@bongos/core 1.19.971 → 1.19.973

package/modules/hall-ui/public/deploy.js

@@ -1,5 +1,5 @@
 // deploy.js — the owner's deploy door (task 1003159, ADR 0293; widened to the
-// hosted projects by task 1004046).
+// hosted projects by task 1004046, narrowed back to ONE project by task 1004171).
 //
 // WHAT THIS PAGE IS FOR. The owner, twice in a month: "I don't think I can make anything
 // live", then "this is above my paygrade." Moving a core pin is gate 3 of the release
@@ -9,18 +9,27 @@
 // `sudo -u <app user>` over ssh by design. So the one gate that is the owner's to hold was the
 // one gate with no instrument. This page is the instrument.
 //
-// WHY THE PROJECTS ARE HERE AND NOT IN THEIR OWN HALLS. The obvious shape — each owner
-// pressing Upgrade in their own project's hall — is not buildable: the upgrade route and
-// the intent queue belong to the PROVISIONING module, and a hosted project does not run
-// it. Probed 2026-09-18: /api/bongos/provisioning/health answers 200 here and 404 on
-// every tenant. The control plane is the only place that can act on them, so this is
-// where the button lives. Their own halls get the banner instead (task 1004045), which
-// each instance derives for itself from the registry and needs nothing from us.
+// ONE PAGE, ONE PROJECT (task 1004171). The owner, 2026-09-22: "Should not show core pin
+// upgrades for all of the projects", and then the rule — "it should only show the project
+// of that builders hall", "every project has the option to upgrade its version of bongos
+// including bongos itself."
 //
-// Nothing about the ENGINE had to change for this. UPGRADE_SHAPES already admitted
-// 'co-tenant' and 'standalone' alongside 'control-plane', coreUpgradeInstance already
-// resolved each shape's own checkout and built that box's own health and version URLs,
-// and the preview route already took any instance id. Only this page was single-row.
+// So the default view is the hall's OWN project and nothing else. On the control plane
+// that is the self row. What this replaces is task 1004046's shape, which listed every
+// live instance here because a hosted project cannot act on itself: the upgrade route and
+// the intent queue belong to the PROVISIONING module, and a tenant does not run it
+// (probed 2026-09-18: /api/bongos/provisioning/health answers 200 here, 404 on every
+// tenant). That reasoning still holds — the ACT still has to happen on the control plane —
+// but it does not license a page in one project's hall that offers to restart five other
+// projects, two of them belonging to builders who never asked. On 2026-09-22 this page
+// listed six boxes and the owner wanted one.
+//
+// WHICH IS WHY ?project= EXISTS, and it is not a fleet browser. A hosted project's hall
+// hands its owner off to this page scoped to THAT project (task 1004174), because the
+// hand-off is how a tenant reaches a working control without the tenant's web tier
+// gaining any capability — the split ADR 0293 D1 and ADR 0043 both turn on. Scoped or
+// not, the page renders exactly one row, and authority is still resolved server-side per
+// request: a slug in a query string decides what is LOOKED at, never what is allowed.
 //
 // THE RULE THAT SHAPES EVERY LINE HERE: this page KNOWS NOTHING. Every version on it is a
 // reading the control-plane runner took on the box, carried through the server with the
@@ -34,10 +43,11 @@
 // already guards the bad release; this guards the wrong button. Step one shows what would
 // move; step two names the version it saw and sends that. The confirm button is built
 // FROM the previewed version, so a release that lands between the two steps cannot
-// silently change what the press does. With several boxes on one page the step is held
-// PER BOX, and each button's handler CLOSES OVER the preview object it was built from —
-// so the version sent is the one that box displayed, and a repaint cannot swap it. A
-// page-wide "currently previewing" would be a wrong-box press waiting to happen.
+// silently change what the press does. The step is still keyed BY INSTANCE rather than
+// held page-wide, and each button's handler still CLOSES OVER the preview object it was
+// built from — so the version sent is the one that was displayed and a repaint cannot
+// swap it. That survives the narrowing to one row on purpose: the identity being carried
+// is the box's, and keying it to the box is what made a wrong-box press unrepresentable.
 (() => {
   'use strict';
 
