 'constraint_violation',
+    status: 400,
+    message: constraint
+      // Deliberately does not guess WHICH field: one CHECK can span several
+      // columns, and naming the wrong one is worse than naming none.
+      ? `a value in this request violates the database constraint "${constraint}" — check the field it guards against the accepted range`
+      : 'a value in this request violates a database constraint',
+    details: { constraint },
+  };
+}
+
+module.exports = { describeCheckViolation, CHECK_VIOLATION };