[HugoXK]

Fixes #2041

Owner: Dev-1
Written-by: Dev-1
Reviewer: Birfy
Claim-Id: 95933d41dc0c46eca230c105c4174339

What changed

The board listed a Project's decision files as inert rows — data-path and data-sha256, no click target, no link — so a person could see that a decision existed and could not open it. A row is a button now, and activating it draws that one file's text under the row; activating it again closes it, and another row replaces it. A button needs no tabIndex, so keyboard focus and activation work.

Host (core/src/host/project-board.js):

• rt.projectDecision(projectId, name, actor) answers the reader's own three states for one name: the text with bytes/sha256/mtime, absent: <path>, or too large: <path> is N bytes (bound 200000).
• The accepted set is the listing the last projectBoard read of that Project produced. decisionsOf hands known back as a map of path → the folder that path was read from, and that map is kept per Project. It is the un-truncated dedupe, so a name past the 200-row cut opens as well, and a decision a meeting archived into a folder of its own is read from that folder rather than the Project folder.
• A name outside the set answers not listed: … before any stat or open. isDecisionPath (Refuse a decision name that leaves decisions/ and stop project_state following a symlink #2038) is the first check, so decisions/../outside.md, an absolute path and a name one level down never reach the disk at all; the set is what refuses a legal-looking name the listing skipped, such as a symlink.
• Who may open one. The text sits behind the same door as the cards (core: the project-board endpoint never sees the actor — a member can read another member's Project cards #1723): the board already answers tasks: [] for a member who cannot see a Project's cards, and its decisions must not answer instead. The actor travels with the id from store.js (channel.js untouched), and visibility is worked out per call, in memory, before anything is opened — the per-Project cache holds names and folders only, never one member's view of them, so one reader cannot lend their reach to the next caller and a revoked card takes effect on the next open. A name a decided meeting archived follows that meeting's own cards through rt.taskVisible, the rule the board paints them with; a plain record has no card, so the Project's role list decides (roleOf: owner, maintainer or member). The chain has three steps, in this order and on purpose: the cards decide when the name has cards; a meeting-linked name whose taskIds is empty, or whose cards are all gone, falls to that same Project role list — the cards are the only thing that carried visibility, and a record that lost them must not read as visible to nobody, so the deliberate consequence is that such a name is exactly as open as a plain record and no wider; and anything that cannot be judged at all — no taskVisible, no Project record — refuses rather than allows. A caller who may not open a name is answered with exactly the sentence a name the listing never had is answered with, so the refusal cannot be read as a list of what exists.
• The byte read is readListedFile in core/src/host/project-state.js, extracted from readProjectState: the 200,000-byte bound and the lstat rule (a symlink answers absent) are one implementation for both readers, and project_state's own answers are unchanged.

Endpoint wiring: project-decision in store.js, dispatched in channel.js beside project-board, listed in authz.js's TASK_ENDPOINTS beside it. Client (core/src/client/project-board.js): ProjectBoardRecord keeps one open path, asks call('project-decision', { id, path }), and draws a pre for the body or the host's own sentence for absent / too large / not listed under a data-open-decision block — the answer is text, never markup it contains. An answer that lands after another row was opened is dropped rather than painted under the row now open. Two copy keys with zh entries.

Red first

Base 3eca1e54 sources with only the two new test files added, cd core && node --import ./test/harness-resolve.mjs --test test/project-board.test.js test/project-board-view.test.js — 81 tests, 68 pass, 13 fail, the same three runs in a row:

test	red shape
#2041: activating a decision row…	expected: 'button', actual: 'div'
#2041: a second activation collapses…	TypeError: rowAt(...).props.onClick is not a function
#2041: each refused answer reads its own sentence…	same TypeError
#2041: an answer that lands after another row opened…	same TypeError
#2041: the overlay hands the board its own read…	the board draws the decision row — no row exists to click
#2041: a decision the board listed opens with its text	the call answers {"ok":false,"error":{"code":"bot/not-found","message":"Unknown endpoint project-decision","details":{}}}, so false !== true
#2041: a name the board did not list…	TypeError: rt.projectDecision is not a function
#2041: a listed decision over the bound…	same TypeError
#2041: a decision past the 200-row cut…	same TypeError
#2041: a decision deleted after the board listed it…	same TypeError
#2041: a decision a meeting archived…	same TypeError
#2041: a decision text is answered only to a caller who can see the Project	the endpoint is unknown, so false !== true
#2041: revoking a card closes the name a board read already cached	same

The client case that answers a refusal walks all three the reader has — too large, not listed and absent — and each has to read as the host's sentence, whole, with the row still a row.

The four refused names in the second case are decisions/../outside.md, an absolute path, decisions/sub/2026-10-30-deep.md and a symlink with a legal name; each must answer not listed: …, carry no text, and the ../ one points at a file over the bound, so too large would be the answer if the host had stat'd it — it is not listed, which is the proof the disk was never touched.

