@bongos/core 1.21.85 → 1.21.87

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.85",
-  "core_contract": "1.21.85",
-  "source_commit": "8a47b19700478214f214b9df7bbfc4cd5ed93958",
+  "core_version": "1.21.87",
+  "core_contract": "1.21.87",
+  "source_commit": "3a000da66e4b7ed910b59eb0e1843e81a7e3f7fd",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T04:31:08.324Z",
+  "built_at": "2026-10-09T05:06:35.756Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 590,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2997,
+    "functional_verbatim": 3000,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3616,
-  "tree_sha256": "22dc94ef353678e33bf64bb41ca709aa63dc8f29cc4bebcd10a09a84f2dc32c9",
+  "file_count": 3619,
+  "tree_sha256": "94cb33a270055b9c3e008a1a26ad2e66038572aae76148fccb2f9b3bf2bbecf9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2327,7 +2327,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "5236bf63df238c4b93e515a9982e76e0908382d049bf38035b5bda2a3ceda11b"
+      "sha256": "0dac6b0ee55d7836cf6352c695f592000bfd61d0c3ec06d9c17d37b476b1134a"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2432,7 +2432,7 @@
     {
       "path": "docs/design/project-startup-direction.md",
       "mode": "0000644",
-      "sha256": "8b95dbb81af5cad9a85d3ffe9532d60391329cc957d5c79327e187bbfb3551de"
+      "sha256": "8cac194bfa4e7e0cfa6785ff72fd141980eb2abed6497ce56e42585c2f4a918c"
     },
     {
       "path": "docs/design/projects-hub-direction-v2.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cbcee180651b88158a4cc173e12c3f73ee842743bcaf9e13629d5ef96ee26e56"
+      "sha256": "39126044930a9015689ba736100232d99d1d13d43d723ec95a15dbe505c4390d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10097,12 +10097,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2784cf3cf476fda15614a347da7e556824a63f50a49cbb74323ceeec704c4b8e"
+      "sha256": "6953a80922eac656bc533d17e921f49228e939cacb64da8e56d1a90fa5f358db"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8fe03b497ac409587e5ded79331fb0ff035d19052cb7c575daf50f07fe8439ee"
+      "sha256": "be88b7b575574dc07cbf071c639c419a4365cd89e7ed0b7bba058de98982b443"
     },
     {
       "path": "public-docs/index.html",
@@ -10122,7 +10122,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "24198ec47220ec2534ed8d6bf187965bf03d9044831ac3eaa50fd45ea141959d"
+      "sha256": "ba7ae503bc8f34ef8244b2fb989462283e4128b6ea03ac066d050acfb35edbc5"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11734,10 +11734,15 @@
       "mode": "0000644",
       "sha256": "9f6ce80e5325f4cfe68cfa6cb82bec52d594af7e461b6734724819b23cbb0d37"
     },
+    {
+      "path": "scripts/gds/start-goals.js",
+      "mode": "0000644",
+      "sha256": "8c4e1f1c7871c82b0fefd5402c93888831543dcd776a1e761e7b1238b3afafaa"
+    },
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "4bc438bb7859c7a405088b2e386b33fb550532a71dbe66866d711e5b1d4b3e69"
+      "sha256": "181f07b8d62f03ae001d08dd5e5b15a65b33f512fb548e55401b97f7f484f31f"
     },
     {
       "path": "scripts/gds/status.js",
@@ -12137,7 +12142,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "373a0ff03c6644ea622ff859edfe9003fcfa94ea7eb5ca937059865c3eeb317f"
+      "sha256": "c45fffd2d1320cfadd2177421e8b58643676a71fa1bac7a01e4219c60bfe20b1"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -12292,7 +12297,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "469a276bc6293c5148288021775d9d5ceca6b81e452533f02e36fbd9e71702dd"
+      "sha256": "aea0a0f28621500bee51e4fec8e794139cf90c3360fdc55caecbbd5a5fc82b69"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -12372,7 +12377,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "901e1e5ef994837bd4ae48f226af1cd104c34a0dd993383c7980eca13bc61d2f"
+      "sha256": "3ba47cbdc5c1c0dc86af2cf1302a6ffc3c9966a7646f88bd2a004f5dd67b0ded"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15754,6 +15759,11 @@
       "mode": "0000644",
       "sha256": "43828c1a95652180d558e7676cc2053d0599a61c0edf4cd1ab100820fc7de493"
     },
+    {
+      "path": "tests/module_store_instance_root.mjs",
+      "mode": "0000644",
+      "sha256": "aa66cdb054eeaef8c3c8babf5238f029d13b668a45a97230efe5f8cfa8908d48"
+    },
     {
       "path": "tests/module_store_listing.mjs",
       "mode": "0000644",
@@ -17524,6 +17534,11 @@
       "mode": "0000644",
       "sha256": "39e62a5fc50113e719cdaacf15e6fd054f38f8703fc64137eddee7901b374f16"
     },
+    {
+      "path": "tests/start_goal_first.mjs",
+      "mode": "0000644",
+      "sha256": "a3addba1547bf0a9ce95f5d6c2ea676f63495669154e2f4c161cb8cc543b30bf"
+    },
     {
       "path": "tests/start_inbox_count.mjs",
       "mode": "0000644",

