@bongos/core 1.21.140 → 1.21.142

package/modules/hall-ui/public/street-office.js

@@ -260,6 +260,32 @@
     };
   }
 
+  // ---------- who should lead (task 1004724) ----------
+  // The office's "who should lead": any builder who may open a board item (the
+  // perm /me reports) may propose one of the project's active people as the
+  // building's Lead. A proposal is the existing appoint_lead People matter (POST
+  // /government/board/matters); only its sitting passing seats anyone, and the
+  // server checks the perm, the person and the building again. null: not offered.
+  function appointPlan(living, key, roster, me, os) {
+    const off = officeOf(living, key);
+    const perms = me && me.permissions;
+    if (!off || !(perms && perms['board.item.open'] === true)) return null;
+    const leadId = off.lead ? off.lead.id : null;
+    const people = (roster && Array.isArray(roster.builders) ? roster.builders : [])
+      .filter((b) => b && b.id != null && (b.status == null || b.status === 'active') && str(b.id) !== leadId)
+      .map((b) => ({ id: str(b.id), name: str(b.display_name || b.github_login) }))
+      .filter((p) => p.name)
+      .sort((a, z) => a.name.localeCompare(z.name));
+    if (!people.length) return null;
+    return { building: key, name: off.name, seated: off.seated, people: people, filed: !!(os && os.leadFiled && os.leadFiled[key]) };
+  }
+  // The body of POST /government/board/matters for one proposed Lead, or null.
+  function appointBody(plan, personId) {
+    const p = plan ? plan.people.find((x) => x.id === str(personId)) : null;
+    if (!p) return null;
+    return { area: 'people', title: 'Appoint ' + p.name + ' as Lead of ' + plan.name, action: { type: 'appoint_lead', building: plan.building, builder_id: Number(p.id) } };
+  }
+
   // ---------- how strict ----------
   // GET /government/presets (task 1004715): the preset is the one the laws in
   // force amount to (none: "No preset yet"), each carries the locks a switch to
@@ -281,6 +307,7 @@
     officeOf: officeOf, worksOf: worksOf, builtFloors: builtFloors, buildPlan: buildPlan, buildsAlone: buildsAlone,
     isoPicture: isoPicture, lawBook: lawBook, injection: injection,
     treasury: treasury, strictness: strictness, usd: usd, dayWords: dayWords,
+    appointPlan: appointPlan, appointBody: appointBody,
   };
 
