@bongos/core 1.20.10 → 1.20.12

package/migrations/core_264_claimable_respects_dependencies.sql

@@ -0,0 +1,115 @@
+-- core_264 — claimable_tasks must also consult the DEPENDENCY graph (task
+-- 1004190, finding #60 of the task 1000379 audit).
+--
+-- THE DEFECT. core_239's view filters on status, smoke titles, open blockers and
+-- touches-overlap — and never once on `dependencies`. So a task sitting at
+-- 'ready' whose predecessor has not shipped is ADVERTISED by /builder-start, the
+-- optimizer and every claimable feed, and only `POST /claims` refuses it
+-- (DEPS_NOT_SHIPPED, step 10 of the refusal ladder in modules/lifecycle/CLAUDE.md).
+-- That is the "feed lies" family: the queue offers work the server will not let
+-- you take. core_239 named this gap by number in its own header and deferred it
+-- deliberately; this is the deferred half.
+--
+-- HOW A 'ready' ROW GETS UNSHIPPED DEPS AT ALL. The migration-163 auto-promotion
+-- triggers gate backlog -> ready on task_is_fully_unblocked, so the common path
+-- cannot produce one. The paths that CAN: a hand-promoted row
+-- (POST /tasks/:id/promote), a dependency edge ADDED after the task reached
+-- 'ready' (nothing demotes it), and a dependency target that leaves 'shipped'
+-- later. db-claims.js calls its own dep check "the second line of defence" for
+-- exactly these; the feed had no first line at all.
+--
+-- WHICH PREDICATE, AND WHY NOT task_is_fully_unblocked. There are two dependency
+-- predicates in this codebase and they disagree on ONE case:
+--
+--   unsatisfiedDeps (modules/lifecycle/db-deps-criteria.js) — what POST /claims
+--     actually runs. Each arm JOINs the target table, so an edge whose target row
+--     no longer exists produces no row and does not gate.
+--   task_is_fully_unblocked (core_245) — what the promotion triggers run. Its
+--     header states the opposite reading: an orphaned `to` "counts as un-done ->
+--     task stays blocked (fail-closed)".
+--
+-- Calling task_is_fully_unblocked here would have been the shorter line, and it
+-- would have re-created core_239's bug inverted: a task with one orphaned edge
+-- would vanish from the feed while POST /claims cheerfully accepted it —
+-- workable by id, unfindable in the queue, permanently, with no blocker row to
+-- explain it. The DONE-WHEN of this task is that the view and the claim path
+-- AGREE, so the view mirrors unsatisfiedDeps' three UNION arms verbatim, not the
+-- promotion predicate. Fail-closed is the right default when the two gates are
+-- answering different questions; here they are answering the SAME question and
+-- matching beats hedging. (The blocker clause below is untouched and stays
+-- fail-closed — that one IS core_239's own question.)
+--
+-- ABANDONED STAYS GATING. `x.status <> 'shipped'` counts 'abandoned' as un-done,
+-- so a task behind a cut prerequisite is now hidden from the feed rather than
+-- offered and refused. That is the owner ruling of 2026-08-21 (modules/lifecycle/
+-- CLAUDE.md) applied consistently, NOT finding #61: nothing here skips abandoned,
+-- and the loud surfaces the ruling made load-bearing are untouched —
+-- `scripts/gds/audit-deps.js --stranded`, `/backlog-review`'s depGated bucket and
+-- the dead_deps refusal hint all read the dependency graph directly, never this
+-- view.
+--
+-- THE THREE OTHER COPIES. The same view body is inlined as CLAIMABLE_SQL in
+-- modules/lifecycle/db-tasks.js and inside src/bongos/optimizer.js's query (task
+-- 2181: raw-table reads so the feed cannot park behind a view DDL lock). core_239
+-- changed the view alone and the feed did not move for the whole life of task
+-- 1003913. Both copies carry this clause as of this change, and
+-- tests/claimable_blocker_status.mjs pins all three against each other.
+--
+-- COST, AND WHY THIS SHIPS NO INDEX. This is the /builder-start hot path, so the
+-- question is fair and the answer is that every lookup the clause makes is already
+-- covered — which is why there is no index migration beside this one:
+--
+--   the three from_kind arms  -> idx_dependencies_from (from_kind, from_id), migration 163.
+--                                All three probe the SAME two columns, so the planner
+--                                can BitmapOr three index scans rather than seq-scan.
+--   the criterion arm's IN    -> idx_task_criteria_task (task_id), migration 055.
+--   the three doneness EXISTS -> the primary keys of tasks / done_when_criteria / goals.
+--
+-- `d.to_kind` / `d.to_id` appear only as filters on rows already found through the
+-- from-side index, never as a lookup key, so idx_dependencies_to is not on this path.
+-- Asserted, not just claimed: tests/claimable_blocker_status.mjs fails if either
+-- named index leaves migrations/, because a comment cannot notice that.
+--
+-- Idempotent: DROP VIEW IF EXISTS + CREATE, the shape core_231 and core_239 used.
+-- The column list stays the `t.*` wildcard plus the calibrated-minutes column,
+-- byte-identical to core_239 (core_227's header records six columns that silently
+-- never reached the feed because a rewrite spelled the list out instead).
+
+BEGIN;
+
+DROP VIEW IF EXISTS claimable_tasks;
+CREATE VIEW claimable_tasks AS
+SELECT t.*,
+       pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
+  FROM tasks t
+ WHERE t.status = 'ready'
+   AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+   AND NOT EXISTS (
+     SELECT 1
+       FROM task_blockers tb
+       LEFT JOIN blockers b ON b.id = tb.blocker_id
+      WHERE tb.task_id = t.id
+        AND (b.id IS NULL OR b.status = 'open')
+   )
+   AND NOT EXISTS (
+     SELECT 1
+       FROM dependencies d
+      WHERE ((d.from_kind = 'task'      AND d.from_id = t.id)
+          OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+          OR (d.from_kind = 'criterion' AND d.from_id IN (
+                SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)))
+        AND ((d.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = d.to_id AND x.status <> 'shipped'))
+          OR (d.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = d.to_id AND x.satisfied = false))
+          OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
+   )
+   AND NOT EXISTS (
+     SELECT 1 FROM claims c
+       JOIN tasks t2 ON t2.id = c.task_id
+      WHERE c.released_at IS NULL
+        AND t2.touches && t.touches
+   );
+
+COMMIT;
+
+INSERT INTO schema_migrations (version) VALUES ('core_264_claimable_respects_dependencies')
+  ON CONFLICT (version) DO NOTHING;

