@bongos/core 1.19.773 → 1.19.774

package/scripts/gds/ship-finish.js

@@ -10,7 +10,7 @@
 
 const fs = require('node:fs');
 const os = require('node:os');
-const { cliClient, printOnboardingNudge, rewardPolicy } = require('./cli-lib');
+const { cliClient, printOnboardingNudge, rewardPolicy, cardFlagsFromMe } = require('./cli-lib');
 const { closeoutPlan } = require('../../modules/lifecycle/ship-preflight');
 const { syncMemoryOnShip } = require('./ship-memory-sync.js');
 const { uploadSessionOnShip } = require('./ship-session-upload.js');
@@ -264,17 +264,18 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
       commit = (v && v.commit) ? String(v.commit).slice(0, 7) : (gitOk('git rev-parse --short HEAD') || null);
     }
 
-    // Running drachmae total + the builder's render-widgets knob (task 1279),
-    // both from one /me fetch (best-effort).
+    // Running drachmae total + the builder's card-richness level (task 1279's
+    // knob, a ladder since task 1002518), both from one /me fetch (best-effort).
     let total = null;
-    let widgetsEnabled = true;
+    let cardFlags = cardFlagsFromMe(null);
     try {
       const me = noteServerReward(await (await cliClient()).me.getMe());
       if (me.ok && me.data) {
         if (me.data.builder) total = me.data.builder.total_credits;
-        if (me.data.render) widgetsEnabled = me.data.render.widgets_enabled !== false;
+        cardFlags = cardFlagsFromMe(me);
       }
-    } catch (_) { /* total + knob are optional; default widgets on */ }
+    } catch (_) { /* total + knob are optional; default to the standard rung */ }
+    const widgetsEnabled = cardFlags.showWidget;
 
     // Token count + estimated cost from the session usage. Split the tokens into
     // 'new' (fresh input + output + first-time cache writes) vs 'cached' re-reads
@@ -328,9 +329,12 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
     // Print the monospace card + write the branded HTML for the in-feed renderer
     // (shared emitCard, task 1275). The skill reads the printed path and passes
     // the contents to the visualization tool — the agent authors nothing, so the
-    // card is identical every ship. task 1279: when the builder has widgets off,
-    // emitCard prints only the monospace card (no HTML written or relayed).
-    shipCard.emitCard(model, taskId, { widgetsEnabled });
+    // card is identical every ship. task 1002518: the resolved richness level
+    // reaches emitCard as flags — at the plain rung no HTML is written or
+    // relayed, at the minimal rung not even the monospace card is printed (the
+    // guaranteed [otb-confirm] line always is), and at the rich rung the
+    // widget's summary arrives already open.
+    shipCard.emitCard(model, taskId, { flags: cardFlags });
 
     // task 1687: in CI deploy mode this card is 'confirmed — landing' and the real
     // confirmed->shipped land happens minutes later, server-side — so the SHIPPED
@@ -338,7 +342,10 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
     // land-watch hook renders the shipped card on a later prompt once it lands.
     // Best-effort: a breadcrumb must never fail a ship (mirrors the card itself).
     if (postGradeStatus === 'confirmed') {
-      try { require('./land-watch').writeBreadcrumb(taskId, { widgetsEnabled, cardInputs }); }
+      // `cardFlags` carries the resolved rung so the later-rendered shipped card
+      // matches the one this session printed; `widgetsEnabled` stays beside it
+      // so a breadcrumb written by an older CLI still reads correctly.
+      try { require('./land-watch').writeBreadcrumb(taskId, { widgetsEnabled, cardFlags, cardInputs }); }
       catch (_) { /* breadcrumb is best-effort */ }
     }
   } catch (_) {

package/scripts/gds/ship-flow.js

@@ -8,7 +8,7 @@
 
 'use strict';
 
-const { cliClient, requireSession, arg, detectWorktreeName } = require('./cli-lib');
+const { cliClient, requireSession, arg, detectWorktreeName, cardFlagsFromMe } = require('./cli-lib');
 const { resolveProse, markShipProgress, smokeGateMessages, proseFlagPresent, regradeNotesRefusal } = require('./ship-honesty.js');
 const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
 const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-map');
@@ -342,10 +342,10 @@ async function shipMain() {
           removed,
           sandboxUrl: sandboxGate.url,
         });
-        // task 1279: honour the builder's render-widgets knob (from the /me
-        // fetched at the top of shipMain; default ON if absent/older server).
-        const widgetsEnabled = me?.data?.render?.widgets_enabled !== false;
-        shipCard.emitCard(model, taskId, { widgetsEnabled });
+        // task 1279 / 1002518: honour the builder's card-richness level (from the
+        // /me fetched at the top of shipMain; the standard rung if absent, and
+        // the boolean's old meaning against an older server).
+        shipCard.emitCard(model, taskId, { flags: cardFlagsFromMe(me) });
       } catch (_) { /* the review pause stands with or without the card */ }
       // #1061 polish: a sandbox review pause is a DELIBERATE, expected
       // checkpoint — not a failed ship. printReviewBlock already showed the URL