   // =====================================================================
@@ -292,6 +319,9 @@
   const page = (function () {
     let env = null, doc = null;
     const os = blank();
+    // the Lead appointments this visit filed, by building (task 1004724); the
+    // vote itself is the server's, on the docket
+    const leadsFiled = {};
     const deckPage = () => (root.GovDeck ? root.GovDeck.page : null);
     const living = () => { const p = deckPage(); return p ? p.living() : null; };
     const viewerId = () => { const d = env ? env.data() : null; return d && d.docket && d.docket.viewer ? str(d.docket.viewer.id) : null; };
@@ -575,6 +605,10 @@
       off.rooms.forEach((r) => row(r.name, r.proposed ? 'proposed · a vote is open' : r.line));
       worksOf(lv, key).forEach((w) => row(w.label, w.line));
       if (rows.children && rows.children.length) el.appendChild(rows);
+      // who should lead: propose a Lead, filed as a People vote (task 1004724)
+      const fd = deckPage() ? deckPage().feeds() : {};
+      const ap = appointPlan(lv, key, fd.roster, fd.me, { leadFiled: leadsFiled });
+      if (ap) el.appendChild(appointEl(ap));
       // build out: a capsule each, one tap. Only the building's holder sees them
       // (GET /government/leads answers; the server holds the same wall).
       if (off.holders && off.holders.includes(str(viewerId()))) {
@@ -597,6 +631,31 @@
         if (c.capsule && c.ask_id) { const card = askHere(c.ask_id, { building: key, change: c.capsule }); if (card) el.appendChild(card); }
       });
     }
+    function appointEl(ap) {
+      const g = h('div', 'govx-build govx-appoint');
+      g.setAttribute('role', 'group');
+      g.setAttribute('aria-label', 'who should lead');
+      g.appendChild(h('span', 'desk-choices__ask', 'who should lead'));
+      if (ap.filed) { g.appendChild(h('span', 'govx-appoint__f', 'proposed · a vote is open')); return g; }
+      const sel = h('select', 'govx-appoint__who');
+      sel.setAttribute('aria-label', 'who should lead ' + ap.name);
+      ap.people.forEach((p) => { const o = h('option', '', p.name); o.setAttribute('value', p.id); sel.appendChild(o); });
+      g.appendChild(sel);
+      g.appendChild(chip('desk-chip--choice', ap.seated ? 'propose instead' : 'put it to a vote', () => appoint(ap, sel.value)));
+      return g;
+    }
+    // One matter, one place (task 1004724): a book's in-place ask card steps
+    // aside when the floor desk below already holds that matter as a row, which
+    // acts in place too — the treasury's dry pot used to show twice.
+    function settle(govt, on) {
+      if (!govt || !on || !govt.querySelectorAll || !on.querySelector) return 0;
+      let n = 0;
+      Array.prototype.slice.call(govt.querySelectorAll('[data-ask]')).forEach((card) => {
+        const id = str(card.getAttribute('data-ask')).replace(/["\\]/g, '');
+        if (id && on.querySelector('[data-row="' + id + '"]') && card.parentNode) { card.parentNode.removeChild(card); n++; }
+      });
+      return n;
+    }
     // the live site over the drawing: a tower crane over a floor going up
     function crane(bv) {
       const layer = doc.getElementById('insideFloors');
@@ -649,6 +708,19 @@
       });
     }
     // a switch of preset (task 1004715): ONE laws vote, filed through the board
+    function appoint(ap, personId) {
+      const body = appointBody(ap, personId);
+      if (!body || !env || !env.send) return Promise.resolve();
+      return env.send({ method: 'POST', url: '/api/bongos/government/board/matters', body: body }).then((out) => {
+        if (preview(out)) { env.say('This preview stores nothing; no vote was filed.', true); return; }
+        if (!out.ok) { env.say(refusal(out), true); return; }
+        leadsFiled[ap.building] = true;
+        env.say('Put to a vote. Nobody leads ' + ap.name + ' until the vote passes.', true);
+        if (root.GovFeeds && typeof root.GovFeeds.refresh === 'function') root.GovFeeds.refresh(['docket', 'leads']);
+        if (env.load) env.load();
+        env.draw();
+      });
+    }
     function switchPreset(to) {
       const st = strictness(living(), os);
       if (!st || !env.send) return Promise.resolve();
@@ -696,7 +768,7 @@
       p.onChange(() => { if (env && env.inside && env.inside()) env.draw(); });
     }
 
-    return { mount: mount, input: input, inside: inside, buildOut: buildOut, switchPreset: switchPreset, state: os };
+    return { mount: mount, input: input, inside: inside, settle: settle, buildOut: buildOut, appoint: appoint, switchPreset: switchPreset, state: os };
   }());
 
   const api = Object.assign({ page: page }, model);

package/modules/hall-ui/public/street.html

@@ -13,7 +13,7 @@
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
   <link rel="stylesheet" href="/builders/street.css?v=2026-10-09-living3">
   <link rel="stylesheet" href="/builders/street-card.css?v=2026-10-04-record1">
-  <link rel="stylesheet" href="/builders/street-deck.css?v=2026-10-13-glass1">
+  <link rel="stylesheet" href="/builders/street-deck.css?v=2026-10-17-tidy">
 </head>
 <!-- THE STREET (task 1004525, goal 1000125, R03). The street view of
      docs/design/mocks/governor-city/Street.dc.html (renderVals' street branch,
@@ -234,7 +234,7 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>
-<script src="/builders/city-draw.js?v=2026-10-09-living3"></script>
+<script src="/builders/city-draw.js?v=2026-10-17-tidy"></script>
 <script src="/builders/street-draw.js?v=2026-10-09-living3"></script>
 <script src="/builders/street-card.js?v=2026-10-04-record1"></script>
 <script src="/builders/street-inside.js?v=2026-10-09-living3"></script>
@@ -242,7 +242,7 @@
 <script src="/builders/street-desk.js?v=2026-10-04-record1"></script>
 <script src="/builders/street-amend.js?v=2026-10-02-amend1"></script>
 <script src="/builders/street-deck.js?v=2026-10-13-glass1"></script>
-<script src="/builders/street-office.js?v=2026-10-09-living3"></script>
-<script src="/builders/street.js?v=2026-10-13-glass1"></script>
+<script src="/builders/street-office.js?v=2026-10-17-tidy"></script>
+<script src="/builders/street.js?v=2026-10-17-tidy"></script>
 </body>
 </html>

