@bongos/core 1.21.139 → 1.21.141

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.139",
-  "core_contract": "1.21.139",
-  "source_commit": "9c3b6a3669e6d8122345fde40f98189a34d6809d",
+  "core_version": "1.21.141",
+  "core_contract": "1.21.141",
+  "source_commit": "1df6b5f512d4695c82c2cf8b94ff0234d721598a",
   "source_ref": "HEAD",
-  "built_at": "2026-10-16T15:50:00.989Z",
+  "built_at": "2026-10-17T04:41:31.753Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3156,
+    "functional_verbatim": 3158,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3793,
-  "tree_sha256": "442b7a9383f6629ccb8a89fca8867a4ced006e1d7e334673b517e6f11c9eea5c",
+  "file_count": 3795,
+  "tree_sha256": "8da5a6404d48fa329a19e2d6d06c7787c097c75f8641723d71c8b54fb33a9d44",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -337,7 +337,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "8f4d02ccf2f324ca2d7167beb2cfb145583d760196dcd6188fe50375b953440e"
+      "sha256": "32473bc4b3af9c775d902e05d2ef4a9ba5ab1b76028ca3cbe9b4589ef5e75beb"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2102,7 +2102,7 @@
     {
       "path": "docs/adr/0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md",
       "mode": "0000644",
-      "sha256": "8a59c1aa7f81d335e96c6305bb4f22689c4a0fee627eecdec9585e76a3477bea"
+      "sha256": "0a40681d78739b99df16e4207e71283d15d4b3895bf24c757c9894060254a03f"
     },
     {
       "path": "docs/adr/0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md",
@@ -2377,7 +2377,7 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "c5e8e4a27cf07799da677172e50a0c06d9be9bdf31f511416b40e392d268ffc0"
+      "sha256": "7efe6a2db56553a970553c66cec08e8c93aebecaa3d6fbe91702f7ab2b85cebc"
     },
     {
       "path": "docs/api-reference.md",
@@ -2387,7 +2387,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "4e622eb1825b3b7d4206d64e58ccea51d5dfa8b486664545f0dca259319280f6"
+      "sha256": "bcd476792cd9928a3398018992090ff5a0123750f2c87df439a346fc311945b4"
     },
     {
       "path": "docs/architecture.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "bf3bea8904852c9de7ef7f176b2e563a19b690e6f16efd7e9d97be7286721643"
+      "sha256": "ee6fea80103d420481d7fa395352caf17d518a80459918575b90cc4ecb865e4b"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "7be20a02d29a2000b6fa5266e08d67c44b4919c29c3cb9425cdc29a911086d59"
+      "sha256": "115ba4452f8cbfba88bef9b9c974514e714e1af5852a2fb06f8f46dc24a457c9"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bdd801f3f3af2b93f31a37b2f2eb1b9ac3b394ab8ef980400e6aaa2ae8e5c476"
+      "sha256": "d64fdd18ff9a02daa52471cd6c719b8218b98824b2f9b0ad6cecc57ef4d044d6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3017,7 +3017,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "68ec3fef38565c648811b2f35f2c67dd6d4f00290d75bb10b13e01a5021cdac0"
+      "sha256": "18e50539ef47bd75e92eedb553130ef086077264e29fa504c748169a13642191"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5992,7 +5992,7 @@
     {
       "path": "modules/hall-ui/public/goals.js",
       "mode": "0000644",
-      "sha256": "7800d109e109d61772edcf9fdd1f01dcd079a0937358f2ed8da6cbed361c1e9c"
+      "sha256": "92178535b69db9ded040f26961adf79ed72249634c4103decc98a63593d8261c"
     },
     {
       "path": "modules/hall-ui/public/goals.states.json",
@@ -7129,6 +7129,11 @@
       "mode": "0000644",
       "sha256": "3586cc2aa07913870ad99073c534e70ef2e2c5ff6a5ef2ddeb141cfd397269cd"
     },
+    {
+      "path": "modules/lifecycle/claimable-counts.js",
+      "mode": "0000644",
+      "sha256": "e030803cd033ad2ccebe77de0aa53a6b2b214466fb72b25324197126b20f87e3"
+    },
     {
       "path": "modules/lifecycle/closeness-weights.json",
       "mode": "0000644",
@@ -7697,7 +7702,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "d6ee7c06be0c26423a88dd7e3e92537563cd4a3a110728ea7607f594bd8fe151"
+      "sha256": "bbedfd0018e793c222c09df377443bf8ddf54dcb3a06e7e19be961ea5ecf86d0"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -10532,12 +10537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6c35ef513a1c02f3f73e27af737b43d8d444be0c810bbbab5400d408562b1d24"
+      "sha256": "a17c1cac4c54a3cfe28d40724b89152ae163a6b594c259df09be108a1c731aae"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cbb5b48ee0147aeb0e05c4cf38add512a7df4efed3b521bd3e069d99102f9cb7"
+      "sha256": "89edc8b83b355ce6f57b15754238190e50f97088c4c111d085c1482995fa8946"
     },
     {
       "path": "public-docs/index.html",
@@ -10557,7 +10562,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "8d3cfe743193bd2308275eb71e3bee00e0467d19861ea18413605f796af9ab0f"
+      "sha256": "4ee7aaaddb122c4798467734d00de8ef8c22a3c1f00a3af5a907d969ee4b8f79"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12922,7 +12927,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6751283b546731a5e4ce9df1826bc81ec8c71d7df3784b23692c38fd079bb979"
+      "sha256": "31a1c9f84de47ff566c8cf8c4c4b281b3fde6fe888e18ba1b9a1fda78673225f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15439,6 +15444,11 @@
       "mode": "0000644",
       "sha256": "5fafbaf95ca562dbafa5fb370e2ef98da2a258eb8a8139d962a0b19ebf693904"
     },
+    {
+      "path": "tests/hall_goals_open_first.mjs",
+      "mode": "0000644",
+      "sha256": "79eb37297318f1dfe4661d4fdee68a80c4705141ee142584609232765aaaf2d7"
+    },
     {
       "path": "tests/hall_gov_counts.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -187,7 +187,7 @@ export interface GetStoreModulesLatestResponse { latest: unknown }
 export interface GetStoreUsageReportingResponse { enabled: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
-export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
+export interface GetTasksClaimableResponse { by_goal?: unknown; claimable_total: unknown; claimable?: unknown; active_claims?: unknown }
 export interface GetTasksIdCriteriaResponse { criteria: unknown }
 export interface GetTasksIdDependenciesResponse { dependencies: unknown; dependents: unknown }
 export interface GetTasksIdRecommendationsResponse { recommendations: unknown; count: unknown }

package/docs/adr/0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md

@@ -1,6 +1,6 @@
 # ADR 0328 — A hosted project's authority is its membership row, not its owner column
 
-- **Status:** accepted
+- **Status:** accepted. **Amended 2026-10-16:** Phase 2 (admitting `member`) is suspended because a `member` row is written at every hub sign-in and is not a grant from the project. The gate stays owner-or-archon. See the *Amendment* at the end ([task 1004754](https://cloudbongos.com/builders#/task/1004754)).
 - **Date:** 2026-09-22
 - **Task:** [task 1003882](https://cloudbongos.com/builders#/task/1003882) (goal 1000094 — BONGOS-V2)
 - **Deciders:** the scoping call — "every API action must name its project; a non-member may only apply" — is the owner's, recorded 2026-09-13 on the task. This ADR is the mechanism that carries it out: where the underlying membership data already lives, what a route must call to consult it, and what a non-member is told.
@@ -46,6 +46,8 @@ No new header, no session binding, no new CLI convention. `/provisioning/instanc
 
 **Phase 1 (consolidate three implementations into one, and correct the inconsistency between them — task 1004159, no schema change, no new port).** Provisioning already holds `owner_builder_id` directly; it needs no cross-module port to check its own column. Extract one local helper, `requireProjectOwner(loadFn, { archonOverride = true } = {})`, mirroring `requireProjectInviter`'s composed-gate shape (mounted after `requireBuilder`, loads the row, admits on ownership match OR — by default — a plain **rank** check, `req.builder.rank === 'archon'`, denies 404 `instance_not_found` fail-closed on every other path). **This must be the exact rank test `instanceAccessDenied` and `resolveOwnInstance` already run — not `requirePermission('provisioning.fleet.manage')`.** The two are not interchangeable: that permission's floor is `metic` (ADR 0157 lowered it from `archon`, `provisioning.js:252-253`), used only by the separately-gated `force-teardown` route; wiring it into `requireProjectOwner` instead of the plain rank test would silently widen all 14 routes — teardown and disconnect included — from archon-only to metic-and-up, an unstated widening this ADR's whole posture forbids. With the correct rank test, all 14 routes point at the one helper: the 11 that already resolve to "owner OR archon" today (via `instanceAccessDenied`, `resolveOwnInstance`, or `disconnect.js`'s inline copy) get a mechanical, behavior-preserving swap; the 3 that resolve only to "owner" today (`teardown`, `domain`, `github-app`) get the SAME rank-based default the other 11 already carry — an explicit, named widening, not an accident: it makes those three routes consistent with the fleet-support access every sibling route in the same module already grants, closing the gap `force-teardown`'s own existence already implies was intended. **Every archon action taken on a project the archon does not own — through the widened routes or the existing ones — must write a `provisioning_events` row naming the archon actor**, the same `actor: 'api:archon:<id>'` convention the existing routes already use for their own-vs-archon audit trail (`provisioning.js:712,883,1048`); task 1004159's acceptance criteria pin this for the 3 newly-widened routes specifically, since they have no such event today.
 
