@bongos/core 1.19.242 → 1.19.244

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.242",
-  "core_contract": "1.19.242",
-  "source_commit": "900c5fe4161d60490d52cd4dfa2e0857a2748042",
+  "core_version": "1.19.244",
+  "core_contract": "1.19.244",
+  "source_commit": "41bd2c1c85734ca5037a53163d076727d440c940",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T20:58:51.212Z",
+  "built_at": "2026-08-18T23:17:48.329Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 312,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1327,
+    "functional_verbatim": 1329,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1660,
-  "tree_sha256": "367c3937d0fd713cbda6b0e1ea8a32ea5f0be72b756ba5440760d6ff8a07b5d4",
+  "file_count": 1662,
+  "tree_sha256": "d1832fb3f92654fd279af06314cb91b05664d23e20bd2b36124ba869b0c1eeb6",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1507,7 +1507,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "0cb2b0b917f7d75a97d501c4c23e6a791aec4ed5c655025841d91ff8c1c10638"
+      "sha256": "ffea58fedd395431492f6f9120c98b11403a37988722e5fa3f43bfdc05709922"
     },
     {
       "path": "docs/handoff-template.md",
@@ -4347,12 +4347,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "026bf4799e0c4eab9e946c1f9d1668f5ee3f47ad487ef5abbfe9de063867cc0f"
+      "sha256": "cb2a6025e2f181d25b23c163ddabea64fbb2285f6e6e48e9d50742d1150ca8ae"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "343d7a6a0e9c8123a4f5cf336dfb8bdaf59c735227371c8fe8b632b6a17706a5"
+      "sha256": "0cab22f1627a9ddb9faeba787e06dc1914e4ae0d8567ccea231265a563339ee2"
     },
     {
       "path": "public-docs/index.html",
@@ -4869,6 +4869,11 @@
       "mode": "0000644",
       "sha256": "8ca6ee391837d7e1a45e69fc62c4a051f5e3d6060db507cdcbc7a343e2b03bd3"
     },
+    {
+      "path": "scripts/gds/copy-inventory.js",
+      "mode": "0000644",
+      "sha256": "8eeeea6fb29101dbd4dc6ce874a8bc87dd1945434f5b6c13a04e7312cc449a4b"
+    },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
       "mode": "0000644",
@@ -5532,12 +5537,12 @@
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
       "mode": "0000644",
-      "sha256": "96a38493a51e3b21d6059bda25bff0bc36123117f7a683d7fc83e4ccf779b899"
+      "sha256": "d27deba8997676ed2224d2261316b3e60c0668bcde585f7efd0443d6ab150d89"
     },
     {
       "path": "scripts/gds/smoke-batch-release.sh",
       "mode": "0000644",
-      "sha256": "1b0276b21420cd4fdbb9a77f0b34270e90109cd62579469e71607c286821904b"
+      "sha256": "57e6f1ce66cd4e5cb7d6bbbd409f074b137344ba7c281a122f8ad42243d76029"
     },
     {
       "path": "scripts/gds/smoke-box.sh",
@@ -5772,7 +5777,7 @@
     {
       "path": "src/bongos/llm-pricing.js",
       "mode": "0000644",
-      "sha256": "f7688e75a873f9c287f6559311877081830798cb1b5f1e548ceff3fcbed9e31d"
+      "sha256": "a932e617ee66dabc49b4087baf6606eeb2074f70ebb3efa0723b1d9c92add290"
     },
     {
       "path": "src/bongos/metrics.js",
@@ -5967,7 +5972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c78192a54a2578a22420c02ac2da5397bccc6fa582540d8184d792dac9b13df3"
+      "sha256": "a2f7371ccaf4bc1f558380c79440bfccf0e22f7856f910d881d9b251f038eb08"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6484,6 +6489,11 @@
       "mode": "0000644",
       "sha256": "55bd70efd8067e39d6220d14f78c743ce80d8a8ff37988acf00136b5108dc004"
     },
+    {
+      "path": "tests/copy_inventory.mjs",
+      "mode": "0000644",
+      "sha256": "3c1f0886799082734e72ceacba5212e7bc9b3f8081e834973383994ffb5eccab"
+    },
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
@@ -7332,7 +7342,7 @@
     {
       "path": "tests/llm-pricing.mjs",
       "mode": "0000644",
-      "sha256": "de3fabaeafb3eb3ad500becf565f3b6d7118a763f1e80d085f94b6ba990d5c58"
+      "sha256": "64f8bd94dc461ca9b4ef82fae929d49675231afa6a24d6d65ba2dbe8721efc89"
     },
     {
       "path": "tests/local_preview.mjs",

