@bongos/core 1.24.23 → 1.24.25

package/modules/lifecycle/db-ship.js

@@ -19,6 +19,7 @@ const { THETES_GRADUATION_THRESHOLD, maybeAutoGraduateToThetes, foldWorktreeName
 const { idKey, mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
 const { LIVE_STATUSES } = require('./dead-deps.js');
 const { isPageTweak } = require('./page-tweak-hold.js');
+const { fundingWallOnResolve } = require('./funding-wall.js'); // task 1003185 / ADR 0386
 const pageTweakArtist = require('./page-tweak-artist.js');
 
 // shouldRefuseClaimResolve — may THIS caller resolve THIS claim? (task 1003767)
@@ -202,16 +203,15 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
         WHERE id = $1`,
       [claim.task_id, newTaskStatus, valueSummary ?? null]
     );
+    await fundingWallOnResolve(client, claim.task_id, outcome); // task 1003185 / ADR 0386
 
     // touches[] cleanup [7/8] (task 882): backfill touches[] from the REAL
     // committed diff at ship. The planning-time touches[] is now optional (a
     // prediction nobody has to get right up front); on a successful ship we
     // replace it with what git actually reports, so the declared set becomes
-    // reality. This is the write path that makes the touches[]-keyed profile
-    // counters (art_ships / pms_ships, see achievements + db leaderboard) and
-    // the historical record diff-accurate — closing the loop left open in #878.
-    // Only on a 'shipped' resolve with a non-empty list (never wipe touches[]
-    // with an empty diff on a DB-only / no-op ship).
+    // reality. This is the write path that makes the touches[]-keyed profile counters (art_ships /
+    // pms_ships, see achievements + db leaderboard) and the record diff-accurate (loop left open in #878).
+    // Only on a 'shipped' resolve with a non-empty list (never wipe touches[] with an empty diff on a DB-only / no-op ship).
     if (outcome === 'shipped' && Array.isArray(committedFiles) && committedFiles.length > 0) {
       const cleaned = Array.from(
         new Set(committedFiles.map((p) => String(p || '').trim()).filter(Boolean))

