@bongos/core 1.19.154 → 1.19.156

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.154",
-  "core_contract": "1.19.154",
-  "source_commit": "fbe11785041864be4c61ec8bb98507574cdd5f10",
+  "core_version": "1.19.156",
+  "core_contract": "1.19.156",
+  "source_commit": "3eb459c447a131f66f5d8297ca621cca2bee58a2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T15:55:19.456Z",
+  "built_at": "2026-08-16T16:14:04.323Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1254,
+    "functional_verbatim": 1256,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1579,
-  "tree_sha256": "b118dbf9bacb9695248f0821386defeac7d1498742efe7e907383359eb1f070b",
+  "file_count": 1581,
+  "tree_sha256": "482b7fbbf94668a5a66dfbbf5f2450699c1670c04b8199d6bf3529b0853cfe31",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "dc69c5c9e9041da9cd3c297c3e7c81c8311f42952524297d9f228cc1751af3ea"
+      "sha256": "c3d785e319252965f8b5f338908d1dd66bd56985dafacb5d2ab8e5095d2515b3"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -2597,7 +2597,7 @@
     {
       "path": "modules/dev-box/app/src/brand.generated.json",
       "mode": "0000644",
-      "sha256": "a230bd4095c23b5f3fcb41f9f691398ca2560a820dd9d01346fee7aec5f07cf9"
+      "sha256": "516593196fc4d75a44325e478690485d91f1d293387a541df571b4bccf6e3360"
     },
     {
       "path": "modules/dev-box/app/src/brand.js",
@@ -4107,7 +4107,7 @@
     {
       "path": "modules/sessions/db.js",
       "mode": "0000644",
-      "sha256": "fde41184b9f82f51dc5fff5df081d3435d296c3132fb619183996c250d621692"
+      "sha256": "65cb78d4a3e0507df5d2b37ac99cdb3d762b98de5c34996f64c6de7ad38dc71a"
     },
     {
       "path": "modules/sessions/module.json",
@@ -4117,7 +4117,7 @@
     {
       "path": "modules/sessions/pollers/session-reward-reconcile.js",
       "mode": "0000644",
-      "sha256": "8d08704aa90f14c8f1a653bc7dc252ddca983dc309f7fa0e190070878a3856e3"
+      "sha256": "32942d1169776ff1b2a32b85269c285f52167a6f3a7add7e38f74f108a9f3f42"
     },
     {
       "path": "modules/sessions/pulse.js",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9f78c537cd7c7914c01ae8fd732fa039c2c749e9ee7f4cf3395d6ce71d0070c8"
+      "sha256": "288b7b3c867bd31f3753a058d01234d02a39d422cc9196569620b3609ca67ba8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d5a00856ea454cdbf92b96b9a2d536272b3dd0481cdf8ecdb92c6e5bff9ec6eb"
+      "sha256": "2892b26243a2c662e0e772a9f8a2a3e7b1ae63bcc046f1d797ac2cab597d7f7e"
     },
     {
       "path": "public-docs/index.html",
@@ -4434,6 +4434,11 @@
       "mode": "0000644",
       "sha256": "611050e8599be5791e89f9711b76ef6efc5b1e8bd703e2badc6a6418a9ed432b"
     },
+    {
+      "path": "public-landing/assets/verro-medallion.png",
+      "mode": "0000644",
+      "sha256": "f374d042a0428f956212a11ca9e86870232ab46af4010bd710a15affd374ab45"
+    },
     {
       "path": "public-landing/buddha.png",
       "mode": "0000644",
@@ -4442,7 +4447,7 @@
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
-      "sha256": "f011cbcc82b95284f00dae9aa63600ea664f9edc5c7b79c533501c2c0c54495c"
+      "sha256": "ab299596b6c514ac044b2471330026e1516f6878e02b9045afae0ddc1f5fbfd9"
     },
     {
       "path": "public-landing/projects.html",
@@ -5782,7 +5787,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0ab78138a36bd9d516a9dd8e3fed336297b4c87387fa6a2254811d5286d938ab"
+      "sha256": "7e9d6b73af3f2c1ebb9aa216c63f0049ce892c85297ff2d5f00cc02aa9e6a1cb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6262,7 +6267,7 @@
     {
       "path": "tests/cloud_bongos_pack.mjs",
       "mode": "0000644",
-      "sha256": "087d0379a559ebb858e8e42458754cfb93720a5222e5f85fb81995851ce811be"
+      "sha256": "9f225b5d4db7e73fbd35bea68ab6c8c64b72bac79daa7be0219e796dc758376a"
     },
     {
       "path": "tests/conductor.mjs",
@@ -6967,7 +6972,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "89a9d21ee1c5b00ee09de2d888873fa13c1b2b6d15ab05a6bfeb7e7a5d016a03"
+      "sha256": "2efddbab276f2ef38dbcf09ef6b76d4c1ff58f68c8b11a8803c7a27b605b385f"
     },
     {
       "path": "tests/lib_sh_resolution.mjs",
@@ -7292,7 +7297,7 @@
     {
       "path": "tests/platform_boot.mjs",
       "mode": "0000644",
-      "sha256": "de3bbe68cb648ad5027506f7dcf848e2758e9e67ea65d8c7fb27febbab264845"
+      "sha256": "3552e9e4e947c21770d734b340893db576ea42c7b5de9d2822021a03e1345810"
     },
     {
       "path": "tests/post_login_landing.mjs",
@@ -7579,6 +7584,11 @@
       "mode": "0000644",
       "sha256": "921c24a356d0fc1f398563bab3e8bb6f0831919a6954d86b6d74fdc60ff3b5f9"
     },
+    {
+      "path": "tests/session_attach_from_claim.mjs",
+      "mode": "0000644",
+      "sha256": "e76a3baf5fb2cdee08ffe8d80c55630b5ab4f708046f3c63c07c480926ccda31"
+    },
     {
       "path": "tests/session_caps.mjs",
       "mode": "0000644",
@@ -7612,7 +7622,7 @@
     {
       "path": "tests/session_reward_on_land.mjs",
       "mode": "0000644",
-      "sha256": "62d0b356029aca4ea307957951aba7ec677598c152ce68caee5001c6c36f9323"
+      "sha256": "52be7bd7afd17f7f7d1c93efb9be32902d08062cd65f35e3e3709a0e3669050f"
     },
     {
       "path": "tests/session_reward_reconcile.mjs",

package/config/branding.neutral.json

@@ -51,7 +51,7 @@
   },
   "rankLabels": { "xenos": "Newcomer", "thetes": "Contributor", "metic": "Trusted", "archon": "Owner" },
   "copy": {
-    "tagline": "Building software is laying down a beat.",
+    "tagline": "Building Digitally, as simple as Bongos.",
     "hallName": "Builders' Hall",
     "notFound": "This page skipped a beat.",
     "authError": {

package/modules/dev-box/app/src/brand.generated.json

@@ -8,6 +8,6 @@
   "APP_ID": "com.cloudbongos.devbox",
   "COPYRIGHT": "© Cloud Bongos",
   "CONFIG_DIR": "cloudbongos",
-  "TAGLINE": "Building software is laying down a beat.",
+  "TAGLINE": "Building Digitally, as simple as Bongos.",
   "BG_COLOR": "#f9d9a8"
 }

package/modules/sessions/db.js

@@ -191,6 +191,67 @@ async function upsertSessionRecordWithReward(opts) {
   });
 }
 