package/docs/file-map.md

@@ -50,6 +50,8 @@
 │   │   └── container-interior.md ← (#645) container building interior: layered industrial shell + aqua wave floor + boutique display; palette reconciled to ADR 0044
 │   ├── file-map.md              ← this file (§11 detail, split out V3.R86); the `.claude/skills/` + `.claude/scheduled-tasks/` trees are GENERATED (gen-file-map.js, ADR 0066) — do not hand-edit those blocks
 │   ├── file-map.notes.json      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): the sidecar of one-line notes for each skill/routine that gen-file-map.js renders into file-map.md; the ONE place to edit those notes — a new skill with no note here fails CI
+│   ├── copy-registry.json      ← GENERATED (scripts/gds/copy-inventory.js): the machine-readable copy registry — 1,096 user-facing strings with stable ids, render paths, and duplicates. R02's flag queue attaches to these ids; regenerate + commit, never hand-edit
+│   ├── copy-inventory.md       ← GENERATED twin of copy-registry.json: the human-readable copy report, including the "what this cannot see" section (server-side messages, skill prose, Discord copy, runtime-composed strings, and the src/ui-vs-reality surface mismatch)
 │   ├── handoff-template.md      ← session-end template + Definition of Done
 │   ├── google-chat-broadcast.md ← team-chat integration plan
 │   ├── pms-v1-deploy.md         ← step-by-step runbook to deploy PMS-V1 + status subdomain
@@ -175,6 +177,7 @@
 │       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
 │       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
 │       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`
+│       ├── copy-inventory.js  ← R01 of goal 1000074 (the artist's loop): the COPY REGISTRY — every user-facing string across the hall / status / landing surfaces, each row naming the render path that shows it (html-text · html-attr · js-markup · js-notice · js-text-assign) + a stable id that survives a move. Writes docs/copy-registry.json + docs/copy-inventory.md; `--check` fails on drift. Precision over recall: a JS literal with no render path is not listed
 │       ├── gen-diagrams.js      ← generates the 5 onboarding diagrams (`.mmd`/`.svg`/`.png` + `assertions.json`) from templates in this file — never hand-edit a `.mmd`/assertions.json; runs on deploy
 │       ├── gen-api-docs.js      ← ADR 0109: generates `docs/api/openapi.json` + `docs/api-reference.md` from the live route files via `route-rank-check.js` introspection, so the API reference cannot drift from what the server actually mounts
 │       ├── architect-audit.js   ← MAS Phase 5 (ADR 0024): the Architect's bounded first-principles `--scope`/`--paths` audit CLI → `docs/audits/`

