wicked-crew 0.7.38 → 0.7.40

package/dist/api/routes.js

@@ -20,13 +20,13 @@ import { applyWorkerConfigRoot, signedInHeuristic } from './seat-signin.js';
 import { chatSeatAdmission } from './seat-standing.js';
 import { rosterWithStandingFactory } from './roster-standing.js';
 import { ChatTurnIndex } from './chat-turns.js';
-import { ChatScopeIndex, chatScopeDeps, prepareChatScratch, removeChatScratch, resolveChatScope, } from './chat-scope.js';
+import { ChatScopeIndex, chatScopeDeps, prepareChatScratch, removeChatScratch, namedKindRefusal, resolveChatScope, } from './chat-scope.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
 import { InvalidDiffBaseError, MERGE_BASE_LITERAL, NotARegularFileError, UnresolvableDiffBaseError, branchDiff, isPlainRef, readFileCapped, worktreeDiff, } from './run-files.js';
 import { DocRunIndex } from '../interactive/doc-run-index.js';
 import { listInteractiveDocs } from '../interactive/docs-index.js';
 import { TestSetIndex } from '../qe/test-sets.js';
-import { estateExe, resolveProjectGraphBinding } from '../projects/graph.js';
+import { estateExe, parseEstateTotals, resolveProjectGraphBinding } from '../projects/graph.js';
 import { registerProjectRoutes } from '../projects/routes.js';
 import { registerCampaignRoutes } from '../campaigns/routes.js';
 import { registerGovernanceWikiRoutes } from './governance-wiki.js';
@@ -35,6 +35,7 @@ import { isSteeringAuthorRun, landSteeringProposal } from './steering-landing.js
 import { registerTestingRoutes } from './testing.js';
 import { registerSkillsRoutes } from './skills.js';
 import { disabledSkillsHealth } from '../skills/runtime.js';
+import { phaseSkillFindings, withPhaseSkillGaps } from '../skills/phase-skill-gaps.js';
 import { STATE_HOME_BLOCKER_CODE, STATE_HOME_REMEDY, isEngineStateHomeRefusal, stateHomeBlockerBody, } from '../projects/state-home-preflight.js';
 import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE, baseSkillRemedy } from '../skills/base-skill.js';
 import { noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
@@ -83,17 +84,10 @@ const STATUS_ORDER = {
 function sortActionableFirst(views) {
     return [...views].sort((a, b) => (STATUS_ORDER[a.session.status] ?? 9) - (STATUS_ORDER[b.session.status] ?? 9));
 }
-/**
- * The whole-graph counts from `wicked-estate stats --db` stdout (`nodes=N edges=M files=F …`, the
- * first line estate prints — `main.rs`'s `stats` summary). `undefined` when the line does not parse
- * (an older/newer estate, an error message): the caller leaves `CodeGraphData.totals` ABSENT.
- */
-export function parseEstateTotals(stdout) {
-    const m = /^nodes=(\d+) edges=(\d+) files=(\d+)/m.exec(stdout);
-    if (m === null)
-        return undefined;
-    return { nodes: Number(m[1]), edges: Number(m[2]), files: Number(m[3]) };
-}
+// parseEstateTotals lives in projects/graph.ts — shared with chat-scope.ts (crew#642) to avoid
+// a circular import (routes.ts → chat-scope.ts). Re-exported here for backward compat
+// (tests import it from routes.js; see top-of-file import for local use).
+export { parseEstateTotals };
 function codeGraphDbOr503(repo, reply) {
     try {
         return codeGraphDb(repo);
@@ -383,6 +377,18 @@ export const LaunchSchema = z.object({
      *  Resolved via `gh pr view` at launch — not OPEN / a fork / gh failure ⇒ 409, nothing launched.