package/modules/hall-ui/public/street.js

@@ -516,7 +516,10 @@
     // the chosen floor: two blocks that take turns, so the block re-enters on every pick
     var on = $(bv.flipA ? 'insideOpenA' : 'insideOpenB'), off = $(bv.flipA ? 'insideOpenB' : 'insideOpenA');
     if (off) { off.hidden = true; clear(off); }
-    if (on) { on.hidden = false; if (!(OP && OP.inside(bv, on, $('insideGovt')))) fillDesk(on, bv); }
+    if (on) {
+      on.hidden = false;
+      if (!(OP && OP.inside(bv, on, $('insideGovt')))) { fillDesk(on, bv); if (OP && OP.settle) OP.settle($('insideGovt'), on); }
+    }
     setText('insideOnFile', bv.onFile);
     var drawers = $('insideDrawers'); clear(drawers);
     bv.drawers.forEach(function (dw) {

package/modules/hall-ui/public/studio-lib.js

@@ -151,6 +151,26 @@
     });
   }
 
+  // Pages in flight (task 1004662): every page with an open round, where it
+  // is and since when, from the server's own list (stuck first). The panel
+  // derives no state; it only words the age.
+  function inFlightRows(pages, now) {
+    const at = now instanceof Date ? now.getTime() : Number(now || Date.now());
+    return ((pages && pages.in_flight) || []).map((p) => {
+      const t = p.since ? Date.parse(p.since) : NaN;
+      const days = Number.isFinite(t) ? Math.max(0, Math.floor((at - t) / 86400000)) : null;
+      const age = days == null ? '' : days === 0 ? 'since today' : days === 1 ? 'for 1 day' : `for ${days} days`;
+      return {
+        page_id: p.page_id,
+        title: titleOf(p),
+        surface: surfaceWord(p.surface),
+        state: p.state_word || 'Needs a look',
+        age,
+        stuck: !!p.stuck,
+      };
+    });
+  }
+
   function askedLine(n) {
     const v = num(n);
     if (v <= 0) return '';
@@ -221,7 +241,7 @@
 
   const api = {
     STUDIO_PAGE, PAGE_ID_RE, SURFACE_WORDS, surfaceWord, titleOf, numberWords, tallyParts, resumeDetail,
-    subParts, flowDetail, statusDetail, apexHost, landingHost, surfaceRows, askedLine, pickLabel, matchLine, claimWords,
+    subParts, flowDetail, statusDetail, apexHost, landingHost, surfaceRows, inFlightRows, askedLine, pickLabel, matchLine, claimWords,
     skyAt, dayPart, STOCK_GREETING, clockGreets,
   };
   if (typeof window !== 'undefined') window.OTBStudioLib = api;

package/modules/hall-ui/public/studio.css

@@ -631,6 +631,17 @@ html.st-open { overflow: hidden; }
 .st-surface__fill { height: 4px; border-radius: 999px; background: var(--st-accent); }
 .st-asked { margin: 0; font-size: 14px; line-height: 1.5; color: var(--st-ink-faint); }
 
+/* Where your pages are (task 1004662): each page with an open round, its state
+   and how long; a stuck page leads and carries the accent. */
+.st-flight__head { margin: 28px 0 10px; font-size: 13px; font-weight: 500; letter-spacing: .04em; text-transform: uppercase; color: var(--st-ink-dim); }
+.st-flights { display: flex; flex-direction: column; gap: 4px; margin: 0; padding: 0; list-style: none; }
+.st-flight { display: flex; align-items: baseline; gap: 10px; flex-wrap: wrap; padding: 6px 0; }
+.st-flight__page { min-height: 24px; display: inline-flex; align-items: center; font-size: 15px; color: var(--st-ink); text-decoration: none; overflow-wrap: anywhere; }
+.st-flight__page:hover, .st-flight__page:focus-visible { text-decoration: underline; }
+.st-flight__where { font-size: 13px; color: var(--st-ink-dim); }
+.st-flight__state { margin-left: auto; font-size: 13.5px; color: var(--st-ink-soft); }
+.st-flight--stuck .st-flight__state { color: var(--st-accent); }
+
 /* From the live site (task 1004499): one row per review, the page then who and
    when, then its opening words. Each row opens the doc in the palette's panel. */
 .st-sites { display: flex; flex-direction: column; gap: 6px; margin: 0; padding: 0; list-style: none; }

