@bongos/core 1.19.918 → 1.19.920

package/modules/hall-ui/public/deploy.html

@@ -55,7 +55,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goal-inbox.js

@@ -191,6 +191,20 @@
       return;
     }
 
+    // task 1004095 (BV2.R16): confirming or dismissing a removal proposal. Like
+    // the two branches above it refreshes ITS OWN slice only — repainting the
+    // goals list would leave the answered row sitting there still asking (the
+    // task-1003066 lesson). The verdict is server-declared on the button rather
+    // than inferred from which one was pressed, so this branch needs to know
+    // nothing about the vocabulary beyond what to say afterwards.
+    const removal = e.target.closest('[data-removal-task]');
+    if (removal) {
+      const verdict = removal.dataset.removalVerdict;
+      act(() => postJSON(`${API}/removal-proposals/${encodeURIComponent(removal.dataset.removalTask)}/decide`, { verdict }),
+        REMOVAL_TOASTS[verdict] || 'Answered.', loadRemovals);
+      return;
+    }
+
     const item = e.target.closest('.ginbox__item');
     const goalId = item && item.dataset.goal;
     if (!goalId) return;
@@ -275,6 +289,86 @@
       .catch(() => { /* a non-triager's 403, or a hiccup: never break the hall */ });
   }
 
+  // ---- removal proposals (task 1004095, BV2.R16) ----------------------------
+  //
+  // A ship that deleted files an earlier SHIPPED task put there files a QUESTION,
+  // never a verdict (task 1004090, ADR 0313): refactors, renames and file moves
+  // all look like deletions to a diff, so nothing is marked removed until a person
+  // says so. This slice is where they say so.
+  //
+  // WHY IT IS NOT A ROW IN THE NOD QUEUE, which is the obvious place. That queue is
+  // scoped to ROUTED FILINGS — `origin='route'` in ideas_task_lineage — and ADR 0299
+  // decided, on live numbers, that it stays that way and is honestly named for that
+  // population. A removal proposal has no idea lineage at all. Same CARD (the
+  // anti-accretion rule at the top of this file), same floor, separate slice.
+  //
+  // THE ANSWER IS NOT IN THIS ROW, and that is deliberate. Which files went and
+  // whose work they were is prose in the proposal's body, because the cascade that
+  // files it has no field for a target (ADR 0242). So the title LINKS to the task
+  // and the buttons sit beside it: a person who has not read the evidence should
+  // have to take one more step, not one fewer.
+  //
+  // No client-side rank gate, for the same reason the nod slice has none: GET
+  // /removal-proposals is Metic+ server-side, so a non-triager's fetch 403s and the
+  // slice renders nothing. One gate, on the server.
+  // What each answer says when it lands. Keyed by the SERVER's verdict name, the
+  // ROT_TOASTS convention, so a verdict added later degrades to a neutral
+  // confirmation instead of a blank toast. The wording states the CONSEQUENCE,
+  // because that is the half a person cannot see from the row they just cleared.
+  const REMOVAL_TOASTS = {
+    confirmed: 'Confirmed — the ideas behind that work will dim.',
+    dismissed: 'Dismissed — nothing dims.',
+  };
+
+  // THE LABELS ARE ONE WORD EACH BECAUSE THE ROW IS A FLEX LINE AT EVERY WIDTH.
+  // `.ginbox__actions` is `flex: 0 0 auto` and nothing in the card wraps, so two
+  // buttons take their width straight off the body’s. Measured at 375px:
+  // "Confirm removal" + "Dismiss" left the title 46px wide and 440px tall — a
+  // column of single letters — where every other row on this card keeps 138–218px.
+  // One word each brings it back into that band; the sentence each answer means
+  // rides the `title`, and the head already says what the question is.
+  function removalRowHtml(r) {
+    const title = escapeHtml(r.title || `task #${r.proposal_task_id}`);
+    const from = r.ship_task_id
+      ? `deleted by task #${escapeHtml(String(r.ship_task_id))}`
+      : 'from a ship whose id could not be read';
+    const goal = r.goal_title ? ` · ${escapeHtml(r.goal_title)}` : '';
+    return `<li class="ginbox__item ginbox__item--stacked">
+        <div class="ginbox__body">
+          <a class="ginbox__goal" href="/task/${encodeURIComponent(r.proposal_task_id)}">${title}</a>
+          <span class="ginbox__sub">${from}${goal} — open it to see what went</span>
+        </div>
+        <div class="ginbox__actions">
+          <button class="btn-ghost" type="button" data-removal-task="${escapeHtml(String(r.proposal_task_id))}"
+            data-removal-verdict="confirmed" title="That work is genuinely gone">Confirm</button>
+          <button class="btn-ghost" type="button" data-removal-task="${escapeHtml(String(r.proposal_task_id))}"
+            data-removal-verdict="dismissed" title="A refactor, a move, or work already superseded">Dismiss</button>
+        </div>
+      </li>`;
+  }
+
+  function renderRemovals(data) {
+    const box = host && host.querySelector('#attention-removals');
+    if (!box) return;
+    const rows = (data && Array.isArray(data.pending) ? data.pending : []);
+    const count = data && data.count != null ? data.count : rows.length;
+    if (!rows.length) {
+      box.innerHTML = '';
+    } else {
+      const more = count > 5 ? `<p class="ginbox__pending">…${count - 5} more awaiting an answer.</p>` : '';
+      box.innerHTML = '<h3 class="ginbox__sec-h">Was this removed? '
+        + `<span class="count-pill">${count}</span></h3>`
+        + `<ul class="ginbox__list">${rows.slice(0, 5).map(removalRowHtml).join('')}</ul>${more}`;
+    }
+    window.OTBAttention?.refresh();
+  }
+
+  function loadRemovals() {
+    return getJSON(`${API}/removal-proposals`)
+      .then((data) => renderRemovals(data))
+      .catch(() => { /* a non-triager's 403, or an older server: never break the hall */ });
+  }
+
   // ---- the rot queue (task 1003279, goal 1000072) ---------------------------
   //
   // "Untouched-for-X triggers a configured action rather than a silent decay."
@@ -484,6 +578,13 @@
       // triage. Its rows carry the shared .ginbox__item class, so refresh()
       // counts them with no change to the selector below.
       '<div id="attention-nod"></div>' +
+      // task 1004095 (BV2.R16): removal proposals — a ship deleted files an
+      // earlier shipped task put there, and somebody has to say whether that work
+      // is genuinely gone or it was a refactor. Straight after nod because it is
+      // the same act at the same floor: a Metic+ answering a question the system
+      // filed, inside a goal. Before blockers because a blocker is waiting on the
+      // owner specifically, while this is waiting on whoever looks first.
+      '<div id="attention-removals"></div>' +
       // task 1003455 (goal 1000089): open blockers — things stuck on the owner
       // (modules/ideas/blockers.js). AFTER nod, BEFORE rot: like every slice
       // above it, a blocker is genuinely waiting on a human, but unlike them it
@@ -499,6 +600,7 @@
     host.addEventListener('click', onClick);
     load();
     loadNodQueue();
+    loadRemovals();
     loadBlockers();
     loadRot();
     // task 1002802 (P06): the profile slice lives in its own file (builders.js is

