@bongos/core 1.19.907 → 1.19.909

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.907",
-  "core_contract": "1.19.907",
-  "source_commit": "71cb07155a010b68421b31a9154436b140d5557d",
+  "core_version": "1.19.909",
+  "core_contract": "1.19.909",
+  "source_commit": "a378172e3f20f9432a63ee723274cb46acd87e5d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T13:52:16.387Z",
+  "built_at": "2026-09-20T14:45:23.165Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 502,
+    "docs_redacted": 503,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2283,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2811,
-  "tree_sha256": "b58d926d1a79850ef28b158610d628958dbbf0c143ba5327cabbcd5ad2f527d3",
+  "file_count": 2812,
+  "tree_sha256": "8f49b63378d69ecb4c8d7d3d6b4ad472ba735ba1ca96922843be33ff8d475d89",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2059,10 +2059,15 @@
       "mode": "0000644",
       "sha256": "9b301cd17f96c3f0b49010f046b994e112a5e1f971797964b836bc578578dd70"
     },
+    {
+      "path": "docs/adr/0314-module-protection-is-per-path-not-per-module.md",
+      "mode": "0000644",
+      "sha256": "541a0ae0223982fe53fcf96e3c4a9509e94101d04db0a87395f39cc1bcd881e8"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "85bb537649c78b08e36e2de94dfde8449760ca163577a7fac63603da4074dd37"
+      "sha256": "4bd65e814cacf8b886b542bf7741dff8f61e9aad3e101db1af2bd28e0eb1a49e"
     },
     {
       "path": "docs/api-reference.md",
@@ -2097,12 +2102,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "b018bdef70a2e46e00fa7e88d4ee489255d8d1ff9eaeecba18eb3c39ec41878d"
+      "sha256": "3a121e993f87d7379836af082bebb8c857427481eb265d477b4b55584cdd604b"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "88c3ac9d52e16fef3c82e09f4a8b4e8d8fa46f490e68bf370d2fd49a90bfbdee"
+      "sha256": "77e94a0337636dd8e444bfca6d749c9a16a937ed8e98b372072c17f5b43cc3fe"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2632,7 +2637,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "efe7ce69b4aed84c057d34db6b6bd2bcbb8a8f7b326bab16320277f314db5a46"
+      "sha256": "9acd2adf3d2f21d23fcc9cc626a26ca331972eb6980c5e0c9f8b883c9094b40f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4662,22 +4667,22 @@
     {
       "path": "modules/hall-ui/public/collab-lib.js",
       "mode": "0000644",
-      "sha256": "bfadae8700cc22ea13f8bc39a3e2a1876b58da6151032e9a973402bc9bd0aaa7"
+      "sha256": "baa893e9f8bd207416ee271f429964a85f7d6e1d44235c98a0a9dc20c7998049"
     },
     {
       "path": "modules/hall-ui/public/collab.css",
       "mode": "0000644",
-      "sha256": "884118a3b38b0c1ed5e1ac9c90c0b5994714bbabde67959f67c49e7f49536983"
+      "sha256": "ee8845701481932fd9c222b5bb1714aaa552c2c0967d97fc91eef166fe6ab712"
     },
     {
       "path": "modules/hall-ui/public/collab.html",
       "mode": "0000644",
-      "sha256": "186a0828e1c3e44388146b94c56f239ea6b2392bd599f143c7c73029da35da32"
+      "sha256": "9876929d0ce989d12dadcdfa6da5cd93ca660e0b291a24a467a920632245dd65"
     },
     {
       "path": "modules/hall-ui/public/collab.js",
       "mode": "0000644",
-      "sha256": "91a0751cebcbc179f28ad1cac7a6c447f90369ae40f29e5f60c1bd934ac68f85"
+      "sha256": "465198338e63c762a8f099df8a43e449e804097074c62285243f4876085f6dc5"
     },
     {
       "path": "modules/hall-ui/public/collab.states.json",
@@ -7782,12 +7787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "55fbc4950d743f2078280ad1311903120e44c8b93a84d7403fa1107321aee16c"
+      "sha256": "97fdcfbc606ed913875732b87e7cfa0cf105349b9a25a8c1831fd9d59f5d0b76"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6b23fd601399995c8b9b2dfc1881d2e4047b2345c61549f0a9661c4cb31ed0c5"
+      "sha256": "f060d07f1520e822ce6bc8294d6970fa66f87ae4c23aa6bdf2e7f64197aeec60"
     },
     {
       "path": "public-docs/index.html",
@@ -9782,7 +9787,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e7dbc1db9bf741ba4a85b171e30b9b5f05a4cf38b3b7422d8df81943c66eb7bb"
+      "sha256": "22cc35de1bea324e4016468dcd0c95e1fa859c2d467127fa3acef7dc18432dbd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10622,7 +10627,7 @@
     {
       "path": "tests/collab_page.mjs",
       "mode": "0000644",
-      "sha256": "b710669fabe9e747fe37abf429356e80c1f7a36cd63ac308dda2a933243e2e6d"
+      "sha256": "3e6ae0773f3997f82764f51373dd2e12b965d05366f7615346ba4f504151be77"
     },
     {
       "path": "tests/compose_demo_credentials.mjs",
@@ -11607,7 +11612,7 @@
     {
       "path": "tests/hall_collab_world.mjs",
       "mode": "0000644",
-      "sha256": "d005de58e0eabd019f616ee6c77123c5880b67034ce33dc1b01d687a2b284b10"
+      "sha256": "0374c15f7bf4cfdb4cccadb51f5c62e2331413e6970a69599cb1f51899d79b0a"
     },
     {
       "path": "tests/hall_error_envelope.mjs",
@@ -12272,7 +12277,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "d55b193ee9dcba85a9d51f108352de17f453dfb413b9b391028c9d8f7ff7fab0"
+      "sha256": "b2609440d099b93b61c63c3cdaa4cf6e65c6dc107b8aa4d06d9cb81c9ec5e2c9"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/adr/0314-module-protection-is-per-path-not-per-module.md

