@bongos/core 1.24.22 → 1.24.24

package/modules/lifecycle/db-ship.js

@@ -19,6 +19,7 @@ const { THETES_GRADUATION_THRESHOLD, maybeAutoGraduateToThetes, foldWorktreeName
 const { idKey, mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
 const { LIVE_STATUSES } = require('./dead-deps.js');
 const { isPageTweak } = require('./page-tweak-hold.js');
+const { fundingWallOnResolve } = require('./funding-wall.js'); // task 1003185 / ADR 0386
 const pageTweakArtist = require('./page-tweak-artist.js');
 
 // shouldRefuseClaimResolve — may THIS caller resolve THIS claim? (task 1003767)
@@ -202,16 +203,15 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
         WHERE id = $1`,
       [claim.task_id, newTaskStatus, valueSummary ?? null]
     );
+    await fundingWallOnResolve(client, claim.task_id, outcome); // task 1003185 / ADR 0386
 
     // touches[] cleanup [7/8] (task 882): backfill touches[] from the REAL
     // committed diff at ship. The planning-time touches[] is now optional (a
     // prediction nobody has to get right up front); on a successful ship we
     // replace it with what git actually reports, so the declared set becomes
-    // reality. This is the write path that makes the touches[]-keyed profile
-    // counters (art_ships / pms_ships, see achievements + db leaderboard) and
-    // the historical record diff-accurate — closing the loop left open in #878.
-    // Only on a 'shipped' resolve with a non-empty list (never wipe touches[]
-    // with an empty diff on a DB-only / no-op ship).
+    // reality. This is the write path that makes the touches[]-keyed profile counters (art_ships /
+    // pms_ships, see achievements + db leaderboard) and the record diff-accurate (loop left open in #878).
+    // Only on a 'shipped' resolve with a non-empty list (never wipe touches[] with an empty diff on a DB-only / no-op ship).
     if (outcome === 'shipped' && Array.isArray(committedFiles) && committedFiles.length > 0) {
       const cleaned = Array.from(
         new Set(committedFiles.map((p) => String(p || '').trim()).filter(Boolean))