package/modules/lifecycle/funding-wall.js

@@ -0,0 +1,253 @@
+// modules/lifecycle/funding-wall.js — AN UNDERFUNDED PROJECT CANNOT ACCRUE PAYABLE WORK
+// (task 1003185, goal 1000092 M06; ADR 0386).
+//
+// WHY. A builder who finishes a task and only then learns the project cannot pay has
+// carried the loss alone. ADR 0386 makes the rule the PROJECT's choice, with three
+// options, and Bongos sets none of its own:
+//
+//   hold_at_claim         (the default) a claim is refused when the project's available
+//                         balance cannot cover the task's cash pay; otherwise that pay is
+//                         HELD against the balance while the task is worked, so several
+//                         claims at once cannot over-commit one balance
+//   refuse_at_completion  the task can be claimed and worked; declaring it done is
+//                         refused while the balance is short
+//   carry_on              nothing is refused; an unpaid amount is the project's own debt
+//
+// WHAT THE WALL READS. A task's price is its CASH pay terms (pay-terms.js; the task's own,
+// else the project's standing terms), and the balance is the project account's record
+// (the economy module's, through the `economy.account` port). A task with no cash term is
+// never walled: credits, equity and the other pay types have no dollar balance here
+// (ADR 0386: a non-cash wall reads the project's own terms for that pay type), and a
+// self-managed term is money Bongos never sees. That is also why switching this on
+// changes nothing for a project that pays no cash.
+//
+// EVERY REFUSAL STATES THE REASON AND THE SHORTFALL. "Insufficient balance" with no number
+// is a dead end for the owner who has to act on it, so the refusal names the task's
+// price, the balance, what is already held, and exactly how far short it is. A cash term
+// whose amount is not a dollar figure is refused as unreadable, saying what it read: a
+// guess at a number would be Bongos setting the pay.
+//
+// FAIL CLOSED. A cash-paying task under a rule that needs the account, with the account
+// record switched off, is refused: the wall cannot be checked, and an unchecked wall is
+// the loss this exists to prevent. A setting that cannot be read falls to the default.
+//
+// The check is the server's (ADR 0016). claimTask, claimTasksBatch and validateClaimBatch
+// call fundingWallFailures (the taskNeedsFailures shape); resolveClaim calls
+// fundingWallOnResolve. A hold is let go by STATE: the account counts it while its task is
+// being worked or has shipped and is not yet paid, and the next claim or resolve writes the
+// hold_release row (economy project-account.js), so no ship or pay path needs a hook.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const { readPayTerms } = require('./pay-terms');
+
+const log = api.logger('lifecycle');
+
+const FUNDING_WALL_MODES = Object.freeze(['hold_at_claim', 'refuse_at_completion', 'carry_on']);
+const DEFAULT_FUNDING_WALL = 'hold_at_claim';
+const MODE_WORDS = Object.freeze({
+  hold_at_claim: 'Hold at claim: a task that pays cash can be claimed only when the project account can cover it, and its pay is set aside until the builder is paid or the task is let go.',
+  refuse_at_completion: 'Refuse at completion: a task can be claimed and worked, but it cannot be marked done while the project account cannot cover its cash pay.',
+  carry_on: 'Carry on: work is never stopped for money. Any unpaid amount is the project’s own debt; Bongos never pays it.',
+});
+const MICRO_PER_DOLLAR = 1000000;
+
+// ── pure half ────────────────────────────────────────────────────────────────
+
+function parseFundingWall(raw) {
+  if (raw == null || String(raw).trim() === '') return { reason: 'empty' };
+  const v = String(raw).trim().toLowerCase();
+  if (!FUNDING_WALL_MODES.includes(v)) return { reason: `must be one of ${FUNDING_WALL_MODES.join(' | ')}` };
+  return { mode: v };
+}
+
+// A cash amount as dollars, or null. Only a plain figure is read ("250", "$1,250.50",
+// "USD 40"); a unit, when given, must say dollars. Anything else is not guessed at.
+const DOLLAR_UNIT = /^(usd|us\$|\$|dollars?)$/i;
+function dollarsMicro(amount, unit) {
+  if (unit != null && !DOLLAR_UNIT.test(String(unit).trim())) return null;
+  const s = String(amount == null ? '' : amount).trim().replace(/^(usd|us\$|\$)\s*/i, '').replace(/\s*(usd)$/i, '');
