@bongos/core 1.19.553 → 1.19.555

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.553",
-  "core_contract": "1.19.553",
-  "source_commit": "0037c66da0cfa4bf64edadc01329b5b053aa50ad",
+  "core_version": "1.19.555",
+  "core_contract": "1.19.555",
+  "source_commit": "24fee783e3642be3f89811525120bcc2714f4fe7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T16:03:40.475Z",
+  "built_at": "2026-09-06T16:20:21.615Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 442,
+    "docs_redacted": 443,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 2019,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2485,
-  "tree_sha256": "5394d408102a1217b87c8481579b5f9ee59eec97a9adac6f841254af6495e52a",
+  "file_count": 2486,
+  "tree_sha256": "d57c07e4504ac8b16360e27f874cfc39373a7dfc066c854f1da2e7cb84443a6f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1764,20 +1764,25 @@
       "mode": "0000644",
       "sha256": "38fa5f4ce3a91eaf3302527a4228ddb1951ea128e83b2ab8e0ad5def658e0a6d"
     },
+    {
+      "path": "docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md",
+      "mode": "0000644",
+      "sha256": "da4549c19609d1f549e6f5a57b530c330765f1778f0a9b09a15a208f4575f986"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "464fa796eeaa7d3a2d6f6d7a2c36d01fc9dfbb613f0824f00b9710bf568c0cce"
+      "sha256": "f779c7dc040fd7096fa27e713c7045c44d69b1b7fa5fee107e6ae4d69ae11d6e"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "5ec1ca7cb551994a31d644eeebd77795955bac39e6389feaf6e6a5ec0217c911"
+      "sha256": "41a9d190c9df11d3adba109668508d147d8a148ae4222c2dc6aacf2ea811c7f3"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "40d863b7b46cc3691298f9e48c254cda3b7f4ab23bb008712a55e75764a69dd1"
+      "sha256": "60adc1a2c18e8237b1c7a6d261998aa77d08b0c699231d31551276d8621e5085"
     },
     {
       "path": "docs/architecture.md",
@@ -1832,12 +1837,12 @@
     {
       "path": "docs/design/hall-direction-v2.md",
       "mode": "0000644",
-      "sha256": "cfbe209c31ab5ee7fa50886c9ef6cec880c6f987b88ba92549c176080983c107"
+      "sha256": "80bfef3747395e2e389535a7ad8114c6959c33982a8231a8ece72cfaf43902b2"
     },
     {
       "path": "docs/design/landing-page-direction-v2.md",
       "mode": "0000644",
-      "sha256": "8602ef938cf855e675e454f4689b433f0f1dde4855337396d9f9a80b332dfda1"
+      "sha256": "332d3820e168f2bea93f6a60dd159fdc9cf57d20e2aa25bcdeb7dff7272f1f60"
     },
     {
       "path": "docs/design/landing-page-direction.md",
@@ -2642,7 +2647,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "e7c193b1cca2fc3f59742e95f921fc65096a32fbbcfba16e4a3950448293a7ba"
+      "sha256": "8b756e1acdec79324f026463292134b1e80613f207015d65fe5f1d158476c306"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2652,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ccbe2f9174064241f3e14dc6d1e816d6ebaae4f982497ff4efe3493e6800846c"
+      "sha256": "4fbdf9b8a0c6ed21e403472dcec14bfc4cad53d58e43dd717e6bea8531a8cb47"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2697,7 +2702,7 @@
     {
       "path": "docs/onboarding/diagrams/assertions.json",
       "mode": "0000644",
-      "sha256": "2716fcbc113ef046610023ff9bfefa57fe6564ead685cc3cf507f3d893ff0cd5"
+      "sha256": "56de4892dbe0bd388bdf904d25dd6c8ebc6b2f5553e640c761245dbc1e463a92"
     },
     {
       "path": "docs/onboarding/diagrams/puppeteer-config.json",
@@ -2847,7 +2852,7 @@
     {
       "path": "docs/recipes/redteam-patrol.md",
       "mode": "0000644",
-      "sha256": "656f30f568a56111ce6c2db8f3d61b0f9df3b168f41388b953a4552144579c94"
+      "sha256": "f6d2bb1da53f03f54080b8e0aec9f63390d3343c32917b64225ac47ae4ba7b42"
     },
     {
       "path": "docs/recipes/search-index-ingestion.md",
@@ -2897,7 +2902,7 @@
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
       "mode": "0000644",
-      "sha256": "be4d67926e39c9f9c146f5f709d30595057058f5c4444c1e87ed92e37b3f3190"
+      "sha256": "c6eebb55d9a77c6bb2bf44e4e47932039c3d8a389126cc324fa74d0e78cdc75c"
     },
     {
       "path": "docs/research/cursor-competitive-analysis.md",
@@ -7472,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cfbffbcea38df68b7a0bffb2c6f99c76be20b0efcbb1d86489e029272e7d410b"
+      "sha256": "04c6a38f5cf60c8912b9254235861cc431f7af898d7ae34924248f34c9f62ac2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "445928943329f12df7a6aa27a544b0f1a7c40bd4634c9c8460518777eb69981f"
+      "sha256": "057cb53bcef464cfe8d189bbc80b9d9860a32c19b20e33a6ae58ce64b1aeb775"
     },
     {
       "path": "public-docs/index.html",
@@ -7967,7 +7972,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "d002fe7dd2564dea5965c0801a5d58a61e6d29b3bf6823299177c78612bf492b"
+      "sha256": "bc3b7c7298d9caa122cbe552bd24630693649b33e4effac3e81ed3bdaf804bc3"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -9087,7 +9092,7 @@
     {
       "path": "src/bongos/routes/live.js",
       "mode": "0000644",
-      "sha256": "a301483bdfe19f43cb7755dbac6b330c5542e6ceac699eec110e6783386ba3c7"
+      "sha256": "86c0ad1c39d735acae2ee6449a5d99cfa94dd3cbc424cc4e7a089c235384eeaf"
     },
     {
       "path": "src/bongos/routes/llm-cache.js",
@@ -9117,7 +9122,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "0127967b6e345e93cb576702f472534d7985d7f2d8a0d7031a865c5c1d815576"
+      "sha256": "7265d554a8feeb192a874d8f5ff2fe08af70cd5e7dc999e60b581fa4f5525800"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -9172,7 +9177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "87189caf049da61dd52f02a1a8f884caac9bde741d3dd29543a7815e6994bca0"
+      "sha256": "aa7e5a37bf8cdacca8bd176ac732662b81d868df50e21930a23517c040882534"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md