package/modules/lifecycle/funding-wall.js

@@ -0,0 +1,253 @@
+// modules/lifecycle/funding-wall.js — AN UNDERFUNDED PROJECT CANNOT ACCRUE PAYABLE WORK
+// (task 1003185, goal 1000092 M06; ADR 0386).
+//
+// WHY. A builder who finishes a task and only then learns the project cannot pay has
+// carried the loss alone. ADR 0386 makes the rule the PROJECT's choice, with three
+// options, and Bongos sets none of its own:
+//
+//   hold_at_claim         (the default) a claim is refused when the project's available
+//                         balance cannot cover the task's cash pay; otherwise that pay is
+//                         HELD against the balance while the task is worked, so several
+//                         claims at once cannot over-commit one balance
+//   refuse_at_completion  the task can be claimed and worked; declaring it done is
+//                         refused while the balance is short
+//   carry_on              nothing is refused; an unpaid amount is the project's own debt
+//
+// WHAT THE WALL READS. A task's price is its CASH pay terms (pay-terms.js; the task's own,
+// else the project's standing terms), and the balance is the project account's record
+// (the economy module's, through the `economy.account` port). A task with no cash term is
+// never walled: credits, equity and the other pay types have no dollar balance here
+// (ADR 0386: a non-cash wall reads the project's own terms for that pay type), and a
+// self-managed term is money Bongos never sees. That is also why switching this on
+// changes nothing for a project that pays no cash.
+//
+// EVERY REFUSAL STATES THE REASON AND THE SHORTFALL. "Insufficient balance" with no number
+// is a dead end for the owner who has to act on it, so the refusal names the task's
+// price, the balance, what is already held, and exactly how far short it is. A cash term
+// whose amount is not a dollar figure is refused as unreadable, saying what it read: a
+// guess at a number would be Bongos setting the pay.
+//
+// FAIL CLOSED. A cash-paying task under a rule that needs the account, with the account
+// record switched off, is refused: the wall cannot be checked, and an unchecked wall is
+// the loss this exists to prevent. A setting that cannot be read falls to the default.
+//
+// The check is the server's (ADR 0016). claimTask, claimTasksBatch and validateClaimBatch
+// call fundingWallFailures (the taskNeedsFailures shape); resolveClaim calls
+// fundingWallOnResolve. A hold is let go by STATE: the account counts it while its task is
+// being worked or has shipped and is not yet paid, and the next claim or resolve writes the
+// hold_release row (economy project-account.js), so no ship or pay path needs a hook.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const { readPayTerms } = require('./pay-terms');
+
+const log = api.logger('lifecycle');
+
+const FUNDING_WALL_MODES = Object.freeze(['hold_at_claim', 'refuse_at_completion', 'carry_on']);
+const DEFAULT_FUNDING_WALL = 'hold_at_claim';
+const MODE_WORDS = Object.freeze({
+  hold_at_claim: 'Hold at claim: a task that pays cash can be claimed only when the project account can cover it, and its pay is set aside until the builder is paid or the task is let go.',
+  refuse_at_completion: 'Refuse at completion: a task can be claimed and worked, but it cannot be marked done while the project account cannot cover its cash pay.',
+  carry_on: 'Carry on: work is never stopped for money. Any unpaid amount is the project’s own debt; Bongos never pays it.',
+});
+const MICRO_PER_DOLLAR = 1000000;
+
+// ── pure half ────────────────────────────────────────────────────────────────
+
+function parseFundingWall(raw) {
+  if (raw == null || String(raw).trim() === '') return { reason: 'empty' };
+  const v = String(raw).trim().toLowerCase();
+  if (!FUNDING_WALL_MODES.includes(v)) return { reason: `must be one of ${FUNDING_WALL_MODES.join(' | ')}` };
+  return { mode: v };
+}
+
+// A cash amount as dollars, or null. Only a plain figure is read ("250", "$1,250.50",
+// "USD 40"); a unit, when given, must say dollars. Anything else is not guessed at.
+const DOLLAR_UNIT = /^(usd|us\$|\$|dollars?)$/i;
+function dollarsMicro(amount, unit) {
+  if (unit != null && !DOLLAR_UNIT.test(String(unit).trim())) return null;
+  const s = String(amount == null ? '' : amount).trim().replace(/^(usd|us\$|\$)\s*/i, '').replace(/\s*(usd)$/i, '');
+  if (!/^\d{1,3}(,\d{3})*(\.\d{1,2})?$|^\d+(\.\d{1,2})?$/.test(s)) return null;
+  const [whole, cents = ''] = s.replace(/,/g, '').split('.');
+  const micro = Number(whole) * MICRO_PER_DOLLAR + Number((cents + '00').slice(0, 2)) * (MICRO_PER_DOLLAR / 100);
+  return Number.isSafeInteger(micro) ? micro : null;
+}
+
+// The task's cash price from its pay-terms view → { cash: false } | { cash: true, micro }
+// | { cash: true, unreadable: '<what the project wrote>' }.
+function cashPrice(view) {
+  const terms = ((view && view.terms) || []).filter((t) => t.pay_type === 'cash');
+  if (!terms.length) return { cash: false };
+  let micro = 0;
+  for (const t of terms) {
+    const m = dollarsMicro(t.amount, t.unit);
+    if (m == null) return { cash: true, unreadable: [t.amount, t.unit].filter(Boolean).join(' ') || 'no amount' };
+    micro += m;
+  }
+  if (!Number.isSafeInteger(micro)) return { cash: true, unreadable: 'a total too large to read' };
+  return { cash: true, micro };
+}
+
+function usd(micro) {
+  const cents = Math.round(Number(micro) / (MICRO_PER_DOLLAR / 100));
+  const sign = cents < 0 ? '-' : '';
+  const abs = Math.abs(cents);
+  return `${sign}$${Math.floor(abs / 100).toLocaleString('en-US')}.${String(abs % 100).padStart(2, '0')}`;
+}
+
+function shortfallRefusal(code, { taskId, priceMicro, account, mode }) {
+  const shortfall = priceMicro - account.available_micro;
+  const at = mode === 'refuse_at_completion' ? 'marked done' : 'claimed';
+  return {
+    code,
+    task_id: Number(taskId),
+    funding_rule: mode,
+    price_micro: priceMicro,
+    balance_micro: account.balance_micro,
+    held_micro: account.held_micro,
+    available_micro: account.available_micro,
+    shortfall_micro: shortfall,
+    message: `Task ${taskId} cannot be ${at} yet: the project account cannot cover its pay. `
+      + `The task pays ${usd(priceMicro)} in cash; the project has ${usd(account.available_micro)} available `
+      + `(${usd(account.balance_micro)} on record, ${usd(account.held_micro)} already held for work in progress). `
+      + `It is ${usd(shortfall)} short.`,
+    hint: 'The project owner can add money to the project account, or change the project’s funding rule on the settings page.',
+  };
+}
+