+  if (!/^\d{1,3}(,\d{3})*(\.\d{1,2})?$|^\d+(\.\d{1,2})?$/.test(s)) return null;
+  const [whole, cents = ''] = s.replace(/,/g, '').split('.');
+  const micro = Number(whole) * MICRO_PER_DOLLAR + Number((cents + '00').slice(0, 2)) * (MICRO_PER_DOLLAR / 100);
+  return Number.isSafeInteger(micro) ? micro : null;
+}
+
+// The task's cash price from its pay-terms view → { cash: false } | { cash: true, micro }
+// | { cash: true, unreadable: '<what the project wrote>' }.
+function cashPrice(view) {
+  const terms = ((view && view.terms) || []).filter((t) => t.pay_type === 'cash');
+  if (!terms.length) return { cash: false };
+  let micro = 0;
+  for (const t of terms) {
+    const m = dollarsMicro(t.amount, t.unit);
+    if (m == null) return { cash: true, unreadable: [t.amount, t.unit].filter(Boolean).join(' ') || 'no amount' };
+    micro += m;
+  }
+  if (!Number.isSafeInteger(micro)) return { cash: true, unreadable: 'a total too large to read' };
+  return { cash: true, micro };
+}
+
+function usd(micro) {
+  const cents = Math.round(Number(micro) / (MICRO_PER_DOLLAR / 100));
+  const sign = cents < 0 ? '-' : '';
+  const abs = Math.abs(cents);
+  return `${sign}$${Math.floor(abs / 100).toLocaleString('en-US')}.${String(abs % 100).padStart(2, '0')}`;
+}
+
+function shortfallRefusal(code, { taskId, priceMicro, account, mode }) {
+  const shortfall = priceMicro - account.available_micro;
+  const at = mode === 'refuse_at_completion' ? 'marked done' : 'claimed';
+  return {
+    code,
+    task_id: Number(taskId),
+    funding_rule: mode,
+    price_micro: priceMicro,
+    balance_micro: account.balance_micro,
+    held_micro: account.held_micro,
+    available_micro: account.available_micro,
+    shortfall_micro: shortfall,
+    message: `Task ${taskId} cannot be ${at} yet: the project account cannot cover its pay. `
+      + `The task pays ${usd(priceMicro)} in cash; the project has ${usd(account.available_micro)} available `
+      + `(${usd(account.balance_micro)} on record, ${usd(account.held_micro)} already held for work in progress). `
+      + `It is ${usd(shortfall)} short.`,
+    hint: 'The project owner can add money to the project account, or change the project’s funding rule on the settings page.',
+  };
+}
+
+function unreadableRefusal(taskId, wrote, mode) {
+  return {
+    code: 'FUNDING_PRICE_UNREADABLE',
+    task_id: Number(taskId),
+    funding_rule: mode,
+    message: `Task ${taskId} pays cash, stated as "${wrote}", which is not a dollar figure. `
+      + 'The project’s funding rule checks a task’s cash pay against the project account, so it cannot be checked.',
+    hint: 'Whoever can edit the task can state its cash pay as a dollar amount (for example 250 USD), or the project owner can change the funding rule.',
+  };
+}
+
+function noAccountRefusal(taskId, mode) {
+  return {
+    code: 'FUNDING_NO_ACCOUNT',
+    task_id: Number(taskId),
+    funding_rule: mode,
+    message: `Task ${taskId} pays cash, and the project account record is switched off on this instance, so the funding rule cannot be checked.`,
+    hint: 'The project owner can turn the economy module back on, or change the project’s funding rule.',
+  };
+}
+
+// ── read half ────────────────────────────────────────────────────────────────
+
+// resolveFundingWall() → { mode, source, chosen, invalid } (resolveShipMode's shape). A
+// database that cannot be read answers the default, which is the protective rule.
+async function resolveFundingWall(deps = {}) {
+  const key = api.projectSettings.KEYS.FUNDING_WALL;
+  let row = null;
+  try {
+    row = await (deps.getSetting || api.projectSettings.get)(key);
+  } catch (err) {
+    log.error(`funding wall: project_settings read failed, using the default: ${err && err.message}`);
+    return { mode: DEFAULT_FUNDING_WALL, source: 'default', chosen: false, invalid: null };
+  }
+  if (row && row.value != null && row.value !== '') {
+    const got = parseFundingWall(row.value);
+    if (got.mode) return { mode: got.mode, source: 'project_settings', chosen: true, invalid: null };
+    return { mode: DEFAULT_FUNDING_WALL, source: 'default', chosen: false, invalid: { where: `project_settings['${key}']`, raw: String(row.value), reason: got.reason } };
+  }
+  return { mode: DEFAULT_FUNDING_WALL, source: 'default', chosen: false, invalid: null };
+}
+
+function describeFundingWall(resolved) {
+  const r = resolved || {};
