@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/seed-bv1-r01-delta-tasks.js

@@ -1,154 +0,0 @@
-// Seed + amend the delta the R01 spike (task 1002277, ADR 0171) surfaced, under
-// goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
-//
-// Source of truth: docs/adr/0171-profile-rollup-join-and-consent.md.
-// Three things happen here, all idempotent / convergent on re-run:
-//   1. Four NEW tasks (idempotent on source_ref bv1-r01-delta-D0N).
-//   2. Dependency rewires ADR 0171 decides (R03 gains R02; P09 gains P03).
-//   3. Amendment sections APPENDED to affected task bodies (guarded by a
-//      marker string so a re-run never double-appends).
-//
-// Run: node scripts/gds/seed-bv1-r01-delta-tasks.js
-
-const { apiCall } = require('./cli-lib');
-
-const VER = 'BONGOS-V1';
-const GOAL = 1000045;
-const SRC = 'planning-session';
-const ADR = 'docs/adr/0171-profile-rollup-join-and-consent.md';
-const MARK = '— ADR 0171 amendments (R01, 2026-08-15) —';
-
-// Existing tasks referenced by id (seeded by seed-bv1-profiles-tasks.js and
-// seed-bv1-profile-page-tasks.js).
-const R01 = 1002277, R02 = 1002278, R03 = 1002279, R04 = 1002280, R05 = 1002281,
-      R06 = 1002282, P02 = 1002798, P03 = 1002799, P07 = 1002803, P08 = 1002804,
-      P09 = 1002805, P01_HANDLE = 1002797, PRIVACY_SPIKE = 1002785;
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-// Throttled + 429-aware wrapper (same shape as the sibling seeders).
-async function api(method, path, body, _tries = 0) {
-  await sleep(1500);
-  const r = await apiCall(method, `/api/bongos${path}`, body);
-  if (r.status === 429 && _tries < 8) {
-    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
-    console.log(`  …rate-limited, waiting ${wait}s`);
-    await sleep(wait * 1000);
-    return api(method, path, body, _tries + 1);
-  }
-  return r;
-}
-
-const NEW_TASKS = [
-  {
-    ref: 'D01', kind: 'bug', prio: 4, est: 60, crit: [], deps: [], ready: true,
-    title: 'listScoutingRollup inflates totals: LATERAL unnest fans rows out before GROUP BY',
-    desc: `modules/platform-identity/platform-identity.js:426-445 — \`LEFT JOIN LATERAL unnest(a.disciplines) AS d ON true\` multiplies each activity row by max(1, cardinality(disciplines)) BEFORE aggregation, so project_count and the credits/ships/karma sums are inflated for any builder with 2+ disciplines on a project row (0/1-discipline rows are correct; max(last_active) and the disciplines array are unaffected — do not "fix" those). Live today on /people and /scouting. Fix: aggregate scalars over un-fanned rows; compute the disciplines union in a separate array_agg(DISTINCT …) over a pre-aggregated CTE/subquery. Testing, honestly: module tests are DB-free (scripts/gds/run-unit-tests.js gate) and the existing test only regex-matches SQL text — either extract the aggregation into an assertable SQL-builder shape, or add real-SQL coverage (pg-mem devDep or an integration DSN) as part of this task. getRollupForBuilder (task ${R02}) builds on the corrected shape. Found by R01; see ${ADR}.`,
-  },
-  {
-    ref: 'D02', kind: 'feature', prio: 4, est: 30, crit: [], deps: [], ready: true,
-    title: 'Reserve `u` as a top-level slug so project slugs cannot shadow builder profiles',
-    desc: `docs/specs/bongos-v1-seo-public-discoverability.md:19 reserves bongos/api/sso/gate/create/explore/builders/status/assets/.well-known/sitemap.xml/robots.txt/favicon.ico as top-level project slugs — but NOT \`u\`. A project could claim slug \`u\` and shadow the entire canonical builder-profile namespace /u/<handle> (profile-page spec Decision 1; ${ADR} D8). Add \`u\` to the reserved list in that spec AND wherever slug validation enforces it (coordinate with goal 1000048). While there, flag the future guild namespace for the same treatment in spike R23 (task 1002299) — reserve, don't squat.`,
-  },
-  {
-    ref: 'D03', kind: 'feature', prio: 3, est: 120, crit: [], deps: [P03],
-    title: 'Platform T&C page + acceptance capture at hub sign-in (the consent artifact ADR 0141 assumes)',
-    desc: `ADR 0141 defers cross-project-analytics consent to "the platform T&C" and conditioned un-gating the scouting rollup on it — but no T&C document, route, page, or acceptance record exists anywhere in the tree (the only reference is a comment at modules/platform-identity/routes/scouting.js:6). Goal 1000045 now makes the same data public by default (owner decision), which makes the artifact overdue: create the T&C page on the hub, record acceptance (timestamp on the platform account) at hub-session sign-in, and tie profile_state 'active' semantics to it once it exists (${ADR} D3). The T&C wording itself is an owner input — draft it, then file a blocker if the owner wants different wording. Depends on P03 (task ${P03}) so the consent boundary is decided before the artifact bakes it in.`,
-  },
-  {
-    ref: 'D04', kind: 'cleanup', prio: 4, est: 20, crit: ['C1', 'C2'], deps: [P03], rank: 'archon',
-    title: 'Amend C1/C2 criterion texts per ADR 0171 + the P03 outcome',
-    desc: `Apply the criterion amendments ${ADR} enumerates (decision payload carried in task ${P03}'s body): C1 — resolve "public by default for any builder with a platform account" per P03's outcome, and ADD the hub surface + its P05 mirror leak test ALONGSIDE the existing route/test references (those are correct and stay — the cross_project section lands on exactly GET /builders/:id/profile, guarded by tests/profile_route.mjs). C2 — "(builder-settings)" becomes "self-serve in hall Settings, stored account-global on the platform account"; "falls back to local-project data" is scoped to the instance render path (the hub has no local data); add the residual note that hide removes the hub AGGREGATE, not the per-instance public numbers it is derived from. Archon: the criteria live on scope-protected goal 1000045.`,
-  },
-];
-
-// Body amendments appended to existing tasks. Each entry: [id, text].