      *  Send it only when `GET /health.capabilities.revisesPr === true` (engine ≥ 0.7.27). */
     revisesPr: z.number().int().positive().optional(),
+    /** crew#619 — the chat this run was promoted from; the daemon retains that chat's transcript
+     *  on disk until this run reaches a terminal state so the Continue-in-Build prefill is
+     *  always reproducible. Optional; omit when the launch is not promoted from a chat. */
+    chatId: z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/).optional(),
+    /** crew#632 — the surface that triggered this launch: `studio` (the web UI), `cli` (the
+     *  wicked-crew CLI), or `api` (a programmatic caller). Persisted on the `run.launched` audit
+     *  entry (`detail.channel`) and served on the run DTO; absent = origin unknown. */
+    channel: z.enum(['studio', 'cli', 'api']).optional(),
+    /** crew#632 — an opaque caller-supplied identifier for the user or system that triggered the
+     *  launch (e.g. a CI job name or a studio tab id). Persisted on the `run.launched` audit entry
+     *  (`detail.actor`) and served on the run DTO; absent = caller omitted it. */
+    actor: z.string().min(1).max(256).optional(),
 }).strict().refine((b) => b.deliver !== 'pr' || b.workflow !== undefined, {
     message: 'deliver: "pr" requires a workflow — a free-text run has no def to append the deliver phase to',
     path: ['deliver'],
@@ -514,7 +520,82 @@ export const ChatOpenSchema = z.object({
     /** File the chat into a project (`crew.chat` membership) — and, with no `repoRefs`, scope it to
      *  every registered `crew.repo` member of that project (crew#502). */
     projectId: z.string().min(1).optional(),
+    /** The scope the caller NAMES (studio#323 R4) — omitted ⇒ the legacy inference. Shape rules
+     *  (which kinds need / refuse `projectId` / `repoRefs`) are the resolver's (`chat-scope.ts`). */
+    scopeKind: z.enum(['system', 'everything', 'project', 'repo', 'repos', 'none']).optional(),
 }).strict();
+/**
+ * The `singleSeat` disclosure (crew#641, hole closed in crew#650) — built in ONE place so the 201
+ * and the 202 cannot drift.
+ *
+ * The property this field states is **"this chat has one seat; it cannot disagree with itself"**,
+ * and that is true of every one-warm-seat chat. The first cut also required `refused.length > 0`,
+ * so the case an operator is most likely to create — a chat deliberately opened with a single seat
+ * — returned `ok: true` with no signal at all, which is the exact failure mode #641 was filed
+ * about. It also made the 202 go quiet after a restart, when `refusedOf` no longer knows the
+ * refusals, even though the chat is just as single-seated as it was a minute earlier.
+ *
+ * `refused` therefore rides along as EVIDENCE when there is any — it never decides whether the
+ * caller is told.
+ *
+ * THREE states, not two (review of #658). The refusal list has a third possibility that `[]` cannot
+ * express: this daemon does not KNOW. `chatScopes.refusedOf` answers `undefined` for a chat this
+ * daemon did not open — the engine keeps the warm session across a restart, the in-memory index does
+ * not — and the first cut collapsed that to `[]` with `?? []`, which made the 202 tell an operator
+ * *"It was opened with a single seat — no other seat was refused"* about a chat that was opened with
+ * two seats, one of which was refused. Both halves false, stated confidently. It is the same
+ * distinction #651 got right for chat-promotion provenance (`.catch(() => null)`, never `[]`):
+ * unreadable and empty are different answers, and only one of them may be asserted.
+ *
+ * TWO MOMENTS, and only one route witnessed each (third review of #658). `refused` describes the
+ * daemon's record — what the OPEN (or the last re-seat) observed; `warmRoster` describes NOW. Any
+ * sentence built from both fabricates the instant they diverge, and they diverge routinely: a seat
+ * that blows its turn budget is RELEASED by the engine (`chat-turns.ts`), a re-seat clears an entry
+ * from the record, a restart drops the record entirely. A chat opened with `['claude','opencode']`
+ * — both warm, nothing refused, nothing unknown — whose `opencode` is later released would have been
+ * told *"It was opened with a single seat — no other seat was refused"*: false in both halves, with
+ * no `undefined` anywhere near it. So `at` names the moment the caller is asking about:
+ *
+ *   • `'open'` — the 201. This route just performed the open, so it is the ONLY one with standing to
+ *     describe it: refusals known and empty ⇒ it may say the chat was opened with a single seat.
+ *   • `'turn'` — the 202. It knows the roster NOW and the refusal record; it knows nothing about how
+ *     the chat came to look like this. Refusals known and empty ⇒ it says NOTHING about opening.
+ *     It still names refusals that are on record, and still says so when the record is unavailable —
+ *     both are statements about the record it holds, not about a moment it did not see.