Mutations (each applied alone, then reverted)

• A — ignore the listed folder map, read from folderOf(project): 80/81, red on a name the board did not list… (the symlink answers absent): the set, not the name shape, is what refuses a legal-looking name.
• B — keep only the rows the 200-row cut kept (decisions.files): 74/81, red on seven cases — the listing-to-open path, the bound, the past-cut name, the deleted one, the archived one, and both caller cases.
• C — drop the MAX_BYTES check in readListedFile: 83/86 together with test/project-state.test.js, red on the board's over the bound, on the caller case and on the reader's own #1702 read one returns its bytes, bounded — the bound is shared, so breaking it once breaks both.
• D — drop the late-answer guard (settle writing into whichever row is open): 32/33 on test/project-board-view.test.js, red on an answer that lands after another row opened is never drawn. Before this test existed the same arm ran 33/33 green, which is why the guard had no evidence behind it.
• E — remove call: read from the pane the overlay builds: 32/33, red on the overlay hands the board its own read, so a row opens through it — without that line the panel's call is undefined and an activation returns silently.
• F — no visibility check at all: 79/81, red on both caller cases, so the door is what the tests measure and not an unused predicate.

Verified at the tip

• Base 3eca1e54261ea22b211e93884e26ea5d578bacb5; local commit c7a3291c50c32f8087e5040a02fd479b27ec6144, tree f7139a1c4c1e5c4b276cbcb7fe86b57c29625f98; the pushed head is rebuilt from that same tree by the push path, so both trees are identical. One commit, 23 files, +1349/−121.
• TZ=UTC ARCH_DOCS_BASE=3eca1e54 npm run verify → exit 0: core 2492/2492, social 541, tree 127, timeline 135, workflow 336, .github 563, interop 37, live-e2e 24; arch-docs: OK (23 changed file(s)); lint 73/36/9/2/16 warnings and 0 errors, plus interop 1 and live-e2e 0; build-client --check exit 0.
• node scripts/ds-bot-patches.mjs check → pin 2b10c70 ok, 10 patches apply cleanly in order, core/ equals ds-bot/ + patches/ds-bot/; canonical → generate is a no-op; generate re-run on this tip changed no path (git status --porcelain empty apart from one untracked dependency symlink this worktree links in), and the tree did not move.

Generated set — what moved and why

This branch is rebased on 3eca1e54, which already carries #2040's and #2044's own regeneration of client.js and 0008, so every number here is this change's delta against that base.

generate rewrote the files/ mirrors of the five edited files (src/host/project-board.js, src/host/project-state.js, src/host/authz.js, src/client/project-board.js and both test files) and core/client.js.

Three patches gained exactly one hunk each, and nothing else in them moved — the endpoint has to be dispatched from store.js and channel.js, which those patches already carry:

patch	inner file	delta	which
0002	src/host/store.js	@@ -160,13 +160,489 @@ → @@ -160,13 +160,497 @@ at patch line 1013	re-aligned hunk header only
0002	src/host/store.js	+8 lines at patch line 1444	mine — the project-decision case (2 comment + 6 code)
0005	src/host/channel.js	@@ -319,32 +319,135 @@ → @@ -319,32 +319,136 @@ at line 844	re-aligned hunk header only
0005	src/host/channel.js	+1 line at line 874	mine — case 'project-decision':
0001	src/client/i18n.js	@@ -41,22 +41,74 @@ → @@ -41,22 +41,76 @@ at line 751	re-aligned hunk header only
0001	src/client/i18n.js	+2 lines at line 808	mine — the two zh entries

0008 is the client bundle, one inner diff (client.js), and it moved as a whole: +128/−90. That is representation drift — inserting the new row markup and the open block moves the diff's own anchors — not extra content: what 0008 produces is core/client.js byte for byte (core/ equals ds-bot/ + patches/ds-bot/ above), and that file's own delta against the base is +50/−7, the client change itself. 0003/0007/0009/0012/0014/0016 are byte-identical to the base.

What I did not run

• The smoke bench (core/dev/bench.sh smoke): it needs the deepseek-harness checkout, which this worktree does not have. The host change is a read endpoint beside project-board and project-state; nothing in index.js or the turn/agent path moved.
• The CI package job (pack check, typecheck, actionlint) — verify does not run it.

Deliberately out of scope

Editing a decision, more than one open at a time, search, and any change to how decisions are written (the issue's own scope). The endpoint never re-lists the folder: a file created after the last board read answers not listed until the board polls again (≤5 s), which is the price of the set being "the listing this board produced" rather than a second, wider read path; closing a row and opening it again re-reads that one file (one lstat and one read, no directory re-list), so a file edited in the meantime is shown as it is now. The rows themselves stay as they are: project-board sends the decision listing to any signed-in actor (#1723 leaves it that way), which is a recorded residual of #2038, not something this change widens — what this change narrows is the text behind a row.