+function unreadableRefusal(taskId, wrote, mode) {
+  return {
+    code: 'FUNDING_PRICE_UNREADABLE',
+    task_id: Number(taskId),
+    funding_rule: mode,
+    message: `Task ${taskId} pays cash, stated as "${wrote}", which is not a dollar figure. `
+      + 'The project’s funding rule checks a task’s cash pay against the project account, so it cannot be checked.',
+    hint: 'Whoever can edit the task can state its cash pay as a dollar amount (for example 250 USD), or the project owner can change the funding rule.',
+  };
+}
+
+function noAccountRefusal(taskId, mode) {
+  return {
+    code: 'FUNDING_NO_ACCOUNT',
+    task_id: Number(taskId),
+    funding_rule: mode,
+    message: `Task ${taskId} pays cash, and the project account record is switched off on this instance, so the funding rule cannot be checked.`,
+    hint: 'The project owner can turn the economy module back on, or change the project’s funding rule.',
+  };
+}
+
+// ── read half ────────────────────────────────────────────────────────────────
+
+// resolveFundingWall() → { mode, source, chosen, invalid } (resolveShipMode's shape). A
+// database that cannot be read answers the default, which is the protective rule.
+async function resolveFundingWall(deps = {}) {
+  const key = api.projectSettings.KEYS.FUNDING_WALL;
+  let row = null;
+  try {
+    row = await (deps.getSetting || api.projectSettings.get)(key);
+  } catch (err) {
+    log.error(`funding wall: project_settings read failed, using the default: ${err && err.message}`);
+    return { mode: DEFAULT_FUNDING_WALL, source: 'default', chosen: false, invalid: null };
+  }
+  if (row && row.value != null && row.value !== '') {
+    const got = parseFundingWall(row.value);
+    if (got.mode) return { mode: got.mode, source: 'project_settings', chosen: true, invalid: null };
+    return { mode: DEFAULT_FUNDING_WALL, source: 'default', chosen: false, invalid: { where: `project_settings['${key}']`, raw: String(row.value), reason: got.reason } };
+  }
+  return { mode: DEFAULT_FUNDING_WALL, source: 'default', chosen: false, invalid: null };
+}
+
+function describeFundingWall(resolved) {
+  const r = resolved || {};
+  return `${MODE_WORDS[r.mode] || MODE_WORDS[DEFAULT_FUNDING_WALL]}${r.chosen ? '' : ' (the default — the project has not chosen)'}`;
+}
+
+function accountPort(deps) {
+  return deps.account !== undefined ? deps.account : api.resolveOptional('economy.account');
+}
+
+// fundingWallFailures — the claim-time wall, called from all three claim surfaces.
+// `client` is the claim transaction (claimTask, claimTasksBatch) or the pool (the
+// validateClaimBatch dry run, `place: false`). With `place`, it takes the account lock,
+// lets go of settled holds, and HOLDS each task's price when every task passes; the
+// caller's rollback undoes the holds if a later gate refuses. Tasks are judged in the
+// order given, each against what the ones before it would hold. Returns
+// [{ task_id, refusal }] — empty for any task that pays no cash, without reading the
+// rule or the account at all.
+async function fundingWallFailures({ client, tasks, place = false, deps = {} }) {
+  const ids = (tasks || []).map((t) => String(t.id)).filter((s) => /^\d+$/.test(s));
+  if (!ids.length) return [];
+  const views = await (deps.readPayTerms || readPayTerms)(ids, { db: client });
+  const priced = ids.map((id) => ({ id, price: cashPrice(views.get(id)) })).filter((p) => p.price.cash);
+  if (!priced.length) return [];
+
+  const { mode } = await (deps.resolveFundingWall || resolveFundingWall)();
+  if (mode !== 'hold_at_claim') return [];
+
+  const account = accountPort(deps);
+  const failures = [];
+  if (!account) {
+    for (const p of priced) failures.push({ task_id: Number(p.id), refusal: noAccountRefusal(p.id, mode) });
+    return failures;
+  }
+  if (place) {
+    await account.lockAccount(client);
+    await account.releaseSettledHolds(client);
+  }
+  const snapshot = await account.readAvailable(client);
+  let committed = 0;
+  const holds = [];
+  for (const p of priced) {
+    if (p.price.unreadable) { failures.push({ task_id: Number(p.id), refusal: unreadableRefusal(p.id, p.price.unreadable, mode) }); continue; }
+    const now = { ...snapshot, held_micro: snapshot.held_micro + committed, available_micro: snapshot.available_micro - committed };
+    if (p.price.micro > now.available_micro) {
+      failures.push({ task_id: Number(p.id), refusal: shortfallRefusal('FUNDING_SHORTFALL', { taskId: p.id, priceMicro: p.price.micro, account: now, mode }) });
+      continue;
+    }
+    committed += p.price.micro;
+    holds.push(p);
+  }
+  if (place && !failures.length) {
+    for (const p of holds) {
+      await account.recordMovement(client, {
+        kind: 'hold', amountMicro: p.price.micro, taskId: p.id,
+        note: `Held at claim for task ${p.id}'s cash pay (${usd(p.price.micro)}), under the project's funding rule.`,
+      });
+    }
+  }
+  return failures;
+}
+
+// fundingWallOnResolve — inside resolveClaim's transaction, after the claim and task rows
+// are updated. A task declared done under refuse_at_completion is refused (throws) when the
+// account cannot cover it; its own hold, if it has one from an earlier rule, counts for
+// it. A task let go (any other outcome) has its hold released now rather than at the next
+// claim, so the owner's view of what is held is current.
+async function fundingWallOnResolve(client, taskId, outcome, deps = {}) {
+  const account = accountPort(deps);
+  if (outcome !== 'shipped') {
+    if (account) await account.releaseSettledHolds(client);
+    return;
+  }
+  const views = await (deps.readPayTerms || readPayTerms)([String(taskId)], { db: client });
+  const price = cashPrice(views.get(String(taskId)));
+  if (!price.cash) return;
+  const { mode } = await (deps.resolveFundingWall || resolveFundingWall)();
+  if (mode !== 'refuse_at_completion') return;
+  if (!account) throw noAccountRefusal(taskId, mode);
+  if (price.unreadable) throw unreadableRefusal(taskId, price.unreadable, mode);
+  await account.lockAccount(client);
+  await account.releaseSettledHolds(client); // as at claim: the record is current before it is read
+  const snapshot = await account.readAvailable(client, { exceptTaskId: taskId });
+  if (price.micro > snapshot.available_micro) {
+    throw shortfallRefusal('FUNDING_SHORTFALL_AT_COMPLETION', { taskId, priceMicro: price.micro, account: snapshot, mode });
+  }
+}
+
+module.exports = {
+  FUNDING_WALL_MODES, DEFAULT_FUNDING_WALL,
+  parseFundingWall, dollarsMicro, cashPrice, usd,
+  resolveFundingWall, describeFundingWall,
+  fundingWallFailures, fundingWallOnResolve,
+};