@@ -106,7 +116,14 @@
     if (secs < 90) return `${secs}s ago`;
     const mins = Math.round(secs / 60);
     if (mins < 90) return `${mins} min ago`;
-    return `${Math.round(mins / 60)}h ago`;
+    const hours = Math.round(mins / 60);
+    // PAST TWO DAYS, HOURS STOP BEING A DURATION AND BECOME A NUMBER (task 1004172).
+    // The failure that motivated dating these at all rendered "55h ago", which is
+    // arithmetic the reader has to do before they can tell whether it is news. Days are
+    // the unit a two-day-old attempt is actually read in.
+    if (hours < 48) return `${hours}h ago`;
+    const days = Math.round(hours / 24);
+    return `${days} day${days === 1 ? '' : 's'} ago`;
   }
 
   function versionHtml(v) {
@@ -147,15 +164,47 @@
   // AND WHAT IT SEES AFTERWARDS. Three outcomes, and the failure is the one that had no
   // surface at all before this: an errored intent is not an OPEN intent, so the payload
   // after a rolled-back upgrade used to be identical to the payload before it.
+  //
+  // A FAILURE IS DATED, AND STOPS BEING THE HEADLINE ONCE THE BOX HAS MOVED ON
+  // (task 1004172). What this block used to render, undated, at the top of the page:
+  // "The move to core 1.19.921 did not land — this project was put back on 1.19.969 and
+  // is running." The attempt was two days old, the box had reached 1.19.969 by another
+  // road, and the cause it named had been fixed and released in between. Three defects in
+  // one sentence: no date, a PAST-tense claim ("was put back on") built from a PRESENT
+  // reading, and no notion that a box can recover.
+  //
+  // The rollback clause is present-tense now, which is the whole fix for the false half:
+  // "is still running core X" is a statement about the reading in hand, and true whenever
+  // the reading is. The page does not decide whether a failure is history — `superseded`
+  // is the server's answer (modules/provisioning/core-upgrade.js), because this page
+  // compares no versions.
   function settledHtml(p) {
     const m = p.last_move;
     if (!m) return '';
+    const when = m.at ? ` ${escapeHtml(ago(m.at))}` : '';
+    // The runner's own words, which name a fix addressed to someone holding a shell. Kept
+    // verbatim and kept CLOSED: the owner cannot run `sudo -u`, so 30 lines of it (the
+    // dirty-tree refusal prints a whole `git status`) is not what a deploy page leads on.
+    const detail = m.error
+      ? `<details class="dp-settled__detail"><summary>What the upgrade said</summary>
+          <pre class="dp-preflight__error">${escapeHtml(String(m.error))}</pre></details>`
+      : '';
+    if (m.state === 'error' && m.superseded) {
+      return `
+        <div class="dp-settled dp-settled--past">
+          <p class="ov-row__sub"><strong>An earlier attempt did not land.</strong> A move to core
+            ${escapeHtml(String(m.target_version))} failed${when} — this project has moved on since,
+            and is serving ${escapeHtml(String(p.served_version))} now. Whatever stopped that one
+            may or may not still apply; the check above is the live answer.</p>
+          ${detail}
+        </div>`;
+    }
     if (m.state === 'error') {
       return `
         <div class="dp-settled dp-settled--failed">
           <p class="ov-row__sub"><strong>The move to core ${escapeHtml(String(m.target_version))} did not land</strong>
-            — this project was put back on ${escapeHtml(String(p.served_version))} and is running.</p>
-          ${m.error ? `<pre class="dp-preflight__error">${escapeHtml(String(m.error))}</pre>` : ''}
+            — attempted${when}. This project is still running core ${escapeHtml(String(p.served_version))}.</p>
+          ${detail}
         </div>`;
     }
     if (m.state === 'done' && m.target_version === p.served_version) {
@@ -193,7 +242,11 @@
   function preflightHtml(p) {
     const pf = p.preflight;
     if (checking.has(String(p.instance_id)) && !(pf && pf.target === p.recommended_version)) {
-      return `<p class="ov-row__sub dp-preflight dp-preflight--checking">Checking what this would do…</p>`;
+      // NAME WHAT THE WAIT IS FOR (task 1004173). The runner picks this up on its own
+      // ~2-minute tick and then reads the box, so a bare spinner leaves the owner watching
+      // an unexplained pause on the one page where a pause could mean a live box is busy.
+      return `<p class="ov-row__sub dp-preflight dp-preflight--checking">Checking what this would do, and what it would bring in.
+        The answer comes from the machine itself, so it can take a couple of minutes.</p>`;
     }
     // No verdict is its own state, and it is NOT "fine". A silent gap here is how the
     // page used to promise a preview it never performed.
@@ -253,9 +306,7 @@
       if (steps.get(p.instance_id) !== 'confirm') break;   // the row was closed; stop.
       try {
         await refreshOne(p, { keepStep: true });
-        const now = (view.self && String(view.self.instance_id) === id)
-          ? view.self
-          : view.boxes.find((b) => String(b.instance_id) === id);
+        const now = view.box && String(view.box.instance_id) === id ? view.box : null;
         if (now && now.preflight && now.preflight.target === now.recommended_version) break;
       } catch (e) { break; }
     }
@@ -264,10 +315,51 @@
     repaint();
   }
 