package/docs/architecture.md

@@ -291,7 +291,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Own-scoped session self-service ([ADR 0206](adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md), task 1003341), in [`src/bongos/routes/my-sessions.js`](../src/bongos/routes/my-sessions.js): `GET /me/sessions` (every live session on the caller's own account — source, user agent, created/last-used/expires, a `current` flag; the token value is never selected), `POST /me/sessions/revoke` (`{session_id}` — one of your own; a miss answers `revoked: 0` so a stranger's id cannot be probed) and `POST /me/sessions/revoke-all` (sign out everywhere, the requesting session included). All three gate on `requireBuilder` alone and key every statement on `req.builder.id` — an account is never named in the query, body or path. They exist because a bearer refreshes to `now()+24h` on every call, so a leaked one never expires, and the cross-builder pair (`POST /auth/revoke`, `/auth/revoke-all`, both still gated on the admin `auth.session.revoke` atom) needed an Archon the victim might not have. Surfaced in the hall at Settings → Active sessions.
 - Authenticated CLI/web: `GET /me` (returns `rank`), `GET /versions[/progress]`, `GET /tasks[?version=&status=&kind=&discipline=]`, `GET /tasks/claimable[?version=&discipline=]`, `GET /tasks/:id`, `POST /tasks` (accepts `discipline` + `criterion_ids`; **metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)), `PATCH /tasks/:id` (supports `parent_task_id`, `kind`, `discipline`, `goal_id` — (re)assign the task's goal; must be a goal in the task's own version, task 1763; **metic+**), `POST /tasks/:id/promote` (**metic+**), `POST /claims`, `POST /claims/:id/resolve`, `POST /cost`.
 - Criterion rollup + task↔criterion links ([ADR 0025](adr/0025-structured-criterion-task-link.md), [#435](https://example.com/builders#/task/435)/[#438](https://example.com/builders#/task/438)): `GET /versions/:id/progress` rolls up each done-when criterion → its gating tasks (via `task_criteria`) → live status counts + the not-yet-shipped `remaining[]` + `unattributed_tasks` (the read behind the `/status` skill, in `src/bongos/done-when.js criterionProgress`). The link CRUD mirrors the dependency endpoints: `GET /tasks/:id/criteria`, `POST /tasks/:id/criteria` (**metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)) and `DELETE /tasks/:id/criteria/:criterionId` (**metic+**). A criterion ref is a numeric `done_when_criteria.id`, a positional `"Cn"` token, or a `criterion_id` slug, resolved against the task's version (`POST /tasks` links at create time so `/status` counts the task with no backfill).
-- Module store publish (ADR 0338 D1, task 1004271): `POST /store/modules/:key/versions` (`requireBuilder` + `requirePermission('module.submit')`, Metic floor). The body is the raw gzip tarball `bongos module publish` builds (own `express.raw` parser, 5 MB cap; 16 MB / 2000 files unpacked). `scripts/gds/module-artifact.js` re-verifies every hash and the publish gate, then `src/bongos/module-store.js` keeps the file under `var/module-store/` and inserts the `store_module_versions` row in one transaction. The first publish makes the caller the author; later versions are author-only, newer than the last and never overwritten; a delisted key takes none.
+- Module store publish (ADR 0338 D1, task 1004271): `POST /store/modules/:key/versions` (`requireBuilder` + `requirePermission('module.submit')`, Metic floor). The body is the raw gzip tarball `bongos module publish` builds (own `express.raw` parser, 5 MB cap; 16 MB / 2000 files unpacked). `scripts/gds/module-artifact.js` re-verifies every hash and the publish gate, then `src/bongos/module-store.js` keeps the file under the INSTANCE root's `var/module-store/` (`MODULE_STORE_DIR` overrides; never inside the installed core package, which every upgrade replaces, and a boot move carries files from that old path, task 1004399) and inserts the `store_module_versions` row in one transaction. The first publish makes the caller the author; later versions are author-only, newer than the last and never overwritten; a delisted key takes none.
 - Module store install (ADR 0338 D1, task 1003785), all `requireBuilder` and own-scoped (the holder is the caller): `POST /store/modules/:key/acquire` (`{version?}`; grants a free entitlement — no price row, or a zero price, is free — or `402 payment_required` for a priced module; refuses a delisted one), `GET /store/modules/:key/versions/:version/tarball` (served only to a live entitlement holder; `X-Tarball-Sha256`), `POST /store/modules/:key/acquired` (`{version}` → `recordAcquired`). Read side in `src/bongos/module-store.js` (`resolveAcquirable`, `isFreePrice`, `versionArtifactFile`). No channel check yet (tasks 1003815, 1003805). `bongos module update` (task 1003786) reuses the same three calls; the acquire route reads price only for a caller with no entitlement, so a holder is never charged again.
 - Module store delist (ADR 0338 D2, task 1003797): `POST /store/modules/:key/delist` (`requireBuilder` + `requirePermission('module.delist')`, Metic floor, granted by `government_022`; strict body `{reason}`, reason required, recorded by the audit middleware). Sets `store_modules.status='delisted'` and `delisted_at` — one-way, no relist route. Every store read already refuses a delisted key (acquire, tarball, acquired, publish), while `GET /store/modules/latest` still answers with the status so `bongos upgrade` warns the holder. `GET /modules` sets `store_delisted` on an instance-tree module the store delisted (hall pill "delisted · no more updates"), and `bongos module list` marks it DELISTED (fail-soft store check, instance modules only). Never revokes an entitlement, never reaches an installed copy, never writes a score (ADR 0359). 404 unknown key, 409 `already_delisted`.
 - Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a checkout with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). `branch` is optional: without it the server finds the task's own PR by its `task <id>: …` title, and the answer names the `branch` it used and its `branch_source` (`query` / `task_pr`, or `null` with a `branch_hint` when there is no such PR) — never a `400` (task 1003764). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (no authenticated `gh` on the machine, or `<PREFIX>_PUSH_VIA_SERVER=1`); a machine with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.

package/docs/design/project-startup-direction.md

@@ -10,7 +10,64 @@ This document is what every build task in goal 1000121 cites. Name a screen by i
 - **what the new design ADDS**;
 - the decisions that govern both.
 