Checkpoint

{
  "pr": 2046,
  "issue": 2041,
  "claim": "Dev-1",
  "summary": "A decision row on the Project board was inert; it is a button now, and activating it draws that one file's text under the row. The host adds rt.projectDecision, which opens a listed name only when the caller may see it: a meeting's decision follows that meeting's cards, a plain record follows the Project's roles, and anyone else gets the not listed sentence a missing name gets. The byte read is readListedFile, shared with project_state, so the bound and the symlink rule cannot drift. The endpoint is wired through store, channel and authz, and the client draws the body or the refusal.",
  "files": [
    "core/src/host/project-board.js",
    "core/src/host/project-state.js",
    "core/src/host/store.js",
    "core/src/client/project-board.js",
    "core/test/project-board.test.js",
    "core/test/project-board-view.test.js",
    "core/src/host/authz.js",
    "docs/subsystems/core-host.md"
  ],
  "checks": {
    "ran": "TZ=UTC ARCH_DOCS_BASE=3eca1e54 npm run verify; generate x2 + check + canonical; build-client --check; red first on 3eca1e54 with tests only",
    "result": "green",
    "at": "2c7b70a6c76bb926aed1e9a0dd338595220392db"
  },
  "next": "none — ready for review; Test and Security are named by the Lead."
}

[Birfy]

Verdict: PASS at dc781ad
Written-by: Reviewer
Attestation: dc781ad role=Reviewer

Ran at this tip:

$ cd p2046tip/core && DSH_HARNESS=/opt/flybot TZ=UTC node --import ./test/harness-resolve.mjs --test test/project-board.test.js test/project-board-view.test.js
# tests 77  # pass 77  # fail 0
$ cd p2046tip/core && DSH_HARNESS=/opt/flybot TZ=UTC node --import ./test/harness-resolve.mjs --test test/project-state.test.js
# tests 5  # pass 5  # fail 0
$ for f in src/host/project-board.js src/host/project-state.js src/host/authz.js src/host/channel.js src/host/store.js src/client/project-board.js; do cp ../p2046base/core/$f ./$f; done && DSH_HARNESS=/opt/flybot TZ=UTC node --import ./test/harness-resolve.mjs --test test/project-board.test.js test/project-board-view.test.js
# tests 77  # pass 68  # fail 9

Red first: the six changed sources (core/src/host/project-board.js, core/src/host/project-state.js, core/src/host/authz.js, core/src/host/channel.js, core/src/host/store.js, core/src/client/project-board.js) were put back to their base blobs dfc4af7a, the two test files untouched, and the suite turned red 77/68/9. The nine failures are exactly the new cases: activating a decision row asks for that row and draws its text under it, a second activation collapses the open decision, one row at a time, each refused answer reads its own sentence, never the markup it carries, a decision the board listed opens with its text, a name the board did not list answers not listed and is never read, a listed decision over the bound answers too large and hands over no text, a decision past the 200-row cut still opens, a decision deleted after the board listed it answers absent, a decision a meeting archived opens from the folder the listing read it in. The tree was restored to the tip and is 77/77 plus 5/5 in test/project-state.test.js again.

Why it is right: rt.projectDecision (core/src/host/project-board.js:...) checks isDecisionPath(name) first, then the per-Project readings map — the un-truncated dedupe of the last projectBoard read, path → the folder it was read from — and only then calls readListedFile(dir, name); a name outside that set answers not listed: … without a stat or open, so decisions/../outside.md, an absolute path, a name one level down and a legal-looking symlink never reach the disk. The byte read is the extracted readListedFile in core/src/host/project-state.js, so the 200000-byte bound and the lstat rule (a symlink answers absent) are one implementation for the board and project_state, whose own answers are unchanged (5/5). The endpoint is wired in store.js, channel.js beside project-board and authz.js's TASK_ENDPOINTS; the client keeps one open path and draws the host's text in a pre (never markup the answer carries) under a data-open-decision block, with two zh keys.

Scope (compare dfc4af7a...dc781ad8, 1 commit, ahead 1 / behind 0, 23 files, +1122/−408) matches the PR exactly: the six sources, two test files, core/client.js, i18n.js, two docs pages, the changelog.d/2041-… entry and the regenerated patches/ds-bot/** mirrors, 0001/0002/0005 one hunk each plus 0008's bundle re-diff. No unrelated file.

CI at this tip: 15 check-runs, one red and it is the expected one — enqueue-guard failure, which this PASS is what it waits for. tests-ok, merge-gate, judge, package, risk tier (report only), reviewed tip (report only), agent-audience, plugins (*) and both Node jobs are all success. No hold, no review yet.