+ *
+ * `refusalsKnown` carries the known/unknown distinction for a machine reader, because `refused: []`
+ * is exactly as ambiguous on the wire as the sentence was in prose.
+ */
+function singleSeatDisclosure(warmed, 
+/** `undefined` = this daemon has no refusal record for the chat (it did not open it). */
+refused, 
+/** Which moment the caller is asking about — see the note above; only `'open'` may describe one. */
+at) {
+    const known = refused !== undefined;
+    const list = refused ?? [];
+    const refusalClause = list.length > 0
+        ? `Refused: ${list.map((r) => `${r.cliKey} (${r.reason})`).join('; ')}. `
+        : known
+            ? at === 'open'
+                ? 'It was opened with a single seat — no other seat was refused. '
+                : // A turn has no standing to say how the chat was opened: this seat may be the survivor of
+                    // a two-seat chat whose other seat was released mid-session. Say nothing.
+                    ''
+            : 'This daemon holds no refusal record for this chat — it was opened before a restart — so ' +
+                'whether another seat was refused is UNKNOWN: the empty refused[] means the record is gone, ' +
+                'not that nothing was refused. ';
+    return {
+        degraded: true,
+        warmed,
+        refused: list,
+        refusalsKnown: known,
+        message: 
+        // "warm" on a turn: the claim is about the roster as it stands, not about how it got there.
+        `This chat has one ${at === 'open' ? 'seat' : 'warm seat'} (${warmed}); it cannot disagree with itself. ` +
+            refusalClause +
+            'The single-seat root cause is tracked as wicked-core#563; this chat makes it visible.',
+    };
+}
 export function registerRoutes(app, adapter, gateCache, elicitationCache, 
 // Defaulted so a caller that never arms the bus seam (tests drive this
 // function directly) gets the same behavior as an unarmed daemon: an empty
@@ -661,6 +742,10 @@ runtime = {}) {
         const guidance = guidanceIndex.guidanceFor(view.session.id);
         if (guidance !== undefined)
             view.session.guidance = guidance;
+        // crew#661: the declared skills this run's phases ran WITHOUT (degrade-and-disclose) — ABSENT when none.
+        const skillGaps = runtime.runSkillGaps?.gapsFor(view.session.id);
+        if (skillGaps !== undefined)
+            view.session.skill_gaps = skillGaps;
         // Run launch time (home command-center run metrics): unix SECONDS from the `run.launched`
         // audit entry, ABSENT when the daemon has no launch record for this run (onboarding/campaign
         // runs launched off POST /runs, pre-field runs) — never fabricated, so a bucketed KPI can
@@ -673,10 +758,24 @@ runtime = {}) {
         const endedAt = runTimingIndex.endedAtFor(view.session.id);
         if (endedAt !== undefined)
             view.session.ended_at = endedAt;
+        // crew#632: launch surface and caller identity — served ABSENT when absent, never null.
+        const channel = runTimingIndex.channelFor(view.session.id);
+        if (channel !== undefined)
+            view.session.channel = channel;
+        const launchActor = runTimingIndex.launchActorFor(view.session.id);
+        if (launchActor !== undefined)
+            view.session.launch_actor = launchActor;
         const state = resolveDelivery(view, conflictStrand);
         view.session.delivery = state.delivery;
         if (state.deliverUrl !== undefined)
             view.session.deliverUrl = state.deliverUrl;
+        // crew#641/#642 (item 5): chat promotion provenance — ABSENT when not a chat-promoted run.
+        const chatSeatCount = runTimingIndex.chatSeatCountFor(view.session.id);
+        if (chatSeatCount !== undefined)
+            view.session.chat_seat_count = chatSeatCount;
+        const chatGrounded = runTimingIndex.chatGroundedFor(view.session.id);
+        if (chatGrounded !== undefined)
+            view.session.chat_grounded = chatGrounded;
         return view;
     };
     // Resolved ONCE and shared by the project routes (which read/write `interactiveRoot`) and the
@@ -700,7 +799,7 @@ runtime = {}) {
         // probe honestly reports no gate.
         const capabilities = typeof adapter.engineCapabilities === 'function'
             ? adapter.engineCapabilities()
-            : { deliverGate: false, revisesPr: false };
+            : { deliverGate: false, revisesPr: false, chatIdOnLaunch: false, seatChipOnCreate: false };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
         // launch while the state home holds an entry the worker Read fence cannot classify. Re-surveyed
@@ -716,9 +815,12 @@ runtime = {}) {
         // `baseSkill.finding` and `/diagnostics.skills.findings[]` (one surface, no new field;
         // `HealthWarning.kind` is open); status stays ok because the daemon serves and studio must load
         // and show it — exactly the state-home blocker's precedent above.