-## The blended flow — supersedes the hub-side screens (owner, 2026-10-01)
+## One-page flow — supersedes the blended six screens (owner, 2026-10-08)
+
+> *Summary wins, do it in the night-room look, if it's day time let's make a day view, and likewise, same for the artist page.* Then: *approved.* — the owner, 2026-10-08.
+
+The owner found the six-screen flow still overcomplicated, and the GitHub steps after Create still failing. The mockup in [`mocks/day-night-rooms/`](mocks/day-night-rooms/README.md) is now the design of record for **every hub-side creation screen and for the artist studio's room**. Where it disagrees with the blended flow below, the mockup wins. Genesis (part 2) and the blend rule are unchanged.
+
+### The owner's decisions
+
+1. **One page, three parts.** Sign-in stays the gate in front. Then one page:
+   - **01 Your project:** name, kind, the optional sentence, and the four quick checks (country, anyone under 18, where builders will be, who's behind it). The screening stop still fires before anything is created.
+   - **02 How it's run:** a summary to skim. Each row (code, address, team, extras, rewards, hosting, we run, look) has a **Change** link that opens the real control in place.
+   - **03 Connect GitHub:** opens once the project exists, below **Create my project**.
+2. **The summary wins.** No row needs confirming and Create is not gated on the rows. This **replaces** the blended flow's "the review must not be skippable" rule. The terms stay a required checkbox above Create, and the terms version stamp still records the acceptance.
+3. **GitHub in one trip (option A).** One click: approve the project's app on GitHub, go straight on to installing it on the repo, and land back on the page. A checklist ticks itself from what the server has verified (approve the app · install it on your repo · builders can sign in · command-line sign-in is on). Coming back works from any tab or device. The founder chooses a personal or an organisation account. A failure says what stopped, and "Pick up where it stopped" resumes without making a second app.
+4. **Day room and night room, by the viewer's own clock.** Day from 07:00 to 18:59 local time, night otherwise. The day room is the same drawing in daylight: a sunny sky with clouds, a sun for the moon, lighter towers with unlit windows, a warm wall and floor, the lamp off and a patch of sun on the floor. Its palette is the mockup's `[data-sky="day"]` tokens. **The artist studio gets the same day room**, and its greeting follows the time of day.
+5. **The demo is a small link** under the heading, not its own screen.
+
+### Nothing the live wizard does is lost
+
+This table replaces the blended flow's table below for every hub-side capability. The mockup draws the simple path; each row's capability is a reveal or sits behind a summary row's **Change**.
+
+| Today | In the one-page flow |
+|---|---|
+| Q1 new or existing, and what already exists | Part 02's Code row: "A repo I already have" reveals what already exists and the adopt path. |
+| Adopt: GitHub repo picker, manual fallback, conflict pre-flight, backlog import | Behind the Code row's Change, unchanged. |
+| Q2 geography | Part 01's "Where are you?", with state or province revealed beside the country for the countries that need it, and "Where will builders be?". |
+| Q3 under-18s and the age tiers | Part 01; "Yes" reveals the tiers and the guardian rules in place. |
+| Q4 entity, new intent or existing legal type | Part 01's "Who's behind it?"; a company or nonprofit reveals the full entity list. |
+| The screening stop | Unchanged: an answer the platform cannot serve stops the page before Create, with the reason in place. |
+| Q5 one or many, count, growth guess | Part 02's Team row; Change opens the count, the growth guess and how people join. |
+| Q6 rewards | Part 02's Rewards row (pick several). |
+| Q7 framing A–D and the hybrid suite | Part 02's **We run** row ("Everything, for you" by default); "Some of it" reveals the service checklist. |
+| Auto-fill from my account | Kept, as an offer at the top of part 01 when the account has a last project. |
+| Resume a saved draft | Kept, as an offer at the top of the page (there is no fork screen any more). |
+| Type and About | Part 01's Kind and "In a sentence". |
+| Modules picker and search | Part 02's Extras row; Change opens the searchable picker. |
+| Address: handle, own domain, no address | Part 02's Address row (PS19: shown on every path, the demo included). |
+| App: Render key check, workspace, runtime, commands, plan, database | Part 02's Hosting row; Render opens today's settings in place. |
+| Look, logo, night tint | Part 02's Look row; Change opens the look picker, the logo and the night tint. |
+| Terms acknowledgement | The required checkbox above Create; the terms version stamp still records it. |
+| Review | Part 02 itself, plus the one-line recap beside Create. Nothing is gated on confirming rows. |
+| Done: standup strip, the owner-only steps, invite | Part 03 on the same page: the GitHub checklist replaces the paged owner-only steps, then "is alive" with the invite box (once the hall is live, PS15) and the genesis door. |
+| Demo: fit check, settings, teammates, 30-day notice | The "Try a small demo instead" link opens the demo's people, hours, idea and teammates in place at the top of part 01, marks the page "demo", and shows the fit sentence; the rest of the page is unchanged. |
+
+### Who builds it
+
+| Task | Builds |
+|---|---|
+| task 1004647 | This record and the mockup. |
+| task 1004648 | The one page, the day room on it, and removing the old panels. |
+| task 1004649 | GitHub in one trip, with the self-ticking checklist. |
+| task 1004650 | The hand-back from any tab or device, and checking while the page is hidden. |
+| task 1004651 | A personal or organisation account for the app. |
+| task 1004652 | Resuming a stopped step, and a fixing button for every failure. |
+| task 1004653 | The end-to-end walk, day and night, desktop and phone. |
+| task 1004654 | The artist studio's day room and time-of-day greeting. |
+
+## The blended flow — superseded by the one-page flow above (owner, 2026-10-01)
 
 > *Go for this as the design of record.* — the owner, approving the blended mockup (task 1004515).
 

package/docs/module-api-changelog.md

@@ -3002,5 +3002,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.83 with no explicit bump. run 37876887587. (task 1002620)
   1.21.85 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.84 with no explicit bump. run 37884200093. (task 1002620)
+  1.21.86 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.85 with no explicit bump. run 37885516955. (task 1002620)
+  1.21.87 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.86 with no explicit bump. run 37886940909. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.85",
+  "version": "1.21.87",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.85",
+      "version": "1.21.87",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.85",
+  "version": "1.21.87",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9336,5 +9336,21 @@
       "id": "1004379",
       "text": "A page tweak that passed its grade and is waiting for its artist no longer reports itself as a failed grade: the closing card, the PR description and the credits line now all say it passed and is waiting for the artist's appro"
     }
+  ],
+  "1.21.86": [
+    {
+      "id": "1004399",
+      "text": "Published module packages are now kept in the project's own data folder instead of inside the installed core, so a core upgrade no longer deletes them; any already stored in the old place are moved over when the server starts."
+    }
+  ],
+  "1.21.87": [
+    {
+      "id": "1004647",
+      "text": "The new project creation design is now on record for every builder: one page in three parts instead of seven screens, a skimmable summary instead of confirming every row, GitHub in a single trip with a checklist that ticks its"
+    },
+    {
+      "id": "1002852",
+      "text": "The task list a builder sees at the start of a session now opens with the goals they have joined and how much work in each is ready, and groups the tasks under their goals, with the builder's own goals first and anything witho"
+    }
   ]
 }