@@ -0,0 +1,133 @@
+# ADR 0314 — A module owns a protected path without the whole module becoming protected
+
+- **Status:** accepted (design only — the implementation is a follow-up, see *Not built here*)
+- **Date:** 2026-09-20
+- **Task:** [task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2
+- **From:** idea 1000689; owner decision 2026-09-19 — *option 1, narrow what counts as protected*
+- **Supersedes nothing.** Refines the derivation in [ADR 0086](0086-goal-scoped-work-hierarchy.md) §7.
+
+## The question
+
+`protected` on a module is DERIVED — a module is protected iff any of its globs
+overlaps `PROTECTED_GLOBS` ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7,
+the SEC #863 "second list that drifts" rule). A protected module makes creating a
+goal scoped to it Archon-only.
+
+Three modules derive protected because of exactly one file that is not their
+domain — a CLI they own that happens to sit on a protected path:
+
+| Module | Protected solely by | of N globs |
+|---|---|---|
+| `onboarding` | `scripts/gds/setup.js` | 1 of 5 |
+| `autonomy` | `scripts/gds/conductor-dispatch.js` | 1 of 6 |
+| `copy-desk` | `scripts/gds/copy-inventory.js` | 1 of 4 |
+
+`onboarding` is the case that raised it: a public goal was <redacted>
+for a Metic because the module owns one CLI that installs the pre-push hook.
+
+## Two corrections to the numbers the task was written on
+
+Re-measured on this tree (`isProtectedModule` over `moduleKeys()`, 2026-09-20):
+
+- **12 of 26 modules derive protected, not 11.** The task's re-measurement of
+  2026-09-19 was already one short.
+- **`agents` is the twelfth**, protected by `modules/agents/` — which is itself a
+  `PROTECTED_GLOBS` entry. It is absent from the task's list of seven that "stay
+  protected", so a reader working from that list would have been surprised by it.
+
+Both corrections argue for the same thing, below: **pin the set by name.**
+
+`government` and `agents` are each protected by exactly one glob too — so "1 of N"
+is not the discriminator. The real one is **whether the protecting glob is the
+module's own territory**: `modules/government/` and `modules/agents/` *are* those
+modules; `scripts/gds/setup.js` merely lives near `onboarding`.
+
+## The options, and why the obvious one is wrong
+
+You cannot subtract. The glob format has no wildcards, so "onboarding minus
+setup.js" is inexpressible. And you cannot delete the glob: `MODULE_GLOBS` is also
+the territory deciding **who may author a task touching that path**, and the shared
+floor is only `tests/` — so an unowned path is authorable by no goal at all.
+
+That left **(a) reassign each incidental CLI to an already-protected module**. It
+was measured rather than reasoned about, by applying the edit to the source and
+re-requiring in a fresh process — `MODULE_SCOPE_MAP` is frozen and built from a
+copy at load, so mutating `MODULE_GLOBS` in-process proves nothing.
+
+With `copy-inventory.js` and `conductor-dispatch.js` moved to `devsecops`:
+
+| Goal scoped to | Authoring | Before | After (a) |
+|---|---|---|---|
+| `copy-desk` | its own generator | authorable | **denied, out_of_scope** |
+| `autonomy` | its own conductor | authorable | **denied, out_of_scope** |
+| `devsecops` | the generator **and its two outputs** | — | **denied, out_of_scope** |
+
+The third row is the one that decides it. `docs/copy-registry.json` and
+`docs/copy-inventory.md` stay `copy-desk`'s, so the generator and the artifacts it
+writes end up either side of a module boundary and **the routine "change a UI
+string, regenerate the registry" becomes authorable by no single goal.** That is
+not a hypothetical workflow: it is the ship-check freshness gate every UI task
+hits, because every row in the registry carries a line number and any edit to a
+scanned file shifts them.
+
+So (a) does not relocate a cost. It converts a correct ownership statement into a
+false one, damages the authoring wall for two of the three modules, and buys the
+flip with a workflow the project runs daily. It is right for exactly one of the
+three — `setup.js` → `devsecops`, which already owns `.husky/` and the hooks.
+
+## Decision
+
+**Protection becomes per-path at the goal-scope wall, as it already is at the
+other three walls.** A module may own a protected path; owning one no longer makes
+the whole module Archon-only to scope a goal to.
+
+The derivation is not weakened and no flag is hand-set — the rule stays computed
+from `PROTECTED_GLOBS`, the single source. What changes is the *question* the
+derivation answers: not "does this module touch the trust core" but "is the
+territory this goal is being scoped to, itself protected".
+
+Three reasons this is the honest shape rather than the convenient one:
+
+- **Per-path is already the rule everywhere else.** `matchProtected` /
+  `checkPermissionPaths` decides task-authoring ([ADR 0086](0086-goal-scoped-work-hierarchy.md) wall 2),
+  the grader and gate decide ship, and the post-push main audit decides the
+  dishonest case. All three ask about the path. Only goal-creation asks about the
+  module, and that inconsistency is the whole defect.
+- **The wall that matters does not move.** A Metic-floor path stays Metic-floor:
+  a sub-Metic builder touching `scripts/gds/setup.js` is refused exactly as
+  before, by the same check. What changes is who may *create a goal* whose
+  territory happens to include it — a question about scoping, not about writing.
+- **It keeps a command with its domain** (design 02§1), which is why those three
+  globs are where they are.
+
+## Not built here
+
+Per the task: an ADR first, implementation as a follow-up. This decision builds no
+new derivation mechanism. Filed separately:
+
+- The implementation of the per-path goal-scope wall.
+- **`builder-settings`, deliberately out of scope.** Its overlap is
+  `src/bongos/routes/me.js` caught by the blanket `src/bongos/routes/` prefix, so
+  narrowing it means either finishing the strangler move of `me.js` into
+  `modules/builder-settings/` or narrowing a blanket protected glob — a security
+  change with its own blast radius.
+- **Nine protected paths are owned by no module at all** — `gen-repo-map.js`,
+  `gen-file-map.js`, `gen-session-index.js`, `install-git-hooks.js`, `cli-lib.js`,
+  `run-unit-tests.js`, `git-merge-regen.js`, `scripts/gds/hooks/` and
+  `.gitattributes`. By the rule above, no goal can author a task on any of them.
+  Found while checking whether deletion was viable; it is a pre-existing hole,
+  not one this decision opens.
+
+## Shipped with this ADR
+
+One thing is built, because it guards the decision rather than implementing it:
+a test pinning the **full protected key set by name**. A count assertion passes on
+the wrong twelve, and both corrections above are exactly the drift it catches — a
+future glob edit that silently unprotects `kernel` or `lifecycle` now reds the
+build.
+
+## Does not decide
+
+The floor a protected path carries (unchanged, Metic, from the surface registry);
+whether `scripts/gds/` should have a shared-floor entry the way `tests/` does;
+or whether the nine unowned paths are assigned or given a home of their own.