+  return `${MODE_WORDS[r.mode] || MODE_WORDS[DEFAULT_FUNDING_WALL]}${r.chosen ? '' : ' (the default — the project has not chosen)'}`;
+}
+
+function accountPort(deps) {
+  return deps.account !== undefined ? deps.account : api.resolveOptional('economy.account');
+}
+
+// fundingWallFailures — the claim-time wall, called from all three claim surfaces.
+// `client` is the claim transaction (claimTask, claimTasksBatch) or the pool (the
+// validateClaimBatch dry run, `place: false`). With `place`, it takes the account lock,
+// lets go of settled holds, and HOLDS each task's price when every task passes; the
+// caller's rollback undoes the holds if a later gate refuses. Tasks are judged in the
+// order given, each against what the ones before it would hold. Returns
+// [{ task_id, refusal }] — empty for any task that pays no cash, without reading the
+// rule or the account at all.
+async function fundingWallFailures({ client, tasks, place = false, deps = {} }) {
+  const ids = (tasks || []).map((t) => String(t.id)).filter((s) => /^\d+$/.test(s));
+  if (!ids.length) return [];
+  const views = await (deps.readPayTerms || readPayTerms)(ids, { db: client });
+  const priced = ids.map((id) => ({ id, price: cashPrice(views.get(id)) })).filter((p) => p.price.cash);
+  if (!priced.length) return [];
+
+  const { mode } = await (deps.resolveFundingWall || resolveFundingWall)();
+  if (mode !== 'hold_at_claim') return [];
+
+  const account = accountPort(deps);
+  const failures = [];
+  if (!account) {
+    for (const p of priced) failures.push({ task_id: Number(p.id), refusal: noAccountRefusal(p.id, mode) });
+    return failures;
+  }
+  if (place) {
+    await account.lockAccount(client);
+    await account.releaseSettledHolds(client);
+  }
+  const snapshot = await account.readAvailable(client);
+  let committed = 0;
+  const holds = [];
+  for (const p of priced) {
+    if (p.price.unreadable) { failures.push({ task_id: Number(p.id), refusal: unreadableRefusal(p.id, p.price.unreadable, mode) }); continue; }
+    const now = { ...snapshot, held_micro: snapshot.held_micro + committed, available_micro: snapshot.available_micro - committed };
+    if (p.price.micro > now.available_micro) {
+      failures.push({ task_id: Number(p.id), refusal: shortfallRefusal('FUNDING_SHORTFALL', { taskId: p.id, priceMicro: p.price.micro, account: now, mode }) });
+      continue;
+    }
+    committed += p.price.micro;
+    holds.push(p);
+  }
+  if (place && !failures.length) {
+    for (const p of holds) {
+      await account.recordMovement(client, {
+        kind: 'hold', amountMicro: p.price.micro, taskId: p.id,
+        note: `Held at claim for task ${p.id}'s cash pay (${usd(p.price.micro)}), under the project's funding rule.`,
+      });
+    }
+  }
+  return failures;
+}
+
+// fundingWallOnResolve — inside resolveClaim's transaction, after the claim and task rows
+// are updated. A task declared done under refuse_at_completion is refused (throws) when the
+// account cannot cover it; its own hold, if it has one from an earlier rule, counts for
+// it. A task let go (any other outcome) has its hold released now rather than at the next
+// claim, so the owner's view of what is held is current.
+async function fundingWallOnResolve(client, taskId, outcome, deps = {}) {
+  const account = accountPort(deps);
+  if (outcome !== 'shipped') {
+    if (account) await account.releaseSettledHolds(client);
+    return;
+  }
+  const views = await (deps.readPayTerms || readPayTerms)([String(taskId)], { db: client });
+  const price = cashPrice(views.get(String(taskId)));
+  if (!price.cash) return;
+  const { mode } = await (deps.resolveFundingWall || resolveFundingWall)();
+  if (mode !== 'refuse_at_completion') return;
+  if (!account) throw noAccountRefusal(taskId, mode);
+  if (price.unreadable) throw unreadableRefusal(taskId, price.unreadable, mode);
+  await account.lockAccount(client);
+  await account.releaseSettledHolds(client); // as at claim: the record is current before it is read
+  const snapshot = await account.readAvailable(client, { exceptTaskId: taskId });
+  if (price.micro > snapshot.available_micro) {
+    throw shortfallRefusal('FUNDING_SHORTFALL_AT_COMPLETION', { taskId, priceMicro: price.micro, account: snapshot, mode });
+  }
+}
+
+module.exports = {
+  FUNDING_WALL_MODES, DEFAULT_FUNDING_WALL,
+  parseFundingWall, dollarsMicro, cashPrice, usd,
+  resolveFundingWall, describeFundingWall,
+  fundingWallFailures, fundingWallOnResolve,
+};