package/scripts/gds/start-goals.js

@@ -0,0 +1,102 @@
+// scripts/gds/start-goals.js — /builder-start, goal-first (task 1002852).
+//
+// WHY. Work is organised in goals, but /builder-start opened on a flat list of
+// tasks, so a builder saw "task 1002852" and never which goal it served or which of
+// their own goals had work waiting. This leads with the goals the builder has
+// JOINED, then shows the same claimable table grouped under each task's goal.
+//
+// The owner's two rules (2026-10-08, WA6 chain kickoff):
+//   - the goals sit ABOVE the claimable table and never replace it, so nothing
+//     claimable is hidden from a builder who has joined no goal;
+//   - a task with no goal is listed under "Other work". Nothing is backfilled.
+//
+// PURE: no I/O. start.js fetches GET /goals (best-effort: a failed read groups by
+// goal id with a generic name and lists no joined goals) and hands both lists in.
+
+'use strict';
+
+const OTHER_WORK = 'Other work';
+const JOINED_SHOWN = 5;
+
+// The open goals this builder is a member of, in the board's own order (version,
+// sort order). `viewer_is_member` is the server's answer, never re-derived here.
+function joinedGoals(goals) {
+  return (Array.isArray(goals) ? goals : [])
+    .filter((g) => g && g.viewer_is_member === true && g.status === 'open');
+}
+
+function goalName(id, byId) {
+  const g = byId.get(String(id));
+  return (g && g.title) || `Goal ${id}`;
+}
+
+// Group claimable rows by goal, keeping each row's place in the server's order
+// (priority, then estimate) inside its group. Groups run: the builder's joined
+// goals first (board order), then every other goal by its first row, then
+// "Other work" last. Every row lands in exactly one group, so the grouped table
+// lists precisely the rows the flat one did.
+function groupByGoal(rows, goals) {
+  const list = Array.isArray(rows) ? rows : [];
+  const byId = new Map((Array.isArray(goals) ? goals : []).map((g) => [String(g.id), g]));
+  const joinedOrder = joinedGoals(goals).map((g) => String(g.id));
+  const groups = new Map();
+  for (const t of list) {
+    const key = t.goal_id == null ? null : String(t.goal_id);
+    if (!groups.has(key)) {
+      groups.set(key, {
+        goal_id: key,
+        title: key == null ? OTHER_WORK : goalName(key, byId),
+        joined: key != null && joinedOrder.includes(key),
+        rows: [],
+      });
+    }
+    groups.get(key).rows.push(t);
+  }
+  const all = [...groups.values()];
+  const joined = joinedOrder.map((id) => groups.get(id)).filter(Boolean);
+  const others = all.filter((g) => g.goal_id != null && !g.joined);
+  const other = groups.get(null);
+  return [...joined, ...others, ...(other ? [other] : [])];
+}
+
+// The "Your goals" lines above the table: each joined goal and how many tasks in
+// it are claimable for this builder right now (from the FULL filtered set, not
+// the capped card rows, so a count never under-reports). Empty when the builder
+// has joined no open goal; the table below still lists everything.
+function yourGoals(goals, claimable) {
+  const counts = new Map();
+  for (const t of Array.isArray(claimable) ? claimable : []) {
+    if (t.goal_id == null) continue;
+    const k = String(t.goal_id);
+    counts.set(k, (counts.get(k) || 0) + 1);
+  }
+  const joined = joinedGoals(goals);
+  return {
+    goals: joined.slice(0, JOINED_SHOWN).map((g) => ({
+      id: String(g.id),
+      title: g.title || `Goal ${g.id}`,
+      claimable: counts.get(String(g.id)) || 0,
+    })),
+    more: Math.max(0, joined.length - JOINED_SHOWN),
+  };
+}
+
+// Goal-first ordering for the capped card: rows in a goal the builder joined come
+// first, everything else after, each half keeping the server's order. Without it
+// the card's top rows were the board's top rows and a builder's own goals could
+// show "5 to claim" above a table holding none of them. A stable partition, so it
+// only moves rows, never drops one.
+function joinedFirst(rows, goals) {
+  const list = Array.isArray(rows) ? rows : [];
+  const joined = new Set(joinedGoals(goals).map((g) => String(g.id)));
+  const mine = [];
+  const rest = [];
+  for (const t of list) (t.goal_id != null && joined.has(String(t.goal_id)) ? mine : rest).push(t);
+  return mine.concat(rest);
+}
+
+function claimableWord(n) {
+  return n === 0 ? 'nothing to claim right now' : `${n} to claim`;
+}
+
+module.exports = { OTHER_WORK, joinedGoals, joinedFirst, groupByGoal, yourGoals, claimableWord };

package/scripts/gds/start.js

@@ -233,23 +233,30 @@ function whatItIs(t) {
 // Ids are emitted as hall links (renders as a clean #N) — a bare "#NNN" in a
 // relayed chat message autolinks to GitHub and 404s (CLAUDE.md ref rule).
 const surface = require('./surface');
+const startGoals = require('./start-goals');
 const HALL_TASK = `${hallBase()}#/task/`;
-function claimableTable(rows, rewardFromServer) {
+function claimableTable(rows, rewardFromServer, goals) {
   // On a cost-plus-only instance the Reward column is an advertised estimate that
   // is never paid — say so in the header so the column can't read as a promise,
   // and footnote what IS paid below the table (task 1002469).
   const perTask = rewardPolicy(rewardFromServer).perTaskCredit;
   const rewardHead = perTask ? 'Reward' : 'Reward (est.)';
   const headers = ['#', 'Version', ROLE_AXIS_LABEL, rewardHead, 'Est.', 'What it is'];
-  const body = rows.map((t) => [
+  const rowCells = (t) => [
     surface.taskRef(t.id, HALL_TASK),
     cell(t.version_id || '?'),
     cell(roleLabel(t) || '—'),
     `${t.credits_reward ?? 0}c`,
     estimateShort(t),
     cell(whatItIs(t)),
-  ]);
-  const out = [surface.table(headers, body)];
+  ];
+  // task 1002852: one table per goal, each under its goal's name; goal-less work
+  // last under "Other work". An empty goal list (a failed read) still groups by id.
+  const out = [];
+  for (const g of startGoals.groupByGoal(rows, goals)) {
+    if (out.length) out.push('');
+    out.push(surface.strong(g.title) + (g.joined ? ' · your goal' : ''), surface.table(headers, g.rows.map(rowCells)));
+  }
   const cpNote = costPlusOnlyNote(rewardFromServer);
   if (cpNote) out.push('', surface.em(cpNote));
   return out.join('\n');
@@ -374,6 +381,7 @@ const WIDGET_STYLE = `<style>
 .bs-thead{text-align:left;color:var(--color-text-tertiary);font-size:12px;}
 .bs-th{padding:0 6px 4px;font-weight:400;}
 .bs-tr{cursor:pointer;}
+.bs-group td{padding:10px 0 4px;font-size:12px;font-weight:500;color:var(--color-text-secondary);}
 .bs-td{padding:7px 6px;border-top:0.5px solid var(--color-border-tertiary);}
 .bs-id{color:var(--color-text-secondary);font-family:var(--font-mono);font-size:12px;}
 .bs-nowrap{white-space:nowrap;}
@@ -384,7 +392,7 @@ const WIDGET_STYLE = `<style>
 .bs-foot{font-size:13px;color:var(--color-text-tertiary);margin-top:12px;}
 </style>`;
 
-function renderWidget({ builder, claims, claimable, total, streak, recommendations, header, routingByPreference, preferred, filters, readyToClose, needsRebaseTasks }) {
+function renderWidget({ builder, claims, claimable, total, streak, recommendations, header, routingByPreference, preferred, filters, readyToClose, needsRebaseTasks, goals, yourGoals }) {
   const b = builder || {};
   // ADR 0120 part 5: the owed-rebase gate warning, rendered at the top of the
   // card (before status/holdings) since it blocks new claims. '' when none owed.
@@ -443,7 +451,7 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
 
   // rows — click to claim. Columns: # / Version / Type / Reward /
   // Est. / What it is (the work lane is its own column, not baked into the title).
-  const rows = claimable.map((t) => {
+  const taskRow = (t) => {
     const claimMsg = jsq(`Claim task ${t.id}`);
     const titleAttr = hesc(`Claim #${t.id}: ${t.title || ''}`);
     const d = t.discipline;
@@ -458,7 +466,16 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
       + TD(hesc(estimateShort(t)), 'bs-sub')
       + TD(hesc(t.title || ''), 'bs-ellip')
       + `</tr>`;
-  }).join('');
+  };
+  // task 1002852: the same rows, grouped under each task's goal ("Other work" last).
+  const rows = startGoals.groupByGoal(claimable, goals).map((g) =>
+    `<tr class="bs-group"><td colspan="6">${hesc(g.title)}${g.joined ? '<span class="bs-sub"> · your goal</span>' : ''}</td></tr>`
+    + g.rows.map(taskRow).join('')).join('');
+  // task 1002852: the goals this builder joined, ABOVE the table (never instead of it).
+  const goalsBlock = yourGoals.goals.length
+    ? `<div class="bs-menuh">Your goals</div>${yourGoals.goals.map((g) =>
+      `<div class="bs-line"><i class="ti ti-target" aria-hidden="true"></i>${hesc(clip(g.title, 60))}<span class="bs-dot"> · </span><span class="bs-sub">${hesc(startGoals.claimableWord(g.claimable))}</span></div>`).join('')}${yourGoals.more ? `<div class="bs-line bs-sub">and ${yourGoals.more} more</div>` : ''}`
+    : '';
 