package/docs/adr/README.md

@@ -405,3 +405,4 @@ This keeps the decision history honest and traceable.
 | 0311 | [**An idea is a permanent origin tag, and the payout follows its descent** ([task 1004076](https://cloudbongos.com/builders#/task/1004076), goal 1000095 — BONGOS-V2). An idea today is a CONTAINER for work: it leaves `idea_inbox` when it names a goal and lives on as a task, so the better-aimed the thought the faster it vanishes from whoever had it. Reported as a small confusion — a thought filed from the hall routed into a goal, the confirmation line cleared on the next keystroke, and five minutes later the owner could not find it. The idea becomes an **immutable origin tag** instead, the only thing that can answer where a piece of work came from, and **the ideator payout follows its whole descent** rather than stopping at the earliest lineage link (`awardIdeaTaskShipCredit`), decaying by depth — full at the direct task, halving each hop — so an infinite descent is worth at most twice the direct task. That is what gives the tag teeth: if it does not survive a fork, someone does not get paid. **Size and brightness are two channels, not one number**: size is the sum of those payouts and never falls, brightness is how much of that work is still alive, so a thought whose work the project tore out renders LARGE AND DEAD rather than looking like one that never mattered. **Karma was rejected as the basis** — `karma_log` carries no task key and no idea key, deliberately ([`migrations/040_builder_karma.sql`](../../migrations/040_builder_karma.sql)), so "the karma a thought caused" is not computable; credits already are idea-attributed. **The task hierarchy is NOT widened** to carry the descent — it is capped at one level and refuses cross-version parents because ship rollup and claim safety lean on it, and provenance is a different relation from work decomposition. **Nothing records that shipped work was later removed** (`shipped` is terminal, `merged_into_task_id` is CHECK-constrained to abandoned rows), so the first `cascade.js` rule PROPOSES a removal and a person confirms it — derived-only would dim for refactors and renames, declared-only would rot. A ratified **Full Idea becomes a goal or a criterion**, carrying a recommendation the board rules on, because scope is the thing you learn last; the five questions are replaced and VERSIONED so prior filings keep their own. Dropped three tasks this invalidated and amended a fourth whose title asserted the exact exclusivity it reverses. Does not decide: the decay rate beyond its default, what precisely counts as removed, how the edges are physically recorded, or how any of it is drawn.](0311-an-idea-is-a-permanent-origin-tag.md) | ideas / economy |
 | 0312 | [**Provenance is a SECOND ideas-owned edge table, written by the seams that already know** ([task 1004080](https://cloudbongos.com/builders#/task/1004080), goal 1000095 — BONGOS-V2). The spike [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: how the descent edges are physically recorded. A descent (`idea → task → rewrite → split → removal`) is four levels deep and crosses a version boundary, and the task hierarchy refuses both — `attachParent` enforces `SELF_PARENT`, `VERSION_MISMATCH`, `PARENT_HAS_PARENT` and `TARGET_HAS_CHILDREN`, all load-bearing for ship rollup and claim safety. The spike was told to CONFIRM `ideas_task_lineage` rather than assume it, and confirmed one half while refuting the other: the table is right as the **idea→task anchor** (bipartite, no depth cap, no version predicate) but CANNOT carry the task→task edge, because a derivation is a property of the task PAIR and [ADR 0236](0236-many-ideas-one-task-the-lineage-key-is-the-pair.md) made co-source ideas both legal and common — a `derived_from_task_id` column would write the same derivation once per co-source idea and let two rows disagree about where a task came from, the same under-keying that silently lost attribution on prod once already. A merge also gives a task SEVERAL parents, so the relation is a **DAG, not a tree**. Decision: a new `ideas_task_descent` (`task_id`, `parent_task_id`, CHECK'd `relation`, PK on the pair, indexed both ways), with NO depth cap and NO version predicate, and **cycles refused at write time** because the payout walks this graph and a cycle is a non-terminating walk rather than a cosmetic error. On who writes it — the question the task actually set, since an edge depending on memory will have holes — **three seams already know and none is telling anyone**: `cascade.js` encodes the originating task id inside `source_ref` as a STRING nothing can join on, `tasks.merged_into_task_id` already records the fold, and `parent_task_id` already records the split. Only `rewrite` and cross-version `merge` stay manual, which is honest — they are editorial acts with no automatic signal, and their absence degrades the picture rather than corrupting it. What it fixes: `sourceIdeaForTask` and `awardIdeaTaskShipCredit` are both one-hop `LIMIT 1` point reads, so a DERIVED task resolves to `no_source_idea` and the origin is not paid at all. Does not decide: the decay rate beyond its default, what counts as removed ([ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md)), or how any of it is drawn.](0312-provenance-is-a-second-ideas-owned-edge-table.md) | ideas / lifecycle |
 | 0313 | [**A removal is derived from the SERVER's own merge diff and confirmed by a person** ([task 1004081](https://cloudbongos.com/builders#/task/1004081), goal 1000095 — BONGOS-V2). The other half [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: what counts as removed, so that brightness can fall at all. Nothing records it today — `shipped` is terminal (`rot.js` says so outright) and `merged_into_task_id` is CHECK'd to `abandoned` rows, describing only work cut BEFORE it landed. Owner decision 13 set the shape (system proposes, person confirms); this settles the detail, and corrects two premises the task was written on. **`cascade.js` is no longer empty** — it carries a production rule and [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) fixed the contract (append an entry, never touch the runner), so there is a precedent to copy including its anti-recursion guard. **`netNegativeBonusAmount` cannot be the trigger** despite being the named nearest signal: it is an aggregate with NO TARGET (it says deletion happened, never what or whose), it is CLIENT-SUPPLIED via `signals.diff_stats`, and `grader-score.js` already documents the forgery it defends against — and brightness sits beside a payout, so a forgeable target-less counter cannot carry it. **Nothing durable records what any ship touched**: `committed_files` and `diff_stats` are client-supplied at grade time and never persisted, `touches[]` is advisory ([ADR 0049](0049-split-parallel-safety-contract.md)), so a removal cannot be reconstructed from history — only derived as a ship lands. Decision: derive it from the SERVER's own merge diff ([ADR 0055](0055-server-mediated-branch-publish.md) — the server holds the repo and does the merge, so it computes the diff rather than being told one), and attribute the deleted hunks through **`claims.published_head_sha`** (`migrations/171`), NOT by parsing `(task NNNN)` out of commit text — only 7 of `main`'s last 15 commits carry a task id, and a convention that holds most of the time cannot underwrite a payout. An UNATTRIBUTABLE deletion files nothing: a wrong proposal costs attention and dims a real star. A rename, a move and a rewrite-in-place are NOT removals, and a cold body is not a remnant — removal applies only below a task that actually shipped. The proposal is an appended `CASCADES` entry filing a QUESTION; confirmation is Metic+/`task.promote` on the existing awaiting-nod surface; an unanswered one rots on the normal clock. Only a CONFIRMED proposal dims a star. The derivation must be NON-BLOCKING — landing work matters more than dimming a star on time. Brightness can only fall forward from here, so historical sizes need a marker or the number lies.](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) | ideas / lifecycle |
+| 0314 | [**A module owns a protected path without the whole module becoming protected** ([task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2). Three modules derive `protected` — and so are Archon-only to scope a goal to — because of ONE file that is not their domain: `onboarding` on `scripts/gds/setup.js`, `autonomy` on `scripts/gds/conductor-dispatch.js`, `copy-desk` on `scripts/gds/copy-inventory.js`. The owner chose *narrow what counts as protected*; the task set the fork and required the choice be justified before any glob moved. **Deleting the glob is out**: `MODULE_GLOBS` is also the territory deciding who may AUTHOR a task on a path, and the shared floor is only `tests/`, so an unowned path is authorable by no goal at all. That left reassigning each CLI to an already-protected module — **measured, not reasoned about**, by applying the edit to the source and re-requiring in a fresh process (`MODULE_SCOPE_MAP` is frozen and built from a COPY of `MODULE_GLOBS` at load, so an in-process mutation proves nothing and passes green). The measurement kills it: `copy-desk` and `autonomy` lose the ability to author on their own generator and their own conductor, and — the row that decides it — `devsecops` as the new owner **cannot author the generator together with the two artifacts it writes**, because `docs/copy-registry.json` and `docs/copy-inventory.md` stay `copy-desk`'s. So *change a UI string, regenerate the registry* becomes authorable by no single goal, and that is the ship-check freshness gate every UI task hits. Decision: **protection becomes per-path at the goal-scope wall, as it already is at the other three** — `matchProtected` decides task-authoring, the grader and gate decide ship, the post-push audit decides the dishonest case; only goal-creation asked about the MODULE, and that inconsistency is the whole defect. The derivation stays computed from `PROTECTED_GLOBS` and no flag is hand-set ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7 / SEC #863), and the Metic floor on those paths does not move. **Corrects the task's own numbers**: 12 of 26 modules derive protected, not 11, and `agents` (protected by `modules/agents/`, itself a protected glob) is absent from its list of seven — which is why the one thing this ADR SHIPS is a test pinning the full protected key set **by name**, a count assertion passing on the wrong twelve being exactly how that drifted. Implementation is deferred to task 1004109, per the task's own instruction to stop after the ADR. Also filed: `builder-settings` (task 1004110), whose overlap rides the blanket `src/bongos/routes/` prefix and so needs either the `me.js` strangler move or its own security ADR; and **nine protected paths owned by no module at all** (task 1004111) — the freshness generators, the merge-driver pair and `cli-lib.js` among them — found while checking whether deletion was viable, a pre-existing hole rather than one this opens. Does not decide: the floor a protected path carries, whether `scripts/gds/` deserves a shared-floor entry the way `tests/` has one, or how the nine unowned paths get a home.](0314-module-protection-is-per-path-not-per-module.md) | modules / permissions |