+  // WHAT THE MOVE WOULD CARRY (task 1004173). The owner: "I don't actually see what would
+  // change when I hit the button." The pre-flight below answers whether the machinery will
+  // allow the move; this answers what taking it buys, in the words the ships themselves
+  // wrote — which are already addressed to this reader, because ship.js demands a summary
+  // an owner can read and posts it to Discord.
+  //
+  // AN EMPTY LIST IS NEVER RENDERED AS "NOTHING CHANGED". A range the runner could not
+  // resolve — no core history on the machine, a release it cannot find — comes back as an
+  // error and says so. "Nothing changed" over ninety-one releases is the one wrong
+  // impression this section could give, and it is the shape a silent failure takes.
+  function changesHtml(p) {
+    const pf = p.preflight;
+    const c = pf && pf.changes;
+    if (!c) return '';
+    if (c.error) {
+      return `<div class="dp-changes dp-changes--unknown">
+          <p class="ov-row__sub">Could not read what this would bring in: ${escapeHtml(String(c.error))}.
+            The check below still applies.</p>
+        </div>`;
+    }
+    const entries = Array.isArray(c.entries) ? c.entries : [];
+    if (!entries.length) {
+      return `<div class="dp-changes dp-changes--unknown">
+          <p class="ov-row__sub">No shipped work is recorded between core ${escapeHtml(String(c.from))} and
+            ${escapeHtml(String(c.to))}.</p>
+        </div>`;
+    }
+    const items = entries.map((e) => `<li>${escapeHtml(String(e.text))}</li>`).join('');
+    const more = c.more > 0
+      ? `<p class="ov-row__sub dp-changes__more">…and ${escapeHtml(String(c.more))} more, not listed.</p>`
+      : '';
+    return `<div class="dp-changes">
+        <p class="ov-row__sub"><strong>What this brings in</strong> — ${escapeHtml(String(entries.length))}
+          ${entries.length === 1 ? 'piece' : 'pieces'} of work landed between core ${escapeHtml(String(c.from))}
+          and ${escapeHtml(String(c.to))}${c.more > 0 ? ', newest first' : ''}:</p>
+        <ul class="dp-changes__list">${items}</ul>
+        ${more}
+      </div>`;
+  }
+
   function stepTwoHtml(p, isSelf) {
     const id = escapeHtml(String(p.instance_id));
     return `
       <div class="ps-controls">
+        ${changesHtml(p)}
         ${preflightHtml(p)}
         <p class="ov-row__sub">This restarts ${isSelf ? 'the platform' : escapeHtml(String(p.slug))} onto core
           <strong>${escapeHtml(String(p.recommended_version))}</strong>. It waits for the box to answer and
@@ -315,13 +407,13 @@
       </div></li>`;
   }
 
-  // A project whose preview could not be read at all. It is LISTED rather than dropped:
-  // a box silently missing from a deploy page reads as a box that does not need
-  // deploying, which is the one wrong impression this page must never give.
-  function unreadableHtml(inst, message) {
+  // The one project's preview could not be read. It is still RENDERED, named, rather
+  // than leaving the page blank: a box missing from a deploy page reads as a box that
+  // does not need deploying, which is the one wrong impression this page must never give.
+  function unreadableHtml(name, message) {
     return `
       <li class="ov-row"><div class="ov-row__main">
-        <span class="ov-row__title">${escapeHtml(String(inst.slug))}</span>
+        <span class="ov-row__title">${escapeHtml(String(name))}</span>
         <p class="ps-invalid">Could not read this project's deploy state: ${escapeHtml(message)}</p>
       </div></li>`;
   }
@@ -338,33 +430,30 @@
     if (confirm) confirm.addEventListener('click', () => move(p));
   }
 
