The 09:00 Project digest is empty on any signed-in install: it reads the board with no actor, so every card is filtered out #1846

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: 233fe40b30d046298aedd6018da7f05e
Branch: dev/4-p234-digest-authz
Base: b4e05ac
At: 2026-10-30T15:05:43Z

Baseline

Re-read on live main b4e05acf9c2785eced88e94f1b70e4f15c860c9f (2026-10-30); #1835 added the metrics block above the board's row builder, so the host project-board.js positions moved. Current: core/src/host/project-board.js const visible = … :363, if (!visible(task, actor)) continue :368; core/src/host/project-assistant.js buildDigest :61-91 (the "no change" line :87), the read :478-479, since :450, setProjectDigest :452; core/src/host/tasks.js taskVisible :334-338, mayAct :218-221, owns :295-300; core/src/host/store.js setProjectDigest :514-521. core/test/project-assistant.test.js:11-25 still seeds no authSessions, and the board-path case is :577.

What happens

On any installation where someone has signed in, the Project Assistant's 09:00 digest says the Project did not change — every day, while the board is moving. The owner gets, and keeps, one line:

Project Assistant (P1) — 2026-10-30: no change since the previous digest.

The digest is not wrong about the date; it reads a board that is empty for the reader it uses, and there is no reader.

Why it is empty (live main b4e05acf)

Four legs, all present today:

1. The digest reads the board with no actor: core/src/host/project-assistant.js:478 — const board = (await rt.projectBoard?.(project.id)) ?? [], and :479 takes board.rows.
2. The board paints a row only when rt.taskVisible(task, actor) says so: core/src/host/project-board.js:363 (const visible = typeof rt.taskVisible === 'function' ? rt.taskVisible : () => false) and :368 (if (!visible(task, actor)) continue).
3. With actor undefined every branch of that predicate is false: core/src/host/tasks.js:334-338 — mayAct (:218) requires actor.memberId when authorization is enforced, ancestorOwned (:302-311) goes through owns (:295-300) which requires the same, and roomAdmin (:321-326) returns false on !actor?.memberId. So rows = [].
4. "Enforced" is every real installation: core/src/host/authz.js:87 — rt.authzEnforced = () => Object.keys(state.authSessions || {}).length > 0, and member-auth.js writes state.authSessions the first time anybody signs in.

With rows = [], buildDigest (project-assistant.js:61-91) fills none of its four sections and :87 returns that single "no change" line. The multi-owner "Needs X's decision" section is empty for the same reason (actionableFor([])).

It is worse than one wrong sentence

The wrong digest is also archived as the baseline for the next one:

• project-assistant.js:452 rt.setProjectDigest?.(project.id, note, owner) stores { day, at, text } in that owner's projectMemory (core/src/host/store.js:514-521), 4000 chars max.
• The next run reads it back as the cut-off: :450 since: memory.digest?.at ?? null, and buildDigest's changed(row) gates the "Merged since / Closed" sections on row.updatedAt > since.

So every card that was completed before the first empty digest can never appear in "Merged since" or "Closed" again. The bug does not only emit a false sentence; it advances the "what counts as changed" watermark along with it.

Why CI stays green

core/test/project-assistant.test.js:11-25 seeds a host with no authSessions, so authzEnforced is false and mayAct short-circuits to true (tasks.js:219). The "through the real task and board path" case at :577 also runs rt.projectBoard(project.id) on a host nobody signed in to. No test asserts digest content under enforcement.

Reproduction

Probe run by FlyBot Product on a clean tree at 2ea55d8a with one authSessions entry, a Project bound to bot a (owned by owner-1), and task-1 in working assigned to Worker (exit 1):

# PROBE authzEnforced = true
# PROBE board as owner-1: 1 row(s) [["task-1","in-progress","Worker"]]
# PROBE board with no actor (what digest() calls): 0 row(s)
# PROBE digest delivered=1 text=["Project Assistant (P1) — 2026-10-30: no change since the previous digest."]
# PROBE archived digest note: day="2026-10-30" at=1793325600000 text="Project Assistant (P1) — 2026-10-30: no change since the previous digest."

Four expectations failed there (the digest cannot see the card; it does not name task-1; the text is the empty sentence; the archived note is the same sentence). The line archived note === delivered text passed — which is exactly the point: the wrong text is what gets stored. The same probe exits 1 on e4773eaa, and the four anchors above were re-read on live main b4e05acf.

Expected

The digest must read the facts the Project's owner sees on that board — the digest is the Project's daily report, not one member's page — and the guard that keeps members from reading each other's cards must keep holding.

Acceptance

1. With one authSessions entry present, a Project bound to a card in working: rt.projectAssistant.digest(id) names that card in its text. (Fails today.)
2. The archived leg too: after the digest runs, projectMemoryFor(id, owner).digest.text names the card — it is the next run's since. (Fails today.)
3. Guard — the internal read must not leak into the channel: in the same installation, the project-board endpoint read with a non-owner member's session still cannot see another member's card, and a call shaped like today's projectBoard(id) (no extra argument) still returns 0 rows. The widened read must be opt-in at the call site, never a default.
4. Multi-owner: both owners' digests name the shared facts, and each personal section still contains only that owner's cards.

Fix shape (not fixed by this issue's author)

The internal-read shape is deliberately left to whoever implements it. The Lead does not endorse a specific signature; rt.projectBoard(id, null, { internal: true }) is one option (pass a flag that only the visible check honours, never passed on the channel path), but an equivalent explicit internal reader is acceptable.

Two shapes are not acceptable: synthesizing an all-powerful actor, and letting the endpoint accept a bypass flag inside the request body — both widen the channel path by construction.

Scope

• core/src/host/project-assistant.js — the digest's read call.
• core/src/host/project-board.js — the explicit internal read (parameter and the single visible decision it controls).
• core/src/host/tasks.js — only if the chosen shape needs the predicate to accept it; taskVisible must keep defaulting to today's behaviour.
• tests: core/test/project-assistant.test.js or a new core/test/project-digest-authz.test.js — the four acceptance cases, with an authSessions entry in the seed and no stub on the board path.
• docs/subsystems/core-host.md — one line: the digest reads the Project's board, not a member's.
• generated files, never hand-edited: run node scripts/ds-bot-patches.mjs generate and commit exactly what it rewrites (host sources are carried by patches/ds-bot/0001-core-fixes.patch and/or the patches/ds-bot/files/src/host/… mirrors); check's three ok lines must be green.
• a changelog fragment in changelog.d/, named after this issue's number with -digest-empty.fixed.md, carrying the issue link in its text.

Does not touch the client, core/client.js or patches/ds-bot/0008-client-bundle.patch — this is a host-side read.

Duplicate check

search/issues on repo:ThinkFlowLab/FlyBot, open and closed: digest no change board empty → #1712 / #1733 (the feature landing), #1737 / #1761 (per-owner digests, quiet-window comparison), none about the reader's identity; digest authz sign-in empty → #1740 (write gate), #1788 (social read), no digest read. No issue or PR covers "the digest has no actor".