package/scripts/gds/start.js

@@ -67,7 +67,7 @@ const { checkTree: _checkTree } = require('./tree-preflight.js');
   if (_fault) { console.error(_fault); process.exit(1); }
 }
 
-const { cliClient, requireSession, fmtUsd, printOnboardingNudge, printCostWarning, printNeedsNudge, hallBase, API_BASE, rewardPolicy, costPlusOnlyNote, isDispatcherIncompatError } = require('./cli-lib');
+const { cliClient, requireSession, fmtUsd, printOnboardingNudge, printCostWarning, printNeedsNudge, hallBase, API_BASE, rewardPolicy, costPlusOnlyNote, isDispatcherIncompatError, cardFlagsFromMe } = require('./cli-lib');
 const { contextPack, formatContextPackCompact } = require('./context-pack');
 const { depsFinding } = require('./preflight');
 
@@ -782,12 +782,18 @@ async function main() {
   }
 
   // ---------- widget (HTML for the app renderer) ----------
-  // task 1279: the per-builder "render widgets" knob. When a builder turns
-  // widgets off, even an explicit --widget request degrades to the markdown card
-  // below — so no HTML is emitted, read, or re-relayed (a real token saving, not
-  // just a visual change). Default ON; /me carries the resolved boolean. Headless
-  // /cron callers don't pass --widget at all (no renderer), so they're unaffected.
-  const widgetsPref = me.ok ? (me.data?.render?.widgets_enabled !== false) : true;
+  // task 1279 / 1002518: the per-builder card-richness level. Below the widget
+  // rung, even an explicit --widget request degrades to the markdown card below
+  // — so no HTML is emitted, read, or re-relayed (a real token saving, not just
+  // a visual change). /me carries the resolved level; an older instance carries
+  // only the boolean and cardFlagsFromMe reads either. Headless/cron callers
+  // don't pass --widget at all (no renderer), so they're unaffected.
+  //
+  // The `minimal` rung lands on the markdown card here rather than on nothing:
+  // the lifecycle card has a guaranteed one-line confirmation to fall back to,
+  // and this card — the list of what you can claim — has no such floor. Dropping
+  // it would leave a session opening with no answer to the question it asked.
+  const widgetsPref = me.ok ? cardFlagsFromMe(me).showWidget : true;
   if (widget && widgetsPref) {
     const myClaims = me.ok ? (me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : [])) : [];
     // Private warnings (budget / onboarding next-stage) → stderr, so stdout

package/src/bongos/auth-admission.js

@@ -46,12 +46,13 @@ function membershipKind({ githubLogin } = {}) {
 // Best-effort server-to-server membership check-in to the hub (ADR 0141 §3): "this
 // github_id builds on project <client_id>, coarse membership <membership_kind>".
 //
-// BOTH SPELLINGS GO ON THE WIRE FOR THE WINDOW (task 1003090). The receiver is the
-// HUB, a different instance on its own upgrade schedule: send only the new field and
-// an un-upgraded hub silently defaults every membership to non-owner (it would drop
-// the owner flag); send only the legacy field and an upgraded hub keeps translating
-// forever. Sending both is what makes the two ends independent — the removal task
-// drops `role` once the hub is past the window. Runs on every
+// ONE SPELLING ON THE WIRE: `membership_kind` (task 1003090 renamed it; task 1003092
+// closed the cross-version window). During the window this sender wrote BOTH
+// spellings, because the receiver is the HUB — a different instance on its own
+// upgrade schedule — and new-field-only against an un-upgraded hub would have
+// silently dropped the owner flag. The hub has been past that release since core
+// 1.19.241 and no longer accepts the legacy field (its schema is strict), so
+// sending it again would turn every check-in into a 400. Runs on every
 // FEDERATED sign-in (the only sign-ins a federated instance has) so a CLI-only
 // project still appears in the builder's My Projects with no hub browser session.
 // Fire-and-forget + fully swallowed: a hub outage must NEVER fail a sign-in (mirrors
@@ -72,8 +73,6 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
         display_name: displayName ?? null,
         avatar_url: avatarUrl ?? null,
         membership_kind: kind,
-        // LEGACY (cross-version window): 'member' → 'builder' for an un-upgraded hub.
-        role: kind === 'member' ? 'builder' : kind,
       }),
     });
   } catch (err) {

