@bongos/core 1.19.1073 → 1.19.1074

package/docs/recipes/render-pilot.md

@@ -6,6 +6,19 @@ The executable half of [task 1004142](https://cloudbongos.com/builders#/task/100
 
 **The API shape below was read from Render's own reference on 2026-09-23** (`api-docs.render.com`), not inferred. Where this recipe and a live response disagree, the response wins and this file is the bug.
 
+> **Corrections, checked against mercury's vendored core (1.19.305) on 2026-09-28 (task 1004142).** Six things in §4–§6 below would have failed on the real repo; §4's payload now carries all of them, and the list says why. Where the prose below still disagrees with this box, this box wins:
+>
+> 1. **There is no `npm start`.** An adopted instance's `package.json` has only the `@bongos/core` dependency, no scripts. The start command is `node node_modules/@bongos/core/src/platform-server.js`, the same thing the box's unit runs (`serviceUnit` in `scripts/gds/provision-units.js`). Set it explicitly, because the repo's `Procfile` starts the owner's Python app.
+> 2. **The env prefix is the instance's own pack, not the neutral one.** mercury's `config/branding.json` pins `envPrefix: "CLOUDBONGOS"`, so every `BONGOS_*` in §4 and §5 is `CLOUDBONGOS_*` for this repo. A wrong prefix is silently ignored and the hall never loads.
+> 3. **Set `BUILDER_SECRET_KEY`.** Without it `src/bongos/secret-box.js` falls back to a key file in the config home, and Render wipes the disk on every deploy. Each deploy would mint a new key and orphan every stored per-builder secret. A random 32-byte hex value held in Render's env is enough.
+> 4. **Migrations run as Render's pre-deploy command**, as `bash node_modules/@bongos/core/scripts/migrate.sh`. `migrate.sh` addresses the database as `psql -d "$PGDATABASE"`, so set `PGDATABASE` to the same connection URL as `DATABASE_URL`. Whether Render's Node runtime ships `psql` is one of the things the pilot measures.
+> 5. **The OAuth callback is `<origin>/api/gds/auth/web/callback`** — what `GET /api/gds/auth/web/start` actually sends (`src/bongos/routes/auth.js`). The `/builders/auth/github/callback` in `src/bongos/auth.js`'s header comment is stale; GitHub refuses it with "redirect_uri is not associated with this application". If the sign-in app is a GitHub App rather than an OAuth App, its Callback URL field must be filled in too, or GitHub answers "must be configured with a callback URL". Also set `NODE_VERSION=22`, because the core declares `engines.node >=22`.
+> 6. **Set `HOST=0.0.0.0`.** `src/platform-server.js` binds `127.0.0.1` unless `HOST` is set. On the box Caddy is on the same machine, but Render's router is not: the server logs "listening", the health check never reaches it, and the deploy sits at `update_in_progress` while the URL answers `502` with `x-render-routing: no-deploy`. Measured live 2026-09-28.
+>
+> **One more, about §2: clone a stripped copy, not the whole repo.** §2's full clone would copy willHermesLines' warehouse application into a repo they never agreed to. The pilot needs only the Bongos layer (`package.json`, the lockfile, `vendor/*.tgz` and `config/`), plus the `Procfile` and a stub `app.py` so the hybrid shape is kept. Twelve files are enough.
+>
+> **What the 2026-09-28 run actually did.** The owner chose to deploy from `willHermesLines/mercury_bongos` itself instead of a clone. That is safe in a narrower sense than a clone: Render only *reads* the repo, the service and its database are new, and live `mercury` (row 31) is untouched. But it needs the platform owner to have Render access to someone else's private repo, which a real customer standup will not have. Both paths are valid for a pilot. The stripped clone is the one to use when you don't have that access. The `envPrefix` above is mercury's; a greenfield instance on the neutral pack uses `BONGOS_*`.