package/modules/lifecycle/module.json

@@ -47,7 +47,8 @@
     "lifecycle.kickoffSeed",
     "lifecycle.removals",
     "lifecycle.workflowDispatch",
-    "lifecycle.traffic"
+    "lifecycle.traffic",
+    "lifecycle.payTypeGates"
   ],
   "consumes": []
 }

package/modules/lifecycle/routes/claims.js

@@ -398,6 +398,11 @@ module.exports = function buildClaimsRouter() {
           err.code === 'AUTO_PICKUP_OFF' ? 409 :
           err.code === 'AUTO_PICKUP_CAP_REACHED' ? 409 :
           err.code === 'AUTO_PICKUP_ROUND_LIMIT' ? 409 :
+          // task 1003185 / ADR 0386: the project's funding wall. The body names the
+          // price, the balance, what is held and the shortfall (funding-wall.js).
+          err.code === 'FUNDING_SHORTFALL' ? 409 :
+          err.code === 'FUNDING_PRICE_UNREADABLE' ? 409 :
+          err.code === 'FUNDING_NO_ACCOUNT' ? 409 :
           500;
         // V4.R14 (#952): a TASK_NOT_READY 409 names the way forward instead of
         // leaving the caller to discover the promote route by spelunking (#506).
@@ -645,6 +650,10 @@ module.exports = function buildClaimsRouter() {
           err.code === 'NOT_YOUR_CLAIM' ? 403 :
           err.code === 'CLAIM_SESSION_MISMATCH' ? 403 :
           err.code === 'ALREADY_RESOLVED' ? 409 :
+          // task 1003185 / ADR 0386: a project that refuses completion while it is short.
+          err.code === 'FUNDING_SHORTFALL_AT_COMPLETION' ? 409 :
+          err.code === 'FUNDING_PRICE_UNREADABLE' ? 409 :
+          err.code === 'FUNDING_NO_ACCOUNT' ? 409 :
           500;
         return res.fail(err.code, status, { ...err });
       }

package/modules/lifecycle/routes/pay-type-gates.js

@@ -21,6 +21,13 @@ const log = api.logger('lifecycle');
 
 module.exports = function buildPayTypeGatesRouter() {
   const router = express.Router();
+  // The `lifecycle.payTypeGates` port (task 1004910): core's module-sale payouts ask it
+  // whether module_share is cleared (licence, takedown contact, payee onboarding) before
+  // a rule, a sale or a share moves. hasProvider-guarded so a rebuilt router never
+  // registers it twice.
+  if (!api.hasProvider('lifecycle.payTypeGates')) {
+    api.registerProvider('lifecycle.payTypeGates', { refuseUnclearedGates: gates.refuseUnclearedGates });
+  }
 
   // rank: any-builder for met/missing (the same pay information `GET /pay-terms` shows, no person's
   // money); the evidence references and who cleared each requirement are the owner's records, so

package/modules/lifecycle/routes/project-settings.js

@@ -36,6 +36,7 @@ const goalCategory = require('../goal-category');
 const autopickup = require('../autopickup');
 const payTermsLib = require('../pay-terms'); // task 1004990
 const payTypeGates = require('../pay-type-gates'); // task 1004991
+const fundingWall = require('../funding-wall'); // task 1003185
 
 const log = api.logger('lifecycle');
 