package/src/bongos/auth-config.js

@@ -135,8 +135,9 @@ function idpConfigured() {
 //
 // 'member', not 'builder' (task 1003090, ADR 0177 §"the fifth use"): ADR 0174 reserves
 // `role` — and the craft name 'Builder' — for Artist / Ideator / Builder, so the coarse
-// project membership says what it means. The legacy spelling still goes on the wire for
-// the cross-version window; see reportMembershipCheckIn.
+// project membership says what it means. It is the only spelling on the wire — the
+// cross-version window that carried the legacy one closed under task 1003092; see
+// reportMembershipCheckIn.
 
 module.exports = {
   SCOPE,

package/src/bongos/goal-scope-check.js

@@ -11,8 +11,11 @@
 //
 //   1. SCOPE-SUBSET — every `touches[]` element must be CONTAINED WITHIN the
 //      goal's territory (the union of its modules' globs, resolved via
-//      module-scope-map G01). This bounds *everyone*, regardless of rank: a goal
-//      member can only author work inside the goal's modules.
+//      module-scope-map G01) or in SHARED_GLOBS, the small set of roots no module
+//      can honestly own that every task legitimately writes (`tests/` — see the
+//      SHARED territory block in module-scope-map.js, task 1003655 / ADR 0288).
+//      This bounds *everyone*, regardless of rank: a goal member can only author
+//      work inside the goal's modules, plus that shared floor.
 //
 //   2. PROTECTED-PATH — a sub-Metic member (xenos/thetes) may not author a task
 //      touching the permission/ship-grade/deploy/migration core, even when that
@@ -37,7 +40,7 @@
 'use strict';
 
 const { matchOne } = require('./path-match');
-const { globsForModules } = require('./module-scope-map');
+const { globsForModules, SHARED_GLOBS } = require('./module-scope-map');
 const { checkPermissionPaths } = require('./permission-path-check');
 
 function clean(arr) {
@@ -54,13 +57,25 @@ function isCovered(touch, goalGlobs) {
   return matchOne(touch, goalGlobs || []) !== null;
 }
 
-// Wall 1 — scope subset. Pure: { ok, out_of_scope[], goal_globs[] }.
-// `ok` is true iff every cleaned touch is covered by the goal's resolved globs.
-// An empty/unknown module set resolves to zero globs → nothing is covered.
+// Wall 1 — scope subset. Pure: { ok, out_of_scope[], goal_globs[], shared_globs[] }.
+// `ok` is true iff every cleaned touch is covered by the goal's resolved globs OR
+// by the shared floor. An empty/unknown module set resolves to zero goal globs.
+//
+// `goal_globs` stays the MODULE-resolved set only — the shared floor is reported
+// separately and never folded in. check()'s unknown_scope guard tests
+// `goal_globs.length === 0`, so mixing the always-present shared globs into it
+// would make a goal scoped to nothing but garbage resolve to a non-empty
+// territory and slip past that fail-closed edge.
 function scopeSubset(goalScopeModules, touches) {
   const goalGlobs = globsForModules(clean(goalScopeModules));
-  const outOfScope = clean(touches).filter((p) => !isCovered(p, goalGlobs));
-  return { ok: outOfScope.length === 0, out_of_scope: outOfScope, goal_globs: goalGlobs };
+  const outOfScope = clean(touches)
+    .filter((p) => !isCovered(p, goalGlobs) && !isCovered(p, SHARED_GLOBS));
+  return {
+    ok: outOfScope.length === 0,
+    out_of_scope: outOfScope,
+    goal_globs: goalGlobs,
+    shared_globs: [...SHARED_GLOBS],
+  };
 }
 
 // Wall 2 — the protected-path delegate. Thin wrapper over checkPermissionPaths

package/src/bongos/module-scope-map.js

@@ -388,6 +388,44 @@ const MODULE_GLOBS = {
   ],
 };
 
