@bongos/core 1.21.175 → 1.21.177

package/modules/government/protected-surfaces.json

@@ -41,9 +41,9 @@
     { "glob": "src/bongos/routes.js", "group": "authz", "why": "the route MOUNT table (a new ungated route lands here)" },
     { "glob": "server.js", "group": "authz", "why": "the Express entrypoint — wires every router + host routing" },
     { "glob": "modules/government/", "group": "authz", "why": "the same authz core under its post-ADR-0174 name (goal 1000068, task 1003003). Listed BEFORE the folder moves, deliberately: `protected` is DERIVED from this registry, so a module key whose globs are absent here computes protected:false — which would silently drop the Archon gate on goal creation AND the pre-push block on these files for the whole window between the key landing and the folder arriving. The prospective-carve precedent is the modules/government/ entry directly above (ADR 0086 §4)." },
-    { "glob": "scripts/gds/provision-config.js", "group": "control-plane", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN. Before this entry nothing that HOLDS the control plane's infrastructure credentials was protected at any rank — an asymmetry idea 1000692 raised and this entry closes. The set is computed, not listed: the tripwire in tests/government_protected_surfaces.mjs recomputes every process.env credential read from the tracked tree and reds if one is unregistered." },
-    { "glob": "scripts/gds/provision-net.js", "group": "control-plane", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task asserted this code lived in scripts/gds/provision.js; it had moved, and provision.js reads no credential at all. Registering the named file rather than the computed one would have recorded the gap as closed while closing nothing." },
-    { "glob": "scripts/gds/do-api.js", "group": "control-plane", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the two above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
+    { "glob": "scripts/bongos/provision-config.js", "group": "control-plane", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN. Before this entry nothing that HOLDS the control plane's infrastructure credentials was protected at any rank — an asymmetry idea 1000692 raised and this entry closes. The set is computed, not listed: the tripwire in tests/government_protected_surfaces.mjs recomputes every process.env credential read from the tracked tree and reds if one is unregistered." },
+    { "glob": "scripts/bongos/provision-net.js", "group": "control-plane", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task asserted this code lived in scripts/bongos/provision.js; it had moved, and provision.js reads no credential at all. Registering the named file rather than the computed one would have recorded the gap as closed while closing nothing." },
+    { "glob": "scripts/bongos/do-api.js", "group": "control-plane", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the two above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
     { "glob": "modules/grading/grader-config.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-model.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
@@ -56,50 +56,51 @@
     { "glob": "modules/grading/grader-providers.neutral.json", "group": "pipeline", "why": "task 1002840. The core's neutral provider set (none): an entry here would send every instance's diffs to a vendor by default." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
-    { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },
-    { "glob": "scripts/gds/ship-check.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-deploy-target.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-escalation.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-finish.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-flow.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-git.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-grade-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-grade.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-honesty.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-io.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-land.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-memory-sync.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-merge-gate.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-merge.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-mode-manual.js", "group": "pipeline", "why": "task 1004631. Split out of the protected scripts/gds/ship.js beside it: the ship-mode step every ship runs before it lands, so it is protected at ship.js's floor (the 1004024 carve tripwire)." },
-    { "glob": "scripts/gds/ship-mode-ask.js", "group": "pipeline", "why": "task 1004630. Split out beside ship.js: the first-ship ask that decides whether a project ships in Auto or Manual mode, so an edit here changes who may start a ship." },
-    { "glob": "scripts/gds/ship-preflight-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-regen.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-resume.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-session-upload.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-state.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-surprise.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/ship-visual.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
-    { "glob": "scripts/gds/confirm.js", "group": "pipeline", "why": "the confirm step" },
-    { "glob": "scripts/gds/merge-mode.js", "group": "pipeline", "why": "the manual land fallback" },
-    { "glob": "scripts/gds/ci-grade.js", "group": "pipeline", "why": "CI grade-gate driver — steers the grade check (ADR 0058)" },
-    { "glob": "scripts/gds/grade-smoke.js", "group": "pipeline", "why": "grade-smoke driver (ADR 0058)" },
-    { "glob": "scripts/gds/conductor-dispatch.js", "group": "pipeline", "why": "mid-flight grader dispatch (ADR 0058)" },
-    { "glob": "scripts/gds/main-audit.js", "group": "pipeline", "why": "the post-push audit — the authoritative substrate layer (self-protect)" },
-    { "glob": "scripts/gds/push-main.js", "group": "pipeline", "why": "the sanctioned main-push (carries the override)" },
-    { "glob": "scripts/gds/run-unit-tests.js", "group": "pipeline", "why": "the unit-gate test SELECTOR — muting tests here blunts the CI gate (ADR 0058)" },
-    { "glob": "scripts/gds/gate-review.js", "group": "pipeline", "why": "the automatic gatekeeper itself (self-protect, ADR 0058)" },
-    { "glob": "scripts/gds/setup.js", "group": "pipeline", "why": "/builder-setup — installs the pre-push hook" },
-    { "glob": "scripts/gds/install-git-hooks.js", "group": "pipeline", "why": "the hook installer (self-protect)" },
-    { "glob": "scripts/gds/hooks/", "group": "pipeline", "why": "the git hooks themselves (self-protect)" },
-    { "glob": "scripts/gds/cli-lib.js", "group": "pipeline", "why": "session/token + apiCall the gate relies on" },
-    { "glob": "scripts/gds/git-merge-regen.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: registerMergeDriver writes 'node scripts/gds/git-merge-regen.js' as a RELATIVE command with cwd at the clone root, so git merge runs the BRANCH's copy, with the live server's DATABASE_URL and BUILDER_SECRET_KEY, before any post-merge step. This and the six generators below are the ENTRYPOINTS in modules/lifecycle/executed-closure.js; tests/government_protected_surfaces.mjs fails the build if that list ever grows past this registry." },
