@bongos/core 1.21.125 → 1.21.126

package/modules/hall-ui/public/goal-forest-render.js

@@ -5,12 +5,12 @@
 // header), so a new self-contained feature is its own file — the same
 // separation goal-map.js already keeps from goals-render.js, one file down.
 //
-// NOT a band column, unlike Completion/Members/Conflicts on the same detail
-// page: a node-link picture needs real width, and this is bounded small BY
-// DESIGN (ADR 0227 §3's own finding — the tasks a forest omits are exactly
-// the ones with nothing to connect them to), so there is no cap-and-"view
-// all" split here. What renders is always the whole forest returned by GET
-// /goals/:id/dependency-forest. The model + layout are goal-forest-lib.js
+// Two surfaces (task 1004738): the band's compact Dependencies card, in the
+// slot Conflicts used to hold — a summary, the tasks to ship first, the
+// conflicts count — and the full picture behind it at #/goal/N/dependencies,
+// where the forest needs real width. The full view always draws the whole
+// forest returned by GET /goals/:id/dependency-forest (ADR 0227 §3: what it
+// omits is exactly what has nothing to connect it). The model + layout are goal-forest-lib.js
 // (pure); this file only draws what it returns, with createElementNS +
 // textContent — the atlas / goal-map.js idiom — so a task title never
 // becomes markup.
@@ -18,8 +18,9 @@
 // A factory, the goals-render.js precedent, because `state` keeps changing
 // after load: `createGoalForestRender(ctx)` takes the SAME `{ API, state,
 // sameId, getJSON }` slice of ctx goals-page.js already builds, and returns
-// `{ loadDependencyForest, renderDependencyForest }` for goals-render.js to
-// call from renderDetail() and for tests/goal_forest_page.mjs to call directly.
+// `{ loadDependencyForest, renderDependencyForest, renderDependencyCard }` for
+// goals-render.js to call (the card again whenever the conflicts land) and for
+// tests/goal_forest_page.mjs to call directly.
 (function () {
   'use strict';
 
@@ -103,7 +104,44 @@
       return svg;
     }
 
+    const SHIP_FIRST = 3;
+    const taskHref = (id) => `#/task/${encodeURIComponent(id)}`;
+    // The band card. Reads state.conflictPairs too, so goals-render.js calls it
+    // again when the conflicts land; null there (loading, or a failed read)
+    // draws no conflicts line rather than a guess.
+    function renderDependencyCard() {
+      const lede = $('#goal-deps-card-lede');
+      const body = $('#goal-deps-card-body');
+      if (!lede || !body) return;
+      const a = state.forest && !state.forestError ? lib.analyse(state.forest) : null;
+      const n = a ? a.order.length : 0;
+      const pill = $('#goal-deps-card-count');
+      if (pill) { pill.hidden = !n; pill.textContent = n ? String(n) : ''; }
+      if (state.forestError) lede.textContent = 'Couldn’t load this goal’s task dependencies right now.';
+      else lede.textContent = a ? lib.brief(a) : 'Reading…';
+      const first = a ? lib.shipFirst(a, SHIP_FIRST) : [];
+      const pairs = Array.isArray(state.conflictPairs) ? state.conflictPairs : null;
+      body.innerHTML = (first.length
+        ? `<p class="gf-brief__h">Ship these first</p><ul class="gf-brief">${first.map((r) => `<li class="gf-brief__row">
+            <a class="lb-name gf-brief__task" href="${taskHref(r.id)}" title="#${escapeHtml(r.id)} ${escapeHtml(r.title)}">#${escapeHtml(r.id)} ${escapeHtml(r.title)}</a>
+            <span class="gf-brief__n">unblocks ${r.unblocks}</span></li>`).join('')}</ul>`
+        : '')
+        + (pairs
+          ? `<p class="gf-brief__conflicts${pairs.length ? ' gf-brief__conflicts--live' : ''}">${pairs.length
+            ? `${escapeHtml(lib.plural(pairs.length, 'file conflict'))} between open tasks.`
+            : 'No file conflicts between open tasks.'}</p>`
+          : '');
+      const foot = $('#goal-deps-card-foot');
+      if (!foot) return;
+      foot.hidden = !((n || (pairs && pairs.length)) && state.current != null);
+      foot.innerHTML = foot.hidden ? ''
+        : `<a class="pill-link" href="#/goal/${encodeURIComponent(state.current)}/dependencies">See the full picture →</a>`;
+    }
+
     function renderDependencyForest() {
+      renderDependencyCard();
+      const back = $('#goal-deps-back');
+      if (back && state.current != null) back.setAttribute('href', `#/goal/${encodeURIComponent(state.current)}`);
       const lede = $('#goal-deps-lede');
       const body = $('#goal-deps-body');
       if (!lede || !body) return;
@@ -130,8 +168,10 @@
       setCount('#goal-deps-count', a.order.length);
       lede.innerHTML = `${escapeHtml(lib.describe(a))} An arrow runs from the task that has to ship first to the task that waits on it. `
         + 'Every task here, and every dependency, is also in the table below.';
+      // The picture is drawn only while its own view is open: on the goal page
+      // the card is all that shows, and a forest drawn hidden cannot measure its titles.
+      if (state.view !== 'dependencies') { body.innerHTML = ''; return; }
       const rows = lib.tableRows(a);
-      const taskHref = (id) => `#/task/${encodeURIComponent(id)}`;
       const depList = (list) => (list.length
         ? `<ul class="gf-deps">${list.map((x) => `<li><a href="${taskHref(x.id)}">#${escapeHtml(x.id)} ${escapeHtml(x.title)}</a></li>`).join('')}</ul>`
         : '<span class="gf-none">—</span>');
@@ -178,6 +218,6 @@
       }
     }
 