+
 ---
 
 ## 0. Before you start — three things worth knowing
@@ -117,23 +130,29 @@ curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: appl
     "autoDeploy": "yes",
     "serviceDetails": {
       "runtime": "node",
-      "plan": "0.5c-512mb",
+      "plan": "starter",
       "region": "virginia",
       "healthCheckPath": "/healthz",
       "envSpecificDetails": {
         "buildCommand": "npm ci",
-        "startCommand": "npm start"
+        "startCommand": "node node_modules/@bongos/core/src/platform-server.js",
+        "preDeployCommand": "bash node_modules/@bongos/core/scripts/migrate.sh"
       }
     },
     "envVars": [
+      { "key": "NODE_VERSION",            "value": "22" },
+      { "key": "HOST",                    "value": "0.0.0.0" },
       { "key": "DATABASE_URL",            "value": "<internalConnectionString>" },
-      { "key": "BONGOS_GITHUB_CLIENT_ID", "value": "" },
-      { "key": "BONGOS_GITHUB_CLIENT_SECRET", "value": "" },
-      { "key": "BONGOS_FIRST_ADMIN",      "value": "<your-github-login>" },
-      { "key": "BONGOS_PUBLIC_ORIGIN",    "value": "https://render-pilot.onrender.com" },
-      { "key": "BONGOS_BUILDERS_ORIGIN",  "value": "https://render-pilot.onrender.com" },
-      { "key": "BONGOS_STATUS_ORIGIN",    "value": "https://render-pilot.onrender.com" },
-      { "key": "BONGOS_OAUTH_ORIGIN",     "value": "https://render-pilot.onrender.com" }
+      { "key": "PGDATABASE",              "value": "<internalConnectionString>" },
+      { "key": "PGPOOL_MAX",              "value": "5" },
+      { "key": "BUILDER_SECRET_KEY",      "value": "<64 random hex chars>" },
+      { "key": "CLOUDBONGOS_GITHUB_CLIENT_ID", "value": "" },
+      { "key": "CLOUDBONGOS_GITHUB_CLIENT_SECRET", "value": "" },
+      { "key": "CLOUDBONGOS_FIRST_ADMIN", "value": "<your-github-login>" },
+      { "key": "CLOUDBONGOS_PUBLIC_ORIGIN",   "value": "https://render-pilot.onrender.com" },
+      { "key": "CLOUDBONGOS_BUILDERS_ORIGIN", "value": "https://render-pilot.onrender.com" },
+      { "key": "CLOUDBONGOS_STATUS_ORIGIN",   "value": "https://render-pilot.onrender.com" },
+      { "key": "CLOUDBONGOS_OAUTH_ORIGIN",    "value": "https://render-pilot.onrender.com" }
     ]
   }' | jq
 ```
@@ -142,7 +161,7 @@ Notes that matter:
 
 - **`PORT` is not set by us.** Render injects it; `webEnvBody` writes it because the box allocates ports itself. One more line the standup leg drops.
 - **The four origin overrides are load-bearing, not cosmetic.** Without them `src/branding.js` stays on neutral localhost and the hall never loads (task 1972). They must be the Render hostname, and they must all four be the same host — a single-host instance has no separate `builders.`/`status.` subdomain.
-- **`BONGOS_FIRST_ADMIN` is what seats you as Archon** on first sign-in. Omit it and the instance has no owner and you can never claim it (the 2026-07-07 `demo` regression).
+- **`CLOUDBONGOS_FIRST_ADMIN` is what seats you as Archon** on first sign-in. Omit it and the instance has no owner and you can never claim it (the 2026-07-07 `demo` regression).
 - **OAuth creds start blank** and are filled after the app exists — see step 5.
 - `PGPOOL_MAX` is read bare and still applies. On `basic_256mb` the connection ceiling is low; if the app struggles to connect, set it small (the box uses `PROVISION_INSTANCE_PGPOOL_MAX`).
 - Do **not** send a `secretFiles` entry for the GitHub App PEM until you know whether the App path is in scope for the pilot; blank OAuth is enough to prove boot.

package/migrations/core_257_module_store_registry.sql

@@ -0,0 +1,87 @@
+-- core_257_module_store_registry.sql — the module store's registry: a row per
+-- known module, a row per published version, and the price it is offered at.
+--
+-- task 1003812 (goal 1000091, working area 5). ADR 0338 D1 puts the store on the
+-- control plane: an author publishes a packaged module version to it (task
+-- 1004271), an instance acquires one from it (task 1003785). These three tables
+-- are what both of those read and write. They are the STORE SURFACE ONLY:
+-- balances, taking payment, fees and author payout belong to area 8 (goal
+-- 1000092) and are deliberately not modelled here. Entitlement (1003813),
+-- channels (1003814) and scores (1003815) are their own tasks and their own
+-- tables; nothing here pre-empts their shape.
+--
+--   store_modules          one row per module key the store knows. `status`
+--                          only governs what comes NEXT (ADR 0338 D2): a
+--                          delisted module leaves the catalog and takes no new
+--                          acquisitions or updates, but installed copies keep
+--                          working forever — nothing here can reach them.
+--   store_module_versions  one row per published version. Immutable once
+--                          written (a version names one exact build, so the
+--                          publish path never UPDATEs a row; a fix is a new
+--                          version). `version` is the module's own exact semver
+--                          from module.json (task 1003781); `tree_sha256` and
+--                          `tarball_sha256` are the package-core.js manifest
+--                          pins install verifies against; `artifact_path` is
+--                          where the tarball sits (DO Spaces key or a path
+--                          under the control plane's store dir).
+--   store_module_prices    the price history. The CURRENT price is the newest
+--                          row per module. Money and credits are separate
+--                          columns because a module can be bought with either;
+--                          ZERO is a first-class price (free modules are
+--                          assessed identically — criterion wa5-quality-assessed),
+--                          so NULL means "not offered in this currency" and
+--                          0 means "free". Kept as history rather than a column
+--                          on store_modules so a buyer's price at acquisition
+--                          time stays answerable.
+--
+-- Additive only (new tables), so forward-safe. Idempotent: safe to re-run.