+        // crew#661: a drafting seam that armed WITHOUT its declared skill rides `warnings` as well — its
+        // runs proceed degraded, so "status ok, no warnings" would be the silent answer the issue names.
         const warnings = [
             ...(stateHome === null ? [] : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }))),
             ...(baseSkill?.finding ? [{ kind: baseSkill.finding.kind, severity: baseSkill.finding.severity, message: baseSkill.finding.message }] : []),
+            ...phaseSkillFindings(runtime.phaseSkills?.gaps() ?? []),
         ];
         return {
             status: 'ok',
@@ -771,7 +873,9 @@ runtime = {}) {
             // The skills seam's last outcome (skills keystone): published / fallback / blocked /
             // config-error, with the `skills.*` findings the ladder produced — the operator's one
             // read-only answer to "why do launches refuse the snapshot".
-            skills: runtime.skills?.health() ?? disabledSkillsHealth(),
+            // crew#661: plus every subsystem whose phases ARMED without a declared skill (`phaseSkillGaps`,
+            // one `skills.phase-skill` finding each) — the degraded runs' operator-facing record.
+            skills: withPhaseSkillGaps(runtime.skills?.health() ?? disabledSkillsHealth(), runtime.phaseSkills),
             // Is the governance evidence LANDING (crew#495): the store, the records on it, the dead
             // letters — with a `governance.deadletter` finding the moment the outbox holds one.
             governance,
@@ -1293,6 +1397,23 @@ runtime = {}) {
         }
         try {
             const runId = await adapter.launchRun(input);
+            // crew#641/#642 (item 5): when a run is promoted from a chat, record how many seats
+            // participated and whether the chat was grounded — so an intent authored by a single
+            // ungrounded model is distinguishable from one that survived a disagreement.
+            let chatSeatCount;
+            let chatGrounded;
+            // Both stay ABSENT unless the chat actually resolves: a closed or unknown chatId must read as
+            // "provenance unavailable", not as "promoted from an ungrounded zero-seat chat". A valid chat
+            // always has at least one warm seat (`crew-api-types` ChatOpenResponse), so 0 is not a value
+            // `chat_seat_count` can honestly hold.
+            if (b.chatId !== undefined) {
+                const promotedFrom = await adapter.chatSeats(b.chatId).catch(() => null);
+                const scope = chatScopes.engineOf(b.chatId);
+                if (promotedFrom !== null && promotedFrom.length > 0 && scope !== undefined) {
+                    chatSeatCount = promotedFrom.length;
+                    chatGrounded = scope.codeGraphDb != null;
+                }
+            }
             // Who launched it — the engine's LaunchOptions carries no actor field
             // (checked, wicked-core-ts 0.6.0), so the crew-side trail is the system
             // of record for run provenance (task #88).
@@ -1322,7 +1443,20 @@ runtime = {}) {
                 // the group index (and a restarted daemon's hydrate) reads it back from here.
                 ...(b.campaignId !== undefined ? { campaignId: b.campaignId } : {}),
                 ...(b.groupLabel !== undefined ? { groupLabel: b.groupLabel } : {}),
+                // crew#619: the chat↔run link is durable so the retention maps can be rehydrated after a
+                // daemon restart (rehydration reads `run.launched` entries and keeps non-terminal entries).
+                ...(b.chatId !== undefined ? { chatId: b.chatId } : {}),
+                // crew#641/#642 (item 5): chat promotion provenance — seat count and grounding at launch.
+                ...(chatSeatCount !== undefined ? { chatSeatCount } : {}),
+                ...(chatGrounded !== undefined ? { chatGrounded } : {}),
+                // crew#632: launch surface and caller identity — human-readable provenance on the audit trail.
