@bongos/core 1.20.66 → 1.20.68

package/modules/hall-ui/public/task.js

@@ -305,8 +305,17 @@
   function lifecycleRail(t, credits) {
     const at = RAIL_AT[t.status] ?? 0;
     const landed = t.status === 'shipped' && credits != null;
+    // task 1004487 — the first beat's caption is what tells a reader WHICH of
+    // the three unclaimed states this is, so it has to read the dependency
+    // graph too: a dep added after promotion leaves the row at `ready` while
+    // the claim gate refuses it, and "waiting for a builder" would then be the
+    // one sentence on the page that is wrong.
+    const waitingOnDep = (t.dependencies || []).some((d) => d.status !== 'shipped');
+    const claimCaption = (t.status === 'ready' && waitingOnDep)
+      ? CLAIM_CAPTION.blocked
+      : (CLAIM_CAPTION[t.status] || 'one builder, one worktree');
     const beats = [
-      ['Claim', CLAIM_CAPTION[t.status] || 'one builder, one worktree'],
+      ['Claim', claimCaption],
       ['Build', 'the code and the docs'],
       ['Grade', 'the panel reads the diff'],
       ['Ship', 'merged, then deployed'],
@@ -727,8 +736,22 @@
     // owed rebase, a module/touches conflict, …) is still possible and still
     // surfaces, because claimAction.claim() carries the same friendlyClaimError
     // switch the board uses, not a second guess at it here.
-    if (t.status === 'ready') {
+    //
+    // task 1004487 — the status is NOT the whole answer, and the paragraph
+    // above assumed it was. A dependency added after this task was promoted
+    // leaves the row at `ready` and never at `blocked`: ADR 0015 rules that the
+    // status stays put and the READERS change, which is what core_264 did for
+    // the claimable feed. So the button also asks the dependency question the
+    // feed asks, from the `dependencies[]` the record already carries (an edge
+    // is met iff its target shipped — the DEPS_NOT_SHIPPED rule verbatim), and
+    // when the answer is no it says so in words rather than offering a control
+    // that cannot work, exactly as the retire refusals below do.
+    const unmetDeps = deps.filter((d) => d.status !== 'shipped');
+    if (t.status === 'ready' && unmetDeps.length === 0) {
       lifecycle = `<button class="td-btn td-btn--primary" type="button" id="claim-btn">Claim it</button>`;
+    } else if (t.status === 'ready') {
+      const names = unmetDeps.map((d) => `${d.id}`).join(', ');
+      lifecycle = `<p class="rec-actnote">This task is waiting on ${unmetDeps.length === 1 ? 'task' : 'tasks'} ${escapeHtml(names)}. It cannot be claimed until ${unmetDeps.length === 1 ? 'that one ships' : 'those ship'} — see Blocked by above.</p>`;
     } else if (t.status === 'confirmed' && (isSupervisor || ownsLastClaim)) {
       lifecycle = `<button class="td-btn td-btn--primary" type="button" id="ship-btn">Ship it</button>`;
     } else if (t.status === 'completed') {

package/modules/lifecycle/goal-rollup.js

@@ -19,10 +19,11 @@
 // THE BUCKETS ARE THE CLIENT'S, VERBATIM. goals-lib.js `readinessOf` is the
 // definition of record and this SQL mirrors it exactly — done (shipped |
 // confirmed | completed) · cut (abandoned | dropped, excluded from the total the
-// way migration 017 keeps them out of version_progress) · active · ready ·
-// blocked (backlog with >=1 unshipped dependency) · backlog. A divergence here
-// would show a person different numbers depending on which surface they opened,
-// so tests/goal_sort_staleness.mjs pins the two against each other.
+// way migration 017 keeps them out of version_progress) · active · blocked
+// (unclaimed with >=1 unshipped dependency, whatever the status column says —
+// task 1004487) · ready · backlog. A divergence here would show a person
+// different numbers depending on which surface they opened, so
+// tests/goal_sort_staleness.mjs pins the two against each other.
 //
 // LAST ACTIVITY is `max(updated_at, shipped_at)` — the same "any task activity
 // counts" rule the client uses (task 1002965, the owner's call), now expressed
@@ -43,8 +44,8 @@ const { DONE_STATUSES, CUT_STATUSES } = require('./task-status');
 // Returns [{ goal_id, done, active, ready, blocked, backlog, cut, total,
 //            last_activity_at, disciplines[], next_ready_id, next_ready_title }].
 //
-// `blocked` needs the dependency edges, so the CTE resolves each backlog task's
-// unshipped-dependency count once rather than per row. deps.pool honors the #538
+// `blocked` needs the dependency edges, so the CTE resolves each task's
+// unshipped-dependency flag once rather than per row. deps.pool honors the #538
 // test seam (NODE_ENV==='test' only), like every other helper in this module.
 // VISIBILITY. A rollup is a COUNT, and counts on a private goal are not the
 // secret — its prose is (ADR 0112's leak rule: a non-member must not learn a
@@ -78,8 +79,13 @@ async function goalRollups({ versionId = null, viewerId = null, viewerIsArchon =
                 WHEN s.status = ANY($2::text[]) THEN 'done'
                 WHEN s.status = ANY($3::text[]) THEN 'cut'
                 WHEN s.status = 'active'  THEN 'active'
+                -- task 1004487 — ahead of the 'ready' arm, and no longer
+                -- backlog-only: a dependency added after promotion leaves the
+                -- row at 'ready' (ADR 0015 demotes the readers, never the
+                -- status), so counting it ready advertises work POST /claims
+                -- refuses — and next_ready below reads this very bucket.
+                WHEN s.has_unshipped_dep  THEN 'blocked'
                 WHEN s.status = 'ready'   THEN 'ready'
-                WHEN s.status = 'backlog' AND s.has_unshipped_dep THEN 'blocked'
                 ELSE 'backlog'
               END AS bucket
          FROM scoped s