+// attachClaimSessionsToTaskTx — SERVER-SIDE task↔session attribution (task
+// 1002964). Every payout path keys on session_records.task_ids, and until this
+// existed exactly ONE thing ever populated that column: ship.js's client-side
+// upload (`task_ids: [taskId]`). When that upload skipped — no
+// CLAUDE_CODE_SESSION_ID, an unsafe id, or a transcript the client couldn't find
+// (classifyUploadSkip, scripts/gds/ship.js) — the session was left with an EMPTY
+// task_ids, which matches NOTHING in awardDeferredSessionRewardForTask,
+// reconcileUnbookedSessionRewards, or the upload-side gate. The reward then
+// stranded PERMANENTLY, not late: even the state-based safety net could not see
+// the row. Builder IAMMASTERQUA hit exactly this — 19 sessions, 19 empty, ~$730
+// of recorded session cost, zero paid, for ten weeks, with the only diagnostic
+// (recordUploadSkip's trace) written to their own laptop.
+//
+// The server does not need the client's help here: a claim already records WHO
+// shipped WHAT and WHEN. So we recover the link from durable state — the
+// builder's session_records whose activity window overlaps the claim window.
+//
+// Design notes:
+//   • OVERLAP, not containment: a session that was already running when the
+//     claim opened (or outlived it) still did that work. started_at/ended_at
+//     fall back to uploaded_at when the transcript carried no span.
+//   • OVER-ATTACHMENT IS FINANCIALLY SAFE. The reward is idempotent per
+//     session_id (the watermark SELECT + uniq_credit_session_token_reward_basis),
+//     so linking one session to several tasks pays it ONCE, never per task. The
+//     bounded downside is a longer task_ids list, not double-pay.
+//   • Bounded by `limit` so a pathological long-running session can't fan out
+//     an unbounded UPDATE.
+//   • Does NOT touch the landing gate. It only answers "which session did this
+//     task come from"; whether the task LANDED is still checked by every caller
+//     (ADR 0120 — never pay for code that didn't land).
+// Returns { attached } (rows freshly linked).
+async function attachClaimSessionsToTaskTx(client, taskId, { limit = 50 } = {}) {
+  const id = Number(taskId);
+  if (!Number.isFinite(id)) return { attached: 0 };
+  const n = Number(limit);
+  const cap = Number.isFinite(n) ? Math.max(1, Math.min(500, Math.trunc(n))) : 50;
+  const { rows } = await client.query(
+    `WITH cand AS (
+       SELECT DISTINCT sr.id
+         FROM claims c
+         JOIN session_records sr ON sr.builder_id = c.builder_id
+        WHERE c.task_id = $1
+          AND NOT (sr.task_ids @> ARRAY[$1]::bigint[])
+          AND COALESCE(sr.started_at, sr.uploaded_at) <= COALESCE(c.released_at, now())
+          AND COALESCE(sr.ended_at,   sr.uploaded_at) >= c.claimed_at
+        ORDER BY sr.id
+        LIMIT $2
+     )
+     UPDATE session_records sr
+        SET task_ids = (
+              SELECT COALESCE(array_agg(DISTINCT e ORDER BY e), '{}')
+                FROM unnest(sr.task_ids || ARRAY[$1]::bigint[]) AS e
+            )
+       FROM cand
+      WHERE cand.id = sr.id
+      RETURNING sr.session_id`,
+    [id, cap]
+  );
+  return { attached: rows.length };
+}
+
 // awardDeferredSessionRewardForTask — the LAND-side half of ADR 0120 "pay on
 // land". When a task reaches status='shipped', routes/sessions.js's task.shipped
 // listener calls this with the shipped task id. It finds every session_record
@@ -198,16 +259,24 @@ async function upsertSessionRecordWithReward(opts) {
 // ci/async path, where the digest was uploaded (and DEFERRED) before the code
 // landed. Opens its own transaction.
 //
+// It first runs attachClaimSessionsToTaskTx (task 1002964) so a session whose
+// client-side upload skipped is still found: before that, an unsent task_ids
+// made the reward unreachable by every path, permanently.
+//
 // We do NOT pre-filter on token_reward_drachmae: awardSessionTokenReward is
 // idempotent per session_id, so a session that already collected at upload time
 // (sync mode) — or a re-fired event — is a clean no-op. The credit_log is the
 // single source of truth for "already paid"; the mirror column is only
-// observability, so it is never the idempotency key. Returns { sessions, awarded }
-// (rows scanned, rewards freshly booked).
+// observability, so it is never the idempotency key.
+// Returns { sessions, awarded, attached } (rows scanned, rewards freshly booked,
+// links freshly recovered).
 async function awardDeferredSessionRewardForTask(taskId) {
   const id = Number(taskId);
-  if (!Number.isFinite(id)) return { sessions: 0, awarded: 0 };
+  if (!Number.isFinite(id)) return { sessions: 0, awarded: 0, attached: 0 };
   return api.withTx(async (client) => {
+    // Recover any link the client-side upload failed to send BEFORE looking for
+    // payable sessions — otherwise a skipped upload is unpayable forever.
+    const { attached } = await attachClaimSessionsToTaskTx(client, id);
     const { rows } = await client.query(
       `SELECT session_id, builder_id, model_usage, total_tokens
          FROM session_records
@@ -224,7 +293,7 @@ async function awardDeferredSessionRewardForTask(taskId) {
       });
       if (tokenReward && tokenReward.awarded && tokenReward.drachmae > 0) awarded += 1;
     }
-    return { sessions: rows.length, awarded };
+    return { sessions: rows.length, awarded, attached };
   });
 }
 
@@ -287,6 +356,64 @@ async function reconcileUnbookedSessionRewards({ limit = 200 } = {}) {
   });
 }
 