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.242",
+  "version": "1.19.244",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.242",
+      "version": "1.19.244",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.242",
+  "version": "1.19.244",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -0,0 +1,425 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/gds/copy-inventory.js — the COPY REGISTRY (R01 of goal 1000074, the
+// artist's loop; from idea 1000736).
+//
+// WHAT IT IS FOR. The owner's ABI brief gives the artist the project's TEXT: no
+// slop, story and ideology communicated, purpose and gravitas, re-text-writing.
+// None of that is exercisable today, because the copy is scattered across 23 hall
+// HTML files, 34 hall JS files, the status dashboard and a server-rendered landing
+// template. This command is the inventory that makes it findable — read-only: no
+// editing, no queue, no UI (those are R02/R03).
+//
+// DELIBERATELY IN THE gen-* FAMILY: pure-ish (fs only — no DB, no network, no
+// clock, no randomness), deterministic byte-for-byte on the same tree, emitting one
+// machine-readable registry and one human report. Same posture as gen-repo-map /
+// gen-api-docs: a command you run and commit.
+//
+// THE SURFACE MISMATCH, RECORDED RATHER THAN ASSUMED AWAY. docs/design-contract.md
+// says UI components live under `src/ui/<surface>/`, and that a surface directory is
+// the unit a design adapter targets. On this tree `src/ui/` contains only
+// `adapters/` — the real UI is modules/hall-ui/public and modules/status-ui/public.
+// So this tool maps REAL paths onto contract-shaped surface ids and reports the
+// mismatch in its own output. Do not "fix" that by pretending the contract layout
+// exists.
+//
+// EVERY ROW NAMES ITS RENDER PATH (`origin`), which is what makes the inventory
+// trustworthy: html-text, html-attr:<attr>, html-title, js-markup (text inside
+// markup a script builds), js-notice (toast/alert/confirm), js-text-assign
+// (.textContent/.innerText/.title). A string this tool cannot tie to one of those
+// paths is not listed at all — the first cut filtered "literals that look like
+// prose" and produced 2144 rows of mostly code, including `use strict` 34 times.
+//
+// Run:  node scripts/gds/copy-inventory.js            (writes both artifacts)
+//       node scripts/gds/copy-inventory.js --check     (exit 1 if artifacts stale)
+//       node scripts/gds/copy-inventory.js --json      (registry to stdout, no write)
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const REGISTRY_REL = path.join('docs', 'copy-registry.json');
+const REPORT_REL = path.join('docs', 'copy-inventory.md');
+
+// The surfaces this tool knows how to read. `id` is the contract-shaped surface
+// name; `at` is where it REALLY lives. Adding a surface is a data edit — the point.
+const SURFACES = [
+  { id: 'builders-hall', kind: 'dir', at: path.join('modules', 'hall-ui', 'public'), exts: ['.html', '.js'] },
+  { id: 'status-dashboard', kind: 'dir', at: path.join('modules', 'status-ui', 'public'), exts: ['.html', '.js'] },
+  // THE LANDING SURFACE IS public-landing/, NOT src/platform-server.js. The first
+  // cut pointed here at the server file, which only fs.readFileSync's these
+  // templates — so its JS patterns matched a handful of incidental literals and the
+  // page's ACTUAL copy (hero, meta/og text, every section) was silently absent
+  // while the registry reported a number. Caught by the grader on task 1003112.
+  { id: 'landing', kind: 'dir', at: 'public-landing', exts: ['.html'] },
+];
+
+// Attributes whose value is COPY a person reads (not wiring). The matchers are
+// built ONCE — the first cut re-created all seven per markup literal.
+const COPY_ATTRS = ['title', 'aria-label', 'placeholder', 'alt', 'data-page-title', 'aria-description'];
+const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${attr}\\s*=\\s*"([^"]{4,400})"`, 'gi') }));
+
+// What this tool knowingly does not see. Printed in the report — an inventory that
+// implies completeness it does not have is worse than a short one.
+const BLIND_SPOTS = [
+  'Landing-page transforms: `public-landing/*.html` is scanned as authored, but the server rewrites it before a visitor sees it — `{{token}}` placeholders are filled from the branding pack, and `<!--apex-only:start--> … <!--apex-only:end-->` sections are STRIPPED on a child instance (src/platform-server.js `landingPage()`). So a row here may be copy that this instance never renders, and a rendered sentence may differ from its authored form.',
+  'Server-side messages: route failures (`res.fail` reasons), validation text and API error copy live in server JS and are not walked here. A person reads them, so widening to them is a deliberate later step, not an oversight to quietly fix.',
+  'Skill and playbook prose: `.claude/skills/**/SKILL.md` is read by agents and by builders and is arguably the largest body of project voice. Out of scope on purpose — it is not UI, and mixing it in would drown the UI signal.',
+  'Discord copy: outbound broadcast text is composed in `modules/discord/*.js` at send time. User-facing, but not part of any UI surface.',
+  'JS literals with no render path: a string is listed only when it can be tied to one — markup built in a script, a toast/alert/confirm argument, or a textContent/innerText/title assignment. Copy reaching the DOM by any other route (a helper that takes a message parameter, a string held in a config object) is invisible here, deliberately: the alternative is a queue where most rows are code.',
+  'Template literals containing a nested backtick: the literal scanner stops at the first closing backtick, so a nested template inside `${...}` truncates that one literal. Rare in this tree and cheap to spot (a row that ends mid-sentence); a real JS parser is the fix if it ever matters.',
+  'Runtime-composed strings: anything assembled from fragments or interpolated at render time is captured only as its literal parts. A sentence that exists only once the browser runs cannot be inventoried by reading the tree.',
+  'Generated pages: `docs/api-reference.md` and the OpenAPI surface are generated from route prose; that copy belongs to its generator, not to a designer.',
+  'The design-contract surface layout: `docs/design-contract.md` expects `src/ui/<surface>/`, which this tree does not use (`src/ui` holds only `adapters/`). Surface ids here are a MAPPING onto real paths, not evidence the contract layout exists.',
+];
+
+// A stable id survives the string MOVING: it hashes surface + normalized text,
+// never file or line. That is what lets a flag (R02) stay attached across
+// refactors — and two identical strings in one surface share an id, which is a
+// feature: they are one piece of copy shown twice.
+function stableId(surfaceId, text) {
+  const norm = text.replace(/\s+/g, ' ').trim();
+  return crypto.createHash('sha256').update(`${surfaceId} ${norm}`).digest('hex').slice(0, 12);
+}
+
+// Locale-independent string order — see the note on the entries sort below.
+function cmp(a, b) {
+  if (a === b) return 0;
+  return a < b ? -1 : 1;
+}
+