+
+CREATE TABLE IF NOT EXISTS store_modules (
+  module_key    text PRIMARY KEY
+                  CHECK (module_key ~ '^[a-z][a-z0-9-]*$'),
+  title         text NOT NULL,
+  description   text NOT NULL DEFAULT '',
+  author_id     bigint NOT NULL REFERENCES builders(id),
+  status        text NOT NULL DEFAULT 'listed'
+                  CHECK (status IN ('listed', 'delisted')),
+  delisted_at   timestamptz,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  CHECK ((status = 'delisted') = (delisted_at IS NOT NULL))
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_modules_author ON store_modules (author_id);
+
+CREATE TABLE IF NOT EXISTS store_module_versions (
+  id              bigserial PRIMARY KEY,
+  module_key      text NOT NULL REFERENCES store_modules(module_key),
+  version         text NOT NULL
+                    CHECK (version ~ '^[0-9]+\.[0-9]+\.[0-9]+$'),
+  core_version    text NOT NULL,
+  manifest        jsonb NOT NULL,
+  tree_sha256     text NOT NULL CHECK (tree_sha256 ~ '^[0-9a-f]{64}$'),
+  tarball_sha256  text NOT NULL CHECK (tarball_sha256 ~ '^[0-9a-f]{64}$'),
+  tarball_bytes   bigint NOT NULL CHECK (tarball_bytes > 0),
+  artifact_path   text NOT NULL,
+  published_by    bigint NOT NULL REFERENCES builders(id),
+  published_at    timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (module_key, version)
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_module_versions_key
+  ON store_module_versions (module_key, published_at DESC);
+
+CREATE TABLE IF NOT EXISTS store_module_prices (
+  id             bigserial PRIMARY KEY,
+  module_key     text NOT NULL REFERENCES store_modules(module_key),
+  price_cents    integer CHECK (price_cents >= 0),
+  price_credits  integer CHECK (price_credits >= 0),
+  set_by         bigint NOT NULL REFERENCES builders(id),
+  set_at         timestamptz NOT NULL DEFAULT now(),
+  CHECK (price_cents IS NOT NULL OR price_credits IS NOT NULL)
+);
+
+CREATE INDEX IF NOT EXISTS idx_store_module_prices_current
+  ON store_module_prices (module_key, set_at DESC, id DESC);
+
+INSERT INTO schema_migrations (version) VALUES ('core_257_module_store_registry')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/core_258_drop_dev_box_tables.sql

@@ -0,0 +1,55 @@
+-- core_258_drop_dev_box_tables.sql — drop the dev box's four tables and its session
+-- source (task 1003895, goal 1000120).
+--
+-- Goal 1000120 removed the dev box: its module, routes and pollers (task 1003892),
+-- its desktop pairing (1004310), its hall surfaces (1004311) and its session scope
+-- and permissions (1003894). Owner decision 2026-09-13: drop the box's stored state
+-- rather than keep it (blocker 1000159 — the historic box compute spend is not worth
+-- preserving). What this removes:
+--
+--   builder_boxes, box_events   migration 067 (+ columns from 071/073/078/079/105/
+--                               121/core_237/core_238, all on builder_boxes)
+--   box_intents                 migration 070 (reshaped by 071, 102)
+--   builder_ssh_keys            migration 069
+--   builder_sessions 'box'      migration 090 widened the source CHECK to admit it;
+--                               its rows are deleted and the CHECK narrowed back to
+--                               ('cli','web'). Since task 1003894 those rows were
+--                               already refused on every route and page.
+--
+-- NOT HERE, deliberately: the four `builders.box_blocked*` columns (migration 104).
+-- A deploy runs migrations while the PREVIOUS server is still up, and an upgrade that
+-- fails rolls the code back but never the schema. The previous code's
+-- getBuilderById SELECTs those columns, so dropping them in the same release would
+-- break every builder read for as long as that code runs. The code stops reading them
+-- in this change; the columns go in task 1004360 (filed with this one, depends on it),
+-- once no live instance runs a core that reads them.
+--
+-- NOT HERE either: cost_log rows the dev box wrote. cost_log has no box category (its
+-- CHECK is api/compute/infra/domain/art/other), so they are ordinary 'compute' rows
+-- recording money that was actually spent; the cost ledger keeps them.
+--
+-- forward-unsafe: drops the dev box's own tables. Their only reader in any previous
+-- core was the dev-box module (removed in task 1003892), so a code rollback past this
+-- migration breaks only that module's box features — never sign-in, claims or any
+-- core read. The one core read of box state (builders.box_blocked*) is deliberately
+-- left for a later migration, above.
+--
+-- Order matters and CASCADE is deliberately absent: box_events references
+-- builder_boxes, so it goes first; if anything outside these four tables still
+-- depended on them the DROP fails loudly rather than silently taking it too.
+-- Idempotent: every statement is IF EXISTS / re-runnable.