+// reconcileUnattachedClaimSessions — the ATTRIBUTION half of the safety net
+// (task 1002964), and the reason reconcileUnbookedSessionRewards alone was not
+// enough. That sweep starts from session_records.task_ids, so a session the
+// client never linked is invisible to it — the very rows most in need of rescue
+// are the ones it cannot see. This sweep runs FIRST and comes at it from the
+// other side: start from LANDED tasks, walk their claims, and link the claiming
+// builder's overlapping sessions. Once linked, the existing sweep pays them.
+//
+// Ordering matters: the poller calls this, then reconcileUnbookedSessionRewards.
+// Same idempotency story as attachClaimSessionsToTaskTx — a session already
+// carrying the task is skipped by the NOT (task_ids @> …) guard, and the payout
+// stays exactly-once per session regardless of how many tasks it links to.
+// Strictly pay-on-land: only tasks at status='shipped' are considered.
+//
+// ⚠️ LOOKBACK WINDOW — this is a SAFETY NET, NOT A BACKFILL. The reward sweep
+// runs immediately after this one, so every task linked here becomes payable on
+// the same tick. Unbounded, the first run would retro-link the ENTIRE history
+// (measured on cloudbongos.com 2026-08-16: 1383 tasks / 1157 sessions for one
+// builder alone) and mint a mass retroactive payout nobody authorised. Deliberate
+// historical back-pay is an Archon decision made with eyes open via
+// scripts/gds/backfill-task-rewards.js (dry-run by default, reviewed amounts) —
+// never a side effect of a poller starting up. So we only consider tasks that
+// landed inside the window: recent enough that a live client-side upload skip is
+// what we are recovering from. Widen it deliberately, never casually.
+// Returns { scanned, attached }.
+const ATTACH_LOOKBACK_DAYS = Number(process.env.SESSION_ATTACH_LOOKBACK_DAYS) || 7;
+
+async function reconcileUnattachedClaimSessions({ limit = 200, lookbackDays } = {}) {
+  const n = Number(limit);
+  const cap = Number.isFinite(n) ? Math.max(1, Math.min(1000, Math.trunc(n))) : 200;
+  const d = Number(lookbackDays ?? ATTACH_LOOKBACK_DAYS);
+  const days = Number.isFinite(d) ? Math.max(1, Math.min(365, Math.trunc(d))) : 7;
+  return api.withTx(async (client) => {
+    // Candidate LANDED tasks whose claiming builder has at least one overlapping
+    // session that is not yet linked. Bounded, newest first — a backlog drains
+    // over successive sweeps rather than in one unbounded UPDATE.
+    const { rows } = await client.query(
+      `SELECT DISTINCT c.task_id
+         FROM claims c
+         JOIN tasks t ON t.id = c.task_id AND t.status = 'shipped'
+         JOIN session_records sr ON sr.builder_id = c.builder_id
+        WHERE NOT (sr.task_ids @> ARRAY[c.task_id]::bigint[])
+          AND COALESCE(t.shipped_at, t.updated_at) >= now() - ($2 || ' days')::interval
+          AND COALESCE(sr.started_at, sr.uploaded_at) <= COALESCE(c.released_at, now())
+          AND COALESCE(sr.ended_at,   sr.uploaded_at) >= c.claimed_at
+        ORDER BY c.task_id DESC
+        LIMIT $1`,
+      [cap, String(days)]
+    );
+    let attached = 0;
+    for (const r of rows) {
+      const res = await attachClaimSessionsToTaskTx(client, r.task_id);
+      attached += res.attached;
+    }
+    return { scanned: rows.length, attached };
+  });
+}
+
 // ---- 6D.2: session search + fetch (read side, ADR 0027) -------------------
 
 // Safe ORDER BY whitelist — the ONLY value interpolated into the search SQL, so
@@ -459,6 +586,8 @@ module.exports = {
   upsertSessionRecordWithReward, // route entry point — upsert + token reward (task 1005)
   awardDeferredSessionRewardForTask, // ADR 0120 land-side trigger — task.shipped listener calls it
   reconcileUnbookedSessionRewards, // ADR 0120 state-based safety net — books rewards for out-of-band ships
+  attachClaimSessionsToTaskTx, // task 1002964 — server-side task↔session link, recovered from the claim
+  reconcileUnattachedClaimSessions, // task 1002964 — attribution sweep; must run BEFORE the reward sweep
   // search + fetch (6D.2)
   searchSessions,
   summarizeSessions,

package/modules/sessions/pollers/session-reward-reconcile.js

@@ -29,13 +29,25 @@ let intervalTimer = null;
 let firstTimer = null;
 
 async function runSweep() {
+  // ATTRIBUTION FIRST (task 1002964). reconcileUnbookedSessionRewards starts from
+  // session_records.task_ids, so a session whose client-side upload skipped — and
+  // which therefore carries an EMPTY task_ids — is invisible to it. Those are
+  // precisely the stranded rows worth rescuing, so recover the task↔session link
+  // from the claim before looking for unbooked rewards. Both halves are
+  // idempotent, so a re-sweep neither re-links nor double-pays.
+  const attach = await db.reconcileUnattachedClaimSessions({ limit: 200 });
+  if (attach && attach.attached > 0) {
+    console.log(
+      `[session-reward-reconcile] linked ${attach.attached} session(s) to landed tasks from claim state (scanned ${attach.scanned})`
+    );
+  }
   const res = await db.reconcileUnbookedSessionRewards({ limit: 200 });
   if (res && res.awarded > 0) {
     console.log(
       `[session-reward-reconcile] booked ${res.awarded} stranded session reward(s) (scanned ${res.scanned})`
     );
   }
-  return res;
+  return { ...res, attached: attach ? attach.attached : 0 };
 }
 
 // Start the periodic sweep. Idempotent (a second call is a no-op). Kill-switched by

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.154",
+  "version": "1.19.156",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.154",
+      "version": "1.19.156",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.154",
+  "version": "1.19.156",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/index.html

@@ -144,11 +144,62 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
    at rest and would otherwise sit visible at full stroke. */
 @media (prefers-reduced-motion:reduce){.bongos .ring{display:none;}}
 