Metadata: Fixes #2041, Owner: Dev-1, Written-by: Dev-1, Reviewer: Birfy, Claim-Id present; no agent-pr label — not asked of a fork head. Checkpoint block present and within the cap (1365 chars, summary 582, 9 files, next 65).

[HugoXK]

@Birfy review request at 2c7b70a6c76bb926aed1e9a0dd338595220392db — this tip needs its own Verdict.

The head moved from dc781ad8 to 2c7b70a6 on top of the new main 3eca1e54 (1 commit, 23 files +1349/−121, mergeable: true / blocked). enqueue-guard at this head reads: comment by Birfy: names dc781ad81cfb, not the tip 2c7b70a6c76b — the change set differs at core/client.js, so that conclusion does not describe this head — the earlier Verdict: PASS stays bound to the old sha.

What changed since dc781ad8 is the point the earlier advisory Security report raised: the decision text is now answered only to a caller who can see the Project. store.js passes the actor into rt.projectDecision(project.id, path, actor); readings still keys by Project id and stores only the listed names (path → dir, plus the meeting's task ids), while visibility is computed per call in memory (meeting-linked names through the same taskVisible the board draws its cards with, pure records through roleOf); a name the caller cannot see and a name that does not exist answer the same sentence, not listed: <name> is not in this board's decision list, with no text, bytes or sha256. Records for the six probes, the four new cases (late-answer guard, overlay call: read wiring, revocation, pure record) and the mutation arms are in the body; the head's own gates are running.

Tier is T3 (authz.js and channel.js are in the change set), so this one needs a Verdict: PASS that names 2c7b70a6c76bb926aed1e9a0dd338595220392db.

[Birfy]

Verdict: PASS at 2c7b70a
Written-by: Reviewer
Attestation: 2c7b70a role=Reviewer

Ran at this tip:

$ cd p2046r-tip/core && DSH_HARNESS=/opt/flybot TZ=UTC node --import ./test/harness-resolve.mjs --test test/project-board.test.js test/project-board-view.test.js test/project-state.test.js
# tests 86  # pass 86  # fail 0
$ cd p2046r-red/core && for f in src/host/project-board.js src/host/project-state.js src/host/authz.js src/host/channel.js src/host/store.js src/client/project-board.js src/client/i18n.js client.js; do cp ../../p2046r-base/core/$f ./$f; done && DSH_HARNESS=/opt/flybot TZ=UTC node --import ./test/harness-resolve.mjs --test test/project-board.test.js test/project-board-view.test.js test/project-state.test.js
# tests 86  # pass 73  # fail 13

Red first, eights on the same suites: with the seven changed sources plus core/client.js put back to their 3eca1e54 blobs, exactly the 13 #2041 cases go red — five in project-board-view.test.js (row is a div not a button; the four click/hover cases TypeError: rowAt(...).props.onClick is not a function; the overlay case finds no row) and eight in project-board.test.js (rt.projectDecision is not a function, and the two endpoint cases answering Unknown endpoint project-decision). No other case moved, so the green is this change's and not the suite's.

Read at the tip rather than trusted from the description:

• core/src/host/project-board.js:569-598 — projectDecision checks isDecisionPath first, then the Project, then visibility, then entry.dirs.get(name); the membership answer and the may-not-open answer are the same not listed: sentence, and both return before any stat/open. A name outside readings (never listed, or listed before this process) is refused unread.
• decisionVisible (:579-592) allows when authz is not enforced, else a name with meeting cards goes through rt.taskVisible and a plain record through roleOf; an empty card list or a missing predicate refuses. readings stores dirs + cards only, per Project, so no actor's reach is cached across callers.
• core/src/host/store.js:738-745 passes actor with the id; channel.js:678 dispatches it; authz.js:72 lists it beside project-board, no new gate.
• readListedFile in project-state.js is the extracted 200,000-byte / lstat read — project_state's own cases still pass, so the bound and the symlink-answers-absent rule are one implementation.

Checks at this tip (check-runs for 2c7b70a6): tests-ok, package, merge-gate, judge, the four plugins (*), typecheck-carrying ubuntu-latest · Node 24 and agent-audience are all success; the only failure is enqueue-guard, whose refusal is that the standing comment names dc781ad8 — that is what this verdict replaces, and it is not a property of the change.

Scope: 23 files, +1349/−121, all of them this change — core/ client+host sources and the two new test files, their patches/ds-bot/files/ mirrors, the three patches that carry one hunk each (0001, 0002, 0005) plus the regenerated 0008 bundle, core/client.js, two subsystem docs and one changelog.d/ entry. Nothing outside the issue's scope; no dependency, config or workflow file.

Metadata: body Reviewer: Birfy (not the Owner Dev-1), checkpoint block 1367 chars with a 590-char summary and checks.at = this tip; agent-pr added.