+// Line lookup without rescanning. The first cut counted newlines from offset 0 for
+// EVERY extracted string — O(n x matches) on the extractor's hottest loop (bounded
+// at ~62 files / ~1096 matches today, but needlessly quadratic-shaped; the grader
+// was right to flag it). One offset table per source, then a binary search.
+function lineIndex(source) {
+  const starts = [0];
+  for (let i = 0; i < source.length; i += 1) if (source[i] === '\n') starts.push(i + 1);
+  return starts;
+}
+
+function lineAt(starts, index) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi + 1) >> 1;
+    if (starts[mid] <= index) lo = mid; else hi = mid - 1;
+  }
+  return lo + 1;
+}
+
+// Does this look like prose a person reads, rather than code that happens to be a
+// string? Conservative on purpose — a false positive costs an artist's attention.
+function looksLikeCopy(raw) {
+  const s = String(raw).trim();
+  if (s.length < 4 || s.length > 400) return false;
+  if (!/[A-Za-z]{2}/.test(s)) return false;               // needs actual letters
+  if (!/\s/.test(s) && !/[.!?]$/.test(s)) return false;   // one bare word is a token
+  if (/^[/.#]/.test(s)) return false;                     // paths, selectors
+  if (/^https?:/i.test(s)) return false;                  // urls
+  if (/^[a-z0-9-]+$/.test(s)) return false;               // css class / slug
+  if (/^[A-Z0-9_]+$/.test(s)) return false;               // CONSTANT_NAME
+  if (/=>|\$\{|function\s*\(/.test(s)) return false;      // code fragments
+  if (/^[\s\d.,:%$-]+$/.test(s)) return false;            // numbers and units
+  return true;
+}
+
+// Strip <script>/<style> bodies so their contents are not read as page text.
+// Replaced with spaces of equal length so every line number stays truthful.
+function stripEmbedded(html) {
+  return html
+    .replace(/<script\b[\s\S]*?<\/script>/gi, (m) => m.replace(/[^\n]/g, ' '))
+    .replace(/<style\b[\s\S]*?<\/style>/gi, (m) => m.replace(/[^\n]/g, ' '));
+}
+
+function fromHtml({ source, rel }) {
+  const out = [];
+  const cleaned = stripEmbedded(source);
+  // stripEmbedded preserves every newline, so one offset table serves both strings.
+  const starts = lineIndex(cleaned);
+  let m;
+
+  // 1. text nodes: everything between a '>' and the next '<'.
+  const textRe = />([^<>]+)</g;
+  while ((m = textRe.exec(cleaned)) !== null) {
+    if (!looksLikeCopy(m[1])) continue;
+    out.push({ text: m[1].replace(/\s+/g, ' ').trim(), file: rel, line: lineAt(starts, m.index), origin: 'html-text', confidence: 'certain' });
+  }
+
+  // 2. copy-bearing attributes.
+  for (const { attr, re } of COPY_ATTR_RES) {
+    re.lastIndex = 0;
+    while ((m = re.exec(cleaned)) !== null) {
+      if (!looksLikeCopy(m[1])) continue;
+      out.push({ text: m[1].replace(/\s+/g, ' ').trim(), file: rel, line: lineAt(starts, m.index), origin: `html-attr:${attr}`, confidence: 'certain' });
+    }
+  }
+
+  // 3. <title> is the page's own name — always copy.
+  const titleRe = /<title>([^<]{2,200})<\/title>/gi;
+  while ((m = titleRe.exec(source)) !== null) {
+    out.push({ text: m[1].replace(/\s+/g, ' ').trim(), file: rel, line: lineAt(starts, m.index), origin: 'html-title', confidence: 'certain' });
+  }
+  return out;
+}
+
+// JS copy is found by FOLLOWING RENDER PATHS, not by guessing at prose. The first
+// cut of this file filtered "literals that look like sentences" and produced 2144
+// rows of which most were code: `use strict` 34 times, CSS values, and fragments of
+// template literals sliced at their quotes. Precision beats recall for a queue an
+// artist actually reads, so this extractor only claims a string when it can name
+// HOW a person sees it:
+//
+//   • markup built in JS — any literal containing tags is parsed as HTML, so the
+//     TEXT inside it is captured (not the tags). Template interpolations become a
+//     `{…}` placeholder, which keeps a sentence readable while marking the hole.
+//   • toast() / alert() / confirm() arguments — shown verbatim to a person.
+//   • .textContent / .innerText / .title assignments — same.
+//
+// Everything else is skipped, and the report says so. A literal this tool cannot
+// tie to a render path is not evidence of copy.
+const PLACEHOLDER = '{…}';
+
+// Template literals + quoted strings. Template bodies may contain ${...}; the
+// no-nested-backtick limitation is real and recorded in BLIND_SPOTS.
+const JS_LITERALS = /`([^`]*)`|'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)"/g;
+const UI_CALL = /\b(?:toast|alert|confirm)\s*\(\s*(?:`([^`]*)`|'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)")/g;
+const TEXT_ASSIGN = /\.(?:textContent|innerText|title)\s*=\s*(?:`([^`]*)`|'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)")/g;
+
+function unescapeLiteral(raw) {
+  return String(raw).replace(/\\(['"`\\])/g, '$1');
+}
+
+// A literal that carries markup: extract what a person reads out of it.
+function copyFromMarkupLiteral(body) {
+  const withHoles = body.replace(/\$\{[^{}]*\}/g, PLACEHOLDER);
+  const out = [];
+  let m;
+  const textRe = />([^<>]+)</g;
+  while ((m = textRe.exec(withHoles)) !== null) {
+    const t = m[1].replace(/\s+/g, ' ').trim();
+    if (t === PLACEHOLDER || !looksLikeCopy(t.replace(/\{…\}/g, 'x'))) continue;
+    out.push(t);
+  }
+  for (const { re } of COPY_ATTR_RES) {
+    re.lastIndex = 0;
+    while ((m = re.exec(withHoles)) !== null) {
+      const t = m[1].replace(/\s+/g, ' ').trim();
+      if (!looksLikeCopy(t.replace(/\{…\}/g, 'x'))) continue;
+      out.push(t);
+    }
+  }
+  return out;
+}
+
+function fromJs({ source, rel }) {
+  const out = [];
+  const starts = lineIndex(source);
+  const seen = new Set(); // (text, line) — one row per string per site
+  const push = (text, index, origin) => {
+    const line = lineAt(starts, index);
+    const key = `${text}\u0000${line}\u0000${origin}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ text, file: rel, line, origin, confidence: 'certain' });
+  };
+
+  let m;
+  // 1. markup built in JS.
+  JS_LITERALS.lastIndex = 0;
+  while ((m = JS_LITERALS.exec(source)) !== null) {
+    const body = m[1] ?? unescapeLiteral(m[2] ?? m[3] ?? '');
+    if (!body || !/<[a-zA-Z/]/.test(body) || !/>/.test(body)) continue;
+    for (const t of copyFromMarkupLiteral(body)) push(t, m.index, 'js-markup');
+  }
+  // 2. strings shown directly to a person.
+  UI_CALL.lastIndex = 0;
+  while ((m = UI_CALL.exec(source)) !== null) {
+    const body = (m[1] ?? unescapeLiteral(m[2] ?? m[3] ?? '')).replace(/\$\{[^{}]*\}/g, PLACEHOLDER).replace(/\s+/g, ' ').trim();
+    if (body && looksLikeCopy(body.replace(/\{…\}/g, 'x'))) push(body, m.index, 'js-notice');
+  }
+  TEXT_ASSIGN.lastIndex = 0;
+  while ((m = TEXT_ASSIGN.exec(source)) !== null) {
+    const body = (m[1] ?? unescapeLiteral(m[2] ?? m[3] ?? '')).replace(/\$\{[^{}]*\}/g, PLACEHOLDER).replace(/\s+/g, ' ').trim();
+    if (body && looksLikeCopy(body.replace(/\{…\}/g, 'x'))) push(body, m.index, 'js-text-assign');
+  }
+  return out;
+}
+
+function filesFor(surface, { fsImpl = fs } = {}) {
+  const abs = path.join(REPO_ROOT, surface.at);
+  if (surface.kind === 'file') return fsImpl.existsSync(abs) ? [surface.at] : [];
+  if (!fsImpl.existsSync(abs)) return [];