package/modules/hall-ui/public/panel.css

@@ -252,7 +252,7 @@ button.craft-save { display: inline-flex; align-items: center; justify-content:
   user-select: none;
 }
 .chip-ctl:has(input:checked), .craft-chip[data-on="1"] { color: var(--ink); border-color: var(--rule); }
-.chip-ctl input, .craft-pref {
+.chip-ctl input, .craft-pref, .speciality-offer__list input[type="checkbox"] {
   appearance: none;
   -webkit-appearance: none;
   position: relative;
@@ -262,7 +262,7 @@ button.craft-save { display: inline-flex; align-items: center; justify-content:
   flex: none;
   cursor: pointer;
 }
-.chip-ctl input::before, .craft-pref::before {
+.chip-ctl input::before, .craft-pref::before, .speciality-offer__list input[type="checkbox"]::before {
   content: "";
   position: absolute;
   inset: 5px;
@@ -272,8 +272,8 @@ button.craft-save { display: inline-flex; align-items: center; justify-content:
   border-radius: 4px;
   background: transparent;
 }
-.chip-ctl input:checked::before, .craft-pref:checked::before { background: var(--accent); border-color: var(--accent); }
-.chip-ctl input:checked::after, .craft-pref:checked::after {
+.chip-ctl input:checked::before, .craft-pref:checked::before, .speciality-offer__list input[type="checkbox"]:checked::before { background: var(--accent); border-color: var(--accent); }
+.chip-ctl input:checked::after, .craft-pref:checked::after, .speciality-offer__list input[type="checkbox"]:checked::after {
   content: "";
   position: absolute;
   left: 9px;