package/modules/lifecycle/task-status.js

@@ -27,7 +27,10 @@
 //     tests/goal_sort_staleness.mjs pins). "Done" there means "no longer in the
 //     queue", which deliberately includes the mid-ship states. It is a progress
 //     ring, not a ledger, and must never be used to decide whether a goal may
-//     close.
+//     close. Note too that the bucketing is NOT a pure function of the status
+//     column: `blocked` there means "has an unshipped dependency", which a
+//     `ready` row can be (ADR 0015 / task 1004487), so neither set below is
+//     enough on its own to bucket a task.
 //
 // NO DEPENDENCIES, deliberately. This file requires nothing — not even
 // `module-api` — so a CLI (`scripts/gds/sequence.js`) can read the vocabulary

package/modules/public-landing/public/account-private.states.json

@@ -5,7 +5,7 @@
   "stub": { "fixtures": { "me__cross-project": "me-cross-project-private" } },
   "modes": ["dark"],
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/me/cross-project$"],
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/cross-project$"],
   "ignoreConsole": ["/api/(gds|bongos)/me/cross-project", "\\b401\\b", "Unauthorized"],
   "ignoreControls": [".vh"],
   "states": {

package/modules/public-landing/public/account.html

@@ -24,14 +24,16 @@
 /* The account page's own layout, in the hub's manage-view voice (a lowercase
    light heading, hairline sections with the title left and the controls right,
    hairline fields, the choice cells with the dot). No :root block — the pack's
-   injected theme owns the tokens; everything below reads them. */
+   injected theme owns the tokens; everything below reads them. The bar and
+   the bands are cosmos.css's own rules, not restyled here. */
+/* the skip link un-hides itself on focus, reversing everything .vh sets (the hub's rule) */
+.skip:focus{position:fixed;top:8px;left:8px;z-index:100;width:auto;height:auto;margin:0;overflow:visible;clip-path:none;white-space:normal;
+  font-size:14px;font-weight:800;text-decoration:none;color:var(--ink);background:var(--bg-card);
+  border:2px solid var(--ctl-line);border-radius:12px;padding:10px 16px;}
 .acct{position:relative;z-index:1;max-width:1060px;margin:0 auto;padding:clamp(6px,1.5vw,18px) clamp(16px,4vw,40px) 56px;}
 .acct h1{font-family:var(--font-display);font-weight:300;font-size:clamp(28px,3.4vw,44px);letter-spacing:-.035em;line-height:1.04;text-transform:lowercase;color:var(--ink);margin:18px 0 0;}
 .acct .lede{margin:8px 0 18px;max-width:62ch;font-size:15.5px;line-height:1.55;color:var(--ink-soft);}
 .acct .loading{font-size:15px;color:var(--ink-soft);}
-.aWho{display:flex;flex-wrap:wrap;align-items:center;gap:4px 14px;margin:0 0 26px;font-size:14px;color:var(--ink-soft);}
-.aWho b{font-weight:500;color:var(--ink);overflow-wrap:anywhere;}
-.aWho a{display:inline-flex;align-items:center;min-height:24px;color:var(--ink);text-decoration:underline;}
 .aDoor{border-top:1px solid var(--rule);padding:30px 0 10px;max-width:62ch;}
 .aDoor p{margin:0 0 18px;font-size:15.5px;line-height:1.55;color:var(--ink-soft);}
 .aDoor .gh{width:18px;height:18px;fill:currentColor;}
@@ -70,12 +72,6 @@
   .aSec>h2,.aSec>.aSide,.aSec>.aBody{grid-column:1;grid-row:auto;}
   .aSec>.aSide{max-width:none;}
 }
-@media (max-width:420px){
-  .top{padding:16px;}
-  .top .mark{font-size:19px;}
-  .top-right{gap:8px;}
-  .top .btn-space{padding:7px 12px;}
-}
 @media (max-width:560px){
   .aLinks{grid-template-columns:1fr;}
   .aBand [role="radiogroup"]{grid-template-columns:1fr;}
@@ -85,14 +81,55 @@
 </style>
 </head>
 <body>
-<header class="top">
-  <a class="mark" href="/">{{productName}}</a>