-    { "glob": "scripts/gds/gen-repo-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: run by the merge resolver as execFile(node, [<clone>/...]) after the merge — the branch's copy, the server's environment." },
-    { "glob": "scripts/gds/gen-file-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
-    { "glob": "scripts/gds/gen-session-index.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
-    { "glob": "scripts/gds/copy-inventory.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone. NOT named by the 2026-08-29 audit, which said 'the gen-* trio' — that trio was already stale against GENERATOR_SCRIPTS, which is why this registry is pinned to the closure's ENTRYPOINTS rather than to the audit's prose." },
-    { "glob": "scripts/gds/gen-api-docs.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone, and the widest one — it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers." },
-    { "glob": "scripts/gds/gen-api-client.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone." },
+    { "glob": "scripts/bongos/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },
+    { "glob": "scripts/bongos/ship-check.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-deploy-target.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-escalation.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-finish.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-flow.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-git.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-grade-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-grade.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-honesty.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-io.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-land.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-memory-sync.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-merge-gate.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-merge.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-mode-manual.js", "group": "pipeline", "why": "task 1004631. Split out of the protected scripts/bongos/ship.js beside it: the ship-mode step every ship runs before it lands, so it is protected at ship.js's floor (the 1004024 carve tripwire)." },
+    { "glob": "scripts/bongos/ship-mode-ask.js", "group": "pipeline", "why": "task 1004630. Split out beside ship.js: the first-ship ask that decides whether a project ships in Auto or Manual mode, so an edit here changes who may start a ship." },
+    { "glob": "scripts/bongos/ship-preflight-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-regen.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-resume.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-session-upload.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-state.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-surprise.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/ship-visual.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/bongos/confirm.js", "group": "pipeline", "why": "the confirm step" },
+    { "glob": "scripts/bongos/merge-mode.js", "group": "pipeline", "why": "the manual land fallback" },
+    { "glob": "scripts/bongos/ci-grade.js", "group": "pipeline", "why": "CI grade-gate driver — steers the grade check (ADR 0058)" },
+    { "glob": "scripts/bongos/grade-smoke.js", "group": "pipeline", "why": "grade-smoke driver (ADR 0058)" },
+    { "glob": "scripts/bongos/conductor-dispatch.js", "group": "pipeline", "why": "mid-flight grader dispatch (ADR 0058)" },
+    { "glob": "scripts/bongos/main-audit.js", "group": "pipeline", "why": "the post-push audit — the authoritative substrate layer (self-protect)" },
+    { "glob": "scripts/bongos/push-main.js", "group": "pipeline", "why": "the sanctioned main-push (carries the override)" },
+    { "glob": "scripts/bongos/run-unit-tests.js", "group": "pipeline", "why": "the unit-gate test SELECTOR — muting tests here blunts the CI gate (ADR 0058)" },
+    { "glob": "scripts/bongos/gate-review.js", "group": "pipeline", "why": "the automatic gatekeeper itself (self-protect, ADR 0058)" },
+    { "glob": "scripts/bongos/setup.js", "group": "pipeline", "why": "/builder-setup — installs the pre-push hook" },
+    { "glob": "scripts/bongos/install-git-hooks.js", "group": "pipeline", "why": "the hook installer (self-protect)" },
+    { "glob": "scripts/bongos/hooks/", "group": "pipeline", "why": "the git hooks themselves (self-protect)" },
+    { "glob": "scripts/gds/", "group": "pipeline", "why": "task 1004848. The @bongos-forwarder files the scripts/gds -> scripts/bongos move left at every old path. Each one runs whatever scripts/bongos/ file it names, and installed systemd units, cron routines and older hooks still call these paths, so an edit here changes what runs on a box exactly as an edit to the real script would. Generated by scripts/bongos/codemod-rename-scripts-gds.js; removed by task 1003706." },
+    { "glob": "scripts/bongos/cli-lib.js", "group": "pipeline", "why": "session/token + apiCall the gate relies on" },
+    { "glob": "scripts/bongos/git-merge-regen.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: registerMergeDriver writes 'node scripts/bongos/git-merge-regen.js' as a RELATIVE command with cwd at the clone root, so git merge runs the BRANCH's copy, with the live server's DATABASE_URL and BUILDER_SECRET_KEY, before any post-merge step. This and the six generators below are the ENTRYPOINTS in modules/lifecycle/executed-closure.js; tests/government_protected_surfaces.mjs fails the build if that list ever grows past this registry." },
+    { "glob": "scripts/bongos/gen-repo-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: run by the merge resolver as execFile(node, [<clone>/...]) after the merge — the branch's copy, the server's environment." },
+    { "glob": "scripts/bongos/gen-file-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
+    { "glob": "scripts/bongos/gen-session-index.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
+    { "glob": "scripts/bongos/copy-inventory.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone. NOT named by the 2026-08-29 audit, which said 'the gen-* trio' — that trio was already stale against GENERATOR_SCRIPTS, which is why this registry is pinned to the closure's ENTRYPOINTS rather than to the audit's prose." },
+    { "glob": "scripts/bongos/gen-api-docs.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone, and the widest one — it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers." },
+    { "glob": "scripts/bongos/gen-api-client.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone." },
     { "glob": ".gitattributes", "group": "pipeline", "why": "task 1003366, audit ref MIT1. Not code and never require()d, but it NAMES which paths git hands the otb-regen driver — so editing it changes how much of the tree that driver rewrites during a merge. modules/lifecycle/executed-closure.js carries it as TRUSTED_NON_CODE for exactly this reason (ADR 0043)." },
     { "glob": "scripts/migrate.sh", "group": "pipeline", "why": "applies migrations on deploy" },
     { "glob": "scripts/deploy/", "group": "pipeline", "why": "the deploy scripts run on the droplet at deploy (ADR 0058)" },