-  // What the page is currently showing: the self row (or null), the readable project
-  // previews, and the ones that would not read. Held so a repaint after a click does not
-  // have to re-fetch everything.
-  let view = { self: null, boxes: [], unreadable: [], notEnrolled: null };
+  // What the page is currently showing: the ONE box this hall is about, whether that box
+  // is this platform itself, and — instead of a box — the reason there isn't one. Held so
+  // a repaint after a click does not have to re-fetch.
+  let view = { box: null, isSelf: true, name: 'This platform', notEnrolled: null, unreadable: null };
 
   function repaint() {
-    const items = [];
-    if (view.self) items.push(boxHtml(view.self, true));
+    let item;
+    if (view.box) item = boxHtml(view.box, view.isSelf);
     else if (view.notEnrolled) {
       // The server's own sentence names the one command that fixes it, which is why it
       // is shown rather than a generic failure line.
-      items.push(`<li class="ov-row"><div class="ov-row__main">
-        <span class="ov-row__title">This platform</span>
+      item = `<li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">${escapeHtml(String(view.name))}</span>
         <p class="ps-invalid">${escapeHtml(view.notEnrolled)}</p>
-      </div></li>`);
-    }
-    for (const p of view.boxes) items.push(boxHtml(p, false));
-    for (const u of view.unreadable) items.push(unreadableHtml(u.inst, u.message));
-    if (!items.length) {
-      items.push(`<li class="ov-row"><div class="ov-row__main">
+      </div></li>`;
+    } else if (view.unreadable) item = unreadableHtml(view.name, view.unreadable);
+    else {
+      item = `<li class="ov-row"><div class="ov-row__main">
         <p class="ov-row__sub">No running box to deploy.</p>
-      </div></li>`);
+      </div></li>`;
     }
-    $('dp-panel').innerHTML = `<ul class="ov-lines">${items.join('')}</ul>
+    $('dp-panel').innerHTML = `<ul class="ov-lines">${item}</ul>
       <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
-    if (view.self) wire(view.self);
-    for (const p of view.boxes) wire(p);
+    if (view.box) wire(view.box);
   }
 
   async function move(p) {
@@ -400,9 +489,7 @@
         // keepStep, for the reason the pre-flight poll documents: a refresh that resets
         // the row would fight the state this loop is painting, every interval.
         await refreshOne(p, { keepStep: true });
-        now = (view.self && String(view.self.instance_id) === id)
-          ? view.self
-          : view.boxes.find((b) => String(b.instance_id) === id);
+        now = view.box && String(view.box.instance_id) === id ? view.box : null;
       } catch (e) { break; }
       if (!now) break;
       // Settled two ways, and BOTH need the intent to be closed: served_version can
@@ -419,21 +506,18 @@
     if (!settled) toast(`Still working on core ${to}. It keeps going without this page — reload to see where it got to.`);
   }
 
-  // Re-read ONLY the box that just changed. The full load() fans out one probe per
-  // hosted project, and firing all of them to refresh one row is cache invalidation
-  // far wider than the change — it also re-probes boxes the owner never touched. A
-  // failure here falls back to the full read, because a stale row on a deploy page is
-  // the one thing worse than an extra request.
+  // Re-read the box. Its own endpoint, never the full load(): the self row and a scoped
+  // project are read from different places, and load() also re-resolves the scope. A
+  // failure here falls back to the full read, because a stale row on a deploy page is the
+  // one thing worse than an extra request.
   // `keepStep` is for the pre-flight poll (task 1004121): a refresh AFTER a move should
   // return the row to step one, but a refresh DURING the wait must not — it would close
   // the panel the owner is reading, under them, every two seconds.
   async function refreshOne(p, { keepStep = false } = {}) {
     const id = String(p.instance_id);
-    const isSelf = view.self && String(view.self.instance_id) === id;
     try {
-      const d = await fetchJson(isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
-      if (isSelf) view.self = d.preview;
-      else view.boxes = view.boxes.map((b) => (String(b.instance_id) === id ? d.preview : b));
+      const d = await fetchJson(view.isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
+      view.box = d.preview;
       if (!keepStep) steps.set(p.instance_id, 'preview');
       repaint();
     } catch (e) {
@@ -442,68 +526,73 @@
     }
   }
 