@@ -530,8 +531,10 @@ module.exports = function buildProjectSettingsRouter() {
       return res.fail('bad_task_ids', { status: 400, message: 'task_ids is a comma list of 1 to 50 task ids.' });
     }
     try {
-      const map = await payTermsLib.readPayTerms(ids);
-      res.json({ pay_terms: Object.fromEntries(map) });
+      const [map, wall] = await Promise.all([payTermsLib.readPayTerms(ids), fundingWall.resolveFundingWall()]);
+      // task 1003185 / ADR 0386: the project's funding rule rides beside the pay, so a
+      // builder sees what happens when the project runs short BEFORE claiming.
+      res.json({ pay_terms: Object.fromEntries(map), funding_wall: { mode: wall.mode, chosen: wall.chosen, sentence: fundingWall.describeFundingWall(wall) } });
     } catch (err) {
       log.error(`GET /pay-terms: ${err && err.message}`);
       res.fail('pay_terms_read_failed', { status: 500, message: 'internal error' });
@@ -564,6 +567,60 @@ module.exports = function buildProjectSettingsRouter() {
     }
   });
 
+  // --- the funding wall (task 1003185, ADR 0386) -------------------------------
+  //
+  // GET /project-settings/funding-wall — the project's rule for running short, in one
+  // plain sentence, plus the three choices. rank: any signed-in builder — a builder is
+  // owed this before claiming (ADR 0386), and it carries no balance or amount.
+  function fundingWallBody(resolved) {
+    return {
+      mode: resolved.mode, chosen: resolved.chosen, source: resolved.source, invalid: resolved.invalid,
+      sentence: fundingWall.describeFundingWall(resolved),
+      choices: fundingWall.FUNDING_WALL_MODES.map((mode) => ({ mode, sentence: fundingWall.describeFundingWall({ mode, chosen: true }) })),
+    };
+  }
+  router.get('/project-settings/funding-wall', api.requireBuilder, async (req, res) => {
+    try {
+      res.set('Cache-Control', 'no-store');
+      res.json(fundingWallBody(await fundingWall.resolveFundingWall()));
+    } catch (err) {
+      log.error(`GET /project-settings/funding-wall: ${err && err.message}`);
+      res.fail('project_settings_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // PATCH /project-settings/funding-wall — body { mode: 'hold_at_claim' | 'refuse_at_completion' | 'carry_on' }.
+  //
+  // rank: project.settings.manage (metic+, government_010), the same atom as the pay-terms
+  // write: the funding rule is part of the project's pay policy (ADR 0385 amendment), so
+  // every change also lands in the audit log (who, when, from what to what).
+  router.patch('/project-settings/funding-wall', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
+    if (api.validateOrRespond(req, res, { mode: { required: true, type: 'string' } })) return;
+    const parsed = fundingWall.parseFundingWall(req.body.mode);
+    if (!parsed.mode) return res.fail('bad_funding_wall', { status: 400, message: `mode: ${parsed.reason}` });
+    try {
+      const before = await fundingWall.resolveFundingWall();
+      await api.projectSettings.set(api.projectSettings.KEYS.FUNDING_WALL, parsed.mode, req.builder.id);
+      try {
+        await api.insertAuditLog({
+          builderId: req.builder.id,
+          route: 'project-settings:funding-wall',
+          method: 'PATCH',
+          requestBodyRedacted: JSON.stringify({ from: before.mode, to: parsed.mode }),
+          responseStatus: 200,
+          ip: req.ip || null,
+          userAgent: req.get ? req.get('user-agent') : null,
+        });
+      } catch (auditErr) {
+        log.error(`AUDIT GAP: funding wall set to ${parsed.mode} but its audit row failed: ${auditErr && auditErr.message}`);
+      }
+      res.json({ ok: true, ...fundingWallBody(await fundingWall.resolveFundingWall()) });
+    } catch (err) {
+      log.error(`PATCH /project-settings/funding-wall: ${err && err.message}`);
+      res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // --- tweak auto-pickup (task 1004677, ADR 0371 D3/D5) ----------------------
   //
   // GET /project-settings/tweak-autopickup — the switch, the monthly cap, and how