-  <div class="top-right">
-    <a class="btn-space" href="/projects">Projects</a>
-    <a class="btn-space" data-link-hall href="{{buildersOrigin}}">Hall</a>
+<!-- THE BAR and its two bands are the hub's own (projects.html, task 1004455):
+     same markup, same cosmos.css rules, so /projects → /account keeps the chrome.
+     No map search (it only filters the map), and the band links name /projects
+     in full because this page has no views of its own. -->
+<a class="skip vh" href="#acct">Skip to content</a>
+<header class="shell bar">
+  <div class="barLeft">
+    <a class="barMark" id="barMark" href="/">
+      <svg viewBox="0 0 26 20" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="1.4"
+           stroke-linecap="round" stroke-linejoin="round">
+        <ellipse cx="8.4" cy="5.6" rx="6.6" ry="2.9"/>
+        <path d="M1.8 5.6v6.6a6.6 2.9 0 0 0 13.2 0V5.6"/>
+        <ellipse cx="19.6" cy="8.4" rx="4.7" ry="2.1"/>
+        <path d="M14.9 8.4v4.6a4.7 2.1 0 0 0 9.4 0V8.4"/>
+      </svg>
+      <span>{{productName}}</span>
+    </a>
+  </div>
+  <div class="barRight">
+    <button class="trig" type="button" id="projTrig" data-menu="projects" aria-expanded="false" aria-controls="menuProjects">Projects<svg class="cv" viewBox="0 0 20 20" aria-hidden="true"><path d="m5.6 8 4.4 4.4L14.4 8"/></svg></button>
+    <!-- the identity chip IS the profile trigger; paintBar fills it from GET /me.
+         Signed out it stays hidden and the sign-in door takes its slot. -->
+    <button class="trig who" type="button" id="who" data-menu="profile" aria-expanded="false" aria-controls="menuProfile" hidden><img id="whoImg" alt="" hidden><span class="whoName" id="whoLogin"></span><svg class="cv" viewBox="0 0 20 20" aria-hidden="true"><path d="m5.6 8 4.4 4.4L14.4 8"/></svg></button>
+    <a class="signinDoor" id="signinTop" hidden href="/api/bongos/auth/web/start?return=/account">Sign in</a>
   </div>
 </header>
 
+<div class="menuBand" id="menuProjects" data-menu="projects" hidden>
+  <div class="bandIn">
+    <ul class="bandRow">
+      <li class="bandCell"><a class="bandT" href="/projects?view=map">Sky</a><span class="bandC">the sky of every project</span></li>
+      <li class="bandCell"><a class="bandT" href="/projects?view=map&amp;sub=table">Table</a><span class="bandC">the same projects as rows</span></li>
+      <li class="bandCell" id="mineCell"><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own or build on</span></li>
+      <li class="bandCell"><a class="bandT" href="/projects?view=new">New project</a><span class="bandC">five questions and a home</span></li>
+    </ul>
+  </div>
+</div>
+<div class="menuBand" id="menuProfile" data-menu="profile" hidden>
+  <div class="bandIn bandProfile">
+    <p class="bandWho" id="bandWho"><img id="bandWhoImg" alt="" hidden><span class="whoName" id="bandWhoLogin"></span></p>
+    <ul class="bandRow">
+      <li class="bandCell"><a class="bandT" href="/projects?view=mine">My projects</a></li>
+      <li class="bandCell"><a class="bandT" href="/account" aria-current="page">Account</a></li>
+      <!-- the honest hover target; the delegated click upgrades it to the POST -->
+      <li class="bandCell"><a class="bandT signout" href="/api/bongos/auth/logout">Sign out</a></li>
+    </ul>
+  </div>
+</div>
+
 <main class="acct" id="acct">
   <h1>your account</h1>
   <p class="lede">Who you are across every project on {{productName}}, and who can find you. It is one account, so you change these once, here — each project’s own settings stay in that project’s hall.</p>
@@ -108,10 +145,6 @@
     </a>
   </section>
 