+// ---------------------------------------------------------------------------
+// SHARED territory — the globs EVERY goal's wall implicitly includes (task 1003655).
+//
+// MODULE_GLOBS answers "who OWNS this path". Some paths have no honest owner: a
+// shared root that every module writes into and none ships. `tests/` is the one
+// that mattered — 751 flat suites covering all ~24 modules, owned by no key — so
+// scopeSubset() denied EVERY touch under it. Since every real task adds a test,
+// the create gate (POST /goals/:id/tasks) refused any task that honestly declared
+// its own test file, whichever goal it was filed under. The wall only looked
+// passable because callers under-declared their touches[] (idea 1000816).
+//
+// The two fixes we did NOT take, and why:
+//   • Give `tests/` to a key (devsecops, methodology). That is a FALSE ownership
+//     claim — an ideas-module test is the ideas module's work, not devsecops' —
+//     and it would hand one goal's members the whole suite while denying it to
+//     everyone else, which is worse than the gap.
+//   • Enumerate per-module test paths. The suites are flat and named by feature,
+//     not by module, and the glob format has no wildcards to carve with; the list
+//     would rot on the next test file.
+//
+// So `tests/` is SHARED, not owned: inside every goal's wall, outside every
+// module's territory. That is sound because a test file is not a shipping
+// surface — nothing imports it, so its blast radius on another module is zero —
+// and the other two walls are untouched: claim collisions are still caught by
+// touchesOverlap, and the protected-path wall (below) runs independently.
+//
+// FAIL-CLOSED, like `protected`: the exported list is DERIVED, not trusted. A
+// shared glob is dropped if it overlaps PROTECTED_GLOBS, because a protected path
+// in here would widen every goal's wall into the trust core in one line. Adding
+// an entry is a deliberate design decision (ADR 0288) — the bar is "no module can
+// honestly own it AND every task legitimately writes it", which today is `tests/`
+// alone. Module-owned suites (modules/<key>/tests/) are already covered by their
+// module's glob and do NOT belong here.
+const SHARED_GLOBS_RAW = ['tests/'];
+const SHARED_GLOBS = Object.freeze(
+  SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], PROTECTED_GLOBS)),
+);
+
 // A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one
 // source of truth (permission-path-check.js). Prefix-aware both directions
 // (path-match.touchesOverlap), so e.g. a module owning 'src/bongos/routes/inbox.js'
@@ -451,6 +489,8 @@ function scopeIncludesProtected(keys) {
 module.exports = {
   MODULE_GLOBS,
   MODULE_SCOPE_MAP,
+  SHARED_GLOBS,
+  SHARED_GLOBS_RAW,
   isProtected,
   moduleKeys,
   isModuleKey,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.773'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.774'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/manifest-schema.js

@@ -45,6 +45,12 @@
 //                                       //   it may be enabled where anyone can sign up. src/modules.js
 //                                       //   refuses the enablement when the join door is `open` and no
 //                                       //   payer is configured.
+//     "declarativeSeams": {             // OPTIONAL. Per-entry exemptions for the seam-wiring
+//       "pollers": ["box-lifecycle"]    //   guard (task 1003819): "this contributes entry ships no
+//     },                                //   artifact ON PURPOSE". Every key must be a key the module
+//                                       //   actually declares in `contributes`, and every entry must be
+//                                       //   one it actually lists there — a typo'd exemption is an error,
+//                                       //   never a silent pass.
 //     "provides":      ["reward"],      // OPTIONAL. seam PORTS this module registers a provider for.
 //     "consumes":      ["grade"],       // OPTIONAL. seam ports this module resolves (required capabilities).
 //     "prerequisites": { "modules": ["economy"] },  // OPTIONAL. other modules that must be enabled.
@@ -117,6 +123,30 @@ const isWebSurface = (v) =>
   isObj(v) && isWebSurfaceDir(v) && (v.apexRoot === true ? !('host' in v) : isStr(v.host));
 const isWebSurfaceArray = (v) => Array.isArray(v) && v.every(isWebSurface);
 
+// The entries a module declares for one `contributes` seam, normalised to a list.
+// `migrations: true` is the one implicit entry (the modules/<key>/migrations/ dir);
+// every array seam yields its own entries; an empty array declares nothing.
+//
+// SINGLE SOURCE, deliberately. This pair lives here rather than in the seam-wiring
+// guard that also needs it (scripts/gds/seam-wiring-guard.js, task 1003819), because
+// "what entries does this contributes block declare, and what is each one called" is
+// schema knowledge — and two copies would be exactly the second list that drifts,
+// with the drift landing on the guard's exemption cross-check.
+function declaredEntries(seam, value) {
+  if (seam === 'migrations') return value === true ? [true] : (Array.isArray(value) ? value : []);
+  return Array.isArray(value) ? value : [];
+}
+
+// A declared entry's stable display name — what a declarativeSeams exemption names.
+// webSurfaces entries are objects and `migrations: true` is implicit, so neither is
+// its own label; everything else is already a string.
+function entryLabel(seam, entry) {
+  if (seam === 'migrations' && entry === true) return 'migrations/';
+  if (seam !== 'webSurfaces') return String(entry);
+  if (!isObj(entry)) return String(entry);
+  return entry.apexRoot === true ? `apexRoot:${entry.dir}` : `${entry.host}(${entry.dir})`;
+}
+
 function validateManifest(obj) {
   const errors = [];
   const E = (msg) => errors.push(msg);
@@ -206,6 +236,54 @@ function validateManifest(obj) {
     }
   }
 