@@ -0,0 +1,133 @@
+# 0250 — Strict versioning: the version boundary is the scope gate
+
+- **Status:** Accepted
+- **Date:** 2026-09-06
+- **Tasks:** [#1003589](https://cloudbongos.com/builders#/task/1003589) (this decision), seeded by the planning session [#1003586](https://cloudbongos.com/builders#/task/1003586). The implementation is BV1.R03–R30 under the same goal.
+- **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning: a goal cannot outlive its tasks, and a version's goal set is closed.
+- **Builds on:** [ADR 0086](<redacted>.md) (Project → Version → Goal → Criteria → Task — the hierarchy this decision finally closes at the top), [ADR 0015](<redacted>.md) (deps are load-bearing, the rank prefix is decorative), [ADR 0183](<redacted>.md) (a criterion satisfies itself when its tasks ship).
+- **Amends:** [ADR 0157](<redacted>.md) — for one key, `version.create`. See §6.
+
+## 1. The problem, measured
+
+The hierarchy has a bottom and no top. Tasks close, criteria close, goals close —
+and a version never does. Measured on the live instance:
+
+| | 2026-09-04 (planning session) | 2026-09-06 (this ADR) |
+|---|---|---|
+| Goals on BONGOS-V1 | 62 | 64 |
+| Closed goals still holding unfinished tasks | 10, holding 28 | **14, holding 35** (both versions) |
+| Open tasks across open goals | 502 | **523** |
+| Versions `building` on one project | 2 | 2 (`BONGOS-V1`, `CB-V1`) |
+
+The second column is not a re-count for its own sake. Two days of ordinary work
+made every number worse, which is the argument: nothing in the system pushes
+back, so the drift is not a backlog to clear once — it is the steady state.
+
+"Closed goals still holding unfinished tasks" is the sharp one. Fourteen goals
+report `achieved` or `archived` on every surface a person or an agent reads,
+while thirty-five tasks inside them are still `ready`, `backlog`, `active`,
+`completed` or `confirmed`. A goal that says it is done and is not is worse than
+no goal at all: `/status` rolls it up as delivered, the board stops showing its
+work, and the tasks become unreachable except by direct id.
+
+## 2. The cause is mechanical, not social
+
+No one decided any of this. Four gaps in the code produce all of it:
+
+1. **`POST /goals` never reads the version's status** ([`modules/lifecycle/routes/goals.js`](../../modules/lifecycle/routes/goals.js)). It fetches the version row to validate the id and ignores `status`, so a goal can be added to a version that has been building for months. That is how a version's scope grows without anyone widening it.
+2. **Goal achievement is computed from criteria alone** ([`db-goals.js`](../../modules/lifecycle/db-goals.js) `achieveGoalIfComplete`, and the cascade in [`done-when.js`](../../modules/lifecycle/done-when.js)). Neither writer consults `tasks`. Since [ADR 0183](<redacted>.md) criteria satisfy themselves on ship, the path from "the criteria I happened to link are satisfied" to `achieved` is fully automatic — and a task nobody linked to a criterion holds nothing open.
+3. **`POST /goals/:id/archive` checks nothing at all.** Archiving is a single call that discards whatever the goal was holding, silently.
+4. **No route ships a version.** Version status has only ever moved by hand-run SQL on the droplet; `scripts/gds/version-close.js` prints that the API cannot do it. A thing with no closing move does not close.
+
+Each gap is small. Together they mean the version boundary — the one line that is
+supposed to say *this much and no more* — has no enforcement anywhere.
+
+## 3. Decision
+
+**The version boundary is the scope gate.** A version's goal set is fixed when
+the version starts building; a goal stays open until its work is genuinely
+finished; and a version can reach done. Five rules:
+
+**D1 — The goal set closes when the version starts building.** New goals may be
+created freely on a version in `planning` — that is where the *next* version is
+scoped, in advance and at leisure. `POST /goals` reads `version.status` and
+refuses anything else with a named 409 an agent can act on.
+
+**D2 — A goal cannot close while it holds non-terminal work.** A goal reaches
+`achieved` only when its criteria are satisfied **and** no task in it is
+non-terminal. Terminal means `shipped` or explicitly `abandoned` — the vocabulary
+declared once in [`modules/lifecycle/task-status.js`](../../modules/lifecycle/task-status.js) ([task #1003588](https://cloudbongos.com/builders#/task/1003588)). `completed` and
+`confirmed` are mid-ship states that can still fail a grade or strand, so they
+hold the goal open. **Shipping is never blocked by this** — only the goal's flip
+to `achieved` is. Both writers gain the check, and the cascade's copy runs on the ship
+transaction's own client so it sees uncommitted flips.
+
+**D3 — Killing a goal is one recorded decision.** Archiving a goal that still
+holds open tasks returns those tasks and refuses until the caller says what
+happens to each: abandon with the archive's reason, or move to a named surviving
+goal. Archiving a goal with nothing open stays a single call.
+
+**D4 — Every task belongs to a real, open goal.** `goal_id` becomes required at
+creation, the per-version catch-all fallback is deleted, and no vector can put a
+task into a closed goal.
+
+**D5 — Exactly one version builds per project, and the next is scopeable while it
+runs.** The server refuses a second `building` version. A version auto-closes
+when its last non-maintenance goal achieves; an Archon may close one early, with
+a per-goal disposition (roll forward as a successor goal, or abandon). The single
+`planning` version promotes itself on close, so the project is never without a
+live train.
+
+### The override, and why it is not a loophole
+
+D1 without an escape hatch would be a rule people route around instead of using —
+the standard failure of a hard scope gate is a fake "hotfix version" cut to hold
+the thing that did not fit. So: an **Archon may admit one named goal to a building
+version, with a reason**, and the overrides are **counted and shown on the
+version**. A visible counter is what keeps the exception honest; an override that
+leaves no trace is just a slower version of no rule.
+
+The maintenance goal is the other pressure valve. Each version carries one
+auto-created maintenance goal, exempt from the auto-close count, whose open bugs
+carry forward — because bugs arrive on their own schedule and must not need an
+override to be filed.
+
+## 4. What this is not
+
+- **Not a new gate on shipping.** Nothing here can refuse a ship, block a claim, or park a task. Every rule acts on a *closing* move — goal achievement, goal archive, version close, goal/task creation. A builder's day is unchanged unless they try to close something that is not finished.
+- **Not a re-litigation of [ADR 0183](<redacted>.md).** Criteria still satisfy themselves. D2 adds a second condition to the *goal's* flip, not a human gate in front of the criterion's.
+- **Not a change to what `abandoned` means.** [Task 1002651](https://cloudbongos.com/builders#/task/1002651) already made abandoned terminal; D2 relies on that and adds nothing.
+
+## 5. Rejected alternatives
+
+- **Count `completed`/`confirmed` as finished.** It would close the visible symptom with one word and is wrong: those states can fail a grade, strand at `confirmed`, or be reconciled back. A goal closed on a task that never landed is the same lie in a shorter timeframe. (The goals **board** does bucket them as done — that is a progress ring, and `task-status.js` keeps the two questions apart on purpose.)
+- **A nightly reconciler that reopens wrongly-closed goals.** Repairs the ledger after the fact and leaves the four gaps open, so the report can never be trusted between sweeps. Prevention is available here; detection is what you build when it is not.
+- **A human review gate before a goal may close.** This is the queue [ADR 0183](<redacted>.md) deliberately dismantled. The check D2 needs is a fact the database already holds — asking a person to assert it is slower and less reliable than asking the table.
+- **Allow concurrent building versions and scope them by module.** Tempting, because it is the state the instance is in. But two live trains on one project means every "what is in this version" question has two answers, and the goal set can never close on either. The `planning` version is the supported way to work ahead.
+- **Retire versions entirely and let goals stand alone.** Genuinely considered: goals already carry criteria, membership and scope, so the version is arguably ceremony. Rejected because the version is the unit the owner sets scope in and the unit `limitations/<version>-shipped.md` archives — removing it would move the scope conversation somewhere with no home.
+
+## 6. The one amendment to ADR 0157
+
+[ADR 0157](<redacted>.md) lowered `version.create` to
+`metic`, on the argument that **authoring delegates, disposition does not**:
+creating a version confers no authority, so its siblings are `goal.create` and
+`task.create`, and only `version.close` stays Archon. That argument was correct
+about what a version *was*.
+
+This decision changes what a version *is*. Once the version boundary carries the
+scope gate, cutting a new version is no longer authoring — it is **the way around
+D1**. A builder refused a goal on a building version needs only create a fresh
+version to put it somewhere, and the gate evaporates without anyone overriding
+anything. So `version.create` returns to the Archon floor, and the pairing
+canonical-permissions has always described — close and rank as the powers that
+never delegate — extends to create for the same reason it covered close: it is
+now a disposition over scope, not a piece of authoring.
+
+The rest of ADR 0157 stands; this touches exactly one key.
+
+## 7. Consequences
+
+- The live instance is **not** in the state these rules describe, and the rules cannot be enforced on data that violates them. Bringing it over is explicit work under criterion `sv-cutover-proven-live`: fold `CB-V1` into `BONGOS-V1`, disposition the closed goals holding open tasks, rehome the catch-all tasks, and scope `BONGOS-V2` in `planning`. Each invariant lands with a query proving it.
+- `POST /goals`, `POST /tasks`, `PATCH /tasks/:id` and `POST /goals/:id/archive` gain refusals that did not exist. Every one is a **named** code, because the callers are agents and an unnamed 409 is an agent stopping to ask a human.
+- Anything that created a task without a goal — capture, idea routing, the CLIs — has to name one. That is the point of D4, and it is the widest blast radius here.
+- `/status` and the goal board start telling the truth about what is finished. Some goals that read `achieved` today will read `open` again after the cutover; that is the repair, not a regression.