+
+BEGIN;
+
+DROP TABLE IF EXISTS box_events;
+DROP TABLE IF EXISTS builder_boxes;
+DROP TABLE IF EXISTS box_intents;
+DROP TABLE IF EXISTS builder_ssh_keys;
+
+DELETE FROM builder_sessions WHERE source = 'box';
+ALTER TABLE builder_sessions
+  DROP CONSTRAINT IF EXISTS builder_sessions_source_check;
+ALTER TABLE builder_sessions
+  ADD CONSTRAINT builder_sessions_source_check CHECK (source IN ('cli', 'web'));
+
+COMMIT;

package/modules/agents/module.json

@@ -2,6 +2,7 @@
   "key": "agents",
   "title": "Agents (declarative agent registry)",
   "description": "Declarative agent definitions (.claude/agents/*.md) reconciled at deploy into a DB-backed registry (agents_definitions) plus a per-fire ledger (agents_runs) — BONGOS-V1 goal 1000038, Phase 1. Files-are-source: agents-sync upserts file-sourced definitions and never clobbers an instance-authored db row, and stamps author_rank from the author's LIVE DB rank because a committed file cannot grant authority (ADR 0016). Spawns consume the EXISTING `grade` port (runSubagentCached), which is fixed read-only, so v1 agents are observe-and-report only — no write principals — and every fire bills through the shared LLM cost cache. default:false: shipped is not enabled, and an instance opts in per ADR 0083. spend.requiresPayer (task 1003884): a fire spends real money for whoever called it (~$0.90, and POST /agents/:name/invoke answers 202 without waiting), so the core refuses to ENABLE this module on an instance whose join door is `open` with no payer configured — an account created seconds ago would otherwise spend the instance's money with nobody to bill. Every run then records its payer beside cost_usd (agents_002_payer.sql) and a per-payer monthly ceiling fails closed when it is exhausted OR unreadable (lib/spend-ceiling.js) — distinct from lib/fire-budget.js, which stays a rate ceiling.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": false,
   "maintenance": { "status": "core-maintained" },

package/modules/autonomy/module.json

@@ -2,6 +2,7 @@
   "key": "autonomy",
   "title": "Autonomy & MAS (conductor · architect · gate · routine timers)",
   "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
+  "version": "1.0.0",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/builder-settings/module.json

@@ -2,6 +2,7 @@
   "key": "builder-settings",
   "title": "Builder settings (prefs · needs)",
   "description": "The per-builder PREFERENCE domain — the wandering knob (how readily the agent opens off-task threads, rank-clamped), per-skill model ceilings, per-sound + per-event-sound on/off, and the render-widgets toggle — plus builder-needs (the 'the system needs an input from you' list). A core-domain module carved out of the GDS core in BV1.R80 (ADR 0093 §1); default-on because every instance configures its own builders. The `/me/*-prefs` routes mount here; the `GET /me` aggregator stays a thin core facade that resolves the `builder-settings` kernel PORT for its wandering/render/needs slices (02-module-map §2).",
+  "version": "1.0.0",
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/builder-settings/render-prefs.js

@@ -258,11 +258,10 @@ function describeForApi(behaviorPrefs) {
     // --- levels (task 1002518) ---
     level,
     // The three booleans a card emitter needs, RESOLVED SERVER-SIDE. This is not
-    // a convenience: scripts/gds/start.js runs on a task-scoped dev box that
-    // carries scripts/ and src/bongos/ but not every modules/ directory (task
-    // 1003098), so a CLI cannot require this file to learn what a rung draws —
-    // tree-preflight fails the entry point that tries. Shipping the answers
-    // keeps the ladder in one place AND keeps the CLI dependency-free.
+    // a convenience: a CLI (scripts/gds/start.js) reaches module logic through
+    // the server, never by requiring this file, so it cannot learn what a rung
+    // draws any other way. Shipping the answers keeps the ladder in one place
+    // AND keeps the CLI dependency-free.
     flags: cardFlags(level),
     levels: levelCatalog(),
     derived_level: derived,

package/modules/copy-desk/docx.js

@@ -464,10 +464,16 @@ function guidFor(seed) {
   return `{${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}}`;
 }
 
+// The Title the download writes, and the one an upload without its page details
+// is identified by (identifyUpload): one rule for both.
+function downloadTitle({ readingPage, title }) {
+  return String(title || readingPage.title || readingPage.id);
+}
+
 // composeDownload({ readingPage, title, draft }) -> Buffer (the .docx)
 function composeDownload({ readingPage, title, draft }) {
   const lines = shownLines(readingPage, draft);
-  const pageTitle = String(title || readingPage.title || readingPage.id);
+  const pageTitle = downloadTitle({ readingPage, title });
   const doc = documentXml({ title: pageTitle, lines });
   const rels = (items) => `${XML_HEAD}<Relationships xmlns="${NS.rels}">${items.map(([id, type, target]) => `<Relationship Id="${id}" Type="${type}" Target="${target}"/>`).join('')}</Relationships>`;
   const OD = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships';
@@ -699,20 +705,86 @@ function headingChanges(expected, found) {
   return out;
 }
 
+const isHeading = (p) => /^heading\s*2$/i.test(String(p.style || ''));
+const isTitle = (p) => /^title$/i.test(String(p.style || ''));
+const sameWords = (a, b) => foldQuotes(tidy(a)) === foldQuotes(tidy(b));
+
+// The file's frame: every untagged paragraph before its first section heading.
+// The download writes the Title and the note there and never a line, so they
+// stay out of the lines even when the program that saved the file dropped
+// their styles (Google Docs keeps Title and Heading 2, not a custom style).