-    return { loadDependencyForest, renderDependencyForest };
+    return { loadDependencyForest, renderDependencyForest, renderDependencyCard };
   };
 })();

package/modules/hall-ui/public/goals-page.js

@@ -58,8 +58,8 @@
     me: null,
     goals: [],           // list rows
     details: new Map(),  // goal_id -> {goal, members, criteria}
-    current: null,       // open goal id (detail/conflicts view) or null (list)
-    view: 'list',        // task 1828 — 'list' | 'detail' | 'conflicts'
+    current: null,       // open goal id (detail or a full view) or null (list)
+    view: 'list',        // task 1828 — 'list' | 'detail' | 'dependencies' | 'members' | 'completion'
     inviteOpen: false,   // task 1762 — the invite form's open/closed state
     directory: null,     // task 1877 — GET /builders/directory, fetched once and cached
     // task 1828 — per-table column sort. by=null → natural order (todo: server
@@ -562,10 +562,8 @@
   // full view at #/goal/N/<view> (the shared pattern behind Conflicts, Members,
   // and Completion). Hidden when nothing is truncated.
 
-  // task 1828 — the band column shows the first CONFLICT_CAP; the foot routes
-  // to the dedicated full-width conflicts view. Count + amber accent on the card.
-
-  // task 1828 — the standalone #/goal/N/conflicts view: the whole set, no cap.
+  // task 1004738 — the conflict set renders on the #/goal/N/dependencies view;
+  // the band's Dependencies card carries its count.
 
   /* ----- Completion (band column + #/goal/N/completion full view) ----- */
 
@@ -727,16 +725,16 @@
     setWorkTab('todo');
     workTabs?.setCount('todo', null);
     workTabs?.setCount('done', null);
-    ['#goal-conflicts-count', '#goal-conflicts-view-count',
+    ['#goal-conflicts-view-count',
       '#goal-members-count', '#goal-members-view-count', '#goal-completion-count'].forEach((sel) => {
       const el = $(sel);
       if (el) { el.hidden = true; el.textContent = ''; }
     });
-    ['#goal-todo-pager', '#goal-done-pager', '#goal-conflicts-foot', '#goal-members-foot', '#goal-completion-foot'].forEach((sel) => {
+    ['#goal-todo-pager', '#goal-done-pager', '#goal-members-foot', '#goal-completion-foot'].forEach((sel) => {
       const el = $(sel);
       if (el) el.hidden = true;
     });
-    ['#goal-conflicts-card', '#goal-conflicts-view-card'].forEach((sel) => $(sel)?.classList.remove('goal-conflicts-card--live'));
+    $('#goal-conflicts-view-card')?.classList.remove('goal-conflicts-card--live');
     reflectSortHeaders('done');
     // task 1002425 — To do is a card list now; Completed stays a table. Show a
     // placeholder in the card list + skeleton rows in the Completed table while
@@ -749,25 +747,23 @@
     if (todoCount) todoCount.textContent = '';
     const bulkBar = $('#goal-bulk-toolbar');
     if (bulkBar) bulkBar.hidden = true;
-    const conflicts = $('#goal-conflicts');
-    if (conflicts) conflicts.innerHTML = '<span class="kit-skel"></span>';
     const conflictsFull = $('#goal-conflicts-full');
     if (conflictsFull) conflictsFull.innerHTML = '<span class="kit-skel"></span>';
   }
 