package/docs/adr/README.md

@@ -337,6 +337,7 @@ This keeps the decision history honest and traceable.
 | 0248 | [**A hub project’s owner is the provisioning row, carried on a port and bound to both halves of the catalog projection** ([task 1003580](https://cloudbongos.com/builders#/task/1003580) · goal 1000046, criterion `proj-invite-builders`). [ADR 0246](<redacted>.md) made a wizard-made project resolvable by `POST /projects/invite` and named the remainder: the route is gated `project.curate` (floor metic) with no own-scope arm, so the project’s own owner — a `xenos` on the hub — got 403 on their own project, blocking BV1.R27–R29 and the C6 proof. The arm admits a `project.curate` holder **OR** the owner, where owner means `provisioning_instances.owner_builder_id` — never the hub’s `owner_github_id` columns, which [ADR 0238](<redacted>.md) fixes as attribution. Three things worth carrying: the fact travels on a NEW port `provisioning.projectOwnedBy` answering a **boolean**, so the comparison stays on the plane that holds the row and no consumer handles an ownership id it could mis-compare; the port is asked about **both halves of the ADR 0246 projection** (slug AND origin), because a hand-seeded catalog row’s name is otherwise a squattable claim on that project’s membership directory; and ownership is asked BEFORE the target is resolved, so the refusal stays the untouched `requirePermission` 403 and cannot become an existence oracle over stealth projects ([ADR 0182](<redacted>.md) D2a). The atom stays spelled in the route’s own middleware list ([ADR 0210](<redacted>.md)’s rule), so the route still classifies `metic+archon`.](<redacted>.md) | onboarding / provisioning / project creation |
 