+  return fsImpl.readdirSync(abs)
+    .filter((n) => surface.exts.includes(path.extname(n)))
+    .sort()
+    .map((n) => path.join(surface.at, n));
+}
+
+function buildRegistry() {
+  const entries = [];
+  const surfaces = {};
+  for (const surface of SURFACES) {
+    const rels = filesFor(surface);
+    let count = 0;
+    for (const rel of rels) {
+      const source = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8');
+      const found = path.extname(rel) === '.html'
+        ? fromHtml({ source, rel })
+        : fromJs({ source, rel });
+      for (const f of found) {
+        entries.push({ id: stableId(surface.id, f.text), surface: surface.id, ...f });
+        count += 1;
+      }
+    }
+    surfaces[surface.id] = { at: surface.at, files: rels.length, strings: count };
+  }
+
+  // Deterministic order, independent of walk order: surface, text, file, line.
+  // BYTE ORDER, NOT localeCompare: these artifacts are committed, and
+  // localeCompare's collation depends on the runtime's ICU data — a Node built with
+  // small-icu would reshuffle the file and every unrelated commit would carry the
+  // churn. `cmp` is boring on purpose.
+  entries.sort((a, b) => cmp(a.surface, b.surface)
+    || cmp(a.text, b.text)
+    || cmp(a.file, b.file)
+    || a.line - b.line);
+
+  // Duplicate copy is the cheapest of the three signals R02 wants, and needs no
+  // judgement: the same normalized text in one surface, shown in more than one place.
+  const byId = new Map();
+  for (const e of entries) {
+    if (!byId.has(e.id)) byId.set(e.id, []);
+    byId.get(e.id).push(e);
+  }
+  const duplicates = [...byId.entries()]
+    .filter(([, list]) => list.length > 1)
+    .map(([id, list]) => ({
+      id, surface: list[0].surface, text: list[0].text,
+      occurrences: list.length, at: list.map((e) => `${e.file}:${e.line}`),
+    }))
+    .sort((a, b) => b.occurrences - a.occurrences || cmp(a.text, b.text));
+
+  return {
+    schema: 1,
+    generator: 'scripts/gds/copy-inventory.js',
+    goal: 1000074,
+    counts: {
+      strings: entries.length,
+      unique_ids: byId.size,
+      certain: entries.filter((e) => e.confidence === 'certain').length,
+      heuristic: entries.filter((e) => e.confidence === 'heuristic').length,
+      duplicate_ids: duplicates.length,
+    },
+    surfaces,
+    blind_spots: BLIND_SPOTS,
+    duplicates,
+    entries,
+  };
+}
+
+function renderReport(reg) {
+  const L = [];
+  const esc = (s) => s.replace(/\|/g, '\\|');
+  L.push('# Copy inventory — every string the product shows a person');
+  L.push('');
+  L.push('> **Generated** by `node scripts/gds/copy-inventory.js` (R01 of goal 1000074, the artist\'s loop).');
+  L.push('> Deterministic on a given tree — regenerate and commit rather than hand-editing.');
+  L.push('> Machine-readable twin: [`copy-registry.json`](copy-registry.json).');
+  L.push('');
+  L.push(`**${reg.counts.strings} strings** across ${Object.keys(reg.surfaces).length} surfaces · `
+    + `${reg.counts.unique_ids} distinct pieces of copy · ${reg.counts.certain} certain, ${reg.counts.heuristic} heuristic · `
+    + `${reg.counts.duplicate_ids} shown in more than one place.`);
+  L.push('');
+  L.push('## Surfaces');
+  L.push('');
+  L.push('| surface | lives at | files | strings |');
+  L.push('|---|---|---|---|');
+  for (const [id, s] of Object.entries(reg.surfaces)) {
+    L.push(`| \`${id}\` | \`${s.at}\` | ${s.files} | ${s.strings} |`);
+  }
+  L.push('');
+  L.push('## Confidence, and why it is on every row');
+  L.push('');
+  L.push('`certain` copy comes from markup only a person reads: an HTML text node, a `<title>`, or a copy-bearing attribute. `heuristic` copy is a JavaScript string literal that passed a prose filter — this tool does not parse JS, so a filtered literal is evidence, not proof. Treat a heuristic row as a candidate an artist confirms, and do not quote the total as "the number of strings in the product".');
+  L.push('');
+  L.push('## What this cannot see');
+  L.push('');
+  for (const b of reg.blind_spots) L.push(`- ${b}`);
+  L.push('');
+  if (reg.duplicates.length) {
+    L.push('## The same words, shown twice');
+    L.push('');
+    L.push('Identical copy within one surface. Sometimes right (a repeated button), sometimes two screens that should share one string.');
+    L.push('');
+    L.push('| id | shown | text | where |');
+    L.push('|---|---|---|---|');
+    for (const d of reg.duplicates.slice(0, 40)) {
+      L.push(`| \`${d.id}\` | ${d.occurrences}x | ${esc(d.text).slice(0, 90)} | ${d.at.slice(0, 3).join(', ')} |`);
+    }
+    if (reg.duplicates.length > 40) L.push(`| … | | _${reg.duplicates.length - 40} more in the JSON registry_ | |`);
+    L.push('');
+  }
+  for (const [surfaceId] of Object.entries(reg.surfaces)) {
+    const rows = reg.entries.filter((e) => e.surface === surfaceId);
+    if (!rows.length) continue;
+    L.push(`## \`${surfaceId}\` — ${rows.length} strings`);
+    L.push('');
+    L.push('| id | conf | text | where |');
+    L.push('|---|---|---|---|');
+    for (const e of rows) {
+      L.push(`| \`${e.id}\` | ${e.confidence === 'certain' ? 'certain' : 'heur'} | ${esc(e.text).slice(0, 110)} | \`${e.file}:${e.line}\` |`);
+    }
+    L.push('');
+  }
+  L.push('---');
+  L.push('');
+  L.push('Ids are stable across moves: a string keeps its id when it changes file or line, and loses it when its TEXT changes — which is exactly when a flag against it should be re-examined.');
+  L.push('');
+  return L.join('\n');
+}
+
+function write({ check = false } = {}) {
+  const reg = buildRegistry();
+  const json = `${JSON.stringify(reg, null, 2)}\n`;
+  const md = renderReport(reg);
+  const jsonPath = path.join(REPO_ROOT, REGISTRY_REL);
+  const mdPath = path.join(REPO_ROOT, REPORT_REL);
+  if (check) {
+    const stale = [];
+    for (const [p, want] of [[jsonPath, json], [mdPath, md]]) {
+      const have = fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null;
+      if (have !== want) stale.push(path.relative(REPO_ROOT, p));
+    }
+    return { reg, stale };
+  }
+  fs.writeFileSync(jsonPath, json);
+  fs.writeFileSync(mdPath, md);
+  return { reg, written: [REGISTRY_REL, REPORT_REL] };
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  if (args.includes('--json')) {
+    process.stdout.write(`${JSON.stringify(buildRegistry(), null, 2)}\n`);
+  } else if (args.includes('--check')) {
+    const { stale } = write({ check: true });
+    if (stale.length) {
+      console.error(`copy-inventory: STALE — ${stale.join(', ')} do not match the tree. Run: node scripts/gds/copy-inventory.js`);
+      process.exit(1);
+    }
+    console.log('copy-inventory: artifacts match the tree.');
+  } else {
+    const { reg, written } = write();
+    console.log(`copy-inventory: ${reg.counts.strings} strings (${reg.counts.certain} certain, ${reg.counts.heuristic} heuristic), `
+      + `${reg.counts.duplicate_ids} duplicated -> wrote ${written.join(', ')}`);
+  }
+}
+
+module.exports = {
+  SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
+  cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
+  buildRegistry, renderReport, write,
+};