   // task 1828 — views sharing this page: the list, a goal's detail, and the
-  // goal's three full views (conflicts / members / completion). `view` defaults
-  // from goalId (null → list).
-  const SUB_VIEWS = ['conflicts', 'members', 'completion'];
+  // goal's three full views (dependencies / members / completion). `view`
+  // defaults from goalId (null → list).
+  const SUB_VIEWS = ['dependencies', 'members', 'completion'];
   const VIEW_SECTION = {
     list: '#goals-list-view',
     detail: '#goal-detail-view',
-    conflicts: '#goal-conflicts-view',
+    dependencies: '#goal-dependencies-view',
     members: '#goal-members-view',
     completion: '#goal-completion-view',
   };
   const SUB_SUBTITLE = {
-    conflicts: 'Goal conflicts — every open task pair whose declared files overlap.',
+    dependencies: 'Goal dependencies — which tasks wait on which, and which open tasks touch the same files.',
     members: 'Goal members — who’s on this goal and what they’ve contributed to it.',
     completion: 'Goal completion — every done-when criterion, with its full detail.',
   };
@@ -787,7 +783,7 @@
     if (sub) {
       sub.textContent = view === 'list'
         ? 'Shared goals: progress, members, and the work remaining.'
-        : (SUB_SUBTITLE[view] || 'Goal detail — completion, members, conflicts, and the work queue.');
+        : (SUB_SUBTITLE[view] || 'Goal detail — completion, members, dependencies, and the work queue.');
     }
     window.scrollTo({ top: 0 });
   }
@@ -804,14 +800,15 @@
       if (state.current == null) renderList();
       return;
     }
-    // task 1828 — a goal's dedicated full views (conflicts / members /
+    // task 1828 — a goal's dedicated full views (dependencies / members /
     // completion). renderDetail renders all three full views + kicks
     // loadGoalTasks, so a cold load straight to one still fills in once data
-    // lands (member stats / work / conflicts refresh async).
-    const mSub = /^#\/goal\/(\d+)\/(conflicts|members|completion)$/.exec(hash);
+    // lands (member stats / work / conflicts refresh async). /conflicts is the
+    // pre-1004738 name, still linked from the attention inbox.
+    const mSub = /^#\/goal\/(\d+)\/(dependencies|conflicts|members|completion)$/.exec(hash);
     if (mSub) {
       const id = mSub[1];
-      const view = mSub[2];
+      const view = mSub[2] === 'conflicts' ? 'dependencies' : mSub[2];
       try {
         await loadDetail(id);
         setView(id, view);
@@ -999,7 +996,7 @@
   }
   $('#goal-back')?.addEventListener('click', (e) => { e.preventDefault(); window.location.hash = ''; });
   // task 1828 — "← Back to goal" from any of the full views.
-  ['#goal-conflicts-back', '#goal-members-back', '#goal-completion-back'].forEach((sel) => {
+  ['#goal-deps-back', '#goal-members-back', '#goal-completion-back'].forEach((sel) => {
     $(sel)?.addEventListener('click', (e) => {
       e.preventDefault();
       if (state.current != null) window.location.hash = `#/goal/${state.current}`;

package/modules/hall-ui/public/goals-render.js

@@ -34,10 +34,9 @@
     // still draws its criteria (state by satisfied/open, no UAT controls).
     const uatUi = window.OTBCriterionUat || { isAwaiting: () => false, badgesHtml: () => '', actionHtml: () => '' };
 