 | 0249 | [**The invite step is the done panel’s first act, not a rail step — and the same widget is the way back** ([task 1002346](https://cloudbongos.com/builders#/task/1002346) · goal 1000046, criterion `proj-invite-builders` / C6). BV1.R27 asks for a skippable invite step *in creation*, but an invite cannot be one of the wizard’s numbered panels: `POST /projects/invite` takes `{ client_id, github_login }` where `client_id` **is the slug**, and per [ADR 0246](<redacted>.md) the catalog row that slug resolves is projected **at create** — so before the Create step there is nothing to invite anyone to, and a pre-Create panel could only queue names and replay them, inventing a second unaudited invite path whose failures land after the owner has left. **Decision: the step is the FIRST act of the DONE panel**, keyed on the created record (not `instanceId`, which `startProgress` sets only *after* `renderDone`), so it also returns on a resumed watch; the rail is NOT renumbered (a captured learning on this file: a renumbering couples in four places, and a step that can only run after the terminal step is not a step in the rail). The SAME widget is mounted again on the project’s own page beside *Its extras* — the [ADR 0245](<redacted>.md) argument, one implementation and two mounts, so the refusal vocabulary cannot drift. The widget answers neither “is anyone signed in” nor “is this their project”: each call site hands over a slug or nothing (the created record; the own-scoped manage read that 404s for everyone else), because a page that re-derived ownership would be a second, weaker copy of a server rule. **The 403 is quoted carefully and that is the point** — [ADR 0248](<redacted>.md) paid two equalised reads per request to make the refusal identical for a real, stealth, absent or malformed target ([ADR 0182](<redacted>.md) D2a), and “you lack permission on **this project**” would assert in copy the existence the route refuses to confirm, so the page says only “this account can’t invite people here” and a test pins that wording. `account_not_found` and `unknown_project` are said in the route’s own words (the latter as a moment, not a dead end — the row is projected at create); anything else falls through to the server’s own message. The pending line is drawn from the 201 row’s `membership_kind` and the typed login — **never the `github_id`** it carries, which names someone who has accepted nothing yet. Creation is never blocked: the project is filed before the step is shown, so every refusal leaves it created and the step re-tryable, and Skip sends nothing. Rejected: a rail step before or after Create; the manage page alone (R27 asks for it *in creation*); reading the real membership directory back (no own-scoped route exists, and the session receipt is honest about being one).](<redacted>.md) | provisioning / project creation |
+| 0250 | [**Strict versioning — the version boundary is the scope gate** ([task 1003589](https://cloudbongos.com/builders#/task/1003589) · goal 1000086). The work hierarchy ([ADR 0086](<redacted>.md)) has a bottom and no top: tasks close, criteria close, goals close, and a version never does. Measured live — **14 goals reading `achieved`/`archived` while holding 35 unfinished tasks**, 523 open tasks across 37 open goals, and **two versions `building` on one project**; every number was worse than the planning session had recorded two days earlier, which is the argument: the drift is the steady state, not a backlog. The cause is four mechanical gaps, not a social one — `POST /goals` fetches the version row and never reads its `status`; goal achievement is computed from criteria alone and never consults `tasks` (both the `db-goals.js` writer and the `done-when.js` cascade); `POST /goals/:id/archive` checks nothing at all; and no route ships a version, so version status has only ever moved as hand-run SQL on the droplet. **Decision, five rules:** the goal set closes when a version starts `building` (new goals go on the `planning` version — where the next version is scoped in advance) with a named 409 an agent can act on; a goal reaches `achieved` only when its criteria are satisfied **and** no task in it is non-terminal, where terminal is `shipped`|`abandoned` per [task 1003588](https://cloudbongos.com/builders#/task/1003588)'s one vocabulary and the mid-ship `completed`/`confirmed` hold it open; archiving a goal that holds open tasks refuses until the caller dispositions each (abandon with the reason, or move to a named surviving goal); `goal_id` becomes required and the per-version catch-all fallback is deleted; and exactly one version builds per project, auto-closing when its last non-maintenance goal achieves, with the single `planning` version promoting itself so the project is never without a live train. **The escape hatches are deliberate and visible**: an Archon may admit one *named* goal to a building version with a reason, and the overrides are counted on the version (the standard failure of a hard scope gate is a fake hotfix version cut to hold what did not fit — an untraced override is just a slower version of no rule); plus one auto-created maintenance goal per version, exempt from the auto-close count, so bugs never need an override to be filed. **Nothing here can refuse a ship, a claim, or a task** — every rule acts on a *closing* move. Rejected: counting `completed`/`confirmed` as finished (they can fail a grade or strand — the goals **board** buckets them as done, but that is a progress ring, and `task-status.js` keeps the two questions apart); a nightly reconciler that reopens wrongly-closed goals (detection is what you build when prevention is unavailable, and it is available here); a human review gate before a goal may close (the queue [ADR 0183](<redacted>.md) dismantled — the check is a fact the table already holds); concurrent building versions scoped by module (two live trains means every "what is in this version" question has two answers); retiring versions entirely (the version is the unit the owner sets scope in and `limitations/<version>-shipped.md` archives). **Amends [ADR 0157](<redacted>.md) for exactly one key:** `version.create` returns to the Archon floor. 0157's "authoring delegates, disposition does not" was right about what a version *was* — but once the boundary carries the scope gate, cutting a new version is no longer authoring, it is the way *around* the gate, so create joins close as a disposition over scope.](<redacted>.md) | lifecycle / versioning / scope |
 
 | 0246 | [**Catalog membership is a projection of the provisioning row, not a side effect of federation** ([task 1003576](https://cloudbongos.com/builders#/task/1003576) · goal 1000046, criterion `proj-detail-interview` / C3). The BV1.R18 proof ([task 1002337](https://cloudbongos.com/builders#/task/1002337)) demonstrated C3 against live and found its last clause — “then it publishes” — structurally false: the owner’s verdict reads `provisioning_instances` while the public map reads `platform_identity_projects`, and the ONLY bridge was `federateInstance → registerClient → upsertProject`, which `shouldFederate` refuses for anything but `co-tenant` (the wizard hard-codes `standalone`) and which runs ONCE, at provision time, through a COALESCE. So a wizard-made project was never catalogued at all and a co-tenant one that answered later never updated — `publishable: true`, `{"projects": []}`, forever. The same missing row is [task 1003580](https://cloudbongos.com/builders#/task/1003580)’s GAP 1: `POST /projects/invite` resolves against `platform_identity_sso_clients`, whose only writer is that same `registerClient`. Underneath is one conflation — federation mints CREDENTIALS and was incidentally the only thing that minted MEMBERSHIP, while [ADR 0182](<redacted>.md) D4 already fixed the map’s gate at IDENTITY, which has nothing to do with hosting topology. **Decision: the catalog row is a PROJECTION of the provisioning row, re-derived at every write that can change its inputs** — two halves, neither sufficient alone. (1) THE ROW SHAPE: every control-plane project gets both rows whatever its hosting shape, and the client row carries NO credential (`secret_hash = ''`, `redirect_uris = '{}'`), so **the shape is the enforcement** rather than a flag a caller could forget — `redirectUriAllowed` refuses `/sso/authorize`, `clientSecretValid` refuses `/sso/token`, `/sso/membership/check-in` and `/sso/activity/rollup`, and the one leg that checked NEITHER (`/sso/device/start`, which resolves a client from a user-typed origin) grew an explicit `clientIsCredentialed` guard. (2) THE TIMING: re-taken on create, on `PATCH …/detail`, on `PATCH …/settings` when the door changes, and on `POST …/domain` (which re-keys the row, retiring the abandoned origin — [ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2’s leak, in the catalog instead of DNS). **NO MIGRATION** — `secret_hash` is `NOT NULL` and `''` satisfies it while hashing to nothing. `description` and `visibility` are ASSIGNED, not COALESCEd (clearing a description must UN-publish); `featured`/`tagline`/`art_url`/`template` are curation and stay untouched, so [ADR 0182](<redacted>.md) D3 holds. It grants nothing — the row is attribution per [ADR 0238](<redacted>.md), ownership stays `provisioning_instances.owner_builder_id` — and because it writes rows keyed on owner-supplied values (a slug, a BYO domain) each write carries its **claim rule in the ON CONFLICT action’s own WHERE**: the client is refreshed only `WHERE secret_hash = ''` (a real client’s origin, which binds the CLI mint audience, can never be rewritten) and the project only `WHERE owner_github_id = EXCLUDED.owner_github_id` (`NULL = anything` is not true, so the hand-seeded rows cannot be claimed). Writing `visibility` does not contradict [ADR 0182](<redacted>.md) D5: the hub authorizes nothing — the authority already ran on the provisioning plane ([ADR 0238](<redacted>.md)’s own-scoped, audited PATCH), and a project the control plane does NOT own has no provisioning row, so D5’s instance report (R08) stays the only channel for those. `tearing_down`/`torn_down` project `hidden`; a `no_address` instance is not catalogued at all. Travels on the kernel port `project.catalog`, the `project.publishGate` seam in the other direction ([ADR 0083](<redacted>.md) forbids the import). Rejected: extending `shouldFederate` to every shape (hands a real secret to instances whose web.env the platform does not write, and keeps the once-at-standup bug); bridging only at the publish moment (leaves the invite with nothing to resolve); registering only at standup (the bug itself); a `catalog_only` boolean column (needs a migration and is weaker than the shape); letting the bridge write `featured`; and backfilling the three existing catalog rows from code.](<redacted>.md) | provisioning / project creation |
 