package/modules/hall-ui/public/settings-specialities.js

@@ -26,7 +26,9 @@
 
   // `walk` is the skills walkthrough in progress, or null (task 1004073):
   // { id, data, step, decisions, saving }. See walkHtml below.
-  const state = { rows: [], suggestions: [], openId: null, busy: false, walk: null };
+  // `offerId` / `offerChoices`: the owner's "what it offers" editor that is open,
+  // and its rendered choices once the instance's skills have loaded (task 1004404).
+  const state = { rows: [], suggestions: [], openId: null, busy: false, walk: null, offerId: null, offerChoices: null };
 
   const el = (id) => document.getElementById(id);
   const statusLine = (msg) => { const s = el('specialities-status'); if (s) s.textContent = msg || ''; };
@@ -211,12 +213,112 @@
     focusWalk();
   }
 
+  // ── WHAT A SPECIALITY OFFERS (task 1004404; ADR 0310 §1) ──────────────────
+  //
+  // The OWNER's half: which of this instance's skills the speciality puts on
+  // its menu. Until this, only the API could set it, so nothing made in the hall
+  // offered anything and the walkthrough above never appeared. Each choice shows
+  // the skill's plain description — the same words the walkthrough will show the
+  // people who adopt it — so the owner is choosing what to teach, not ticking
+  // names. Offering turns nothing on for anyone: every adopter still starts with
+  // all of them off and decides one at a time.
+  //
+  // The choices come from GET /specialities/installed-skills, so only skills
+  // this instance has are offered; the server's unknown_skill check on POST/PATCH
+  // stays the rule for anything a stale page sends.
+
+  let installedList = null; // fetched once per page, on first need
+  async function installedSkillList() {
+    if (!installedList) {
+      const data = await call('GET', '/specialities/installed-skills');
+      installedList = (data && data.skills) || [];
+    }
+    return installedList;
+  }
+
+  function offerChoicesHtml(all, chosen) {
+    const picked = new Set(chosen || []);
+    const gone = (chosen || []).filter((n) => !all.some((k) => k.name === n));
+    return `
+      <p class="prow__hint">
+        Offering a skill turns nothing on. Everyone who uses this speciality is shown
+        each one and chooses for themselves — all start off.
+      </p>
+      <label class="speciality-field">
+        <span>Find a skill</span>
+        <input type="search" class="speciality-offer__filter" placeholder="Type to narrow the list" />
+      </label>
+      <ul class="speciality-offer__list">
+        ${all.map((k) => `
+          <li data-find="${escapeHtml(`${k.name} ${k.does || ''}`.toLowerCase())}">
+            <label class="speciality-field speciality-field--check">
+              <input type="checkbox" name="skill" value="${escapeHtml(k.name)}" ${picked.has(k.name) ? 'checked' : ''} />
+              <span>
+                <strong>${escapeHtml(k.name)}</strong> — ${escapeHtml(k.does || 'Its author gave no description.')}
+                <small>${escapeHtml(k.cost || '')}</small>
+              </span>
+            </label>
+          </li>`).join('')}
+      </ul>
+      ${gone.length ? `<p class="prow__hint">No longer on this project, so saving drops it from the offer: ${gone.map((n) => `<code>${escapeHtml(n)}</code>`).join(', ')}.</p>` : ''}`;
+  }
+
+  const chosenSkills = (form) => [...form.querySelectorAll('input[name="skill"]:checked')].map((i) => i.value);
+
+  function narrowOffer(input) {
+    const q = input.value.trim().toLowerCase();
+    const list = input.closest('form') && input.closest('form').querySelector('.speciality-offer__list');
+    if (!list) return;
+    for (const li of list.children) li.hidden = q !== '' && !String(li.dataset.find || '').includes(q);
+  }
+
+  function offerFormHtml(s) {