-const AMEND = [
-  [R02, `Build brief from ${ADR} (decisions D1-D7):
-(1) Migration platform_identity_007_profile_consent.sql: profile_state text NOT NULL DEFAULT 'provisional' CHECK (IN 'provisional','active') + hide_stats boolean NOT NULL DEFAULT false, on platform_identity_accounts. NO backfill joining core builders (type-unsafe: 'system:bfg'-style text ids vs bigint; boundary-violating: module migration reading core state). All existing accounts start provisional; a hub-session /sso/authorize lazily upgrades to active. Device-poll and check-in create provisional; /sso/activity/rollup creates NO account (orphan activity rows are never publicly addressable).
-(2) getRollupForBuilder(github_id) + the memberships-to-projects join (client_id -> sso_clients.origin -> projects.origin) with CORRECTED aggregation — no LATERAL-unnest fan-out (bug task {{D01}}).
-(3) listScoutingRollup gains the profile_state='active' AND NOT hide_stats predicate + a whitelisted projection: /people and /scouting must honor hide BY CONSTRUCTION (they are live cross-project surfaces at Metic floor today).
-(4) Register the declared-but-unwired 'platform-identity.hub' port (hasProvider-guarded, route-factory pattern; module.json already declares provides). Port: getPublicProfileExtras(githubId) -> null unless active AND not hidden, else {totals:{projects,credits,works_shipped,karma}, disciplines, last_active, projects:[{name,origin,rank_held}], more_projects} — whitelist-shaped INSIDE the module (client_id never crosses); guard non-numeric github_id -> null (never a bigint cast error). getOwnProfileExtras(githubId) serves the self view regardless of flags.
-(5) Core GET /builders/:id/profile resolves the port beside 'reward', attaches cross_project; Cache-Control: no-store when the port resolves (hide must beat the 60s cache), unchanged max-age=60 elsewhere. Project names only where the catalog row is public; others counted in more_projects, never named.
-(6) Harden POST /sso/activity/rollup BEFORE anything publishes: require an existing membership row for (client_id, github_id); validate rank against the four core rank keys (else null); disciplines: string elements only, cap count (<=8) and element length (<=32). Sequence check-in BEFORE rollup in src/bongos/auth.js (await the check-in) so the membership requirement cannot race a first sign-in.
-(7) Extend tests/profile_route.mjs: a second PUBLIC/PRIVATE key list scoped to cross_project + sentinel strings planted on the port-stub fixture (a client_id, a fake private project name) so the raw-text scan bites.`],
-  [R03, `The hide_stats column and the read-path enforcement land with R02 (task ${R02} — now a declared dependency). R03's residual scope: the WRITE path — an own-scoped PATCH route in platform-identity keyed by req.builder.github_id (validateOrRespond-validated, '// rank: any-builder'), the hall Settings toggle (P04's Profile rail group) and the profile-page self-toggle handoff to R04, plus verification that /people, /scouting, and the profile all drop the numbers live on toggle. Public responses stay viewer-independent; a builder inspects their own hidden stats via the own-scoped read (getOwnProfileExtras), not the public route. See ${ADR} D4.`],
-  [R04, `Per ${ADR}: the self hide-toggle renders CLIENT-SIDE only, after comparing the /me identity to the profile id — the profile response stays viewer-independent (single response shape keeps the leak test honest). Hidden -> render the "keeps their track record private" line and NOTHING derived from the rollup (no partial numbers — a count plus a hidden total is a leak by subtraction). Keep the instance rank badge (the platform-rank ban applies to the hub identity band only — profile-page spec Decision 1). Reserve layout slots for connections/guilds/actions (spec Decision 5). Hub profile API responses are no-store (ADR 0171 D5) — do not build UI caching assumptions on them.`],
-  [R05, `Retarget per ${ADR} D8 — the ?builder=<login> brief is superseded (github_login is mutable; profile-page spec Decision 3). R05 now delivers HANDLE-BASED LOOKUP: resolve <handle> -> platform account (case rules + the previous-handle 301 window from P01, task ${P01_HANDLE}) and the profile read the hub's canonical page consumes. The page itself is goal 1000048 R14 (task 1002365) — coordinate; exactly one page gets built. The numeric-id 301 and instance-side rel=canonical stay with P08 (task ${P08}).`],
-  [R06, `Proof additions from ${ADR}: assert the hide toggle takes effect on immediate reload (no-store — the old public,max-age=60 would fail this); assert /people and /scouting also drop the hidden builder (the read-path enforcement, not just the profile); assert the extended leak test (cross_project key lists + sentinels) goes red when a private field is planted. State the residual in the proof notes: hide removes the hub's AGGREGATED view — per-instance public leaderboards remain public by design.`],
-  [P02, `Addition from ${ADR}: upsertAccount (modules/platform-identity/platform-identity.js:104-117) overwrites display_name/avatar_url unconditionally on every check-in — a hub-edited display_name would be silently clobbered by the builder's next federated sign-in anywhere. Mirror the ADR 0156 source-tracked guard (user-set wins) for the hub account fields as part of this task.`],
-  [P03, `Reframe from ${ADR} (read before deciding): (1) The fail-closed mechanics ship with R02 regardless of this decision: profile_state DEFAULT 'provisional'; ONLY a hub-session /sso/authorize upgrades to 'active' (the SSO device flow never shows a hub page and mints no hub session — it creates provisional; so does check-in). Backfill: ALL existing accounts start provisional and lazily upgrade on their next hub-session authorize. So this decision can only ever WIDEN exposure — nothing needs clawing back. (2) ACCEPT = ratify that boundary (recommended; it narrows the Phase-4 interview's "no extra consent gate" to accounts whose consent premise actually holds). REJECT (= all accounts public, the interview decision verbatim) has a hard precondition: check-in/device-created identities have NO self-serve hide path today (no hub builder session exists for them; hub admission is invite-gated) — rejecting requires first building an assertion-authenticated hide path or opening hub enrollment. (3) The C1/C2 criterion text amendments ride task {{D04}} (dep on this one); the replacement texts are enumerated there and in the ADR. (4) The T&C artifact rides task {{D03}} (dep on this one).`],