+  // --- optional declarativeSeams (task 1003819) ---
+  // The exemption list for the seam-wiring guard: "this contributes entry ships no
+  // artifact on purpose". Some declarations are legitimately declarative-only —
+  // dev-box's `box-lifecycle` poller runs on the control plane, not in this process,
+  // and its `boxes` uiSection ships no hall widget — so the guard needs a way to say
+  // so without a blanket skip that would hide the real cases it exists to catch.
+  //
+  // Validated HERE, against `contributes`, because this is the one place that holds
+  // both: an exemption naming a seam the module does not declare, or an entry it does
+  // not list, is an ERROR rather than a no-op. A typo'd exemption that quietly
+  // validated would exempt nothing while reading as though it exempted something —
+  // the failure mode the closed key sets on `contributes`/`maintenance`/`spend` exist
+  // to prevent, in the direction that hides a defect. The guard itself (the on-disk
+  // artifact check, and whether an exemption has gone STALE because the artifact
+  // now exists) lives in scripts/gds/seam-wiring-guard.js, which needs the filesystem.
+  if ('declarativeSeams' in obj) {
+    const ds = obj.declarativeSeams;
+    if (!isObj(ds)) {
+      E('declarativeSeams: must be an object of { "<contributes seam>": ["<entry>", …] }');
+    } else {
+      const contributes = isObj(obj.contributes) ? obj.contributes : {};
+      for (const [seam, entries] of Object.entries(ds)) {
+        if (!ALLOWED_CONTRIBUTES.includes(seam)) {
+          E(`declarativeSeams.${seam}: unknown seam (allowed: ${ALLOWED_CONTRIBUTES.join(', ')})`);
+          continue;
+        }
+        if (!isStrArray(entries)) {
+          E(`declarativeSeams.${seam}: must be an array of non-empty strings`);
+          continue;
+        }
+        if (!(seam in contributes)) {
+          E(`declarativeSeams.${seam}: the module does not declare contributes.${seam} — an exemption for a seam it never contributes exempts nothing`);
+          continue;
+        }
+        // Compared against the LABELS, not the raw values, so the check spans every
+        // seam — webSurfaces declares objects and `migrations: true` is implicit, and
+        // an earlier cut that matched raw strings silently skipped both, letting
+        // `declarativeSeams: { webSurfaces: ['bogus'] }` validate clean.
+        const labels = declaredEntries(seam, contributes[seam]).map((e) => entryLabel(seam, e));
+        for (const entry of entries) {
+          if (!labels.includes(entry)) {
+            E(`declarativeSeams.${seam}: "${entry}" is not in contributes.${seam} (${labels.join(', ') || 'empty'}) — an exemption must name an entry the module actually declares`);
+          }
+        }
+      }
+    }
+  }
+
   // --- optional spend declaration (task 1003884) ---
   if ('spend' in obj) {
     const sp = obj.spend;
@@ -255,6 +333,6 @@ function assertValidManifest(obj, label = 'module.json') {
 }
 
 module.exports = {
-  validateManifest, assertValidManifest, KEY_RE, ALLOWED_CONTRIBUTES, ARRAY_OF_STRING_KEYS, ATTRIBUTION_KEYS,
+  validateManifest, assertValidManifest, declaredEntries, entryLabel, KEY_RE, ALLOWED_CONTRIBUTES, ARRAY_OF_STRING_KEYS, ATTRIBUTION_KEYS,
   MAINTENANCE_STATUSES, MAINTENANCE_KEYS, SUNSET_STATUSES,
 };

package/tests/catalog_only_client.mjs

@@ -227,14 +227,17 @@ test('mounting the projects routes registers the `project.catalog` port', async
   assert.ok(Object.isFrozen(catalog.projectCatalogPort), 'a consumer must not be able to re-point the port');
 });
 