   const menu = claimable.length
     ? `<table class="bs-table">
@@ -495,6 +512,7 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
   ${statusRow}
   ${holdings}
   ${closeBanner}
+  ${goalsBlock}
   <div class="bs-menuh">Claim one to start — ${total || claimable.length} ready for you right now${matched}${fNote}</div>
   ${menu}
   <div class="bs-foot">Click a task to claim it${moreLink}${crossLane}</div>
@@ -679,9 +697,9 @@ async function main() {
   // endpoint fails, that widget degrades to "N/A" rather than killing
   // /builder-start.
   const api = await cliClient();
-  let me, r, closeRes, progressRes, costRes, recentRes, inboxRes, blockersRes;
+  let me, r, closeRes, progressRes, costRes, recentRes, inboxRes, blockersRes, goalsRes;
   try {
-    [me, r, closeRes, progressRes, costRes, recentRes, inboxRes, blockersRes] = await Promise.all([
+    [me, r, closeRes, progressRes, costRes, recentRes, inboxRes, blockersRes, goalsRes] = await Promise.all([
       api.me.getMe(),
       api.tasks.getTasksClaimable({ query: claimableQuery }),
       api.versions.getVersionsCloseSuggestions(),
@@ -690,6 +708,8 @@ async function main() {
       api.public.getPublicRecentShipped(),
       api.inbox.getInbox({ query: { status: 'open' } }),
       api.blockers.getBlockers(),
+      // task 1002852: best-effort — a failed goals read leaves the table flat-grouped by id.
+      api.goals.getGoals({ query: { status: 'open' } }).catch(() => ({ ok: false })),
     ]);
   } catch (err) {
     // A fresh-clone instance that was never brought up refuses the connection.
@@ -741,7 +761,10 @@ async function main() {
   const filtered = routingByPreference
     ? rawClaimable.filter((t) => preferred.includes(t.discipline))
     : rawClaimable;
-  const claimable = filtered.slice(0, limit);
+  // task 1002852: goal-first. The open goals (with the server's viewer_is_member)
+  // group the table and put the builder's joined goals' rows ahead of the cap.
+  const goals = goalsRes && goalsRes.ok && Array.isArray(goalsRes.data?.goals) ? goalsRes.data.goals : [];
+  const claimable = startGoals.joinedFirst(filtered, goals).slice(0, limit);
 
   // "You might enjoy" — up to 3 claimable tasks outside the builder's lanes.
   // Computed from the FULL set so it can reach across disciplines. Suppressed
@@ -758,6 +781,7 @@ async function main() {
     ? closeRes.data.suggestions
     : [];
   const readyToClose = closeSuggestions.filter((s) => s.ready);
+  const yourGoals = startGoals.yourGoals(goals, filtered);
 
   // Header widget data (each independently optional).
   const progress = progressRes.ok && Array.isArray(progressRes.data?.progress) ? progressRes.data.progress : null;
@@ -781,6 +805,7 @@ async function main() {
         me: me.data,
         claimable,
         recommendations,
+        your_goals: yourGoals.goals,
         discipline_routing: {
           preferred_disciplines: preferred,
           applied: routingByPreference,
@@ -836,6 +861,8 @@ async function main() {
       filters: { version, discipline, fit },
       readyToClose,
       needsRebaseTasks,
+      goals,
+      yourGoals,
     }) + '\n');
     return;
   }
@@ -951,11 +978,18 @@ async function main() {
     fit && `fit=${fit}`,
   ].filter(Boolean);
   const filterNote = filterBits.length ? ` (${filterBits.join(', ')})` : '';
+  // task 1002852: the goals this builder joined, above the table (never instead of it).
+  if (yourGoals.goals.length) {
+    console.log(surface.strong('Your goals'));
+    for (const g of yourGoals.goals) console.log(`  ${clip(g.title, 60)} · ${startGoals.claimableWord(g.claimable)}`);
+    if (yourGoals.more) console.log(`  and ${yourGoals.more} more`);
+    console.log('');
+  }
   console.log(`${surface.strong('Claim one to start')} — ${filtered.length} ready for you right now${matched}${filterNote}:`);
   console.log('');
   if (claimable.length) {
     const cardRows = claimable.slice(0, CARD_ROWS);
-    console.log(claimableTable(cardRows, me.ok ? me.data?.reward : null));
+    console.log(claimableTable(cardRows, me.ok ? me.data?.reward : null, goals));
     const moreN = filtered.length - cardRows.length;
     if (moreN > 0) {
       console.log('');
@@ -1012,6 +1046,8 @@ async function main() {
         filters: { version, discipline, fit },
         readyToClose,
         needsRebaseTasks,
+        goals,
+        yourGoals,
       })
       : null;
     const markdown = captureLog(emitMarkdownCard).join('\n');

package/src/bongos/module-store.js

@@ -8,9 +8,8 @@
 //   1. stageArtifact — write the tarball under the store dir (a temp name first;
 //      commitArtifact moves it into place inside step 2's transaction). ADR 0338 lets the
 //      store keep tarballs on the control plane's disk while volume is small, so it
-//      does: <MODULE_STORE_DIR or var/module-store>/<key>/<key>-<version>.tgz. Outside
-//      the git tree, like var/task-visuals, so a deploy's `git reset --hard` never
-//      wipes it.
+//      does: <MODULE_STORE_DIR or <instance root>/var/module-store>/<key>/<key>-<version>.tgz
+//      (see storeDirFor for why the INSTANCE root, task 1004399).
 //   2. publishVersion — one transaction over the registry tables (core_257): create
 //      the store_modules row on a key's first publish (the publisher becomes its
 //      author), refuse anyone else's key, refuse a delisted key (ADR 0338 D2: delisting
@@ -26,9 +25,105 @@ const crypto = require('node:crypto');
 const { parseVersion, cmp } = require('../module-loader/semver');
 const { KEY_RE } = require('../module-loader/manifest-schema');
 