+> **Suspended 2026-10-16.** The premise below is wrong: the hub's sign-in default is itself `member`, so the rows this phase would admit include everyone who has signed in. Do not build this phase from this text. See the *Amendment* at the end.
+
 **Phase 2 (the multi-member widening — task 1004161).** Extend the same helper to resolve a NEW port, `platform-identity.projectMembershipKind(clientId, githubId) → Promise<'owner'|'member'|'visitor'|'pending'|null>` — a thin wrapper over the already-correct `getMembership()` — via `resolveOptional`, admitting on `owner` or `member`. **This is only as trustworthy as who may write a `member` row, which this ADR consumes and does not change or re-audit.** The one write path that sets `membership_kind` to a value other than the sign-in default (`POST /sso/membership/check-in`, `modules/platform-identity/routes/sso.js`) is authenticated by the PROJECT's own `client_id`/`client_secret` — not a builder's session — and is update-only against a row that already carries a hub-witnessed sign-in (`touchMembership`'s `WHERE ... signin_verified_at IS NOT NULL`). So a `member` row on the hub reflects what the FEDERATED PROJECT's own server reported about its own builder, under the trust model ADR 0141/0201/0247 already established for federated check-ins generally. This ADR's gate inherits that existing trust boundary as-is for provisioning's admission decision; it neither tightens nor loosens it, and does not itself re-verify the check-in path's authorization. **The fallback is scoped narrowly, and the two failure shapes are NOT the same decision:** when the port is unregistered (a self-hosted instance without `platform-identity`), fall back to the Phase 1 direct-column check — the ADR 0083 "graceful degradation on a module-less instance" contract, and the correct answer there, since such an instance has no fleet of *other people's* projects to protect. When the port IS registered but the call throws or resolves an unrecognized value (a hub where the port should be answering and is not), **deny** — do not silently widen the fallback to cover a runtime fault on infrastructure that is supposed to be present. Task 1004161's acceptance criteria must test both paths separately.
 
 This is a **new, parallel axis**, not a fifth branch bolted onto `requirePermission` — exactly as the existing ownership axis (`authorizeOwned`/`authorizeOwnedOrAny`, [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3, R100) is kept structurally separate from the plain permission resolve, for the same reason: a fact `requireBuilder` cannot know (which concrete row, and who stands on it) must be supplied by the handler's own loaded row, and folding it into `requirePermission` would silently drop that second fact for every other caller of that gate.
@@ -82,7 +84,7 @@ The task's own point 5 asks for migration order "for the 96 write routes." This
 
 ## Consequences
 
-- **A team can share one paid hosted instance for the first time**, once task 1004161 lands — `member`-kind rows already exist in the schema and are already correct; they are simply not consulted yet by the surface that would need them.
+- ~~**A team can share one paid hosted instance for the first time**, once task 1004161 lands.~~ *Withdrawn 2026-10-16:* `member`-kind rows are not a project grant (see the *Amendment*). Sharing an instance waits on an owner-made grant ([task 1004753](https://cloudbongos.com/builders#/task/1004753)).
 - **An archon gains fleet-support reach on `teardown`, `domain`, and `github-app` that does not exist today**, once task 1004159 lands — a stated widening, matching the access every other project-scoped route in the same module already grants, not a side effect discovered later.
 - **Three redundant local implementations (`instanceAccessDenied`, `resolveOwnInstance`, `disconnect.js`'s inline copy) collapse into one function**, auditable by `route-rank-check.js` the same way a missing rank check already is — the exact mechanism "Why now" says does not exist today.
 - **A self-hosted instance running `provisioning` without `platform-identity` installed is unaffected**: the port's `resolveOptional` fallback is the existing owner-only check, verbatim, kept as the fallback branch instead of the only branch — and a hub where the port SHOULD be answering and errors instead denies rather than silently falling back (Decision 2, Phase 2).
@@ -96,3 +98,28 @@ The task's own point 5 asks for migration order "for the 96 write routes." This
 - **Fold project authority into `requirePermission` as a fifth axis.** Rejected for the same reason the ownership axis is its own entry point ([ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3, R100): project standing is parameterized by a concrete row `requirePermission` is never handed, so admitting on a bare permission key would collapse per-project standing into "holds the key everywhere" — precisely the widening the ownership axis exists to prevent for `.own` keys.
 - **Migrate all 96 `any-builder` write routes under one project-scope umbrella.** Rejected: the other ~82 routes act on a single-tenant instance's own Bongos data, which has no project dimension per ADR 0100 — applying this decision there would be inventing multi-tenancy for a system deliberately built single-tenant-per-repo, a far larger and unrelated call the owner's one-line decision does not ask for.
 - **Drop the 404 existence-hiding and return 403 for every unauthorized instance id.** Rejected: a stranger with no standing on a project should learn nothing about whether it exists, exactly as `invite-authz.js`'s existing ownership refusal already guarantees. Only a caller who already has a membership row (however weak) is told anything more, because the row itself is proof they already know the project exists.
+
+## Amendment — 2026-10-16: Phase 2 is suspended, because a `member` row is not a grant
+
+[Task 1004754](https://cloudbongos.com/builders#/task/1004754). This is the owner's decision of 2026-10-16. It was made when the session claiming [task 1004161](https://cloudbongos.com/builders#/task/1004161) stopped before writing code.
+
+**What Phase 2 got wrong.** Decision 2 says the only write that sets `membership_kind` "to a value other than the sign-in default" is the project's own check-in, so a `member` row reflects what the project reported. That is true, but the sign-in default is itself `member`:
+
+- `recordFederatedSignin` (`modules/platform-identity/platform-identity.js`) inserts `membership_kind = 'member'`, with the hub's witness, on every completed hub sign-in.
+- It runs at `POST /sso/token`, which completes before the instance's own admission gate runs (`src/bongos/auth-idp.js` `completeIdpFlow` checks `firstTimeAdmissionBlocked` only after the code exchange). A person the project refuses still gets a witnessed `member` row.
+- It runs at `POST /sso/device/poll`. `POST /sso/device/start` takes only a typed origin and needs no sign-in, so any GitHub user can run the device flow against any federated project and get a witnessed `member` row. The project's server is never asked.
+- Instance side, `membershipKind` (`src/bongos/auth-admission.js`) reports `owner` for the first admin and `member` for every other builder. On an instance with `admission.policy: open`, every GitHub sign-up is a builder.
+
+So `member` means "has signed in here". It does not mean "the owner trusts this person with the hosting". Admitting it on the 14 routes would let any GitHub user tear down, re-domain, disconnect, restart or reconfigure any federated hosted project. The witness (`signin_verified_at`) proves that the sign-in happened, not that anyone approved it.
+
+**What changes.**
+
+1. Phase 2 is suspended. `requireProjectOwner` stays the Phase 1 owner-or-archon gate. Task 1004161 is parked in the backlog and depends on the design task below.
+2. A person other than the owner can reach a project's provisioning routes only through a grant that the project's owner (or an archon) makes on purpose. That grant must be stored apart from the sign-in default, and must have one named writer. [Task 1004753](https://cloudbongos.com/builders#/task/1004753) designs it: who writes it, which routes a grantee may use (reads and writes separately; repo-private and the github-app pick-up stay owner-only because they act with the owner's own GitHub token), whether the hub's sign-in default should stop being `member`, and the audit actor a grantee's write carries (neither `api:self` nor `api:archon:<id>`).
+3. Task 1004162's 403 split assumed this vocabulary, so it is re-checked against the new design before it is built.
+
+**What still holds, verified for task 1004161:**
+
+- `client_id = slug` is a sound join key. `scripts/gds/provision-net.js` registers each hosted instance's credentialed client with `clientId = inst.slug`. `provisioning_instances.slug` is `UNIQUE` and is never reused. A catalog-only client cannot check in.
+- `(client_id, github_id)` is already indexed by the table's own `UNIQUE (client_id, github_id)` constraint (`platform_identity_003_project_memberships.sql`). The per-request read needs no new index.
+- Decision 2 has two failure shapes, and they still apply to whatever port carries the grant. If the port is unregistered, fall back to the Phase 1 owner-or-archon check. If the port is registered but throws or returns an unknown value, deny.