package/modules/lifecycle/module.json

@@ -47,7 +47,8 @@
     "lifecycle.kickoffSeed",
     "lifecycle.removals",
     "lifecycle.workflowDispatch",
-    "lifecycle.traffic"
+    "lifecycle.traffic",
+    "lifecycle.payTypeGates"
   ],
   "consumes": []
 }

package/modules/lifecycle/routes/claims.js

@@ -398,6 +398,11 @@ module.exports = function buildClaimsRouter() {
           err.code === 'AUTO_PICKUP_OFF' ? 409 :
           err.code === 'AUTO_PICKUP_CAP_REACHED' ? 409 :
           err.code === 'AUTO_PICKUP_ROUND_LIMIT' ? 409 :
+          // task 1003185 / ADR 0386: the project's funding wall. The body names the
+          // price, the balance, what is held and the shortfall (funding-wall.js).
+          err.code === 'FUNDING_SHORTFALL' ? 409 :
+          err.code === 'FUNDING_PRICE_UNREADABLE' ? 409 :
+          err.code === 'FUNDING_NO_ACCOUNT' ? 409 :
           500;
         // V4.R14 (#952): a TASK_NOT_READY 409 names the way forward instead of
         // leaving the caller to discover the promote route by spelunking (#506).
@@ -645,6 +650,10 @@ module.exports = function buildClaimsRouter() {
           err.code === 'NOT_YOUR_CLAIM' ? 403 :
           err.code === 'CLAIM_SESSION_MISMATCH' ? 403 :
           err.code === 'ALREADY_RESOLVED' ? 409 :
+          // task 1003185 / ADR 0386: a project that refuses completion while it is short.
+          err.code === 'FUNDING_SHORTFALL_AT_COMPLETION' ? 409 :
+          err.code === 'FUNDING_PRICE_UNREADABLE' ? 409 :
+          err.code === 'FUNDING_NO_ACCOUNT' ? 409 :
           500;
         return res.fail(err.code, status, { ...err });
       }