+                ...(b.channel !== undefined ? { channel: b.channel } : {}),
+                ...(b.actor !== undefined ? { actor: b.actor } : {}),
             });
+            // Stamp the index live so the field is served without waiting for a daemon restart.
+            if (chatSeatCount !== undefined && chatGrounded !== undefined) {
+                runTimingIndex.setChatPromotion(runId, chatSeatCount, chatGrounded);
+            }
             if (b.retryOf !== undefined)
                 retryIndex.set(runId, b.retryOf);
             if (revisesPr !== undefined)
@@ -1341,6 +1475,10 @@ runtime = {}) {
                 // decision #6 replaces spoofable actor strings on the event surface.
                 { project_id: b.projectId, member: { kind: 'crew.run', ref: runId }, actor: actorOf(req).id }, membershipAttachedKey(b.projectId, 'crew.run', runId, Date.now()));
             }
+            // crew#619: retain the chat transcript for the run's lifetime so Continue-in-Build prefill
+            // is always reproducible even if the chat is idle-reclaimed before the run finishes.
+            if (b.chatId !== undefined)
+                runtime.linkChatRun?.(b.chatId, runId);
             return reply.code(201).send({ runId });
         }
         catch (err) {
@@ -1797,6 +1935,12 @@ runtime = {}) {
         }
         const b = parsed.data;
         const chatId = b.chatId ?? randomUUID();
+        const requestedRefs = [...(b.repoRef !== undefined ? [b.repoRef] : []), ...(b.repoRefs ?? [])];
+        // A named scope's SHAPE first (studio#323 R4, codex on #664): a body whose kind refuses its own
+        // projectId/repoRefs is a 400 — never masked by the project lookup's 404/409 below.
+        const shape = namedKindRefusal(b.scopeKind, b.projectId, [...new Set(requestedRefs)]);
+        if (shape !== null)
+            return reply.code(400).send({ error: shape.error });
         // Validate the project BEFORE opening seats: a chat has no launch record for the engine to
         // attach against atomically (chats are an in-memory seat pool), so the route validates
         // up-front and attaches right after open — the one non-atomic attach, documented in the ADR
@@ -1837,8 +1981,14 @@ runtime = {}) {
             const resolution = await resolveChatScope({
                 chatId,
                 ...(b.projectId !== undefined ? { projectId: b.projectId } : {}),
-                repoRefs: [...(b.repoRef !== undefined ? [b.repoRef] : []), ...(b.repoRefs ?? [])],
-            }, { ...chatScopeDeps(adapter), scratchBase: chatScopes.base, log: (m) => req.log.warn(m) });
+                repoRefs: requestedRefs,
+                ...(b.scopeKind !== undefined ? { kind: b.scopeKind } : {}),
+            }, {
+                ...chatScopeDeps(adapter),
+                scratchBase: chatScopes.base,
+                log: (m) => req.log.warn(m),
+                ...(runtime.entityCount !== undefined ? { entityCount: runtime.entityCount } : {}),
+            });
             if (!resolution.ok) {
                 chatScopes.release(chatId, token);
                 return reply.code(resolution.status).send({
@@ -1866,7 +2016,10 @@ runtime = {}) {
             // here is NAMED on the response (`refused`) and in the thread (`chatSeatRefused`), so a
             // person can see why pi is missing. Explicit `clis` are passed through as asked; the engine
             // refuses per seat with its reason, which is copied into `refused` too.
-            const scoped = scope.kind !== 'none';
+            // A chat is SCOPED — held to read-only roots — when it reads repositories by its kind. `none`
+            // and `system` (studio#323 R4: the platform itself, no repository) read none, so they take the
+            // unscoped admission and open on an engine that predates chat scope.
+            const scoped = scope.kind !== 'none' && scope.kind !== 'system';
             const refused = [];
             // The standing roster, read ONCE: the default admission below and the engine-drop
             // attribution after `chatOpen` both consult it (F-A45-011).
@@ -2019,6 +2172,12 @@ runtime = {}) {
                         error: `chat ${chatId} was closed while it was being opened; open it again`,
                     });
                 }
+                // Register roots for path rewriting (crew#618): absolute host paths in seat replies are
+                // rewritten to repo-relative form before being stored in the transcript.