-  // The projects this control plane hosts. `/provisioning/fleet` is the whole roster and
-  // needs its own atom; a holder of core.pin.move who lacks it still gets their OWN
-  // projects rather than an error, because the pin move itself is gated server-side per
-  // instance either way — this choice only decides what the page can LIST.
-  async function hostedProjects() {
+  // Which project is this page about? The hall's own unless a scope was asked for.
+  //
+  // READ OFF `location`, DEFENSIVELY. The page runs in a vm harness whose `window.location`
+  // is a stub with no `search`, and a page that threw there would be untestable — but the
+  // deeper reason is that a missing scope is the ORDINARY case and must cost nothing.
+  function scopeSlug() {
+    try {
+      const q = String((window.location && window.location.search) || '');
+      const m = /[?&]project=([^&#]+)/.exec(q);
+      return m ? decodeURIComponent(m[1]) : null;
+    } catch (e) { return null; }
+  }
+
+  // Resolve a scoped slug to the instance the control plane knows by that name.
+  //
+  // `/provisioning/fleet` is the whole roster and needs its own atom; a holder of
+  // core.pin.move who lacks it falls back to their OWN projects, which is the set a
+  // project's owner is arriving from anyway. This is a LOOKUP, not a listing: exactly one
+  // row survives it, and the pin move is gated server-side per instance regardless — the
+  // slug decides what is looked at, never what is allowed.
+  async function findBySlug(slug) {
+    let rows = [];
     try {
-      const d = await fetchJson('/provisioning/fleet');
-      return d.instances || [];
+      rows = (await fetchJson('/provisioning/fleet')).instances || [];
     } catch (e) {
-      if (e && e.kind === '403') {
-        const d = await fetchJson('/provisioning/instances');
-        return d.instances || [];
-      }
-      throw e;
+      if (e && e.kind !== '403') throw e;
+      rows = (await fetchJson('/provisioning/instances')).instances || [];
     }
+    return rows.find((i) => i && String(i.slug) === slug) || null;
   }
 
-  // Only a RUNNING box can have its pin moved, and the runner refuses every other shape.
-  // Filtering here keeps torn-down rows — there are far more of them than live ones — off
-  // a page whose whole job is naming what is live.
-  const UPGRADEABLE = new Set(['standalone', 'co-tenant']);
-  const isLive = (i) => i && i.status === 'active' && UPGRADEABLE.has(i.hosting_shape);
-
   async function load() {
+    const slug = scopeSlug();
     try {
-      let self = null;
-      let notEnrolled = null;
-      try {
-        const d = await fetchJson('/provisioning/control-plane');
-        self = d.preview;
-      } catch (e) {
-        if (e && e.kind === '401') return;
-        if (e && e.kind === '403') throw e;
-        notEnrolled = e.message || 'This platform has no deploy door yet.';
-      }
-
-      const live = (await hostedProjects()).filter(isLive);
-      // One preview per project, in parallel and INDEPENDENTLY: one project that cannot
-      // be read must not blank the page for the others. The request count scales with the
-      // fleet, which is deliberate and bounded — each is a cached server-side reading, not
-      // a live probe of the box, and this page exists precisely to show every box's state
-      // at once. It is re-read on OPEN only; a move refreshes just its own row.
-      const settled = await Promise.all(live.map(async (inst) => {
+      if (!slug) {
+        // THE HALL'S OWN PROJECT. On the control plane that is the self row, which is why
+        // this endpoint exists: the row is created once at install time and its id differs
+        // per install, so the page cannot be expected to know it.
+        view = { box: null, isSelf: true, name: 'This platform', notEnrolled: null, unreadable: null };
         try {
-          const d = await fetchJson(`/provisioning/instances/${inst.id}/core-upgrade`);
-          return { ok: true, preview: d.preview };
+          view.box = (await fetchJson('/provisioning/control-plane')).preview;
+          view.name = (view.box && view.box.slug) || 'This platform';
         } catch (e) {
-          if (e && e.kind === '401') return { ok: false, inst, message: 'not signed in' };
-          return { ok: false, inst, message: (e && e.message) || 'unknown error' };
+          if (e && e.kind === '401') return;
+          if (e && e.kind === '403') throw e;
+          view.notEnrolled = e.message || 'This platform has no deploy door yet.';
         }
-      }));
-
-      view = {
-        self,
-        notEnrolled,
-        boxes: settled.filter((s) => s.ok).map((s) => s.preview),
-        unreadable: settled.filter((s) => !s.ok).map((s) => ({ inst: s.inst, message: s.message })),
-      };
-      const n = view.boxes.length + view.unreadable.length;
-      $('dp-sub').textContent = n
-        ? `This platform and ${n} hosted project${n === 1 ? '' : 's'}`
-        : 'This platform';
+        $('dp-sub').textContent = (view.box && view.box.slug) || 'This platform';
+      } else {
+        view = { box: null, isSelf: false, name: slug, notEnrolled: null, unreadable: null };
+        const inst = await findBySlug(slug);
+        if (!inst) {
+          // NAMED, NOT BLANK. A project the control plane cannot find is a wrong link or a
+          // torn-down project, and both are worth saying out loud — a deploy page that
+          // renders nothing reads as a project with nothing to deploy.
+          view.unreadable = 'no project by that name is hosted here.';
+        } else {
+          try {
+            view.box = (await fetchJson(`/provisioning/instances/${inst.id}/core-upgrade`)).preview;
+          } catch (e) {
+            if (e && e.kind === '401') return;
+            if (e && e.kind === '403') throw e;
+            view.unreadable = (e && e.message) || 'unknown error';
+          }
+        }
+        $('dp-sub').textContent = slug;
+      }
       $('dp-body').hidden = false;
       repaint();
     } catch (e) {