package/modules/hall-ui/public/goals.html

@@ -220,7 +220,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-03-goals1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -192,7 +192,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1" defer></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -55,7 +55,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-03-roadmap1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/style.css

@@ -3032,6 +3032,18 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .ginbox__note { margin: 3px 0 0; font-size: 12.5px; color: var(--ink-soft); font-style: italic; }
 .ginbox__actions { flex: 0 0 auto; display: flex; gap: 6px; }
 .ginbox__pending { font-size: 12.5px; margin: 10px 0 0; color: var(--ink-soft); }
+/* task 1004095: a row whose actions are TWO verbs, not one. `.ginbox__actions` is
+   `flex: 0 0 auto` and the card never wraps, so a second button takes its width
+   straight off the title’s — measured at 375px, the removal row’s title fell to
+   96px and 252px tall where every other row on this card keeps 138–218px. The
+   modifier lets the actions drop under the words at phone width instead, which is
+   the card’s own "a phone gets its own treatment, the document never widens"
+   rule. Opt-in: an existing single-verb row is untouched. */
+@media (max-width: 640px) {
+  .ginbox__item--stacked { flex-wrap: wrap; }
+  .ginbox__item--stacked .ginbox__body { flex: 1 1 100%; }
+  .ginbox__item--stacked .ginbox__actions { margin-top: 6px; }
+}
 /* task 1003464: the system's notices are inbox LINES on Home (rebase owed, an
    input the system needs, the monthly budget) — the placement rule, not a
    banner inside the Standing card. A row is a kind in the label voice over one