package/docs/adr/README.md

@@ -446,7 +446,7 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0325 | [**The managed fleet control plane is the hub we already run** ([task 1001948](https://cloudbongos.com/builders#/task/1001948), goal 1000106 — BONGOS-V2). The spike was written against [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7, which deferred the managed offering as **"genuinely greenfield (no fleet registry exists)"** behind two gates — Mercury and a real `bongos upgrade`. Both gates are shipped and **the premise is not**: measuring the call sites first changed the answer, as it did for [task 1004141](https://cloudbongos.com/builders#/task/1004141). The registry is `provisioning_instances` (owner, shape, domain, database, port, lifecycle, cost estimate, module selection, the liveness overlay and the served/available core-version snapshot), with `provisioning_intents` as the queue and `provisioning_events` as the audit trail; the operator is `scripts/gds/provision.js`, the single token-holder draining that queue behind ADR 0111 §2's trust boundary; oversight is `GET /provisioning/fleet` and `/fleet/cost-ledger`; and the update channel is not one mechanism but two shipped ones — the owner's per-instance deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md), health-gated with auto-rollback) and the opt-in patch-only sweep ([ADR 0136](0136-update-channel-subscription-policy.md)). **Decision: there is no greenfield fleet control plane to design, and none will be built — the hub IS it.** It never needed to sit *above* the per-repo databases [ADR 0100](0100-two-repo-instance-model.md) §3 locks: the roster is a hub table and the operator has never read one. The genuinely missing leg is a **platform leg** — `grep -rl RENDER_API scripts modules src` returns nothing, and after [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) a `cloud-host` is a Render service — and this ADR **deliberately specifies none of it**, because that is [task 1004142](https://cloudbongos.com/builders#/task/1004142)'s with those files open and a second spec for one implementation is how two drift. The fleet **driven** and the fleet **observed** are different populations: `byo-host` is in the registry and operated by nobody, its liveness the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull, so every operator surface must state which it counts — a roster that mixes them reports a fleet-wide upgrade as complete while an unknown number were never asked. The operator holds **exactly one** credential and it is **its own** (the platform account token, root-only on the control plane, never the web tier, never per-customer); ADR 0323 D6's "names, never values" rule is about the CUSTOMER's secrets and is unchanged. Two gaps are filed rather than fixed here: the subscription roster living in `config/update-subscriptions.json` is the one fleet fact the roster route cannot report and a restored backup can lose independently of the rows it describes ([task 1004150](https://cloudbongos.com/builders#/task/1004150), a recommendation and not a ruling), and **`costEstimateUsd` returns 0 for every shape but `dedicated`** — measured live, all 24 fleet rows report `$0`, confidently and with no error, for projects about to cost ~\$14/month each ([task 1004148](https://cloudbongos.com/builders#/task/1004148)). **No fleet-wide "upgrade everything" button**: both channels are per-instance by construction, and one action that moves the whole fleet is the shape most likely to take every customer down at once. AGPL posture unchanged — ADR 0111 §5's one-sentence rule survives its own table. Rejected: building the separate control plane §5 described (a second registry and a second operator holding the same rows with nothing keeping them equal); specifying Render here; reading per-instance databases for fleet reporting; and continuing to defer the whole layer, which is now the reason the ledger reads \$0 for a fleet about to cost real money.](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) | hosting / fleet / provisioning |
 | 0326 | [**An upgrade may ADD a deny rule to a file the instance owns** ([task 1004156](https://cloudbongos.com/builders#/task/1004156), goal 1000090 — BONGOS-V2). Task 1003966 gave the instance starter its deny rules — no reading `.env` files, keys or session tokens, no shelving with the repo-global stash — and they reached **nobody who was already here**. The starter is written only when `.claude/settings.json` is ABSENT, and `bongos upgrade` materializes from the published package, which excludes that file on purpose; so an upgrade always takes the starter branch, always finds a settings.json already there, and left it alone. Every instance on the allow-only starter from task 1003962 — the live one included — kept it forever. That was deliberate ("rewriting a file the instance owns is the line task 1003962 drew"), and the recorded remedy was manual: re-run `bongos init`, or delete the file. **A manual remedy for a security gap protects the instances whose owners read release notes, which is not the set that needs protecting.** The owner's call: ADD the missing deny rules and NAME each one in the run output. The argument is that a deny rule is **monotonic in the safe direction** — an allow rule widens what the local agent may do, a deny rule can only narrow, so appending one cannot make any instance less safe than it was a moment earlier. That is what makes this the one merge worth doing without asking per-instance, and it extends [ADR 0121](0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md) §2's already-licensed "merge OR leave-and-report" from `--adopt` to every materialize. "Never clobber" survives in the sense that was load-bearing: **nothing the instance wrote is removed, reordered or rewritten** — their allow rules, own denies, `ask` list, hooks, env and every key outside `permissions` come back exactly as they were, with new rules appended after. Deliberately NOT done: **no provenance**, so an owner who deletes a rule we add gets it back next upgrade and (deny beating allow in Claude Code's order) cannot override it with an allow — rejected as speculative machinery for a case nobody has hit, revisit on a real complaint; a file that will not parse, or whose `permissions`/`permissions.deny` is not the expected shape, is left BYTE-FOR-BYTE alone and reported, the posture task 1004023 took for the core's own file, because a half-understood rewrite of a permissions file is worse than the gap; and **the allow half is never topped up** — the safety argument is directionality and does not survive being applied to a rule that grants. `materializeClaude` gains `summary.settingsDenyAdded` + `settingsDenyUncheckable`, both printed through `log()` since `upgrade.js` does not iterate `summary.notes`. The test asserting an instance's settings.json comes back byte-identical is superseded by a strictly stronger one — every rule still there, unmoved, deny-only growth — the weaker spelling being what froze the gap in place. **AMENDED 2026-09-22 by [task 1004158](https://cloudbongos.com/builders#/task/1004158): the two shelf rules are now starter-only and the top-up asks for the CREDENTIAL half alone.** 0326 itself named this exclusion as the remedy if the rule ever bit; the owner took it ahead of that, because the monotonicity argument licenses a rule about reading a secret and does not reach one that guards a workflow — with no provenance and deny beating allow, an instance that loses the shelf cannot give it back. A fresh instance still gets both. The top-up only ever appends, so this is **forward-looking only**: an instance that already took them keeps them, live included.](0326-an-upgrade-may-add-a-deny-rule-to-a-file-the-instance-owns.md) | security / instance onboarding |
 | 0327 | [**A `cloud-host` runs on the owner's own account, and the key is borrowed, not stored** ([task 1004175](https://cloudbongos.com/builders#/task/1004175), goal 1000106 — BONGOS-V2). [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) moved a `cloud-host` to Render to stop being a landlord but left **whose account** unexamined; [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 then ruled the platform token is ours and "never per-customer". Standing it up disproved the premise: a Render API key is issued against a **user** and carries their rights in **every workspace they belong to** — the owner's reached three, one of them another builder's, holding their live production. The same check found `mercury` **already on Render**, run by its own owner, which 0323 would have migrated OFF a correct setup onto our bill. The remaining landlord relationship was never the servers; it was the **account**. **Decisions:** (1) each project brings its own platform key — we hold no billing relationship for anyone's compute, and a leaked key's blast radius is exactly its own owner's account, a property that comes from the decision and not from cryptography; (2) the key is **borrowed for standup and cleared**, never stored, because nothing afterwards needs it — Render auto-deploys from Git, the deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)) is a push, liveness is the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull — so it rides the queue as a short-lived value encrypted with the existing `secret-box.js`, the [ADR 0133](0133-github-app-manifest-onboarding-signin.md) handshake's shape; (3) we **never destroy a customer's infrastructure** — teardown disconnects, the owner deletes their own services, a safety property first and the reason (2) works; (4) **two shapes, not three** (`dedicated-cloud-host` removed — on someone's own account a bigger plan is a setting, finishing 0323 §1's own "plan size, not a second code path"), and the **free tier is free**, 0323 §7's cap retired with its premise. **Deliberately NOT built, because nothing is stored:** an asymmetric sealing module, per-row credential binding, rotation/revocation, and the separate-unix-user precondition — each designed in full, then deleted when the retention question was asked instead of assumed. **Stated honestly:** encrypting the in-transit value protects it from a database dump, NOT from a compromised web tier, because the owner's key arrives there in plaintext first; that defence was never available at any retention length. **§5 records a measurement, fixed elsewhere:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §2's boundary is enforced by the CODE, not the kernel — `cloudbongos.service` runs `User=lars` with no sandboxing and `/etc/cloudbongos/box.env` is mode 600 owned by `lars`, so the web tier CAN read the DigitalOcean, Cloudflare and platform tokens; 0325 §4's "root-only" is not what is on the box. (A second finding in the same section — a "mode 777" key file — was **void and is corrected in place**: the path is a symlink, whose mode display is meaningless, to a 600 target. It was inferred from an `ls` rather than an attempted read.) **Resolved 2026-09-23 by [task 1004176](https://cloudbongos.com/builders#/task/1004176)**, and more narrowly than §5 proposed — not the unix split (which would mean relocating the checkout, config dir, `web.env` and the secret-box master key the web tier legitimately needs), but a systemd drop-in with `InaccessiblePaths`, verified as the service user; proving it as **root** reports "no effect" against a working config, because `CAP_DAC_OVERRIDE` bypasses the mode-000 over-mount. It is emphatically NOT a precondition here — that is the point of storing nothing, and had we sealed per-project keys with a private key in that same file the two would have had to land together. **Consequences:** the migration shrinks to an **adoption**; the cost ledger's question inverts (our spend on a `cloud-host` is ~\$0 and correct — what an owner is worth telling is THEIR Render cost, a different column, [task 1004148](https://cloudbongos.com/builders#/task/1004148)); and metering loses its forcing function, cost *visibility* surviving as a feature while billing for hosting does not ([task 1001949](https://cloudbongos.com/builders#/task/1001949)). Rejected: storing each key sealed with a key pair (three days plus a live-site infra change, to keep a value needed once); one platform account holding every project (0325 §4 as written — keeps us the billing landlord and makes one credential reach every customer); generating a Blueprint and having the owner click once in Render (simplest, but the click is the exact friction `cloud-host` exists to remove); and keeping the key in the browser to call Render directly (standup is a runner job with retries and an audit trail, not a page that stays open).](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) | hosting / provisioning / credentials |