-  <!-- who is signed in, and the way out: in the page rather than the bar, so
-       the bar keeps the footer doors' two pills and fits a phone on one line -->
-  <p class="aWho" id="aWho" hidden><span>Signed in as <b id="whoName"></b></span><a href="/api/bongos/auth/logout" id="signOut">sign out</a></p>
-
   <p class="loading" id="loading">Reading your account…</p>
   <div class="alert" id="pageAlert" role="alert"></div>
 
@@ -214,7 +247,7 @@
   </div>
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 
 <script>
 (function () {
@@ -265,7 +298,7 @@
   function showDoor() {
     $('loading').hidden = true;
     $('acctBody').hidden = true;
-    $('aWho').hidden = true;
+    paintBar(null);
     $('door').hidden = false;
   }
   function showAlert(text) {
@@ -283,8 +316,6 @@
       $('loading').hidden = true;
       $('door').hidden = true;
       $('acctBody').hidden = false;
-      $('whoName').textContent = acct.handle || acct.display_name || 'your account';
-      $('aWho').hidden = false;
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });
   }
 
@@ -492,8 +523,86 @@
       : 'Cross-project record shown on your public profile.');
   });
 
-  // ---- sign out: the hub's own logout (projects.html doLogout) ----
-  $('signOut').addEventListener('click', function (ev) {
+  // ---- the bar: who is signed in, from the hub's own identity read. Signed
+  // out there is no chip and no Your-projects item; the sign-in door takes the slot ----
+  function paintBar(me) {
+    var login = me ? (me.github_login || 'signed in') : '';
+    var avatar = me && me.avatar_url;
+    $('who').hidden = !me;
+    $('signinTop').hidden = !!me;
+    $('mineCell').hidden = !me;
+    [['whoImg', 'whoLogin'], ['bandWhoImg', 'bandWhoLogin']].forEach(function (ids) {
+      $(ids[0]).hidden = !avatar;
+      if (avatar) $(ids[0]).src = avatar;
+      $(ids[1]).textContent = login;
+    });
+    if (me) $('who').setAttribute('aria-label', 'Account, ' + login);
+    else closeMenus();
+  }
+
+  // ---- the bands: the hub's disclosure (projects.html "THE BANDS") without
+  // the map search. Escape closes and returns focus to the trigger, a click
+  // outside closes, the arrows walk the items, opening one closes the other ----
+  function openBand() { return document.querySelector('.menuBand:not([hidden])'); }
+  function closeMenus() {
+    var open = openBand();
+    if (!open) return;
+    var trig = document.querySelector('.trig[aria-expanded="true"]');
+    var inside = open.contains(document.activeElement);
+    open.hidden = true;
+    if (trig) trig.setAttribute('aria-expanded', 'false');
+    if (inside && trig) trig.focus();
+  }
+  function openMenu(trig, byKeyboard) {
+    closeMenus();
+    trig.setAttribute('aria-expanded', 'true');
+    var band = $(trig.getAttribute('aria-controls'));
+    band.hidden = false;
+    // Enter/Space on the trigger lands on the first item; a pointer stays put
+    if (byKeyboard) { var first = band.querySelector('.bandCell:not([hidden]) a'); if (first) first.focus(); }
+  }
+  document.querySelectorAll('.trig').forEach(function (t) {
+    t.addEventListener('click', function (ev) {
+      if (t.getAttribute('aria-expanded') === 'true') closeMenus();
+      else openMenu(t, ev.detail === 0);
+    });
+  });
+  document.addEventListener('click', function (ev) {
+    if (!openBand()) return;
+    if (ev.target.closest && (ev.target.closest('.menuBand') || ev.target.closest('.trig'))) return;
+    closeMenus();
+  });
+  document.addEventListener('keydown', function (ev) {
+    var open = openBand();
+    if (!open) return;
+    if (ev.key === 'Escape') { closeMenus(); return; }
+    if (ev.key !== 'ArrowDown' && ev.key !== 'ArrowUp') return;
+    var items = Array.prototype.filter.call(open.querySelectorAll('a'), function (a) { return !a.closest('[hidden]'); });
+    if (!items.length) return;
+    var at = items.indexOf(document.activeElement);
+    ev.preventDefault();
+    items[(at + (ev.key === 'ArrowDown' ? 1 : items.length - 1) + items.length) % items.length].focus();
+  });
+  document.querySelectorAll('.menuBand').forEach(function (b) {
+    b.addEventListener('click', function (ev) {
+      if (ev.target.closest && ev.target.closest('a')) closeMenus();
+    });
+    // Tab out of the band closes it; a null relatedTarget is the window losing
+    // focus or a click on nothing, which the document click covers
+    b.addEventListener('focusout', function (ev) {
+      var to = ev.relatedTarget;
+      if (!to || b.contains(to) || (to.closest && to.closest('.trig'))) return;
+      closeMenus();
+    });
+  });
+
+  // ---- sign out: the hub's own logout (projects.html doLogout), delegated on
+  // the profile band's plain anchor ----
+  $('menuProfile').addEventListener('click', function (ev) {
+    if (!ev.target.closest) return;
+    // Account is this page: a reload would only throw away what was typed
+    if (ev.target.closest('[aria-current="page"]')) { ev.preventDefault(); return; }
+    if (!ev.target.closest('a.signout')) return;
     ev.preventDefault();
     var finish = function () {
       var apex = location.hostname.split('.').slice(-2).join('.');
@@ -506,7 +615,15 @@
     fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' }).then(finish, finish);
   });
 