-test('the port declares the catalog write, one presence read, and nothing else', () => {
-  // Two verbs, and the reason for the ceiling is unchanged: a consumer maps its own row onto
+test('the port declares the catalog write, one presence read, the disconnect delete, and nothing else', () => {
+  // Three verbs, and the reason for the ceiling is unchanged: a consumer maps its own row onto
   // the entry shape and asks about ORIGINS, so the catalog never learns another module's
   // schema and no module gets a general-purpose handle on these tables. `catalogued` arrived
   // with the backfill (task 1003581) because healing history without a presence read means
-  // re-writing every catalog row at every boot. Anything wider than these two is a new
-  // decision, and this list is where it has to be made.
-  assert.deepEqual(Object.keys(catalog.projectCatalogPort).sort(), ['catalogued', 'publish']);
+  // re-writing every catalog row at every boot. `forget` arrived with "Disconnect from Bongos
+  // entirely" (task 1003249, ADR 0290): a released name and address cannot leave a hidden row
+  // behind, and it takes the same {clientId, origin, ownerGithubId} a publish carries, under
+  // the same two claim rules. Anything wider is a new decision, and this list is where it has
+  // to be made.
+  assert.deepEqual(Object.keys(catalog.projectCatalogPort).sort(), ['catalogued', 'forget', 'publish']);
 });
 
 test('the module manifest DECLARES the port it registers', async () => {

package/tests/fitness.mjs

@@ -421,6 +421,28 @@ test('module-migrations-additive actually CATCHES destructive + non-namespaced D
   // but a BARE drop constraint (no matching re-add) is STILL destructive
   assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT (no re-add) must still be flagged');
 
+  // an ACKNOWLEDGED contract-phase column drop (task 1003092, ADR 0177's expand-then-
+  // contract) is the ONE destructive shape allowed: the file carries the same
+  // `-- forward-unsafe:` pragma lint-migrations.js requires, the statement is exactly
+  // one DROP COLUMN, and the table is the module's own.
+  const PRAGMA = '-- forward-unsafe: drop-column on dev_box_runs — the contract phase of a two-step rename\n';
+  const contract = fitness.moduleMigrationViolations('dev-box',
+    PRAGMA + 'ALTER TABLE dev_box_runs DROP COLUMN IF EXISTS note;\nALTER TABLE dev_box_runs ALTER COLUMN note2 SET NOT NULL;');
+  assert.deepEqual(contract, [], 'an acknowledged own-table DROP COLUMN must pass: ' + contract.join('; '));
+  // the pragma is per-STATEMENT permission for that one shape, not a per-file switch
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'DROP TABLE dev_box_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'TRUNCATE dev_box_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE dev_box_runs DROP COLUMN note, DROP COLUMN note2;').some((v) => /destructive/i.test(v)), 'a multi-clause drop is not the one allowed shape');
+  // and a column drop on a table OUTSIDE the namespace is refused twice over
+  const foreign = fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE builders DROP COLUMN note;');
+  assert.ok(foreign.some((v) => /destructive/i.test(v)), 'a core-table DROP COLUMN is still destructive under the pragma');
+  assert.ok(foreign.some((v) => /namespace/i.test(v)), 'and still a namespace violation');
+  // the real contract migration is the shape's first user — it must pass the REAL check
+  assert.equal(fitness.moduleMigrationViolations('platform-identity',
+    fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'migrations', 'platform_identity_021_drop_legacy_role.sql'), 'utf8')).length, 0,
+    'platform_identity_021 is the acknowledged contract phase and must be clean');
+
   // a created object outside the <key>_ namespace is rejected
   assert.ok(fitness.moduleMigrationViolations('dev-box', 'CREATE TABLE runs (id int);').some((v) => /namespace/i.test(v)), 'a table outside dev_box_ must be flagged');
   // a module migration altering a CORE table is rejected (reach core via the seam)

package/tests/goal_scope_check.mjs

@@ -18,7 +18,8 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const gsc = require('../src/bongos/goal-scope-check.js');
 const { touchesOverlap } = require('../src/bongos/path-match.js');
-const { globsForModules, isModuleKey, protectedModules } = require('../src/bongos/module-scope-map.js');
+const { PROTECTED_GLOBS: protectedGlobs } = require('../src/bongos/permission-path-check.js');
+const { globsForModules, isModuleKey, protectedModules, SHARED_GLOBS, SHARED_GLOBS_RAW } = require('../src/bongos/module-scope-map.js');
 
 let passed = 0;
 let failed = 0;
@@ -102,6 +103,67 @@ t('the subset does NOT use symmetric touchesOverlap (which would leak the broad
     'goal-scope-check must REJECT the broad touch despite the symmetric overlap');
 });
 