package/modules/government/recommendations.js

@@ -42,6 +42,10 @@ const charter = require('./charter');
 const freeze = (o) => Object.freeze(o);
 
 // ── project types ────────────────────────────────────────────────────────────
+// What an owner says they are building, picked in the project wizard. 'game' here
+// is a project TYPE (it recommends a playtester rank), not the game feature module
+// this core deleted — task 1004860 kept it for that reason. The list is held equal
+// to provisioning's PROJECT_TYPES by tests/government_recommendations.mjs.
 const PROJECT_TYPES = freeze([
   freeze({ key: 'game', name: 'Game' }),
   freeze({ key: 'research', name: 'Research' }),
@@ -76,7 +80,7 @@ function sizeBandFor(headcount) {
 // operational keys that job needs — never a trust-boundary key (a custom rank
 // cannot hold one, ADR 0172).
 const JOB_GRANTS = freeze({
-  reviewer: freeze(['criterion.review', 'task.vote', 'idea.triage']),
+  reviewer: freeze(['criterion.review', 'task.vote', 'idea.vote', 'idea.triage']),
   lead: freeze(['task.create', 'task.edit', 'task.promote', 'task.dependency.manage',
     'goal.manage.own', 'idea.triage', 'criterion.review']),
   council: freeze(['board.item.open', 'idea.ratify', 'criterion.satisfy', 'criterion.unsatisfy',
@@ -88,7 +92,7 @@ const JOB_GRANTS = freeze({
 // a reader never has to decode a permission key to judge a recommendation.
 // When a job's grants change, change its sentence in the same edit.
 const JOB_CAN = freeze({
-  reviewer: 'Check finished work against what "done" means, vote on tasks, and sort incoming ideas.',
+  reviewer: 'Check finished work against what "done" means, vote on tasks and ideas, and sort incoming ideas.',
   lead: 'Write, edit and order tasks, move them into the queue, look after their own goals, sort ideas and check finished work.',
   council: 'Put proposals to the board, ratify ideas, decide when a goal is met (or reopen it), create goals and set priorities.',
 });

package/modules/government/routes/government.js

@@ -689,7 +689,7 @@ module.exports = function buildGovernmentRouter() {
   // a read, and the write (the vote) re-checks membership in-handler.
   router.get('/government/board/items', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
     try {
-      const view = await board.boardRoomView({ closedLimit: 20 });
+      const view = await board.boardRoomView({ closedLimit: 20, viewerId: String(req.builder.id) });
       res.json({ ...view, viewer_id: String(req.builder.id) });
     } catch (err) {
       log.error('[gds] GET /government/board/items', err);