package/scripts/gds/smoke-batch-claim.sh

@@ -70,6 +70,7 @@ print(json.dumps({
 CREATED_TASKS=()
 CREATED_CLAIMS=()
 cleanup() {
+  local leaked=()
   echo
   echo "--- cleanup ---"
   for cid in "${CREATED_CLAIMS[@]:-}"; do
@@ -79,10 +80,25 @@ cleanup() {
   done
   for tid in "${CREATED_TASKS[@]:-}"; do
     [[ -z "${tid}" ]] && continue
-    # Mark task abandoned via PATCH /api/gds/tasks/:id if available, else leave.
-    # The smoke filter on version_progress already keeps these out of dashboards.
-    call POST "/api/gds/tasks/${tid}/promote" '{"status":"abandoned"}' >/dev/null 2>&1 || true
+    # task 1002856: this used to POST /tasks/:id/promote {"status":"abandoned"},
+    # which is the backlog->ready transition and ignores a status field — so it
+    # never abandoned anything, and `>/dev/null 2>&1 || true` swallowed the
+    # failure. Every run since has leaked its fixtures as status='ready'
+    # (the 2026-05-11 batch, then 1001920-1001925 from 2026-07-03). The real
+    # endpoint is POST /tasks/:id/abandon {"reason": ...}.
+    if ! call POST "/api/gds/tasks/${tid}/abandon" \
+         '{"reason":"smoke cleanup (scripts/gds/smoke-batch-claim.sh)"}' >/dev/null 2>&1; then
+      leaked+=("${tid}")
+    fi
   done
+  # Never silently leave debris: a failed cleanup is reported, not swallowed.
+  # The claimable feed filters `__smoke__%` by title, so a leak is a ledger
+  # accuracy problem (it inflates open-task counts and goal rollups), not a
+  # builder-facing one — but it still needs a human to clear it.
+  if [[ ${#leaked[@]} -gt 0 ]]; then
+    echo "WARN: could not abandon ${#leaked[@]} smoke task(s): ${leaked[*]}"
+    echo "WARN: clear them with: node scripts/gds/api.js POST /tasks/<id>/abandon --body '{\"reason\":\"smoke residue\"}'"
+  fi
   echo "cleanup done"
 }
 trap cleanup EXIT

package/scripts/gds/smoke-batch-release.sh

@@ -91,6 +91,7 @@ claim_task() {
 CREATED_TASKS=()
 CREATED_CLAIMS=()
 cleanup() {
+  local leaked=()
   echo
   echo "--- cleanup ---"
   for cid in "${CREATED_CLAIMS[@]:-}"; do
@@ -100,8 +101,18 @@ cleanup() {
   done
   for tid in "${CREATED_TASKS[@]:-}"; do
     [[ -z "${tid}" ]] && continue
-    call POST "/api/gds/tasks/${tid}/promote" '{"status":"abandoned"}' >/dev/null 2>&1 || true
+    # task 1002856: same bug as smoke-batch-claim.sh — /tasks/:id/promote is the
+    # backlog->ready transition and ignores a status field, so this never
+    # abandoned anything and the redirect swallowed the failure.
+    if ! call POST "/api/gds/tasks/${tid}/abandon" \
+         '{"reason":"smoke cleanup (scripts/gds/smoke-batch-release.sh)"}' >/dev/null 2>&1; then
+      leaked+=("${tid}")
+    fi
   done
+  if [[ ${#leaked[@]} -gt 0 ]]; then
+    echo "WARN: could not abandon ${#leaked[@]} smoke task(s): ${leaked[*]}"
+    echo "WARN: clear them with: node scripts/gds/api.js POST /tasks/<id>/abandon --body '{\"reason\":\"smoke residue\"}'"
+  fi
   echo "cleanup done"
 }
 trap cleanup EXIT