package/docs/api/openapi.json

@@ -8222,7 +8222,7 @@
           "live"
         ],
         "summary": "GET /live",
-        "description": "GET /api/gds/live — SSE stream of GDS state-change nudges for the hall. rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense in depth; the payload leaks nothing). Mirrors the room's task 983 signed-in gate. EventSource carries the gds_session cookie on this same-origin GET, so a signed-in viewer authenticates transparently. NOT module-gated: the hall's live refresh is core to every instance (the done-when is \"live on a game-less boot\"), so it mounts unconditionally in the GDS router.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall. rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense in depth; the payload leaks nothing). Mirrors the room's task 983 signed-in gate. EventSource carries the gds_session cookie on this same-origin GET, so a signed-in viewer authenticates transparently. NOT module-gated: the hall's live refresh is core to every instance (the done-when is \"live on a game-less boot\"), so it mounts unconditionally in the GDS router.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/live.js",
         "responses": {
@@ -12272,7 +12272,7 @@
           "public"
         ],
         "summary": "GET /public/cost-summary",
-        "description": "GDS task 118: `daily` + `daily_credits` are guaranteed gap-free (one row per day from the earliest event through CURRENT_DATE, server timezone) so the treasury chart's cumulative line carries forward on idle days and always reaches today. The gap-fill is implemented inside db.costSummary() via generate_series + LEFT JOIN. System 1 / task 1345: the same payload now also carries additive by_source / by_tier / savings blocks (existing keys keep their shape) — a pure passthrough; the shaping + the savings-table guard live in costSummary(). rank: public — treasury chart feed.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "Bongos task 118: `daily` + `daily_credits` are guaranteed gap-free (one row per day from the earliest event through CURRENT_DATE, server timezone) so the treasury chart's cumulative line carries forward on idle days and always reaches today. The gap-fill is implemented inside db.costSummary() via generate_series + LEFT JOIN. System 1 / task 1345: the same payload now also carries additive by_source / by_tier / savings blocks (existing keys keep their shape) — a pure passthrough; the shaping + the savings-table guard live in costSummary(). rank: public — treasury chart feed.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
@@ -12461,7 +12461,7 @@
           "public"
         ],
         "summary": "GET /public/recent-shipped",
-        "description": "GDS task 191: `?days=7|30|90` restricts to that trailing window; `?days=all` or omitted with no query returns the historical 30-row \"recent\" feed. Any other value falls back to all-time (still capped by the row limit) so a malformed query never produces an empty list. rank: public — recent shipped tasks (windowed).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "Bongos task 191: `?days=7|30|90` restricts to that trailing window; `?days=all` or omitted with no query returns the historical 30-row \"recent\" feed. Any other value falls back to all-time (still capped by the row limit) so a malformed query never produces an empty list. rank: public — recent shipped tasks (windowed).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {

package/docs/api-reference.md

@@ -340,7 +340,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/live` | `any-builder` | — | GET /api/gds/live — SSE stream of GDS state-change nudges for the hall. |
+| GET | `/api/bongos/live` | `any-builder` | — | GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall. |
 
 ## `llm-cache` (2)
 
@@ -493,14 +493,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/public/blockers/:id` | `public` | — | Public blocker resolver (task 654) — same minimal-projection posture as the idea resolver. |
 | GET | `/api/bongos/public/bounty-table` | `public` | — | V3.R65 task 284: red-team bounty payout table by severity. |
 | GET | `/api/bongos/public/branding` | `public` | — | the client-safe branding projection (R56 task 1195, ADR 0062 §3). |
-| GET | `/api/bongos/public/cost-summary` | `public` | — | GDS task 118: `daily` + `daily_credits` are guaranteed gap-free (one row per day from the earliest event through CURRENT_DATE, server tim… |
+| GET | `/api/bongos/public/cost-summary` | `public` | — | Bongos task 118: `daily` + `daily_credits` are guaranteed gap-free (one row per day from the earliest event through CURRENT_DATE, server … |
 | GET | `/api/bongos/public/estimation-drift` | `public` | — | est-vs-actual aggregate. |
 | GET | `/api/bongos/public/grades` | `public` | — | PMS-V2 task 197: rolling 7d quality-grade tile + 30d trend for the dashboard. |
 | GET | `/api/bongos/public/ideas/:id` | `public` | — | Public idea resolver (task 654) — the open-web counterpart to the hall's authenticated /inbox/:id. |
 | GET | `/api/bongos/public/leaderboard` | `public` | — | PMS-V2 task 188: each row now carries an `achievements` string[] (top 5 unlocked IDs by sort_order) so the dashboard can render inline em… |
 | GET | `/api/bongos/public/modules` | `public` | — | the client-safe feature-module set (R54 task 1193, ADR 0062 §4). |
 | GET | `/api/bongos/public/progress` | `public` | — | version progress aggregate. |
-| GET | `/api/bongos/public/recent-shipped` | `public` | — | GDS task 191: `?days=7\|30\|90` restricts to that trailing window; `?days=all` or omitted with no query returns the historical 30-row "rece… |
+| GET | `/api/bongos/public/recent-shipped` | `public` | — | Bongos task 191: `?days=7\|30\|90` restricts to that trailing window; `?days=all` or omitted with no query returns the historical 30-row "r… |
 | GET | `/api/bongos/public/ref-ids` | `public` | — | The id allow-list the doc-ref linkifier (scripts/gds/linkify-refs.js) and its CI gate consult to decide which bare "#NNN" are real refere… |
 | GET | `/api/bongos/public/repo-health` | `public` | — | V3.R91 task 352: repo-health substrate. |
 | GET | `/api/bongos/public/repo-info` | `public` | — | GitHub URL bases for the deployed checkout (V3.R13-followup-2 task 411). |