+    return `
+      <form class="speciality-offer" data-id="${escapeHtml(String(s.id))}">
+        <h4 class="speciality-create__h">What ${escapeHtml(s.name)} offers</h4>
+        <div class="speciality-offer__choices">${state.offerChoices || '<p class="prow__hint">Loading this project’s skills…</p>'}</div>
+        <div class="speciality-actions">
+          <button type="submit" class="btn" ${state.offerChoices ? '' : 'disabled'}>Save what it offers</button>
+        </div>
+      </form>`;
+  }
+
+  async function openOffer(id) {
+    if (String(state.offerId) === String(id)) { state.offerId = null; render(); return; }
+    state.offerId = String(id);
+    state.offerChoices = null;
+    state.openId = null;
+    state.walk = null;
+    render();
+    try {
+      const all = await installedSkillList();
+      const row = state.rows.find((r) => String(r.id) === String(id));
+      if (state.offerId !== String(id) || !row) return;
+      state.offerChoices = offerChoicesHtml(all, row.skills || []);
+      render();
+    } catch (err) { statusLine(`Could not load this project’s skills — ${err.message}`); }
+  }
+
+  // The create form's picker fills the first time it is opened, so a builder
+  // who never offers a skill never pays for the list.
+  async function fillCreateOffer(host) {
+    if (host.dataset.filled) return;
+    host.dataset.filled = '1';
+    try {
+      host.innerHTML = offerChoicesHtml(await installedSkillList(), []);
+    } catch (err) {
+      delete host.dataset.filled;
+      host.innerHTML = `<p class="prow__hint">Could not load this project’s skills — ${escapeHtml(err.message)}</p>`;
+    }
+  }
+
   function cardHtml(s) {
     const trained = Number(s.documentCount || 0);
     const learned = Number(s.learningCount || 0);
     const open = String(state.openId) === String(s.id);
     const offered = Array.isArray(s.skills) ? s.skills.length : 0;
     const walking = state.walk && state.walk.id === String(s.id);
+    const offering = s.mine && String(state.offerId) === String(s.id);
     return `
       <li class="prow speciality-card" data-id="${escapeHtml(String(s.id))}">
         <div class="prow__main">
@@ -237,11 +339,13 @@
         <div class="prow__actions">
           ${s.active && offered && !walking ? `<button type="button" class="btn btn--quiet" data-act="walk" data-id="${escapeHtml(String(s.id))}">Choose its skills</button>` : ''}
           ${s.mine ? `<button type="button" class="btn btn--quiet" data-act="train" data-id="${escapeHtml(String(s.id))}">${open ? 'Close' : 'Train'}</button>` : ''}
+          ${s.mine ? `<button type="button" class="btn btn--quiet" data-act="offer" data-id="${escapeHtml(String(s.id))}" aria-expanded="${offering}">${offering ? 'Close' : 'Offered skills'}</button>` : ''}
           ${s.active
             ? `<button type="button" class="btn btn--quiet" data-act="abandon" data-id="${escapeHtml(String(s.id))}">Stop using</button>`
             : `<button type="button" class="btn" data-act="adopt" data-id="${escapeHtml(String(s.id))}" ${s.adoptable ? '' : 'disabled'}>Use this</button>`}
         </div>
         ${open ? trainHtml(s) : ''}
+        ${offering ? offerFormHtml(s) : ''}
         ${walking ? walkHtml() : ''}
       </li>`;
   }
@@ -388,11 +492,28 @@
         if (!btn) return;
         const { act: action, id } = btn.dataset;
         if (action === 'walk') { openWalk(id); return; }
-        if (action === 'train') { state.openId = String(state.openId) === String(id) ? null : id; state.walk = null; render(); return; }
+        if (action === 'offer') { openOffer(id); return; }
+        if (action === 'train') { state.openId = String(state.openId) === String(id) ? null : id; state.walk = null; state.offerId = null; render(); return; }
         act(action, id);
       });
 