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -151,7 +151,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/lifecycle/cascade.js

@@ -113,6 +113,13 @@
 // person. Kept as an explicit set rather than inferred, because "is this
 // copy/visual work" is a judgement the rule should state out loud and a test
 // should be able to pin — an inferred predicate is the kind that quietly widens.
+// The removal rule's key, lifted out of its declaration so the SURFACE that
+// answers a removal proposal (task 1004095 / BV2.R16) can find those proposals
+// without hand-typing the string. The key is half of every generated row's
+// `source_ref` (see cascadeSourceRef below), so a reader that re-types it is a
+// reader that silently returns nothing the day the key changes.
+const REMOVAL_RULE_KEY = 'removal-proposed-on-ship';
+
 const COPY_VISUAL_MODULES = Object.freeze([
   'copy-desk',    // the copy registry + proposals (goal 1000074's own spine)
   'hall-ui',      // the builders' hall — the most-seen surface
@@ -234,7 +241,7 @@ const CASCADES = Object.freeze([
     body: artistReviewBody,
   }),
   Object.freeze({
-    key: 'removal-proposed-on-ship',
+    key: REMOVAL_RULE_KEY,
     // ENGINEER, not artist: confirming asks whether deleted code is genuinely
     // gone or was moved, which is a question about the diff.
     discipline: 'engineer',
@@ -567,6 +574,7 @@ async function runCascadesForShip(shipped, deps = {}) {
 
 module.exports = {
   CASCADES,
+  REMOVAL_RULE_KEY,
   removalProposalBody,
   IDEA_CASCADES,
   TRIGGERS,