package/modules/lifecycle/routes/pay-type-gates.js

@@ -21,6 +21,13 @@ const log = api.logger('lifecycle');
 
 module.exports = function buildPayTypeGatesRouter() {
   const router = express.Router();
+  // The `lifecycle.payTypeGates` port (task 1004910): core's module-sale payouts ask it
+  // whether module_share is cleared (licence, takedown contact, payee onboarding) before
+  // a rule, a sale or a share moves. hasProvider-guarded so a rebuilt router never
+  // registers it twice.
+  if (!api.hasProvider('lifecycle.payTypeGates')) {
+    api.registerProvider('lifecycle.payTypeGates', { refuseUnclearedGates: gates.refuseUnclearedGates });
+  }
 
   // rank: any-builder for met/missing (the same pay information `GET /pay-terms` shows, no person's
   // money); the evidence references and who cleared each requirement are the owner's records, so

package/modules/lifecycle/routes/project-settings.js

@@ -36,6 +36,7 @@ const goalCategory = require('../goal-category');
 const autopickup = require('../autopickup');
 const payTermsLib = require('../pay-terms'); // task 1004990
 const payTypeGates = require('../pay-type-gates'); // task 1004991
+const fundingWall = require('../funding-wall'); // task 1003185
 
 const log = api.logger('lifecycle');
 
@@ -530,8 +531,10 @@ module.exports = function buildProjectSettingsRouter() {
       return res.fail('bad_task_ids', { status: 400, message: 'task_ids is a comma list of 1 to 50 task ids.' });
     }
     try {
-      const map = await payTermsLib.readPayTerms(ids);
-      res.json({ pay_terms: Object.fromEntries(map) });
+      const [map, wall] = await Promise.all([payTermsLib.readPayTerms(ids), fundingWall.resolveFundingWall()]);
+      // task 1003185 / ADR 0386: the project's funding rule rides beside the pay, so a
+      // builder sees what happens when the project runs short BEFORE claiming.
+      res.json({ pay_terms: Object.fromEntries(map), funding_wall: { mode: wall.mode, chosen: wall.chosen, sentence: fundingWall.describeFundingWall(wall) } });
     } catch (err) {
       log.error(`GET /pay-terms: ${err && err.message}`);
       res.fail('pay_terms_read_failed', { status: 500, message: 'internal error' });
@@ -564,6 +567,60 @@ module.exports = function buildProjectSettingsRouter() {
     }
   });
 