+      host.addEventListener('input', (e) => {
+        if (e.target.matches('.speciality-offer__filter')) narrowOffer(e.target);
+      });
+
       host.addEventListener('submit', async (e) => {
+        const offer = e.target.closest('form.speciality-offer');
+        if (offer) {
+          e.preventDefault();
+          const skills = chosenSkills(offer);
+          try {
+            await call('PATCH', `/specialities/${offer.dataset.id}`, { skills });
+            state.offerId = null;
+            toast(skills.length ? `Saved — it offers ${skills.length} skill${skills.length === 1 ? '' : 's'}.` : 'Saved — it offers no skills.');
+            await load();
+          } catch (err) { statusLine(`Could not save what it offers — ${err.message}`); }
+          return;
+        }
         const form = e.target.closest('form.speciality-train');
         if (!form) return;
         e.preventDefault();
@@ -426,8 +547,10 @@
             contract_md: create.elements.contract_md.value.trim(),
             visibility: create.elements.visibility.value,
             sellable: create.elements.sellable.checked,
+            skills: chosenSkills(create),
           });
           create.reset();
+          for (const li of create.querySelectorAll('.speciality-offer__list > li')) li.hidden = false;
           toast('Speciality created.');
           await load();
         } catch (err) { statusLine(err.message); }
@@ -445,7 +568,21 @@
       };
       vis.addEventListener('change', sync);
       sync();
+
+      // The skills picker (task 1004404): filled on first open, narrowed as you type.
+      const offerBox = el('speciality-create-offer');
+      const offerHost = el('speciality-create-skills');
+      if (offerBox && offerHost) offerBox.addEventListener('toggle', () => { if (offerBox.open) fillCreateOffer(offerHost); });
+      create.addEventListener('input', (e) => {
+        if (e.target.matches('.speciality-offer__filter')) narrowOffer(e.target);
+      });
     }
+
+    // Enter in a "Find a skill" box narrows the list; it must not submit the
+    // form around it half-chosen.
+    document.addEventListener('keydown', (e) => {
+      if (e.key === 'Enter' && e.target && e.target.matches && e.target.matches('.speciality-offer__filter')) e.preventDefault();
+    });
   }
 
   function boot() {

package/modules/hall-ui/public/settings.css

@@ -199,6 +199,32 @@ select.voices__select { min-width: 140px; }
 .speciality-field--check { flex-direction: row; align-items: flex-start; gap: 0.5rem; }
 .speciality-field--check input { margin-top: 0.2rem; }
 .speciality-actions { display: flex; gap: 0.5rem; }
+/* What a speciality OFFERS (task 1004404): the owner's pick-list of this
+   instance's skills, each with its plain line. Sixty-odd rows, so the list
+   scrolls inside its own box rather than pushing the form's buttons off-screen;
+   the reading lines keep the measure. */
+.speciality-field input[type='search'] { width: 100%; box-sizing: border-box; }
+.speciality-offer,
+.speciality-offer-box { flex-basis: 100%; display: flex; flex-direction: column; gap: 0.6rem; }
+.speciality-offer { margin-top: 0.75rem; padding-top: 0.75rem; border-top: 1px solid var(--rule); }
+.speciality-offer > *, .speciality-offer-box > * { max-width: var(--measure); }
+.speciality-offer-box > summary { cursor: pointer; font-size: 0.85rem; min-height: 24px; padding-block: 2px; box-sizing: border-box; }
+.speciality-offer-box > summary small { opacity: 0.7; }
+.speciality-offer__choices, #speciality-create-skills { display: flex; flex-direction: column; gap: 0.6rem; }
+.speciality-offer__list {
+  list-style: none;
+  margin: 0;
+  padding: 0 0.25rem 0 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  max-height: 24rem;
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+.speciality-offer__list li[hidden] { display: none; }
+.speciality-offer__list strong { font-family: var(--font-mono); font-weight: 600; }
+.speciality-offer__list .speciality-field--check > span { font-size: 0.85rem; line-height: 1.45; }
 /* The adopted contract, shown in full before "Use this" — another builder's prose
    reaching your sessions is the one thing here that must never be folded away. */
 .speciality-contract { flex-basis: 100%; margin-top: 0.5rem; font-size: 0.85rem; }