-/* ── S3 · the mechanism ── */
-.beats{--col:238px;}
-.beat{background:var(--card);border-radius:22px;box-shadow:var(--shadow-card);padding:clamp(19px,2.5vw,26px);}
-.beatNum{font-family:var(--font-mono);font-size:12px;font-weight:500;color:var(--accent);letter-spacing:1.3px;text-transform:uppercase;margin-bottom:11px;}
-.beat p{font-size:var(--fs-body);font-weight:500;color:var(--ink-soft);line-height:1.58;}
+/* ── S3 · the builder-credit strip (apex-only content; classes .verro*) ──
+   Deliberately a different house from the rest of the page. Its palette is a
+   LOCAL token set, not the Bongos one: cool greys that hold in both schemes,
+   so the block reads as an inset plaque rather than another warm card. Only
+   these five tokens are local — everything else still comes from cosmos.css. */
+.verro{
+  --v-ground:#e9ecec; --v-surface:#f3f5f5; --v-ink:#4e5457;
+  --v-ink-strong:#33383b; --v-hair:#aeb6b8;
+  background:var(--v-ground);border-radius:20px;
+  padding:clamp(18px,2.4vw,26px) clamp(20px,2.8vw,30px);
+  box-shadow:var(--shadow-card);overflow:hidden;
+}
+@media (prefers-color-scheme:dark){
+  .verro{--v-ground:#15181a;--v-surface:#1b1f21;--v-ink:#aeb6b9;--v-ink-strong:#d6dcde;--v-hair:#3d4548;}
+}
+:root[data-theme="dark"] .verro{--v-ground:#15181a;--v-surface:#1b1f21;--v-ink:#aeb6b9;--v-ink-strong:#d6dcde;--v-hair:#3d4548;}
+:root[data-theme="light"] .verro{--v-ground:#e9ecec;--v-surface:#f3f5f5;--v-ink:#4e5457;--v-ink-strong:#33383b;--v-hair:#aeb6b8;}
+/* mark LEFT, text RIGHT — a fixed logo column, the copy takes the rest */
+.verroInner{position:relative;display:grid;grid-template-columns:124px 1fr;gap:clamp(18px,2.6vw,30px);align-items:center;}
+.verroMark{
+  font-family:system-ui,-apple-system,"Segoe UI",Arial,sans-serif;font-weight:400;
+  font-size:clamp(19px,2.6vw,26px);letter-spacing:.075em;line-height:1;
+  color:var(--v-ink-strong);margin-bottom:11px;
+  text-shadow:-1px 0 rgba(214,120,40,.26),1px 0 rgba(60,120,190,.26);
+}
+.verroRule{width:40px;height:1px;background:var(--v-hair);margin-bottom:12px;}
+.verro p{
+  position:relative;font-family:system-ui,-apple-system,"Segoe UI",Arial,sans-serif;
+  font-size:clamp(14px,1.5vw,15.5px);font-weight:400;line-height:1.58;
+  color:var(--v-ink);max-width:62ch;
+}
+.verroMedal{justify-self:center;}
+/* No border-radius needed: the PNG is already masked to a transparent-cornered
+   disc, so it sits on the grey block with nothing to clip. Width/height are
+   also set as attributes on the element so the box is reserved before the
+   image loads and the block does not reflow. */
+.verroMedal .verroDisc{width:124px;height:124px;display:block;}
+@media (max-width:760px){
+  .verroInner{grid-template-columns:1fr;justify-items:center;text-align:center;}
+  .verroRule{margin-left:auto;margin-right:auto;}
+}
+
+
+/* ── S6b · the basics ── */
+.basics{--col:300px;align-items:stretch;}
+.basic{background:var(--card);border-radius:22px;box-shadow:var(--shadow-card);padding:clamp(20px,2.8vw,28px);}
+.basicWho{font-family:var(--font-mono);font-size:12px;font-weight:500;color:var(--accent);letter-spacing:1.3px;text-transform:uppercase;margin-bottom:11px;}
+.basic ul{list-style:none;margin:14px 0 0;padding:0;display:flex;flex-direction:column;gap:13px;}
+.basic li{position:relative;padding-left:19px;font-size:var(--fs-body);font-weight:500;color:var(--ink-soft);line-height:1.55;}
+.basic li::before{content:"";position:absolute;left:0;top:.62em;width:7px;height:7px;border-radius:50%;background:var(--accent);}
+.basic li b{font-weight:700;color:var(--ink);}
+/* second level: the points that fold up under a tier. Hollow marker so the
+   nesting reads as subordinate rather than as another top-level choice. */
+.basic li ul{margin:9px 0 0;gap:7px;}
+.basic li li{padding-left:16px;font-size:calc(var(--fs-body) - .5px);}
+.basic li li::before{top:.66em;width:5px;height:5px;background:transparent;border:1.5px solid var(--accent);}
 
 /* ── S4 · the lifecycle: cosmos.css's .strip, unmodified, doing marketing work.
       The marketing page and the working page share the component rather than
@@ -179,10 +230,10 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 .conTag{font-size:12.5px;font-weight:600;color:rgba(255,246,230,.58);margin-top:3px;line-height:1.35;display:block;}
 .conItem .chip{margin-top:8px;white-space:nowrap;}
 
-/* ── S6/S7 ── */
-.own{background:var(--card);border-radius:24px;box-shadow:var(--shadow-card);padding:clamp(22px,3.2vw,34px);}
-.door{background:var(--card);border-radius:22px;box-shadow:var(--shadow-card);padding:clamp(20px,2.8vw,28px);display:flex;flex-direction:column;gap:10px;align-items:flex-start;}
-.door p{font-size:var(--fs-body);font-weight:500;color:var(--ink-soft);line-height:1.55;flex:1;}
+/* ── S7 ── */
+/* S7 closes on two bare buttons — the door cards are gone (task 1002934), and
+   .door/.door p went with them rather than lingering as dead rules. */
+.closing .cta-row{justify-content:center;}
 
 @media (max-width:900px){
   .lead{grid-template-columns:1fr;text-align:center;}
@@ -238,11 +289,16 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
   <section class="lead">
     <div>
       <p class="eyebrow">type <b>bongos</b> in <span class="typed" id="typed">any AI</span><span class="caret" aria-hidden="true">▌</span></p>
-      <h1 class="big" data-brand-tagline>Building software is laying&nbsp;down a beat.</h1>
-      <p class="lede">AI agents claim tasks and ship the code; you set the direction and the gates.</p>
+      <h1 class="big" data-brand-tagline>Building Digitally, as simple as&nbsp;Bongos.</h1>
+      <p class="lede">AI agents claim tasks and ship code. You direct them.</p>
+      <!-- ONE button by owner direction (task 1002934). The former ghost CTA
+           ("See what's building") is gone; the survivor keeps .btn.lg exactly as
+           it was — a deletion, not a restyle. It now points at /projects rather
+           than /projects?view=new because the label is an invitation to browse,
+           not to create. NOTE for a child instance: /projects there means that
+           instance's own provisioning rows, not the hub catalog. -->
       <div class="cta-row">
-        <a class="btn lg" href="/projects?view=new">Start a project</a>
-        <!--apex-only:start--><a class="btn ghost lg" href="/projects">See what's building</a><!--apex-only:end-->
+        <a class="btn lg" href="/projects">Explore Bongo Projects</a>
       </div>
     </div>
     <div class="mascot">
@@ -329,41 +385,64 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
   </section>
 </div>
 