package/docs/copy-inventory.md

@@ -152,7 +152,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8b736e365191` | certain | All builders | `modules/hall-ui/public/hall-render.js:1238` |
 | `b5e03617b319` | certain | All goals | `modules/hall-ui/public/goals.html:53` |
 | `e08d410571e9` | certain | All kinds | `modules/hall-ui/public/sessions.js:286` |
-| `9c34bccb06ef` | certain | All open asks | `modules/hall-ui/public/collab.html:71` |
+| `9c34bccb06ef` | certain | All open asks | `modules/hall-ui/public/collab.html:73` |
 | `bea7817e57a4` | certain | All surfaces | `modules/hall-ui/public/copy-desk.js:301` |
 | `627c683a5e5d` | certain | All time | `modules/hall-ui/public/hall-widgets.js:130` |
 | `b38c01691857` | certain | All your work → | `modules/hall-ui/public/hall-widgets.js:110` |
@@ -163,7 +163,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `69f0ca4a4d84` | certain | Analytics scope | `modules/hall-ui/public/hall-render.js:1236` |
 | `14bdceaac078` | certain | Answer the five questions and this spark becomes a Full Idea. | `modules/hall-ui/public/ideas.js:692` |
 | `0293418d5e8e` | certain | Answerable for: | `modules/hall-ui/public/profile.js:72` |
-| `05761b08ec8f` | certain | Answering is optional and declining costs nothing. Nobody is assigned by being asked. | `modules/hall-ui/public/collab.html:97` |
+| `05761b08ec8f` | certain | Answering is optional and declining costs nothing. Nobody is assigned by being asked. | `modules/hall-ui/public/collab.html:100` |
 | `52ed0e2e3470` | certain | Any rank | `modules/hall-ui/public/task-lib.js:62` |
 | `8832c7204180` | certain | Anyone in the owning project | `modules/hall-ui/public/settings.html:291` |
 | `7d2ab55d4112` | certain | Anyone on this instance | `modules/hall-ui/public/settings.html:292` |
@@ -176,7 +176,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5fcfdf8975cf` | certain | As configuration: | `modules/hall-ui/public/government.js:829` |
 | `01a0f29ff406` | certain | As first filed | `modules/hall-ui/public/idea.js:252` |
 | `688cc6dd38ee` | certain | Asked of you | `modules/hall-ui/public/collab.html:48` |
-| `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/collab.js:58` |
+| `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/collab.js:66` |
 | `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/watch.js:488` |
 | `8c8ec2597036` | certain | Assigned {…} to builder {…}. | `modules/hall-ui/public/government.js:463` |
 | `46714066f2da` | certain | Audit log | `modules/hall-ui/public/watch.html:141` |
@@ -275,7 +275,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `12ee050d0180` | certain | Copy desk | `modules/hall-ui/public/copy-desk.html:27` |
 | `1214ea8e0d1b` | certain | Copy desk — {{worldName}} | `modules/hall-ui/public/copy-desk.html:6` |
 | `1214ea8e0d1b` | certain | Copy desk — {{worldName}} | `modules/hall-ui/public/copy-desk.html:6` |
-| `30764a4f0e28` | certain | Copy for Session Start | `modules/hall-ui/public/collab.js:90` |
+| `30764a4f0e28` | certain | Copy for Session Start | `modules/hall-ui/public/collab.js:98` |
 | `ebc8a6c16a22` | certain | Copy parallel prompt | `modules/hall-ui/public/work.html:146` |
 | `a873e7c29d80` | certain | Copy prompt | `modules/hall-ui/public/task.js:795` |
 | `a873e7c29d80` | certain | Copy prompt | `modules/hall-ui/public/task.js:816` |
@@ -303,7 +303,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/task.js:982` |
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:735` |
 | `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:318` |
-| `9912c3835136` | certain | Could not load requests — reload to try again. | `modules/hall-ui/public/collab.js:529` |
+| `9912c3835136` | certain | Could not load requests — reload to try again. | `modules/hall-ui/public/collab.js:551` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:399` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:437` |
 | `a2f2e8babef5` | certain | Could not load that page. Try again. | `modules/hall-ui/public/blockers.js:274` |
@@ -603,7 +603,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:489` |
 | `dce0546c9e34` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this platform — or any p | `modules/hall-ui/public/deploy.html:39` |
 | `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:781` |
-| `91328a97fe68` | certain | Mingle pairs you with someone from another role. Saying no costs nothing. | `modules/hall-ui/public/collab.html:87` |
+| `91328a97fe68` | certain | Mingle pairs you with someone from another role. Saying no costs nothing. | `modules/hall-ui/public/collab.html:90` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
 | `19b0ed5781ae` | certain | Minimum rank required to claim this task | `modules/hall-ui/public/task-lib.js:65` |
 | `64e91044df43` | certain | Mint a fresh CLI token using this browser session and paste it into your terminal — the quick way back in when | `modules/hall-ui/public/settings.html:145` |
@@ -644,7 +644,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fbb887a9b678` | certain | No goal has criteria met yet — work is in the task queue. | `modules/hall-ui/public/roadmap.js:128` |
 | `6771a8966ec3` | certain | No goals declared yet — this version is tracked by its {…} done-when criteria. | `modules/hall-ui/public/roadmap.js:106` |
 | `abc64639b134` | certain | No goals seeded yet. | `modules/hall-ui/public/roadmap.js:205` |
-| `139ec3636c22` | certain | No introductions right now. One appears here when a pairing round runs. | `modules/hall-ui/public/collab.html:90` |
+| `139ec3636c22` | certain | No introductions right now. One appears here when a pairing round runs. | `modules/hall-ui/public/collab.html:93` |
 | `3b9823dd4579` | certain | No maintenance declared — nobody is on the hook for this module as the core advances. | `modules/hall-ui/public/modules.js:92` |
 | `64a4281934d1` | certain | No match. Try a page name, or an id like | `modules/hall-ui/public/palette.js:182` |
 | `4f89817b92e5` | certain | No onboarding steps recorded yet. | `modules/hall-ui/public/hall-render.js:941` |
@@ -662,13 +662,13 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c9800f8b6bc8` | certain | No versions declared yet. | `modules/hall-ui/public/roadmap.js:427` |
 | `4654849396a3` | certain | No work reviewed yet. | `modules/hall-ui/public/hall-widgets.js:150` |
 | `086665af6208` | certain | No {…} sessions recorded. Choose another kind to widen the ledger. | `modules/hall-ui/public/sessions.js:145` |
-| `1967d2176f2e` | certain | Nobody has an open ask right now. | `modules/hall-ui/public/collab.html:75` |
-| `c65c9f5c02e3` | certain | Nobody is waiting on you. Requests reach you by role — | `modules/hall-ui/public/collab.html:53` |
+| `1967d2176f2e` | certain | Nobody has an open ask right now. | `modules/hall-ui/public/collab.html:78` |
+| `c65c9f5c02e3` | certain | Nobody is waiting on you. Requests reach you by role — | `modules/hall-ui/public/collab.html:54` |
 | `91c409a4aea5` | certain | Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit | `modules/hall-ui/public/watch.js:374` |
 | `c72e0bdb834a` | certain | Not declared in module.json — this is who ships the module. | `modules/hall-ui/public/modules.js:62` |
 | `361b353ded5e` | certain | Not enough shipped work yet to chart. | `modules/hall-ui/public/hall-widgets.js:184` |
 | `90230572d017` | certain | Not found | `modules/hall-ui/public/task.js:970` |
-| `8226c979db4d` | certain | Not now | `modules/hall-ui/public/collab.js:435` |
+| `8226c979db4d` | certain | Not now | `modules/hall-ui/public/collab.js:457` |
 | `5ffcdc1a0176` | certain | Not scored — this builder’s own profile waived every signal, or the session predates this measure. | `modules/hall-ui/public/sessions.js:100` |
 | `61250b49a90b` | certain | Not scored. | `modules/hall-ui/public/idea.js:84` |
 | `8d6afe6def47` | certain | Not signed in | `modules/hall-ui/public/settings.html:40` |
@@ -780,7 +780,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/drachmae.js:148` |
 | `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1132` |
 | `b6fcfdd652a7` | certain | Read it here | `modules/hall-ui/public/work.html:45` |
-| `053df132e22c` | certain | Read the full ask | `modules/hall-ui/public/collab.js:90` |
+| `053df132e22c` | certain | Read the full ask | `modules/hall-ui/public/collab.js:98` |
 | `c5f19a888a15` | certain | Read the handoff notes | `modules/hall-ui/public/task.js:481` |
 | `f9e998f4af3d` | certain | Read to the end and the button below unlocks. It is an honour system — nothing here checks your comprehension. | `modules/hall-ui/public/primer.html:100` |
 | `26e6c9879035` | certain | Reading the diagrams | `modules/hall-ui/public/diagrams.html:39` |
@@ -847,7 +847,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `42cbc20a6ec8` | certain | Saves when you press Save; your next | `modules/hall-ui/public/settings.html:136` |
 | `645dd8117cf3` | certain | Say why it is being retired — the reason goes in the record. | `modules/hall-ui/public/task.js:924` |
 | `fc9d783ed0f5` | certain | Say why it is better. Whoever reviews this decides it from your reason, without asking you. | `modules/hall-ui/public/copy-desk.js:446` |
-| `12c1ec21a2c6` | certain | Say yes | `modules/hall-ui/public/collab.js:435` |
+| `12c1ec21a2c6` | certain | Say yes | `modules/hall-ui/public/collab.js:457` |
 | `46711f7bc3df` | certain | Search every string the product shows a person, by what it says or the file it lives in. | `modules/hall-ui/public/copy-desk.html:65` |
 | `5d2ba8e72fa1` | certain | Search failed. | `modules/hall-ui/public/copy-desk.js:343` |
 | `373a7639bcb9` | certain | Sections in this primer | `modules/hall-ui/public/primer.html:52` |
@@ -882,7 +882,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ac44b08aec92` | certain | Ship it | `modules/hall-ui/public/task.js:710` |
 | `b94a6b5b3d8c` | certain | Shipped with the core | `modules/hall-ui/public/modules.html:56` |
 | `0c0a50ba1666` | certain | Shipped {…}{…}, {…}. | `modules/hall-ui/public/task.js:691` |
-| `6dde12eb0c78` | certain | Show all {…} | `modules/hall-ui/public/collab.js:253` |
+| `6dde12eb0c78` | certain | Show all {…} | `modules/hall-ui/public/collab.js:275` |
 | `14d32a35c15f` | certain | Show my cross-project record | `modules/hall-ui/public/settings.js:514` |
 | `dc0f9fe50a65` | certain | Show the setup guide again | `modules/hall-ui/public/index.html:64` |
 | `2af4c0f2b4b9` | certain | Showing {…} of {…}. | `modules/hall-ui/public/ideas.js:638` |
@@ -905,7 +905,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:663` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:294` |
-| `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:203` |
+| `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:211` |
 | `e7b592185803` | certain | Someone is holding a claim on this task. It has to be released before the task can be retired. | `modules/hall-ui/public/task.js:753` |
 | `867df58c9aaa` | certain | Something else | `modules/hall-ui/public/copy-desk.html:95` |
 | `c377d8ed744b` | certain | Something went wrong. Try again. | `modules/hall-ui/public/profile-connections.js:275` |
@@ -1132,14 +1132,14 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `23c68db6db4e` | certain | You created this task, but it has already moved past planning. Retiring it now is a change to the record, so i | `modules/hall-ui/public/task.js:776` |
 | `cf0c107a39fc` | certain | You created this task, but it has shipped. Shipped work is immutable history — nobody can retire it, whatever  | `modules/hall-ui/public/task.js:769` |
 | `b91183c02c63` | certain | You created this task, but someone is holding a claim on it. Once that is released you can retire it yourself. | `modules/hall-ui/public/task.js:774` |
-| `da274462bb30` | certain | You have no open asks. | `modules/hall-ui/public/collab.html:64` |
+| `da274462bb30` | certain | You have no open asks. | `modules/hall-ui/public/collab.html:66` |
 | `6b759151f722` | certain | You have reached the end. The button below is now active. | `modules/hall-ui/public/primer.js:309` |
 | `6d5a4ca58dd6` | certain | You haven’t joined any goals yet. | `modules/hall-ui/public/goals.js:83` |
 | `8e527ab12334` | certain | You {…}. One vote per member. | `modules/hall-ui/public/board-room.js:348` |
 | `8e1915b19274` | certain | You're in the {…} server with your rank role. | `modules/hall-ui/public/settings.js:833` |
 | `d8c542541c15` | certain | You're not signed in yet. Sign in to manage your connections, your keys, your dev box and the way the hall beh | `modules/hall-ui/public/settings.html:41` |
 | `3a6ed99ec333` | certain | You've been approved before — sign in and pick up where you left off. | `modules/hall-ui/public/hall-render.js:367` |
-| `7d26333b5fb0` | certain | Your asks | `modules/hall-ui/public/collab.html:61` |
+| `7d26333b5fb0` | certain | Your asks | `modules/hall-ui/public/collab.html:62` |
 | `f96bc227dba0` | certain | Your choice | `modules/hall-ui/public/settings.html:359` |
 | `f20a4adfd5a8` | certain | Your dev box builds itself in a minute or two and the app chimes when it's ready. It lives in the menu bar on  | `modules/hall-ui/public/hall-render.js:825` |
 | `909b0b7c6ffa` | certain | Your display name | `modules/hall-ui/public/settings.html:84` |
@@ -1284,7 +1284,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `594962dc9ec3` | certain | s into the view containers below (falling back to | `modules/hall-ui/public/index.html:52` |
 | `2a42549b34ae` | certain | said, when flagged: | `modules/hall-ui/public/copy-desk.js:124` |
 | `9bec9eb4829e` | certain | scope: {…} | `modules/hall-ui/public/goals-render.js:836` |
-| `a13ee0cde7f2` | certain | set yours in Settings | `modules/hall-ui/public/collab.html:54` |
+| `a13ee0cde7f2` | certain | set yours in Settings | `modules/hall-ui/public/collab.html:55` |
 | `a6f55d7aa6f7` | certain | shipped (live) | `modules/hall-ui/public/roadmap.js:298` |
 | `026ba1289d4d` | certain | shipped · | `modules/hall-ui/public/goals-render.js:758` |
 | `ec6d8c900bc8` | certain | sign in | `modules/hall-ui/public/profile-charts.js:502` |