-  [P07, `Addition from ${ADR}: the rollup fires only on federated sign-in today, so hub numbers can be months stale with no indicator. Add a ship-time push (lifecycle ship path -> reportActivityRollup) alongside the sign-in trigger, and SEQUENCE check-in before rollup (await the check-in) so the membership-row requirement R02 adds to /sso/activity/rollup cannot race a first sign-in.`],
-  [P08, `Amendment from ${ADR} D1 (this AMENDS profile-page spec Decision 1): federated non-hub instances LINK OUT instead of inlining a cross-project section in V1 — an instance-side copy is either stale-on-hide (breaks C2's "live everywhere") or a per-view hub call (rejected: always-on dependency); the canonical page is one click away. P08 now owns the federated render path: the visible "see the cross-project record" link + rel=canonical emission (needs a server-side hub-origin stamp token — clientBranding()/serve-internal.js carry no hub origin today, and goal 1000048 R13 flags this Metic+) + the numeric-id 301. Coordinate with goal 1000048 R13/R14.`],
-];
-
-(async () => {
-  const idByRef = {};
-  let created = 0, existing = 0;
-
-  console.log(`Seeding ${NEW_TASKS.length} delta tasks under goal ${GOAL} (${VER})…`);
-  for (const t of NEW_TASKS) {
-    const r = await api('POST', '/tasks', {
-      version_id: VER,
-      goal_id: GOAL,
-      title: t.title,
-      description: t.desc,
-      kind: t.kind,
-      discipline: 'engineer',
-      priority: t.prio,
-      est_minutes: t.est,
-      criterion_ids: t.crit,
-      source: SRC,
-      source_ref: `bv1-r01-delta-${t.ref}`,
-    });
-    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`); continue; }
-    const task = r.data.task || r.data;
-    idByRef[t.ref] = Number(task.id);
-    if (r.data.idempotent || r.data.existing) existing++; else created++;
-    console.log(`  ${t.ref} → task ${task.id} (${t.kind}, P${t.prio})`);
-  }
-
-  console.log('Wiring dependencies…');
-  const DEP_SETS = [
-    ...NEW_TASKS.filter((t) => t.deps.length).map((t) => [idByRef[t.ref], t.deps]),
-    [R03, [R01, R02]],                              // ADR 0171: column+enforcement land in R02
-    [P09, [P01_HANDLE, PRIVACY_SPIKE, P03]],        // spec said P09's shape waits on P03 — make the edge real
-  ];
-  for (const [id, deps] of DEP_SETS) {
-    if (!id) continue;
-    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: deps });
-    console.log(`  task ${id} depends on [${deps.join(', ')}]: ${r.ok ? 'ok' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
-  }
-
-  console.log('Setting requires_rank…');
-  for (const t of NEW_TASKS.filter((x) => x.rank)) {
-    const id = idByRef[t.ref];
-    if (!id) continue;
-    const r = await api('PATCH', `/tasks/${id}`, { requires_rank: t.rank });
-    console.log(`  ${t.ref}: requires_rank=${t.rank} ${r.ok ? 'ok' : 'FAILED ' + JSON.stringify(r.data).slice(0, 120)}`);
-  }
-
-  console.log('Appending ADR 0171 amendment sections…');
-  const sub = (s) => s.replace('{{D01}}', idByRef.D01 || '<D01>').replace('{{D03}}', idByRef.D03 || '<D03>').replace('{{D04}}', idByRef.D04 || '<D04>');
-  for (const [id, text] of AMEND) {
-    const g = await api('GET', `/tasks/${id}`);
-    if (!g.ok) { console.log(`  task ${id}: read FAILED ${g.status}`); continue; }
-    const task = g.data.task || g.data;
-    const body = task.description || '';
-    if (body.includes(MARK)) { console.log(`  task ${id}: already amended, skipping`); continue; }
-    const next = `${body}\n\n${MARK}\n${sub(text)}`;
-    const r = await api('PATCH', `/tasks/${id}`, { description: next });
-    console.log(`  task ${id}: ${r.ok ? 'amended' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
-  }
-
-  console.log('Promoting zero-dep roots to ready…');
-  for (const t of NEW_TASKS.filter((x) => x.ready)) {
-    const id = idByRef[t.ref];
-    if (!id) continue;
-    const r = await api('POST', `/tasks/${id}/promote`, {});
-    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
-  }
-
-  console.log(`\nDONE. created=${created} existing=${existing}.`);
-  console.log('ref→id:', JSON.stringify(idByRef));
-})();

package/scripts/gds/seed-bv2-tweak-mode-tasks.js

@@ -1,277 +0,0 @@
-// scripts/gds/seed-bv2-tweak-mode-tasks.js — seed the Tweak Mode chain into goal 1000095 (planning session, task 1004312)
-//
-// WHY. The 2026-09-27 planning session settled Tweak Mode — an artist takes a
-// whole page from the lofi studio, rewrites every word of it as one document
-// (or offline in Word and uploads it back), submits, and approves the applied
-// page before it ships — as a dependency CHAIN inside the existing
-// working-area-6 goal. Tweak Mode REPLACES the per-ship artist review (same
-// payouts), text only for now. Source of truth: docs/specs/bongos-v2-tweak-mode.md
-// (final); the approved screens: docs/design/mocks/tweak-mode/.
-//
-// Lands: one criterion, the scope widening the chain needs, the new tasks, the
-// rescope of 1003971 (1004238 merged into it), 1004078 merged into TW14, a
-// split-off backlog task for ARTIST MODE's photo half, and every edge.
-//
-// Idempotent: tasks on (source, source_ref) — a reused ref returns 200 with the
-// FIRST row, so a 200 whose title is not ours is reported, not trusted; the
-// criterion on criterion_id (409 = already seeded); scope is a set-union; edges
-// and criterion links are idempotent server-side; merge reports already_merged.