-  const CONFLICT_CAP = 3;
-  // task 1828 — the band's Completion / Members / Conflicts columns each cap
-  // their list and offer a "View all →" into a dedicated full view (these grow:
-  // more members, more criteria). Conflicts uses CONFLICT_CAP above.
+  // task 1828 — the band's Completion / Members columns each cap their list and
+  // offer a "View all →" into a dedicated full view (these grow: more members,
+  // more criteria). The third column is the Dependencies card (task 1004738).
   const MEMBER_CAP = 5;
   const CRITERIA_CAP = 4;
   // task 1932/1956 → kit (task 2171): the goal-card grid + the goal-detail Work
@@ -620,24 +619,15 @@
       foot.innerHTML = '';
     }
   }
+  // task 1004738 — the whole conflict set lives on the dependencies view; the
+  // band's Dependencies card carries only its count.
   function renderConflicts() {
-    const pairs = state.conflictPairs;
-    const card = $('#goal-conflicts-card');
-    fillConflicts($('#goal-conflicts'), pairs == null ? null : pairs.slice(0, CONFLICT_CAP));
-    const total = pairs ? pairs.length : 0;
-    renderViewAllFoot('#goal-conflicts-foot', total, CONFLICT_CAP, 'conflicts', 'conflicts');
-    setCount('#goal-conflicts-count', total);
-    card?.classList.toggle('goal-conflicts-card--live', total > 0);
-    renderConflictsFull();
-  }
-  function renderConflictsFull() {
     const pairs = state.conflictPairs;
     const total = pairs ? pairs.length : 0;
     fillConflicts($('#goal-conflicts-full'), pairs);
     setCount('#goal-conflicts-view-count', total);
     $('#goal-conflicts-view-card')?.classList.toggle('goal-conflicts-card--live', total > 0);
-    const back = $('#goal-conflicts-back');
-    if (back && state.current != null) back.setAttribute('href', `#/goal/${state.current}`);
+    forestRender.renderDependencyCard();
   }
   // task 1003480 — the per-goal task dependency forest is drawn by its own
   // module now (goal-forest-render.js, carved out to keep this file under the

package/modules/hall-ui/public/goals.css

@@ -87,10 +87,8 @@
   .goal-band__col + .goal-band__col { border-top: none; border-left: var(--line) solid var(--rule-soft); }
 }
 
-/* Live conflicts: the band COLUMN can't own the card border, so it gets a
-   subtle amber wash; the standalone full-view card keeps the amber border.
-   (Count pills on these headers are the shared .count-pill.) */
-.goal-conflicts-card--live { background: color-mix(in srgb, var(--warn) 6%, transparent); }
+/* Live conflicts: the conflicts card on the dependencies view wears the amber
+   border (task 1004738 moved it there from the band). */
 .goal-conflicts-card--live .count-pill { background: var(--warn-weak); color: var(--warn); }
 #goal-conflicts-view-card.goal-conflicts-card--live { background: var(--bg-card); border-color: color-mix(in srgb, var(--warn) 42%, transparent); }
 
@@ -554,3 +552,14 @@
 .gf-table .gf-deps { margin: 0; padding: 0; list-style: none; min-width: 12rem; }
 .gf-table .gf-deps li { font-size: 12.5px; line-height: 1.4; }
 .gf-none { color: var(--ink-faint); }
+
+/* task 1004738 — the band's compact Dependencies card: a third of the width,
+   so each "ship first" title holds one line and ellipsises (the whole title is
+   its tooltip and the full view's table). */
+.gf-brief__h { margin: 10px 0 2px; font-size: 12px; color: var(--ink-faint); }
+.gf-brief { list-style: none; margin: 0; padding: 0; }
+.gf-brief__row { display: flex; align-items: center; gap: 10px; font-size: 13px; }
+.gf-brief__task { flex: 1; min-width: 0; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.gf-brief__n { flex-shrink: 0; font-size: 12px; color: var(--ink-faint); }
+.gf-brief__conflicts { margin: 10px 0 0; font-size: 13px; color: var(--ink-soft); }
+.gf-brief__conflicts--live { color: var(--warn); font-weight: 600; }

package/modules/hall-ui/public/goals.html

@@ -112,28 +112,18 @@
               <ul class="member-list" id="goal-members"></ul>
               <div class="goal-col__foot" id="goal-members-foot" hidden></div>
             </div>
-            <div class="goal-band__col" id="goal-conflicts-card">
-              <h2 class="scroll__h">Conflicts<span class="count-pill" id="goal-conflicts-count" hidden></span></h2>
-              <p class="scroll__lede">Open tasks whose declared files overlap — sequence these before two builders collide.</p>
-              <div id="goal-conflicts"></div>
-              <!-- task 1828 — replaces the show-all pager: click into a dedicated
-                   full-width conflicts view instead of expanding this column. -->
-              <div class="goal-col__foot" id="goal-conflicts-foot" hidden></div>
+            <!-- task 1004738 — the compact Dependencies card takes the slot
+                 Conflicts held: a summary, the tasks to ship first and the
+                 conflicts count. The forest, its table and the conflict list
+                 are one click away on #/goal/N/dependencies. -->
+            <div class="goal-band__col" id="goal-deps-card">
+              <h2 class="scroll__h">Dependencies<span class="count-pill" id="goal-deps-card-count" hidden></span></h2>
+              <p class="scroll__lede" id="goal-deps-card-lede">Reading…</p>
+              <div id="goal-deps-card-body"></div>
+              <div class="goal-col__foot" id="goal-deps-card-foot" hidden></div>
             </div>
           </div>
 