+// Where the store lives: <INSTANCE ROOT>/var/module-store (task 1004399).
+//
+// THE BUG THIS FIXES. This used to be path.join(__dirname, '..', '..', 'var',
+// 'module-store') — the CORE root. Right in a single checkout, where core root and
+// instance root are one directory; wrong in the consumer layout, where __dirname is
+// node_modules/@bongos/core/src/bongos, so every published tarball was written INSIDE
+// the installed package and every core upgrade (npm ci replaces it) erased them all,
+// leaving registry rows pointing at nothing. Task 1004381 found and fixed the same
+// failure for task visuals (modules/lifecycle/task-visuals.js); this follows it.
+//
+// MODULE_STORE_DIR stays the override (tests, or an operator who wants the tarballs on
+// another disk). The default store carries a `*` .gitignore, because the instance root
+// is a git checkout whose tree `bongos upgrade` requires to be clean.
+let instanceRootCache;
+function instanceRoot() {
+  if (instanceRootCache === undefined) {
+    try {
+      instanceRootCache = require('../instance-config').resolveInstanceRoot();
+    } catch (e) {
+      // A storage-path lookup must never take the server down: fall back to the
+      // historical location, which is right in a single checkout.
+      instanceRootCache = path.join(__dirname, '..', '..');
+    }
+  }
+  return instanceRootCache;
+}
+
+// PURE given its inputs, so the consumer-layout test can prove where it lands.
+function storeDirFor({ env = process.env, root } = {}) {
+  if (env.MODULE_STORE_DIR) return env.MODULE_STORE_DIR;
+  return path.join(root || instanceRoot(), 'var', 'module-store');
+}
 
 function storeDir() {
-  return process.env.MODULE_STORE_DIR || path.join(__dirname, '..', '..', 'var', 'module-store');
+  return storeDirFor();
+}
+
+// The old, in-package location. Read only by migrateLegacyStore.
+function legacyStoreDir() {
+  return path.join(__dirname, '..', '..', 'var', 'module-store');
+}
+
+// mkdir -p the store and, for the DEFAULT store, drop a `*` .gitignore in it so the
+// tarballs never show as untracked in the instance's git tree (an untracked path
+// there halts the next `bongos upgrade` pre-flight). An override is the operator's
+// own directory and is left bare. Idempotent; the .gitignore write is best-effort.
+const DIR_GITIGNORE = '# Module store tarballs (task 1004399): runtime data, never committed.\n*\n';
+async function ensureStoreDir(dir, { env = process.env } = {}) {
+  await fs.promises.mkdir(dir, { recursive: true });
+  if (env.MODULE_STORE_DIR || path.resolve(dir) !== path.resolve(storeDirFor({ env }))) return;
+  try {
+    await fs.promises.writeFile(path.join(dir, '.gitignore'), DIR_GITIGNORE, { flag: 'wx' });
+  } catch { /* EEXIST is the steady state; anything else is non-fatal */ }
+}
+
+// One-time boot move: every tarball still at the old in-package path moves into the
+// instance store, keeping its <key>/<key>-<version>.tgz place — the registry stores
+// artifact_path RELATIVE to the store dir, so the rows stay right with no data
+// migration. Only well-formed artifacts move (a key directory matching KEY_RE holding
+// "<key>-<version>.tgz"); a leftover .partial is not one. A no-op when both paths are
+// the same directory (a single checkout), the old one is absent, or MODULE_STORE_DIR
+// is set (the old code honoured it too, so nothing was ever written to the legacy
+// path). Never overwrites, never throws: returns { moved, skipped, failed }.
+async function migrateLegacyStore({ from, to = storeDir(), env = process.env } = {}) {
+  const out = { moved: 0, skipped: 0, failed: 0 };
+  if (from === undefined) {
+    if (env.MODULE_STORE_DIR) return out;
+    from = legacyStoreDir();
+  }
+  if (path.resolve(from) === path.resolve(to)) return out;
+  let keys;
+  try { keys = await fs.promises.readdir(from); } catch { return out; }
+  for (const key of keys.filter((k) => KEY_RE.test(k))) {
+    let names;
+    try { names = await fs.promises.readdir(path.join(from, key)); } catch { continue; }
+    for (const name of names) {
+      const m = name.startsWith(`${key}-`) && name.endsWith('.tgz') ? name.slice(key.length + 1, -4) : null;
+      if (!m || !parseVersion(m)) continue;
+      const src = path.join(from, key, name);
+      const dest = artifactPath(key, m, { dir: to });
+      try {
+        try { await fs.promises.access(dest); out.skipped += 1; continue; } catch { /* absent: move it */ }
+        await ensureStoreDir(to, { env });
+        await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+        try {
+          await fs.promises.rename(src, dest);
+        } catch (err) {
+          if (!err || err.code !== 'EXDEV') throw err;
+          // Another filesystem: copy, then remove the original.
+          await fs.promises.copyFile(src, dest, fs.constants.COPYFILE_EXCL);
+          await fs.promises.unlink(src);
+        }
+        out.moved += 1;
+      } catch {
+        out.failed += 1;
+      }
+    }
+  }
+  return out;
 }
 
 // Where one version's tarball lives. Key and version are re-validated here so this
@@ -48,6 +143,7 @@ function artifactPath(key, version, { dir = storeDir() } = {}) {
 // Async throughout so a multi-MB write never holds the web process's event loop.
 async function stageArtifact(buf, { key, version, dir = storeDir() } = {}) {
   const final = artifactPath(key, version, { dir });
+  await ensureStoreDir(dir);
   await fs.promises.mkdir(path.dirname(final), { recursive: true });
   const tmp = `${final}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.partial`;
   await fs.promises.writeFile(tmp, buf, { flag: 'wx', mode: 0o640 });
@@ -276,5 +372,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet,
+  delistModule, delistedKeySet, storeDir, storeDirFor, migrateLegacyStore,
 };

package/src/bongos/routes/modules.js

@@ -95,7 +95,7 @@ const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } =
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet,
+  delistModule, delistedKeySet, migrateLegacyStore,
 } = require('../module-store');
 const {
   isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
@@ -210,6 +210,12 @@ function contributeModuleDesk() {
 module.exports = function buildModulesRouter() {
   contributeModuleRechecksToDocket();
   contributeModuleDesk();
+  // Task 1004399: carry tarballs written inside the installed core package (the old
+  // store path) into the instance store before the next upgrade erases them. Async and
+  // never fatal; a no-op in a single checkout, where the two paths are one directory.
+  migrateLegacyStore()
+    .then((r) => { if (r.moved || r.failed) log.info(r, 'module store: moved from the old in-package store'); })
+    .catch((err) => log.error({ err: err && err.message }, 'module store: boot move failed'));
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
   // router starts empty.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.85'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.87'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_store_instance_root.mjs