-//
-// Ends with verifySeedCriteriaLinks. The goal already carries other criteria, so
-// the expected counts are the goal's PRE-seed linked_tasks plus this seed's plan
-// (re-running after a full success therefore reports a mismatch on wa6-tweak-mode:
-// that is the plan being counted twice, not a mislink).
-//
-// Run: node scripts/gds/seed-bv2-tweak-mode-tasks.js [--dry-run]
-const os = require('os');
-const fs = require('fs');
-const path = require('path');
-const { verifySeedCriteriaLinks } = require('./seed-verify-criteria');
-// cliExit, never process.exit after a request: a hard exit mid-teardown aborts
-// natively on Windows + Node 24 and reports a false exit code (task 1002734).
-const { cliExit } = require('./cli-lib');
-
-function loadSession() {
-  const candidates = [
-    path.join(os.homedir(), '.config', 'cloudbongos', 'gds-session.json'),
-    path.join(os.homedir(), '.config', 'otb', 'gds-session.json'),
-  ];
-  for (const p of candidates) if (fs.existsSync(p)) return JSON.parse(fs.readFileSync(p, 'utf8'));
-  throw new Error('no Bongos session found — run /builder-setup');
-}
-const sess = loadSession();
-const BASE = (process.env.GDS_API_BASE || sess.api_base).replace(/\/$/, '');
-const H = { Authorization: `Bearer ${sess.token}`, 'Content-Type': 'application/json' };
-const DRY = process.argv.includes('--dry-run');
-
-const VER = 'BONGOS-V2';
-const GOAL = 1000095;
-const SRC = 'planning-session';
-const REF = 'bv2-tweak-mode';
-const CRIT = 'wa6-tweak-mode';
-const SPEC = 'docs/specs/bongos-v2-tweak-mode.md';
-const MOCKS = 'docs/design/mocks/tweak-mode/';
-const ARTIST_MODE = 1003971;   // rescoped into TW16
-const LOFI_PAGE = 1004238;     // merged into 1003971
-const STUDIO_COPY = 1004078;   // merged into TW14
-const SCOPE_ADD = ['copy-desk', 'ui-design', 'public-landing', 'status-ui', 'economy'];
-
-const CRITERION_MD = `**An artist can take any page of their project from untweaked to tweaked without leaving the studio or touching a terminal.**
-
-Today an artist's work arrives as one review task per ship and one flag per string, which cannot keep up with how much the project ships; most of it was abandoned unread. When this is true, the page is the unit of an artist's work, and it all happens from one calm place:
-
-- The studio is a lofi home with four doors: Resume, Tweak/CopyWrite Flow, Approval queue and Artist Review Status. The last three open in place as glass panels, and the studio's own words can be rewritten where they stand. The artist's credit tally sits in the corner.
-- Every page on every surface (landing, builders hall, status) has a tweak status with a count ("text tweaked 2x"), a changelog and a changed-since-last-tweak marker. Artist Review Status sums it per surface in three lines.
-- The Tweak/CopyWrite Flow recommends the next page (asked-for first, then changed, then untweaked) and lets the artist pick another; taking it claims the page for them alone.
-- The artist sees every word the rendered page shows as one document and types over it, or downloads it as a .docx, works offline, and uploads it back into the draft. The draft survives closing the tab. One submit, then "next up".
-- The applied page is rendered in the Approval queue, flipped between before and after with the changed words highlighted; nothing ships until the artist approves or sends it back with a note.
-- Text only: nothing structural can change, and shared text changes only on the page being tweaked unless it is literally the same UI element. Text the tool cannot place in the source goes to an engineer as its own task.
-- Tweak Mode replaces the per-ship artist review, and the artist is paid for an approved page what the reviews paid.
-- It works on any Bongos project.
-
-*Written 2026-09-27 by the area owner (planning session, task 1004312). Spec: ${SPEC}. Screens: ${MOCKS}.*`;
-
-const S = `Spec: ${SPEC} (Tweak Mode chain, goal 1000095). Prototype: ${MOCKS} (README maps each screen).`;
-// The prototype is the MASTER: screens are built 1:1 on it, and the proof is a
-// side-by-side, not a claim.
-const PIXEL = (board, part) => `\n\nPIXEL CONTRACT (1:1): ${MOCKS}${board}${part ? ` (${part})` : ''} is the master design, approved by the owner. Build it 1:1: the same layout, words, sizes, colours, glass and states. Before shipping, render the built page with modules/ui-design/kit at 1440 and 390 wide, in light and dark, and put each render beside the artboard with scripts/gds/review-sheet.js. Every difference is either fixed or listed in the ship notes with the gate or route that forced it. An unlisted difference is a defect.`;
-
-const TASKS = [
-  { ref: 'TW01', kind: 'infra', disc: 'engineer', prio: 5, est: 30, deps: [],
-    title: 'BV2.TW01 · Turn the artist gate off on the Cloud Bongos instance',
-    desc: `Owner decision 2026-09-27: the artist gate (ADR 0241) is off for now; approval of page tweaks moves into the studio's Approval queue (TW12).\n\nSet the Cloud Bongos instance's artistGate to 'off' through the provisioning settings path (modules/provisioning, the artistGate vocabulary key), not by hand-editing a host file. Record the before/after value on this task. Task 1004107 (the gate's contradiction) stays open for when the gate returns.\n\nDONE WHEN: the live instance reports artistGate 'off' and a deploy is no longer held by an unresolved artist review. ${S}` },
-  { ref: 'TW02', kind: 'feature', disc: 'engineer', prio: 5, est: 150, deps: [],
-    title: 'BV2.TW02 · Page inventory: every page of every surface gets a stable id',
-    desc: `The PAGE is Tweak Mode's unit, and pages are implicit today (body[data-page] in the hall, file names on landing and status). Generate an inventory: for each surface (builders hall, landing, status) every page with a stable id, title, live url, the files that render it, and its .states.json states where present. Portable: derived from the modules an instance has enabled. Freshness-checked like the copy registry (a --check the ship pipeline runs).\n\nDONE WHEN: the inventory lists every hall, landing and status page with stable ids and a --check fails on drift. ${S}` },