+  // --- the funding wall (task 1003185, ADR 0386) -------------------------------
+  //
+  // GET /project-settings/funding-wall — the project's rule for running short, in one
+  // plain sentence, plus the three choices. rank: any signed-in builder — a builder is
+  // owed this before claiming (ADR 0386), and it carries no balance or amount.
+  function fundingWallBody(resolved) {
+    return {
+      mode: resolved.mode, chosen: resolved.chosen, source: resolved.source, invalid: resolved.invalid,
+      sentence: fundingWall.describeFundingWall(resolved),
+      choices: fundingWall.FUNDING_WALL_MODES.map((mode) => ({ mode, sentence: fundingWall.describeFundingWall({ mode, chosen: true }) })),
+    };
+  }
+  router.get('/project-settings/funding-wall', api.requireBuilder, async (req, res) => {
+    try {
+      res.set('Cache-Control', 'no-store');
+      res.json(fundingWallBody(await fundingWall.resolveFundingWall()));
+    } catch (err) {
+      log.error(`GET /project-settings/funding-wall: ${err && err.message}`);
+      res.fail('project_settings_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // PATCH /project-settings/funding-wall — body { mode: 'hold_at_claim' | 'refuse_at_completion' | 'carry_on' }.
+  //
+  // rank: project.settings.manage (metic+, government_010), the same atom as the pay-terms
+  // write: the funding rule is part of the project's pay policy (ADR 0385 amendment), so
+  // every change also lands in the audit log (who, when, from what to what).
+  router.patch('/project-settings/funding-wall', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
+    if (api.validateOrRespond(req, res, { mode: { required: true, type: 'string' } })) return;
+    const parsed = fundingWall.parseFundingWall(req.body.mode);
+    if (!parsed.mode) return res.fail('bad_funding_wall', { status: 400, message: `mode: ${parsed.reason}` });
+    try {
+      const before = await fundingWall.resolveFundingWall();
+      await api.projectSettings.set(api.projectSettings.KEYS.FUNDING_WALL, parsed.mode, req.builder.id);
+      try {
+        await api.insertAuditLog({
+          builderId: req.builder.id,
+          route: 'project-settings:funding-wall',
+          method: 'PATCH',
+          requestBodyRedacted: JSON.stringify({ from: before.mode, to: parsed.mode }),
+          responseStatus: 200,
+          ip: req.ip || null,
+          userAgent: req.get ? req.get('user-agent') : null,
+        });
+      } catch (auditErr) {
+        log.error(`AUDIT GAP: funding wall set to ${parsed.mode} but its audit row failed: ${auditErr && auditErr.message}`);
+      }
+      res.json({ ok: true, ...fundingWallBody(await fundingWall.resolveFundingWall()) });
+    } catch (err) {
+      log.error(`PATCH /project-settings/funding-wall: ${err && err.message}`);
+      res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // --- tweak auto-pickup (task 1004677, ADR 0371 D3/D5) ----------------------
   //
   // GET /project-settings/tweak-autopickup — the switch, the monthly cap, and how

package/modules/onboarding/founding-birth.js

@@ -50,11 +50,13 @@ const { DEMO_PEOPLE, DEMO_HOURS, intIn } = genesis;
 function birthMarker(founding) {
   const f = founding && typeof founding === 'object' ? founding : {};
   const born = typeof f.birth === 'string' && Number.isFinite(new Date(f.birth).getTime());
-  if (!born) return { born: false, demo: null };
+  if (!born) return { born: false, demo: null, genesis: false };
   const people = Number(f.demoPeople);
   const hours = Number(f.demoHours);
   const demo = intIn(people, DEMO_PEOPLE[0], DEMO_PEOPLE[1]) && intIn(hours, DEMO_HOURS[0], DEMO_HOURS[1]) ? { people, hours_each: hours } : null;
-  return { born: true, demo };
+  // Genesis is paused (owner, 2026-11-01): only a birth stamped with the genesis companion starts it, so a
+  // project born before the pause, carrying a marker alone, never does.
+  return { born: true, demo, genesis: f.genesis === 'on' };
 }
 
 function markerFrom(deps) {
@@ -71,6 +73,7 @@ function markerFrom(deps) {
 async function bornFounding(deps = {}) {
   const marker = markerFrom(deps);
   if (!marker.born) return { ran: false, reason: 'no_marker' };
+  if (!marker.genesis) return { ran: false, reason: 'genesis_paused' };
   const get = deps.getSetting || require('../../src/module-api').projectSettings.get;
   const [started, ended] = await Promise.all([get(fm.KEYS.STARTED_AT), get(fm.KEYS.ENDED_AT)]);
   if (ended && ended.value) return { ran: false, reason: 'already_alive' };

package/modules/onboarding/founding-mode.js

@@ -50,6 +50,11 @@ const KEYS = Object.freeze({
   // When the planet came alive (founding switched off). With STARTED_AT it bounds the
   // window a builder must have joined in to carry the founding mark (task 1004424).
   ENDED_AT: 'founding.ended_at',
+  // Genesis is OFF unless a project turns it on (owner, 2026-11-01: not polished enough, so every
+  // project opens as the full hall). Read as ordinary 'true'; absent or anything else is OFF, which is
+  // also what pauses a project that was already mid-founding. A demo, or a project born with genesis,
+  // turns it on once at birth (founding-birth.js); the owner's own switch can follow it.
+  ENABLED: 'genesis.enabled',
 });
 