package/docs/copy-registry.json

@@ -541,7 +541,7 @@
       "text": "Asked {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/collab.js:58",
+        "modules/hall-ui/public/collab.js:66",
         "modules/hall-ui/public/watch.js:488"
       ]
     },
@@ -2412,7 +2412,7 @@
       "surface": "builders-hall",
       "text": "All open asks",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 71,
+      "line": 73,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -2511,7 +2511,7 @@
       "surface": "builders-hall",
       "text": "Answering is optional and declining costs nothing. Nobody is assigned by being asked.",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 97,
+      "line": 100,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -2628,7 +2628,7 @@
       "surface": "builders-hall",
       "text": "Asked {…}",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 58,
+      "line": 66,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3519,7 +3519,7 @@
       "surface": "builders-hall",
       "text": "Copy for Session Start",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 90,
+      "line": 98,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3771,7 +3771,7 @@
       "surface": "builders-hall",
       "text": "Could not load requests — reload to try again.",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 529,
+      "line": 551,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6471,7 +6471,7 @@
       "surface": "builders-hall",
       "text": "Mingle pairs you with someone from another role. Saying no costs nothing.",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 87,
+      "line": 90,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -6840,7 +6840,7 @@
       "surface": "builders-hall",
       "text": "No introductions right now. One appears here when a pairing round runs.",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 90,
+      "line": 93,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7002,7 +7002,7 @@
       "surface": "builders-hall",
       "text": "Nobody has an open ask right now.",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 75,
+      "line": 78,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7011,7 +7011,7 @@
       "surface": "builders-hall",
       "text": "Nobody is waiting on you. Requests reach you by role —",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 53,
+      "line": 54,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7056,7 +7056,7 @@
       "surface": "builders-hall",
       "text": "Not now",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 435,
+      "line": 457,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8064,7 +8064,7 @@
       "surface": "builders-hall",
       "text": "Read the full ask",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 90,
+      "line": 98,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8667,7 +8667,7 @@
       "surface": "builders-hall",
       "text": "Say yes",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 435,
+      "line": 457,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8982,7 +8982,7 @@
       "surface": "builders-hall",
       "text": "Show all {…}",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 253,
+      "line": 275,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9189,7 +9189,7 @@
       "surface": "builders-hall",
       "text": "Someone helped",
       "file": "modules/hall-ui/public/collab.js",
-      "line": 203,
+      "line": 211,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11232,7 +11232,7 @@
       "surface": "builders-hall",
       "text": "You have no open asks.",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 64,
+      "line": 66,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -11295,7 +11295,7 @@
       "surface": "builders-hall",
       "text": "Your asks",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 61,
+      "line": 62,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12600,7 +12600,7 @@
       "surface": "builders-hall",
       "text": "set yours in Settings",
       "file": "modules/hall-ui/public/collab.html",
-      "line": 54,
+      "line": 55,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2288,5 +2288,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.905 with no explicit bump. run 35514202453. (task 1002620)
   1.19.907 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.906 with no explicit bump. run 35514739370. (task 1002620)
+  1.19.908 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.907 with no explicit bump. run 35516559010. (task 1002620)
+  1.19.909 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.908 with no explicit bump. run 35517426559. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/collab-lib.js