+function frameOf(paragraphs) {
+  const first = paragraphs.findIndex((p) => isHeading(p) || p.tags.length);
+  return new Set((first < 0 ? paragraphs : paragraphs.slice(0, first)).filter((p) => !p.tags.length));
+}
+
+// The page title the file shows: its Title paragraph, else the first words of
+// its frame.
+function uploadTitle(paragraphs) {
+  const frame = [...frameOf(paragraphs)].filter((p) => tidy(p.text));
+  const t = frame.find(isTitle) || frame[0];
+  return t ? tidy(t.text) : null;
+}
+
+// identifyUpload({ readingPage, pageId, title, upload }) ->
+//   { ok, page_details } | wrong_page | reading_moved
+//
+// WHICH PAGE a file is (task 1004354 / BV2.TW23, ADR 0341 D12). With its page
+// details (the page_id and reading_hash properties) the file says so, and it
+// must be this page on this reading. A program that re-saves the file may drop
+// them: a Google Docs download keeps the words, the styles and the comments,
+// and loses the custom properties, the shown-text part and every content
+// control. Then the file is identified by what the download WROTE: its Title
+// must be this page's title and its section headings must be this reading's,
+// in order. Anything else is another page's file, and wrong_page names what
+// did not match. The line count per section is mapUpload's to check, so an
+// added or dropped line in the right page's file is still structure_changed,
+// named, and never merged. With no reading_hash there is no reading to move
+// from: the structure matching THIS reading is the check.
+function identifyUpload({ readingPage, pageId, title, upload }) {
+  if (upload.page_id != null) {
+    if (upload.page_id !== pageId) return fail('wrong_page', { page_id: pageId, file_page_id: upload.page_id, page_details: true });
+    if (upload.reading_hash !== readingPage.reading_hash) {
+      return fail('reading_moved', { reading_hash: readingPage.reading_hash || null, file_reading_hash: upload.reading_hash });
+    }
+    return { ok: true, page_details: true };
+  }
+  const expected = { title: tidy(downloadTitle({ readingPage, title })), headings: sectionRuns(readingPage.lines || []).map((r) => tidy(r.section)) };
+  const found = { title: uploadTitle(upload.paragraphs), headings: upload.paragraphs.filter((p) => isHeading(p) && !p.tags.length).map((p) => tidy(p.text)) };
+  const mismatched = [];
+  if (found.title == null || !sameWords(found.title, expected.title)) mismatched.push('title');
+  if (found.headings.length !== expected.headings.length || found.headings.some((h, i) => !sameWords(h, expected.headings[i]))) mismatched.push('headings');
+  if (mismatched.length) {
+    return fail('wrong_page', {
+      page_id: pageId,
+      file_page_id: null,
+      page_details: false,
+      mismatched,
+      expected_title: expected.title,
+      file_title: found.title,
+    });
+  }
+  if (upload.reading_hash != null && upload.reading_hash !== readingPage.reading_hash) {
+    return fail('reading_moved', { reading_hash: readingPage.reading_hash || null, file_reading_hash: upload.reading_hash });
+  }
+  return { ok: true, page_details: false };
+}
+
 // mapUpload({ readingPage, upload }) -> { ok, mode, texts: Map(key -> text) } | structure_changed
 //
 // By TAG when any paragraph carries a line tag; by POSITION when every tag is
 // gone, which needs the same section headings and the same number of lines in
-// each. Paragraphs styled as the Title or the note, and empty untagged
-// paragraphs (an artist's spacing), are not lines.
+// each. Paragraphs styled as the Title or the note, the untagged frame above
+// the first heading (frameOf), and empty untagged paragraphs (an artist's
+// spacing), are not lines.
 function mapUpload({ readingPage, upload }) {
   const lines = readingPage.lines || [];
   const byKey = new Map(lines.map((l) => [l.key, l]));
   const order = new Map(lines.map((l, i) => [l.key, i]));
   const runs = sectionRuns(lines);
   const expectedHeadings = runs.map((r) => tidy(r.section));
-  const isHeading = (p) => /^heading\s*2$/i.test(String(p.style || ''));
-  const isFrame = (p) => /^title$/i.test(String(p.style || '')) || p.style === STYLE.note;
+  const frame = frameOf(upload.paragraphs);
+  const isFrame = (p) => isTitle(p) || p.style === STYLE.note || frame.has(p);
   const paras = upload.paragraphs.filter((p) => !isFrame(p) && !(p.tags.length === 0 && !isHeading(p) && !tidy(p.text)));
   const moved = [];
   const named = (change, key, extra) => {
@@ -813,6 +885,7 @@ module.exports = {
   composeDownload,
   downloadName,
   readUpload,
+  identifyUpload,
   mapUpload,
   mergeUpload,
 };

package/modules/copy-desk/module.json

@@ -2,6 +2,7 @@
   "key": "copy-desk",
   "title": "Copy desk (the artist's loop over user-facing text)",
   "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/gds/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
+  "version": "1.0.0",
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/copy-desk/routes/copy-desk.js

@@ -164,7 +164,7 @@ const PAGE_REFUSAL_MEANS = Object.freeze({
 });
 // The upload's answers when the file is readable but is not this page's, or not
 // this reading's (task 1004320, ADR 0341 D12).