package/modules/hall-ui/public/studio.js

@@ -720,7 +720,14 @@
         <div class="st-surface__track"><div class="st-surface__fill" style="width: ${Number(s.pct)}%"></div></div>
       </li>`).join('');
     const asked = lib.askedLine(home.next && home.next.asked_pages);
-    return `<ul class="st-surfaces">${rows}</ul>${asked ? `<p class="st-asked">${escapeHtml(asked)}</p>` : ''}`;
+    const flight = lib.inFlightRows(home.pages, new Date()).map((f) => `
+      <li class="st-flight${f.stuck ? ' st-flight--stuck' : ''}">
+        <a class="st-flight__page" href="${escapeHtml(editorHref(f.page_id))}">${escapeHtml(f.title)}</a>
+        <span class="st-flight__where">${escapeHtml(f.surface)}</span>
+        <span class="st-flight__state">${escapeHtml(f.state)}${f.age ? ` · ${escapeHtml(f.age)}` : ''}${f.stuck ? ' · stuck' : ''}</span>
+      </li>`).join('');
+    const inFlight = flight ? `<h3 class="st-flight__head">Where your pages are</h3><ul class="st-flights">${flight}</ul>` : '';
+    return `<ul class="st-surfaces">${rows}</ul>${asked ? `<p class="st-asked">${escapeHtml(asked)}</p>` : ''}${inFlight}`;
   }
 
   function siteHtml() {

package/modules/hall-ui/records/living-city.md

@@ -45,7 +45,9 @@ The city's plaque and door, the street's header and readings, the deck and the s
 
 - **Nothing is invented.** A field comes from a read or is derived from reads by a rule in `gov-living.js`; a read that fails leaves its part out. No sample data, no prototype mark, no key.
 - **Salmon is spent only on what needs you**, everywhere: a matter routed to another seat stands in ink on the street (pin and windows) as in the city. Ordinary activity is ink, and so is a choice: inside a building the chosen floor, its frame, sign and number, the lift and the desk's plate are ink, salmon only while that floor needs you (task 1004718).
-- **What needs you is never hidden.** The civic quarter's back corner, centre and front corner stand in one screen column, so the Charter (the tallest) takes the back corner and nothing taller stands in front of Planning; a building's salmon windows take its top rows first (task 1004718).
+- **What needs you is never hidden.** The civic quarter's back corner, centre and front corner stand in one screen column, so the Charter (the tallest) takes the back corner and nothing taller stands in front of Planning; a building's salmon windows take its top rows first (task 1004718). Task 1004724 holds the rule in every column: the taller of any two buildings in one screen column stands at the back (Release behind Rules, Automation behind People), tested over all nine.
+- **One ask, one place.** Inside a building, an ask the floor desk already holds as a row (the treasury's dry pot) is not repeated as a card in the building's book above it (task 1004724).
+- **Who should lead.** The Lead's office offers anyone who may open a board item a pick of the project's active people and one chip; it files the existing appoint_lead People matter (POST /government/board/matters). Only the vote passing seats a Lead; the server checks everything again (task 1004724).
 - **The street band is cropped to what it draws** (`street.js` `BAND_TOP`/`BAND_H`, matched by `street.css`): no empty sky over the skylanes and no bare ground under the brackets; a stage taller than the street needs gives its spare height to the foot of the page, under the readings, never to the sky. Paper haze is a cool sea tone deep enough to read as distance (task 1004718).
 - **Motion is CSS only**, says only "this is live", and carries no data (count, size, position and colour do). Ambient loops are 20 s or longer (the pin's halo breathes on 24 s); growth, build-out and the deck's card (the panel rises once) are class-triggered one-shots; every animation stops under `prefers-reduced-motion`, and the still frame is a complete picture.
 - **Colours are the pack's tokens**, except the iso and front-on drawing palettes, which are drawing data. Dark rules are written twice. Light mode is paper: glows become ink washes.

package/modules/ideas/governor-docket.js

@@ -22,7 +22,10 @@ const blockers = require('./blockers');
 const ratify = require('./ratify');
 
 const POINT = 'governor.docket';
-const DOCKET_BLOCKER_LIMIT = 50;
+// Every open blocker is a matter, so the docket's counts are complete (task
+// 1004724: a cap of 50 undercounted past it). Open blockers are few and the read
+// is one indexed query; this ceiling only guards a runaway table.
+const DOCKET_BLOCKER_LIMIT = 2000;
 
 // One open blocker for one viewer. The list is public (GET /blockers), so every
 // governor sees it; only a viewer who may resolve it (`blocker.review`, the

package/modules/lifecycle/claimable-counts.js

@@ -0,0 +1,19 @@
+// claimable-counts.js — how much claimable work sits in each goal (task 1004755).
+//
+// Backs `GET /tasks/claimable?group=goal`, which the hall Home goals card reads to say
+// "N tasks you can claim" under each open goal it lists. It counts the SAME filtered
+// feed the route returns rows from, so a count and claimable_total cannot disagree,
+// and it returns no rows, so a Home card never downloads the feed to count it.
+// A row with no goal is not counted.
+'use strict';
+
+function claimableCountsByGoal(rows) {
+  const out = {};
+  for (const t of Array.isArray(rows) ? rows : []) {
+    if (!t || t.goal_id == null) continue;
+    out[t.goal_id] = (out[t.goal_id] || 0) + 1;
+  }
+  return out;
+}
+
+module.exports = { claimableCountsByGoal };

package/modules/lifecycle/criterion-uat-db.js

@@ -135,6 +135,7 @@ async function signOff({ criterionId, kind, signerId, recording = null, liveAtte
   const readings = await readLive(before.shippedIds, deps);
   const live = uat.foldLiveReadings(readings);
   const owner = deps.ownerId !== undefined ? { id: deps.ownerId } : await api.getFoundingBuilder();
+  const signerIsOwner = await holdsOwnerSeat(signerId, deps);
 
   return withTx(async (client) => {
     const { rows: crit } = await client.query(
@@ -148,7 +149,7 @@ async function signOff({ criterionId, kind, signerId, recording = null, liveAtte
     const backendOnly = criterion ? await isBackendOnly(client, id) : false;
     const refusal = uat.signoffRefusal({
       criterion, counts: now.counts, remaining: now.remaining, backendOnly, kind,
-      signerId, ownerId: owner ? owner.id : null, shipperIds: now.shipperIds,
+      signerId, ownerId: owner ? owner.id : null, signerIsOwner, shipperIds: now.shipperIds,
       recording, live, liveAttested,
     });
     if (refusal) return { ok: false, refusal };
@@ -164,6 +165,22 @@ async function signOff({ criterionId, kind, signerId, recording = null, liveAtte
   }, { pool });
 }
 
+// holdsOwnerSeat — does the signer hold the government's owner seat (task
+// 1004757)? Read per request through the government port, uncached (ADR 0016).
+// No port, or a failed read, answers false: the founding-builder check still
+// applies, so this can only ever ADD the owner, never widen past them.
+async function holdsOwnerSeat(signerId, deps = {}) {
+  const testing = process.env.NODE_ENV === 'test';
+  const government = testing && deps.government !== undefined ? deps.government : api.resolveOptional('government');
+  if (!government || typeof government.positionsFor !== 'function') return false;
+  try {
+    const p = await government.positionsFor(signerId);
+    return !!(p && Array.isArray(p.held) && p.held.some((h) => h && h.kind === 'owner'));
+  } catch {
+    return false;
+  }
+}
+
 // recordOverride — the /satisfy escape hatch, which now has to give a reason and
 // leaves a row saying so (the state reads "Satisfied (override)", never UAT).
 async function recordOverride(exec, { criterionId, signerId, reason }) {