@@ -0,0 +1,163 @@
+// tests/module_store_instance_root.mjs
+//
+// Task 1004399: published module tarballs must be stored under the INSTANCE root,
+// never inside the installed core package, so they survive a core upgrade. The
+// sibling of tests/task_visuals_instance_root.mjs (task 1004381), which found the
+// same bug in the task-visuals store.
+//
+// This builds a real consumer tree in a temp dir: a fake installed core package
+// carrying the REAL src/bongos/module-store.js, with its three core requires
+// re-exporting the real files, then proves, through that installed copy:
+//   1. the store is the instance's var/module-store, not inside the package;
+//   2. a published tarball survives the package being deleted and reinstalled,
+//      and the registry row's artifact_path still resolves to it;
+//   3. the boot move carries tarballs from the old in-package path, keeping their
+//      <key>/ place, once, without overwriting, skipping anything not an artifact,
+//      and is a no-op in a single checkout or under MODULE_STORE_DIR;
+//   4. the store keeps the instance's git tree clean (upgrade pre-flight).
+//
+// Run:  node tests/module_store_instance_root.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const REAL = (...p) => path.join(REPO, 'src', ...p);
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e && e.stack ? e.stack.split('\n').slice(0, 3).join('\n        ') : e}`); }
+}
+
+const TGZ = Buffer.from('1f8b0800000000000003', 'hex');
+
+const WORK = fs.mkdtempSync(path.join(os.tmpdir(), 'ms-instance-root-'));
+const CONSUMER = path.join(WORK, 'consumer');
+const CORE = path.join(CONSUMER, 'node_modules', '@bongos', 'core');
+const reexport = (real) => `module.exports = require(${JSON.stringify(real)});\n`;
+
+// "npm ci": (re)install the fake core package — the real store, its requires stubbed through.
+function installCore() {
+  fs.rmSync(CORE, { recursive: true, force: true });
+  fs.mkdirSync(path.join(CORE, 'src', 'bongos'), { recursive: true });
+  fs.mkdirSync(path.join(CORE, 'src', 'module-loader'), { recursive: true });
+  fs.copyFileSync(REAL('bongos', 'module-store.js'), path.join(CORE, 'src', 'bongos', 'module-store.js'));
+  fs.writeFileSync(path.join(CORE, 'src', 'module-loader', 'semver.js'), reexport(REAL('module-loader', 'semver.js')));
+  fs.writeFileSync(path.join(CORE, 'src', 'module-loader', 'manifest-schema.js'), reexport(REAL('module-loader', 'manifest-schema.js')));
+  fs.writeFileSync(path.join(CORE, 'src', 'instance-config.js'), reexport(REAL('instance-config.js')));
+}
+// A fresh require of the INSTALLED copy (a restarted server).
+function loadInstalled() {
+  const p = path.join(CORE, 'src', 'bongos', 'module-store.js');
+  delete require.cache[p];
+  return require(p);
+}
+const inside = (child, parent) => {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+};
+
+fs.mkdirSync(CONSUMER, { recursive: true });
+installCore();
+delete process.env.MODULE_STORE_DIR;
+process.env.BONGOS_INSTANCE_ROOT = CONSUMER;
+
+await t('consumer layout: the store is <instance>/var/module-store, NOT inside the core package', () => {
+  const ms = loadInstalled();
+  const dir = ms.storeDir();
+  assert.equal(path.resolve(dir), path.join(CONSUMER, 'var', 'module-store'));
+  assert.ok(!inside(dir, CORE), `store ${dir} is inside the core package ${CORE}`);
+});
+
+await t('MODULE_STORE_DIR still overrides', () => {
+  const ms = loadInstalled();
+  assert.equal(ms.storeDirFor({ env: { MODULE_STORE_DIR: '/elsewhere/x' } }), '/elsewhere/x');
+});
+
+await t('the checkout copy resolves the same way: an instance root, or the override', () => {
+  const { storeDir, storeDirFor } = require('../src/bongos/module-store.js');
+  assert.equal(storeDirFor({ env: {}, root: '/inst' }), path.join('/inst', 'var', 'module-store'));
+  assert.equal(path.resolve(storeDir()), path.join(CONSUMER, 'var', 'module-store'));
+});
+
+let row;
+await t('a published tarball survives a core upgrade (package deleted and reinstalled)', async () => {
+  const ms = loadInstalled();
+  const staged = await ms.stageArtifact(TGZ, { key: 'weather', version: '1.2.0' });
+  await ms.commitArtifact(staged);
+  row = { module_key: 'weather', version: '1.2.0', artifact_path: ms.relativeArtifactPath(staged.final) };
+  assert.equal(row.artifact_path, 'weather/weather-1.2.0.tgz');
+  installCore(); // the upgrade
+  const after = loadInstalled();
+  const file = after.versionArtifactFile(row);
+  assert.ok(fs.existsSync(file), 'the tarball is gone after the upgrade');
+  assert.deepEqual(fs.readFileSync(file), TGZ);
+});
+
+await t('the default store carries a * .gitignore, so the instance git tree stays clean', () => {
+  const gi = fs.readFileSync(path.join(CONSUMER, 'var', 'module-store', '.gitignore'), 'utf8');
+  assert.match(gi, /^\*$/m);
+  const init = spawnSync('git', ['init', '-q'], { cwd: CONSUMER, encoding: 'utf8' });
+  if (init.status !== 0) { console.log('        (git unavailable: .gitignore content checked only)'); return; }
+  fs.writeFileSync(path.join(CONSUMER, '.gitignore'), 'node_modules/\n');
+  const st = spawnSync('git', ['status', '--porcelain', '--untracked-files=all', '--', 'var'], { cwd: CONSUMER, encoding: 'utf8' });
+  assert.equal(st.status, 0);
+  assert.equal(st.stdout.trim(), '', `var/ shows in git status:\n${st.stdout}`);
+});
+
+await t('boot move: tarballs at the old in-package path move into the instance store, once', async () => {
+  const ms = loadInstalled();
+  const legacy = path.join(CORE, 'var', 'module-store');
+  fs.mkdirSync(path.join(legacy, 'notes'), { recursive: true });
+  fs.mkdirSync(path.join(legacy, 'weather'), { recursive: true });
+  fs.mkdirSync(path.join(legacy, 'Bad Key'), { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'notes', 'notes-0.1.0.tgz'), TGZ);
+  fs.writeFileSync(path.join(legacy, 'notes', 'notes-0.1.0.tgz.123.456.ab.partial'), 'half');
+  fs.writeFileSync(path.join(legacy, 'notes', 'other-0.1.0.tgz'), 'not this key');
+  fs.writeFileSync(path.join(legacy, 'Bad Key', 'Bad Key-1.0.0.tgz'), 'x');
+  // weather 1.2.0 already exists in the new store: kept, never overwritten.
+  fs.writeFileSync(path.join(legacy, 'weather', 'weather-1.2.0.tgz'), 'legacy copy');
+
+  const r = await ms.migrateLegacyStore();
+  assert.deepEqual(r, { moved: 1, skipped: 1, failed: 0 });
+  const store = ms.storeDir();
+  assert.deepEqual(fs.readFileSync(path.join(store, 'notes', 'notes-0.1.0.tgz')), TGZ);
+  assert.ok(!fs.existsSync(path.join(legacy, 'notes', 'notes-0.1.0.tgz')), 'moved, not copied');
+  assert.deepEqual(fs.readFileSync(path.join(store, 'weather', 'weather-1.2.0.tgz')), TGZ, 'the existing file is not overwritten');
+  assert.ok(!fs.existsSync(path.join(store, 'notes', 'notes-0.1.0.tgz.123.456.ab.partial')), 'a .partial is not an artifact');
+  assert.ok(!fs.existsSync(path.join(store, 'Bad Key')), 'a directory that is not a module key is left alone');
+
+  // A moved tarball is served through its unchanged registry row.
+  const moved = ms.versionArtifactFile({ module_key: 'notes', version: '0.1.0', artifact_path: 'notes/notes-0.1.0.tgz' });
+  assert.ok(fs.existsSync(moved));
+
+  const again = await ms.migrateLegacyStore();
+  assert.equal(again.moved, 0, 'the second boot moves nothing');
+});
+
+await t('boot move is a no-op in a single checkout and under MODULE_STORE_DIR', async () => {
+  const ms = loadInstalled();
+  const dir = fs.mkdtempSync(path.join(WORK, 'same-'));
+  fs.mkdirSync(path.join(dir, 'notes'));
+  fs.writeFileSync(path.join(dir, 'notes', 'notes-0.2.0.tgz'), TGZ);
+  assert.deepEqual(await ms.migrateLegacyStore({ from: dir, to: dir }), { moved: 0, skipped: 0, failed: 0 });
+  assert.deepEqual(await ms.migrateLegacyStore({ env: { MODULE_STORE_DIR: dir } }), { moved: 0, skipped: 0, failed: 0 });
+  assert.ok(fs.existsSync(path.join(dir, 'notes', 'notes-0.2.0.tgz')));
+});
+
+await t('the modules router runs the boot move when it is built', () => {
+  const src = fs.readFileSync(path.join(REPO, 'src', 'bongos', 'routes', 'modules.js'), 'utf8');
+  const body = src.slice(src.indexOf('module.exports = function buildModulesRouter('));
+  assert.ok(body.indexOf('migrateLegacyStore()') > 0 && body.indexOf('migrateLegacyStore()') < body.indexOf('express.Router()'));
+});
+
+fs.rmSync(WORK, { recursive: true, force: true });
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exitCode = 1;