package/src/bongos/llm-pricing.js

@@ -49,15 +49,52 @@
 //   - opus   = Claude Opus 5 / 4.8 / 4.7  ($5 in / $25 out)  [re-verified]
 //   - sonnet = Claude Sonnet 4.6          ($3 in / $15 out)  [re-verified]
 //   - haiku  = Claude Haiku 4.5           ($1 in / $5 out)   [re-verified]
-// NOTE (deliberately NOT changed here — its own task, per the rule above):
-// Claude Sonnet 5 is now $2/$10, not the $3/$15 this `sonnet` row carries. The
-// grader's default worker model is claude-sonnet-5, so grade costs are currently
-// OVER-priced ~1.5×. That is a separate price-table decision; see task 1003001.
+// VERIFIED 2026-08-18 against the live models overview at platform.claude.com
+// (task 1003001 — the task the note this replaces pointed at):
+//   - sonnet = Claude Sonnet 5  ($2 in / $10 out)  [WAS $3/$15 = Sonnet 4.6's rate]
+//   - fable  = Claude Fable 5 / Mythos 5 ($10/$50) [re-verified, unchanged]
+//   - opus   = Claude Opus 5 / 4.8 / 4.7 ($5/$25)  [re-verified, unchanged]
+//   - haiku  = Claude Haiku 4.5 ($1/$5)            [re-verified, unchanged]
+// The live page states Sonnet 5 as $2/$10 flatly — NO introductory qualifier and
+// no scheduled increase. (An earlier launch note describing $2/$10 as
+// introductory through 2026-08-31 is superseded; a cached model table that still
+// carries the qualifier is stale, which is precisely why this file re-verifies
+// against the live page rather than a recalled figure.)
+//
+// WHY IT MATTERED, and why it was worth its own task: the grader's default worker
+// model is claude-sonnet-5 (modules/grading/grader-rubric.json), so the panel is
+// this platform's heaviest sonnet consumer, and ADR 0054 pays each shipped session
+// round(true_cost_usd × 1.20). An over-priced sonnet row therefore OVER-PAID real
+// credits — the mirror image of the fable bug recorded above, which under-paid.
+//
+// HISTORICAL ROWS ARE NOT RE-PRICED. cost_log rows written before today keep the
+// dollars we believed at the time: the ledger is a record of what was charged and
+// paid, and rewriting paid rows to a new rate would make the credit history
+// disagree with the credit_log it produced. Expect a visible step change in
+// cost-per-ship around 2026-08-18 for sonnet-heavy work; this note is its
+// explanation.
+//
+// THE FAMILY↔MODEL BINDING IS NOW DATA (FAMILY_CURRENT_MODEL below) and pinned by
+// tests/llm-pricing.mjs: a family whose current model is re-pinned cannot keep the
+// old model's rate silently, which is exactly the failure this task fixed.
+// The model each family's rate is quoted FROM. Data, not logic: nothing branches
+// on it, but it makes the claim "this row is <model>'s price" checkable — the test
+// asserts each family's rate against that model's published figures, so re-pinning
+// a family to a newer model without re-pricing it reds the build (task 1003001).
+// Legacy members of a family are knowingly mis-priced (the family-pricing trade-off
+// documented above): claude-sonnet-4-6 is really $3/$15 and prices here as Sonnet 5.
+const FAMILY_CURRENT_MODEL = Object.freeze({
+  fable:  'claude-fable-5',
+  opus:   'claude-opus-5',
+  sonnet: 'claude-sonnet-5',
+  haiku:  'claude-haiku-4-5',
+});
+
 const PRICES = {
   // family : { input, output, cache_write_5m, cache_write_1h, cache_read }  (USD / 1e6 tokens)
   fable:  { input: 10, output: 50, cache_write_5m: 12.5, cache_write_1h: 20, cache_read: 1   },
   opus:   { input: 5,  output: 25, cache_write_5m: 6.25, cache_write_1h: 10, cache_read: 0.5 },
-  sonnet: { input: 3,  output: 15, cache_write_5m: 3.75, cache_write_1h: 6,  cache_read: 0.3 },
+  sonnet: { input: 2,  output: 10, cache_write_5m: 2.5,  cache_write_1h: 4,  cache_read: 0.2 },
   haiku:  { input: 1,  output: 5,  cache_write_5m: 1.25, cache_write_1h: 2,  cache_read: 0.1 },
 };
 
@@ -246,4 +283,4 @@ function componentsFromModelUsage(modelUsage) {
   };
 }
 
-module.exports = { PRICES, familyFor, priceUsage, canonicalizeModelId, priceModelUsage, componentsFromModelUsage };
+module.exports = { PRICES, FAMILY_CURRENT_MODEL, familyFor, priceUsage, canonicalizeModelId, priceModelUsage, componentsFromModelUsage };

package/src/module-api.js

@@ -911,8 +911,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.240 with no explicit bump. run 32184475745. (task 1002620)
 //   1.19.242 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.241 with no explicit bump. run 32185198139. (task 1002620)
+//   1.19.243 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.242 with no explicit bump. run 32193666731. (task 1002620)
+//   1.19.244 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.243 with no explicit bump. run 32196511343. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.242'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.244'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/llm-pricing.mjs