package/modules/grading/generated-provenance.js

@@ -58,7 +58,7 @@ const GENERATORS = [
     owns: [
       { file: 'src/bongos/CLAUDE.md', scope: 'fence', marker: 'BEGIN GENERATED REPO-MAP' },
       { file: 'src/bongos/routes/CLAUDE.md', scope: 'fence', marker: 'BEGIN GENERATED REPO-MAP' },
-      // scripts/gds/CLAUDE.md left NESTED_DIRS in task 1003548 — it carries no fence any more.
+      // scripts/bongos/CLAUDE.md left NESTED_DIRS in task 1003548 — it carries no fence any more.
     ],
   },
   {
@@ -81,14 +81,22 @@ const GENERATORS = [
     owns: [{ file: 'CLAUDE.md', scope: 'fence', marker: 'BEGIN GENERATED INTERACTION POSTURE' }],
   },
   {
+    // task 1004866: openapi.json + api-reference.md are gitignored now, so they never reach
+    // a diff; the committed pointer stub is the one file this generator owns in git.
     script: 'gen-api-docs.js',
     verify: '--check',
     owns: [
-      { file: 'docs/api/openapi.json', scope: 'whole' },
-      { file: 'docs/api-reference.md', scope: 'whole' },
       { file: 'docs/routes-permissions.md', scope: 'whole' },
     ],
   },
+  {
+    // task 1004866: fitness gates "the client generates from the routes", but the client
+    // is gitignored — it never appears in a diff, so this generator owns no committed file.
+    // Listed so the roster stays in lockstep with fitness (tests/grader_generated_provenance.mjs).
+    script: 'gen-api-client.js',
+    verify: '--check',
+    owns: [],
+  },
 ];
 
 // THE CIRCULARITY GUARD (panel blocker, task 1002795). Verification works by
@@ -160,7 +168,7 @@ function _verify({ changedFiles, cwd, scriptDir, run } = {}) {
   const verified = [];
   const unverified = [];
   if (implicated.length === 0) return { verified, unverified, checked: [] };
-  const dir = scriptDir || path.join(__dirname, '..', '..', 'scripts', 'gds');
+  const dir = scriptDir || path.join(__dirname, '..', '..', 'scripts', 'bongos');
   const exec = run || ((script, flag) => {
     execFileSync(process.execPath, [path.join(dir, script), flag], {
       cwd: cwd || process.cwd(), stdio: 'pipe', timeout: VERIFY_TIMEOUT_MS, env: SPAWN_ENV,
@@ -227,7 +235,7 @@ async function verifyGeneratedProvenanceAsync({ changedFiles, cwd, scriptDir, ru
   const implicated = generatorsInDiff(changedFiles);
   const empty = { verified: [], unverified: [], checked: [] };
   if (implicated.length === 0) return empty;
-  const dir = scriptDir || path.join(__dirname, '..', '..', 'scripts', 'gds');
+  const dir = scriptDir || path.join(__dirname, '..', '..', 'scripts', 'bongos');
   const runOne = run || ((script, flag) => new Promise((resolve, reject) => {
     execFile(process.execPath, [path.join(dir, script), flag],
       { cwd: cwd || process.cwd(), timeout: VERIFY_TIMEOUT_MS, env: SPAWN_ENV },

package/modules/grading/grade-engine.js

@@ -40,7 +40,7 @@
 // REPLAY. replayRecorded re-runs aggregate + gate over a grade's PERSISTED
 // per-judge signals — zero model calls. It is how a change to either stage is
 // proven against real recorded grades before it touches the live gate
-// (scripts/gds/grade-replay.js, tests/grade_engine_replay.mjs).
+// (scripts/bongos/grade-replay.js, tests/grade_engine_replay.mjs).
 
 'use strict';
 