@@ -73,6 +73,75 @@
     return 'waiting ' + weeks + ' weeks';
   }
 
+  // A PILL MARKS A ROW WORSE THAN ITS ROOM (task 1004067, from idea 1001065).
+  //
+  // Task 1004041 fixed half of this: the words now carry the real age, and the
+  // two calm bands lost their ring. What it could not fix from inside a single
+  // row is the case the report is actually about — a room where EVERY row is
+  // genuinely past a week. There the condition is not too loose; it is correct
+  // on all fourteen, and fourteen correct alarms are still not a signal. The
+  // instrument is wrong, not the threshold: a per-row badge can only say "this
+  // row is bad", and it has no way to say "this row is bad AND so is every other
+  // one", which is the fact a reader needs.
+  //
+  // So the room states its own condition once, in the block head, and a row
+  // wears the pill only when it is MORE SEVERE than that baseline. On a mixed
+  // board no band is dominant, nothing is muted, and the page reads exactly as
+  // it does today. On a uniformly stale board the alarm is said once instead of
+  // fourteen times, and the per-row words still carry each real age — so nothing
+  // goes silently dead, which is the criterion the bands exist to satisfy.
+  //
+  // Two dials, both deliberately blunt. A room under BASELINE_MIN_ROWS is not a
+  // wall — four pills can be read one at a time, so a short list keeps every
+  // one. BASELINE_SHARE is below 1 because thirteen-of-fourteen reads as a wall
+  // just as much as fourteen does, and a rule that only fires on unanimity is a
+  // rule that almost never fires.
+  var BASELINE_MIN_ROWS = 4;
+  var BASELINE_SHARE = 0.7;
+
+  // Only a band that actually WEARS a pill can be a baseline (severity >= 2 —
+  // aging and stale; collab.css rings those two and leaves the calm pair as
+  // plain text). A room that is uniformly 'just asked' has no alarm to move to
+  // the head, and announcing one there would invent the very noise this removes.
+  function roomBaseline(reqs, nowMs) {
+    var list = Array.isArray(reqs) ? reqs : [];
+    if (list.length < BASELINE_MIN_ROWS) return null;
+    var counts = {};
+    for (var i = 0; i < list.length; i += 1) {
+      var id = ageBand(list[i] && list[i].created_at, nowMs).id;
+      counts[id] = (counts[id] || 0) + 1;
+    }
+    // BANDS is severest-first, and two bands cannot both clear a share above a
+    // half, so the first match is the only match.
+    for (var j = 0; j < BANDS.length; j += 1) {
+      var band = BANDS[j];
+      var n = counts[band.id] || 0;
+      if (band.severity >= 2 && n / list.length >= BASELINE_SHARE) {
+        return { band: band, count: n, total: list.length };
+      }
+    }
+    return null;
+  }
+
+  // At or below the room's baseline, a row is the rule and reads quiet; above
+  // it, a row is the exception and keeps its pill. With no baseline nothing is
+  // quieted, which is what makes this inert on every mixed board.
+  function isRoomQuiet(band, baseline) {
+    if (!band || !baseline) return false;
+    return band.severity <= baseline.band.severity;
+  }
+
+  // The fact the pills used to repeat, said once. The band's own label supplies
+  // the words, so the head and the rows can never describe the same threshold
+  // two different ways.
+  function roomAgeLine(baseline) {
+    if (!baseline) return '';
+    var many = baseline.count === baseline.total
+      ? 'all ' + baseline.total
+      : baseline.count + ' of ' + baseline.total;
+    return many + ' ' + baseline.band.label;
+  }
+
   // Oldest first WITHIN the page, because the thing most at risk of dying
   // silently should be read first. This is in ADDITION to the band, never
   // instead of it.
@@ -336,6 +405,8 @@
 
   window.OTBCollabLib = {
     BANDS: BANDS, ageBand: ageBand, ageLabel: ageLabel,
+    roomBaseline: roomBaseline, isRoomQuiet: isRoomQuiet, roomAgeLine: roomAgeLine,
+    BASELINE_MIN_ROWS: BASELINE_MIN_ROWS, BASELINE_SHARE: BASELINE_SHARE,
     byAgeOldestFirst: byAgeOldestFirst, byNewestFirst: byNewestFirst,
     askerOf: askerOf, contextOf: contextOf,
     directionLine: directionLine, boardLine: boardLine,

package/modules/hall-ui/public/collab.css

@@ -43,6 +43,33 @@
   padding-right: 0;
 }
 
+/* THE ROOM'S OWN CONDITION IS NOT A PER-ROW WARNING (task 1004067). When a
+   block is uniformly old, every row's band is correct and every row's pill is
+   therefore identical — the wall the report describes. A row at or below its
+   room's baseline drops to the same plain quiet text the calm bands wear, so
+   the only chips left in the column are the rows that are worse than their
+   room. Two classes, so this outranks the band ink it replaces without an
+   !important. The WORDS are untouched: each row still states its own real age,
+   which is what keeps an old ask visibly aging rather than silently dead. */
+.cb-age.cb-age--quiet {
+  color: var(--ink-soft);
+  border-color: transparent;
+  padding-left: 0;
+  padding-right: 0;
+  font-weight: 400;
+}
+
+/* The fact the chips used to repeat, stated once in the head. It sits in the
+   band's own ink because here it IS the exception — one line on a page, not one
+   per row — and it is the only thing on the head that is allowed to be loud. */
+.cb-block__age {
+  font-size: 13px;
+  letter-spacing: 0;
+  color: var(--ink-soft);
+}
+.cb-block__age--aging { color: var(--warn); }
+.cb-block__age--stale { color: var(--danger); font-weight: 600; }
+
 /* ---- the figure strip -----------------------------------------------------
    The shell's .stat-row, unchanged, except that this page's third tile holds
    WORDS (the roles you answer for) rather than a figure. The shell's own

package/modules/hall-ui/public/collab.html

@@ -46,6 +46,7 @@
           <section class="scroll cb-block" aria-labelledby="cb-for-me-h">
             <div class="cb-block__head">
               <h2 class="scroll__h" id="cb-for-me-h">Asked of you <span class="cb-block__n" id="cb-for-me-n"></span></h2>
+              <span class="cb-block__age" id="cb-for-me-age" hidden></span>
               <span class="cb-faces" id="cb-for-me-faces" aria-hidden="true"></span>
             </div>
             <ul class="ov-rows" id="cb-for-me"></ul>
@@ -59,6 +60,7 @@
           <section class="scroll cb-block" aria-labelledby="cb-mine-h">
             <div class="cb-block__head">
               <h2 class="scroll__h" id="cb-mine-h">Your asks <span class="cb-block__n" id="cb-mine-n"></span></h2>
+              <span class="cb-block__age" id="cb-mine-age" hidden></span>
             </div>
             <ul class="ov-rows" id="cb-mine"></ul>
             <div class="empty-state cb-empty" id="cb-mine-empty" hidden><p>You have no open asks.</p></div>
@@ -69,6 +71,7 @@
         <section class="scroll cb-block cb-block--all" aria-labelledby="cb-all-h">
           <div class="cb-block__head">
             <h2 class="scroll__h" id="cb-all-h">All open asks <span class="cb-block__n" id="cb-all-n"></span></h2>
+              <span class="cb-block__age" id="cb-all-age" hidden></span>
             <span class="cb-faces" id="cb-all-faces" aria-hidden="true"></span>
           </div>
           <ul class="ov-rows" id="cb-all"></ul>

package/modules/hall-ui/public/collab.js

@@ -53,9 +53,17 @@
   // exact timestamp stays on the title, where a reader who wants the date can
   // still reach it — which is also why the separate date line that used to sit
   // under this pill is gone: the same fact twice is one fact too many.
-  function ageChip(req, nowMs) {
+  //
+  // `baseline` is the block's own room condition (L.roomBaseline), and it is the
+  // second half of the same verdict: where the label stops fourteen old rows
+  // reading as fourteen copies of one alarm, the baseline stops them WEARING
+  // fourteen copies of one alarm. A row at or below its room's baseline is the
+  // rule, not the exception, so it drops the ring and the danger ink and keeps
+  // only its words — the head says the room's condition once instead.
+  function ageChip(req, nowMs, baseline) {
     const band = L.ageBand(req.created_at, nowMs);
-    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(L.ageLabel(req.created_at, nowMs))}</span>`;
+    const quiet = L.isRoomQuiet(band, baseline) ? ' cb-age--quiet' : '';
+    return `<span class="fact-pill cb-age cb-age--${band.id}${quiet}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(L.ageLabel(req.created_at, nowMs))}</span>`;
   }
 