-  load();
+  var whoRead = request('GET', '/me').then(function (res) {
+    var d = res.ok && res.data;
+    paintBar(d ? (d.builder || d.me || d) : null);
+  }, function () { paintBar(null); });
+  // The identity read failing is not a sign-out. If the account itself was
+  // read, the chip names it from that answer, so the way out is never lost.
+  load().then(function () { return whoRead; }).then(function () {
+    if (acct && $('who').hidden) paintBar({ github_login: acct.handle || acct.display_name });
+  });
 })();
 </script>
 </body>

package/modules/public-landing/public/account.probes.json

@@ -30,6 +30,36 @@
     { "name": "hiding the record saves hide_stats alone", "continue": true,
       "steps": [["click", "#aRecord .aOpt:nth-child(2)"], ["click", "#recordSave"], ["wait", 400]],
       "expect": { "text": [["#recordMsg", "Cross-project record hidden — removed from your profile and directories immediately."]], "checked": "input[name=record][value=hide]" } },
+    { "name": "the hub's bar: the chip names the person, both bands closed, the page starts under the bar (task 1004455)", "auth": true, "width": 1440,
+      "steps": [["wait", 400]],
+      "expect": { "expanded": false, "top": [["#acct", 64]], "visible": ["#projTrig", "#who"], "hidden": ["#signinTop", "#menuProjects", "#menuProfile"], "text": [["#whoLogin", "builder"]], "count": [["#mapQ", 0]] } },
+    { "name": "Enter opens Projects and lands on the first item; the band overlays and the page does not move", "continue": true,
+      "steps": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 150]],
+      "expect": { "open": "#menuProjects", "activeText": "Sky", "top": [["#acct", 64]], "href": [["#menuProjects .bandCell:first-child a", "/projects?view=map"]] } },
+    { "name": "ArrowDown walks to Table", "continue": true,
+      "steps": [["press", "ArrowDown"]],
+      "expect": { "activeText": "Table" } },
+    { "name": "ArrowUp wraps to the last item", "continue": true,
+      "steps": [["press", "ArrowUp"], ["press", "ArrowUp"]],
+      "expect": { "activeText": "New project" } },
+    { "name": "Escape closes and returns focus to the trigger", "continue": true,
+      "steps": [["press", "Escape"], ["wait", 100]],
+      "expect": { "closed": "#menuProjects", "activeId": "projTrig", "expanded": false } },
+    { "name": "opening the profile band closes the Projects band; Account is the current place", "continue": true,
+      "steps": [["click", "#projTrig"], ["wait", 120], ["click", "#who"], ["wait", 120]],
+      "expect": { "open": "#menuProfile", "closed": "#menuProjects", "expandedIds": ["who"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]], "count": [["#bandWho img", 1], ["[aria-current=\"page\"]", 1]], "href": [["#menuProfile a.signout", "/api/bongos/auth/logout"], ["#menuProfile .bandCell:first-child a", "/projects?view=mine"]] } },
+    { "name": "a click outside closes", "continue": true,
+      "steps": [["clickAt", 700, 600], ["wait", 120]],
+      "expect": { "closed": "#menuProfile", "expanded": false } },
+    { "name": "Tab out of the band closes it", "continue": true,
+      "steps": [["click", "#projTrig"], ["wait", 120], ["focus", "#menuProjects .bandCell:last-child a"], ["press", "Tab"], ["wait", 120]],
+      "expect": { "closed": "#menuProjects" } },
+    { "name": "signed out: no chip, the sign-in door in its slot, returning to /account", "auth": false, "width": 1440,
+      "steps": [["wait", 300]],
+      "expect": { "hidden": ["#who"], "visible": ["#signinTop", "#projTrig"], "href": [["#signinTop", "/api/bongos/auth/web/start?return=/account"]] } },
+    { "name": "signed out the Projects band is Sky / Table / New project (no Your projects)", "continue": true,
+      "steps": [["click", "#projTrig"], ["wait", 120]],
+      "expect": { "open": "#menuProjects", "count": [["#menuProjects .bandCell:not([hidden])", 3]], "hidden": ["#mineCell"] } },
     { "name": "phone width: the bar stays one line and nothing scrolls sideways", "auth": true, "width": 320,
       "steps": [["wait", 400]],
       "expect": { "noOverflow": true, "visible": ["#acctBody"] } }