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.23",
+  "version": "1.24.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.23",
+      "version": "1.24.25",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.23",
+  "version": "1.24.25",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11027,5 +11027,49 @@
       "id": "1005035",
       "text": "Projects that were still in the guided setup now open as the full project instead, and no project starts the guided setup unless it is switched on for that project. Hosted projects pick this up when their version is moved forw"
     }
+  ],
+  "1.24.24": [
+    {
+      "id": "1005039",
+      "text": "The automatic check that tax-detail records can never be deleted now tests real records, so it passes and still guards that rule."
+    },
+    {
+      "id": "1004912",
+      "text": "Every day the project now checks its money records against the payment processor's and alerts the owner if they differ. Until a payment processor is connected there is nothing to compare, so each day's check is recorded as not"
+    },
+    {
+      "id": "1003186",
+      "text": "Proved end to end that a funded project pays a builder exactly once and an underfunded one refuses with the shortfall, and closed a gap where money owed to a builder could be promised to a second task before they were paid."
+    },
+    {
+      "id": "1004911",
+      "text": "People can now take their own balance out to their bank, with a $10 minimum, holds that explain themselves, and a record of every failed try that can never pay twice."
+    },
+    {
+      "id": "1004910",
+      "text": "When a module sells, the money can now be split the way its project decides: the seller gets their share, and the people who built it share the rest by the work they recorded. Each person is paid once, only after a person appr"
+    },
+    {
+      "id": "1003185",
+      "text": "A project that cannot pay for a cash task now stops it being claimed, and says exactly how much money is missing; each project can choose that rule, stop work at completion instead, or carry on."
+    },
+    {
+      "id": "1003184",
+      "text": "The owner can now see where the project's money went: spending each month, what each builder was paid, and what is still owed but not yet paid, with the balance that is really left after those debts."
+    },
+    {
+      "id": "1004907",
+      "text": "Each person can now see their own balance and the project's, fund the project, and pay a teammate with no fee, and one project can never see or spend another's money. Nothing moves until the payment processor is connected."
+    },
+    {
+      "id": "1004908",
+      "text": "Contractors are now only paid once a signed NDA is on file and the payment processor has collected their tax details; if either is missing the payment waits and the person is told why. Bongos never stores tax numbers."
+    }
+  ],
+  "1.24.25": [
+    {
+      "id": "1004593",
+      "text": "A hosted project's Settings page no longer offers an unreleased version; it now offers exactly what the Upgrade page offers."
+    }
   ]
 }

package/scripts/bongos/government-walk.js

@@ -83,6 +83,7 @@ const REQUESTS = Object.freeze({
   'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
   'PATCH /project-settings/tweak-autopickup': ['PATCH', '/project-settings/tweak-autopickup', { mode: 'sometimes' }],
   'PATCH /project-settings/pay-terms': ['PATCH', '/project-settings/pay-terms', { terms: 'not a list' }],
+  'PATCH /project-settings/funding-wall': ['PATCH', '/project-settings/funding-wall', { mode: 'sometimes' }],
   'PATCH /project-settings/spend-cap': ['PATCH', '/project-settings/spend-cap', { usd: 'lots' }],
   'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
   'POST /market-watch/proposals/:id/decide': ['POST', `/market-watch/proposals/${BAD}/decide`, { decision: 'approve' }],

package/scripts/bongos/plain-cards.js

@@ -86,6 +86,24 @@ const CARDS = Object.freeze({
     'This task needs server access, which this account does not have yet.',
     'I will pick a task that can be done from here instead.',
     'The project owner, if you should have server access.', RULE),
+  // task 1003185 / ADR 0386: the project's funding rule. The message above the card
+  // names the task's pay, the money available and how far short it is.
+  FUNDING_SHORTFALL: card(
+    'This project does not have enough money set aside to pay for this task yet, and its rule is to stop new work until it does.',
+    'I will show you how far short it is and pick a task that does not need the money.',
+    'The project owner, who can add money or change the rule.', RULE),
+  FUNDING_SHORTFALL_AT_COMPLETION: card(
+    'This project does not have enough money to pay for this task yet, and its rule is that work cannot be marked done until it does.',
+    'Your work is kept as it is. I will show you how far short it is; it can be marked done once the money is there.',
+    'The project owner, who can add money or change the rule.', RULE),
+  FUNDING_PRICE_UNREADABLE: card(
+    'This task pays money, but its pay is not written as a dollar amount, so the project cannot check it can pay.',
+    'I will show you what the pay says and pick another task meanwhile.',
+    'Whoever looks after the task, to write its pay as a dollar amount.', RULE),
+  FUNDING_NO_ACCOUNT: card(
+    'This task pays money, and the record of the project’s money is switched off, so nobody can check the project can pay.',
+    'I will pick a task that does not pay money meanwhile.',
+    'The project owner, who can switch the record back on or change the rule.', RULE),
   archon_approval_required: card(
     'This goal covers a protected part of the project, so joining it needs an Archon to say yes.',
     'I will file the request for you and we pick other work while it waits.',