-| 0328 | [**A hosted project's authority is its membership row, not its owner column** ([task 1003882](https://cloudbongos.com/builders#/task/1003882), goal 1000094 — BONGOS-V2). The owner's decision (2026-09-13): every API action must name its project, and a non-member may only apply. Two "project" concepts exist and answer different questions: `provisioning_instances` (the hub's fleet registry, single `owner_builder_id`, [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md)) and `<redacted>` (`client_id, github_id, membership_kind ∈ {owner,member,visitor,pending}`, already correct, already backing `GET /my-projects`). The composition this needs already exists once, in the opposite direction: `provisioning.projectOwnedBy` is a published port (task 1003580) that `platform-identity/invite-authz.js` already consumes via `resolveOptional` to ask "does this builder own this project" without importing provisioning (ADR 0083). **The gap is that the module which owns the fact does not use it on itself, and has grown three separate local copies of it instead of one** — `instanceAccessDenied` (6 routes), `resolveOwnInstance` (4 routes) and `disconnect.js`'s own inline copy (1 route) all implement "owner OR archon", while 3 routes (`teardown`, `domain`, `github-app`) implement only "owner" with no archon override at all — an existing inconsistency between sibling routes in the same module, not just duplication, and none of the three implementations is visible to `route-rank-check.js`. Decision: (1) project scope stays the existing path segment, resolved through `slug` (the `client_id = slug` join key [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) already establishes); (2) Phase 1 extracts one local `requireProjectOwner` helper replacing all three implementations — a behavior-preserving swap for 11 routes and a stated, intentional archon-override widening for the 3 that lacked it — no new port needed since provisioning already holds the column; Phase 2 adds a new port `platform-identity.projectMembershipKind` and widens the same helper to admit `owner` OR `member`, falling back to the Phase 1 column check when platform-identity isn't installed (ADR 0083's degrade-gracefully contract) — a NEW parallel axis, not a fifth branch on `requirePermission`, mirroring why the ownership axis ([ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3, R100) is kept separate; (3) a caller with NO membership row still gets 404 `instance_not_found` (existence-hidden, unchanged), but a `pending`/`visitor` row gets 403 `project_membership_required` naming `POST /my-projects/join` (ADR 0141/0201/0247's existing apply flow) — the "apply to join it" the owner's decision names, routed into the flow that already ships rather than a second one; (4) `route-rank-check.js` gains a `project_scope_missing` finding (blocker on write, concerns on read) for any `/provisioning/instances/:id...` route missing the gate, the same structural read it already gives `requirePermission`; (5) migration order is the 14 evidenced routes only — the task's own "96 write routes" figure is the whole app's census, and the other ~82 act on a single-tenant instance's own Bongos board, which [ADR 0100](0100-two-repo-instance-model.md) §3 already isolates one-database-per-repo and has no project dimension to name. Filed: [task 1004159](https://cloudbongos.com/builders#/task/1004159) (the helper) · [task 1004160](https://cloudbongos.com/builders#/task/1004160) (route-rank-check.js, depends on 1004159) · [task 1004161](https://cloudbongos.com/builders#/task/1004161) (the membership port, depends on 1004159) · [task 1004162](https://cloudbongos.com/builders#/task/1004162) (the 403/404 split, depends on 1004161). Rejected: a second `provisioning_instance_members` table (the membership table already exists and joins on the same key — a second one repeats the mistake ADR 0325 already refused); folding project authority into `requirePermission` as a fifth axis (same reasoning R100 already applied to `.own` keys); migrating all 96 write routes (re-litigates ADR 0100's single-tenant model, not this decision); dropping 404 existence-hiding entirely (a total stranger should learn nothing, exactly as `invite-authz.js` already guarantees).](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) | security / authorization / provisioning |
+| 0328 | [**A hosted project's authority is its membership row, not its owner column** ([task 1003882](https://cloudbongos.com/builders#/task/1003882), goal 1000094 — BONGOS-V2). **Amended 2026-10-16 ([task 1004754](https://cloudbongos.com/builders#/task/1004754)):** Phase 2 is suspended. The hub writes a `member` row at every sign-in, including the device flow anyone can start, so admitting `member` would hand any GitHub user any hosted project. The gate stays owner-or-archon until an owner-made grant is designed ([task 1004753](https://cloudbongos.com/builders#/task/1004753)). The owner's decision (2026-09-13): every API action must name its project, and a non-member may only apply. Two "project" concepts exist and answer different questions: `provisioning_instances` (the hub's fleet registry, single `owner_builder_id`, [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md)) and `<redacted>` (`client_id, github_id, membership_kind ∈ {owner,member,visitor,pending}`, already correct, already backing `GET /my-projects`). The composition this needs already exists once, in the opposite direction: `provisioning.projectOwnedBy` is a published port (task 1003580) that `platform-identity/invite-authz.js` already consumes via `resolveOptional` to ask "does this builder own this project" without importing provisioning (ADR 0083). **The gap is that the module which owns the fact does not use it on itself, and has grown three separate local copies of it instead of one** — `instanceAccessDenied` (6 routes), `resolveOwnInstance` (4 routes) and `disconnect.js`'s own inline copy (1 route) all implement "owner OR archon", while 3 routes (`teardown`, `domain`, `github-app`) implement only "owner" with no archon override at all — an existing inconsistency between sibling routes in the same module, not just duplication, and none of the three implementations is visible to `route-rank-check.js`. Decision: (1) project scope stays the existing path segment, resolved through `slug` (the `client_id = slug` join key [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) already establishes); (2) Phase 1 extracts one local `requireProjectOwner` helper replacing all three implementations — a behavior-preserving swap for 11 routes and a stated, intentional archon-override widening for the 3 that lacked it — no new port needed since provisioning already holds the column; Phase 2 adds a new port `platform-identity.projectMembershipKind` and widens the same helper to admit `owner` OR `member`, falling back to the Phase 1 column check when platform-identity isn't installed (ADR 0083's degrade-gracefully contract) — a NEW parallel axis, not a fifth branch on `requirePermission`, mirroring why the ownership axis ([ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3, R100) is kept separate; (3) a caller with NO membership row still gets 404 `instance_not_found` (existence-hidden, unchanged), but a `pending`/`visitor` row gets 403 `project_membership_required` naming `POST /my-projects/join` (ADR 0141/0201/0247's existing apply flow) — the "apply to join it" the owner's decision names, routed into the flow that already ships rather than a second one; (4) `route-rank-check.js` gains a `project_scope_missing` finding (blocker on write, concerns on read) for any `/provisioning/instances/:id...` route missing the gate, the same structural read it already gives `requirePermission`; (5) migration order is the 14 evidenced routes only — the task's own "96 write routes" figure is the whole app's census, and the other ~82 act on a single-tenant instance's own Bongos board, which [ADR 0100](0100-two-repo-instance-model.md) §3 already isolates one-database-per-repo and has no project dimension to name. Filed: [task 1004159](https://cloudbongos.com/builders#/task/1004159) (the helper) · [task 1004160](https://cloudbongos.com/builders#/task/1004160) (route-rank-check.js, depends on 1004159) · [task 1004161](https://cloudbongos.com/builders#/task/1004161) (the membership port, depends on 1004159) · [task 1004162](https://cloudbongos.com/builders#/task/1004162) (the 403/404 split, depends on 1004161). Rejected: a second `provisioning_instance_members` table (the membership table already exists and joins on the same key — a second one repeats the mistake ADR 0325 already refused); folding project authority into `requirePermission` as a fifth axis (same reasoning R100 already applied to `.own` keys); migrating all 96 write routes (re-litigates ADR 0100's single-tenant model, not this decision); dropping 404 existence-hiding entirely (a total stranger should learn nothing, exactly as `invite-authz.js` already guarantees).](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) | security / authorization / provisioning |
 | 0329 | [**The rendered fit check is a kit floor and an advisory ship-check row, not a grader worker** ([task 1004203](https://cloudbongos.com/builders#/task/1004203), goal 1000095 — UI quality). Nothing in the pipeline rendered a page, so titles clipped by character count ran past their cards (task 1003480, task 1004204) and a second `.mSec` child would have landed on the first (task 1003078), each found only in a browser. Two new kit floors, `text-fit` (text measured word by word past its box; SVG text past its card rect) and `sibling-overlap` (in-flow, block-level, text-bearing siblings), run in every `render.js` render; `scripts/gds/render-check.js` renders the pages a branch changed at 1280 + 390 and `/ship-check` shows them as an ADVISORY row that never flips its exit. Not a grader worker: that would put a browser, fixtures and a harness on the grader host for signal the builder already saw; the artist gate (ADR 0241) stays the human look before deploy.](0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md) | ui-design / kit + ship-check |
 | 0330 | [**An ask is answered where it was asked** ([task 1004216](https://cloudbongos.com/builders#/task/1004216), goal 1000095 — BONGOS-V2), amending [ADR 0187](0187-collab-four-decisions.md) §4a. `lifecycle_004` let a builder ASK for help and let the **asker** mark their own row answered; the person being **asked** had no write at all, so the answer happened somewhere Bongos cannot see and the row sat open until its author remembered it — six asks addressed to the owner had been open between four and thirteen days on 2026-09-23, every one of them answerable. That was not an oversight: §4a deferred conversation to the Agora and a test named *"there is deliberately NO reply thread"* enforced it. **The deferral lost its addressee** — task 1002946 is ABANDONED and goal 1000064 ARCHIVED (verified against the live DB), so the rule had stopped meaning "wait for the Agora" and started meaning "an ask stays unanswerable forever to keep a promise to something that does not exist". **Decisions:** (1) an ask carries a thread of replies, APPEND-ONLY in the SCHEMA rather than by convention — no `updated_at`, `edited_by`, `deleted_at` or `parent_reply_id`, no reactions, no mentions, and a trigger that refuses UPDATE and DELETE outright, because a thing you can edit, nest, react to and address at people is a chat and that is what §4a declined; any builder may reply, since the board read is already project-wide and the good case is somebody you did not ask knowing the answer; (2) the **ADDRESSEE** may close an ask (`answered`), widening an asker-only UPDATE that was coherent only while nothing could be said on the row — but `withdrawn` does NOT widen, since "I no longer need this" is the asker's sentence alone and widening it would be a way to make an ask vanish unanswered; `settled_by` records which of the two closed it, and ADR 0187 §3's consent posture is untouched — closing ends a question, it does not accept work; (3) `/collab-review` posts the reply and **leaves the ask open** (owner decision), since an answer the reader has not read is exactly what an unattended run must halt on. **Consequences:** a reply cannot be taken back, by design; the FK **RESTRICTS rather than cascades** — the first draft cascaded, which reads right and was wrong, because a cascade is a plain DELETE the trigger refuses, so deleting an answered ask failed outright (caught by applying the migration to a real Postgres, not by reading it); the old test was REPLACED, not deleted, so the record that the restraint was deliberate survives; and replies inherit the pull-not-push posture, so nothing still tells an asker they were answered. Rejected: a single `answer` column (cheapest and unambiguously not a chat, but a follow-up would have nowhere to go except a second ask, splitting one conversation across two rows); waiting for the Agora (abandoned — waiting means forever); letting anyone close any ask (an open question is somebody's, and a stranger ending it should not be one click away).](0330-an-ask-is-answered-where-it-was-asked.md) | collab / lifecycle / schema |
 | 0331 | [**The sky is the ideator's home, and the project sky takes the goal map's page** ([task 1004229](https://cloudbongos.com/builders#/task/1004229), goal 1000095 — BONGOS-V2), amending [ADR 0227](0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md) and decision 11 of `docs/specs/<redacted>.md`. The owner reviewed an interactive prototype of the ideator sky and the project sky over five rounds on 2026-09-24 and adopted it AS IS — copy, layout, colours, tour text, toggles, interactions — which contradicts two things already written down, so they are rewritten rather than leaving the build graded against a contract nobody means any more. **Decisions:** (1) the sky is the ideator's HOME surface — it replaces *Your thinking*, and the project sky replaces the goal map page — so "never load-bearing" and "arrives last" are DROPPED as a sequencing hedge from before there was a design to look at; the rule that survives at full force is the accessibility half, that the sky is never the ONLY path to anything it shows (the list drawer — the room — is one key away, and every drawn thing is a row in it); (2) ADR 0227 is AMENDED, not reversed — its measured refusal of a whole-corpus task map stands, and the project sky is §1's own prescription rather than its refusal: the goal graph is the entry point, tasks are drawn only INSIDE one goal past a zoom threshold (the per-goal drill-down §10.5 measured readable at 85.2px pitch worst case), below that they are dust density on the rings with NO identities, and the goal map's table survives as the sky's ledger drawer (§6's table equivalent kept); the nav slot the goal map was deliberately denied is GRANTED to the project sky, under Goals (owner, 2026-09-24), so part 4 changes the page and the test asserting no slot together; (3) the five states and the two channels are UNTOUCHED — criterion `ideator-sky-tells-the-truth` names a model, not a picture, and this amendment changes the picture's standing only; (4) the two HEURISTICS in the prototype — an idea's origin guessed from its text, and "born of a thought" found by scanning text for idea ids — must not ship as ledger facts: parts 3 and 4 hide both layers, part 5 replaces them with a `filed_via` column and a real born-of read. **Consequences:** `docs/design/mocks/sky/sky.template.html` is the PIXEL CONTRACT for parts 2–5, and every deviation a gate or the file ratchet forces is listed in that part's ship notes; no snapshot JSON or built page is ever committed (it carries real task and idea titles and this repo is public); ADR 0264's deleted goal "Living project sky" is superseded by this work under Working area 3. Rejected: shipping the sky as an extra and keeping "never load-bearing" (makes the adopted home surface unroutable); reversing ADR 0227 (its refusal is measured and still correct — the sky needs its drill-down shape, not its repeal); shipping the heuristics behind a disclaimer (a labelled guess is still a guess in a picture whose promise is that it cannot be faked).](0331-the-sky-is-the-ideators-home.md) | design / ideator / sky |