-<!-- ══ S3 · THE MECHANISM ══════════════════════════════════════════════════
-     "AI writes code" is a crowded claim and not the differentiator. What is
-     actually enforced — a complete ledger, a server-checked ladder, an
-     adversarial grade — is. All three are portable: a child instance inherits
-     them, so none of this section is apex-only.
+<!--apex-only:start-->
+<!-- ══ S3 · VERRO LABS ═════════════════════════════════════════════════════
+     Replaces the three mechanism cards (the ledger / the gates / the grade) by
+     owner direction, task 1002934.
+
+     APEX-ONLY, and it must stay that way: a child instance is NOT built by
+     Verro Labs and must never say so. The block the beats used to occupy was
+     deliberately portable; this one cannot be. Consequence a child instance
+     now has nothing between the hero and the lifecycle — flagged to the owner
+     as a follow-up decision, not silently absorbed.
+
+     The design is drawn FROM the Verro Labs logo so it reads as a different
+     house inside the warm Bongos page: cool grey monochrome, a wide-tracked
+     uppercase wordmark, and a dialled-down chromatic fringe.
+
+     NO HAIRLINE FRAME. An earlier pass added one, reading the thin rectangle
+     in the logo lockup as part of the mark; the owner confirmed it was not
+     meant to be there. Do not reintroduce it.
      ═══════════════════════════════════════════════════════════════════════ -->
 <div class="wrap">
-  <section class="sec grid beats">
-    <div class="beat">
-      <div class="beatNum">the ledger</div>
-      <h3 class="sec-h3">Every change is a claimed task</h3>
-      <p>No admin loophole, no tiny-fix loophole. If work happened, there is a row that says who did
-         it, what it cost, and why. The ledger is complete or it lies.</p>
-    </div>
-    <div class="beat">
-      <div class="beatNum">the gates</div>
-      <h3 class="sec-h3">A rank ladder the server enforces</h3>
-      <p>Authority lives in the database, checked per request, never cached. An agent editing its own
-         instructions grants itself nothing.</p>
-    </div>
-    <div class="beat">
-      <div class="beatNum">the grade</div>
-      <h3 class="sec-h3">Nothing ships ungraded</h3>
-      <p>An adversarial panel reads the real committed diff before work lands — not the summary the
-         agent wrote about itself.</p>
+  <section class="sec verro">
+    <div class="verroInner">
+      <!-- mark first in source order as well as visually, so it reads the same
+           way to a screen reader and stacks logo-above-text on a narrow screen
+           without needing an order override -->
+      <div class="verroMedal">
+        <!-- The Verro Labs medallion. Cropped from the supplied artwork to the
+             circle only and masked to a transparent-cornered disc, so there is
+             no white plate and no square frame to hide with CSS. The file is
+             384px against a 124px box — comfortably past 2x, so it stays sharp
+             if the block is ever scaled back up.
+
+             NOTE ON SHARPNESS: the source was a 217x210 screenshot and the disc
+             within it only 193x197, so this is upscaled and will look soft on a
+             high-DPI screen. If a higher-resolution original (or a vector)
+             exists, re-crop from that — the recipe is in the task notes. -->
+        <img class="verroDisc" src="assets/verro-medallion.png"
+             width="124" height="124" loading="lazy" decoding="async"
+             alt="The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry">
+      </div>
+      <div>
+        <div class="verroMark">VERRO LABS</div>
+        <div class="verroRule"></div>
+        <p>Built by Verro Labs, Cloud Bongos is our way of making AI co-building usable by entire
+           project groups — whether that's a 5,000-person company, a 3,000-person department inside
+           one, a college research project, or a solo dev.</p>
+      </div>
     </div>
   </section>
 </div>
 
+<!--apex-only:end-->
+
 <!-- ══ S4 · THE LIFECYCLE ══════════════════════════════════════════════════ -->
 <div class="wrap">
   <section class="sec railWrap">
-    <h2 class="sec-h">How a change reaches your project</h2>
-    <p class="sec-p">The same five beats every task moves through — the ones you'll watch on your own
-      projects page.</p>
+    <h2 class="sec-h">A project as a codebase, regardless of function.</h2>
+    <p class="sec-p">A laddered beat progresses all tasks.</p>
     <div class="strip isLive" role="img" aria-label="claim, build, grade, ship, credit">
       <ul class="stages">
         <li class="done"><span class="sdot"></span><span class="slbl">claim</span></li>
@@ -391,7 +470,8 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
     <div class="bandHead">
       <div>
         <h2 class="sec-h">Built on Cloud Bongos</h2>
-        <p class="bandSub">Real projects, standing up right now.</p>
+        <p class="bandSub">At present, Bongos projects are all held by Verro Labs or its pilot
+          clients.</p>
       </div>
       <a class="linklike" href="/projects">Open the map →</a>
     </div>
@@ -401,43 +481,61 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 <!--apex-only:end-->
 
 <!--apex-only:start-->
-<!-- ══ S6 · WHAT YOU OWN ═══════════════════════════════════════════════════
-     Copy verbatim from create.html — already owner-approved and already
-     public-facing. It is a claim about Cloud Bongos the platform, so it does
-     not travel to a child instance.
+<!-- ══ S6b · THE BASICS ═════════════════════════════════════════════════════
+     New dual block, owner direction (task 1002934). Inside the existing
+     apex-only run: it describes Verro Labs' commercial offering, which is not
+     true of a child instance.
+
+     Placement is a planner's call — the last block before the closing
+     doors, so the practical explainer sits just ahead of the final ask.
      ═══════════════════════════════════════════════════════════════════════ -->
 <div class="wrap">
-  <section class="sec own">
-    <h2 class="sec-h">What you own</h2>
-    <p class="sec-p" style="margin-bottom:18px;">Free while we find our feet. Your project's repo and
-      server are yours — Cloud Bongos is
-      <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source
-      (AGPL-3.0)</a> and capture-resistant by design. Run the whole thing on your own box and owe us
-      nothing; the hosted version is a convenience, not a lock.</p>
-    <!-- server-stamped from the pack's repo binding, never baked: a hardcoded
-         owner/name would point every instance at whoever authored this file, and
-         the authorship audit fails it. Dropped below if the pack names no repo. -->
-    <a class="btn ghost" href="{{sourceRepoUrl}}" target="_blank" rel="noopener">Read the source →</a>
+  <section class="sec">
+    <div class="grid pair basics">
+      <div class="basic">
+        <div class="basicWho">For founders</div>
+        <h3 class="sec-h3">Types of projects</h3>
+        <ul>
+          <li><b>Open source.</b> Download our core code and protocols, and build instantly with
+            your team.</li>
+          <!-- "Bongos Managed" and "Cloud Bongos Managed" were two separate tiers with
+               near-identical names, which read as the same thing said twice. Consolidated
+               into one tier by owner direction; every point from both now sits under it. -->
+          <li><b>Bongos Managed.</b>
+            <ul>
+              <li>Buy microtransaction packages of code modules on our marketplace.</li>
+              <li>Have us handle your hosting.</li>
+              <li>Get access to our advanced project presets and module packages.</li>
+              <li>Equity issuance, business filing, and builder compensation.</li>
+            </ul>
+          </li>
+        </ul>
+      </div>
+      <div class="basic">
+        <div class="basicWho">For builders</div>
+        <h3 class="sec-h3">Ways to get paid</h3>
+        <ul>
+          <li><b>Build equity</b> in multiple projects.</li>
+          <li><b>Work as a contractor</b> for companies big, medium and small — and get paid
+            instantly.</li>
+          <li><b>Build as a game</b> or a learning experience.</li>
+        </ul>
+      </div>
+    </div>
   </section>
 </div>
 <!--apex-only:end-->
 