package/modules/hall-ui/public/settings.html

@@ -259,6 +259,10 @@
                     <small>Records your decision only — there is no marketplace yet, and nothing is listed anywhere.</small>
                   </span>
                 </label>
+                <details id="speciality-create-offer" class="speciality-offer-box">
+                  <summary>Skills it offers <small>(optional)</small></summary>
+                  <div id="speciality-create-skills"><p class="prow__hint">Loading this project’s skills…</p></div>
+                </details>
                 <div class="speciality-actions">
                   <button type="submit" class="btn">Create speciality</button>
                 </div>

package/modules/hall-ui/public/settings.states.json

@@ -11,6 +11,7 @@
     "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },
     "preferences": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900]], "expect": { "visible": ["#wander-rows", "#render-rows", "#specialities-rows"] } },
     "skills-walkthrough": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900], ["click", "#specialities-rows button[data-act=\"adopt\"]"], ["wait", 700]], "expect": { "visible": [".skill-walk", ".skill-walk__facts", "button[data-walk=\"on\"]", "button[data-walk=\"off\"]"] } },
+    "offered-skills": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900], ["click", "#specialities-rows button[data-act=\"offer\"]"], ["wait", 700]], "expect": { "visible": ["form.speciality-offer", ".speciality-offer__list", ".speciality-offer__filter"] } },
     "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } },
     "update": { "auth": true, "url": "/settings#software-update", "actions": [["wait", 1200]], "expect": { "visible": ["#software-update-h", "#su-body", "#su-update", ".su-versions"] } }
   },

package/modules/hall-ui/records/panel-family.md

@@ -28,3 +28,5 @@ Also fixed here, as the board task handed forward: the two sub-24px links on Hom
 - **Kit:** `settings.states.json` `update`, ALL CLEAN at 1440/390/320 × dark/light against the harness with the fixture `software-update.json` (a live reading for 1.19.1033). Tests: `tests/software_update.mjs`.
 
 **Settings: adopting a speciality walks through its skills (task 1004073, ADR 0310 §3)** — the owner ruled an adopted speciality's skills start OFF "and you should walk through what comes with each". So adopting one that offers skills opens `.skill-walk` inside its card: one skill per step (what it does, when to reach for it, what it costs, what it needs, who can run it), "Leave it off" / "Turn it on" at EQUAL weight (plain `.pbtn`, no accent — the default is off, so the page must not lean toward on), Back, then a recap restating each skill in a line, then ONE `PUT` of the whole set. "Finish later" saves nothing. Focus moves to each new step heading. Two things found on the way: the specialities panel shipped `hidden` and nothing ever revealed it, so adoption was unreachable from the hall; and its contract `<summary>` measured 21px once visible (now 24). **Kit:** `settings.states.json` `skills-walkthrough` + `preferences`, ALL CLEAN at 1440/390/320 × dark/light against the harness, with fixtures `specialities*.json` built from the real skills on disk and canned answers for adopt and save. Tests: `tests/speciality_walkthrough_ui.mjs` (runs the real page script).
+
+**Settings: a speciality's owner chooses what it offers (task 1004404, ADR 0310 §1)** — until this only the API could set an offer, so the walkthrough above never appeared for a speciality made in the hall. The create form gains a `<details>` "Skills it offers" picker (filled on first open, so a builder who never offers one never pays for the list), and an owned card gains "Offered skills", an inline `form.speciality-offer` like Train. Both list `GET /specialities/installed-skills` — only what this instance has — each row a checkbox with the skill's plain line and cost, the words adopters will see, under a line saying offering turns nothing on. A "Find a skill" box narrows the sixty-odd rows (Enter never submits), the list scrolls in its own box, an offered skill removed since is named and dropped on save rather than silently kept, and saving is ONE `PATCH { skills }`. **The checkboxes take the shared 24px rule in `panel.css`** (the `.chip-ctl input` / `.craft-pref` block, one selector added) rather than a fourth copy of the `::before` box; without it 128 targets measured 13px. **Kit:** `settings.states.json` `offered-skills` + `preferences`, ALL CLEAN at 1440/390/320 × dark/light, with fixtures `specialities__installed-skills.json` (the real 64 skills, explained) and an owned speciality in `specialities.json`, plus canned POST/PATCH answers. Tests: `tests/speciality_offer_ui.mjs` (runs the real page script).