+                if (chatTranscripts !== undefined && scope.repos.length > 0) {
+                    const roots = scope.repos.map((r) => ({ absRoot: resolve(r.rootPath), name: r.name }));
+                    chatTranscripts.registerRoots(chatId, roots);
+                }
                 // The thread learns of every refused seat the way it learns of everything else — a frame
                 // on /ws — AFTER the scope is published, so a reader never sees a refusal for a chat it
                 // cannot yet look up.
@@ -2032,12 +2191,17 @@ runtime = {}) {
                         ...(b.projectId !== undefined ? { project_id: b.projectId } : {}),
                     });
                 }
+                // crew#641: a chat with exactly ONE warm seat cannot disagree with itself — disclosed
+                // prominently so the caller does not have to reason about the refused[] array.
+                const warm = seats.filter((s) => s.ok);
+                const singleSeat = warm.length === 1 ? singleSeatDisclosure(warm[0].cliKey, refused, 'open') : undefined;
                 return reply.code(201).send({
                     chatId,
                     seats,
                     scope,
                     refused,
                     ...(projectAttachError !== undefined ? { projectAttachError } : {}),
+                    ...(singleSeat !== undefined ? { singleSeat } : {}),
                 });
             }
             catch (err) {
@@ -2088,7 +2252,12 @@ runtime = {}) {
         // warm seats — so the turn can be opened BEFORE the engine call, in the same tick as the
         // predicate below: two racing sends can no longer both pass `inFlight` during the await, and a
         // `chatDelta` that lands before `chatSend` resolves is already stamped with its `turn_id`.
-        const audience = parsed.data.targets ?? (await adapter.chatSeats(id));
+        // crew#641 (review): the ROSTER and the AUDIENCE are different things and only one of them can
+        // answer "can this chat disagree with itself". Resolved ONCE here: `audience` is who this turn
+        // goes to (the named targets, else everyone warm), `warmRoster` is who is warm at all. A
+        // targeted send to one seat of a two-seat chat is not a degraded chat.
+        const warmRoster = await adapter.chatSeats(id);
+        const audience = parsed.data.targets ?? warmRoster;
         if (audience.length === 0) {
             return reply.code(409).send({ error: `chat '${id}' has no warm seats — open it first` });
         }
@@ -2106,7 +2275,22 @@ runtime = {}) {
                 chatTurns.reconcile(id, turn.turnId, seats);
                 chatTranscripts?.appendUser(id, turn.turnId, parsed.data.text, seats);
             }
-            return reply.code(202).send({ seats, ...(turn !== null ? { turnId: turn.turnId } : {}) });
+            // crew#641: re-state single-seat degradation on every turn so it is visible in the transcript.
+            // Decided from `warmRoster` — the seats that are WARM — never from `seats`, which is only the
+            // seats this turn reached: a targeted send to one seat of a two-seat chat would otherwise
+            // announce a degradation that does not exist, and a false "you are degraded" sends an operator
+            // after a problem they do not have.
+            // crew#650: `refusedOf` is `undefined` for a chat THIS daemon did not open (a restart drops
+            // the index) — that is "the refusals are unknown", not "the chat gained a seat". The
+            // disclosure is decided by the warm roster alone, and the `undefined` is handed STRAIGHT to
+            // the builder (never `?? []`, review of #658): only it may decide what an unknown record is
+            // allowed to claim.
+            const singleSeat202 = warmRoster.length === 1 ? singleSeatDisclosure(warmRoster[0], chatScopes.refusedOf(id), 'turn') : undefined;
+            return reply.code(202).send({
+                seats,
+                ...(turn !== null ? { turnId: turn.turnId } : {}),
+                ...(singleSeat202 !== undefined ? { singleSeat: singleSeat202 } : {}),
+            });
         }
         catch (err) {
             // Nothing went out: the reservation is retracted so the next send is not refused for it.
@@ -4136,6 +4320,8 @@ runtime = {}) {
         settings: projectSettings,
         pool: interactiveBridges,
         ...(runtime.docGrounding !== undefined ? { grounding: runtime.docGrounding } : {}),
+        // crew#631: supply the standing roster so doc/demo creates can refuse an unavailable seat.
+        roster: () => rosterWithStanding(),
         log: (m) => app.log.warn(m),
     });
     // ── Governed doc delete (crew#338) — the one door that changes BOTH stores ──