-<!-- ══ S7 · TWO DOORS ══════════════════════════════════════════════════════
-     The hero can only lead one of the two arrivals. This is the second chance
-     for whichever one it didn't serve.
+<!-- ══ S7 · THE CLOSING PAIR ═══════════════════════════════════════════════
+     Was two "door" cards (Build a project / Join as a builder). Reduced to two
+     bare buttons by owner direction, task 1002934 — the hero already made the
+     argument, so the page closes on the choice rather than re-pitching it.
      ═══════════════════════════════════════════════════════════════════════ -->
 <div class="wrap">
-  <section class="sec grid pair">
-    <div class="door">
-      <h3 class="sec-h3">Build a project</h3>
-      <p>Say what you want to exist. Agents take it from there, and you hold every gate that matters.</p>
-      <a class="btn" href="/projects?view=new">Start a project</a>
-    </div>
-    <div class="door">
-      <h3 class="sec-h3">Join as a builder</h3>
-      <p>Claim tasks, ship code, earn credits. The hall is where the work is, and newcomers start
-         with a real task on day one.</p>
-      <a class="btn ghost" data-link-hall href="{{buildersOrigin}}">Enter the Hall →</a>
+  <section class="sec closing">
+    <div class="cta-row">
+      <a class="btn lg" href="/projects?view=new">Start a Project</a>
+      <a class="btn ghost lg" href="/projects">Find a Project</a>
     </div>
   </section>
 </div>

package/src/module-api.js

@@ -735,8 +735,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.152 with no explicit bump. run 31956560292. (task 1002620)
 //   1.19.154 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.153 with no explicit bump. run 31957052737. (task 1002620)
+//   1.19.155 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.154 with no explicit bump. run 31957556550. (task 1002620)
+//   1.19.156 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.155 with no explicit bump. run 31957976979. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.154'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.156'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cloud_bongos_pack.mjs

@@ -44,7 +44,8 @@ test('R74: the vanilla pack carries the Cloud Bongos LOOK (sunrise palette, Balo
   assert.match(c.theme.favicon, /circle/, 'bongo-pair favicon (circles), not the Greek Α');
   assert.doesNotMatch(c.theme.favicon, /font-family='serif'>Α/);
   assert.equal(c.theme.backdrop, '#f9d9a8', 'the marigold ground holds all the way down');
-  assert.equal(c.copy.tagline, 'Building software is laying down a beat.');
+  // task 1002934: the owner's homepage rewrite retitled the platform.
+  assert.equal(c.copy.tagline, 'Building Digitally, as simple as Bongos.');
   assert.equal(c.rankLabels.archon, 'Owner', 'plain rank labels, not "Archon"');
 });
 

package/tests/landing_page.mjs

@@ -55,20 +55,22 @@ test('the hub keeps every apex-only section', () => {
 test('a child instance is served none of the platform-only claims', () => {
   const child = stripApexOnly(HTML, false);
   assert.doesNotMatch(child, /<!--apex-only:(start|end)-->/, 'no sentinel survives the strip');
-  // the four regions, by their load-bearing content
+  // the apex-only regions, by their load-bearing content (task 1002934: the
+  // Verro Labs strip + The Basics replaced the beats / What-you-own era)
   assert.doesNotMatch(child, /capture-resistant commons/, 'the commons claim is the platform\'s, not a child\'s');
   assert.doesNotMatch(child, /Built on Cloud Bongos/, 'a child has no catalog of other instances');
-  assert.doesNotMatch(child, /What you own/, 'the AGPL/ownership pitch is the platform\'s');
-  assert.doesNotMatch(child, /See what's building/, 'the catalog CTA has nothing to point at');
+  assert.doesNotMatch(child, /Verro Labs/, 'a child instance is not built by Verro Labs');
+  assert.doesNotMatch(child, /Bongos Managed/, 'the commercial offer is the platform\'s, not a child\'s');
+  assert.doesNotMatch(child, /thousands of builders/, 'a child has no hub builder pool to promise');
 });
 
 test('a child instance keeps the whole portable spine', () => {
   const child = stripApexOnly(HTML, false);
   for (const portable of [
-    'Building software is laying', // the hero tagline
-    'the ledger', 'the gates', 'the grade', // S3, the differentiator
-    'How a change reaches your project', // S4
-    'Build a project', 'Join as a builder', // S7, both doors
+    'Building Digitally, as simple as', // the hero tagline (task 1002934)
+    'A project as a codebase', // S4 heading (task 1002934 rewording)
+    'A laddered beat progresses all tasks', // S4 subtitle
+    'Start a Project', 'Find a Project', // S7, the closing pair (buttons since 1002934)
     'Built by agents, on Cloud', // the portable half of the footer
     'id="who"', // the identity chip
   ]) {
@@ -109,7 +111,9 @@ test('every head tag a crawler reads is stamped, and no token survives', () => {
 test('every cross-host link is stamped to THIS instance, never the platform', () => {
   const out = applyBrandTokens(HTML, BRAND, 'https://spike-harbor.example', 'https://builders.spike-harbor.example');
   const halls = [...out.matchAll(/data-link-hall href="([^"]*)"/g)].map((m) => m[1]);
-  assert.ok(halls.length >= 2, 'the header door and the builders door both point at the hall');
+  // task 1002934: the S7 door cards (which carried the second hall link) became
+  // two bare project buttons — the header Hall entry is the one that remains.
+  assert.ok(halls.length >= 1, 'the header Hall entry points at the hall');
   for (const href of halls) assert.equal(href, 'https://builders.spike-harbor.example');
   // C6: this is the bug the stamping fixes — clientBranding() omits domains, so a
   // client fill can never re-point these and every child sent visitors to the platform.
@@ -121,19 +125,21 @@ test('a pack with no hall of its own falls back to its own apex, not the platfor
   assert.match(out, /data-link-hall href="https:\/\/spike-harbor\.example"/);
 });
 