-const UPLOAD_WRONG_PAGE_MEANS = 'This file is not the download of this page, or the program that saved it dropped the page details Word keeps. Download this page again and make your changes in that file. Nothing was saved.';
+const UPLOAD_WRONG_PAGE_MEANS = 'This file is not the download of this page: its title or its section headings are not this page\'s. Check you picked the file you downloaded from this page, or download this page again and make your changes in that file. Nothing was saved.';
 const UPLOAD_READING_MOVED_MEANS = 'The page has changed since this file was downloaded, so its lines may no longer line up with the page. Download the page again and copy your changes across. Nothing was saved.';
 
 // The upload's body is the .docx itself, never JSON (the global parser only
@@ -1166,7 +1166,7 @@ module.exports = function buildCopyDeskRouter() {
     try {
       const found = pageOrFail(req, res);
       if (!found) return;
-      const { pageId } = found;
+      const { page, pageId } = found;
       const lifecycle = pageReadsOrFail(res);
       if (!lifecycle) return;
       if (typeof lifecycle.updateHeldTaskDescription !== 'function') {
@@ -1177,12 +1177,10 @@ module.exports = function buildCopyDeskRouter() {
 
       const upload = docx.readUpload(Buffer.isBuffer(req.body) ? req.body : null);
       if (!upload.ok) return refusePage(res, upload);
-      if (upload.page_id !== pageId) {
-        return res.fail('wrong_page', 409, { page_id: pageId, file_page_id: upload.page_id, what_this_means: UPLOAD_WRONG_PAGE_MEANS });
-      }
-      if (upload.reading_hash !== readingPage.reading_hash) {
-        return res.fail('reading_moved', 409, { reading_hash: readingPage.reading_hash || null, file_reading_hash: upload.reading_hash, what_this_means: UPLOAD_READING_MOVED_MEANS });
-      }
+      // Which page the file is: its page details, or (a Google Docs save drops
+      // them, task 1004354) its title and section headings.
+      const who = docx.identifyUpload({ readingPage, pageId, title: page.title, upload });
+      if (!who.ok) return res.fail(who.code, 409, { ...who.detail, what_this_means: who.code === 'wrong_page' ? UPLOAD_WRONG_PAGE_MEANS : UPLOAD_READING_MOVED_MEANS });
       const mapped = docx.mapUpload({ readingPage, upload });
       if (!mapped.ok) return refusePage(res, mapped);
 
@@ -1227,7 +1225,9 @@ module.exports = function buildCopyDeskRouter() {
             // your doc", Editor.dc.html): the lines the file changed, the draft
             // lines it left alone, and whether lines were matched by tag or by
             // position, with or without the file's record of what it showed.
-            merge: { mode: mapped.mode, baseline: !!upload.baseline, from_file: merge.from_file, kept_from_draft: merge.kept_from_draft },
+            // page_details false: the file had lost its page details and was
+            // matched by its title and headings (task 1004354).
+            merge: { mode: mapped.mode, baseline: !!upload.baseline, page_details: who.page_details, from_file: merge.from_file, kept_from_draft: merge.kept_from_draft },
           });
         case 'not_held':
           return refuseNotHeld(res, pageId, r, round);

package/modules/copy-desk/tests/copy_docx.mjs

@@ -15,7 +15,7 @@
 import { strict as assert } from 'node:assert';
 import zlib from 'node:zlib';
 import { createRequire } from 'node:module';
-import { unzipAll, wordZip, resave, typeInto, wordRuns, trackedInsert, trackedDelete, stripControls, lineParagraph } from './fixtures/word-docx.mjs';
+import { unzipAll, wordZip, resave, typeInto, wordRuns, trackedInsert, trackedDelete, stripControls, lineParagraph, googleDocsSave, GOOGLE_DOCS_DROPS } from './fixtures/word-docx.mjs';
 
 const require = createRequire(import.meta.url);
 const docx = require('../docx.js');
@@ -327,10 +327,116 @@ test('by position, a section with a line more or a line fewer is refused and nam
   assert.equal(refusal(heading)[0].change, 'heading_changed');
 });
 
+// ---------------------------------------------------------------------------
+// A file re-saved by Google Docs (task 1004354 / BV2.TW23): no page details,
+// no shown text, no controls, no custom styles. Identified by its title and
+// headings, mapped by position, merged with the file as the whole state.