-          <!-- task 1003480 (ADR 0227 §6 item 4 + §10.5): the per-goal task
-               dependency forest. Its own full-width section, not a band
-               column — a node-link picture needs real width, and (unlike
-               Completion/Members/Conflicts) this is bounded small BY DESIGN
-               (ADR 0227 §3's own finding), so there is no "view all" split:
-               what renders here is the whole forest, every time. -->
-          <div class="scroll" style="margin-top:20px" id="goal-deps-scroll">
-            <h2 class="scroll__h" id="goal-deps-h">Task dependencies<span class="count-pill" id="goal-deps-count" hidden></span></h2>
-            <p class="scroll__lede" id="goal-deps-lede">Reading…</p>
-            <div id="goal-deps-body"></div>
-          </div>
-
           <div class="scroll" style="margin-top:20px">
             <div class="goal-work__head">
               <h2 class="scroll__h">Tasks</h2>
@@ -188,11 +178,19 @@
           </div>
         </section>
 
-        <!-- CONFLICTS full view (hash-routed: #/goal/N/conflicts) — the whole
-             conflict set, opened by the band's "View all" link (task 1828). -->
-        <section id="goal-conflicts-view" hidden aria-labelledby="goal-conflicts-view-h">
-          <p class="card-foot" style="margin:0 0 14px"><a href="#" id="goal-conflicts-back">← Back to goal</a></p>
-          <div class="scroll" style="margin:0" id="goal-conflicts-view-card">
+        <!-- DEPENDENCIES full view (hash-routed: #/goal/N/dependencies; the old
+             #/goal/N/conflicts lands here too) — task 1004738. The per-goal task
+             dependency forest (task 1003480, ADR 0227 §6 item 4 + §10.5) gets
+             the page's full width a node-link picture needs, then the whole
+             conflict set (task 1828). -->
+        <section id="goal-dependencies-view" hidden aria-labelledby="goal-deps-h">
+          <p class="card-foot" style="margin:0 0 14px"><a href="#" id="goal-deps-back">← Back to goal</a></p>
+          <div class="scroll" style="margin:0" id="goal-deps-scroll">
+            <h2 class="scroll__h" id="goal-deps-h">Task dependencies<span class="count-pill" id="goal-deps-count" hidden></span></h2>
+            <p class="scroll__lede" id="goal-deps-lede">Reading…</p>
+            <div id="goal-deps-body"></div>
+          </div>
+          <div class="scroll" style="margin-top:20px" id="goal-conflicts-view-card">
             <h2 class="scroll__h" id="goal-conflicts-view-h">Conflicts<span class="count-pill" id="goal-conflicts-view-count" hidden></span></h2>
             <p class="scroll__lede">Open tasks whose declared files overlap — sequence these before two builders collide.</p>
             <div id="goal-conflicts-full"></div>

package/modules/hall-ui/public/goals.states.json

@@ -122,7 +122,25 @@
       ],
       "expect": {
         "visible": [
-          "#goal-detail-view"
+          "#goal-detail-view",
+          "#goal-deps-card"
+        ]
+      }
+    },
+    "dependencies": {
+      "auth": true,
+      "url": "/builders/goals#/goal/25/dependencies",
+      "actions": [
+        [
+          "wait",
+          1200
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#goal-dependencies-view",
+          "#goal-deps-scroll",
+          "#goal-conflicts-view-card"
         ]
       }
     },

package/modules/hall-ui/records/goal-dependency-forest.md

@@ -1,9 +1,10 @@
-# The per-goal dependency forest — on the Goals page (tasks 1003480, 1004200)
+# The per-goal dependency forest — on the Goals page (tasks 1003480, 1004200, 1004738)
 
 **THE PER-GOAL DEPENDENCY FOREST landed on the Goals page (task 1003480, goal 1000089; ADR 0227 §6 item 4 and its §10.5 amendment)** — the drill-down the goal map's own header pointed at (the map is the project sky since task 1004232): a task-level picture of which of THIS goal's tasks depend on which, from `GET /goals/:id/dependency-forest`. `goal-forest-lib.js` was the goal map's sibling — the same layered-layout idea (a task sits one column right of what it depends on, deterministic) at a smaller scale, since a per-goal forest is small BY MEASUREMENT (ADR 0227 §10.5: largest 127 tasks, median 9) rather than needing the goal map's cluster-and-shelf packing. Five things worth knowing:
 