 // The key that records when a stage first became current, so a builder's join time
@@ -121,6 +126,11 @@ async function foundingModeFor(deps = {}) {
   const get = deps.getSetting || require('../../src/module-api').projectSettings.get;
   let shaped;
   try {
+    // Paused unless the project turned genesis on: the hall opens full, whatever founding.active says.
+    // Asked FIRST and alone, because this is the answer for nearly every project and every /me, so the
+    // common case is one read, not four.
+    const enabled = await get(KEYS.ENABLED);
+    if (!parseActive(enabled && enabled.value)) return null;
     const [active, stage, startedAt] = await Promise.all([
       get(KEYS.ACTIVE), get(KEYS.STAGE), get(KEYS.STARTED_AT),
     ]);

package/modules/onboarding/genesis-home.js

@@ -264,6 +264,9 @@ async function startFounding(builderId, deps = {}) {
   const s = seams(deps);
   const ended = await s.get(fm.KEYS.ENDED_AT);
   if (ended && ended.value) return { ok: false, reason: 'already_alive' };
+  // Genesis is off unless a project turns it on (task 1005035): starting it IS turning it on, whether the
+  // birth does it or the owner's own start route does, so the mode read below never answers null for it.
+  await s.set(fm.KEYS.ENABLED, 'true', builderId);
   const mode = await fm.setFoundingMode({ active: true }, builderId, modeDeps(s));
   return { ok: true, mode };
 }

package/modules/provisioning/birth.js

@@ -21,6 +21,9 @@
 // that came and went would leave a stale line behind.
 
 const BIRTH_KEY = 'founding_birth';
+// Genesis is paused (owner, 2026-11-01): only a birth stamped with this key starts it. Reserved like the
+// birth itself; a row born before the pause carries the birth alone, so it never founds.
+const GENESIS_KEY = 'founding_genesis';
 // The wizard's ship-mode answer (task 1004629): auto | manual, stamped beside the birth on
 // the row the create route just made. Reserved like the birth (out of SETTINGS_VOCAB): the
 // instance's own project_settings['ship.mode'] is where the setting LIVES and where the
@@ -36,6 +39,11 @@ function bornAt(row) {
   return ISO.test(v) && Number.isFinite(new Date(v).getTime()) ? v : '';
 }
 
+// genesisOn(row) — PURE. 'on' only for a born row stamped with genesis, else ''.
+function genesisOn(row) {
+  return bornAt(row) && storedOf(row)[GENESIS_KEY] === 'on' ? 'on' : '';
+}
+
 // demoBox(row) — PURE. A born demo's { people, hours_each }, or null. Only a row that is
 // both born and a demo carries one: an older demo has no marker and founds nothing.
 function demoBox(row) {
@@ -57,6 +65,7 @@ const bornShipMode = (row) => parseShipMode(storedOf(row)[SHIP_MODE_KEY]).mode |
 // The companion env (SETTINGS_COMPANION_ENV). src/branding.js maps them onto founding.*.
 const BIRTH_COMPANION_ENV = Object.freeze({
   FOUNDING_BIRTH: bornAt,
+  FOUNDING_GENESIS: genesisOn,
   DEMO_PEOPLE: (row) => { const d = demoBox(row); return d ? String(d.people) : ''; },
   DEMO_HOURS: (row) => { const d = demoBox(row); return d ? String(d.hours_each) : ''; },
   SHIP_MODE: bornShipMode,
@@ -67,9 +76,9 @@ const BIRTH_COMPANION_ENV = Object.freeze({
 async function stampBirth(db, instanceId, now = new Date()) {
   await db.query(
     `UPDATE provisioning_instances
-        SET settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object($2::text, $3::text)
+        SET settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object($2::text, $3::text, $4::text, 'on')
       WHERE id = $1 AND NOT (COALESCE(settings, '{}'::jsonb) ? $2::text)`,
-    [instanceId, BIRTH_KEY, now.toISOString()],
+    [instanceId, BIRTH_KEY, now.toISOString(), GENESIS_KEY],
   );
 }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.22",
+  "version": "1.24.24",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.22",
+      "version": "1.24.24",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.22",
+  "version": "1.24.24",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11021,5 +11021,49 @@
       "id": "1005034",
       "text": "New projects now open as the full hall instead of starting in the guided setup (genesis and founding mode). The guided setup is paused for now and stays available for demo projects and for test projects that ask for it. Projec"
     }
+  ],
+  "1.24.23": [
+    {
+      "id": "1005035",
+      "text": "Projects that were still in the guided setup now open as the full project instead, and no project starts the guided setup unless it is switched on for that project. Hosted projects pick this up when their version is moved forw"
+    }
+  ],
+  "1.24.24": [
+    {
+      "id": "1005039",
+      "text": "The automatic check that tax-detail records can never be deleted now tests real records, so it passes and still guards that rule."
+    },
+    {
+      "id": "1004912",
+      "text": "Every day the project now checks its money records against the payment processor's and alerts the owner if they differ. Until a payment processor is connected there is nothing to compare, so each day's check is recorded as not"
+    },
+    {
+      "id": "1003186",
+      "text": "Proved end to end that a funded project pays a builder exactly once and an underfunded one refuses with the shortfall, and closed a gap where money owed to a builder could be promised to a second task before they were paid."
+    },
+    {
+      "id": "1004911",
+      "text": "People can now take their own balance out to their bank, with a $10 minimum, holds that explain themselves, and a record of every failed try that can never pay twice."
+    },
+    {
+      "id": "1004910",
+      "text": "When a module sells, the money can now be split the way its project decides: the seller gets their share, and the people who built it share the rest by the work they recorded. Each person is paid once, only after a person appr"
+    },
+    {
+      "id": "1003185",
+      "text": "A project that cannot pay for a cash task now stops it being claimed, and says exactly how much money is missing; each project can choose that rule, stop work at completion instead, or carry on."
+    },
+    {
+      "id": "1003184",
+      "text": "The owner can now see where the project's money went: spending each month, what each builder was paid, and what is still owed but not yet paid, with the balance that is really left after those debts."
+    },
+    {
+      "id": "1004907",
+      "text": "Each person can now see their own balance and the project's, fund the project, and pay a teammate with no fee, and one project can never see or spend another's money. Nothing moves until the payment processor is connected."
+    },
+    {
+      "id": "1004908",
+      "text": "Contractors are now only paid once a signed NDA is on file and the payment processor has collected their tax details; if either is missing the payment waits and the person is told why. Bongos never stores tax numbers."
+    }
   ]
 }