package/tests/start_goal_first.mjs

@@ -0,0 +1,90 @@
+// tests/start_goal_first.mjs — /builder-start leads with the builder's goals
+// (task 1002852).
+//
+// The owner's rules (2026-10-08): the joined goals sit ABOVE the claimable table
+// and never replace it, and a task with no goal is listed under "Other work".
+// These drive the pure helpers in scripts/gds/start-goals.js and the real table
+// renderer start.js uses, so the property that matters — every claimable row is
+// still listed, exactly once — is checked on what the builder actually sees.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { test, summary } = makeRunner();
+const sg = require('../scripts/gds/start-goals.js');
+
+const GOALS = [
+  { id: 10, title: 'Alpha', status: 'open', viewer_is_member: false },
+  { id: 20, title: 'Mine', status: 'open', viewer_is_member: true },
+  { id: 30, title: 'Done one', status: 'achieved', viewer_is_member: true },
+  { id: 40, title: 'Also mine', status: 'open', viewer_is_member: true },
+];
+const ROWS = [
+  { id: 1, goal_id: 10, title: 'a1' },
+  { id: 2, goal_id: null, title: 'loose' },
+  { id: 3, goal_id: 20, title: 'm1' },
+  { id: 4, goal_id: 99, title: 'unknown goal' },
+  { id: 5, goal_id: 20, title: 'm2' },
+];
+
+await test('joined goals are the open ones the server says the viewer is a member of', () => {
+  assert.deepEqual(sg.joinedGoals(GOALS).map((g) => g.id), [20, 40]);
+});
+
+await test('groups: joined goals first, then other goals, then "Other work" last; every row exactly once', () => {
+  const groups = sg.groupByGoal(ROWS, GOALS);
+  assert.deepEqual(groups.map((g) => g.title), ['Mine', 'Alpha', 'Goal 99', sg.OTHER_WORK]);
+  assert.deepEqual(groups[0].rows.map((r) => r.id), [3, 5], 'server order kept inside a group');
+  assert.equal(groups[0].joined, true);
+  assert.equal(groups[3].goal_id, null);
+  const ids = groups.flatMap((g) => g.rows.map((r) => r.id)).sort();
+  assert.deepEqual(ids, [1, 2, 3, 4, 5]);
+});
+
+await test('with no goal list (a failed read) nothing is hidden: goals by id, goal-less under Other work', () => {
+  const groups = sg.groupByGoal(ROWS, []);
+  assert.equal(groups.flatMap((g) => g.rows).length, ROWS.length);
+  assert.equal(groups.at(-1).title, sg.OTHER_WORK);
+  assert.ok(groups.every((g) => !g.joined));
+});
+
+await test('joinedFirst moves the joined goals\' rows ahead of the cap and drops nothing', () => {
+  const out = sg.joinedFirst(ROWS, GOALS);
+  assert.deepEqual(out.map((r) => r.id), [3, 5, 1, 2, 4]);
+  assert.deepEqual(sg.joinedFirst(ROWS, []).map((r) => r.id), [1, 2, 3, 4, 5], 'no joined goal: order unchanged');
+});
+
+await test('"Your goals" counts claimable work per joined goal from the full set', () => {
+  const y = sg.yourGoals(GOALS, ROWS);
+  assert.deepEqual(y.goals, [
+    { id: '20', title: 'Mine', claimable: 2 },
+    { id: '40', title: 'Also mine', claimable: 0 },
+  ]);
+  assert.equal(y.more, 0);
+  assert.equal(sg.claimableWord(0), 'nothing to claim right now');
+  assert.equal(sg.claimableWord(2), '2 to claim');
+});
+
+await test('a builder in no goal gets no goals list, and the table still lists everything', () => {
+  const none = GOALS.map((g) => ({ ...g, viewer_is_member: false }));
+  assert.deepEqual(sg.yourGoals(none, ROWS).goals, []);
+  assert.equal(sg.groupByGoal(ROWS, none).flatMap((g) => g.rows).length, ROWS.length);
+});
+
+await test('start.js renders "Your goals" ABOVE the table and groups the table by goal (the wiring)', () => {
+  const fs = require('node:fs');
+  const src = fs.readFileSync(require.resolve('../scripts/gds/start.js'), 'utf8');
+  const goalsAt = src.indexOf("surface.strong('Your goals')");
+  const tableAt = src.indexOf("surface.strong('Claim one to start')");
+  assert.ok(goalsAt > 0 && goalsAt < tableAt, 'markdown: goals before the table');
+  const wGoals = src.indexOf('${goalsBlock}');
+  const wMenu = src.indexOf('<div class="bs-menuh">Claim one to start');
+  assert.ok(wGoals > 0 && wGoals < wMenu, 'widget: goals before the table');
+  assert.match(src, /claimableTable\(cardRows, [^)]*, goals\)/, 'the markdown table is grouped');
+  assert.equal((src.match(/\n\s+goals,\n\s+yourGoals,\n/g) || []).length, 2, 'both widget calls carry the goals');
+  assert.match(src, /startGoals\.joinedFirst\(filtered, goals\)\.slice\(0, limit\)/);
+});
+
+summary();