package/modules/grading/grader-rubric.json

@@ -48,7 +48,7 @@
         "scores_reported": ["copy_score"],
         "gating": false,
         "verdict_rules": "NON-GATING (task 1003977, ADR 0298). Emits the single verdict 'advisory' on every path INCLUDING its own errors — computeVerdict has no branch returning pass/concerns/fail, so 'cannot block' is a property of the function, not a promise kept by callers. aggregatePanel additionally partitions it out of the gate (NON_GATING_WORKERS in grader-workers/index.js). Belt and braces: a filter is one refactor from being forgotten, a verdict is not. Stronger than the advisory treatment narc receives, which only downgrades a fail to manual-confirm — the reader cannot reach 'concerns' either. A 'blocker' severity is FLOORED to 'major' rather than dropped: the observation survives, the veto does not. Deliberately NO blocker escape hatch of the kind narc/hacker carry (grader.js isAdvisory, '... && !hasBlocker'), because that hatch is the exact hole the owner's term closes. An errored reader records NO copy_score rather than 0 — a 0 is a real reading, an outage is missing signal (the #943 distinction, per worker).",
-        "scope": "copy-bearing diffs ONLY. The caller (scripts/gds/ship-grade.js) asks hasCopyOrVisualWork(task) from modules/lifecycle/cascade.js and passes the answer to WORKERS.panelFor({ copyBearing }); the grading module may not require a sibling module (ADR 0083, CI-enforced), and a second predicate inside grading would let the at-ship lens and the after-the-fact artist review disagree about what they cover. Where false the panel is byte-identical to DEFAULT_PANEL and costs what it costs today, and the skip is recorded as signals.reader_skipped='not_copy_bearing' — never a silent absence, because a missing copy score must not read as a passing one.",
+        "scope": "copy-bearing diffs ONLY. The caller (scripts/bongos/ship-grade.js) asks hasCopyOrVisualWork(task) from modules/lifecycle/cascade.js and passes the answer to WORKERS.panelFor({ copyBearing }); the grading module may not require a sibling module (ADR 0083, CI-enforced), and a second predicate inside grading would let the at-ship lens and the after-the-fact artist review disagree about what they cover. Where false the panel is byte-identical to DEFAULT_PANEL and costs what it costs today, and the skip is recorded as signals.reader_skipped='not_copy_bearing' — never a silent absence, because a missing copy score must not read as a passing one.",
         "standard": "docs/voice.md (task 1003976), cited by rule id. Hard rules V1-V5 are checkable and may be ASSERTED as breaks; judgement rules V6-V11 may only be FLAGGED with the line quoted. A finding that cites no rule id is not a finding — the guide's own rule, carried into the prompt, and what keeps an advisory lens from recording taste as fact.",
         "prompt_lives_in": "modules/grading/grader-workers/reader.js"
       },

package/modules/grading/grader-score.js

@@ -289,7 +289,7 @@ function validateAndScore(rawSubagent, meta = {}) {
 // THE FINDING (SR-9 / SR-18): POST /api/bongos/tasks/:id/grade trusts the client.
 // validateAndScore only shape-validates the numbers — `passed` is computed from
 // the CLIENT's submitted scores. The real adversarial panel + the deterministic
-// route-rank / permission-path pre-passes run CLIENT-SIDE in scripts/gds/ship.js;
+// route-rank / permission-path pre-passes run CLIENT-SIDE in scripts/bongos/ship.js;
 // the server never re-runs them. So a builder can POST
 // {functional_fidelity:10, code_quality:10, confidence:1, issues:[]} to self-pass.
 // AND the credit/achievement side-effects (net-negative "Subtractor" bonus,

package/modules/grading/grader-workers/index.js

@@ -54,7 +54,7 @@ function isNonGatingKind(kind) { return NON_GATING_WORKERS.has(kind); }
 // grading cannot reach it. Writing a second predicate here is exactly what the
 // task forbids — the at-ship lens and the after-the-fact artist review must
 // never disagree about what they cover, and widening that set must widen both
-// at once. So the caller (scripts/gds/ship-grade.js, which is not a module and
+// at once. So the caller (scripts/bongos/ship-grade.js, which is not a module and
 // may require both) asks lifecycle and passes the answer down.
 //
 // Where it is false the panel is BYTE-IDENTICAL to today's and costs what it

package/modules/grading/grader.js

@@ -78,7 +78,7 @@
 // ## Retired (task 1002842)
 //
 //   The v1 deterministic process-audit grader (gradeDeterministic and its nine
-//   per-criterion scorers) and its one caller, scripts/gds/audit-ships.js, are
+//   per-criterion scorers) and its one caller, scripts/bongos/audit-ships.js, are
 //   deleted: the live panel grades every ship at ship time, so a retroactive
 //   heuristic audit has nothing left to cover. aggregateShots / runOneShot moved
 //   to grader-no-artifact.js, the species that depends on them; they are still

package/modules/grading/routes/grade.js

@@ -19,7 +19,7 @@
 // re-instantiation never trips the seam's single-provider duplicate guard.
 //
 // The 4-worker adversarial PANEL (grader.gradeSubagent) runs in the CLI/box
-// (scripts/gds/ship.js), not in-process — it posts its scored output to
+// (scripts/bongos/ship.js), not in-process — it posts its scored output to
 // POST /tasks/:id/grade, where the server-side guards re-run the deterministic
 // pre-passes. So the in-process port surface the lifecycle needs is the grader
 // module itself.

package/modules/hall-ui/public/atlas.html

@@ -23,12 +23,10 @@
   <div class="app-body">
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
-      <!-- task 1003307: the atlas shipped with no page head and no <h1> — the
-           map filled the column and the page had no name in the document. The
-           board's label voice gives it one without competing with the map. -->
+      <!-- The page's one h1, for screen readers: no page shows its head (task
+           1004836), so its eyebrow and sub-line went in task 1004828. -->
       <div class="page-head page-head--board">
         <h1 class="page-head__h">Repo atlas</h1>
-        <p class="page-head__sub">A daily-self-drawing map of the codebase: all the building blocks :)</p>
       </div>
 