-test('the source link is stamped from the pack repo, never a baked owner/name', () => {
-  // the authorship audit fails a hardcoded owner/name, and a baked one would
-  // point every instance at whoever authored this file
+test('no repo path is baked into the page', () => {
+  // task 1002934 removed the "What you own" section and with it the page's only
+  // {{sourceRepoUrl}} link (owner-accepted). What must still hold: no HARDCODED
+  // owner/name — a baked one would point every instance at whoever authored
+  // this file, and the authorship audit fails it.
   assert.doesNotMatch(HTML, /github\.com\/[a-z0-9-]+\/[a-z0-9-]+/i, 'no baked repo path');
-  const out = applyBrandTokens(HTML, BRAND, 'https://o.example', '', 'https://github.com/acme/harbor');
-  assert.match(out, /href="https:\/\/github\.com\/acme\/harbor"/);
 });
 
 test('an unstamped link is removed, not left dangling', () => {
-  const out = applyBrandTokens(HTML, BRAND, 'https://o.example', '', '');
-  assert.match(out, /href=""/, 'the token resolves empty when the pack names no repo');
-  assert.match(CODE, /a\[href=""\]/, 'and the page drops those links');
+  // the page keeps its empty-href scrubber so ANY future unstamped token link
+  // (the header hall entry today) is dropped rather than rendered dead.
+  const out = applyBrandTokens(HTML, BRAND, 'https://o.example', '');
+  assert.match(CODE, /a\[href=""\]/, 'the page drops empty-href links');
   assert.match(CODE, /\.remove\(\)/);
+  assert.ok(out.length > 0);
 });
 
 // ── the branding cascade + portability ─────────────────────────────────────
@@ -238,13 +244,12 @@ test('nothing about the platform is hardcoded — the file is portable (C5)', ()
 test('the page reads without JavaScript: the spine is markup, not script-built', () => {
   const body = HTML.split('<body>')[1].split('<script>')[0];
   for (const copy of [
-    'Building software is laying',
-    'Every change is a claimed task',
-    'A rank ladder the server enforces',
-    'Nothing ships ungraded',
-    'How a change reaches your project',
-    'Start a project',
-    'Enter the Hall',
+    'Building Digitally, as simple as', // hero (task 1002934)
+    'Built by Verro Labs',              // the Verro strip
+    'A project as a codebase',          // S4 heading
+    'Explore Bongo Projects',           // the hero CTA
+    'Start a Project',                  // the closing pair
+    'Find a Project',
   ]) {
     assert.ok(body.includes(copy), `"${copy}" is only reachable with scripting on`);
   }
@@ -297,7 +302,7 @@ test('the five primitives graduated into cosmos.css, not the page (§6)', () =>
 
 test('the page satisfies the parked platform_boot assertions', () => {
   assert.match(HTML, /id="who"/);
-  assert.match(HTML, /Enter the Hall/);
+  assert.match(HTML, /Find a Project/); // the landing marker since task 1002934
   // an ORG-level action that lives only on the gate — asserted absent there
   assert.doesNotMatch(HTML, /Create a project/);
 });

package/tests/platform_boot.mjs

@@ -113,7 +113,9 @@ test('the apex host serves the landing page — not the game — on a game-less
   assert.doesNotMatch(res.body, /404 — not found/);  // not the bare apex tail
   // it IS the landing, with the branding pack injected (look + identity from config)
   assert.match(res.body, /window\.__BRANDING__=/);
-  assert.match(res.body, /Enter the Hall/);
+  // task 1002934: the doors became two bare buttons; "Find a Project" is the
+  // portable landing marker now ("Enter the Hall" left with the door cards).
+  assert.match(res.body, /Find a Project/);
   // the per-project landing carries the top-right identity chip + hall entry
   // (goal 35, task 2094). "Create a project" is an ORG-level action that lives
   // only on the gate now — it must NOT appear on a project's own landing.