-- **Its own full-width section, not a band column.** The existing Completion / Members / Conflicts band (task 1828) is three narrow columns; a node-link picture needs real width, so "Task dependencies" sits as its own `.scroll` block between the band and Tasks, drawn with `createElementNS` + `textContent` (the atlas idiom, which the retired goal-map.js shared — a task title never becomes markup) inside `.gf-scroll`, which names BOTH overflow axes (task 1004130).
-- **No cap, no "view all", unlike its band neighbours.** Completion/Members/Conflicts are per-item lists that can genuinely grow long, so they cap-and-link into a dedicated full view. A dependency forest cannot — ADR 0227 §3's own finding is that the tasks it omits are precisely the ones with nothing to connect them to, so what the server returns is already the honest whole picture, every time.
+- **A compact card on the goal page, the whole picture one click away (task 1004738, owner's call).** The forest first shipped as its own full-width block between the band and Tasks — ~840px for a five-task forest, with a table repeating every task — and the owner called it way too long. Now the band's third column (Conflicts' old slot) is a **Dependencies card**: `brief` (one line), up to three `shipFirst` tasks (open, blocked by nothing open, ranked by how many open tasks wait on them down the chain), the conflicts count, and "See the full picture →". The forest, its table and the whole conflict list live on **`#/goal/N/dependencies`**; `#/goal/N/conflicts` still lands there because the attention inbox links it. Conflicts folded in rather than kept beside it: both answer "what order do we build in".
+- **The full view is never capped.** ADR 0227 §3's finding still holds — the tasks a forest omits are precisely the ones with nothing to connect them to — so the full view draws everything the server returns; only the card summarises. The figure is drawn with `createElementNS` + `textContent` (the atlas idiom — a task title never becomes markup) inside `.gf-scroll`, which names BOTH overflow axes (task 1004130), and it is drawn only while its view is open (`state.view === 'dependencies'`): the goal page shows just the card, so drawing there would be thrown away, and a forest drawn hidden cannot measure its titles.
+- **The card reads two feeds.** It renders from `state.forest` AND `state.conflictPairs`, so `renderConflicts` in `goals-render.js` calls `renderDependencyCard` again when the conflicts land; a null `conflictPairs` (loading, or a failed read) draws no conflicts line rather than a zero.
 - **The states are three, and distinct on purpose:** "Reading…" while the request is in flight, "No task in this goal depends on another task in this goal" for a real empty forest (never a blank canvas), and "Couldn't load…" only for an actual failure — a redirecting-to-auth error is swallowed silently instead, the `loadGoalTasks` precedent, because the page is already navigating away.
 - **`loadDependencyForest`/`renderDependencyForest` are exported from `createGoalsRender`'s return** specifically so `tests/goal_forest_page.mjs` can call them directly against a minimal DOM stub, without needing the much larger fixture a full `renderDetail()` boot would need for members/completion/invites this task never touches.
 - **The harness fixture is a single generic `goals__dependency-forest.json`** (task ids real, drawn from goal 25's own rows in `tasks.json`) — every goal id in the harness sees the same forest, which is fine for looking at the picture and not meant to describe any goal's real dependencies.

package/modules/platform-identity/invite-authz.js

@@ -18,7 +18,7 @@
 // .owner_github_id` and `platform_identity_projects.owner_github_id` are ATTRIBUTION, not
 // authority — their own migration says so and ADR 0238 restates it. The authority is
 // `provisioning_instances.owner_builder_id`, the fact the manage view already trusts and
-// `instanceAccessDenied` already enforces. This module may not import provisioning (ADR 0083's
+// `requireProjectOwner` already enforces. This module may not import provisioning (ADR 0083's
 // one-way rule), so the fact travels on the kernel port `provisioning.projectOwnedBy` —
 // resolveOptional and NOT declared in `consumes` (the `provisioning.projectPlanets`
 // precedent): provisioning is default-off, and a hub running without it simply has no

package/modules/provisioning/catalog-bridge.js

@@ -12,7 +12,7 @@
 // re-pointed address), which is the property a once-at-standup write can never have.
 //
 // IT GRANTS NOTHING. The catalog row is attribution (ADR 0238): ownership stays
-// `provisioning_instances.owner_builder_id`, which is what `instanceAccessDenied` already
+// `provisioning_instances.owner_builder_id`, which is what `requireProjectOwner` already
 // enforces on every route that calls this. The projection carries the owner's github id only
 // so the hub can attribute the row and claim-check its own writes.
 'use strict';