+// ---------- the shared floor: tests/ is inside EVERY wall (task 1003655) ----------
+//
+// `tests/` belongs to no module, and every real task adds a test — so before the
+// shared floor existed the create gate refused any task that honestly declared its
+// own test file, whichever goal it was filed under (idea 1000816). These cases pin
+// both halves: the floor is reachable from any scope, and it did not become a hole.
+
+t('shared floor: a test file passes under a goal scoped to an unrelated module', () => {
+  const r = gsc.check(['art-pipeline'], ['tests/idea_routing.mjs'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+  // and it is NOT because art-pipeline owns it — no module does.
+  assert.equal(gsc.isCovered('tests/idea_routing.mjs', globsForModules(['art-pipeline'])), false);
+});
+
+t('shared floor: sub-Metic too — the floor is scope, not rank (tests/ is unprotected)', () => {
+  assert.equal(gsc.check(['game'], ['tests/seats.mjs'], 'thetes').ok, true);
+});
+
+t('shared floor: the realistic mixed task — module code PLUS its own test', () => {
+  const r = gsc.check(['ideas'], ['modules/ideas/inbox.js', 'tests/idea_routing.mjs'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+});
+
+t('shared floor is reported separately and NEVER folded into goal_globs', () => {
+  // check()'s unknown_scope guard tests goal_globs.length === 0; folding the
+  // always-present shared globs in would give a garbage scope a non-empty
+  // territory and slip it past that fail-closed edge.
+  const s = gsc.scopeSubset(['art-pipeline'], ['tests/x.mjs']);
+  assert.equal(s.ok, true);
+  assert.deepEqual(s.shared_globs, ['tests/']);
+  assert.ok(!s.goal_globs.includes('tests/'), 'goal_globs must stay module-resolved only');
+  const garbage = gsc.scopeSubset(['not-a-real-module'], ['tests/x.mjs']);
+  assert.equal(garbage.goal_globs.length, 0, 'an unknown scope still resolves to zero territory');
+});
+
+t('shared floor does not defeat the other fail-closed edges', () => {
+  assert.equal(gsc.check(['not-a-real-module'], ['tests/x.mjs'], 'metic').code, 'unknown_scope');
+  assert.equal(gsc.check([], ['tests/x.mjs'], 'metic').code, 'empty_scope');
+  assert.equal(gsc.check(['art-pipeline'], [], 'metic').code, 'empty_touches');
+});
+
+t('shared floor is NARROW: it opens tests/ and nothing else', () => {
+  assert.deepEqual([...SHARED_GLOBS], ['tests/']);
+  // the sibling roots that DO have owners must still be walled to their owner
+  assert.equal(gsc.check(['art-pipeline'], ['.claude/skills/status/SKILL.md'], 'metic').code, 'out_of_scope');
+  assert.equal(gsc.check(['art-pipeline'], ['docs/adr/0288-x.md'], 'metic').code, 'out_of_scope');
+  assert.equal(gsc.check(['art-pipeline'], ['src/bongos/auth.js'], 'metic').code, 'out_of_scope');
+  // …and a lookalike sibling dir is not swept in by the name prefix
+  assert.equal(gsc.check(['art-pipeline'], ['tests-e2e/x.mjs'], 'metic').code, 'out_of_scope');
+});
+
+t('shared floor is DERIVED fail-closed: a protected glob could never take effect', () => {
+  // The exported list filters its own literal against PROTECTED_GLOBS, so a future
+  // edit adding e.g. 'migrations/' would drop out rather than widen every goal's
+  // wall into the trust core. Today the raw literal is already clean.
+  assert.deepEqual([...SHARED_GLOBS], SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], protectedGlobs)));
+  for (const g of SHARED_GLOBS) {
+    assert.equal(touchesOverlap([g], protectedGlobs), false, `shared glob ${g} overlaps the protected core`);
+  }
+});
+
 // ---------- fail-closed edges ----------
 
 t('empty-touches reject: a task with no touches[] cannot be scope-checked', () => {