package/tests/session_attach_from_claim.mjs

@@ -0,0 +1,188 @@
+// tests/session_attach_from_claim.mjs
+//
+// Regression guard for task 1002964 — SERVER-SIDE task↔session attribution.
+//
+// THE BUG. Every payout path keys on session_records.task_ids, and until this
+// fix exactly ONE thing populated that column: ship.js's client-side upload.
+// When that upload skipped (classifyUploadSkip: no_session_id /
+// unsafe_session_id / transcript_not_found) the session was left with an EMPTY
+// task_ids — which matches NOTHING in the upload-side gate,
+// awardDeferredSessionRewardForTask, or reconcileUnbookedSessionRewards. The
+// reward stranded PERMANENTLY, invisible even to the state-based safety net.
+// Builder IAMMASTERQUA hit exactly this: 19 sessions, 19 empty, ~$730 of
+// recorded session cost, zero paid, for ten weeks.
+//
+// THE FIX. The server recovers the link from durable claim state — the claiming
+// builder's session_records whose activity window overlaps the claim window —
+// so a client-side skip can no longer zero a builder's pay. What this must NOT
+// do is loosen the landing gate: ADR 0120 still pays only for code that landed.
+//
+// Run:  node tests/session_attach_from_claim.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const api = require('../src/module-api.js');
+const db = require('../modules/sessions/db.js');
+
+const { test, summary } = makeRunner();
+
+// Same priceable fixture the sibling reward tests use: Opus 110k input →
+// $0.55 true cost → ×1.20 → 1 drachma. A non-zero payout is what lets the
+// idempotency watermark SELECT run at all.
+const MODEL_USAGE = { 'claude-opus-4-8': { input: 110_000 } };
+const WATERMARK_RE = /COALESCE\(SUM\(delta\)/;
+
+const norm = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+const find = (queries, re) => queries.find((q) => re.test(norm(q)));
+const all = (queries, re) => queries.filter((q) => re.test(norm(q)));
+
+const ATTACH_RE = /WITH cand AS .* UPDATE session_records/;
+const PAYABLE_RE = /SELECT session_id, builder_id, model_usage, total_tokens FROM session_records WHERE task_ids @>/;
+
+async function withFakeTx(handler, run) {
+  const fake = makeSqlAwareClient(handler);
+  const prev = api.withTx;
+  api.withTx = (fn) => fn(fake._client);
+  try {
+    const result = await run();
+    return { result, queries: fake.queries };
+  } finally {
+    api.withTx = prev;
+  }
+}
+
+// =========================================================================
+// (1) The attach runs, and runs BEFORE the payable-session lookup
+// =========================================================================
+
+await test('awardDeferredSessionRewardForTask: attaches from the claim BEFORE selecting payable sessions', async () => {
+  const seen = [];
+  const { result, queries } = await withFakeTx(
+    (s) => {
+      seen.push(s);
+      if (ATTACH_RE.test(s)) return { rows: [{ session_id: 'sess-hook-only' }] };
+      if (PAYABLE_RE.test(s)) {
+        return { rows: [{ session_id: 'sess-hook-only', builder_id: 7, model_usage: MODEL_USAGE, total_tokens: 5000 }] };
+      }
+      if (WATERMARK_RE.test(s)) return { rows: [{ paid: 0, legacy: 0 }] };
+      if (/^INSERT INTO credit_log/.test(s)) return { rows: [{ id: 1 }] };
+      return null;
+    },
+    () => db.awardDeferredSessionRewardForTask(660)
+  );
+
+  const attachIdx = seen.findIndex((s) => ATTACH_RE.test(s));
+  const payableIdx = seen.findIndex((s) => PAYABLE_RE.test(s));
+  assert.ok(attachIdx >= 0, 'the claim-based attach UPDATE must run');
+  assert.ok(payableIdx >= 0, 'the payable-session SELECT must run');
+  assert.ok(attachIdx < payableIdx,
+    'the attach MUST precede the payable lookup — otherwise a skipped upload is unpayable forever');
+  assert.equal(result.attached, 1, 'the freshly-linked session is reported');
+  assert.equal(result.awarded, 1, 'the hook-only session is paid once linked');
+});
+
+// =========================================================================
+// (2) The end-to-end shape the bug produced: hook-only record gets paid
+// =========================================================================
+
+await test('a hook-only record (empty task_ids, empty model_usage) is attributed and paid from total_tokens', async () => {
+  // The exact Masterqua row shape: no task, no per-model usage — only a token
+  // total. Pricing must fall back to totalTokens (task 1676) or this still pays 0.
+  const { result, queries } = await withFakeTx(
+    (s) => {
+      if (ATTACH_RE.test(s)) return { rows: [{ session_id: 'sess-masterqua' }] };
+      if (PAYABLE_RE.test(s)) {
+        return { rows: [{ session_id: 'sess-masterqua', builder_id: 1000025, model_usage: {}, total_tokens: 77_403_545 }] };
+      }
+      if (WATERMARK_RE.test(s)) return { rows: [{ paid: 0, legacy: 0 }] };
+      if (/^INSERT INTO credit_log/.test(s)) return { rows: [{ id: 1 }] };
+      return null;
+    },
+    () => db.awardDeferredSessionRewardForTask(660)
+  );
+
+  const insert = find(queries, /^INSERT INTO credit_log/);
+  assert.ok(insert, 'an empty model_usage must still book a reward via the totalTokens fallback');
+  assert.equal(result.awarded, 1, 'the session that was stranded for ten weeks now pays');
+});
+
+// =========================================================================
+// (3) Idempotency + the landing gate (the two things this must not break)
+// =========================================================================
+
+await test('attach SQL skips sessions already carrying the task (no re-link, no double-pay)', async () => {
+  const { queries } = await withFakeTx(
+    (s) => {
+      if (ATTACH_RE.test(s)) return { rows: [] }; // nothing new to link
+      if (PAYABLE_RE.test(s)) return { rows: [] };
+      return null;
+    },
+    () => db.awardDeferredSessionRewardForTask(660)
+  );
+  const attach = find(queries, ATTACH_RE);
+  assert.ok(/NOT \(sr\.task_ids @> ARRAY/.test(norm(attach)),
+    'the attach must exclude sessions already linked to this task');
+  assert.equal(all(queries, /^INSERT INTO credit_log/).length, 0, 'nothing linked → nothing paid');
+});
+
+await test('attach is bounded by a LIMIT so one long session cannot fan out an unbounded UPDATE', async () => {
+  const { queries } = await withFakeTx(
+    (s) => (ATTACH_RE.test(s) || PAYABLE_RE.test(s) ? { rows: [] } : null),
+    () => db.awardDeferredSessionRewardForTask(660)
+  );
+  const attach = find(queries, ATTACH_RE);
+  assert.ok(/LIMIT \$2/.test(norm(attach)), 'the candidate set must be bounded');
+  assert.equal(attach.params[1], 50, 'default cap');
+});
+
+await test('reconcileUnattachedClaimSessions considers ONLY landed tasks (ADR 0120 unchanged)', async () => {
+  const { queries } = await withFakeTx(
+    (s) => (/FROM claims c JOIN tasks t/.test(s) ? { rows: [] } : null),
+    () => db.reconcileUnattachedClaimSessions({ limit: 5 })
+  );
+  const scan = find(queries, /FROM claims c JOIN tasks t/);
+  assert.ok(scan, 'the attribution sweep must scan claims joined to tasks');
+  assert.ok(/t\.status = 'shipped'/.test(norm(scan)),
+    "the sweep must require status='shipped' — never attribute-and-pay unlanded work");
+  assert.equal(scan.params[0], 5, 'the caller-supplied limit is honoured');
+});
+
+// The guard that keeps a safety net from becoming an unauthorised mass payout.
+// Without the window, the first sweep on cloudbongos.com would have retro-linked
+// 1383 tasks / 1157 sessions for a single builder and paid them on the same tick.
+await test('the sweep is WINDOWED — it can never become a retroactive mass backfill', async () => {
+  const { queries } = await withFakeTx(
+    (s) => (/FROM claims c JOIN tasks t/.test(s) ? { rows: [] } : null),
+    () => db.reconcileUnattachedClaimSessions({ limit: 5 })
+  );
+  const scan = find(queries, /FROM claims c JOIN tasks t/);
+  assert.ok(/shipped_at, t\.updated_at\) >= now\(\) - /.test(norm(scan)),
+    'the sweep MUST bound itself to recently-landed tasks — historical back-pay is a deliberate Archon decision, not a poller side effect');
+  assert.equal(scan.params[1], '7', 'conservative default lookback');
+});
+
+await test('lookbackDays is clamped to a sane range (no 0-day no-op, no 10-year backfill)', async () => {
+  for (const [given, expected] of [[0, '1'], [-5, '1'], [99999, '365'], ['junk', '7']]) {
+    const { queries } = await withFakeTx(
+      (s) => (/FROM claims c JOIN tasks t/.test(s) ? { rows: [] } : null),
+      () => db.reconcileUnattachedClaimSessions({ limit: 5, lookbackDays: given })
+    );
+    assert.equal(find(queries, /FROM claims c JOIN tasks t/).params[1], expected,
+      `lookbackDays ${given} must clamp to ${expected}`);
+  }
+});
+
+await test('a non-finite task id is a clean no-op (no SQL, no reward)', async () => {
+  const { result, queries } = await withFakeTx(() => null, () => db.awardDeferredSessionRewardForTask('nope'));
+  assert.equal(queries.length, 0, 'a garbage id must not reach the DB');
+  assert.deepEqual(result, { sessions: 0, awarded: 0, attached: 0 });
+});
+
+summary();

package/tests/session_reward_on_land.mjs

@@ -224,8 +224,10 @@ await test('awardDeferredSessionRewardForTask: no session shipped this task →
 
 await test('awardDeferredSessionRewardForTask: non-numeric id → immediate no-op (no DB touch)', async () => {
   // No withTx patch — a bad id must return before opening a transaction.
+  // `attached` joined the shape in task 1002964 (the claim-based attribution
+  // recovery that now runs ahead of the payable-session lookup).
   const out = await db.awardDeferredSessionRewardForTask('not-a-number');
-  assert.deepEqual(out, { sessions: 0, awarded: 0 });
+  assert.deepEqual(out, { sessions: 0, awarded: 0, attached: 0 });
 });
 
 // =========================================================================