package/docs/api/openapi.json

@@ -28773,14 +28773,13 @@
       "GetTasksClaimableResponse": {
         "type": "object",
         "properties": {
-          "claimable": {},
+          "by_goal": {},
           "claimable_total": {},
+          "claimable": {},
           "active_claims": {}
         },
         "required": [
-          "claimable",
-          "claimable_total",
-          "active_claims"
+          "claimable_total"
         ]
       },
       "GetTasksIdCriteriaResponse": {

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2758 strings** across 3 surfaces · 2336 distinct pieces of copy · 2758 certain, 0 heuristic · 242 shown in more than one place.
+**2760 strings** across 3 surfaces · 2338 distinct pieces of copy · 2760 certain, 0 heuristic · 242 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 146 | 1950 |
+| `builders-hall` | `modules/hall-ui/public` | 146 | 1952 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 9 | 708 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8226c979db4d` | 3x | Not now | modules/hall-ui/public/collab.js:668, modules/hall-ui/public/paintbrush.js:119, modules/hall-ui/public/paintbrush.js:183 |
 | … | | _202 more in the JSON registry_ | |
 
-## `builders-hall` — 1950 strings
+## `builders-hall` — 1952 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -238,7 +238,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `118026595c16` | certain | Board Room | `modules/hall-ui/public/board-room.html:31` |
 | `2b8ad43383de` | certain | Board Room — {{worldName}} | `modules/hall-ui/public/board-room.html:6` |
 | `2b8ad43383de` | certain | Board Room — {{worldName}} | `modules/hall-ui/public/board-room.html:6` |
-| `da910fee01d7` | certain | Browse goals → | `modules/hall-ui/public/goals.js:83` |
+| `da910fee01d7` | certain | Browse goals → | `modules/hall-ui/public/goals.js:100` |
 | `25b4ab94728a` | certain | Build from your own machine — get a copy of the project, sign in once, then work in Claude. | `modules/hall-ui/public/hall-render.js:813` |
 | `08bfcc9198ba` | certain | Builder id | `modules/hall-ui/public/government.html:109` |
 | `fd1903586e8e` | certain | Builders hall · this session | `modules/hall-ui/public/craft-mode.js:810` |
@@ -579,10 +579,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6f0deb0b667d` | certain | Goal {…} added. | `modules/hall-ui/public/gate.js:480` |
 | `8a421ae268e6` | certain | Goal {…} removed. | `modules/hall-ui/public/gate.js:504` |
 | `e0bc28d10785` | certain | Goals could not be loaded. Refresh to try again. | `modules/hall-ui/public/goals-page.js:895` |
-| `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:121` |
+| `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:144` |
 | `6a85997bda21` | certain | Goals created | `modules/hall-ui/public/profile.html:154` |
 | `6bbd703b5aad` | certain | Goals it can work on | `modules/hall-ui/public/gate.js:376` |
-| `2ed2cb8fbffd` | certain | Goals page | `modules/hall-ui/public/goals.js:94` |
+| `2ed2cb8fbffd` | certain | Goals page | `modules/hall-ui/public/goals.js:111` |
 | `320a0516a33e` | certain | Goals seeded — awaiting kickoff | `modules/hall-ui/public/roadmap.js:271` |
 | `bba4caf837e9` | certain | Goals — {{worldName}} | `modules/hall-ui/public/goals.html:6` |
 | `bba4caf837e9` | certain | Goals — {{worldName}} | `modules/hall-ui/public/goals.html:6` |
@@ -737,7 +737,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `af8ea41cdf53` | certain | Loading the terminal commands… | `modules/hall-ui/public/commands.html:46` |
 | `1dffb93947f2` | certain | Loading this project’s skills… | `modules/hall-ui/public/settings.html:308` |
 | `d28d321e8a1e` | certain | Loading versions… | `modules/hall-ui/public/task-detail.js:418` |
-| `3c43f157035e` | certain | Loading your goals… | `modules/hall-ui/public/goals.js:95` |
+| `3c43f157035e` | certain | Loading your goals… | `modules/hall-ui/public/goals.js:112` |
 | `7a239a17afc8` | certain | Loading your preferences… | `modules/hall-ui/public/settings.html:35` |
 | `04df1bd30129` | certain | Loading your rank… | `modules/hall-ui/public/ranks.html:30` |
 | `c27711f9eb4d` | certain | Locked until you reach the end of the article above. | `modules/hall-ui/public/primer.html:103` |
@@ -888,6 +888,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c404f22d7892` | certain | Noted on the review — it stays open. | `modules/hall-ui/public/studio.js:423` |
 | `1376762e97db` | certain | Nothing anyone asked of you has been settled yet. | `modules/hall-ui/public/collab.html:125` |
 | `cd652d04d616` | certain | Nothing changes yet. This files a task carrying your wording; whoever claims it lands the diff, and it ships g | `modules/hall-ui/public/copy-desk.html:168` |
+| `65434cfeb080` | certain | Nothing claimable right now | `modules/hall-ui/public/goals.js:71` |
 | `b4b8ed14e704` | certain | Nothing explored yet. Pick a starting point in the sky. | `modules/hall-ui/public/sky-panel.js:134` |
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:817` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1032` |
@@ -944,7 +945,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ec2a3a90b788` | certain | Open your account page | `modules/hall-ui/public/settings.html:110` |
 | `f6f68ba322be` | certain | Open {…} | `modules/hall-ui/public/goal-inbox.js:53` |
 | `f6f68ba322be` | certain | Open {…} | `modules/hall-ui/public/goal-inbox.js:69` |
-| `f6f68ba322be` | certain | Open {…} | `modules/hall-ui/public/goals.js:67` |
+| `f6f68ba322be` | certain | Open {…} | `modules/hall-ui/public/goals.js:84` |
 | `35d46f963cd1` | certain | Opening the doc… | `modules/hall-ui/public/page-notes.js:279` |
 | `7a8dfadb7468` | certain | Opening the rendered page… | `modules/hall-ui/public/approval-queue.js:129` |
 | `62e75a9d0af4` | certain | Opening the reviews… | `modules/hall-ui/public/studio.html:171` |
@@ -1326,6 +1327,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:78` |
 | `4b20ecf5528b` | certain | The next page could not be read. | `modules/hall-ui/public/tweak-editor.js:575` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
+| `0a98e249b324` | certain | The open goals you’ve joined, and the work you can claim in each. Browse, join, and leave goals — and read the | `modules/hall-ui/public/goals.js:111` |
 | `329a1d350f07` | certain | The page changed after your draft was saved, so the draft is not shown over its new words. Rewrite the lines a | `modules/hall-ui/public/tweak-editor.js:310` |
 | `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1467` |
 | `28e0c1457b08` | certain | The page is in. | `modules/hall-ui/public/tweak-editor.html:96` |
@@ -1354,7 +1356,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e48a9b77d91b` | certain | The session log opens from a higher rank. | `modules/hall-ui/public/sessions.html:41` |
 | `af664a644b13` | certain | The seven government structures, for getting a team up to speed before deciding when to flip a switch. | `modules/hall-ui/public/government.js:847` |
 | `6360a5988f26` | certain | The shape and health of the codebase. | `modules/hall-ui/public/watch.html:108` |
-| `fc422cced9e3` | certain | The shared goals you’ve joined. Browse, join, and leave goals — and read their criteria — on the | `modules/hall-ui/public/goals.js:94` |
 | `ac46dc53d95f` | certain | The shared repository the core ships and the modules this project built for itself, each credited to its autho | `modules/hall-ui/public/modules.html:50` |
 | `282638f26534` | certain | The six readings | `modules/hall-ui/public/street.html:204` |
 | `5f631f51f29e` | certain | The skill list could not be loaded. Reload the page to try again. | `modules/hall-ui/public/settings.js:127` |
@@ -1573,7 +1574,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b91183c02c63` | certain | You created this task, but someone is holding a claim on it. Once that is released you can retire it yourself. | `modules/hall-ui/public/task.js:783` |
 | `da274462bb30` | certain | You have no open asks. | `modules/hall-ui/public/collab.html:72` |
 | `6b759151f722` | certain | You have reached the end. The button below is now active. | `modules/hall-ui/public/primer.js:309` |
-| `6d5a4ca58dd6` | certain | You haven’t joined any goals yet. | `modules/hall-ui/public/goals.js:83` |
+| `044387a6f90c` | certain | You haven’t joined any open goals. | `modules/hall-ui/public/goals.js:100` |
 | `8e527ab12334` | certain | You {…}. One vote per member. | `modules/hall-ui/public/board-room.js:451` |
 | `8e1915b19274` | certain | You're in the {…} server with your rank role. | `modules/hall-ui/public/settings.js:716` |
 | `56cfdcc60079` | certain | You're not signed in yet. Sign in to manage your connections, your keys and the way the hall behaves. | `modules/hall-ui/public/settings.html:44` |
@@ -1938,7 +1939,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `73c1372b43d9` | certain | {…} of {…} | `modules/hall-ui/public/sky-panel.js:120` |
 | `cc5106af4b35` | certain | {…} of {…} criteria satisfied | `modules/hall-ui/public/goals-lib.js:32` |
 | `cc5106af4b35` | certain | {…} of {…} criteria satisfied | `modules/hall-ui/public/goals-render.js:701` |
-| `cc5106af4b35` | certain | {…} of {…} criteria satisfied | `modules/hall-ui/public/goals.js:45` |
+| `cc5106af4b35` | certain | {…} of {…} criteria satisfied | `modules/hall-ui/public/goals.js:55` |
 | `c3d9687e2375` | certain | {…} of {…} shipped | `modules/hall-ui/public/profile.js:671` |
 | `f32710d0ef37` | certain | {…} of {…} steps cleared. | `modules/hall-ui/public/hall-render.js:985` |
 | `f5e456c3aaf6` | certain | {…} of {…} turned on. Each one, in a line: | `modules/hall-ui/public/settings-specialities.js:152` |
@@ -1952,6 +1953,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e08fa22622f0` | certain | {…} shipped, {…} confirmed, {…} completed, {…} remaining of {…} | `modules/hall-ui/public/roadmap.js:351` |
 | `5d79bba0d667` | certain | {…} task {…} on live work — {…}. Sequence them before two builders collide. | `modules/hall-ui/public/goal-inbox.js:112` |
 | `ad27ae9f5433` | certain | {…} tasks · {…} | `modules/hall-ui/public/roadmap.js:477` |
+| `db8f35bfcb4f` | certain | {…} task{…} you can claim | `modules/hall-ui/public/goals.js:72` |
 | `955499559f0a` | certain | {…} tokens | `modules/hall-ui/public/sessions.js:173` |
 | `8e28c14b106d` | certain | {…} total | `modules/hall-ui/public/roadmap.js:120` |
 | `1a8a6267e490` | certain | {…} unfinished task{…} — say what happens to each | `modules/hall-ui/public/goals-render.js:1032` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2758,
-    "unique_ids": 2336,
-    "certain": 2758,
+    "strings": 2760,
+    "unique_ids": 2338,
+    "certain": 2760,
     "heuristic": 0,
     "duplicate_ids": 242
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 146,
-      "strings": 1950
+      "strings": 1952
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -613,7 +613,7 @@
       "at": [
         "modules/hall-ui/public/goal-inbox.js:53",
         "modules/hall-ui/public/goal-inbox.js:69",
-        "modules/hall-ui/public/goals.js:67"
+        "modules/hall-ui/public/goals.js:84"
       ]
     },
     {
@@ -734,7 +734,7 @@
       "at": [
         "modules/hall-ui/public/goals-lib.js:32",
         "modules/hall-ui/public/goals-render.js:701",
-        "modules/hall-ui/public/goals.js:45"
+        "modules/hall-ui/public/goals.js:55"
       ]
     },
     {
@@ -4049,7 +4049,7 @@
       "surface": "builders-hall",
       "text": "Browse goals →",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 83,
+      "line": 100,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7118,7 +7118,7 @@
       "surface": "builders-hall",
       "text": "Goals couldn’t be loaded just now. Refresh to try again.",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 121,
+      "line": 144,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7145,7 +7145,7 @@
       "surface": "builders-hall",
       "text": "Goals page",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 94,
+      "line": 111,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8540,7 +8540,7 @@