-  { ref: 'TW03', kind: 'feature', disc: 'engineer', prio: 5, est: 120, deps: ['TW02'],
-    title: 'BV2.TW03 · ADR: write down the page tweak model',
-    desc: `The owner has already made these decisions (spec, "Design decisions"); this task WRITES THEM DOWN as one ADR so every later task builds on the same model. It is not a design pass: where the spec is genuinely silent, file a blocker for the owner rather than choosing. The ADR records:\n- page status DERIVED from the ledger (approved, shipped tweak tasks per page id; text and ui counts), the changelog, drift ("changed since last tweak"), and the per-surface Artist Review Status sums;\n- one active tweak per page, the claim, page asks, and the recommendation order (asked-for, then changed, then untweaked);\n- the draft kept on the tweak task and the page-batch proposal (amends ADR 0233), with copy_no_cms.mjs staying green;\n- the .docx round trip: the file's shape, how an upload maps back to lines, and what an upload that changes structure is refused with;\n- the waiting-for-artist state and send-back;\n- REPLACING the artist-review-on-ship cascade (lifecycle/cascade.js), and paying an approved page what the reviews paid.\nConfirm or re-cut TW04–TW16 against it.\n\nDONE WHEN: the ADR is merged and TW04–TW16 match it. ${S}` },
-  { ref: 'TW04', kind: 'feature', disc: 'engineer', prio: 5, est: 240, deps: ['TW02'],
-    title: 'BV2.TW04 · Page reader: every string a rendered page shows',
-    desc: `The copy registry (docs/copy-registry.json) is keyed by FILE, includes comment text no one sees, and misses runtime-built and server-sent text. The page reader answers "what does this page actually show": render each inventory page in each state (scripts/hall-preview/server.js fixtures + modules/ui-design/kit; landing and status the same way) and list every visible string in page order, grouped by section. Map each to a registry entry (file + line), or mark it UNPLACED; mark shared-shell text (top bar, footer) as a SHARED ELEMENT.\n\nDONE WHEN: every inventory page has a reading with placed / unplaced / shared marked, and a test proves an unplaced string is listed, not dropped. ${S}` },
-  { ref: 'TW05', kind: 'feature', disc: 'engineer', prio: 5, est: 180, deps: ['TW03', 'TW04'],
-    title: 'BV2.TW05 · Page tweak status, Artist Review Status and the artist tally (the reads)',
-    desc: `Per TW03, derived from the ledger, no status table:\n- per page: status (Untweaked / Text tweaked / UI tweaked / Both), counts ("2x"), changelog (artist, date, lines, before/after), and changed-since-last-tweak lines;\n- per surface (Artist Review Status): "N of M tweaked";\n- per artist (the studio's corner tally): credits earned from page tweaks, pages tweaked, and this week's gain.\n\nDONE WHEN: all three reads are correct for a fixture with an untweaked page, a page tweaked twice, and a tweaked page whose text changed afterwards. ${S}` },
-  { ref: 'TW06', kind: 'feature', disc: 'engineer', prio: 5, est: 120, deps: ['TW03'],
-    title: 'BV2.TW06 · Claim a page, and ask for one',
-    desc: `A builder holding the Artist role claims a page's tweak in one call, which creates (or reuses) the page's tweak task and claims it for them; a second claim while one is held is refused and names the holder. Anyone can ask for a page with a one-line reason; asks feed the recommendation (TW07). The page ask replaces per-string flags as the main signal.\n\nDONE WHEN: an artist claims a page; a second artist is refused with the holder named; a non-artist can ask but not claim. ${S}` },
-  { ref: 'TW07', kind: 'feature', disc: 'engineer', prio: 5, est: 90, deps: ['TW05', 'TW06'],
-    title: 'BV2.TW07 · The Tweak/CopyWrite Flow: recommend the next page',
-    desc: `The chain the owner asked for: finish a page, get the next one. One read returns the recommended next page for this artist and why ("2 people asked for it"), plus a short list of alternatives for "pick another". Order per TW03: asked-for first, then changed since last tweak, then untweaked; never a page someone else holds. Taking it is TW06's claim.\n\nDONE WHEN: the recommendation follows the order on a fixture, skips held pages, and "take next" claims the recommended page in one call. ${S}` },
-  { ref: 'TW08', kind: 'feature', disc: 'engineer', prio: 5, est: 180, deps: ['TW03', 'TW04', 'TW06'],
-    title: 'BV2.TW08 · Page-batch proposal with a saved draft',
-    desc: `Extend the copy-desk proposal (ADR 0233, amended by TW03) from one occurrence to a whole page. The artist's draft saves onto the page's tweak task as they write; submit freezes it into the page-batch patch and queues it for /tweak. A rewrite of an UNPLACED line files its own engineer task carrying the wording and does not block the page. Targets resolve server-side from the page reading, never from the request body.\n\nDONE WHEN: draft save, submit and the unplaced split work end to end, and modules/copy-desk/tests/copy_no_cms.mjs stays green. ${S}` },
-  { ref: 'TW09', kind: 'feature', disc: 'engineer', prio: 5, est: 180, deps: ['TW08'],
-    title: 'BV2.TW09 · Work offline: download a page as .docx and upload it back',
-    desc: `Owner decision: an artist can download the page's words as a Word document, work offline, and upload it back into the draft. Download renders the page reading as a .docx (sections as headings, one paragraph per line, shared and engineer lines marked). Upload maps paragraphs back to lines per TW03 and merges them into the draft (never straight to the site). An upload that adds, drops or reorders lines is refused with a plain explanation of which lines moved. Cheapest viable library, no paid service.\n\nDONE WHEN: a round trip with edits lands those edits in the draft, and a structure-changing upload is refused by name. ${S}` },