package/modules/provisioning/provisioning.js

@@ -1402,7 +1402,7 @@ async function instanceStateForSlug(db, slug) {
 // control-plane project a hub catalog row names? Lets a hub surface own-scope a project it
 // did not create — without importing this module (ADR 0083) and without promoting the hub's
 // own `owner_github_id` columns, which are attribution and never authority (ADR 0238). The
-// fact returned is the one `instanceAccessDenied` already enforces on every owner-facing
+// fact returned is the one `requireProjectOwner` already enforces on every owner-facing
 // route here: `provisioning_instances.owner_builder_id`.
 //
 // BOTH HALVES OF THE PROJECTION MUST AGREE, which is why this takes a slug AND a host rather

package/modules/provisioning/route-helpers.js

@@ -0,0 +1,50 @@
+// modules/provisioning/route-helpers.js — the one owner-or-archon gate every own-scoped
+// /provisioning/instances/:id route mounts (task 1004159, ADR 0328 decision 2). It replaced
+// three hand-written copies of the same rule, and the three routes that had only the owner
+// half of it (teardown, domain, github-app).
+'use strict';
+
+const api = require('../../src/module-api');
+const { failFrom } = require('./public-refusal');
+
+const log = api.logger('provisioning');
+
+function isProjectOwner(inst, builder) {
+  return String(inst.owner_builder_id) === String(builder.id);
+}
+
+// The audit actor for a request the gate admitted: the owner acts as themselves, and an
+// archon on someone else's project is named, so the override never reads as the owner's act.
+function projectActor(req) {
+  return isProjectOwner(req.project, req.builder) ? 'api:self' : `api:archon:${req.builder.id}`;
+}
+
+// requireProjectOwner(loadFn, { archonOverride }) — mounted after requireBuilder, and spelled
+// in the route's own middleware list so route-rank-check.js can see it (ADR 0328 §4). Loads
+// the row with the caller's loader (`loadFn(id)`) and admits its owner or, by default, an
+// archon. That is a plain RANK test on purpose: `provisioning.fleet.manage` floors at metic
+// (ADR 0157), so gating on it would widen every route it guards.
+//
+// A missing row and someone else's row are the same 404, and the gate runs before the
+// handler's body validator, so a stranger cannot tell a real id from a malformed request.
+// The loaded row rides on `req.project`.
+function requireProjectOwner(loadFn, { archonOverride = true } = {}) {
+  return async function projectOwnerGate(req, res, next) {
+    const id = api.parseId(req, res); // sends 400 bad_id + returns null on failure
+    if (!id) return;
+    let inst;
+    try {
+      inst = await loadFn(id);
+    } catch (err) {
+      log.error(`[provisioning] ${req.method} ${req.path} — project load`, err);
+      return failFrom(res, err, 'instance_read_failed');
+    }
+    const admitted = !!inst
+      && (isProjectOwner(inst, req.builder) || (archonOverride && req.builder.rank === 'archon'));
+    if (!admitted) return res.fail('instance_not_found', 404);
+    req.project = inst;
+    return next();
+  };
+}
+
+module.exports = { requireProjectOwner, projectActor, isProjectOwner };

package/modules/provisioning/routes/disconnect.js

@@ -12,8 +12,10 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const disconnect = require('../disconnect');
 const { failFrom } = require('../public-refusal');
+const { requireProjectOwner, projectActor, isProjectOwner } = require('../route-helpers');
 
 const log = api.logger('provisioning');
+const loadInstance = (id) => provisioning.getInstanceById(pool, id);
 
 module.exports = function buildDisconnectRouter() {
   const router = express.Router();
@@ -24,19 +26,18 @@ module.exports = function buildDisconnectRouter() {
   // this erases a database, so a replayed or scripted request must carry the same proof
   // the button does. No status gate — any state may be disconnected; the queue refuses
   // while another run is open (disconnect.enqueueDisconnect).
-  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { confirm_slug: { required: true, type: 'string', maxLength: 40 } })) return;
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
-      if (!inst || (!isOwner && req.builder.rank !== 'archon')) return res.fail('instance_not_found', 404);
+      const inst = req.project;
+      const isOwner = isProjectOwner(inst, req.builder);
       if (String(req.body.confirm_slug).trim().toLowerCase() !== inst.slug) {
         return res.fail('confirm_mismatch', { status: 400,
           message: `Type the project's name exactly — ${inst.slug} — to disconnect it. Nothing was changed.` });
       }
-      const actor = isOwner ? 'api:self' : `api:archon:${req.builder.id}`;
+      const actor = projectActor(req);
       const r = await disconnect.enqueueDisconnect(pool, id, actor);
       if (r.conflict) {
         return res.fail('intent_conflict', { status: 409,

package/modules/provisioning/routes/env-manifest.js

@@ -21,26 +21,14 @@
 
 const express = require('express');
 const api = require('../../../src/module-api');
-const { pool, validateOrRespond, parseId } = api;
+const { pool, validateOrRespond } = api;
 const provisioning = require('../provisioning');
 const envManifest = require('../env-manifest');
 const { failFrom } = require('../public-refusal');
+const { requireProjectOwner } = require('../route-helpers');
 
 const log = api.logger('provisioning');
-
-// Resolve the project and decide whether this caller may see it. Returns the instance, or
-// null having already sent the 404 — the same own-or-archon rule as ./disconnect.js.
-async function resolveOwnInstance(req, res) {
-  const id = parseId(req, res); // sends 400 bad_id + returns null on failure
-  if (!id) return null;
-  const inst = await provisioning.getInstanceById(pool, id);
-  const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
-  if (!inst || (!isOwner && req.builder.rank !== 'archon')) {
-    res.fail('instance_not_found', 404);
-    return null;
-  }
-  return inst;
-}
+const loadInstance = (id) => provisioning.getInstanceById(pool, id);
 
 // The `:varId` path segment. parseId reads `:id`, which is the PROJECT here, so the
 // declaration's id is parsed separately. A non-numeric id is a 400 naming the field
@@ -103,10 +91,9 @@ module.exports = function buildEnvManifestRouter() {
 
   // GET — the declared surface. This is the route a BUILDER SESSION reads to learn which
   // variables a project has, which is the whole reason the manifest exists.
-  router.get('/provisioning/instances/:id/env-manifest', api.requireBuilder, async (req, res) => {
+  router.get('/provisioning/instances/:id/env-manifest', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       const vars = await envManifest.listEnvVars(pool, inst.id);
       res.json({
         instance: { id: String(inst.id), slug: inst.slug, hosting_shape: inst.hosting_shape },
@@ -126,7 +113,7 @@ module.exports = function buildEnvManifestRouter() {
 
   // POST — declare a variable, or re-declare one that exists (an edit, not a duplicate:
   // see ../env-manifest.js's declareEnvVar).
-  router.post('/provisioning/instances/:id/env-manifest', api.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances/:id/env-manifest', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     if (refusesValue(req, res)) return;   // before the strict validator — see refusesValue
     if (validateOrRespond(req, res, {
       name: { required: true, type: 'string', maxLength: envManifest.ENV_NAME_MAX },
@@ -135,8 +122,7 @@ module.exports = function buildEnvManifestRouter() {
       required: { type: 'boolean' },
     })) return;
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       if (badDeclaration(req, res, { nameRequired: true })) return;
       const { row, created } = await envManifest.declareEnvVar(pool, {
         instanceId: inst.id,
@@ -154,7 +140,7 @@ module.exports = function buildEnvManifestRouter() {
 
   // PATCH — edit one declaration. Merge-patch: an omitted field is left alone, so the
   // hall can fix a description without restating the environments.
-  router.patch('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, async (req, res) => {
+  router.patch('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     if (refusesValue(req, res)) return;   // before the strict validator — see refusesValue
     if (validateOrRespond(req, res, {
       name: { type: 'string', maxLength: envManifest.ENV_NAME_MAX },
@@ -163,8 +149,7 @@ module.exports = function buildEnvManifestRouter() {
       required: { type: 'boolean' },
     })) return;
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       const varId = parseVarId(req, res);
       if (!varId) return;
       if (badDeclaration(req, res, { nameRequired: false })) return;
@@ -182,10 +167,9 @@ module.exports = function buildEnvManifestRouter() {
   // DELETE — remove one declaration. Nothing outside this table is affected: the value,
   // wherever it lives, is untouched, and the response says so rather than letting an
   // owner believe removing the name removed the secret.
-  router.delete('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, async (req, res) => {
+  router.delete('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       const varId = parseVarId(req, res);
       if (!varId) return;
       const removed = await envManifest.removeEnvVar(pool, inst.id, varId);