       <main id="hall-main">
@@ -60,12 +58,12 @@
             </div>
             <div class="ab-empty" id="empty">
               <div class="empty-state ab-empty__state">
-                <p><b>The map is being drawn.</b> The atlas regenerates itself on the server every time code ships; Check back after the next deploy.</p>
+                <p><b>The map is being drawn.</b> It redraws itself each time code ships. Check back after the next deploy.</p>
               </div>
             </div>
           </div>
 
-          <p class="ab-hint ov-foot" id="hint">Hover an island to light its links, click one for its details, or open it from the index below.</p>
+          <p class="ab-hint ov-foot" id="hint">Hover an island to light its links. Click one, or pick it in the index below, for its details.</p>
           <div class="ab-legend" id="legend"></div>
 
           <!-- The island index (task 1003472): the same islands as rows. Closed
@@ -93,7 +91,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
+<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/atlas.js

@@ -1,6 +1,6 @@
 // atlas.js — the Repo Atlas renderer (ADR 0094, idea #457; restyled task 1737;
 // redesigned task 1003472). Reads the server-generated /builders/atlas.json
-// (produced by scripts/gds/gen-atlas.js on every deploy) and draws an
+// (produced by scripts/bongos/gen-atlas.js on every deploy) and draws an
 // isometric, hover-connective, click-for-detail map of the repository. Two
 // views: the .md/context layer and the module truth. Under the map, the ISLAND
 // INDEX renders the same nodes as rows a keyboard or a phone can open — the

package/modules/hall-ui/public/atlas.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "Repo atlas — the self-drawing module map. Its SEMANTIC node palette is fixed by ADR 0094 and is not the token tier's business; everything around it (the panel, the view switch, the caption, the detail card, the legend, the island index) is chrome and rides the world. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once; the redesign (task 1003472) added the `truth`, `detail` and `index` states. Populated look: the hall-preview harness serves modules/hall-ui/public/atlas.json when scripts/gds/gen-atlas.js has written it (the file is generated on deploy and gitignored, so run the generator first).",
+  "_": "Repo atlas — the self-drawing module map. Its SEMANTIC node palette is fixed by ADR 0094 and is not the token tier's business; everything around it (the panel, the view switch, the caption, the detail card, the legend, the island index) is chrome and rides the world. Written with the re-skin (task 1003307) so this page is MEASURED at three widths in both modes rather than looked at once; the redesign (task 1003472) added the `truth`, `detail` and `index` states. Populated look: the hall-preview harness serves modules/hall-ui/public/atlas.json when scripts/bongos/gen-atlas.js has written it (the file is generated on deploy and gitignored, so run the generator first).",
   "page": "/builders/atlas",
   "surface": "hall-ui",
   "stub": {

package/modules/hall-ui/public/blockers.css

@@ -0,0 +1,9 @@
+/* blockers.css — the Blockers page's own rules (task 1004824). The row shape
+   is oversight.css's, the reviewer card is hall-ask.css's; this sheet only
+   seats the plain "Link a task" control on the card's facts line, and keeps
+   the one-answer card from stretching its chip across the whole card. */
+.blockers-facts { display: flex; flex-wrap: wrap; align-items: center; gap: 4px 12px; }
+.blockers-facts__link { margin-left: auto; }
+@media (min-width: 761px) {
+  #blockers-list .hask__opts--row .hask__opt { flex: 0 1 20rem; }
+}

package/modules/hall-ui/public/blockers.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Blockers — {{worldName}}</title>
-  <meta name="description" content="What is stuck on the owner right now: open blockers and the work they hold up.">
+  <meta name="description" content="What needs the project owner right now, and the work it holds up.">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -13,6 +13,7 @@
   <!-- task 1003455: the row shape (title + facts) is the oversight family's,
        the same archetype collab/copy-desk/watch/gate already ride. -->
   <link rel="stylesheet" href="/builders/oversight.css">
+  <link rel="stylesheet" href="/builders/blockers.css">
 </head>
 <body data-page="blockers" data-page-title="Blockers">
 
@@ -24,7 +25,6 @@
     <div class="app-content">
       <div class="page-head page-head--board">
         <h1 class="page-head__h">Blockers</h1>
-        <p class="page-head__sub" id="blockers-sub">A credential, a purchase, a product call, etc. gated at the owner level. Any tasks awaiting the same block will unblock automatically on resolution.</p>
       </div>
 