+// ---------------------------------------------------------------------------
+
+const identify = (buf, readingPage = READING, title = 'Studio') => docx.identifyUpload({ readingPage, pageId: readingPage.id, title, upload: upload(buf) });
+const OTHER = {
+  id: 'builders:home',
+  title: 'Home',
+  reading_hash: 'home-now',
+  lines: [
+    L('L0001', 'top bar', 'Home', 'shared'),
+    L('L0002', 'welcome', 'Good to see you', 'placed', { file: 'index.html', line: 4, string_id: 'hm02' }),
+    L('L0003', 'welcome', 'Three tasks wait', 'placed', { file: 'index.html', line: 5, string_id: 'hm03' }),
+  ],
+};
+
+test('the Google Docs shape: no page details, no shown text, no controls and no custom styles', () => {
+  const buf = googleDocsSave(download());
+  const parts = unzipAll(buf);
+  for (const k of GOOGLE_DOCS_DROPS) assert.equal(parts.has(k), false, k);
+  assert.doesNotMatch(parts.get('word/document.xml'), /<w:tag |TweakNote|TweakShared|TweakUnplaced/);
+  assert.doesNotMatch(parts.get('_rels/.rels'), /custom-properties/);
+  const u = upload(buf);
+  assert.deepEqual([u.page_id, u.reading_hash, u.baseline], [null, null, null]);
+});
+
+test('a Google Docs round trip merges: identified by its title and headings, mapped by position', () => {
+  const buf = googleDocsSave(download(), { document: (xml) => typeInto(xml, 'L0006', wordRuns(['Pick ', 'up ', 'where you left off'])) });
+  assert.deepEqual(identify(buf), { ok: true, page_details: false });
+  const { mapped, merged } = roundTrip(buf);
+  assert.equal(mapped.ok, true, JSON.stringify(mapped.detail));
+  assert.equal(mapped.mode, 'position');
+  assert.deepEqual(merged.from_file, ['L0006']);
+  assert.equal(merged.lines.find((l) => l.key === 'L0006').after, 'Pick up where you left off');
+  // Every other line, the curly one included, reads as unchanged.
+  assert.deepEqual(merged.lines.filter((l) => l.key !== 'L0006').map((l) => l.after), READING.lines.filter((l) => l.key !== 'L0006').map((l) => l.text));
+});
+
+test('a Google Docs round trip over a draft keeps the draft, since the file shows it', () => {
+  const draft = draftOf([{ key: 'L0002', before: 'Welcome back', after: 'Welcome home' }]);
+  const buf = googleDocsSave(download(draft), { document: (xml) => typeInto(xml, 'L0004', wordRuns(['Nothing ', 'waits'])) });
+  const { merged } = roundTrip(buf, draft);
+  assert.deepEqual(merged.from_file, ['L0004']);
+  assert.deepEqual(merged.kept_from_draft, ['L0002']);
+  assert.equal(merged.lines.find((l) => l.key === 'L0002').after, 'Welcome home');
+});
+
+test('a Google Docs file that kept its note style, or lost only its page details, still merges', () => {
+  const styled = googleDocsSave(download(), { plainStyles: false, document: (xml) => typeInto(xml, 'L0002', wordRuns(['Hello'])) });
+  assert.equal(identify(styled).ok, true);
+  assert.deepEqual(roundTrip(styled).merged.from_file, ['L0002']);
+  // Controls kept, page details dropped: mapped by tag, identified by the file.
+  const tagged = resave(download(), { drop: GOOGLE_DOCS_DROPS, document: (xml) => typeInto(xml, 'L0002', wordRuns(['Hello'])) });
+  assert.deepEqual(identify(tagged), { ok: true, page_details: false });
+  assert.equal(roundTrip(tagged).mapped.mode, 'tag');
+});
+
+test('another page\'s file with its page details dropped is still wrong_page, and says what did not match', () => {
+  const other = docx.composeDownload({ readingPage: OTHER, title: 'Home', draft: null });
+  const r = identify(googleDocsSave(other));
+  assert.equal(r.code, 'wrong_page');
+  assert.deepEqual(r.detail, { page_id: 'builders:studio', file_page_id: null, page_details: false, mismatched: ['title', 'headings'], expected_title: 'Studio', file_title: 'Home' });
+  // Its line tags survived (L0001… on every page), so only the page check
+  // stands between it and this page's lines.
+  assert.equal(identify(resave(other, { drop: GOOGLE_DOCS_DROPS })).code, 'wrong_page');
+  // This page's headings under another title; this page's title over other headings.
+  const retitled = googleDocsSave(download(), { document: (xml) => xml.replace('<w:t xml:space="preserve">Studio</w:t></w:r></w:p><w:p><w:pPr><w:pStyle w:val="TweakNote"/>', '<w:t xml:space="preserve">Home</w:t></w:r></w:p><w:p><w:pPr><w:pStyle w:val="TweakNote"/>') });
+  assert.deepEqual(identify(retitled).detail.mismatched, ['title']);
+  const reheaded = googleDocsSave(download(), { document: (xml) => xml.replace('<w:t xml:space="preserve">footer</w:t>', '<w:t>foot</w:t>') });
+  assert.deepEqual(identify(reheaded).detail.mismatched, ['headings']);
+});
+
+test('with its page details kept, the file still names its page and its reading', () => {
+  const other = docx.composeDownload({ readingPage: OTHER, title: 'Home', draft: null });
+  assert.deepEqual(identify(other).detail, { page_id: 'builders:studio', file_page_id: 'builders:home', page_details: true });
+  assert.equal(identify(download(), { ...READING, reading_hash: 'h-later' }).code, 'reading_moved');
+  assert.deepEqual(identify(download()), { ok: true, page_details: true });
+});
+
+test('the right page from Google Docs with a line added is structure_changed, named, not wrong_page', () => {
+  const buf = googleDocsSave(download(), { document: (xml) => { const p = lineParagraph(xml, 'L0006'); return xml.replace(p, () => `${p}<w:p><w:r><w:t>A new thought</w:t></w:r></w:p>`); } });
+  assert.equal(identify(buf).ok, true);
+  assert.deepEqual(refusal(buf), [{ change: 'added', key: null, section: 'footer', first_words: 'A new thought' }]);
+});
+
 // ---------------------------------------------------------------------------
 // Every page the inventory reads round-trips untouched.