package/modules/lifecycle/criterion-uat.js

@@ -27,6 +27,14 @@
 // solo project can never deadlock on its own work (the owner's "any other
 // builder or the owner").
 //
+// WHO IS THE OWNER (task 1004757). The government's owner seat — every active
+// Archon (modules/government/leads.js ownerOf) — is who this project calls its
+// owner everywhere else (the "Owner" position on /me, the seat an unseated
+// building falls to). The founding builder (lowest-id human) is kept as a
+// fallback for an instance without the government module. Using ONLY the
+// founding builder refused the real owner on a hub whose lowest-id human is
+// someone else, while the refusal itself told them the owner could sign.
+//
 // This file has NO database and NO express: the state derivation and the
 // refusal ladder are pure so every answer is pinned by a DB-free test, and the
 // store unit-tests against a temp dir. The SQL lives in criterion-uat-db.js.
@@ -125,12 +133,13 @@ function foldLiveReadings(readings) {
 //   backendOnly    boolean
 //   kind           'uat' | 'backend_signoff'
 //   signerId       the authenticated builder
-//   ownerId        the project owner (getFoundingBuilder), or null
+//   ownerId        the founding builder (getFoundingBuilder), or null
+//   signerIsOwner  the signer holds the government's owner seat
 //   shipperIds     builder ids that shipped a linked task
 //   recording      a stored recording name, or null
 //   live           foldLiveReadings(...) output
 //   liveAttested   the signer ticked "this is on the live site"
-function signoffRefusal({ criterion, counts, remaining = [], backendOnly, kind, signerId, ownerId = null, shipperIds = [], recording = null, live = { available: false }, liveAttested = false }) {
+function signoffRefusal({ criterion, counts, remaining = [], backendOnly, kind, signerId, ownerId = null, signerIsOwner = false, shipperIds = [], recording = null, live = { available: false }, liveAttested = false }) {
   if (!criterion) return { code: 'criterion_not_found', status: 404, message: 'No such criterion.' };
   if (criterion.satisfied) {
     return { code: 'criterion_already_satisfied', status: 409, message: 'This criterion is already closed.' };
@@ -153,7 +162,7 @@ function signoffRefusal({ criterion, counts, remaining = [], backendOnly, kind,
     return { code: 'criterion_needs_recording', status: 409, message: 'This criterion is user-facing, so it needs a UAT recording. Only a criterion marked backend-only when it was written can be signed off without one.' };
   }
   const signer = String(signerId);
-  const isOwner = ownerId != null && String(ownerId) === signer;
+  const isOwner = signerIsOwner === true || (ownerId != null && String(ownerId) === signer);
   if (!isOwner && shipperIds.map(String).includes(signer)) {
     return { code: 'signer_shipped_this_work', status: 403, message: 'You shipped work linked to this criterion, so someone else has to sign it off. Any other reviewer, or the project owner, can.' };
   }

package/modules/lifecycle/routes/project-settings.js

@@ -412,9 +412,9 @@ module.exports = function buildProjectSettingsRouter() {
   router.patch('/project-settings/spend-cap', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('treasury'), async (req, res) => {
     if (api.validateOrRespond(req, res, { usd: {} })) return; // a number of dollars, or null to turn it off; parsed below
     const raw = req.body ? req.body.usd : undefined;
-    if (raw === undefined) return res.fail('bad_spend_cap', { status: 400, message: 'usd: send a number of dollars a month, or null to turn the cap off' });
+    if (raw === undefined) return res.fail('bad_spend_cap', { status: 400, message: 'Send a number of dollars a month, or nothing to turn the cap off.' });
     const parsed = raw === null ? { usd: null } : api.projectSettings.parseSpendCap(raw);
-    if (parsed.reason) return res.fail('bad_spend_cap', { status: 400, message: `usd: ${parsed.reason}` });
+    if (parsed.reason) return res.fail('bad_spend_cap', { status: 400, message: parsed.reason });
     try {
       await api.projectSettings.setSpendCap(parsed.usd, req.builder.id);
       const resolved = await api.projectSettings.resolveSpendCap();