-  { ref: 'TW10', kind: 'feature', disc: 'ui', prio: 5, est: 240, deps: ['TW04', 'TW06', 'TW08', 'TW09'],
-    title: 'BV2.TW10 · The tweak editor: the whole page as one document',
-    desc: `The artist's own flow, not Claude's. Over the dimmed studio: a glass top bar (back to studio, page name, lines rewritten + saved, open the page in a new tab, download .docx, upload .docx, submit page) and one paper document holding every word of the page in page order, typed over in place, autosaving (TW08). A changed line carries a small accent mark and a faint "was:"; shared and engineer lines carry a margin note. Submit opens "<page> is in" with the next recommended page (TW07): take next, pick another, back to the studio. No terminal anywhere; /design floors apply.\n\nDONE WHEN: an artist rewrites a page, closes the tab, returns to the draft, round-trips it through Word, submits, and takes the next page, at desktop and phone width in light and dark. ${S}${PIXEL('Editor.dc.html')}` },
-  { ref: 'TW11', kind: 'feature', disc: 'engineer', prio: 5, est: 240, deps: ['TW08'],
-    title: 'BV2.TW11 · /tweak skill + batch applier',
-    desc: `A new skill, /tweak: a builder or agent session takes the next submitted page, claims it, and applies every line via scripts/gds/copy-apply.js in a new --batch mode (keeps \${expr} holes; names each refusal). It renders the applied page before and after (desktop + phone, light + dark) through the ui-design kit, attaches both to the task, and parks it at waiting-for-artist (TW03). It never ships without the artist's approval (TW12).\n\nDONE WHEN: /tweak applies a multi-line page batch, attaches the renders and parks; a refused line is named, not skipped. ${S}` },
-  { ref: 'TW12', kind: 'feature', disc: 'ui', prio: 5, est: 180, deps: ['TW11'],
-    title: 'BV2.TW12 · The Approval queue: the applied page, rendered, before and after',
-    desc: `A glass panel opened from the studio. It shows the applied page ITSELF, rendered with its new words (not a list of strings), with a before/after switch, the changed words highlighted, and the queue position ("1 of 2"). Approve and ship (the ship proceeds, the page's count goes up, the next page in the queue is named), or send it back with a one-line note (it returns to the tweak queue). Added to the studio's WRITE_ROUTES allowlist; still no live string write.\n\nDONE WHEN: approve ships the page and advances its status; send-back re-queues it with the note; both from the studio with no terminal. ${S}${PIXEL('Main.dc.html', 'its Approval queue panel')}` },
-  { ref: 'TW13', kind: 'feature', disc: 'engineer', prio: 4, est: 150, deps: ['TW03', 'TW11'],
-    title: 'BV2.TW13 · Pay the artist for an approved page, as the artist reviews paid',
-    desc: `Owner decision: Tweak Mode replaces the per-ship artist review with the same payouts. On an approved page tweak's ship, the artist who wrote it is paid what completing the replaced artist review paid them; the applying session keeps its normal build reward. Payees resolved server-side from the task (the ADR 0185 pattern in modules/economy/credits.js), never from the caller; a self-applied tweak is one payee; the total is conserved. Feeds the studio tally (TW05).\n\nDONE WHEN: a shipped page tweak pays the artist and the applier as above, with tests for the self-applied and rounding cases. ${S}` },
-  { ref: 'TW14', kind: 'refactor', disc: 'engineer', prio: 4, est: 150, deps: ['TW05'],
-    title: 'BV2.TW14 · Tweak Mode replaces the per-ship artist review',
-    desc: `The artist-review-on-ship cascade (modules/lifecycle/cascade.js) files one task per ship; 34 of the 39 it filed were abandoned, 33 with no note. Per TW03: a ship that changes a page's words no longer files a review task. It marks that page "changed since last tweak", which raises it in the Tweak/CopyWrite Flow and shows in Artist Review Status. Task 1004078 (the studio's review card never showing the copy) is merged into this one: with no per-ship review cards, it has nothing left to fix.\n\nDONE WHEN: a ship changing a page's text files no artist review and the page reads changed-since; the cascade's tests are updated to the new rule. ${S}` },
-  { ref: 'TW15', kind: 'cleanup', disc: 'ui', prio: 3, est: 60, deps: ['TW16'],
-    title: 'BV2.TW15 · Archive the Copy desk and Ideas tabs',
-    desc: `Owner decision 2026-09-27: the Copy desk and the Ideas board come off the hall's tab groups. ARCHIVED, not deleted: remove both entries from the nav (modules/hall-ui/public/shell.js), keep the pages and routes reachable by link so old bookmarks and links still land, and delete no data. Ideas are still filed from Your thinking (its filing form covers quick and Full Ideas); artist work lives in the studio (TW16). Update the page-gate map and any test that pins the nav list.\n\nDONE WHEN: neither tab shows in the nav, both URLs still load, and the hall tests are green. ${S}` },
-  { ref: 'TW20', kind: 'feature', disc: 'ui', prio: 5, est: 180, deps: [],
-    title: 'BV2.TW20 · The studio and Your thinking sit in the hall, with a full-screen switch',
-    desc: `Owner decision 2026-09-27: the Studio (/studio) and Your thinking (/thinking) join the normal hall chrome, the sidebar and the top bar, like every other hall page. Your thinking deliberately carries none today (its header comment says so). Each page gets one button that goes FULL SCREEN, hiding the sidebar and top bar so the page fills the window (the prototype's studio is what full screen looks like), and a button in full screen to come back. Shared, not per page: one switch in shell.js that any page can opt into, remembered per page in localStorage (try/catch), reachable by keyboard, with Esc leaving full screen. Both pages must still pass the kit floors in both states (header, main, 24px targets, reduced motion).\n\nDONE WHEN: both pages render inside the hall chrome, the switch hides and restores it, the choice survives a reload, and the kit floors pass in both states at 1440 and 390, light and dark. ${S}` },