package/modules/hall-ui/public/goals-page.js

@@ -1052,6 +1052,12 @@
       // ADR 0174: the craft axis again, scoped to the tasks inside one goal.
       { id: 'f-goal-discipline', label: `Task ${window.OTB.roleAxisLabel().toLowerCase()}`, options: window.OTB.roleOptions({ unset: true }) }, // ADR 0174
       { id: 'f-goal-newcomer', label: 'Newcomer', options: [{ value: '', label: '— any —' }, { value: 'yes', label: 'newcomer-friendly only' }] },
+      // The board's "Only mine" lens, scoped to one goal. Inside a goal the
+      // membership half of that question is already answered (you are looking at
+      // one goal, and the page says whether you are on it), so what is left is the
+      // claim half: of the work queued here, what am I holding? Answered from
+      // state.claimsByTask, which the detail already loads for the Release button.
+      { id: 'f-goal-claimed', label: 'Mine', options: [{ value: '', label: '— anyone\'s —' }, { value: 'mine', label: 'claimed by me' }] },
       { id: 'f-goal-fit', label: 'Run mode', options: [{ value: '', label: '— any —' },
         { value: 'parallel', label: 'parallel-safe only' },
         { value: 'conflict', label: 'has file conflicts' }] },

package/modules/hall-ui/public/goals-render.js

@@ -111,7 +111,14 @@
       || !!(state.disciplines && state.disciplines.get(String(g.id))?.has(role));
     const matchesStale = (g) => !staleDays || isStale(goalActivityMs(g), staleDays);
     const myId = selfId();
+    // GET /goals now answers this on the row itself (`viewer_is_member`, an EXISTS
+    // over goal_members for the AUTHENTICATED reader), which is what this lens
+    // reads first. The per-goal detail is kept as the fallback, and the order
+    // matters: the detail prefetch is a best-effort fan-out, so on a slow or
+    // partly-failed boot the lens used to return NOTHING and say, in effect, "you
+    // are on no goals" — a claim about the reader, made out of a failed fetch.
     const iAmMember = (g) => {
+      if (typeof g.viewer_is_member === 'boolean') return g.viewer_is_member;
       const d = state.details.get(String(g.id));
       return d ? (d.members || []).some((m) => sameId(m.builder_id, myId)) : false;
     };
@@ -505,12 +512,21 @@
     const kFilter = $('#f-goal-kind')?.value || '';
     const dFilter = $('#f-goal-discipline')?.value || '';
     const nFilter = $('#f-goal-newcomer')?.value || '';
+    // "Mine" inside a goal = the claims this builder is holding here. Signed out
+    // there is no answer, so the lens is inert rather than emptying the list.
+    const myId = selfId();
+    const mineFilter = (myId != null && $('#f-goal-claimed')?.value === 'mine');
+    const claimedByMe = (t) => {
+      const c = state.claimsByTask.get(String(t.id));
+      return !!(c && sameId(c.builder_id, myId));
+    };
     const sortBy = $('#f-goal-sort')?.value || 'cpm';
     let list = state.work.todo.filter((t) => {
       if (!matchesTodoSearch(t, sQuery)) return false;
       if (kFilter && (t.kind || window.OTB.KIND_UNSET) !== kFilter) return false;
       if (dFilter && (t.discipline || window.OTB.ROLE_UNSET) !== dFilter) return false;
       if (nFilter === 'yes' && !t.newcomer_friendly) return false;
+      if (mineFilter && !claimedByMe(t)) return false;
       return true;
     });
     // Run-mode filter: parallel-safe (touches[] disjoint from the rest of the