package/modules/lifecycle/routes/tasks.js

@@ -29,6 +29,7 @@ const api = require('../../../src/module-api');
 // depRefusalRow: the ONE shape a dependency refusal carries, shared with the claim
 // path so promote and claim describe a blocked task identically (task 1003553).
 const { depRefusalRow } = require('../dead-deps.js');
+const { claimableCountsByGoal } = require('../claimable-counts');
 // gradeQualityWhere: the ONE definition of a task_grades row that is an actual
 // quality verdict rather than an outage or an errored worker (task 1002652).
 // The acclaim feed reads it so a grader outage never reaches a voter as 0.0.
@@ -207,16 +208,13 @@ module.exports = function buildTasksRouter() {
     if (fit && !VALID_FITS.has(fit)) {
       return res.fail('bad_fit', 400, { valid: Array.from(VALID_FITS) });
     }
-    // task 1003278 — the creator + staleness axes, so the Work Board narrows the
-    // feed at the SOURCE instead of downloading it and reducing it in the browser.
-    // Same validators as GET /tasks: one vocabulary, two surfaces.
+    // task 1003278 — creator + staleness at the SOURCE, with GET /tasks's validators.
     const claimCreatedBy = parseCreatedBy(req.query.created_by);
     if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
     const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
     if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
-    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072; the hall's
-    // two-line Home card was pulling this whole feed, descriptions and all). It slices
-    // the RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
+    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072). It slices the
+    // RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
     const claimLimit = posInt(req.query.limit, 'bad_limit', 1000);
     if (claimLimit && claimLimit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer (max 1000).' });
     const [feed, active] = await Promise.all([
@@ -228,8 +226,11 @@ module.exports = function buildTasksRouter() {
         createdBy: claimCreatedBy ?? null,
         staleDays: claimStaleDays ?? null,
       }),
-      db.listActiveClaims(),
+      req.query.group === 'goal' ? [] : db.listActiveClaims(),
     ]);
+    if (req.query.group === 'goal') { // counts only, no rows (task 1004755)
+      return res.json({ by_goal: claimableCountsByGoal(feed), claimable_total: feed.length });
+    }
     const claimable = claimLimit ? feed.slice(0, claimLimit) : feed;
     // V3.R75 (#294): tick the onboarding state machine for first_start. Fire
     // and forget — the response should never wait on or fail because of the
@@ -237,9 +238,8 @@ module.exports = function buildTasksRouter() {
     // graduation broadcast. Through the `onboarding` kernel port (BV1.R81 / ADR
     // 0093 §1); ?. degrades to a no-op when the module is off.
     seams.resolveOptional('onboarding')?.safeMarkStage(pool, req.builder.id, 'first_start', req.builder);
-    // `claimable_total` is what makes the limit honest — two rows with no count reads
-    // as "there are only two". It is the length of the array the slice came from, never
-    // a second count query (that is how a total and its own list drift apart, ADR 0197).
+    // `claimable_total` keeps the limit honest: the length of the sliced array, never a
+    // second count query (ADR 0197).
     res.json({ claimable, claimable_total: feed.length, active_claims: active });
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.140",
+  "version": "1.21.142",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.140",
+      "version": "1.21.142",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.140",
+  "version": "1.21.142",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9842,5 +9842,25 @@
       "id": "1004754",
       "text": "Stopped a planned change that would have let anyone who signs in to a hosted project manage it. The design record now says sharing a project needs the owner to grant access on purpose; that design is filed as its own task."
     }
+  ],
+  "1.21.141": [
+    {
+      "id": "1004757",
+      "text": "The project owner can now sign off a goal criterion even when they built some of its work, as the on-screen message always said. Everyone else who built the work still needs someone else to sign."
+    },
+    {
+      "id": "1004662",
+      "text": "The Studio now shows where every page you have submitted actually is: waiting to be applied, being applied, waiting for your review, or approved and going live, with how long it has sat there and a \"stuck\" mark when it has sat"
+    },
+    {
+      "id": "1004755",
+      "text": "Your home page now lists only the goals you have joined that are still open, and under each one says how many tasks you can pick up. Finished goals no longer crowd them out."
+    }
+  ],
+  "1.21.142": [
+    {
+      "id": "1004724",
+      "text": "Twelve small government fixes. Spend-cap mistakes now read as plain sentences. Removing a Lead from a building with none says what to do next. A toast names a setting by its name, not its code. Inside the Treasury, the dry-pot"
+    }
   ]
 }