       "surface": "builders-hall",
       "text": "Loading your goals…",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 95,
+      "line": 112,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9894,6 +9894,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "65434cfeb080",
+      "surface": "builders-hall",
+      "text": "Nothing claimable right now",
+      "file": "modules/hall-ui/public/goals.js",
+      "line": 71,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "b4b8ed14e704",
       "surface": "builders-hall",
@@ -10403,7 +10412,7 @@
       "surface": "builders-hall",
       "text": "Open {…}",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 67,
+      "line": 84,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13836,6 +13845,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "0a98e249b324",
+      "surface": "builders-hall",
+      "text": "The open goals you’ve joined, and the work you can claim in each. Browse, join, and leave goals — and read their criteria — on the",
+      "file": "modules/hall-ui/public/goals.js",
+      "line": 111,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "329a1d350f07",
       "surface": "builders-hall",
@@ -14088,15 +14106,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "fc422cced9e3",
-      "surface": "builders-hall",
-      "text": "The shared goals you’ve joined. Browse, join, and leave goals — and read their criteria — on the",
-      "file": "modules/hall-ui/public/goals.js",
-      "line": 94,
-      "origin": "js-markup",
-      "confidence": "certain"
-    },
     {
       "id": "ac46dc53d95f",
       "surface": "builders-hall",
@@ -16060,11 +16069,11 @@
       "confidence": "certain"
     },
     {
-      "id": "6d5a4ca58dd6",
+      "id": "044387a6f90c",
       "surface": "builders-hall",
-      "text": "You haven’t joined any goals yet.",
+      "text": "You haven’t joined any open goals.",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 83,
+      "line": 100,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19349,7 +19358,7 @@
       "surface": "builders-hall",
       "text": "{…} of {…} criteria satisfied",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 45,
+      "line": 55,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19470,6 +19479,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "db8f35bfcb4f",
+      "surface": "builders-hall",
+      "text": "{…} task{…} you can claim",
+      "file": "modules/hall-ui/public/goals.js",
+      "line": 72,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "955499559f0a",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -3115,5 +3115,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.137 with no explicit bump. run 38920999785. (task 1002620)
   1.21.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.138 with no explicit bump. run 38927010049. (task 1002620)
+  1.21.140 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.139 with no explicit bump. run 38941756016. (task 1002620)
+  1.21.141 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.140 with no explicit bump. run 39003470982. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":46,"lines":5551,"placed":1701,"shared":398,"unplaced":3452,"omitted_data":3574},
+  "counts": {"pages":46,"lines":5551,"placed":1701,"shared":398,"unplaced":3452,"omitted_data":3575},
   "pages": [
     {
       "id": "builders:atlas",
@@ -1439,10 +1439,10 @@
       "surface": "builders",
       "title": "Builders' Hall",
       "states_read": ["home","standing","standing-karma","out","founding","genesis","decide","demo"],
-      "files_hash": "a9e5eadd756bd211",
-      "reading_hash": "cbd0efe0468d04ba",
+      "files_hash": "96338f028ee183da",
+      "reading_hash": "6ba0ac4c30cc2d79",
       "counts": {"lines":283,"placed":77,"shared":10,"unplaced":196},
-      "omitted": {"data":215},
+      "omitted": {"data":216},
       "notes": ["founding: an action failed (page.focus: Timeout 6000ms exceeded.); read as it stood"],
       "lines": [
         {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":860,"string_id":"87cee78ca134"},
@@ -1454,23 +1454,23 @@
         {"key":"L0007","section":"top bar","text":"Building","placement":"shared"},
         {"key":"L0008","section":"top bar","text":"Artistry","placement":"shared"},
         {"key":"L0009","section":"top bar","text":"Ideating","placement":"shared"},
-        {"key":"L0010","section":"Good afternoon, {…}","text":"Good afternoon, {…}","placement":"unplaced"},
-        {"key":"L0011","section":"Good afternoon, {…}","text":"{…} is 83 percent {…}. 150 tasks are claimable right now.","placement":"unplaced"},
-        {"key":"L0012","section":"Good afternoon, {…}","text":"Work","placement":"unplaced","state":"standing"},
-        {"key":"L0013","section":"Good afternoon, {…}","text":"Credits","placement":"unplaced"},
-        {"key":"L0014","section":"Good afternoon, {…}","text":"Shipped","placement":"placed","file":"modules/hall-ui/public/task.js","line":677,"string_id":"0c0a50ba1666"},
-        {"key":"L0015","section":"Good afternoon, {…}","text":"Karma","placement":"unplaced"},
-        {"key":"L0016","section":"Good afternoon, {…}","text":"Achievements","placement":"unplaced","state":"standing"},
-        {"key":"L0017","section":"Good afternoon, {…}","text":"Rebase owed — new claims paused","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":564,"string_id":"06cbba1440b1","state":"standing"},
-        {"key":"L0018","section":"Good afternoon, {…}","text":"— {…} confirmed {…} can't land yet, so {…} reward is pending (it lands on ship). Rebase + re-ship or release {…}: {…}.","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":564,"string_id":"68b547166d48","state":"standing"},
-        {"key":"L0019","section":"Good afternoon, {…}","text":"+11 in 30d","placement":"unplaced"},
-        {"key":"L0020","section":"Good afternoon, {…}","text":"Rank","placement":"unplaced"},
-        {"key":"L0021","section":"Good afternoon, {…}","text":"Member since {…}","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":569,"string_id":"df335a1224ae","state":"standing"},
-        {"key":"L0022","section":"Good afternoon, {…}","text":"+11 karma in 30d","placement":"unplaced","state":"standing"},
-        {"key":"L0023","section":"Good afternoon, {…}","text":"Preferred work:","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":584,"string_id":"ed8edd684547","state":"standing"},
-        {"key":"L0024","section":"Good afternoon, {…}","text":"{…}, {…}, {…}, ui","placement":"unplaced","state":"standing"},
-        {"key":"L0025","section":"Good afternoon, {…}","text":"Change in Settings →","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":584,"string_id":"0279db21e29a","state":"standing"},
-        {"key":"L0026","section":"Good afternoon, {…}","text":"karma","placement":"unplaced","state":"standing"},
+        {"key":"L0010","section":"Good morning, {…}","text":"Good morning, {…}","placement":"unplaced"},
+        {"key":"L0011","section":"Good morning, {…}","text":"{…} is 83 percent {…}. 150 tasks are claimable right now.","placement":"unplaced"},
+        {"key":"L0012","section":"Good morning, {…}","text":"Work","placement":"unplaced","state":"standing"},
+        {"key":"L0013","section":"Good morning, {…}","text":"Credits","placement":"unplaced"},
+        {"key":"L0014","section":"Good morning, {…}","text":"Shipped","placement":"placed","file":"modules/hall-ui/public/task.js","line":677,"string_id":"0c0a50ba1666"},
+        {"key":"L0015","section":"Good morning, {…}","text":"Karma","placement":"unplaced"},
+        {"key":"L0016","section":"Good morning, {…}","text":"Achievements","placement":"unplaced","state":"standing"},
+        {"key":"L0017","section":"Good morning, {…}","text":"Rebase owed — new claims paused","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":564,"string_id":"06cbba1440b1","state":"standing"},
+        {"key":"L0018","section":"Good morning, {…}","text":"— {…} confirmed {…} can't land yet, so {…} reward is pending (it lands on ship). Rebase + re-ship or release {…}: {…}.","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":564,"string_id":"68b547166d48","state":"standing"},
+        {"key":"L0019","section":"Good morning, {…}","text":"+11 in 30d","placement":"unplaced"},
+        {"key":"L0020","section":"Good morning, {…}","text":"Rank","placement":"unplaced"},
+        {"key":"L0021","section":"Good morning, {…}","text":"Member since {…}","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":569,"string_id":"df335a1224ae","state":"standing"},
+        {"key":"L0022","section":"Good morning, {…}","text":"+11 karma in 30d","placement":"unplaced","state":"standing"},
+        {"key":"L0023","section":"Good morning, {…}","text":"Preferred work:","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":584,"string_id":"ed8edd684547","state":"standing"},
+        {"key":"L0024","section":"Good morning, {…}","text":"{…}, {…}, {…}, ui","placement":"unplaced","state":"standing"},
+        {"key":"L0025","section":"Good morning, {…}","text":"Change in Settings →","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":584,"string_id":"0279db21e29a","state":"standing"},
+        {"key":"L0026","section":"Good morning, {…}","text":"karma","placement":"unplaced","state":"standing"},
         {"key":"L0027","section":"Standing","text":"Standing","placement":"unplaced"},
         {"key":"L0028","section":"Standing","text":"Credits","placement":"unplaced"},
         {"key":"L0029","section":"Standing","text":"On the board","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":633,"string_id":"11a1905c76b2"},
@@ -1478,10 +1478,10 @@
         {"key":"L0031","section":"Standing","text":"{…}, {…}, {…}, ui","placement":"unplaced"},
         {"key":"L0032","section":"Standing","text":"View full standing →","placement":"placed","file":"modules/hall-ui/public/hall-widgets.js","line":86,"string_id":"4babdfeaf27f"},
         {"key":"L0033","section":"Goals","text":"Goals","placement":"unplaced"},
-        {"key":"L0034","section":"Goals","text":"The shared goals you’ve joined. Browse, join, and leave goals — and read their criteria — on the","placement":"placed","file":"modules/hall-ui/public/goals.js","line":94,"string_id":"fc422cced9e3"},
-        {"key":"L0035","section":"Goals","text":"Goals page","placement":"placed","file":"modules/hall-ui/public/goals.js","line":94,"string_id":"2ed2cb8fbffd"},
-        {"key":"L0036","section":"Goals","text":"You haven’t joined any goals yet.","placement":"placed","file":"modules/hall-ui/public/goals.js","line":83,"string_id":"6d5a4ca58dd6"},
-        {"key":"L0037","section":"Goals","text":"Browse goals →","placement":"placed","file":"modules/hall-ui/public/goals.js","line":83,"string_id":"da910fee01d7"},
+        {"key":"L0034","section":"Goals","text":"The open goals you’ve joined, and the work you can claim in each. Browse, join, and leave goals — and read their criteria — on the","placement":"placed","file":"modules/hall-ui/public/goals.js","line":111,"string_id":"0a98e249b324"},
+        {"key":"L0035","section":"Goals","text":"Goals page","placement":"placed","file":"modules/hall-ui/public/goals.js","line":111,"string_id":"2ed2cb8fbffd"},
+        {"key":"L0036","section":"Goals","text":"You haven’t joined any open goals.","placement":"placed","file":"modules/hall-ui/public/goals.js","line":100,"string_id":"044387a6f90c"},
+        {"key":"L0037","section":"Goals","text":"Browse goals →","placement":"placed","file":"modules/hall-ui/public/goals.js","line":100,"string_id":"da910fee01d7"},
         {"key":"L0038","section":"Needs your attention13","text":"Needs your attention","placement":"placed","file":"modules/hall-ui/public/goal-inbox.js","line":597,"string_id":"7def635421ea"},
         {"key":"L0039","section":"From the system","text":"From the system","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":711,"string_id":"d32c5e058d1e"},
         {"key":"L0040","section":"From the system","text":"Rebase owed","placement":"placed","file":"modules/hall-ui/public/hall-render.js","line":680,"string_id":"4f619c19a8e7"},