package/tests/hall_settings_world.mjs

@@ -127,7 +127,11 @@ test('a toggle is a role=switch with aria-checked, and the page script keeps dat
   assert.match(fn[0], /data-on="\$\{on \? '1' : '0'\}"/, 'and data-on stays, because every delegated click handler reads it');
   assert.match(fn[0], /sw__track[\s\S]*sw__knob/, 'drawn as a track and a knob');
   assert.doesNotMatch(settingsJs, /aria-pressed/, 'no aria-pressed toggles are left on the page');
-  for (const fnName of ['renderSounds', 'renderRender', 'renderCrossProject', 'privacyRow']) {
+  // renderRender is deliberately absent: the Rendering panel stopped being a
+  // toggle in task 1002518 (four rungs, not on/off), so it became a radio group
+  // in settings-render.js — covered by the radio assertions and the wiring test
+  // below, not by the switch contract.
+  for (const fnName of ['renderSounds', 'renderCrossProject', 'privacyRow']) {
     const body = settingsJs.match(new RegExp(`function ${fnName}\\([\\s\\S]*?\\n  \\}\\n`));
     assert.ok(body && /switchHtml\(/.test(body[0]), `${fnName} renders the switch`);
   }
@@ -199,6 +203,58 @@ test('the interaction panel stays out of settings.js, which is against the size
   assert.ok(lines < 1500, `settings.js is ${lines} lines — at or over the 1500 ratchet; carve the next panel out too`);
 });
 
+// ---- the Rendering panel, carved out the same way (task 1002518) -----------
+//
+// Same two-file shape as the interaction panel above, and the same reason: the
+// knob became a four-rung ladder with a DERIVED default, which is more UI than
+// settings.js has room for. The extra fact this panel has to keep true is that
+// its "default" row explains itself — the default is computed from another
+// panel's answers, so a bare "default" tag would name a choice without naming
+// who made it.
+
+test('the rendering panel is wired end to end across its two files', () => {
+  const html = read('settings.html');
+  const panelJs = read('settings-render.js');
+
+  const section = html.match(/<section class="scroll" id="render-scroll"[^>]*>/);
+  assert.ok(section, 'the panel has a section');
+  assert.match(section[0], /data-group="preferences"/, 'it joins a group the rail already renders');
+  assert.match(section[0], /\bhidden\b/, 'hidden until its own read succeeds');
+  assert.match(html, /<script src="\/builders\/settings-render\.js/, 'the page loads the panel script');
+
+  assert.match(panelJs, /\$\('#render-scroll'\)\.hidden = false/, 'the script reveals its own section');
+  assert.match(panelJs, /setup\(\);/, 'it self-boots — settings.js does not call it');
+
+  // settings.js keeps ONLY the anchor entry.
+  assert.match(settingsJs, /'rendering': 'render-scroll'/, 'the deep-link anchor stays in settings.js');
+  assert.doesNotMatch(settingsJs, /function renderRender\(/, 'the renderer moved out and must not come back inline');
+  assert.doesNotMatch(settingsJs, /loadRender\(\)/, 'and settings.js no longer calls it');
+});
+
+test('the rendering panel is a radio group, wired on change, and can clear the override', () => {
+  const panelJs = read('settings-render.js');
+  const render = panelJs.match(/function render\([\s\S]*?\n  \}\n/);
+  assert.ok(render, 'render is a whole function');
+  assert.match(render[0], /<input class="pradio" type="radio" name="render-level"/, 'a real radio group');
+  assert.match(render[0], /<label class="prow prow--pick"/, 'the whole row is the radio\'s label');
+  const setup = panelJs.match(/async function setup\([\s\S]*?\n  \}\n/);
+  assert.match(setup[0], /addEventListener\('change'/, 'a radio fires change, not click');
+  assert.match(setup[0], /closest\('\.pradio'\)/);
+  // The sentinel row must send null, not a level: pinning the rung that happens
+  // to be derived today would silently stop tracking the interaction profile.
+  assert.match(panelJs, /widgets: value === USE_DEFAULT \? null : value/,
+    'choosing "match my profile" CLEARS the override rather than pinning a level');
+});
+
+test('the derived default explains itself, because it is computed elsewhere', () => {
+  // Unlike every other picker on the page, "default" here is not a constant —
+  // render-prefs.js derives it from the interaction profile. A row that said
+  // only "default" would name a choice the reader never made and cannot see.
+  const panelJs = read('settings-render.js');
+  assert.match(panelJs, /derived_reason/, 'the row states WHY the default landed where it did');
+  assert.match(panelJs, /derived_level/, 'and WHICH rung that is');
+});
+
 test('a default value is named once, by the API, not twice by the row', () => {
   // The first render read "Non-technical (default) · DEFAULT": interaction-prefs.js
   // already ends every default value's LABEL with "(default)", and the row also