-  { ref: 'TW21', kind: 'refactor', disc: 'ui', prio: 4, est: 150, deps: ['TW20'],
-    title: 'BV2.TW21 · Your thinking is only your thinking; the project views live on the project map',
-    desc: `Owner decision 2026-09-27. Today /thinking and /goal-map are one sky with a lens switcher ("simple", "your thinking", "the whole project"); "the whole project" hands off to /goal-map, and "my ideas" lays your thoughts over the project map. Disconnect them. /thinking keeps only YOUR thinking and its own tools. The whole-project views and features, including the "the whole project" lens and the "my ideas" overlay, live only on the goals/project map page (/goal-map), which stops offering "your thinking" as a lens. Keep the shared sky-*.js code shared where it is only drawing. It is the lens and the features that separate, not the renderer.\n\nCONFIRMED BY THE OWNER (2026-09-27): "the your projects tab" means the whole-project lens, the "the whole project" switch and the project-map features on Your thinking. They move to the goals/project map page only.\n\nDONE WHEN: /thinking shows no whole-project lens or project-map features, /goal-map holds them all, neither links to the other as a lens, and the sky tests are updated to the split. ${S}` },
-  { ref: 'TW17', kind: 'feature', disc: 'engineer', prio: 2, est: 60, deps: ['TW16'],
-    title: 'BV2.TW17 · The artist pack teaches Tweak Mode',
-    desc: `docs/packs/artist.md leads with the studio: Resume, the Tweak/CopyWrite Flow, the editor and the Word round trip, the Approval queue. The per-ship review and the copy-desk flag flow are gone from the artist's loop. Keep the pack inside its CI budget.\n\nDONE WHEN: an artist session reading only the pack can take a page through Tweak Mode. ${S}` },
-  { ref: 'TW18', kind: 'verify', disc: 'artist', prio: 4, est: 90, deps: ['TW09', 'TW10', 'TW12', 'TW13', 'TW16'],
-    title: 'BV2.TW18 · Proof: an artist tweaks a landing page and a hall page end to end',
-    desc: `The live demonstration that wa6-tweak-mode holds. A non-technical artist, with no terminal, from the studio: takes a landing page from the Tweak/CopyWrite Flow and rewrites it in the editor, takes next and rewrites a hall page offline in Word and uploads it; a session runs /tweak; the artist approves both in the Approval queue. Both pages then read "text tweaked 1x", Artist Review Status moves, and the tally shows the payout.\n\nDONE WHEN: the above happens on the live instance and is recorded (screens + the two shipped tasks) on this task. ${S}` },
-  { ref: 'TW19', kind: 'spike', disc: 'engineer', prio: 2, est: 120, deps: ['TW18'],
-    title: 'BV2.TW19 · Auto-pickup: an agent takes submitted tweaks with no session started',
-    desc: `"Queue now, auto later" (owner, 2026-09-27). Today agents fire only on task.shipped and may only report (modules/agents/CLAUDE.md, the event path), and the autonomy runner is off. Design an agent that claims and applies a submitted page on its own: the trigger, who pays (spend caps), the loop guard, the rank it runs at. Output: an ADR plus the tasks to build it.\n\nDONE WHEN: the ADR is written and its build tasks are filed in this goal. ${S}` },
-];
-
-// Existing task folded into the chain at TW16.
-const TW16_TITLE = 'BV2.TW16 · ARTIST MODE: the lofi studio home, with Tweak Mode as its four doors';
-const TW16_DESC = `RESCOPED 2026-09-27 (planning session, task 1004312; spec ${SPEC}). Task 1004238 ("the artist page is simple and lofi") is merged into this one. The photo-to-asset half split out to its own backlog task, because the core has no image path yet (see the correction in the original text below).
-
-**Now:** the Studio (/builders/studio) becomes a lofi home an artist wants to be in. The owner likes the prototype's lofi design for now: a night window, a lamp and a desk, over the project's Chrome World tokens. On it:
-- the studio's own words are editable in place (that edit is itself a tweak of the studio page, through TW08);
-- the artist's tally in the top right: credits, pages tweaked, this week (TW05);
-- **Resume** goes back into the page the artist holds (TW10);
-- three quick actions open glass panels in place, so the artist never flips pages: **Tweak/CopyWrite Flow** (TW07), **Approval queue** (TW12) and **Artist Review Status** (TW05's three surface lines).
-The old review/flag queue on this page goes: Tweak Mode replaces it (TW14).
-
-DONE WHEN: an artist opening the studio can do all of Tweak Mode from it, approved by the owner at desktop and phone width in light and dark.${PIXEL('Main.dc.html')}
-
----
-ORIGINAL DESCRIPTION (kept for provenance):
-
-`;
-
-const PHOTO_TASK = {
-  kind: 'feature', disc: 'artist', prio: 2, est: 240,
-  title: 'ARTIST MODE part 2: from a photo of physical work to a usable asset',
-  desc: `Split from task 1003971 at the 2026-09-27 planning session (task 1004312). An artist uploads photos of physical work and digitises them into whatever they are meant for, keeping their personal style continuous with the project's design rules.\n\nBlocked in substance: the core has no image-generation path (modules/art-pipeline is excluded from the published core). First decide between bringing an image path into the core cleanly (its own ADR) or scoping to the parts that need no model. See 1003971's original description.\n\nNot part of the Tweak Mode chain.`,
-};
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-let dryId = 0;
-async function api(method, p, body, tries = 0) {
-  if (DRY && method !== 'GET') {
-    console.log(`  [dry] ${method} ${p}`);
-    return { ok: true, status: 0, json: { task: { id: `dry${++dryId}`, title: body && body.title } } };
-  }
-  await sleep(400);