package/docs/design/hall-direction-v2.md

@@ -116,7 +116,7 @@ Five things were reconciled **between** the archetypes, since the builders ran i
   satisfied the "at least one" rule. All five now point at `nav-items-<group>`. **This is a real addition the build
   inherits, not a mock artefact.**
 - **The goal-detail data was made true.** An earlier pass inferred the titles of tasks 1003303 to 1003309 and
-  showed one as shipped. Nothing in goal 1000081 has shipped; all eight rows now carry their real GDS titles and
+  showed one as shipped. Nothing in goal 1000081 has shipped; all eight rows now carry their real Bongos titles and
   statuses, and the Completed pane renders its honest empty state, which also gives the round an empty case inside
   an otherwise populated page.
 - **An invented task id collided with a real one** on goal 1000064's card. All seven of that goal's tasks are

package/docs/design/landing-page-direction-v2.md

@@ -6,7 +6,7 @@ This document records the landing composition round: what it had to do, how it w
 
 ## 1. What this round had to do
 
-Three MATERIALLY different full-page compositions of `cloudbongos.com/` inside the approved world, as real HTML mocks under `docs/design/mocks/landing/v{1,2,3}.html` with a contact sheet `landing-sheet.html`, both modes, desktop and a 390 frame. Every version carries: two equal doors that read as one claim; the bongo pair as the mark; the platform's proof (real GDS surfaces, real project orbs, nothing invented); the hall link in the footer; the apex-only regions marked so the shared `index.html` still serves a child instance's plain landing. The taste pre-flight applies (hero at most four text elements, headline at most two lines, lede at most twenty words, nav on one line at most 80px, one eyebrow per three sections at most, no three-equal-card row, no div-built fake screenshots, no em dash or emoji in visible copy, real imagery or a labeled placeholder, motion motivated and reduced-motion safe).
+Three MATERIALLY different full-page compositions of `cloudbongos.com/` inside the approved world, as real HTML mocks under `docs/design/mocks/landing/v{1,2,3}.html` with a contact sheet `landing-sheet.html`, both modes, desktop and a 390 frame. Every version carries: two equal doors that read as one claim; the bongo pair as the mark; the platform's proof (real Bongos surfaces, real project orbs, nothing invented); the hall link in the footer; the apex-only regions marked so the shared `index.html` still serves a child instance's plain landing. The taste pre-flight applies (hero at most four text elements, headline at most two lines, lede at most twenty words, nav on one line at most 80px, one eyebrow per three sections at most, no three-equal-card row, no div-built fake screenshots, no em dash or emoji in visible copy, real imagery or a labeled placeholder, motion motivated and reduced-motion safe).
 
 The owner's steer from the world round, applied here: (1) the **animated chrome background** is the named signature interaction, code-led, one authored moment, dead under reduced motion, with at least one version whose forms are bongo-shaped; (2) the **light-mode decision** is put to the owner explicitly with the three compositions (rebuild light to the dark standard, or ship the landing dark-only while the hall and the hub keep both modes).
 