package/scripts/bongos/run-unit-tests.js

@@ -285,10 +285,38 @@ const INTEGRATION = new Set([
   // causeless or wrongly-directed movement, any UPDATE/DELETE/TRUNCATE, and a second row
   // for one processor reference.
   'project_account_db',
+  // task 1003185 (ADR 0386): the funding wall on the real account and pay-terms migrations —
+  // a claim holds its cash pay, a short one is refused with the shortfall, a let-go hold is
+  // released by state, and two simultaneous claims cannot commit one balance twice.
+  'funding_wall_db',
   // task 1003183: builder payouts from the real migrations — Postgres refuses a second debt
   // for one task or approval, a second sent attempt, a causeless attempt, and any rewrite;
   // the real payForTask pays once and books one payout movement.
   'builder_payouts_db',
+  // task 1003184: the owner's outflow view over the real project-account and payout
+  // migrations — paid vs owed vs approved-unbooked, gap-free months, after-commitments.
+  'project_outflow_db',
+  // task 1003186 (M07): the whole goal on the migrated schema — fund, claim, the wall's refusal
+  // and shortfall, ship, an approved payout paid exactly once, the owner's outflow, then drain.
+  'funded_project_pays_proof_db',
+  // task 1004907: user balances from the real migrations in TWO project schemas — Postgres
+  // refuses a platform fee, a self-payment, a shared account, a reused instruction, a second
+  // sent attempt and any rewrite; neither project sees or spends the other's accounts.
+  'user_balances_db',
+  // task 1004911: cash-outs from the real migrations — Postgres refuses a cash-out approval by
+  // anyone but its payee, an owner's approval spent as one, a try number the processor has not
+  // earned, a second payout on one try, anything after a cancel, and any rewrite; the real
+  // flow retries a timeout on the SAME key and a refusal or bank return on a new one.
+  'cash_outs_db',
+  // task 1004910: module-sale payouts from the real migrations — a split that does not add
+  // to the price, a second sale per reference, a second sent share, one approval paying two
+  // things are refused; the weights query and the real recordSale/payShare book once.
+  'module_payouts_db',
+  // task 1004912: the daily ledger check on the real account, member-payment and check
+  // migrations — the real store reads every sent reference, a clean day then a drift filed
+  // once, and Postgres refuses an edited check, a drift with no fingerprint or a filed alarm
+  // with no blocker.
+  'ledger_check_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/builder-payouts.js

@@ -260,5 +260,10 @@ async function listPayouts(db = defaultPool(), { limit = 50, offset = 0 } = {})
 }
 
 // One object, as payout-gates.js does: the router reaches it through an injectable default.
-const api = { PayoutRefusal, idempotencyKey, payForTask, listPayouts };
+// The helpers and constants after listPayouts are shared with module-payouts.js (task 1004910),
+// which pays a module-sale share down this same path.
+const api = {
+  PayoutRefusal, HELD_WORDS, idempotencyKey, payForTask, listPayouts,
+  inTx, withTimeout, clip, MICRO_PER_CENT, CURRENCY, TRANSFER_TIMEOUT_MS,
+};
 module.exports = api;