package/modules/public-landing/public/account.states.json

@@ -1,15 +1,17 @@
 {
-  "_": "The account page's states for modules/ui-design/kit/render.js (task 1004259, ADR 0337 D4.3): signed out it is the sign-in door and nothing else; signed in it is the four sections, painted from the stub's one account (fixtures/me__cross-project.json — public, recruiters following the profile setting, a bio and two links). Dark only, like every apex page (ADR 0204). The private, hidden, not-yet-published account renders from account-private.states.json.",
+  "_": "The account page's states for modules/ui-design/kit/render.js (task 1004259, ADR 0337 D4.3): signed out it is the sign-in door and nothing else; signed in it is the hub's bar (task 1004455: the identity chip from GET /me, the Projects band and the profile band with Account current) over the four sections, painted from the stub's one account (fixtures/me__cross-project.json — public, recruiters following the profile setting, a bio and two links). Dark only, like every apex page (ADR 0204). The private, hidden, not-yet-published account renders from account-private.states.json.",
   "page": "/account",
   "surface": "public-landing",
   "modes": ["dark"],
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/me/cross-project$"],
-  "ignoreConsole": ["/api/(gds|bongos)/me/cross-project", "\\b401\\b", "Unauthorized"],
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/cross-project$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "Unauthorized"],
   "ignoreControls": [".vh"],
   "states": {
-    "out": { "auth": false, "actions": [["wait", 300]], "expect": { "visible": ["#door", "#signin"], "hidden": ["#acctBody", "#aWho", "#loading"] } },
-    "in": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#fName", "#fBio", "#fHandle", "#recWhat", "#recordLine", "#signOut"], "text": [["#whoName", "builder"], ["#recordLine", "Your record: 3 projects · 1000 credits · 19 works shipped · 10 karma."]], "hidden": ["#door", "#loading"], "value": [["#fHandle", "builder"], ["#fName", "A Builder"], ["#fLinkX", "https://x.com/builder"]] } },
+    "out": { "auth": false, "actions": [["wait", 300]], "expect": { "visible": ["#door", "#signin", "#signinTop", "#projTrig"], "hidden": ["#acctBody", "#who", "#loading"] } },
+    "in": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#fName", "#fBio", "#fHandle", "#recWhat", "#recordLine", "#who"], "text": [["#whoLogin", "builder"], ["#recordLine", "Your record: 3 projects · 1000 credits · 19 works shipped · 10 karma."]], "hidden": ["#door", "#loading", "#signinTop", "#menuProjects", "#menuProfile"], "value": [["#fHandle", "builder"], ["#fName", "A Builder"], ["#fLinkX", "https://x.com/builder"]] } },
+    "in-projects-band": { "auth": true, "actions": [["wait", 400], ["click", "#projTrig"], ["wait", 300]], "expect": { "visible": ["#menuProjects", "#mineCell"], "hidden": ["#menuProfile"] } },
+    "in-profile-band": { "auth": true, "actions": [["wait", 400], ["click", "#who"], ["wait", 300]], "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]] } },
     "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "text": [["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 300]] }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.66",
+  "version": "1.20.68",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.66",
+      "version": "1.20.68",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.66",
+  "version": "1.20.68",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8525,5 +8525,17 @@
       "id": "1004485",
       "text": "Goals can now be moved from one version to another, taking their tasks and done-when criteria with them and keeping every task number. Used first to move the two goals that did not make V2 into V3."
     }
+  ],
+  "1.20.67": [
+    {
+      "id": "1004487",
+      "text": "The hall no longer offers a Claim button on work the system will refuse. If a task gets a new prerequisite after it was opened up for claiming, its page and its goal card now say it is waiting on that other task — and name whi"
+    }
+  ],
+  "1.20.68": [
+    {
+      "id": "1004455",
+      "text": "The account page on cloudbongos.com now has the same top bar as the projects page — the Projects menu and your profile menu (My projects, Account, Sign out) — so moving between the two no longer swaps the whole header."
+    }
   ]
 }