       <main id="hall-main">
@@ -34,7 +34,7 @@
              builder) below the heading, and per-row Resolve/Link (blocker.review
              — metic+archon) rendered by blockers.js when the viewer holds it. -->
         <section class="scroll" id="blockers-scroll" aria-labelledby="blockers-h">
-          <h2 id="blockers-h" class="scroll__h">Open blockers<span class="count-pill" id="blockers-count" hidden></span></h2>
+          <h2 id="blockers-h" class="scroll__h">Requires project owner fix<span class="count-pill" id="blockers-count" hidden></span></h2>
           <div id="blockers-file-area"></div>
           <div id="blockers-body">
             <p class="profile__placeholder">Loading…</p>
@@ -53,7 +53,7 @@
      chrome exists before the page script runs. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
+<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/blockers.js

@@ -52,10 +52,6 @@
   var API = '/api/bongos';
   var body = document.getElementById('blockers-body');
   var countPill = document.getElementById('blockers-count');
-  var sub = document.getElementById('blockers-sub');
-  // The reason-for-blockers prose lives ONLY in blockers.html; JS restores what
-  // the markup shipped instead of carrying a second copy that can drift.
-  var baseSub = sub ? sub.textContent : '';
   var fileArea = document.getElementById('blockers-file-area');
 
   // The generated typed client (task-detail.js's own pattern), result-mode so
@@ -92,7 +88,7 @@
   // blocker.review floor, so it gets the specific message rather than
   // whatever (or nothing) the server's envelope happened to say.
   function reviewerRefusalMessage(err, fallback) {
-    if (err && err.status === 403) return 'You need Metic+ access to do that.';
+    if (err && err.status === 403) return 'You can’t resolve or link blockers here.';
     return refusalMessage(err, fallback);
   }
 
@@ -101,11 +97,14 @@
   };
   var blockerHref = function (id) { return '#/blocker/' + encodeURIComponent(id); };
 
-  // Which rank a reviewer action (Resolve / Link) needs — mirrors the server's
-  // blocker.review floor (metic+archon), cosmetically only; the server holds
-  // the actual gate regardless of what this variable says.
-  var viewer = { rank: null };
-  var isReviewer = function () { return viewer.rank === 'metic' || viewer.rank === 'archon'; };
+  // Who may Resolve / Link — the server's own gate is requirePermission(
+  // 'blocker.review'), which a project's government can grant below Metic or
+  // withhold above it, so the page reads the SAME atom off /me.permissions
+  // (task 1004824) rather than guessing from rank. Cosmetic only: the routes
+  // hold the wall. A missing or unreadable map hides the controls (null is
+  // "authority could not be established", never "holds everything").
+  var viewer = { mayReview: false };
+  var isReviewer = function () { return viewer.mayReview === true; };
 
   // Which row (if any) has an inline action form open, and which form.
   // { id, mode: 'resolve' | 'link' } | null — a row's OWN form, not a global
@@ -144,15 +143,17 @@
           + '</div><p class="td-action-note" data-err></p></form></div>';
       } else if (window.OTBAsk) {
         // task 1004820: a closed row a reviewer can act on is the city's ask card
+        // — for the one real decision, resolving it. Linking a task is
+        // bookkeeping, so it stays a plain control beside the facts (owner
+        // 2026-10-23: a card only where the page asks the reader to decide).
         return window.OTBAsk.html({
           attrs: { 'data-id': id },
-          where: 'Waiting on the project owner',
           q: b.title || ('Blocker ' + id), qHref: blockerHref(id),
-          saidHtml: facts.noteHtml + '<div class="ov-row__facts">' + facts.factsHtml + '</div>',
+          saidHtml: facts.noteHtml + '<div class="ov-row__facts blockers-facts">' + facts.factsHtml
+            + '<button type="button" class="btn-ghost blockers-facts__link" data-link-open="' + kit.esc(id) + '">Link a task</button></div>',
           row: true,
           opts: [
             { label: 'Resolve it', result: 'Say what settled it', rec: true, attrs: { 'data-resolve-open': id } },
-            { label: 'Link a task', result: 'Name the task it holds up', attrs: { 'data-link-open': id } },
           ],
         });
       } else {
@@ -197,7 +198,7 @@
   // flight at once; only the newest may paint (the profile activity-log idiom).
   var inFlight = 0;
   // The rows currently on screen — kept ONLY so a purely local state change
-  // (a row's action form opening/closing, the viewer's rank arriving) can
+  // (a row's action form opening/closing, the viewer's permission arriving) can
   // repaint without asking the server again. Never sliced or paged from here.
   var lastRows = [];
 
@@ -220,9 +221,6 @@
 
   function paintHeadline() {
     if (countPill) { countPill.textContent = String(state.total); countPill.hidden = state.total === 0; }
-    if (sub) {
-      sub.textContent = state.total ? baseSub : 'Nothing is stuck on the owner right now.';
-    }
   }
 
   function renderList(rows) {
@@ -230,12 +228,12 @@
     if (!listEl) return;
     listEl.innerHTML = rows.length
       ? rows.map(rowHtml).join('')
-      : kit.emptyStateHtml('Nothing is stuck on the owner right now.');
+      : kit.emptyStateHtml('Nothing needs the project owner right now.');
   }
 
   // Repaint the rows already on screen — no server call. Used when only local
   // UI state changed (a row's Resolve/Link form opened or closed, or the
-  // viewer's rank just arrived and rowHtml() needs to reconsider isReviewer()).
+  // viewer's permission just arrived and rowHtml() needs to reconsider isReviewer()).
   function rerender() { renderList(lastRows); }
 
   // Fetch the page the pager currently points at. `reclamped` guards against a
@@ -281,7 +279,7 @@
         pager.page = state.page;
         pager.perPage = state.perPage;
         if (!painted) {
-          notice('Couldn’t load the blocker queue right now.');
+          notice('Couldn’t load the blockers right now.');
           return;
         }
         renderPager();
@@ -313,13 +311,13 @@
 
   function fileFormHtml() {
     return '<div class="td-actions" id="blockers-file-toggle">'
-      + '<button type="button" class="btn-ghost" id="blockers-file-open">+ File blocker</button>'
+      + '<button type="button" class="btn-ghost" id="blockers-file-open">File a blocker</button>'
       + '</div>'
       + '<form class="td-form" id="blockers-file-form" hidden>'
       + '<label class="td-field td-field--wide"><span>Title</span>'
-      + '<input type="text" id="bf-title" maxlength="200" required placeholder="what needs the owner’s decision"></label>'
-      + '<label class="td-field td-field--wide"><span>What’s stuck (optional)</span>'
-      + '<input type="text" id="bf-note" maxlength="2000" placeholder="a sentence of context"></label>'
+      + '<input type="text" id="bf-title" maxlength="200" required placeholder="What the owner needs to settle"></label>'
+      + '<label class="td-field td-field--wide"><span>More detail (optional)</span>'
+      + '<input type="text" id="bf-note" maxlength="2000" placeholder="One sentence"></label>'
       + '<label class="td-field"><span>Blocking task # (optional)</span>'
       + '<input type="number" id="bf-task-id" min="1" placeholder="e.g. 1002980"></label>'
       + '<div class="td-actions">'
@@ -330,7 +328,7 @@
       // touches: filing succeeds regardless, but linking needs blocker.review,
       // and a viewer below it is told so BEFORE they submit — not left to
       // discover it from a refusal.
-      + (isReviewer() ? '' : '<p class="td-form-hint">Filing is open to anyone. Linking to a task needs Metic+ — if you name one and aren’t, the blocker still files and a Metic+ can link it.</p>')
+      + (isReviewer() ? '' : '<p class="td-form-hint">Anyone can file. If you can’t link tasks, it still files and a reviewer links it.</p>')
       + '</form>';
   }
 
@@ -378,7 +376,7 @@
           } catch (linkErr) {
             // Honest copy, not a silent no-op: the filing DID succeed, and the
             // reader is told exactly what still needs a Metic+.
-            toast('Blocker #' + blocker.id + ' filed. ' + reviewerRefusalMessage(linkErr, 'Could not link it to task #' + taskId + ' — a Metic+ can do that from this page.'));
+            toast('Blocker #' + blocker.id + ' filed. ' + reviewerRefusalMessage(linkErr, 'Could not link it to task #' + taskId + ' — a reviewer can link it from this page.'));
           }
         } else if (blocker) {
           toast('Blocker #' + blocker.id + ' filed.');
@@ -442,10 +440,11 @@
   async function loadViewer() {
     try {
       var res = await api.request('GET', API + '/me');
-      if (res.ok && res.data && res.data.builder) {
-        viewer = { rank: String(res.data.builder.rank || '').toLowerCase() };
+      var perms = res.ok && res.data ? res.data.permissions : null;
+      if (perms && typeof perms === 'object') {
+        viewer = { mayReview: perms['blocker.review'] === true };
       }
-    } catch (_) { /* signed out or offline — viewer stays { rank: null }, isReviewer() false */ }
+    } catch (_) { /* signed out or offline — viewer stays { mayReview: false }, isReviewer() false */ }
   }
 
   mountShell();
@@ -457,7 +456,7 @@
     // isReviewer() at RENDER time. If the queue rendered first (the common
     // case — /me is Metic+-gated work the server does more of), it rendered
     // with isReviewer() still false and nothing re-draws it once the real
-    // rank lands — a Metic/Archon would see no Resolve/Link buttons until an
+    // permission lands — a reviewer would see no Resolve/Link buttons until an
     // unrelated re-render (a pager click, a file, an otb:blocker-resolved).
     // Re-render now that the viewer is known, but only if a page has actually
     // painted yet (fetchPage may still be in flight — it will render