-  const res = await fetch(`${BASE}/api/bongos${p}`, { method, headers: H, body: body ? JSON.stringify(body) : undefined });
-  const text = await res.text();
-  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
-  if (res.status === 429 && tries < 8) {
-    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
-    console.log(`  …rate-limited, waiting ${wait}s`);
-    await sleep(wait * 1000);
-    return api(method, p, body, tries + 1);
-  }
-  return { status: res.status, ok: res.ok, json };
-}
-const note = (r) => JSON.stringify(r.json).slice(0, 200);
-
-(async () => {
-  let failed = 0;
-  const pre = await api('GET', `/goals/${GOAL}`);
-  if (!pre.ok) { console.log(`cannot read goal ${GOAL}: ${pre.status}`); cliExit(1); return; }
-  const baseline = {};
-  for (const c of pre.json.criteria || []) baseline[c.criterion_id] = Number(c.linked_tasks) || 0;
-
-  console.log('Criterion…');
-  const c = await api('POST', `/versions/${VER}/done-when`, { criterion_id: CRIT, criterion_md: CRITERION_MD, goal_id: GOAL });
-  console.log(`  ${CRIT}: ${c.ok ? 'created' : c.status === 409 ? 'already seeded' : 'FAILED ' + note(c)}`);
-  if (!c.ok && c.status !== 409) { cliExit(1); return; }
-
-  console.log('Scope…');
-  const sc = await api('POST', `/goals/${GOAL}/scope`, { add: SCOPE_ADD });
-  console.log(`  +${SCOPE_ADD.join(', ')}: ${sc.ok ? 'ok' : 'FAILED ' + note(sc)}`);
-  if (!sc.ok) failed++;
-
-  console.log(`Tasks (${TASKS.length})…`);
-  const idByRef = { TW16: ARTIST_MODE };
-  const plan = [];
-  for (const t of TASKS) {
-    const r = await api('POST', '/tasks', {
-      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc, kind: t.kind,
-      discipline: t.disc, priority: t.prio, est_minutes: t.est, criterion_ids: [CRIT],
-      source: SRC, source_ref: `${REF}-${t.ref}`,
-    });
-    const task = r.json.task || r.json;
-    if (!r.ok || !task.id) { console.log(`  ${t.ref}: FAILED ${r.status} ${note(r)}`); failed++; continue; }
-    if (!DRY && task.title !== t.title) { console.log(`  ${t.ref}: source_ref collision — got task ${task.id} "${task.title}"`); failed++; continue; }
-    idByRef[t.ref] = task.id;
-    plan.push([CRIT]);
-    console.log(`  ${t.ref} → task ${task.id} (${r.status})`);
-  }
-
-  console.log('Existing tasks…');
-  const am = await api('GET', `/tasks/${ARTIST_MODE}`);
-  const amTask = am.json.task || am.json;
-  if (!String(amTask.title || '').startsWith('BV2.TW16')) {
-    const r = await api('PATCH', `/tasks/${ARTIST_MODE}`, { title: TW16_TITLE, description: TW16_DESC + (amTask.description || ''), priority: 4 });
-    console.log(`  1003971 rescoped: ${r.ok ? 'ok' : 'FAILED ' + note(r)}`); if (!r.ok) failed++;
-  } else console.log('  1003971 already rescoped');
-  const link = await api('POST', `/tasks/${ARTIST_MODE}/criteria`, { criterion_ids: [CRIT] });
-  console.log(`  1003971 → ${CRIT}: ${link.ok ? 'linked' : 'FAILED ' + note(link)}`);
-  if (link.ok) plan.push([CRIT]); else failed++;
-  for (const [from, into, why] of [
-    [LOFI_PAGE, ARTIST_MODE, 'Merged into 1003971 at the Tweak Mode planning session (task 1004312): the lofi artist page IS the rescoped ARTIST MODE studio home.'],
-    [STUDIO_COPY, idByRef.TW14, 'Merged into BV2.TW14 at the Tweak Mode planning session (task 1004312): Tweak Mode replaces the per-ship artist review, so there are no review cards left whose copy needs showing.'],
-  ]) {
-    if (!into) { console.log(`  ${from}: merge target missing`); failed++; continue; }
-    const mg = await api('POST', `/tasks/${from}/merge`, { into_task_id: Number(into) || into, reason: why });
-    console.log(`  ${from} merged into ${into}: ${mg.ok ? 'ok' : mg.status === 409 ? 'already merged' : 'FAILED ' + note(mg)}`);
-    if (!mg.ok && mg.status !== 409) failed++;
-  }
-
-  console.log('Dependencies…');
-  const EDGES = [...TASKS.map((t) => [t.ref, t.deps]), ['TW16', ['TW05', 'TW07', 'TW10', 'TW12', 'TW20']]];
-  for (const [ref, deps] of EDGES) {
-    if (!deps.length) continue;
-    const id = idByRef[ref];
-    const depIds = deps.map((d) => idByRef[d]).filter(Boolean);
-    if (!id || depIds.length !== deps.length) { console.log(`  ${ref}: dep resolve gap`); failed++; continue; }
-    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
-    console.log(`  ${ref} ← ${deps.join(', ')}: ${r.ok ? 'ok' : 'FAILED ' + note(r)}`); if (!r.ok) failed++;
-  }
-
-  console.log('Split-off task…');
-  const ph = await api('POST', '/tasks', {
-    version_id: VER, goal_id: GOAL, title: PHOTO_TASK.title, description: PHOTO_TASK.desc, kind: PHOTO_TASK.kind,
-    discipline: PHOTO_TASK.disc, priority: PHOTO_TASK.prio, est_minutes: PHOTO_TASK.est,
-    source: SRC, source_ref: `${REF}-photo-split`,
-  });
-  console.log(`  photo half → ${ph.ok ? 'task ' + (ph.json.task || ph.json).id : 'FAILED ' + note(ph)}`); if (!ph.ok) failed++;
-
-  console.log('Opening the zero-dep layer…');
-  for (const ref of ['TW01', 'TW02', 'TW20']) {
-    const id = idByRef[ref]; if (!id) continue;
-    const r = await api('POST', `/tasks/${id}/promote`, {});
-    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'note ' + note(r)}`);
-  }
-
-  console.log('\nref→id:', JSON.stringify(idByRef));
-  if (DRY) return;
-  const expected = { ...baseline };
-  for (const ids of plan) for (const s of ids) expected[s] = (expected[s] || 0) + 1;
-  // A merge abandons its task, and 1004078 was linked to other criteria on this
-  // goal; if the goal's linked_tasks counts only live tasks, that criterion drops
-  // by one. Report it rather than fail on it.
-  await verifySeedCriteriaLinks({ goalId: GOAL, expectedCounts: expected, fetchGoal: (id) => api('GET', `/goals/${id}`),
-    exit: (code) => { if (code) console.log('(check the mismatch above: a drop of 1 on a criterion 1004078 or 1004238 was linked to is the merge, not a mislink)'); failed += code ? 1 : 0; } });
-  if (failed) { console.log(`${failed} step(s) FAILED — see above.`); cliExit(1); }
-})();