package/scripts/hall-preview/refresh-fixtures.js

@@ -58,7 +58,11 @@ const SNAPSHOTS = [
   ['goals/25/conflicts', 'goals__conflicts'],
   ['goals/25/requests', 'goals__requests'],
   ['tasks/claimable', 'tasks__claimable'],
-  ['tasks?status=ready', 'tasks', trimList('tasks', 60)],
+  // &include=deps (task 1004487) — the goal page's task cards read `blocked_by[]`
+  // to tell a claimable `ready` row from one whose dependencies have not shipped.
+  // Without it every row refreshes with no dependency data and the harness can
+  // only ever demo the claimable half of that fork.
+  ['tasks?status=ready&include=deps', 'tasks', trimList('tasks', 60)],
   ['tasks/2166', 'tasks__detail'],
   ['tasks/peer-votes/feed?limit=25', 'tasks__peer-votes__feed'],
   ['analytics/builder/95?days=90', 'analytics__builder'],

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.66'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.68'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claim_from_task_and_home.mjs

@@ -38,11 +38,32 @@ await test('task.js constructs the shared claim action', () => {
 });
 
 await test('task.js renders a Claim button only when the task is ready', () => {
-  const m = taskJs.match(/if \(t\.status === 'ready'\) \{\s*lifecycle = `([^`]*)`/);
+  const m = taskJs.match(/if \(t\.status === 'ready' && unmetDeps\.length === 0\) \{\s*lifecycle = `([^`]*)`/);
   assert.ok(m, 'no ready-status branch found in the lifecycle chain');
   assert.match(m[1], /id="claim-btn"/);
 });
 
+// Task 1004487 — `ready` alone was never the claim gate's question. A dependency
+// added after promotion leaves the row at `ready` (ADR 0015: the status is
+// deliberately never demoted), and POST /claims refuses it with
+// DEPS_NOT_SHIPPED. core_264 taught the claimable FEED that; this page was the
+// surface it did not reach.
+await test('a dep-blocked ready task gets NO Claim button, and is told why', () => {
+  assert.match(taskJs, /const unmetDeps = deps\.filter\(\(d\) => d\.status !== 'shipped'\);/,
+    'the unmet-dependency predicate must mirror the gate: met iff the target shipped');
+  const refusal = taskJs.match(/\} else if \(t\.status === 'ready'\) \{\s*([\s\S]{0,600}?)\n {4}\} else if/);
+  assert.ok(refusal, 'no dep-blocked ready branch after the claimable one');
+  assert.doesNotMatch(refusal[1], /claim-btn/, 'a task the gate will refuse must not be offered the button');
+  assert.match(refusal[1], /rec-actnote/, 'the refusal is pre-answered in words, like the retire refusals');
+  assert.match(refusal[1], /waiting on/, 'and it names what it is waiting on');
+});
+
+await test("the lifecycle rail's first beat does not call a dep-blocked task 'waiting for a builder'", () => {
+  assert.match(taskJs, /const waitingOnDep = \(t\.dependencies \|\| \[\]\)\.some\(\(d\) => d\.status !== 'shipped'\);/);
+  assert.match(taskJs, /t\.status === 'ready' && waitingOnDep\)\s*\n?\s*\? CLAIM_CAPTION\.blocked/,
+    "a dep-blocked ready row borrows the 'blocked' caption — waiting on another task");
+});
+
 await test('the Claim button click routes through claimAction.claim, not a raw POST', () => {
   const m = taskJs.match(/const claimBtn = \$\('#claim-btn'\);[\s\S]*?\n {4}\}/);
   assert.ok(m, 'claim-btn wiring block not found');