@@ -5,12 +5,17 @@
 // Re-VERIFIED + extended 2026-08-16 (task 1002883): fable (Fable 5 / Mythos 5)
 // $10/$50 — the family familyFor() used to miss, so Fable sessions priced at the
 // opus fallback and cost-plus under-paid by half.
+// Re-VERIFIED 2026-08-18 (task 1003001): sonnet is CLAUDE SONNET 5 at $2/$10 —
+// the row had carried Sonnet 4.6's $3/$15, over-pricing the grader panel (whose
+// default worker IS claude-sonnet-5) and therefore over-paying cost-plus credits.
+// The family↔model binding is now data (FAMILY_CURRENT_MODEL) and is pinned below,
+// so a future re-pin cannot keep an old model's rate silently.
 // Run:  node tests/llm-pricing.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
-const { priceUsage, familyFor, PRICES, canonicalizeModelId, priceModelUsage } = require('../src/bongos/llm-pricing.js');
+const { priceUsage, familyFor, PRICES, FAMILY_CURRENT_MODEL, canonicalizeModelId, priceModelUsage } = require('../src/bongos/llm-pricing.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {
@@ -101,11 +106,68 @@ test('opus 4.8: 1M input + 1M output = $5 + $25 = $30', () => {
   assert.equal(r.family, 'opus');
 });
 
-test('sonnet input ($3) vs haiku output ($5) use their own rates', () => {
-  assert.ok(near(priceUsage('claude-sonnet-4-6', { input_tokens: M }).usd, 3));
+test('sonnet input ($2 — Sonnet 5) vs haiku output ($5) use their own rates', () => {
+  assert.ok(near(priceUsage('claude-sonnet-5', { input_tokens: M }).usd, 2));
   assert.ok(near(priceUsage('claude-haiku-4-5', { output_tokens: M }).usd, 5));
 });
 
+test('the grader panel prices at Sonnet 5, not Sonnet 4.6 — 1M in + 1M out = $12', () => {
+  // The regression this task fixed, stated as money: the panel's default worker is
+  // claude-sonnet-5 (modules/grading/grader-rubric.json), and the row used to say
+  // $3/$15 = $18 for the same tokens. ADR 0054 pays round(true_cost × 1.20), so the
+  // extra $6 per million became real over-paid credits.
+  const r = priceUsage('claude-sonnet-5', { input_tokens: M, output_tokens: M });
+  assert.ok(near(r.usd, 12), `got ${r.usd}`);
+  assert.equal(r.family, 'sonnet');
+  assert.equal(r.unknown_model, false);
+});
+
+test('a LEGACY family member is knowingly mis-priced — sonnet 4.6 rides Sonnet 5 rates', () => {
+  // Family pricing assumes the CURRENT model in each family (the file says so).
+  // claude-sonnet-4-6 really costs $3/$15; here it prices at $2/$10. This test
+  // exists so that trade-off is a recorded decision rather than a surprise — if the
+  // platform ever runs a legacy model in earnest, this is the test that should fail
+  // first and force a per-model override.
+  assert.ok(near(priceUsage('claude-sonnet-4-6', { input_tokens: M }).usd, 2));
+});
+
+// ── the family↔model binding (task 1003001) ─────────────────────────────────
+// Each family's rate is quoted from ONE named model. These literals are the
+// published per-model figures, kept separate from PRICES on purpose: if someone
+// re-pins a family to a newer model, the two copies disagree and this test names
+// the model in its failure — the drift that shipped Sonnet 4.6's price under a
+// Sonnet 5 workload cannot recur silently.
+const PUBLISHED = {
+  'claude-fable-5':  { input: 10, output: 50 },
+  'claude-opus-5':   { input: 5,  output: 25 },
+  'claude-sonnet-5': { input: 2,  output: 10 },
+  'claude-haiku-4-5': { input: 1, output: 5  },
+};
+
+test('every family rate matches the published price of the model it names', () => {
+  for (const [family, modelId] of Object.entries(FAMILY_CURRENT_MODEL)) {
+    const published = PUBLISHED[modelId];
+    assert.ok(published, `FAMILY_CURRENT_MODEL.${family} names ${modelId}, which this test has no published price for — add it (verified against the live models page), do not guess`);
+    assert.equal(PRICES[family].input, published.input, `${family} input should be ${modelId}'s $${published.input}`);
+    assert.equal(PRICES[family].output, published.output, `${family} output should be ${modelId}'s $${published.output}`);
+  }
+});
+
+test('every family names a model familyFor() actually resolves back to it', () => {
+  for (const [family, modelId] of Object.entries(FAMILY_CURRENT_MODEL)) {
+    assert.equal(familyFor(modelId), family,
+      `FAMILY_CURRENT_MODEL.${family} names ${modelId}, but familyFor('${modelId}') says ${familyFor(modelId)} — the binding and the matcher disagree`);
+  }
+});
+
+test('cache rates ride the published multipliers off each family base (1.25× / 2× / 0.1×)', () => {
+  for (const [family, p] of Object.entries(PRICES)) {
+    assert.ok(near(p.cache_write_5m, p.input * 1.25), `${family} 5m write should be 1.25× input`);
+    assert.ok(near(p.cache_write_1h, p.input * 2),    `${family} 1h write should be 2× input`);
+    assert.ok(near(p.cache_read,     p.input * 0.1),  `${family} cache read should be 0.1× input`);
+  }
+});
+
 test('cache read is 0.1× input (opus $0.50 / 1M)', () => {
   const r = priceUsage('claude-opus-4-8', { cache_read_input_tokens: M });
   assert.ok(near(r.usd, 0.5), `got ${r.usd}`);