package/modules/lifecycle/db-tasks.js

@@ -883,11 +883,52 @@ const OPEN_BLOCKER_GUARD = `
           AND (b.id IS NULL OR b.status = 'open')
      )`;
 
+// THE DEPENDENCY GUARD, spelled ONCE (task 1004190, finding #60).
+//
+// The sibling of OPEN_BLOCKER_GUARD, and it was missing entirely until now: the
+// claimable feed filtered on status, smoke titles, open blockers and touches
+// overlap, and never on `dependencies`. A task at 'ready' whose predecessor has
+// not shipped was ADVERTISED here and then refused by POST /claims with
+// DEPS_NOT_SHIPPED — the same "the feed lies" family core_239 fixed for blockers.
+//
+// THIS MIRRORS unsatisfiedDeps (db-deps-criteria.js), NOT task_is_fully_unblocked.
+// The two predicates disagree on one case and the disagreement is deliberate on
+// both sides: an edge whose target row no longer exists does NOT gate a claim
+// (each of unsatisfiedDeps' arms JOINs the target, so an orphan produces no row)
+// and DOES block promotion (core_245's header calls that fail-closed). Copying the
+// promotion predicate into the feed would hide a task POST /claims would accept —
+// core_239's bug inverted, and invisible to the builder looking for it. The feed
+// must say exactly what the claim gate will do, so the three UNION arms of
+// unsatisfiedDeps are reproduced here verbatim.
+//
+// `x.status <> 'shipped'` keeps 'abandoned' gating, per the owner ruling of
+// 2026-08-21 (see ./CLAUDE.md). A task behind a cut prerequisite is now hidden
+// rather than offered-and-refused; the surfaces that must stay LOUD about it read
+// the dependency graph directly (audit-deps.js --stranded, /backlog-review, the
+// dead_deps refusal hint) and never this feed.
+//
+// ONE query interpolates it, not two. SESSION_FIT_SQL is deliberately left alone:
+// it is only ever JOINed onto this feed (here and in optimizer.js), so the guard
+// already applies to every row it can see, and adding it there would change what
+// the tasks_session_fit VIEW means with no migration saying so.
+const UNSHIPPED_DEPS_GUARD = `
+     AND NOT EXISTS (
+       SELECT 1
+         FROM dependencies d
+        WHERE ((d.from_kind = 'task'      AND d.from_id = t.id)
+            OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+            OR (d.from_kind = 'criterion' AND d.from_id IN (
+                  SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)))
+          AND ((d.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = d.to_id AND x.status <> 'shipped'))
+            OR (d.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = d.to_id AND x.satisfied = false))
+            OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
+     )`;
+
 const CLAIMABLE_SQL = `
   SELECT t.*, pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
     FROM tasks t
    WHERE t.status = 'ready'
-     AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'${OPEN_BLOCKER_GUARD}
+     AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
      AND NOT EXISTS (
        SELECT 1 FROM claims c
          JOIN tasks t2 ON t2.id = c.task_id

package/modules/specialities/routes/specialities.js

@@ -285,6 +285,22 @@ module.exports = function buildSpecialitiesRouter() {
     res.json({ suggestions });
   }));
 