package/src/bongos/project-settings.js

@@ -358,11 +358,12 @@ function describeTweakAutopickup(resolved) {
 // it is said so and a new loan is recommended against. It never stops work.
 const MAX_SPEND_CAP_USD = 1000000;
 function parseSpendCap(raw) {
-  if (raw == null || raw === '') return { reason: 'empty' };
+  // The reasons are plain sentences a person reads as-is (task 1004724).
+  if (raw == null || raw === '') return { reason: 'Type a number of dollars a month, or clear the cap to turn it off.' };
   const n = Number(raw);
-  if (!Number.isFinite(n)) return { reason: 'not a number' };
-  if (n <= 0) return { reason: 'must be more than $0; clear the cap to turn it off' };
-  if (n > MAX_SPEND_CAP_USD) return { reason: `out of range (1..${MAX_SPEND_CAP_USD})` };
+  if (!Number.isFinite(n)) return { reason: 'That is not a number. Type a number of dollars a month, like 200.' };
+  if (n <= 0) return { reason: 'The cap must be more than $0. To have no cap, clear it instead.' };
+  if (n > MAX_SPEND_CAP_USD) return { reason: `The cap can be at most $${MAX_SPEND_CAP_USD.toLocaleString('en-US')} a month.` };
   return { usd: Math.round(n * 100) / 100 };
 }
 // resolveSpendCap() — { on, usd, source, invalid }. Off (usd null) unless a usable

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.140'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.142'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/criterion_uat.mjs

@@ -238,6 +238,48 @@ await test('SIGNOFF: a shipper is refused and NOTHING is written', async () => {
   assert.ok(!db.calls.some((c) => /WITH candidate AS/.test(c.sql)), 'a refusal never runs the close');
 });
 
+// task 1004757: the owner the refusal names is the government's owner seat. The
+// hub's owner was refused because only the founding builder (lowest-id human)
+// counted, and on the hub that is someone else.
+const ownerSeat = (ids) => ({ positionsFor: async (id) => ({ held: ids.includes(String(id)) ? [{ kind: 'owner' }] : [{ kind: 'board' }] }) });
+
+await test('LADDER: the owner seat may sign off work they shipped, even when not the founding builder', () => {
+  assert.equal(code({ signerId: 7, ownerId: 3, signerIsOwner: true }), null);
+  assert.equal(code({ signerId: 7, ownerId: 3, signerIsOwner: false }), 'signer_shipped_this_work');
+});
+
+await test('SIGNOFF: a shipper holding the owner seat is allowed and the row is written', async () => {
+  const db = signoffDb({ linked: SHIPPED });
+  const out = await uatDb.signOff(
+    { criterionId: 5, kind: 'uat', signerId: 7, recording: REC, liveAttested: true },
+    { pool: db, withTx: withTx(db), deployPort: null, ownerId: 3, government: ownerSeat(['7']) },
+  );
+  assert.equal(out.ok, true, JSON.stringify(out.refusal));
+  assert.equal(inserts(db).length, 1);
+});
+
+await test('SIGNOFF: a shipper on the board but NOT the owner seat is still refused', async () => {
+  const db = signoffDb({ linked: SHIPPED });
+  const out = await uatDb.signOff(
+    { criterionId: 5, kind: 'uat', signerId: 7, recording: REC, liveAttested: true },
+    { pool: db, withTx: withTx(db), deployPort: null, ownerId: 3, government: ownerSeat(['9']) },
+  );
+  assert.equal(out.ok, false);
+  assert.equal(out.refusal.code, 'signer_shipped_this_work');
+  assert.equal(inserts(db).length, 0);
+});
+
+await test('SIGNOFF: an unreadable owner seat falls back to the founding builder, never wider', async () => {
+  const broken = { positionsFor: async () => { throw new Error('down'); } };
+  const db = signoffDb({ linked: SHIPPED });
+  const out = await uatDb.signOff(
+    { criterionId: 5, kind: 'uat', signerId: 7, recording: REC, liveAttested: true },
+    { pool: db, withTx: withTx(db), deployPort: null, ownerId: 3, government: broken },
+  );
+  assert.equal(out.ok, false);
+  assert.equal(out.refusal.code, 'signer_shipped_this_work');
+});
+
 await test('SIGNOFF: the project owner may sign off their own shipped work', async () => {
   const db = signoffDb({ linked: [{ id: 11, status: 'shipped', shipped_by: 3, shipped_at: new Date() }] });
   const out = await uatDb.signOff(