   // A DOM id per row that is stable, unique and safe to put in an attribute. The
@@ -175,14 +183,14 @@
   // chat mirror). What the page owes a helper is the request, its age, its
   // context, and who to answer — and their face. A by-name ask is the personal
   // call on this reader, so its row is the LIT one (.cb-row--live).
-  function forMeRow(req, nowMs, extra, key) {
+  function forMeRow(req, nowMs, extra, key, baseline) {
     const live = req.needs_builder_id != null ? ' cb-row--live' : '';
     return `<li class="ov-row ov-row--lead cb-row${live}" data-id="${escapeHtml(String(req.id))}"${extra ? ' data-extra hidden' : ''}>
       ${faceHtml(L.faceOf(req, 'in'))}
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${directionFact(req, 'in')}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs, baseline)}</div>
     </li>`;
   }
 
@@ -198,12 +206,12 @@
   // which is precisely the distinction a reader could no longer make. Moving the
   // pill down to the facts line puts the warning with the other facts about the
   // ask and leaves the right column as what it is here: the place you act.
-  function mineRow(req, nowMs, extra, key) {
+  function mineRow(req, nowMs, extra, key, baseline) {
     const id = escapeHtml(String(req.id));
     return `<li class="ov-row ov-row--lead cb-row" data-id="${id}"${extra ? ' data-extra hidden' : ''}>
       ${faceHtml(L.faceOf(req, 'out'))}
       <div class="ov-row__main">${askHtml(req, key)}
-        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}${ageChip(req, nowMs)}</div>
+        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}${ageChip(req, nowMs, baseline)}</div>
       </div>
       <div class="ov-row__right">
         <div class="ov-row__actions">
@@ -216,13 +224,13 @@
 
   // A row on the board of everyone's asks: the asker's face, the third-person
   // line, no actions — settling is the asker's, in their own block.
-  function allRow(req, nowMs, extra, key) {
+  function allRow(req, nowMs, extra, key, baseline) {
     return `<li class="ov-row ov-row--lead cb-row" data-id="${escapeHtml(String(req.id))}"${extra ? ' data-extra hidden' : ''}>
       ${faceHtml(L.faceOf(req, 'in'))}
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${boardFact(req)}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs, baseline)}</div>
     </li>`;
   }
 
@@ -235,13 +243,27 @@
   function paintBlock(key, rows, rowFn, nowMs, faces) {
     const list = rows.slice().sort(L.byNewestFirst);
     const { shown, hidden } = L.splitShown(list, SHOWN);
+    // Over the WHOLE list, not the shown three: the door hides rows, it does not
+    // change what the room is, and a baseline that flipped when someone pressed
+    // "Show all" would re-alarm the rows it had just quieted.
+    const baseline = L.roomBaseline(list, nowMs);
     const host = $(`#cb-${key}`);
     if (host) {
-      host.innerHTML = shown.map((r) => rowFn(r, nowMs, false, key)).join('')
-        + hidden.map((r) => rowFn(r, nowMs, true, key)).join('');
+      host.innerHTML = shown.map((r) => rowFn(r, nowMs, false, key, baseline)).join('')
+        + hidden.map((r) => rowFn(r, nowMs, true, key, baseline)).join('');
     }
     const n = $(`#cb-${key}-n`);
     if (n) n.textContent = list.length ? String(list.length) : '';
+    // The room's condition, said once, beside the count that scopes it.
+    const age = $(`#cb-${key}-age`);
+    if (age) {
+      const line = L.roomAgeLine(baseline);
+      age.textContent = line;
+      age.hidden = !line;
+      age.className = line
+        ? `cb-block__age cb-block__age--${baseline.band.id}`
+        : 'cb-block__age';
+    }
     const empty = $(`#cb-${key}-empty`);
     if (empty) empty.hidden = list.length > 0;
     const facesEl = $(`#cb-${key}-faces`);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.907",
+  "version": "1.19.909",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.907",
+      "version": "1.19.909",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.907",
+  "version": "1.19.909",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.907'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.909'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/collab_page.mjs

@@ -136,6 +136,98 @@ test('the two calm bands are not chips, and the date is not said twice', () => {
   assert.match(js, /title="Asked \$\{escapeHtml\(String\(req\.created_at/, 'the exact date is still reachable');
 });
 
+// ---- THE ROOM'S OWN CONDITION (task 1004067, from idea 1001065) -----------
+//
+// The report: fourteen of fourteen rows wore the "waiting over a week" pill, so
+// the loudest thing on the page carried no information. Task 1004041 made the
+// WORDS differ, which is why these tests are about the TREATMENT — fourteen
+// differently-worded rows in identical danger ink and identical rings still read
+// as a wall. Each case below is run through the lib, not grepped, so a rule that
+// is wrong fails here rather than looking plausible in a diff.
+const room = (...ages) => ages.map((d) => ({ created_at: daysAgo(d) }));
+
+test('a uniformly old room states its condition once instead of on every row', () => {
+  const L = lib();
+  // The reported board, reproduced: fourteen rows, every one past a week.
+  const rows = room(8, 9, 11, 13, 15, 16, 18, 21, 24, 27, 30, 34, 38, 41);
+  const baseline = L.roomBaseline(rows, NOW);
+  assert.ok(baseline, 'fourteen of fourteen is a room condition, not fourteen warnings');
+  assert.equal(baseline.band.id, 'stale');
+  assert.equal(L.roomAgeLine(baseline), 'all 14 waiting over a week');
+  const loud = rows.filter((r) => !L.isRoomQuiet(L.ageBand(r.created_at, NOW), baseline));
+  assert.equal(loud.length, 0, 'no row is worse than a room where every row is the same');
+  // And nothing is silently dead: each row still says its own real age.
+  const words = new Set(rows.map((r) => L.ageLabel(r.created_at, NOW)));
+  assert.ok(words.size > 1, 'the per-row words still carry the differing ages');
+});
+
+test('the pill is kept for the row that is worse than its room', () => {
+  const L = lib();
+  // Six of eight sitting a few days, two genuinely old. The two are the whole
+  // point of the column, and before this they were indistinguishable from the six.
+  const rows = room(4, 4, 5, 5, 5, 6, 21, 30);
+  const baseline = L.roomBaseline(rows, NOW);
+  assert.equal(baseline.band.id, 'aging');
+  assert.equal(L.roomAgeLine(baseline), '6 of 8 waiting a few days');
+  const loud = rows
+    .filter((r) => !L.isRoomQuiet(L.ageBand(r.created_at, NOW), baseline))
+    .map((r) => L.ageLabel(r.created_at, NOW));
+  assert.deepEqual(loud, ['waiting 3 weeks', 'waiting 4 weeks'], 'only the exceptions keep a chip');
+});
+
+test('a mixed room is left exactly as it was', () => {
+  const L = lib();
+  // No band is dominant here, so nothing is quieted and nothing is announced —
+  // which is what keeps this inert on the board as it usually looks.
+  const rows = room(0.2, 0.5, 1, 2, 4, 5, 9, 21);
+  assert.equal(L.roomBaseline(rows, NOW), null);
+  assert.equal(L.roomAgeLine(null), '');
+  for (const r of rows) {
+    assert.equal(L.isRoomQuiet(L.ageBand(r.created_at, NOW), null), false, 'no baseline quiets nothing');
+  }
+});
+
+test('a short list keeps every pill, and a calm room announces nothing', () => {
+  const L = lib();
+  // Three chips can be read one at a time; a wall needs a crowd.
+  assert.equal(L.roomBaseline(room(30, 30, 30), NOW), null, 'under the minimum, every row keeps its own');
+  assert.equal(L.BASELINE_MIN_ROWS, 4);
+  // A room that is uniformly calm has no alarm to move to the head. Announcing
+  // one there would invent the noise this removes.
+  assert.equal(L.roomBaseline(room(0.1, 0.2, 0.3, 0.4, 0.5), NOW), null, 'all fresh says nothing');
+  assert.equal(L.roomBaseline(room(1, 1, 2, 2, 2), NOW), null, 'all waiting-a-day says nothing either');
+});
+
+test('the room line and the rows cannot describe the threshold two ways', () => {
+  const L = lib();
+  // The head's words come from the band's own label, so there is one vocabulary.
+  for (const b of L.BANDS) {
+    const line = L.roomAgeLine({ band: b, count: 9, total: 12 });
+    assert.equal(line, `9 of 12 ${b.label}`, `${b.id} reads in its own words`);
+  }
+});
+
+test('the quiet treatment is wired through the render, not just defined', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(js, /function ageChip\(req, nowMs, baseline\)/, 'the chip is told about its room');
+  assert.match(js, /L\.isRoomQuiet\(band, baseline\)/, 'through the lib, so the rule is the tested one');
+  assert.match(js, /cb-age--quiet/, 'and the class reaches the markup');
+  // Over the WHOLE list: a baseline computed on the shown three would flip when
+  // a reader pressed "Show all" and re-alarm the rows it had just quieted.
+  assert.match(js, /const baseline = L\.roomBaseline\(list, nowMs\)/, 'the room is the whole block');
+  const html = read('modules', 'hall-ui', 'public', 'collab.html');
+  for (const key of ['for-me', 'mine', 'all']) {
+    assert.ok(html.includes(`id="cb-${key}-age"`), `the ${key} head has somewhere to say it`);
+  }
+  const css = read('modules', 'hall-ui', 'public', 'collab.css');
+  assert.match(
+    css,
+    /\.cb-age\.cb-age--quiet\s*\{[^}]*border-color: transparent/,
+    'the quieted row drops its ring',
+  );
+  assert.match(css, /\.cb-age\.cb-age--quiet\s*\{[^}]*color: var\(--ink-soft\)/, 'and the danger ink with it');
+});
+
 test('the alarm does not sit beside the accent control', () => {
   // DESIGN.md spends the accent only on what is pressable or live. On "Your
   // asks" the age pill (danger ink) used to share the right column with the