+  // GET /specialities/installed-skills — every skill THIS instance has, each
+  // explained the way the adoption walkthrough explains it, so a speciality's
+  // owner can choose what it offers from the hall (task 1004404). The CHOICES
+  // only: the POST/PATCH `skills` check (unknown_skill) is still the rule, so a
+  // stale page that sends a name removed since is refused, not trusted. Nothing
+  // here is per-builder and the list is public knowledge of the install — every
+  // name is already materialised into each checkout's .claude/skills/.
+  // Mounted before '/specialities/:id' would capture it as an id. Read-only;
+  // rank: any builder.
+  router.get('/specialities/installed-skills', api.requireBuilder, asyncHandler('GET /specialities/installed-skills', async (_req, res) => {
+    const skills = [...installedSkills()]
+      .map(([name, entry]) => skillsLib.explainSkill({ name, ...entry }))
+      .sort((a, b) => a.name.localeCompare(b.name));
+    res.json({ skills });
+  }));
+
   router.get('/specialities/:id', api.requireBuilder, asyncHandler('GET /specialities/:id', async (req, res) => {
     const id = parseId(req, res, { code: 'bad_id' });
     if (id === null) return;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.10",
+  "version": "1.20.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.10",
+      "version": "1.20.12",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.10",
+  "version": "1.20.12",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8112,5 +8112,17 @@
       "id": "1004403",
       "text": "When you adopt a speciality, each skill it offers is now explained in plain words: what it does, when you would use it, and what it costs, including which ones spend money. Before, those explanations were guessed from technica"
     }
+  ],
+  "1.20.11": [
+    {
+      "id": "1004404",
+      "text": "You can now choose which skills your speciality offers from Settings, not just through the API. You can do it when you create the speciality or later from its card. Each skill is listed with a plain description and what it cos"
+    }
+  ],
+  "1.20.12": [
+    {
+      "id": "1004190",
+      "text": "The task list no longer offers you work the system will refuse: a job waiting on another job that hasn't finished yet is now hidden until it's actually ready to start."
+    }
   ]
 }

package/scripts/hall-preview/server.js

@@ -164,6 +164,10 @@ const CANNED_WRITES = [
   // opens the skills walkthrough and its recap can save in the harness.
   ['POST', /^specialities\/\d+\/adopt$/, 'specialities__9__adopt.post'],
   ['PUT', /^specialities\/\d+\/skills$/, 'specialities__9__skills.put'],
+  // the owner choosing what a speciality offers (task 1004404): on create, and
+  // afterwards from the card's "Offered skills" editor.
+  ['POST', /^specialities$/, 'specialities.post'],
+  ['PATCH', /^specialities\/\d+$/, 'specialities__12.patch'],
 ];
 
 // A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request

package/src/bongos/optimizer.js

@@ -52,6 +52,31 @@ const OPEN_BLOCKER_GUARD = `
                  AND (b.id IS NULL OR b.status = 'open')
             )`;
 
+// The dependency guard, once (task 1004190, finding #60). Same predicate as
+// migration core_264 and as db-tasks.js's UNSHIPPED_DEPS_GUARD, duplicated ACROSS
+// those files for the ADR 0083 reason above and deduplicated WITHIN this one.
+//
+// It mirrors unsatisfiedDeps (the claim gate), not task_is_fully_unblocked (the
+// promotion predicate): the two disagree on an edge whose target row is gone, and
+// the feed must say what POST /claims will actually do. Full rationale in
+// core_264's header.
+//
+// Only the claimable body below interpolates it — the session-fit body is JOINed
+// onto that body, so every row it can see is already guarded, and putting it there
+// would change what the tasks_session_fit VIEW means with no migration saying so.
+const UNSHIPPED_DEPS_GUARD = `
+            AND NOT EXISTS (
+              SELECT 1
+                FROM dependencies d
+               WHERE ((d.from_kind = 'task'      AND d.from_id = t.id)
+                   OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+                   OR (d.from_kind = 'criterion' AND d.from_id IN (
+                         SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)))
+                 AND ((d.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = d.to_id AND x.status <> 'shipped'))
+                   OR (d.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = d.to_id AND x.satisfied = false))
+                   OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
+            )`;
+
 const VALID_MODES = ['active', 'check-in', 'autonomous'];
 const DEFAULT_MAX_PARALLEL = 3;
 
@@ -90,7 +115,7 @@ async function optimizeSession({ builderId, mode, timeBudgetMin, maxParallel })
            FROM tasks t
           WHERE t.status = 'ready'
             AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
-${OPEN_BLOCKER_GUARD}
+${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
             AND NOT EXISTS (
               SELECT 1 FROM claims c
                 JOIN tasks t2 ON t2.id = c.task_id

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.10'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.12'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');