package/tests/dep_blocked_ready_cards.mjs

@@ -0,0 +1,70 @@
+// tests/dep_blocked_ready_cards.mjs — task 1004487.
+//
+// THE BUG. ADR 0015 rules that a dependency added AFTER a task was promoted
+// leaves the row at `ready`: the status answers "was this promoted?", not "is
+// this workable right now?", so nothing demotes it. `core_264` (task 1004190)
+// taught the claimable FEED to ask the dependency graph instead of the status
+// column. The Goals page's task cards were a surface it did not reach — they
+// read `t.status === 'ready'` alone, so a dep-blocked row got a bulk-claim
+// checkbox and a Claim button for work `POST /claims` refuses with
+// DEPS_NOT_SHIPPED.
+//
+// The predicate itself (`hasUnmetDeps` / `readinessOf`) is proven BEHAVIOURALLY
+// in tests/goals_lib.mjs, and the server-side mirror in
+// tests/goal_sort_staleness.mjs. What is left to pin, and what this file pins,
+// is that the card actually CALLS it — and that the data it needs is asked for,
+// because the predicate is silent (correctly) when `blocked_by[]` is absent, so
+// a dropped `?include=deps` would reopen the bug with every test still green.
+//
+// goals-render.js is a browser IIFE reaching for `window` at eval time, so it is
+// read as text — the idiom tests/claim_action.mjs and claim_from_task_and_home.mjs
+// already use for these files.
+//
+// Run:  node tests/dep_blocked_ready_cards.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const { test, summary } = makeRunner();
+
+const renderJs = read('modules', 'hall-ui', 'public', 'goals-render.js');
+
+await test('the goal page ASKS for the dependency data its cards now read', () => {
+  // Without include=deps every task arrives with no blocked_by[], hasUnmetDeps
+  // answers false for all of them, and the gate below is a no-op that still passes.
+  assert.match(renderJs, /\$\{API\}\/tasks\?goal_id=\$\{encodeURIComponent\(goalId\)\}&include=deps/,
+    'loadGoalTasks must request ?include=deps');
+});
+
+await test('a dep-blocked ready card is not offered the claim affordances', () => {
+  assert.match(renderJs, /const isReadyNow = t\.status === 'ready' && !hasUnmetDeps\(t\);/,
+    "the card's claimable predicate must ask the dependency question, not the status alone");
+  // The checkbox and the Claim button both hang off isReady, so gating that one
+  // name is what removes both.
+  assert.match(renderJs, /const isReady = isReadyNow && !!state\.me;/);
+});
+
+await test('the bulk selection prunes a tick that is no longer claimable', () => {
+  // A tick that survives the prune rides into a bulk claim the server refuses,
+  // which is the same lie one layer down.
+  assert.match(renderJs, /state\.work\.todo\.filter\(\(t\) => t\.status === 'ready' && !hasUnmetDeps\(t\)\)/);
+});
+
+await test('the card takes its lead tag from the lib, never a status echo of its own', () => {
+  // Hiding the checkbox without changing the word would leave the row reading
+  // "ready" with no affordance and no reason — worse than the bug. The tag is
+  // pure, so it lives in goals-lib.js and is proven BEHAVIOURALLY in
+  // tests/goals_lib.mjs; what this pins is that the card calls it and that the
+  // hand-rolled status span it replaced has not grown back beside it.
+  assert.match(renderJs, /: taskStatusTagHtml\(t\)\);/);
+  assert.doesNotMatch(renderJs, /<span class="task__tag" title="Task status">/,
+    'goals-render.js must not re-grow its own status tag');
+});
+
+summary();

package/tests/goal_sort_staleness.mjs

@@ -171,9 +171,14 @@ await test('the SQL rollup buckets MIRROR goals-lib readinessOf exactly', () =>
   assert.match(lib, /DONE_STATUSES = new Set\(\['completed', 'confirmed', 'shipped'\]\)/);
   assert.match(vocab, /const CUT_STATUSES = \['abandoned', 'dropped'\]/);
   assert.match(lib, /CUT_STATUSES = new Set\(\['abandoned', 'dropped'\]\)/);
-  // blocked = backlog with >=1 unshipped dependency, both sides
-  assert.match(rollup, /WHEN s\.status = 'backlog' AND s\.has_unshipped_dep THEN 'blocked'/);
-  assert.match(lib, /s === 'backlog' && \(t\.blocked_by \|\| \[\]\)\.some\(\(d\) => !d\.satisfied\)/);
+  // blocked = >=1 unshipped dependency on an unclaimed task, both sides — and
+  // on BOTH sides the arm sits AHEAD of 'ready' (task 1004487), because a dep
+  // added after promotion leaves the row at 'ready' and a status-first
+  // bucketing would then count un-claimable work as ready. The ORDER is the
+  // assertion, not just the presence of the clause.
+  assert.match(rollup, /WHEN s\.has_unshipped_dep\s+THEN 'blocked'\s*\n\s*WHEN s\.status = 'ready'\s+THEN 'ready'/);
+  assert.match(lib, /const hasUnmetDeps = \(t\) => \(\(t && t\.blocked_by\) \|\| \[\]\)\.some\(\(d\) => !d\.satisfied\);/);
+  assert.match(lib, /if \(hasUnmetDeps\(t\)\) return 'blocked';\s*\n\s*if \(s === 'ready'\) return 'ready';/);
   // cut is excluded from the total on both sides (migration 017's rule)
   assert.match(rollup, /FILTER \(WHERE b\.bucket <> 'cut'\)::int\s+AS total/);
   assert.match(read('modules/hall-ui/public/goals-page.js'), /total: row\.total \|\| 0/);