package/docs/file-map.md

@@ -132,7 +132,7 @@
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, pair, not-ready, task 1003308: the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `pair.css` the device row, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
-│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
+│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
@@ -373,7 +373,7 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/skills/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/skills/
-├── blocker-review/SKILL.md        ← /blocker-review — daily review of open GDS blockers (resolve / escalate / note); Metic+
+├── blocker-review/SKILL.md        ← /blocker-review — daily review of open Bongos blockers (resolve / escalate / note); Metic+
 ├── blocker-solve/SKILL.md         ← /blocker-solve N — drive ONE blocker to done: do the doable parts, hand back owner-only steps, verify, auto-resolve (auto-promotes waiters); Metic+
 ├── bug-triage/SKILL.md            ← /bug-triage — daily walk through open kind=bug tasks (batch-cluster near-dups, merge / won't-fix); the idea-triage counterpart built on the new tasks.merge primitive (task 1001478); Metic+
 ├── builder-backup/SKILL.md        ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
@@ -384,28 +384,28 @@ tests/
 ├── builder-end/SKILL.md           ← /builder-end — safely close out a session: resolve the claim (ship/release) + clean-git verify + worktree teardown + (on a dev box) offer to close the box; the bookend to /builder-start, and the own-scoped session close-out that /builder-exit redirects non-Archons to
 ├── builder-exit/SKILL.md          ← /builder-exit — gracefully offboard (or reactivate) a builder: release claims, seal session logs, drop rank to xenos
 ├── builder-key/SKILL.md           ← /builder-key — list API-key status, render the visual 'key needed' callout for anything missing, drive the UI-first Settings add-flow + re-sync/confirm; never accepts a key pasted in chat (task 1391)
-├── builder-reauth/SKILL.md        ← /builder-reauth — refresh an expired GDS CLI session the UI-first way (no terminal Device Flow)
+├── builder-reauth/SKILL.md        ← /builder-reauth — refresh an expired Bongos CLI session the UI-first way (no terminal Device Flow)
 ├── builder-redteam/SKILL.md       ← /builder-redteam — file a red-team / vulnerability report (severity, target, repro) to /api/gds/security
 ├── builder-release/SKILL.md       ← /builder-release — abandon a claim (task returns to ready, no credits)
 ├── builder-sequence/SKILL.md      ← /builder-sequence N — walk a whole dependency chain from one kickoff (claim → build → ship → next), one claim at a time; halts and reports on migration/security/protected-path/thin-spec/judgement tasks (scripts/gds/sequence.js, task 1002484)
-├── builder-setup/SKILL.md         ← /builder-setup — one-time GitHub Device Flow auth (GDS); multi-builder-on-one-device gate
+├── builder-setup/SKILL.md         ← /builder-setup — one-time GitHub Device Flow auth (Bongos); multi-builder-on-one-device gate
 ├── builder-ship/SKILL.md          ← /builder-ship — record + award credits (runs touches[] scanner; warns on drift; sandbox-first review gate on dev boxes, ADR 0046)
 ├── builder-stage/SKILL.md         ← /builder-stage — stage work on the builder's sandbox (sandbox-<login>) for browser review before shipping (#927, ADR 0046)
 ├── builder-start/SKILL.md         ← /builder-start — list claimable tasks (parallel-safe vs active claims)
 ├── builder-sync/SKILL.md          ← /builder-sync — 'sync now': re-run the box source-fetch on demand so a freshly-claimed task's code lands within seconds, re-scoped to the active claim (BV1.R96, ADR 0148)
 ├── close-box/SKILL.md             ← /close-box — tear down the dev box you're working on, from inside the box terminal (POST /box/close)
 ├── design/SKILL.md                ← /design — the UI design session: the operating playbook for ui-discipline work on ANY instance (load the instance's pack + DESIGN.md first, look before you ship, build inside the platform floors, ship the tests with the UI); routed from a `ui` claim via discipline-modes.json; shipped by the ui-design module (task 1003324, ADR 0197)
-├── design-sync/SKILL.md           ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a GDS task (ADR 0081)
+├── design-sync/SKILL.md           ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a Bongos task (ADR 0081)
 ├── dev/SKILL.md                   ← /dev — engineering-session playbook for engineer-discipline tasks; the default understand→scoped-change→verify→ship loop made explicit ([#1272](https://example.com/builders#/task/1272))
 ├── feedback/SKILL.md              ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)
 ├── figma-design-sync/SKILL.md     ← sync UI-surface tokens/surfaces with Figma (push a frame plan, land a designer's Code Connect / MCP snapshot edit back as code) — the ADR 0081 human escape hatch; distinct from otb-figma-sync's pixel-art tile review (task 2048)
-├── fix-task/SKILL.md              ← /fix-task N — claim, fix (test-first), verify, and ship a single GDS task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
+├── fix-task/SKILL.md              ← /fix-task N — claim, fix (test-first), verify, and ship a single Bongos task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
 ├── goal-create/SKILL.md           ← /goal-create — plan and create ONE goal (the module-scoped workspace between version and criteria, ADR 0086) in one session: <redacted>, scope wall, 2-4 criteria, seed tasks; also the auto-pickup when a task is created with no goal to live in (goal_advisory); Metic+ (Archon for a protected-module scope)
 ├── goal-review/SKILL.md           ← /goal-review — walk the criterion review queue: each auto-flagged 'met — pending review' criterion gets confirm / reject / defer; confirming a goal's last criterion auto-achieves it (ADR 0086 §6); Metic+
 ├── grade-audit/SKILL.md           ← /grade-audit — manual-cadence accountability sweep: override ledger (shipped-despite-fail, infra vs real, un-requested confirms named), dropped blocker/major findings on passes queued via capture.js with the advisory-Narc filter, runtime-blindness false-pass spot-check, outage roll-up → /grader-health; describes and queues only, never confirms (ADR 0162, task 1002657)
 ├── grade-recover/SKILL.md         ← /grade-recover N — the 'my grade failed, now what' loop: diagnose outage vs fabricated fail vs genuine fail from the persisted grade, then run the right recovery (--regrade or the auditable override-request); adds no ship-path gate (ADR 0162, task 1002655)
 ├── grader-health/SKILL.md         ← /grader-health — read-only grader health check: outage runs (n_unavailable streaks, outage-vs-rejection confirmation), pass-rate drift vs baseline, per-grade cost anomalies, stale model pins; emits exact --regrade remediation lines; optional --probe live calibration (Metic+, paid) (task 1002656)
-├── idea-triage/SKILL.md           ← /idea-triage — daily walk through the GDS idea_inbox (promote / discard / merge); Metic+
+├── idea-triage/SKILL.md           ← /idea-triage — daily walk through the Bongos idea_inbox (promote / discard / merge); Metic+
 ├── ideate/SKILL.md                ← /ideate — ideation-session playbook for ideator-discipline tasks; inverts the loop (human drives, Claude is the sounding board) ([#1267](https://example.com/builders#/task/1267))
 ├── merge-mode/SKILL.md            ← /merge-mode — manual fallback for the auto-merge: land every confirmed task (merge + smoke + deploy)
 ├── new-project/SKILL.md           ← /new-project — the canonical zero-to-live onboarding runbook for a new STANDALONE instance (name+address → init → scaffold → provision → OAuth+verified-secret+sign-in → verify → brand); the CLI + hall wizard are forms over it ([#1981](https://example.com/builders#/task/1981))
@@ -415,7 +415,7 @@ tests/
 ├── otb-figma-sync/SKILL.md        ← /otb-figma-sync — push tiles into the Example Figma file as a review canvas
 ├── otb-tile-generate/SKILL.md     ← /otb-tile-generate — run the pixel-art pipeline (generate world tiles/sprites)
 ├── paint/SKILL.md                 ← /paint — art-session playbook for artist-discipline tasks; show-first/low-text, drives the otb-* pixel-art pipeline underneath ([#1269](https://example.com/builders#/task/1269))
-├── planning-session/SKILL.md      ← /planning-session — run a structured planning session for an upcoming version (set criteria, brainstorm, rank, seed GDS); Metic+
+├── planning-session/SKILL.md      ← /planning-session — run a structured planning session for an upcoming version (set criteria, brainstorm, rank, seed Bongos); Metic+
 ├── priority-session/SKILL.md      ← /priority-session — a trusted builder answers plain-speech questions; the answers reweight the idea_inbox + suggest what to build next
 ├── read-session-export/SKILL.md   ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/gds/read-session-export.js
 ├── recall/SKILL.md                ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)

package/docs/module-api-changelog.md

@@ -1555,5 +1555,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.551 with no explicit bump. run 34043771286. (task 1002620)
   1.19.553 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.552 with no explicit bump. run 34044208907. (task 1002620)
+  1.19.554 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.553 with no explicit bump. run 34044540046. (task 1002620)
+  1.19.555 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.554 with no explicit bump. run 34045075186. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/onboarding/diagrams/assertions.json

@@ -74,7 +74,7 @@
   },
   "drachmae_karma": {
     "diagram": "03-drachmae-karma",
-    "_comment": "Pieces of 03-drachmae-karma that are gated on a backing GDS task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/gds/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
+    "_comment": "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/gds/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
     "live_tasks": [
       {
         "id": 284,
@@ -107,7 +107,7 @@
   },
   "architecture": {
     "diagram": "04-architecture",
-    "_comment": "Pieces of 04-architecture gated on a backing GDS task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
+    "_comment": "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
     "live_tasks": [
       {
         "id": 273,

package/docs/recipes/redteam-patrol.md

@@ -46,9 +46,9 @@ clean. ADR 0188 §2.1.
 