package/tests/hall_collab_world.mjs

@@ -230,7 +230,11 @@ test('the door and the copy control are on the row, and the copy control is reac
   // One request can appear in three blocks at once, so the id is block-scoped.
   assert.match(js, /function askId\(key, id\)/);
   assert.match(js, /cb-ask-\$\{key\}-/);
-  assert.match(js, /rowFn\(r, nowMs, false, key\)/, 'and paintBlock hands the key down');
+  // A bracket class, not a closing paren: paintBlock also hands the row its
+  // block's age baseline (task 1004067), and pinning the exact arity would red
+  // this on an argument the invariant — that the KEY reaches the row — does not
+  // care about.
+  assert.match(js, /rowFn\(r, nowMs, false, key[,)]/, 'and paintBlock hands the key down');
 
   const css = read('collab.css');
   for (const cls of ['.cb-ask ', '.cb-ask__door', '.cb-ask__copy', '.cb-ask__full']) {
@@ -262,8 +266,12 @@ test('the age is a state pill in the row\'s right column, and every band has its
   assert.match(css, /\.cb-age--stale\s*\{[^}]*var\(--danger\)/, 'stale is the danger ink');
   assert.match(css, /\.cb-age--aging\s*\{[^}]*var\(--warn\)/, 'aging is the warn ink');
   const js = read('collab.js');
-  assert.match(js, /class="fact-pill cb-age cb-age--\$\{band\.id\}"/, 'the pill is the shell\'s fact-pill');
-  assert.match(js, /<div class="ov-row__right">\$\{ageChip\(req, nowMs\)\}/, 'in the right column, so a glance down the list reads the ages');
+  // Both pins stop short of the closing character, because the band's class is
+  // now followed by the room's quiet modifier and ageChip by the baseline that
+  // decides it (task 1004067). What they assert is unchanged: the shell's pill,
+  // in the right column.
+  assert.match(js, /class="fact-pill cb-age cb-age--\$\{band\.id\}/, 'the pill is the shell\'s fact-pill');
+  assert.match(js, /<div class="ov-row__right">\$\{ageChip\(req, nowMs[,)]/, 'in the right column, so a glance down the list reads the ages');
 });
 
 // ---- the copy desk: quieter, and no fact lost ----------------------------------

package/tests/module-scope-map.mjs

@@ -54,6 +54,77 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
   assert.ok(prot.length < scope.moduleKeys().length, 'expected at least one non-protected module');
 });
 
+// THE PROTECTED SET IS PINNED BY NAME (task 1004070, ADR 0314).
+//
+// The assertion above says the roster contains both kinds; it passes on any
+// twelve. That is the shape a silent unprotection hides in — a glob edit that
+// dropped `migrations/` off `lifecycle` would keep the count and leave the ship
+// pipeline scopeable by anyone. It has already drifted once in the other
+// direction: task 1004070 was written against a re-measurement of 11, and
+// `agents` (protected by `modules/agents/`, itself a PROTECTED_GLOBS entry) was
+// missing from it.
+//
+// So the set is spelled out. A module ARRIVING here is a deliberate line in a
+// diff; a module LEAVING is the one that must never happen quietly.
+const PROTECTED_MODULES = [
+  'agents',
+  'autonomy',
+  'builder-settings',
+  'copy-desk',
+  'dev-box',
+  'devsecops',
+  'government',
+  'grading',
+  'kernel',
+  'lifecycle',
+  'methodology',
+  'onboarding',
+];
+
+test('the protected module set is exactly this, by name', () => {
+  assert.deepEqual(
+    scope.protectedModules().slice().sort(),
+    [...PROTECTED_MODULES].sort(),
+    'the derived protected set changed — if that was intended, edit PROTECTED_MODULES in the same diff and say why',
+  );
+});
+
+test('the seven trust-core modules can never leave the protected set', () => {
+  // Stated separately from the pin above because these are not interchangeable
+  // with the rest: their territory IS the trust / ship / authz core, so an edit
+  // that unprotects one is a security regression rather than a roster change.
+  // ADR 0314 narrows which MODULES derive protected; it must never reach these.
+  for (const k of ['kernel', 'lifecycle', 'government', 'grading', 'dev-box', 'devsecops', 'methodology']) {
+    assert.equal(scope.scopeForModule(k).protected, true, `${k} must stay protected`);
+  }
+});
+
+test('narrowing the module roster must not narrow the PATH wall', () => {
+  // The other half of ADR 0314's verification, and the one that would make this
+  // a false success: whatever happens to the module flag, a sub-Metic builder
+  // touching a protected CLI is still refused, by the per-file check.
+  // Each file is scoped to the module that OWNS it, deliberately: check() runs
+  // scope-subset before the path wall, so scoping them all to one module would
+  // get `out_of_scope` and prove nothing about protection. The owning module is
+  // what makes the scope wall pass, leaving the path wall as the only thing that
+  // can refuse — which is exactly the claim under test.
+  const owned = [
+    ['onboarding', 'scripts/gds/setup.js'],
+    ['autonomy', 'scripts/gds/conductor-dispatch.js'],
+    ['copy-desk', 'scripts/gds/copy-inventory.js'],
+  ];
+  for (const [mod, f] of owned) {
+    assert.ok(PROTECTED_GLOBS.includes(f), `fixture assumption: ${f} is a protected surface`);
+    assert.equal(gsc.scopeSubset([mod], [f]).ok, true, `fixture assumption: ${mod} owns ${f}`);
+    const r = gsc.check([mod], [f], 'thetes');
+    assert.equal(r.ok, false, `a sub-Metic builder must still be refused on ${f}`);
+    assert.equal(r.code, 'protected_path', `${f} must be refused BY THE PATH WALL, not by scope`);
+    // ...and Metic+ passes, so the refusal is the rank floor and not the path
+    // being unreachable to everyone.
+    assert.equal(gsc.check([mod], [f], 'metic').ok, true, `a Metic must still be able to author on ${f}`);
+  }
+});
+
 test('isProtected actually consults PROTECTED_GLOBS (overlap, prefix-aware both ways)', () => {
   assert.ok(PROTECTED_GLOBS.includes('migrations/'), 'fixture assumption: migrations/ is protected');
   assert.equal(scope.isProtected(['migrations/']), true, 'a protected glob must compute protected');