package/scripts/bongos/government-walk.js

@@ -83,6 +83,7 @@ const REQUESTS = Object.freeze({
   'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
   'PATCH /project-settings/tweak-autopickup': ['PATCH', '/project-settings/tweak-autopickup', { mode: 'sometimes' }],
   'PATCH /project-settings/pay-terms': ['PATCH', '/project-settings/pay-terms', { terms: 'not a list' }],
+  'PATCH /project-settings/funding-wall': ['PATCH', '/project-settings/funding-wall', { mode: 'sometimes' }],
   'PATCH /project-settings/spend-cap': ['PATCH', '/project-settings/spend-cap', { usd: 'lots' }],
   'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
   'POST /market-watch/proposals/:id/decide': ['POST', `/market-watch/proposals/${BAD}/decide`, { decision: 'approve' }],

package/scripts/bongos/plain-cards.js

@@ -86,6 +86,24 @@ const CARDS = Object.freeze({
     'This task needs server access, which this account does not have yet.',
     'I will pick a task that can be done from here instead.',
     'The project owner, if you should have server access.', RULE),
+  // task 1003185 / ADR 0386: the project's funding rule. The message above the card
+  // names the task's pay, the money available and how far short it is.
+  FUNDING_SHORTFALL: card(
+    'This project does not have enough money set aside to pay for this task yet, and its rule is to stop new work until it does.',
+    'I will show you how far short it is and pick a task that does not need the money.',
+    'The project owner, who can add money or change the rule.', RULE),
+  FUNDING_SHORTFALL_AT_COMPLETION: card(
+    'This project does not have enough money to pay for this task yet, and its rule is that work cannot be marked done until it does.',
+    'Your work is kept as it is. I will show you how far short it is; it can be marked done once the money is there.',
+    'The project owner, who can add money or change the rule.', RULE),
+  FUNDING_PRICE_UNREADABLE: card(
+    'This task pays money, but its pay is not written as a dollar amount, so the project cannot check it can pay.',
+    'I will show you what the pay says and pick another task meanwhile.',
+    'Whoever looks after the task, to write its pay as a dollar amount.', RULE),
+  FUNDING_NO_ACCOUNT: card(
+    'This task pays money, and the record of the project’s money is switched off, so nobody can check the project can pay.',
+    'I will pick a task that does not pay money meanwhile.',
+    'The project owner, who can switch the record back on or change the rule.', RULE),
   archon_approval_required: card(
     'This goal covers a protected part of the project, so joining it needs an Archon to say yes.',
     'I will file the request for you and we pick other work while it waits.',