package/modules/hall-ui/public/goals.js

@@ -30,6 +30,16 @@
     return res.data;
   }
 
+  const isOpenGoal = (g) => !!g && g.status === 'open';
+
+  // goal id -> how many claimable tasks it holds. The server counts (?group=goal
+  // returns counts and no rows), so this card never downloads the feed itself.
+  function claimableByGoal(byGoal) {
+    const counts = new Map();
+    for (const [k, n] of Object.entries(byGoal || {})) counts.set(String(k), Number(n) || 0);
+    return counts;
+  }
+
   let host = null;
   let myId = null;
   const sameId = (a, b) => a != null && b != null && String(a) === String(b);
@@ -55,7 +65,14 @@
     return `<span class="goal-badge ${cls}">${escapeHtml(status)}</span>`;
   }
 
-  function row(detail) {
+  // task 1004755: the claimable count rides under each open goal, so the card
+  // leads with the builder's open goals and shows the work waiting in each.
+  function claimableLine(n) {
+    if (!n) return '<span class="goal-mine__work card-foot">Nothing claimable right now</span>';
+    return `<span class="goal-mine__work card-foot">${n} task${n === 1 ? '' : 's'} you can claim</span>`;
+  }
+
+  function row(detail, counts) {
     const g = detail.goal;
     const crit = Array.isArray(detail.criteria) ? detail.criteria : [];
     const sat = crit.filter((c) => c.satisfied).length;
@@ -68,7 +85,7 @@
         <a class="goal-mine__link" href="${href}" title="Open ${escapeHtml(g.title || 'goal')}"
            style="flex:1;display:flex;align-items:center;gap:12px;min-width:0;color:inherit;text-decoration:none;">
           <span class="goal-mine__ring">${ring(sat, crit.length, achieved)}</span>
-          <span class="goal-mine__title">${escapeHtml(g.title || 'Untitled goal')}</span>
+          <span class="goal-mine__title" style="display:flex;flex-direction:column;min-width:0;">${escapeHtml(g.title || 'Untitled goal')}${claimableLine((counts && counts.get(String(g.id))) || 0)}</span>
           <span class="goal-mine__meta"><span class="goal-mine__ver">${escapeHtml(g.version_id || '')}</span>${statusBadge(g.status)}</span>
         </a>
       </li>`;
@@ -77,21 +94,21 @@
   // task 2184 (Home rule: a summary card never lists more than 5 rows): cap the
   // joined-goals list; the overflow count rides the "All goals" foot link.
   const MAX_HOME_ROWS = 5;
-  function render(joined) {
+  function render(joined, counts) {
     const body = host.querySelector('#goals-body');
     if (!joined.length) {
-      body.innerHTML = '<p class="goal-empty">You haven’t joined any goals yet. <a href="/goals">Browse goals →</a></p>';
+      body.innerHTML = '<p class="goal-empty">You haven’t joined any open goals. <a href="/goals">Browse goals →</a></p>';
       return;
     }
     const shown = joined.slice(0, MAX_HOME_ROWS);
     const more = joined.length - shown.length;
-    body.innerHTML = `<ul class="goal-mine-list">${shown.map(row).join('')}</ul>` +
+    body.innerHTML = `<ul class="goal-mine-list">${shown.map((d) => row(d, counts)).join('')}</ul>` +
       `<p class="goal-mine__foot card-foot"><a href="/goals">${more > 0 ? `All ${joined.length} goals →` : 'All goals →'}</a></p>`;
   }
 
   const SKELETON =
     '<h2 id="goals-h" class="scroll__h">Goals</h2>' +
-    '<p class="scroll__lede">The shared goals you’ve joined. Browse, join, and leave goals — and read their criteria — on the <a href="/goals">Goals page</a>.</p>' +
+    '<p class="scroll__lede">The open goals you’ve joined, and the work you can claim in each. Browse, join, and leave goals — and read their criteria — on the <a href="/goals">Goals page</a>.</p>' +
     '<div id="goals-body"><div class="profile__placeholder">Loading your goals…</div></div>';
 
   async function load() {
@@ -107,12 +124,18 @@
       // paint. boot() no longer mounts widgets for a signed-out visitor; this
       // keeps the widget itself harmless if it is ever mounted without a session
       // (an expired cookie mid-visit), where the honest answer is to say nothing.
+      // Started now, awaited after the goal reads, so the two run side by side.
+      const feedP = getJSON(`${API}/tasks/claimable?group=goal`, { softAuth: true }).catch(() => null);
       const gres = await getJSON(`${API}/goals`, { softAuth: true });
-      const candidates = (gres.goals || []).filter((g) => g.status !== 'archived');
+      // task 1004755: OPEN goals only. An achieved goal has no work left in it, and
+      // listing it here (it took slots in the five-row cap) pushed the goals with
+      // work waiting off the card.
+      const candidates = (gres.goals || []).filter(isOpenGoal);
       const details = (await Promise.all(candidates.map((g) =>
         getJSON(`${API}/goals/${encodeURIComponent(g.id)}`).catch(() => null)))).filter(Boolean);
       const joined = details.filter((d) => (d.members || []).some((m) => sameId(m.builder_id, myId)));
-      render(joined);
+      const feed = await feedP;
+      render(joined, claimableByGoal(feed && feed.by_goal));
     } catch (err) {
       const body = host.querySelector('#goals-body');
       // Signed out is not a failure — it is simply nothing to show. Only a real