package/modules/lifecycle/migrations/lifecycle_009_removal_verdicts.sql

@@ -0,0 +1,111 @@
+-- lifecycle_009_removal_verdicts.sql — the ANSWER to a removal proposal
+-- (task 1004095 / BV2.R16, goal 1000095; ADR 0313 + ADR 0319).
+--
+-- WHY A TABLE AT ALL, when the proposal is already a task row. Because the two
+-- answers are otherwise indistinguishable. A removal proposal is a question filed
+-- at `backlog` by the `removal-proposed-on-ship` cascade (task 1004090); answering
+-- it either way leaves nothing to build, so either way the task ends `abandoned`.
+-- "Yes, that work is gone" and "no, that was a refactor" would then be the SAME
+-- row, and brightness — the live share of a descent, the next task in this chain —
+-- would have no way to tell the star it must dim from the one it must not. The
+-- verdict is the fact the whole feature exists to produce; it cannot live in a
+-- status that has one spelling for both answers.
+--
+-- WHY NOT A NEW TASK STATUS. ADR 0313 rejected exactly that: `shipped` is terminal
+-- by design and much of the ledger leans on it, so "a removal is a fact about
+-- work's fate, recorded BESIDE it, not a new terminal state that ship rollup would
+-- have to learn". This table is that beside.
+--
+-- WHAT IS DELIBERATELY NOT HERE: the list of tasks whose work was removed. The
+-- cascade files one task per rule per ship with no field for a target (ADR 0242
+-- forbids widening the runner to fan out), so that list travels as prose in the
+-- proposal's body — the owner's decision of 2026-09-20, recorded in
+-- cascade.js:removalProposalBody. Brightness designs its own storage for targets
+-- when it needs one. What this table owes brightness is the VERDICT and a
+-- structured handle on the ship it was about; both are here, and neither is prose.
+--
+-- MODULE-OWNED and `lifecycle_`-prefixed so fitness check 11 permits it (ADR 0083
+-- §Decision #5) — the lifecycle_004..008 convention. It only REFERENCES the core
+-- `tasks` / `builders` tables; a module migration may not ALTER them.
+--
+-- Module migrations are ADDITIVE and NAMESPACED: no down-migration, idempotent
+-- (safe to re-run).
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS lifecycle_removal_verdicts (
+  -- The PROPOSAL task — the question that was answered. PRIMARY KEY, not just an
+  -- index: one proposal has exactly one answer, ever. A second decide is refused
+  -- at the route rather than upserted, because silently overwriting a person's
+  -- verdict would lose the only record that they gave a different one.
+  proposal_task_id bigint PRIMARY KEY REFERENCES tasks(id) ON DELETE CASCADE,
+
+  -- The SHIP the proposal was about — the task whose merge deleted the files.
+  -- Denormalised out of the proposal's `source_ref`, which encodes it as
+  -- `cascade-removal-proposed-on-ship-<id>`: a string nothing can join on, the
+  -- same complaint ideas_007 makes about the same field. Nullable because a
+  -- proposal whose ref cannot be parsed must still be answerable — the verdict is
+  -- the point, and refusing to record it over a malformed ref would be the tail
+  -- wagging the dog.
+  ship_task_id     bigint REFERENCES tasks(id) ON DELETE SET NULL,
+
+  -- The answer. An ALLOW-LIST, not a deny-list: a value added to the vocabulary
+  -- later has to be added here too, rather than being admitted by default.
+  --   'confirmed' — the work is genuinely gone. This is what brightness reads.
+  --   'dismissed' — a refactor, a move the rename detection missed, or work
+  --                 already superseded. Nothing dims.
+  verdict          text NOT NULL CHECK (verdict IN ('confirmed', 'dismissed')),
+
+  -- WHO answered, and WHEN. A verdict with no author is a rumour: this is the
+  -- record that a PERSON decided, which is the entire difference between this
+  -- design and the derived-only one ADR 0313 rejected. Nullable only so a
+  -- deleted builder does not take the verdict with them.
+  decided_by       bigint REFERENCES builders(id) ON DELETE SET NULL,
+  decided_at       timestamptz NOT NULL DEFAULT now(),
+
+  -- Optional free text. Not NOT NULL, unlike lifecycle_008's `reason`: there the
+  -- row exists only when somebody overrode a rule and the "why" is the whole
+  -- record, whereas here the common case is an obvious yes or no and demanding
+  -- prose for it would only breed empty ceremony.
+  note             text
+);
+
+-- Brightness reads the CONFIRMED rows and only those, so the partial index is the
+-- shape of the one hot query rather than a general-purpose one on a two-value
+-- column, which would never be worth its write cost.
+CREATE INDEX IF NOT EXISTS idx_lifecycle_removal_verdicts_confirmed
+  ON lifecycle_removal_verdicts (ship_task_id)
+  WHERE verdict = 'confirmed';
+
+-- SAFETY NET — a migration that cannot prove its own effect must not report
+-- success (the lifecycle_007 / ideas_007 precedent). Read-only, no DDL. If the
+-- table came back without the single-column primary key, one proposal could carry
+-- two contradictory verdicts with nothing to arbitrate; if the CHECK is missing,
+-- a typo'd verdict would be stored and read as neither answer.
+DO $$
+DECLARE pk_cols text; has_verdict_check boolean;
+BEGIN
+  SELECT string_agg(a.attname, ',' ORDER BY a.attname) INTO pk_cols
+    FROM pg_constraint c
+    JOIN unnest(c.conkey) AS k(attnum) ON true
+    JOIN pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = k.attnum
+   WHERE c.conrelid = 'lifecycle_removal_verdicts'::regclass
+     AND c.contype  = 'p';
+  IF pk_cols IS DISTINCT FROM 'proposal_task_id' THEN
+    RAISE EXCEPTION
+      'lifecycle_009: lifecycle_removal_verdicts primary key is (%) — expected (proposal_task_id), so one proposal holds one verdict.', COALESCE(pk_cols, 'none');
+  END IF;
+
+  SELECT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conrelid = 'lifecycle_removal_verdicts'::regclass
+       AND contype  = 'c'
+       AND pg_get_constraintdef(oid) ILIKE '%verdict%'
+  ) INTO has_verdict_check;
+  IF NOT has_verdict_check THEN
+    RAISE EXCEPTION
+      'lifecycle_009: the verdict CHECK is missing — an unrecognised verdict would store as neither answer.';
+  END IF;
+END $$;
+
+COMMIT;

package/modules/lifecycle/module.json

@@ -26,7 +26,8 @@
       "kickoff-seed",
       "rot",
       "project-settings",
-      "artist-gate"
+      "artist-gate",
+      "removal-proposals"
     ],
     "pollers": [
       "publish-reconciler"