 ### Filing from CI (optional)
 
-A CI runner has no GDS session, so by default the scheduled run **reports but
+A CI runner has no Bongos session, so by default the scheduled run **reports but
 cannot file**: findings go to the Actions job summary and the job exits 2. To let
-it file, set the repo secret **`GDS_PATROL_SESSION`** to a GDS CLI session JSON
+it file, set the repo secret **`GDS_PATROL_SESSION`** to a Bongos CLI session JSON
 (`{"token":…,"api_base":…}`) for a builder holding `security.report.file`; the
 workflow writes it to the session path `instance-config` resolves and the patrol
 files normally. This is opt-in on purpose — the patrol must not *require* a
@@ -75,7 +75,7 @@ being broken.
   the dependency + pin checks still run. The scheduled lane installs it itself —
   version-pinned and checksum-verified, the same binary and digest the unit gate
   uses, rather than a mutable action tag (the tj-actions lesson).
-- A GDS session (the normal builder token) for `--file`; dry runs need nothing.
+- A Bongos session (the normal builder token) for `--file`; dry runs need nothing.
   `--file` preflights it, so a sessionless run prints its findings and says it
   could not file them — it never drops into the CLI's interactive re-auth wall,
   which in a cron log is indistinguishable from a crash.

package/docs/recipes/work-on-a-task-from-your-dev-box.md

@@ -42,7 +42,7 @@ fault ([ADR 0055](../adr/<redacted>.md)):
   cron; log at `/tmp/box-source-fetch.log`). `/builder-sync` runs the same fetch
   on demand.
 - **If a remote git op says `could not read Username`, or the sync log shows
-  401:** the box's GDS session expired. Run `/builder-reauth`, then
+  401:** the box's Bongos session expired. Run `/builder-reauth`, then
   `/builder-sync`. That is the whole fix.
 
 The box writes these same facts to `/workspace/CLAUDE.local.md` on every sync, so

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.553",
+  "version": "1.19.555",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.553",
+      "version": "1.19.555",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.553",
+  "version": "1.19.555",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-diagrams.js

@@ -23,10 +23,10 @@
 //
 // The 2 CONCEPTUAL diagrams (03-drachmae-karma, 04-architecture) used to be
 // hand-authored and only flagged on drift. As of #436 they are auto-generated
-// too: each feature-piece is LIVE iff its backing GDS task is 'shipped', so their
+// too: each feature-piece is LIVE iff its backing Bongos task is 'shipped', so their
 // LIVE/PLANNED labels + edge styles are driven by live data and never need a
 // hand-fix. CAVEAT — they reduce to the AUTHENTICATED /tasks/:id status, so when
-// no GDS session is available (headless run, no creds) facts.gatherFacts returns
+// no Bongos session is available (headless run, no creds) facts.gatherFacts returns
 // conceptual=null and this generator SKIPS 03/04 (leaving the files untouched)
 // rather than emit wrong data. The 3 mechanical diagrams have no such dependency
 // and always regenerate. The drift checker remains as a belt-and-braces backstop.
@@ -336,7 +336,7 @@ function drachmaeKarmaMmd(f) {
 // Merges the old 04-server-repo-memory (the three layers) + 06-dev-box (the box
 // → prod ship flow) into one map (task 1059), collapsing the SERVER they both
 // drew. Conceptual like 03: every feature-piece + flow edge is LIVE/solid iff its
-// backing GDS task is 'shipped', dotted/PLANNED otherwise — so the map is an
+// backing Bongos task is 'shipped', dotted/PLANNED otherwise — so the map is an
 // honest snapshot that flips itself as pieces ship (or regresses if one is
 // reopened). Pieces → live task ids:
 //   memory layer  : 273 schema · 274 sync-on-ship · 275 pull-on-start · 276 isolation
@@ -506,7 +506,7 @@ function rebuildAssertions(prev, f) {
     next.architecture = {
       diagram: '04-architecture',
       _comment:
-        "Pieces of 04-architecture gated on a backing GDS task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
+        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
       live_tasks: arch.live_tasks,
       pending_tasks: arch.pending_tasks,
     };
@@ -517,10 +517,11 @@ function rebuildAssertions(prev, f) {
 
     // 03-drachmae-karma — bounty + karma pieces (D_SHIP/D_ACH have no task gate).
     const dk = split([284, 286, 282, 245, 248, 246]);
-    next.drachmae_karma = next.drachmae_karma || {
+    next.drachmae_karma = {
+      ...next.drachmae_karma,
       diagram: '03-drachmae-karma',
       _comment:
-        "Pieces of 03-drachmae-karma that are gated on a backing GDS task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/gds/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
+        "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/gds/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
     };
     next.drachmae_karma.live_tasks = dk.live_tasks;
     next.drachmae_karma.pending_tasks = dk.pending_tasks;
@@ -555,7 +556,7 @@ const CONCEPTUAL_TARGETS = [
     TARGETS.push(...CONCEPTUAL_TARGETS);
   } else {
     console.log(
-      'gen-diagrams: conceptual facts unavailable (no GDS session / API unreachable) — SKIPPING 03-drachmae-karma + 04-architecture; the 3 mechanical diagrams still regenerate.'
+      'gen-diagrams: conceptual facts unavailable (no Bongos session / API unreachable) — SKIPPING 03-drachmae-karma + 04-architecture; the 3 mechanical diagrams still regenerate.'
     );
   }
 

package/src/bongos/routes/live.js

@@ -105,7 +105,7 @@ function streamLive(req, res, deps = {}) {
 function buildLiveRouter() {
   const router = express.Router();
 
-  // GET /api/gds/live — SSE stream of GDS state-change nudges for the hall.
+  // GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall.
   // rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense
   // in depth; the payload leaks nothing). Mirrors the room's #983 signed-in
   // gate. EventSource carries the gds_session cookie on this same-origin GET, so

package/src/bongos/routes/public.js

@@ -186,7 +186,7 @@ module.exports = function buildPublicRouter() {
     res.json({ progress });
   });
 
-  // GDS #118: `daily` + `daily_credits` are guaranteed gap-free (one row
+  // Bongos task 118: `daily` + `daily_credits` are guaranteed gap-free (one row
   // per day from the earliest event through CURRENT_DATE, server timezone)
   // so the treasury chart's cumulative line carries forward on idle days
   // and always reaches today. The gap-fill is implemented inside
@@ -213,7 +213,7 @@ module.exports = function buildPublicRouter() {
     res.json(summary);
   });
 
-  // GDS #191: `?days=7|30|90` restricts to that trailing window; `?days=all`
+  // Bongos task 191: `?days=7|30|90` restricts to that trailing window; `?days=all`
   // or omitted with no query returns the historical 30-row "recent" feed. Any
   // other value falls back to all-time (still capped by the row limit) so a
   // malformed query never produces an empty list.

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.553'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.555'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');