package/modules/lifecycle/claimable-counts.js

@@ -0,0 +1,19 @@
+// claimable-counts.js — how much claimable work sits in each goal (task 1004755).
+//
+// Backs `GET /tasks/claimable?group=goal`, which the hall Home goals card reads to say
+// "N tasks you can claim" under each open goal it lists. It counts the SAME filtered
+// feed the route returns rows from, so a count and claimable_total cannot disagree,
+// and it returns no rows, so a Home card never downloads the feed to count it.
+// A row with no goal is not counted.
+'use strict';
+
+function claimableCountsByGoal(rows) {
+  const out = {};
+  for (const t of Array.isArray(rows) ? rows : []) {
+    if (!t || t.goal_id == null) continue;
+    out[t.goal_id] = (out[t.goal_id] || 0) + 1;
+  }
+  return out;
+}
+
+module.exports = { claimableCountsByGoal };

package/modules/lifecycle/routes/tasks.js

@@ -29,6 +29,7 @@ const api = require('../../../src/module-api');
 // depRefusalRow: the ONE shape a dependency refusal carries, shared with the claim
 // path so promote and claim describe a blocked task identically (task 1003553).
 const { depRefusalRow } = require('../dead-deps.js');
+const { claimableCountsByGoal } = require('../claimable-counts');
 // gradeQualityWhere: the ONE definition of a task_grades row that is an actual
 // quality verdict rather than an outage or an errored worker (task 1002652).
 // The acclaim feed reads it so a grader outage never reaches a voter as 0.0.
@@ -207,16 +208,13 @@ module.exports = function buildTasksRouter() {
     if (fit && !VALID_FITS.has(fit)) {
       return res.fail('bad_fit', 400, { valid: Array.from(VALID_FITS) });
     }
-    // task 1003278 — the creator + staleness axes, so the Work Board narrows the
-    // feed at the SOURCE instead of downloading it and reducing it in the browser.
-    // Same validators as GET /tasks: one vocabulary, two surfaces.
+    // task 1003278 — creator + staleness at the SOURCE, with GET /tasks's validators.
     const claimCreatedBy = parseCreatedBy(req.query.created_by);
     if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
     const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
     if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
-    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072; the hall's
-    // two-line Home card was pulling this whole feed, descriptions and all). It slices
-    // the RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
+    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072). It slices the
+    // RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
     const claimLimit = posInt(req.query.limit, 'bad_limit', 1000);
     if (claimLimit && claimLimit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer (max 1000).' });
     const [feed, active] = await Promise.all([
@@ -228,8 +226,11 @@ module.exports = function buildTasksRouter() {
         createdBy: claimCreatedBy ?? null,
         staleDays: claimStaleDays ?? null,
       }),
-      db.listActiveClaims(),
+      req.query.group === 'goal' ? [] : db.listActiveClaims(),
     ]);
+    if (req.query.group === 'goal') { // counts only, no rows (task 1004755)
+      return res.json({ by_goal: claimableCountsByGoal(feed), claimable_total: feed.length });
+    }
     const claimable = claimLimit ? feed.slice(0, claimLimit) : feed;
     // V3.R75 (#294): tick the onboarding state machine for first_start. Fire
     // and forget — the response should never wait on or fail because of the
@@ -237,9 +238,8 @@ module.exports = function buildTasksRouter() {
     // graduation broadcast. Through the `onboarding` kernel port (BV1.R81 / ADR
     // 0093 §1); ?. degrades to a no-op when the module is off.
     seams.resolveOptional('onboarding')?.safeMarkStage(pool, req.builder.id, 'first_start', req.builder);
-    // `claimable_total` is what makes the limit honest — two rows with no count reads
-    // as "there are only two". It is the length of the array the slice came from, never
-    // a second count query (that is how a total and its own list drift apart, ADR 0197).
+    // `claimable_total` keeps the limit honest: the length of the sliced array, never a
+    // second count query (ADR 0197).
     res.json({ claimable, claimable_total: feed.length, active_claims: active });
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.139",
+  "version": "1.21.141",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.139",
+      "version": "1.21.141",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.139",
+  "version": "1.21.141",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9836,5 +9836,17 @@
       "id": "1004752",
       "text": "Provisioning's own tests now run in the automated checks, so they can't quietly break again."
     }
+  ],
+  "1.21.140": [
+    {
+      "id": "1004754",
+      "text": "Stopped a planned change that would have let anyone who signs in to a hosted project manage it. The design record now says sharing a project needs the owner to grant access on purpose; that design is filed as its own task."
+    }
+  ],
+  "1.21.141": [
+    {
+      "id": "1004755",
+      "text": "Your home page now lists only the goals you have joined that are still open, and under each one says how many tasks you can pick up. Finished goals no longer crowd them out."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.139'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.141'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_goals_open_first.mjs

@@ -0,0 +1,120 @@
+// tests/hall_goals_open_first.mjs — the hall Home goals card leads with the OPEN
+// goals the builder has joined, with the claimable work in each (task 1004755).
+//
+// The owner's acceptance test of criterion wa6-noise-limited found the card
+// listing COMPLETED goals: it kept every non-archived goal, so achieved goals took
+// slots in the five-row cap. This boots the real goals.js in a vm against a fake
+// API and reads what it renders.
+//
+// Run:  node tests/hall_goals_open_first.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { claimableCountsByGoal } = require('../modules/lifecycle/claimable-counts.js');
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals.js'), 'utf8');
+const { test, summary } = makeRunner();
+
+async function renderCard({ goals, members, claimable }) {
+  const body = { innerHTML: '' };
+  const host = { innerHTML: '', querySelector: () => body };
+  let widget = null;
+  const routes = (p) => {
+    if (p === '/api/bongos/me') return { builder: { id: 7 } };
+    if (p === '/api/bongos/goals') return { goals };
+    if (p === '/api/bongos/tasks/claimable?group=goal') {
+      return { by_goal: claimableCountsByGoal(claimable), claimable_total: claimable.length };
+    }
+    if (p.startsWith('/api/bongos/tasks/claimable')) throw new Error('the card must not download the claimable feed: ' + p);
+    const m = p.match(/^\/api\/bongos\/goals\/(\d+)$/);
+    if (m) {
+      const g = goals.find((x) => String(x.id) === m[1]);
+      return { goal: g, criteria: [], members: members[g.id] || [] };
+    }
+    return null;
+  };
+  const window = {
+    OTB: {
+      escapeHtml: (s) => String(s),
+      contributeHallWidget: (w) => { widget = w; },
+    },
+    BongosClient: {
+      createClient: () => ({
+        request: async (_m, p) => { const data = routes(p); return { status: data ? 200 : 404, ok: !!data, data }; },
+      }),
+    },
+    location: { assign() {} },
+  };
+  vm.runInNewContext(SRC, { window, console, Promise, Map, String, Array, Math, encodeURIComponent });
+  widget.mount(host);
+  for (let i = 0; i < 20; i++) await new Promise((r) => setImmediate(r));
+  return body.innerHTML;
+}
+
+const me = [{ builder_id: 7 }];
+
+await test('an achieved goal the builder joined is NOT listed; the open one is', async () => {
+  const html = await renderCard({
+    goals: [
+      { id: 1, title: 'Finished goal', status: 'achieved' },
+      { id: 2, title: 'Live goal', status: 'open' },
+    ],
+    members: { 1: me, 2: me },
+    claimable: [],
+  });
+  assert.ok(html.includes('Live goal'), 'the open joined goal is shown');
+  assert.ok(!html.includes('Finished goal'), 'the completed goal is left off the card');
+});
+
+await test('achieved goals no longer take the five slots ahead of open ones', async () => {
+  const goals = [];
+  for (let i = 1; i <= 5; i++) goals.push({ id: i, title: `Done ${i}`, status: 'achieved' });
+  goals.push({ id: 9, title: 'Open nine', status: 'open' });
+  const members = Object.fromEntries(goals.map((g) => [g.id, me]));
+  const html = await renderCard({ goals, members, claimable: [] });
+  assert.ok(html.includes('Open nine'));
+  assert.ok(!/Done \d/.test(html));
+});
+
+await test('each open goal carries how much claimable work sits in it', async () => {
+  const html = await renderCard({
+    goals: [{ id: 2, title: 'Live goal', status: 'open' }, { id: 3, title: 'Quiet goal', status: 'open' }],
+    members: { 2: me, 3: me },
+    claimable: [{ id: 10, goal_id: 2 }, { id: 11, goal_id: 2 }, { id: 12, goal_id: null }],
+  });
+  assert.match(html, /Live goal[\s\S]*2 tasks you can claim/);
+  assert.match(html, /Quiet goal[\s\S]*Nothing claimable right now/);
+});
+
+await test('a goal the builder has not joined is not listed', async () => {
+  const html = await renderCard({
+    goals: [{ id: 4, title: 'Someone else', status: 'open' }],
+    members: { 4: [{ builder_id: 99 }] },
+    claimable: [],
+  });
+  assert.ok(!html.includes('Someone else'));
+  assert.match(html, /joined any open goals/);
+});
+
+await test('claimableCountsByGoal counts per goal and skips goal-less rows', () => {
+  assert.deepEqual(
+    JSON.parse(JSON.stringify(claimableCountsByGoal([{ goal_id: 2 }, { goal_id: '2' }, { goal_id: 5 }, { goal_id: null }, {}, null]))),
+    { 2: 2, 5: 1 });
+  assert.deepEqual(claimableCountsByGoal(undefined), {});
+});
+
+await test('the route answers ?group=goal with counts and no rows', () => {
+  const route = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+  const body = route.slice(route.indexOf("req.query.group === 'goal'"));
+  assert.ok(body.slice(0, 300).includes('res.json({ by_goal: claimableCountsByGoal(feed), claimable_total: feed.length })'));
+});
+
+summary();