 // ---------------------------------------------------------------------------
 
+test('every committed page, re-saved by Google Docs, merges into itself and into no other page', () => {
+  const readings = require('../../../docs/page-readings.json');
+  const files = readings.pages.map((p) => upload(googleDocsSave(docx.composeDownload({ readingPage: p, title: p.title, draft: null }))));
+  readings.pages.forEach((a, i) => {
+    for (const b of readings.pages) {
+      const who = docx.identifyUpload({ readingPage: b, pageId: b.id, title: b.title, upload: files[i] });
+      if (a === b) {
+        assert.equal(who.ok, true, a.id);
+        const m = docx.mapUpload({ readingPage: a, upload: files[i] });
+        assert.equal(m.ok, true, `${a.id}: ${JSON.stringify(m.detail)}`);
+        assert.deepEqual(docx.mergeUpload({ readingPage: a, texts: m.texts, baseline: null, draft: null }).from_file, [], a.id);
+      } else if (who.ok) {
+        // The same title and headings: the lines must still refuse it.
+        assert.equal(docx.mapUpload({ readingPage: b, upload: files[i] }).ok, false, `${a.id} merged into ${b.id}`);
+      }
+    }
+  });
+});
+
 test('every committed page reading round-trips with no change', () => {
   const readings = require('../../../docs/page-readings.json');
   for (const p of readings.pages) {

package/modules/copy-desk/tests/fixtures/word-docx.mjs

@@ -129,3 +129,33 @@ export function trackedDelete(text) {
 export function stripControls(xml) {
   return xml.replace(/<w:sdt><w:sdtPr>[\s\S]*?<\/w:sdtPr><w:sdtContent>([\s\S]*?)<\/w:sdtContent><\/w:sdt>/g, (m, inner) => inner);
 }
+
+// The parts a Google Docs "Download, Microsoft Word (.docx)" does not carry
+// back: the custom properties (page_id, reading_hash) and the custom XML part
+// (the shown text). Task 1004354 (BV2.TW23) reproduced the owner's upload by
+// dropping exactly these.
+export const GOOGLE_DOCS_DROPS = Object.freeze(['docProps/custom.xml', 'customXml/item1.xml', 'customXml/itemProps1.xml', 'customXml/_rels/item1.xml.rels']);
+
+// Re-save a downloaded file the way Google Docs hands it back: every content
+// control gone, the page details and the shown text dropped, and the package's
+// references to them removed. Google Docs has no custom paragraph styles, so
+// `plainStyles` also turns the note, shared and engineer styles into plain
+// paragraphs (Title and Heading 2 are its own and stay). `document` edits the
+// document part first, while its line tags are still there to find a line by.
+export function googleDocsSave(buf, { document, plainStyles = true } = {}) {
+  const all = unzipAll(buf);
+  const rels = (xml) => xml.replace(/<Relationship [^>]*(?:custom-properties|customXml)"[^>]*\/>/g, '');
+  return resave(buf, {
+    drop: GOOGLE_DOCS_DROPS,
+    parts: {
+      '_rels/.rels': rels(all.get('_rels/.rels')),
+      'word/_rels/document.xml.rels': rels(all.get('word/_rels/document.xml.rels')),
+      '[Content_Types].xml': all.get('[Content_Types].xml').replace(/<Override PartName="\/(?:docProps\/custom|customXml\/[^"]+)\.xml"[^>]*\/>/g, ''),
+    },
+    document: (xml) => {
+      let out = stripControls(document ? document(xml) : xml);
+      if (plainStyles) out = out.replace(/<w:pPr><w:pStyle w:val="Tweak(?:Note|Shared|Unplaced)"\/><\/w:pPr>/g, '');
+      return out;
+    },
+  });
+}

package/modules/discord/module.json

@@ -2,6 +2,7 @@
   "key": "discord",
   "title": "Discord",
   "description": "Outbound ship broadcast + the inbound #ideas/#bugs bot + role-sync + channel management + account-link state. Mirror only, never authority (ADR 0033).",
+  "version": "1.0.0",
   "coreVersion": "^1.4.0",
   "default": false,
   "maintenance": { "status": "core-maintained" },

package/modules/economy/module.json

@@ -2,6 +2,7 @@
   "key": "economy",
   "title": "Economy",
   "description": "Credit allocation (the cost-plus + kind-multiplier reward model), the cost ledger + dashboard rollups, builder streaks, achievements/gamification, and the leaderboard. A core-domain module carved out of the GDS core in BV1.R77 (ADR 0093 §1-2); default-on because every instance rewards its own builders. Registers the `reward` kernel PORT the lifecycle resolves at confirm/ship/claim time.",
+  "version": "1.0.0",
   "coreVersion": "^1.7.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },